diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7e6108d..8621b9a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,42 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - Critic/ensemble judge (independent second opinion in the uncertain band)
 - Unified finding clustering for the webscan→redteam escalation path
 
+## [1.4.1] - 2026-07-09
+
+### Added — detection coverage
+- **Many new attack signatures** for LLM/chatbot/MCP targets, each tagged with an
+  OWASP LLM Top 10 id and a CWE: system-prompt extraction, roleplay/virtualization
+  (pretend, hypothetical/fictional framing, the "grandma" exploit, AIM/Machiavellian),
+  encoding & obfuscation (base64/rot13 decode-and-run, payload splitting, leetspeak),
+  indirect/RAG injection markers, data exfiltration (URL, markdown-image beacon,
+  private-key and env-var leaks), and MCP/tool abuse (tool-description poisoning,
+  ignore-tool-schema, cross-server confused deputy, excessive-permission requests).
+  The unified rule catalog grew from ~21 to 41 rules.
+- L1 evidence spans now carry `owasp` and `cwe`; a `rule_by_name()` helper exposes
+  rule metadata to the reporting layer.
+
+### Added — understandable results
+- HTML reports now include a **"How AgentArmor analyzed this"** panel per finding that
+  lists each analysis agent (Triage → Analyst → OWASP Mapper → Remediation → Synthesis)
+  in plain language with its model and latency, plus a **"How we scored this"** line
+  explaining which detection layers fired and how they combined into the risk score.
+
+### Changed — cloud-only cleanup
+- Removed the last remnants of the offline analysis mode: the dead `--analysis-mode offline`
+  CLI option is gone, `apply_analysis_options` no longer takes `analysis_mode`, and defaults
+  now resolve to cloud everywhere. The internal catalog pre-fill (formerly
+  `enrich_finding_offline`) is renamed `enrich_finding_base` and is used only as a fallback
+  when cloud enrichment cannot complete.
+
+### Changed — Rust/Python parity
+- The native Rust L1 engine now embeds the **same `catalog.yaml`** at compile time and
+  applies the identical rule selection as the Python fallback, ending the long-standing rule
+  drift (11 vs 21 rules). A parity test guards against regressions.
+
+### Discoverability
+- Rewritten README intro with search-optimized keywords and badges; added PyPI `keywords`
+  and `classifiers`; refreshed the GitHub repository About + topics.
+
 ## [1.4.0] - 2026-07-05
 
 ### Changed — Multi-agentic only
diff --git a/gui/package.json b/gui/package.json
index 28f5d86..aea720e 100644
--- a/gui/package.json
+++ b/gui/package.json
@@ -1,7 +1,7 @@
 {
   "name": "agentarmor-gui",
   "private": true,
-  "version": "1.4.0",
+  "version": "1.4.1",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/gui/src-tauri/Cargo.toml b/gui/src-tauri/Cargo.toml
index 308a1c6..502d94f 100644
--- a/gui/src-tauri/Cargo.toml
+++ b/gui/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "agentarmor-gui"
-version = "1.4.0"
+version = "1.4.1"
 description = "AgentArmor Desktop"
 authors = ["AgentArmor"]
 edition = "2021"
diff --git a/gui/src-tauri/tauri.conf.json b/gui/src-tauri/tauri.conf.json
index c6b3951..2a1eafa 100644
--- a/gui/src-tauri/tauri.conf.json
+++ b/gui/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "AgentArmor",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "identifier": "com.agentarmor.desktop",
   "build": {
     "beforeDevCommand": "npm run dev",