v1.1.0

What's Changed

Feature

• feat(113): detect javascript:/data:/userinfo/token-in-query in markdown links by @trek-e in #133
• feat(115): secret-scan exclusion governance + --strict reduced-scan mode by @trek-e in #134
• feat(114): npm dependency integrity gate (npm ls invalid/extraneous) by @trek-e in #135
• feat(117): reproducible npm environment bootstrap + check-env validator by @trek-e in #136

Enhancement

• chore: add concurrency block to 11 PR workflows by @trek-e in #141
• docs(118): org-level security baseline RFC (draft) by @trek-e in #137
• docs(2): clarify installer is required for cross-runtime compatibility by @trek-e in #144
• enh(#142): centralize runtime alias canonicalization seam by @trek-e in #143
• chore: invalidate bug-2543 outdated namespace invariant + document /gsd- migration in CONTEXT.md by @trek-e in #164
• chore: enforce sdk/dist freshness in gen-*.mjs + add staleness guard helper by @trek-e in #169
• chore: codify session anti-patterns into skill + CONTEXT.md (after 2026-05-23 PR campaign) by @trek-e in #172

Fix

• fix(3785): case-insensitive depends_on resolution in phase resolver by @trek-e in #88
• fix(ci): use GETSHITDONEREDUXNPMTOKEN secret in release workflows by @trek-e in #129
• fix(ci): escape colons in echo strings in workflow yaml by @trek-e in #125
• fix(#131): isolate HOME for release-tarball-smoke (before() + runSmoke A-F) by @trek-e in #139
• fix(116): locale-safe base64-scan with portable timeout and partial-scan signaling by @trek-e in #132
• fix(ci): harden test workflow git auth on github-hosted runners by @trek-e in #153
• fix(3): milestone.complete header dup, bullet leakage, one-liner noise by @trek-e in #146
• fix(#21): add YAML frontmatter to STATE.md template by @trek-e in #151
• fix(ci): pin actions/checkout@v4 on Windows to bypass v6 includeIf auth bug by @trek-e in #162
• fix(6): retire validate.ts/verify.cjs cooperating-sibling, fix W007/phaseVariants/W006 drift via generator by @trek-e in #156
• fix(26): retire validate.ts/verify.cjs cooperating-sibling for W005/W006-archived/I001 via generator (stacks on #156) by @trek-e in #158
• fix(5): decision-coverage gate parses XML tag bodies for D-NN citations by @trek-e in #155
• fix(7): raise concurrency-safety roadmap-analyze budget to 5000ms (Mac flake mitigation) by @trek-e in #157
• fix(#14): wire --auto flag through progress→next handoff by @trek-e in #148
• fix(4): retire cooperating-sibling for phase.*, introduce generator + I/O adapter, fix cmdPhaseComplete by @trek-e in #154
• fix(ci): reduce Windows test concurrency 4→2 to prevent synckit worker exhaustion on Node 24 by @trek-e in #173
• fix(#105): skip strategy-branch auto-switch when use_worktrees=false by @trek-e in #150

Full Changelog: v1.0.0...v1.01.0