v1.1.0

This release adds Beacon Security to the complete Beacon Java agent as an opt-in capability. The
publication scope is the versioned complete Agent JAR; it does not include a standalone Security
extension JAR or a Beacon-owned container image.

Beacon Security

• Migrated the Java runtime data-flow and runtime SBOM implementation into the internal
  extensions/security module and embedded it in the complete Beacon Java agent. Applications use
  one Agent JAR, while Security remains disabled by default and shares OpenTelemetry resource
  identity and OTLP Logs delivery.
• Established the initial beacon.security.* configuration and beacon.security.* event contract
  without legacy compatibility aliases, added local diagnostic output as an explicit opt-in, and
  added a Boot 2 end-to-end smoke test plus a native Kubernetes initContainer deployment example.
• Pinned the language-neutral
  Beacon Security specification by
  immutable commit and embedded its repository, revision, schema version, and fingerprint version
  in the complete Agent artifact provenance.
• Published Security as part of beacon-javaagent-1.1.0.jar, disabled by default. The Kubernetes
  initContainer manifest is a deployment example and does not imply publication of a Beacon-owned
  container image.

Engineering and release

• Added Beacon-owned release preparation and controlled publication workflows. A formal release is
  bound to a successful full Beacon CI run for the exact source commit, promotes one tested Agent
  candidate without rebuilding it, and publishes its checksum, SPDX SBOM, provenance, licenses,
  notices, and GitHub build-provenance attestations.
• Added a repository-owned Spring Boot 2 fixture and made the packaged-agent CI path verify dynamic
  SQL detection, prepared-statement suppression, runtime SBOM output, and delivery health.

Release evidence

• Source commit: 1a276cb60f86c8e8d669b2297663d87b340441f7
• Full validation: https://github.com/beacon-observability/beacon-java/actions/runs/37013600038
• Agent SHA-256: 571fdeb375c2643e9c705a44cf4135b139b8ac8ef6085a1444d35ddcf41e17e8
• The attached JAR is the exact candidate tested by this release workflow; the publish job does not rebuild it.