v1.1.1

Security hardening

• Fail closed when replay, trust-source, or attestation interfaces contain typed nil values.
• Make the built-in memory and SETNX replay caches reject nil receivers instead of silently accepting replay state.
• Require iat and a verifier-local maximum token lifetime for both Manager grants and Agent session proofs in the supported production compositions.
• Add bounded clock-skew policy to production JWT verification.
• Require a verified mTLS client-certificate chain in the protected-change reference consumer.
• Bind reference outcome records to the accepted identity projection and reject conflicting identity reuse.

Upgrade requirement

Set both production authority roles explicitly:

managerAuthority.MaxTokenLifetime = 10 * time.Minute
managerAuthority.ClockSkew = 5 * time.Second
agentAuthority.MaxTokenLifetime = 2 * time.Minute
agentAuthority.ClockSkew = 5 * time.Second

An omitted or non-positive MaxTokenLifetime now fails closed. The Direct-Agent v1 claim names and token profile remain unchanged.

Verification

• CI: all lint, build, package, race, integration, bounded fuzz, and govulncheck gates passed.
• Security Red Team passed.
• Redis Sentinel Failover passed with a real primary stop and replica promotion in the CI topology.

This release does not add Redis discovery, a zero-loss replication guarantee, hardware-attestation qualification, or a complete application transaction. Durable outcome reconciliation remains consumer-owned.