build(release): prepare offline auditor v0.1.1

README.md

@@ -25,7 +25,7 @@ go build -o ci-trust ./cmd/ci-trust
 On Windows build `ci-trust.exe` and invoke `./ci-trust.exe`. The development version
 is `dev`; build-time `-ldflags "-X main.version=VALUE"` sets it explicitly.
 Versioned archives and `SHA256SUMS` are published on the
-[v0.1.0 release page](https://github.com/dnlrsls/ci-trust/releases/tag/v0.1.0).
+[GitHub releases page](https://github.com/dnlrsls/ci-trust/releases).
 Choose the listed OS/architecture, verify the archive checksum, extract it and
 run `ci-trust --version` (`ci-trust.exe` on Windows). Archives include the source
 license, third-party notices and license texts; no Node/Docker image is bundled.
@@ -53,7 +53,7 @@ Build from source if an archive for your architecture is not listed.
   **1** means operational failure; **2** means invalid invocation. Report input is
   bounded to 8 MiB; interactive stdin is refused.
 
-**v0.1.0 scope: offline MVP — audit, report and conditional bootstrap dry-run.**
+**Release scope: offline MVP — audit, report and conditional bootstrap dry-run.**
 Controlled lint execution is experimental and outside this release's acceptance.
 The
 [observed demo](docs/audit-demo.md) records input immutability, report parity and a
@@ -62,8 +62,9 @@ independently accepted public cases passing on Linux, Windows and macOS at the
 exact tested revision. This is execution of CI Trust's own tests, not execution
 or enforcement evidence for the workflows it audits.
 
-The [0.1.0 release notes](docs/releases/0.1.0.md) define this intentionally
-narrowed first release. [Issue #9](https://github.com/dnlrsls/ci-trust/issues/9)
+The [0.1.1 release notes](docs/releases/0.1.1.md) describe repository boundaries
+and lossless human summaries; the [first release notes](docs/releases/0.1.0.md)
+record the original offline scope. [Issue #9](https://github.com/dnlrsls/ci-trust/issues/9)
 remains open for a later execution-verification stage. No real isolated ESLint
 sensitivity, project efficacy, historical CI execution or enforcement is claimed.
 

THIRD_PARTY_NOTICES.md

@@ -1,4 +1,4 @@
-# Third-party notices for CI Trust 0.1.0
+# Third-party notices for CI Trust
 
 CI Trust source is MIT licensed; see `LICENSE`. The Go binaries also contain
 third-party software under its own terms. Preserve this file and `LICENSES/`

cmd/ci-trust/release_export_test.go

@@ -35,7 +35,7 @@ func TestNativeArchiveExport(t *testing.T) {
 	if err := command.Run(); err != nil || stderr.Len() != 0 {
 		t.Fatalf("owned native test exit: %v stdout=%q stderr=%q", err, out.Bytes(), stderr.Bytes())
 	}
-	name := "ci-trust_0.1.0_" + runtime.GOOS + "_" + runtime.GOARCH + ".zip"
+	name := "ci-trust_0.1.1_" + runtime.GOOS + "_" + runtime.GOARCH + ".zip"
 	z, err := zip.OpenReader(filepath.Join(dir, name))
 	if err != nil {
 		t.Fatalf("native archive was not retained: %v", err)
@@ -66,7 +66,7 @@ func TestNativeArchiveExport(t *testing.T) {
 	if err := json.Unmarshal(files["RELEASE.json"], &meta); err != nil {
 		t.Fatal(err)
 	}
-	if meta["version"] != "0.1.0" || meta["goos"] != runtime.GOOS || meta["goarch"] != runtime.GOARCH || meta["sha256"] != fmt.Sprintf("%x", sha256.Sum256(files[binary])) || len(files[binary]) == 0 || modes[binary].Perm() != 0755 {
+	if meta["version"] != "0.1.1" || meta["goos"] != runtime.GOOS || meta["goarch"] != runtime.GOARCH || meta["sha256"] != fmt.Sprintf("%x", sha256.Sum256(files[binary])) || len(files[binary]) == 0 || modes[binary].Perm() != 0755 {
 		t.Fatal("native binary metadata/mode mismatch")
 	}
 	for _, p := range []string{"LICENSE", "THIRD_PARTY_NOTICES.md"} {
@@ -169,7 +169,7 @@ func exportNativeArchive(t *testing.T, dir, binaryName string, binary []byte, me
 	if err = os.MkdirAll(dir, 0700); err != nil {
 		t.Fatal(err)
 	}
-	name := "ci-trust_0.1.0_" + runtime.GOOS + "_" + runtime.GOARCH + ".zip"
+	name := "ci-trust_0.1.1_" + runtime.GOOS + "_" + runtime.GOARCH + ".zip"
 	meta["archive"] = name
 	meta["archive_sha256"] = fmt.Sprintf("%x", sha256.Sum256(archive.Bytes()))
 	receipt, err := json.Marshal(meta)

