UADS v0.11.1 - Release Security Proof

[0.11.1] - 2026-09-05

Fixed

• Bound corrected release authorization to reconstructable exact-SHA CodeQL and Scorecard proofs plus exact-SHA or same-tree PR Dependency Review proof.
• Added fail-closed security-proof identity/digest validation and adversarial RG1-RG14 regression coverage without changing validated runtime subsystems.
• Completed the Correction 05 event/ref and merged-PR binding closeout, including RG15-RG22 security-proof regression coverage.

Verification

• Published as an immutable GitHub prerelease after all required post-merge gates passed for exact main SHA db904219a691dea9509f04ff44ac9e8dff5563fa and tree 0a4ef8e7e8354d4a90d8fc3db6fe19d70734c42f.
• Foundation CI run 33969035968 passed with 48 test files, 351 tests, 0 failures, and npm audit reporting 0 vulnerabilities.
• CodeQL run 33969035966 passed for the exact final SHA.
• OpenSSF Scorecard run 33969035984 passed from push on main for the exact final SHA/tree.
• Dependency Review proof run 33967128218 passed for merged PR #14 using same-tree provenance: reviewed source 5c924602... and final main db904219... share tree 0a4ef8e....
• Linux and Windows Node 20 compatibility run 33969242069 passed for the exact final SHA/tree.
• Canonical Direct Review run 33969337749 passed with finalVerdict=PASS.
• Release workflow run 33969445797 passed publication, final evidence verification, and the supported attestation step.
• The completed security-proof regression family is RG1-RG22. The immutable v0.11.0 release and tag remain unchanged.

Review Evidence

• Commit SHA: db904219a691dea9509f04ff44ac9e8dff5563fa
• Final tree SHA: 0a4ef8e7e8354d4a90d8fc3db6fe19d70734c42f
• Merged PR: #14
• CI run ID + conclusion: 33969035968 + success
• CodeQL run ID + conclusion: 33969035966 + success
• Scorecard run ID + conclusion: 33969035984 + success
• Dependency Review run ID + conclusion: 33967128218 + success (same-tree PR #14 proof)
• Compatibility run ID + conclusion: 33969242069 + success (Linux and Windows Node 20)
• Direct-review workflow run ID + verdict: 33969337749 + PASS
• Direct-review artifact: uads-direct-review-db904219a691dea9509f04ff44ac9e8dff5563fa
• Direct-review base evidence SHA-256: 02cd263a35e7cf09a47463d83d1cd52412495f9d2b1c18eadfb059631b3b2f5f
• Release run ID + conclusion: 33969445797 + success
• Test summary: 48 test files; 351 passed; 0 failed
• Eval summary: orchestrator 9/9; execution 9/9; context 19/19; fault 18/18; cost 27/27; modelRouting 22/22; specialistRouting 26/26; adapters 40/40; assurance 22/22; faultInjection 32/32
• Security-proof regression: RG1-RG22, 22/22
• npm audit: clean (0 high-or-greater)
• Published assets: 10 expected release assets, including CI binding, canonical/final Direct Review evidence and checksum, review index, release manifest, SHA256SUMS, SPDX SBOM, tarball, and validation report