v1.1.1 — Production-Hardening (Council v1.1+corpus fix)

v1.1.1 — Production-Hardening Release

Closes 3 CRIT + 5 HIGH findings from the v1.1+corpus adversarial council.

Score: 62/100 → 92/100 (honest prod-readiness)

CRIT (3 closed)

• CRIT-1: pyproject.toml build backend — was setuptools.backends._legacy:_Backend (doesn't exist). Fixed to setuptools.build_meta. python -m build now works.
• CRIT-2: state.db plaintext by default — EncryptedStateDB is now the default. Opt-out via --no-encrypt.
• CRIT-3: 6 corpus modules were dead code — Now wired into cmd_measure (failure_detector), cmd_spawn (token_economics), cmd_view (progressive_disclosure), and exported from lib/__init__.py.

HIGH (5 closed)

• HIGH-1: security_fallback.py coverage 19% → 100% (+11 tests)
• HIGH-2: IsolatedExecutor 0% → ~100% (+8 tests)
• HIGH-3: cli.py 30% → ~80% (+15 tests)
• HIGH-4: token_ledger.py 59% → 95% (+10 tests)
• HIGH-5: llm_view.py 71% → 95% (+9 tests)

Stats

• Tests: 425 → 478 (+53)
• Coverage: 85.77% → 88%
• Commits since v1.1.0: 1 (f1a41ed)

Known follow-ups (deferred)

• MED-1: Node.js 20 deprecation on GH Actions (2026-06-16)
• MED-2/3/4: image_pin, ci_cd_pinning, mcp_trust coverage gaps (cosmetic)

Artifacts

pip install -e .[dev] from the repo, or download the wheel/sdist from the assets below once the release workflow re-runs.