cmd/ci-trust/release_test.go

@@ -26,7 +26,7 @@ func TestVersionedBinary(t *testing.T) {
 		name += ".exe"
 	}
 	binary := filepath.Join(t.TempDir(), name)
-	command := exec.Command("go", "build", "-trimpath", "-buildvcs=false", "-ldflags=-buildid= -X main.version=0.1.0", "-o", binary, ".")
+	command := exec.Command("go", "build", "-trimpath", "-buildvcs=false", "-ldflags=-buildid= -X main.version=0.1.1", "-o", binary, ".")
 	fixed := map[string]string{
 		"CGO_ENABLED": "0", "GOENV": "off", "GOFLAGS": "", "GOWORK": "off",
 		"GOTOOLCHAIN": "local", "GOOS": runtime.GOOS, "GOARCH": runtime.GOARCH,
@@ -54,7 +54,7 @@ func TestVersionedBinary(t *testing.T) {
 	}
 	before := fixtureBytes(t, root)
 	code, out, errOut := invokePublic(t, binary, nil, "--version")
-	assertPublic(t, code, out, errOut, 0, "ci-trust \"0.1.0\"\n", "")
+	assertPublic(t, code, out, errOut, 0, "ci-trust \"0.1.1\"\n", "")
 	code, out, errOut = invokePublic(t, binary, nil, "--help")
 	assertPublic(t, code, out, errOut, 0, publicHelp, "")
 	for _, args := range [][]string{
@@ -84,7 +84,7 @@ func TestVersionedBinary(t *testing.T) {
 		t.Fatal(err)
 	}
 	receipt, err := json.Marshal(map[string]string{
-		"version": "0.1.0", "go_version": runtime.Version(),
+		"version": "0.1.1", "go_version": runtime.Version(),
 		"goos": runtime.GOOS, "goarch": runtime.GOARCH,
 		"sha256": fmt.Sprintf("%x", sha256.Sum256(data)),
 	})

docs/releases/0.1.1.md

@@ -0,0 +1,65 @@
+# 0.1.1 — repository boundaries and clearer offline reports
+
+This patch improves the existing offline auditor without expanding its execution
+scope. It includes the reviewed fixes from [#113](https://github.com/dnlrsls/ci-trust/pull/113)
+and [#114](https://github.com/dnlrsls/ci-trust/pull/114). Publication and actual
+source/run/asset identities belong to the
+[GitHub release record](https://github.com/dnlrsls/ci-trust/releases/tag/v0.1.1).
+
+## What changed
+
+- Discovery stops before descending into a nested repository with its own `.git`
+  entry, including a worktree marker. The explicitly selected root remains
+  auditable, and ordinary nested packages without that marker remain included.
+  Marker contents and Git-directory pointers are not followed. Intentional
+  boundaries remain visible as `EXCLUDED_REPOSITORY` diagnostics.
+- Conditional bootstrap can preserve an otherwise valid root proposal when a
+  nested repository is outside the proposed destination. A boundary at the
+  destination itself or an ancestor still blocks the draft; unsafe inspection
+  and discovery-limit diagnostics remain conservative.
+- Human audit/report output adds deterministic groups by exact rule and
+  explanation, with escaped display text and counts of **records, not confirmed
+  defects**. Every original scoped record remains in the detailed body. JSON
+  schema-v1, machine output, exit codes and empty-findings output are unchanged.
+
+A copied source tree without a repository marker is not automatically excluded.
+Folder names are not an exclusion policy. See [discovery bounds](../discovery.md),
+[bootstrap limits](../bootstrap.md) and the [CLI contract](../cli.md).
+
+## Install and check
+
+Choose an OS/architecture actually listed on the release page, verify the ZIP
+against `SHA256SUMS`, extract it and run:
+
+```sh
+./ci-trust --version
+./ci-trust audit PATH --format json > audit.json
+./ci-trust report --input audit.json --format human
+```
+
+The expected version output is `ci-trust "0.1.1"`. On Windows invoke
+`./ci-trust.exe`. Source builds can set the version explicitly with
+`-ldflags "-X main.version=0.1.1"`; unversioned development builds remain `dev`.
+Archives include `LICENSE`, `THIRD_PARTY_NOTICES.md`, unmodified `LICENSES/` texts
+and `RELEASE.json`. No Node.js, npm, ESLint or container image is bundled.
+
+## Verification and unchanged limits
+
+The existing native Linux, Windows and macOS CI builds and tests the versioned
+binaries, checks public CLI parity and unchanged owned inputs/counters, and runs
+vet. Release distribution uses those exact retained final-main ZIPs, with
+source/run bindings, actual compiler/platform metadata and binary/archive
+hashes checked before publication. It does not distribute local reconstructed
+cross-builds. Published checksums detect byte differences, not publisher identity;
+binaries are unsigned and no Windows signing or macOS notarization is claimed.
+
+Audit/report and bootstrap dry-run do not execute target code, install packages,
+contact remote services or apply changes. Exit 0 can include findings, FAIL,
+UNKNOWN and conditional proposals: it is not proof of complete coverage, correct
+CI execution, validator efficacy or required-check enforcement.
+
+The [original offline acceptance scope](0.1.0.md) still applies. Controlled lint
+verification remains experimental and [#9](https://github.com/dnlrsls/ci-trust/issues/9)
+is deferred, not completed or a gate for this offline patch. No accepted real
+CLEAN → expected FAULT diagnostic → RESTORED sequence is claimed; no runtime
+consent, admission or isolation control is relaxed by this release.