tlk-sentinel 1.1.0

Documentation and release plumbing. Detection and response are byte-for-byte what 1.0.0 shipped.

Two documents a security product should not have been missing

• docs/architecture.md — one log line traced from the file, through the engine, to the firewall, including why the community build cannot ban even if you edit the profile.
• docs/threat-model.md — mostly about the limits. Distributed low-and-slow traffic and IPv6 rotation walk straight past it. A spoofed proxy header lets an attacker choose whose address gets banned. Log injection, locking yourself out, and a poisoned reputation feed are the other three ways this becomes the risk.

Also

• SECURITY.md with a disclosure address, scope and a response window; the issue chooser points at it first.
• A licence permission table in the README, both languages, matching clauses 1 and 2 of LICENSE.
• This release carries a tarball and its SHA-256. The workflow refuses to publish unless the suite passes, the README's test count still matches it, and the public build comes out monitor-only.
• CI fails if any of the four places the README states a test count drifts from the suite.

Verify the download

sha256sum -c tlk-sentinel-v1.1.0.tar.gz.sha256