Release v1.1.6

[mohanagy]

Summary

Prepare the compatible v1.1.6 patch release delivering the identity-fingerprint fix from #451.

Contents

• Identity verification silently downgraded when a fingerprint contains control characters #451 — an identity fingerprint containing a control character validated, verified, and was then silently rewritten into a verification failure by the binding store. The single shared predicate is now used by the configuration schema, the probe parser, and the binding store, so an unstorable fingerprint is refused at configuration time with its exact path, and doctor surfaces the IDENTITY_* code.

Boundary

Compatible patch. No public API change, no dependency change, no credential, routing, redaction, or audit change. Fail-closed behavior on a genuine binding-storage outage is unchanged.

Two boundaries tighten deliberately: a configuration carrying a control character in an identity fingerprint is now rejected at validation, and probe output containing control characters is no longer accepted as an identity field. Neither could previously produce a durable binding, so no working configuration is invalidated.

Release checklist

• Version, package-lock.json, and dated changelog entry finalized on development
• Release checks pass on current head with review approval
• Reviewed promotion pull request from development to main, merged with a merge commit (never squash)
• GitHub Release for v1.1.6 created at the exact current main commit, triggering .github/workflows/publish.yml
• Registry version and provenance verified after publication
• GitHub Release and workflow evidence verified

[mohanagy]

Released. v1.1.6 is published and verified.

• Fix merged: fix(identity): reject control characters in identity fingerprints #452 (a4c6f15)
• Release prep merged: chore(release): prepare v1.1.6 #454 (5ebba34)
• Promotion merged with a merge commit, never squashed: chore(release): promote v1.1.6 to main #455 (d5a932d)
• GitHub Release v1.1.6 created at the exact current main commit d5a932de4b309f4879a16af5ca92964f1f19acfe; publish workflow run 35302872166 succeeded
• Ancestry back-merge merged: chore: sync the v1.1.6 promotion merge into development #456 — git merge-base --is-ancestor origin/main origin/development now passes and the main-only commit count is back to 0

Registry verification:

• dist-tags.latest = 1.1.6
• shasum e7cbfd3f487c230cb5f827f22ecbeaffe1ae32b8, matching the publish log
• SLSA provenance attestation and signatures present; provenance in the Sigstore transparency log at logIndex=2882768411
• Fresh install of @lubab/miftah@1.1.6 into a clean directory reports 1.1.6 and contains the fix

No superseded version is unsafe, so no deprecation was required.