v0.1.1 — security release

Security release. Upgrade from 0.1.0.

An adversarial audit found six high-severity issues, all present in 0.1.0. The most serious: the MCP proxy failed open. Policy was applied only to messages matching dict + method == "tools/call" + a present id; everything else was forwarded to the child unchecked and unjournaled.

Four shapes of an ordinary blocked call slipped through:

• a JSON-RPC batch array
• a tools/call with no id
• a payload CPython's JSON parser rejects but a child accepts (integer literal over 4300 digits)
• a payload with one invalid UTF-8 byte

No malformed framing or exotic encoding required — plain, valid JSON. Because nothing was journaled, the bypassed calls were also invisible to aileron verify.

Also fixed: checkpoint rollback via reordering the checkpoints file, verify-checkpoint taking its trust anchor from the directory under audit, audit records silently dropped on duplicate JSON-RPC ids, duplicate-JSON-key and non-canonical-number smuggling past verify(), and an exception string persisted despite capture_content=False.

⚠️ Breaking change

Canonical JSON is now ASCII-escaped and rejects NaN/Infinity. This makes the integrity check total — a peer-supplied lone surrogate could previously raise inside verify() and suppress a TAMPERED verdict — but it changes the hash of any event containing non-ASCII content. Journals written by 0.1.0 containing non-ASCII will not verify under 0.1.1. Re-sign or archive them before upgrading.

Performance

The proxy read one byte at a time. Reading line-wise cuts overhead ~11x on 32 KB tool calls (2.16 ms → 0.19 ms). Measured overhead is now 0.08 ms (p50) at 64 B and 0.33 ms at 32 KB, via the new reproducible benchmarks/bench_proxy.py.

Full detail in CHANGELOG.md. 112 tests.