chore(release): promote v1.1.6 to main

[mohanagy]

Pull request

Summary

Refs #453. Reviewed release promotion of v1.1.6 from development to main. This is the only permitted main pull request per CONTRIBUTING.md.

Promotes three commits:

• a4c6f15 fix(identity): reject control characters in identity fingerprints (fix(identity): reject control characters in identity fingerprints #452)
• 5ebba34 chore(release): prepare v1.1.6 (chore(release): prepare v1.1.6 #454)
• 3c6298b the v1.1.5 ancestry sync merge already on development

Merge with a merge commit. Do not squash. Squashing a long-lived-to-long-lived promotion bakes the content into a new SHA that development never receives, so the branches drift by identity every release and the next promotion reports a phantom conflict.

Security impact

No public API, dependency, credential, routing, policy-enforcement, redaction, audit, or subprocess change. No dependency was added, removed, or moved; the packaged file count is unchanged at 58. Fail-closed behavior on a genuine binding-storage outage is unchanged.

Two boundaries tighten deliberately, both from #451:

• A configuration carrying a control character in an identity fingerprint is rejected at validation with its exact path, rather than validating, verifying, and then being silently rewritten into a verification failure by the binding store.
• Probe output containing control characters is no longer accepted as an identity field, so unstorable evidence cannot reach the store or trip its process-sticky unavailable flag.

Neither case could previously produce a durable binding, so no working configuration is invalidated. The IDENTITY_* codes now appended to doctor output are fixed enumeration members, not identity values.

Validation

• A failing test was observed first for each behavior or configuration-contract change.
• npm run lint — pre-existing local .worktrees parser noise only; Linux quality passes in CI.
• npm run typecheck — clean.
• npm test — 162 files, 2003 passed, 34 skipped, 0 failed.
• npm run build — success.
• node dist/cli/main.js schema — success.
• npm run check:pack — Package contract verified (58 files).
• node dist/cli/main.js version — reports 1.1.6.
• Full CI green on both contributing pull requests across macOS, Ubuntu, and Windows on Node 20, 22, and 24, plus Linux quality and Verify. One Windows Node 22 run failed on an npm ci --offline 120s timeout in the real-tarball install test and passed on re-run; Windows Node 20 and 24 passed that same test on the first attempt.
• Fixtures, logs, screenshots, and examples contain no credentials or private data. tests/fixtures/fake-upstream-runtime.mjs is not modified, so the named-host evidence hash is intact.
• User-facing documentation and CHANGELOG.md are updated.
• Dependency and packaged-file changes are intentional and reviewed.
• Undisclosed vulnerabilities are reported privately instead of in this pull request.

After merge

Create a GitHub Release for v1.1.6 at the exact current main commit to trigger .github/workflows/publish.yml, then verify registry version and provenance, verify the GitHub Release and workflow evidence, and open chore/sync-main-ancestry-v116 to back-merge this promotion into development (merge commit, never squash) so the branches do not drift.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 83a7db47-ad31-42cc-a6a5-0d3af8b3d7a3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}