[Release] Publish v1.1.4 tool schema dialect fix

[mohanagy]

Goal

Publish @lubab/miftah@1.1.4 as a compatible patch release delivering the client-visible tool schema dialect fix.

The prior npm and GitHub Release baseline was 1.1.3. Since that release, development gained the named-host compatibility evidence for the remaining retirement gate #388, and one runtime fix: Miftah forwarded a wrapped upstream's non-2020-12 JSON Schema dialect declaration to the client, so strict clients rejected the entire outputSchema and the affected tools silently lost their structured-output contract. The fix drops the offending declaration only; no tool name, argument, annotation, routing, policy, or credential behavior changed, and no public API changed, so this is a patch release.

Release scope

• Upstream draft-07 schema dialect is forwarded, so strict clients reject outputSchema #439: publish the client-visible tool schema dialect normalization
• [Evidence] Capture v1.1.3 named-host transcripts for Codex CLI and Claude Code #423: publish the deidentified exact-package named-host STDIO evidence for the continuing retirement gate [Compatibility] Gate any retirement of legacy MCP eras and deprecated features #388

Acceptance criteria

• Set package.json and package-lock.json to 1.1.4 without creating a local tag.
• Finalize the 1.1.4 changelog dated 2026-09-11 and link this release issue.
• Align pinned release/version documentation and release-contract tests with 1.1.4 where required.
• Verify a zero-known-vulnerability npm audit.
• Run the documented release checks, including source, package, installed-artifact, lint, typecheck, build, and cross-platform CI gates.
• Merge the release-preparation PR into development only after current-head CI and CodeRabbit review gates pass.
• Open and merge the exact development to main promotion PR as a merge commit, only after its current-head gates pass.
• Confirm the v1.1.4 tag and GitHub Release point to the exact current main commit.
• Publish only through the protected GitHub Release workflow using npm trusted publishing; no NPM_TOKEN or workstation npm publish.
• Verify npm latest, registry provenance, GitHub Release/workflow success, a fresh install, package contents, and package signatures.

Completion evidence

• implementation PR: fix(tools): normalize client-visible tool schema dialect #440

[mohanagy]

Progress

• implementation PR: fix(tools): normalize client-visible tool schema dialect #440 — merged into development as 8214e09
• preparation PR: chore(release): prepare v1.1.4 #442 — open, CI running

Dependency remediation outcome

All four production advisories resolved: fast-uri 3.1.5→3.1.7, hono 4.12.34→4.13.7, qs 6.15.3→6.16.0. ajv carried no advisory of its own and cleared with fast-uri.

fast-uri deliberately stays on 3.x. All four of its advisories are fixed in 3.1.6, and ajv@8.20.0 (latest) declares fast-uri: ^3.0.1 — no ajv release accepts 4.x. A 4.1.4 override was attempted first and rejected: npm overrides bind only this repository, so a consumer installing the published package still resolves ajv's own ^3.0.1. That override cleared the local audit while protecting no installer, and ran ajv's URI resolver against an undeclared major. The packed-artifact contract correctly caught the divergence between our lock and real consumer resolution.

Acceptance criteria status

• package.json and package-lock.json set to 1.1.4 without a local tag
• 1.1.4 changelog dated 2026-09-11, linking this issue
• Pinned release/version documentation and release-contract tests aligned
• Documented release checks run: full suite 1999 passed / 0 failed (162/162 files), typecheck, lint, build, packed-artifact, and fixture-parity all clean
• Zero-known-vulnerability audit — production-only audit is zero; see caveat below
• Merge the release-preparation PR after current-head CI and CodeRabbit gates pass
• Open and merge the development→main promotion PR as a merge commit
• Confirm the v1.1.4 tag and GitHub Release point to the exact current main commit
• Publish only through the protected GitHub Release workflow
• Verify npm latest, provenance, workflow success, fresh install, contents, signatures

Audit caveat

npm audit --omit=dev reports zero. The full audit still reports two development-only moderates (vitest, @vitest/mocker), fixed only in vitest ≥ 4.1.11 — a major migration across 162 test files, tracked separately (chore/coordinated-vitest-4). This release therefore does not claim a zero full audit, unlike #420. Nothing shipped to users is affected.

