v1.1.0

A legibility and presentation-correctness release on the advisory channel.
Nothing new is analysed: the same files are read by the same readers, and the
same rows come out — bar the three Claude Code permission shapes #816 was
reading in the wrong direction. What changes is what a run says about itself.
A refusal names the files that blocked it, a comparison states what it
established, a permission change carries its direction and its
allow/deny/ask scope, and --json says what the text says about the
same run.

Measured by re-running a 23-PR public corpus on main before and after this
cycle: audit --host output was byte-identical on 12 of 12 pairs diffed and
zero new files are read; rows were byte-identical on 22 of 23 pull requests;
18 of 23 comparisons were comparable in every measurement, before and after;
and the automatic author-actionable yield was 0 of 23 both times. The limits
are unchanged and worth stating plainly: a zero-row result still does not tell
you which relevant file went unread (#821), and hook script bodies,
plugin-package files and marketplace inputs are still not read.

The full reviewed prose is in
docs/changelog/1.1.0.md. This section is the
release note; that file is the record.

Migration notes: read every Migration Note: 1.1.0 entry in
STABILITY.md before upgrading from 1.0.0. Schema versions
move: host-grants inventory 0.5 → 0.6, runtime contract 39 → 40, capability
diff 0.2 → 0.3 and verifier 0.19 → 0.20.

Highlights

• A refusal names what blocked it. An incomparable comparison now names the
  files it could not establish, with host, side and reason; 5 of the 5
  previously silent refusals in the corpus now say which input stopped them.
  (#812)
• Every comparison says what it established, source by source, including a
  zero-row result — 23 of 23 in the corpus. The block lists only sources the
  run read or tried to read, says so in its first line, and is therefore not an
  account of the whole change: a changed file it does not read is absent.
  (#812)
• A permission change reads as the change it is. A deny → allow move
  and a narrowed rule are told apart from plain additions, and every rule
  carries the list it is declared under. (#795, #816)
• A fully-qualified single MCP tool rule is no longer reported as a
  whole-server wildcard at high risk, and an MCP row names the server's
  command or its URL with the path redacted. (#816, #795)
• The text and the JSON describe one run. The row semantics the text shows
  and the coverage list are published in diff --json and verifier.json too.
  (#795, #812)
• --out pointing at a directory refuses with a runnable fix instead of a
  raw OS error, and a relative --out resolves against the current directory,
  so every printed artifact path opens from the caller. (#818)

Changes

• The What this run established block says what it is not, ranks what it
  keeps before the cap of ten and states how many items are past it, and a
  zero-row result or a refusal names its provenance; an instruction file whose
  declared structure could not be established no longer prescribes a repair
  when its own text parses. (#812 follow-up; naming the changed files the block
  does not read is #821)
• Every host comparison says what it established, source by source, so
  "compared, no supported change" can be told from "this input was not
  established" without running audit --host, and an incomparable result names
  the files that blocked it. Verifier schema 0.20 adds
  host_comparison.coverage; diff --json moves to capability diff 0.3.
  (#812, slice 1; relevant unread candidates are #821, per-scope rows #808)
• The host-diff text names the concrete change, its evidence and one question
  to answer: a permission rule reads with its allow, deny or ask
  disposition, a replacement or move is one change rather than an unrelated
  added and removed pair, and an MCP server names its command or redacted URL.
  No row, row value or row count moves. (#795, slice 1; hook matcher, command
  and timeout and MCP arguments are #819)
• diff --json and verifier.json state what that text says —
  rows[].disposition, the moved and narrowed directions, and a review
  block — so a script and a reader cannot disagree about one run. Rows keep the
  values and the row count they published on 1.0.0. (#795, follow-up;
  engine-side pairing is #816)
• A relative --out resolves against the current directory for verify,
  scan and fixture run, every artifact path these commands print opens from
  the caller, and audit --host --out <directory> refuses with a runnable fix
  instead of a raw Is a directory error. (#818)
• The host diff reads the direction of three ordinary Claude Code permission
  edits correctly: a trailing :* rule, a rule whose identical text moved into
  allow, and a single mcp__<server>__<tool> grant, which is a scoped grant
  rather than a whole-server one. (#816)
• diff no longer exits 1 with a traceback in a partial clone whose base
  objects were never fetched; it exits 2 naming the side it could not read.
  (#817)
• The discovery copy a coding agent or search engine reads first explains
  reviewing a change to coding-agent configuration, with its limits, not only
  tool-surface scanning. (#792)
• A currency refusal says why the workspace could not be read, and agent control routes by that cause instead of repeating the verify that failed
  the same way. (#813)
• check no longer exits 1 with a traceback when a changed
  .claude/settings.json, .claude/settings.local.json or .cursor/cli.json
  sets a top-level key outside the host-boundary rule allow-list; the answer is
  require_review. (#810)
• verify refuses an output directory that holds repository content, and every
  reader refuses a pointer published into one. (#804)
• Read the action reference each workflow step declares: moving
  uses: actions/checkout@<sha> to @main is a changed row naming the job
  and step, with expands: false. Host-grants schemas move to 0.6 (runtime
  contract 40). (#771)
• A Claude Code hook row states whether anything selects the hook file; a
  .claude/hooks/hooks.json nothing selects is access: unknown,
  risk: unknown, and is never an expansion. (#714)
• agent control --workspace <repo> without --reports-dir reads
  <repo>/agents-shipgate-reports, where verify --workspace <repo> publishes
  by default, and one containment rule decides an output directory for the
  writing run and the refresh alike. (#575, #785)
• Compare the named secrets a job passes to a reusable workflow: repointing
  secrets: {credential: ${{ secrets.STAGING_TOKEN }}} at PRODUCTION_TOKEN
  is a changed row naming the job and destination, with expands: false.
  (#693)
• Stop publishing credential-shaped workflow labels verbatim: every job id,
  step id/name, trigger and permission scope name is published once,
  through the report redactor, where the workflow grant is built. (#802)
• Move the published-release pins, examples and adoption prompts to v1.0.0
  (contract 39) now that it is published, and re-measure the pilot ledger's
  Route H dry run on the published build. (#570, #648)
• Fix the optional skill adoption kits in a released wheel naming the previous
  release: a release-stamped wheel renders its own version, immutable Action
  source and contract into every kit pin and contract-floor statement. Already
  published 1.0.0 bytes are unchanged; the fix reaches adopters in 1.1.0.
  (#781)
• Lead the README and quickstart with the manifest-free agents-shipgate diff
  on a real permission or MCP change, quoting each of its answers, and
  reconcile the release statements with the advisory v1.0.0. (#779, #571)
• Add examples/github-actions/14-host-only-advisory-pr.yml, an advisory PR
  recipe for a repository with coding-agent host configuration and no
  shipgate.yaml or saved baseline. (#780)
• The Action no longer imports Python code from the pull request's checkout:
  its install step, the local-wheel installer and the merge-verdict step all
  run Python with -P. The published v1.0.0 Action tag still has the old
  behaviour; the fix reaches v1.1.0. (#780)
• Evidence readers no longer hang on a FIFO: they refuse a FIFO, directory or
  other non-regular input before reading it instead of waiting for a writer.
  (#577)
• verify's base-scan cache no longer reads, writes or prunes through a link;
  a linked, non-directory or unopenable cache component makes the cache
  unavailable for that run and the base is regenerated from Git. (#638)
• Sequence the post-1.0 adoption roadmap around real reviewer value. (#782)