chore(release): prepare v1.1.6

[mohanagy]

Pull request

Summary

Refs #453. Finalizes the compatible v1.1.6 patch release on development, delivering the identity-fingerprint fix from #451 (merged as a4c6f15).

Version bumped 1.1.5 → 1.1.6 across package.json, package-lock.json, README.md, docs/mcp-compatibility.md, docs/presets-and-clients.md, docs/whats-new-in-0.5.md, and the pinned release contract in tests/release-version.test.ts, with a dated ## [1.1.6] - 2026-09-18 changelog section. Same eight-file shape as the v1.1.5 prep commit.

Security impact

No public API, dependency, credential, routing, policy-enforcement, redaction, audit, or subprocess change. No dependency was added, removed, or moved. Fail-closed behavior on a genuine binding-storage outage is unchanged.

Two boundaries tighten deliberately, both carried by #451 rather than by this commit:

• A configuration carrying a control character in an identity fingerprint is now rejected at validation with its exact path.
• Probe output containing control characters is no longer accepted as an identity field.

Neither could previously produce a durable binding, so no working configuration is invalidated. The IDENTITY_* codes now shown by doctor are fixed enumeration members, not identity values.

Publication remains gated on exact development-to-main promotion and protected OIDC trusted publishing, registry provenance, a fresh install, and package-signature verification. This release does not authorize removal of any legacy behavior.

Validation

• A failing test was observed first for each behavior or configuration-contract change — the behavior changes landed in Identity verification silently downgraded when a fingerprint contains control characters #451 with failing tests observed first; the release contract in tests/release-version.test.ts was updated and re-run here.
• npm run lint — pre-existing local .worktrees tsconfigRootDir parser noise only; Linux quality passes in CI, where .worktrees does not exist.
• npm run typecheck — clean.
• npm test — 162 files, 2003 passed, 34 skipped, 0 failed.
• npm run build — success.
• node dist/cli/main.js schema — success.
• npm run check:pack — Package contract verified (58 files).
• node dist/cli/main.js version — reports 1.1.6.
• Fixtures, logs, screenshots, and examples contain no credentials or private data. tests/fixtures/fake-upstream-runtime.mjs is not modified, so the named-host evidence hash is intact.
• User-facing documentation and CHANGELOG.md are updated when applicable.
• Dependency and packaged-file changes are intentional and reviewed — no dependency change; packaged file count unchanged at 58.
• Undisclosed vulnerabilities are reported privately instead of in this pull request.

After merge

Per CONTRIBUTING.md, the remaining steps are a reviewed development → main promotion pull request merged with a merge commit, never squash, then a GitHub Release for v1.1.6 at the exact current main commit to trigger .github/workflows/publish.yml, then post-publish verification and the chore/sync-main-ancestry-v116 back-merge.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Corrected identity fingerprint handling.
  • Confirmed rejection of control characters and configuration-time path errors.
  • Preserved fail-closed behavior during outages.

• Documentation

  • Updated installation instructions and compatibility guidance for version 1.1.6.
  • Added release notes documenting the fix and unchanged security and reliability guarantees.

• Release

  • Published version 1.1.6 as a compatible patch release with no public API changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 13bd7a5c-2c43-48fe-9eaa-ca384f26a632

📥 Commits

Reviewing files that changed from the base of the PR and between a4c6f15 and 7dc84ad.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (7)

• CHANGELOG.md
• README.md
• docs/mcp-compatibility.md
• docs/presets-and-clients.md
• docs/whats-new-in-0.5.md
• package.json
• tests/release-version.test.ts

Included review availability: 2 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

---

📝 Walkthrough

Walkthrough

The package version changed to 1.1.6. The changelog and documentation now reference the release. Release artifact tests validate the new version and documented release entries.

Changes

Version 1.1.6 release alignment

Layer / File(s)	Summary
Release metadata and documentation package.json, CHANGELOG.md, README.md, docs/*	The package version, changelog, installation commands, and compatibility references now use version 1.1.6.
Release artifact validation tests/release-version.test.ts	Release tests now target version 1.1.6 and assert the documented identity-fingerprint fix and related release guarantees.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 7dc84

The release metadata and documentation are aligned, and the planned date is permitted during release preparation.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Docstring Coverage	❌ Error	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (6 skipped: 6 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies a release-preparation change for version 1.1.6 and matches the primary changeset.
Description check	✅ Passed	The description includes the required Summary, Security impact, and Validation sections. It documents the version updates, security boundaries, exact validation results, documentation updates, package…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (6 skipped: 6 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{A rabbit checks the version line
One point one six now hops in time
The changelog gleams
Tests guard the dreams
And docs align in a tidy sign}

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Pre-merge checks failed. Please resolve the failing checks before merging.