1.11.0 (2026-07-23)
Features
- 20-01: add includeAudit gate field and AUDIT diagnostic counter (43adde7)
- 20-01: widen classification gate to include AUDIT verdicts (5b586ae)
- 20-02: widen FlowSource interface + filter sites 1-4, thread IncludeAudit through pipeline (dceb3ad)
- 20-04: register --include-audit CLI flag on generate/replay (4e397d1)
- 20-04: thread include_audit MCP arg through StartArgs to PipelineConfig (e49e93d)
- 21-01: add pkg/k8s/version.go Cilium version detection (cfa36ea)
- 21-03: add maybeRunVersionPreflight always-on preflight in generate.go (6362e89)
- 21-04: add compat fields + detectVersionFn seam + resolveSetup wiring (3ca6465)
- 22-01: add BuildBootstrapPolicy default-deny CNP constructor (2a1b0fc)
- 22-02: add cpg bootstrap CLI command + version gate (52861d7)
- 22-02: add readonly get_bootstrap_policy MCP tool (87630fd)
- 23-01: add read-before-flip, canonical flip, binary gate, daemon precondition (f0ab85f)
- 23-01: add SPDY exec primitive + node-to-agent-pod mapping (c36e03e)
- 23-02: add auditwindow.Manager scaffold + Open precondition/flip/UID bookkeeping (f2de4da)
- 23-02: add bounded revert fan-out for Close/Shutdown with per-endpoint reporting (4c9c66e)
- 23-02: add new-endpoint watcher with bounded-backoff reconnect (42b3b8f)
- 23: add cpg audit-window command (6b7157a)
- 24: add cpg-audit-onboard + cpg-policy-review skills (de97afa)
- 24: add cpg-health-report + cpg-mcp-smoke skills + README agent tooling (26d06a5)
- 24: add cpg-operator agent + cpg-triage skill (817db1f)
- quick: use WebSocket exec with SPDY fallback in audit-window exec path (2465740)
Bug Fixes
- 20: surface AuditVerdictCount through SessionStats and StopResult (WR-01) (ada7b30)
- 21: WR-01 bound CLI version preflight and suppress Ctrl+C warn (c4db965)
- 21: WR-02 bound GetNodes RPC with versionDetectTimeout budget (0144ae0)
- 22-02: make cpg bootstrap stdout-only, restoring zero new SEC-01 allowlist entries (61c58c0)
- 22-02: update pinned MCP tool-count tests for get_bootstrap_policy (a111188)
- 22: review fixes — runbook -o drift + DNS-1123 namespace validation on both surfaces (4ebdfe4)
- 23: CR-01/CR-02/WR-01 route audit-window revert through bounded Shutdown (4d62126)
- 23: report possibly-stuck endpoints when revert deadline expires (acee4a9)
- 23: WR-02/WR-03 harden SEC-01 exec tripwire negative half (dc7f21c)
- 24: correct nonexistent 'cpg explain --output json' flag to --json (skill + tool descriptions) (d011d16)
- 24: correct remaining --output json reference in README MCP table (755cf0c)
- resolve new lint findings (errcheck Fprintln, QF1008 embedded ObjectMeta, QF1001 De Morgan) (86fecf0)