v1.1.1 — Onboarding Correctness, Evidence Quality & Release Consistency

Finest Computer Use Safety v1.1.1

This patch release hardens clean-machine onboarding, refines Antigravity discovery semantics, eliminates configuration risk, introduces capability probing, and enforces rigorous evidence classification across all diagnostic and acceptance surfaces.

Key Additions & Fixes

• Canonical MCP Configuration Isolation (scripts/bootstrap.py):
  • Restricts automatic MCP configuration strictly to canonical ~/.gemini/config/mcp_config.json.
  • Prohibits blind copying or destruction of secondary/legacy ~/.gemini/antigravity/mcp_config.json.
  • Implements atomic writes via sibling .tmp.<pid> files, fsync, post-write JSON verification, and automated rollback on error.
• Antigravity Discovery Verification (scripts/bootstrap.py, scripts/doctor.py):
  • Enforces macOS app bundle structural integrity (verifies executable binary inside Contents/MacOS/).
  • Reclassifies config-only state (~/.gemini present without confirmed app bundle or CLI) as ACTION REQUIRED rather than false positive PASS.
• Peekaboo Capability Readiness Probes (scripts/doctor.py):
  • Added multi-tier capability probes (probe_peekaboo_mcp, probe_peekaboo_permissions, probe_peekaboo_observation, probe_peekaboo_capabilities).
  • Validates that the installed Peekaboo binary supports the required mcp subcommand and non-invasive read-only observation.
• Evidence Categorization & Honest Semantics (scripts/smoke_test.py, scripts/fresh_mac_acceptance.py):
  • Clear 4-section smoke test explicitly distinguishing standalone handler smoke from host Antigravity PreToolUse hook dispatch (REAL ANTIGRAVITY HOOK E2E: NOT EXECUTED).
  • Structured acceptance report annotating each check with confidence tiers (PORTABLE, HOST_INTEGRATION, FIXTURE, ANTIGRAVITY_E2E, TRUE_CLEAN_MAC_E2E).
  • Retains honest declaration that physical virgin-machine validation is unexecuted (TRUE CLEAN MAC E2E: NOT EXECUTED).
• Deterministic Release Manifest Tooling (scripts/generate_manifest.py):
  • Introduced automated manifest generator supporting deterministic SHA-256 generation, cryptographic verification (--verify), and cross-surface version reconciliation (--check-version).

Verification Summary

• Intent/Effect Firewall Regression Suite: 35/35 PASS
• Clean-Machine Lifecycle Test Suite: 31/31 PASS
• Onboarding Corrections Test Suite: 27/27 PASS
• Standalone Firewall Healthcheck: 30/30 PASS
• Multi-tier System Doctor: READY (Exit Code 0)
• Target Mac Acceptance Audit: PASS (READY WITH DOCUMENTED MANUAL STEPS)
• Cryptographic Release Manifest Verification: 40/40 Files Verified