v1.1.2 — Security and release-integrity patch

Fail-closed fixes at the audit and hook boundaries, plus two install-path defects found while verifying this release.

Security

• Symlink audit escape. A symlink or Windows junction used as the top-level recursive audit target is now rejected, so an audit (and the opt-in LLM scan) cannot escape into unrelated local files.
• Oversized hook payloads. Payloads beyond the scan limit are blocked instead of allowing an uninspected tail.
• High-risk hook traffic. Any payload with a high or critical finding is blocked. Medium-only suspect content stays warning-only to control false positives.
• Receipt verification. Verification short-circuits before any scan work, so it never scans or transmits the current directory.
• Malformed manifests. A broken package.json no longer crashes --check-deps.

Install and proof

Both of these were found by running the documented install paths end to end, not by code review:

• pip install was broken. snapshot-runtimes listed codex-tools.json as a written artifact but only wrote it when it already existed. A git clone masked this because data/snapshots ships a seed copy, so every pip-based install left rebuild, route, and bundle failing with "Required runtime snapshot is missing".
• The proof table could not be regenerated. bench_context_savings.py crashed with a KeyError on any index that did not match all six benchmark tasks. It had no test coverage; it does now.

Also

• Package metadata corrected to 1.1.2 with modern SPDX/setuptools fields.
• README proof regenerated from a single verified run against a 58,018-capability index. Two per-task figures had drifted.

Verified on Linux, macOS, and Windows across Python 3.11-3.14.

Full changelog: v1.1.1...v1.1.2