v0.9.1

Patch release. The headline: pip install prompt-armor now works correctly out of the box. No API changes.

🐛 Fixed

• pip install prompt-armor ships the ML detection layers by default. The L2/L3/L5 ML layers were behind an optional [ml] extra, but the fusion meta-classifier is trained expecting their scores — so a base install silently returned ALLOW on textbook injections (e.g. "Ignore all previous instructions…"), contradicting the README's own BLOCK example. ML deps are now core; prompt-armor[ml] kept as a no-op back-compat alias; a packaging regression guard (tests/unit/test_default_install.py) prevents recurrence.
• Silenced a per-call scikit-learn InconsistentVersionWarning at the sha256-verified L5 load site.

✨ Added

• Out-of-sample validation of the internal F1 (scripts/eval_holdout.py): cluster-aware holdout with the decision threshold selected on train only → F1 85.5% ± 1.2%, statistically indistinguishable from the in-sample 84.4% (the benchmark is not materially leakage-inflated). Out-of-DB (zero-day) attack recall: 81%.

✅ Verified (clean venv, from PyPI)

analyze("Ignore all previous instructions…") → BLOCK / 1.00; benign → ALLOW / 0.12; no warnings. Benchmark byte-identical on scikit-learn 1.8.0 / 1.9.0 (F1 84.43%).

Full changelog: https://github.com/prompt-armor/prompt-armor/blob/main/CHANGELOG.md · Compare: v0.9.0...v0.9.1