v1.11.0

1.11.0 (2026-07-23)

Features

• 20-01: add includeAudit gate field and AUDIT diagnostic counter (43adde7)
• 20-01: widen classification gate to include AUDIT verdicts (5b586ae)
• 20-02: widen FlowSource interface + filter sites 1-4, thread IncludeAudit through pipeline (dceb3ad)
• 20-04: register --include-audit CLI flag on generate/replay (4e397d1)
• 20-04: thread include_audit MCP arg through StartArgs to PipelineConfig (e49e93d)
• 21-01: add pkg/k8s/version.go Cilium version detection (cfa36ea)
• 21-03: add maybeRunVersionPreflight always-on preflight in generate.go (6362e89)
• 21-04: add compat fields + detectVersionFn seam + resolveSetup wiring (3ca6465)
• 22-01: add BuildBootstrapPolicy default-deny CNP constructor (2a1b0fc)
• 22-02: add cpg bootstrap CLI command + version gate (52861d7)
• 22-02: add readonly get_bootstrap_policy MCP tool (87630fd)
• 23-01: add read-before-flip, canonical flip, binary gate, daemon precondition (f0ab85f)
• 23-01: add SPDY exec primitive + node-to-agent-pod mapping (c36e03e)
• 23-02: add auditwindow.Manager scaffold + Open precondition/flip/UID bookkeeping (f2de4da)
• 23-02: add bounded revert fan-out for Close/Shutdown with per-endpoint reporting (4c9c66e)
• 23-02: add new-endpoint watcher with bounded-backoff reconnect (42b3b8f)
• 23: add cpg audit-window command (6b7157a)
• 24: add cpg-audit-onboard + cpg-policy-review skills (de97afa)
• 24: add cpg-health-report + cpg-mcp-smoke skills + README agent tooling (26d06a5)
• 24: add cpg-operator agent + cpg-triage skill (817db1f)
• quick: use WebSocket exec with SPDY fallback in audit-window exec path (2465740)

Bug Fixes

• 20: surface AuditVerdictCount through SessionStats and StopResult (WR-01) (ada7b30)
• 21: WR-01 bound CLI version preflight and suppress Ctrl+C warn (c4db965)
• 21: WR-02 bound GetNodes RPC with versionDetectTimeout budget (0144ae0)
• 22-02: make cpg bootstrap stdout-only, restoring zero new SEC-01 allowlist entries (61c58c0)
• 22-02: update pinned MCP tool-count tests for get_bootstrap_policy (a111188)
• 22: review fixes — runbook -o drift + DNS-1123 namespace validation on both surfaces (4ebdfe4)
• 23: CR-01/CR-02/WR-01 route audit-window revert through bounded Shutdown (4d62126)
• 23: report possibly-stuck endpoints when revert deadline expires (acee4a9)
• 23: WR-02/WR-03 harden SEC-01 exec tripwire negative half (dc7f21c)
• 24: correct nonexistent 'cpg explain --output json' flag to --json (skill + tool descriptions) (d011d16)
• 24: correct remaining --output json reference in README MCP table (755cf0c)
• resolve new lint findings (errcheck Fprintln, QF1008 embedded ObjectMeta, QF1001 De Morgan) (86fecf0)