Ancestry note

origin/main currently holds one commit not in development: ea1cbf8, the v1.1.3 promotion merge itself. It carries no unique content and does not affect this promotion, but a chore/sync-main-ancestry back-merge should follow the release to restore containment.

[mohanagy]

Released — v1.1.4 published

Completion evidence

• implementation PR: fix(tools): normalize client-visible tool schema dialect #440 (8214e09)
• preparation PR: chore(release): prepare v1.1.4 #442 (1c3e8f5)
• promotion PR: chore(release): promote v1.1.4 to main #443 — merge commit 3af8b22e02eebe447a3bee8f28a11758937662d4 (two parents, not squashed)
• release commit and tag target: 3af8b22e02eebe447a3bee8f28a11758937662d4
• GitHub Release: https://github.com/mohanagy/miftah/releases/tag/v1.1.4
• trusted Publish workflow: https://github.com/mohanagy/miftah/actions/runs/34533127374
• provenance transparency log: https://search.sigstore.dev/?logIndex=2787544764
• npm latest: 1.1.4

Post-publish verification

• Registry dist-tags.latest = 1.1.4; provenance attestation present at https://registry.npmjs.org/-/npm/v1/attestations/@lubab%2fmiftah@1.1.4
• Fresh install from the registry into a clean project: found 0 vulnerabilities
• npm audit signatures: 101 packages with verified registry signatures, 15 with verified attestations
• Consumer-resolved security dependencies in that fresh tree: hono 4.13.7, qs 6.16.0, fast-uri 3.1.7

That last line is the point of the fast-uri 3.x decision: an installer resolves the patched 3.1.7 through ajv's own ^3.0.1 range. A 4.x override would have cleared only this repository's audit while leaving every installer on vulnerable 3.x.

• The published binary was run against a real MongoDB upstream: 34 tools advertised, 17 carrying an outputSchema, 0 still declaring a dialect, schema bodies intact.

Remaining

• chore: sync main release history into development #444 restores main↔development ancestry containment (content-neutral).
• No superseded version needs deprecation: 1.1.4 is a compatible fix over 1.1.3, which carries no known-unsafe runtime defect.
• The two development-only Vitest advisories remain out of scope, tracked with the Vitest 4 migration.

[mohanagy]

Completed. @lubab/miftah@1.1.5 is published, verified, and main/development containment was restored in #444.

All acceptance criteria met:

• package.json and package-lock.json set to 1.1.4 without a local tag
• 1.1.4 changelog dated 2026-09-11, linking this issue
• Pinned release/version documentation and release-contract tests aligned
• Release checks run: full suite 1999 passed / 0 failed (162/162), typecheck, lint, build, packed-artifact, fixture parity
• Release-preparation PR chore(release): prepare v1.1.4 #442 merged after current-head CI and CodeRabbit gates passed
• Promotion PR chore(release): promote v1.1.4 to main #443 merged as a merge commit (3af8b22, two parents)
• v1.1.4 tag and GitHub Release point to the exact main commit 3af8b22e02eebe447a3bee8f28a11758937662d4
• Published only through the protected GitHub Release workflow using npm trusted publishing; no NPM_TOKEN, no workstation publish
• Verified npm latest, registry provenance, workflow success, a fresh install (found 0 vulnerabilities), package contents, and signatures (101 verified, 15 attestations)

Audit caveat now resolved. This release shipped with a zero production-only audit but two remaining development-only Vitest advisories, which it explicitly did not claim to fix. #446 has since cleared them via the Vitest 5 upgrade, so both the production-only and full audits now report zero.

No superseded version needs deprecation: 1.1.4 is a compatible fix over 1.1.3, which carries no known-unsafe runtime defect.

Follow-up release: #447.