chore(release): ship v1.1.1 to main

.gitignore

@@ -22,6 +22,7 @@
 !LICENSE
 !CHANGELOG.md
 !CONTRIBUTING.md
+!AGENTS.md
 !SECURITY.md
 !codecov.yml
 !go.mod

AGENTS.md

@@ -0,0 +1,93 @@
+# Agent Guidelines (kzero)
+
+Context and instructions for AI coding agents working on **kzero** (declarative Kubernetes workload reset CLI). See [agents.md](https://agents.md/) for the format.
+
+## Project overview
+
+- **What it is:** Go CLI that runs **out-of-band** **`down` / `up` / `reset`** pipelines from YAML — ordered scale, Helm, PVC, exec, job/cronjob, hooks, dry-run/analyze, notify, and API watchdog. Not in-cluster GitOps; bastion-first (see [docs/deployment-models.md](docs/deployment-models.md)).
+- **Entrypoint:** `cmd/kzero/main.go`. Core packages: `internal/config`, `internal/engine`, `internal/executor`, `internal/cli`, `internal/diff`, `internal/doctor`, `internal/notify`, `internal/probe`, `internal/verify`.
+- **Config contract:** [SPECIFICATIONS.md](SPECIFICATIONS.md) (root; also linked as `docs/SPECIFICATIONS.md` in some clones). Example profile: [configs/kzero.sample.yml](configs/kzero.sample.yml). Feature cookbooks: `docs/examples/`.
+- **External tools:** **`kubectl`** on `PATH` (required). **`helm`** when the profile uses `release.*` shell steps. Behavior is **configuration-first** — no product-specific playbooks hardcoded in Go (see `.cursor/rules/declarative-workflow-go.mdc` in a local clone).
+
+## Scope (product vs operator)
+
+- **This repo (`kzero`):** Go CLI, engine, validation, tests, CI, **`make release-check`**, binaries, `.deb`/`.rpm`, **`ghcr.io/hrodrig/kzero`**, Homebrew — same split as **pgwd** / **pgwd-selfhosted**.
+- **Not here:** bastion cron/systemd, `docker run` operator notes, kind e2e lab assets, reference hook scripts, in-cluster manifests → **[hrodrig/kzero-selfhosted](https://github.com/hrodrig/kzero-selfhosted)**. Do not add `run/` or operator deployment trees to this repository.
+- **`.cursor/`** is **local-only** (not committed). Shared agent and release policy belong in tracked files such as this **AGENTS.md**, **README**, and **CONTRIBUTING.md**.
+
+## Setup and build
+
+- Install deps: `go mod download`.
+- Build: **`make build`** (reads **`VERSION`**, ldflags for version/commit/date/branch). Root **`GNUmakefile`** is canonical; on **FreeBSD** use **`gmake`** via the BSD **`Makefile`** stub.
+- Install to `$GOBIN`: `make install`. Optional kubectl plugin: `make install-kubectl-plugin`.
+- Cross-compile: `make build-all` (output under `dist/`).
+
+## Test and quality commands
+
+- **Unit tests:** `make test` or `go test ./...`.
+- **Coverage:** `make cover`; gate **`make cover-check`** (total statement coverage **≥ 80%**, override `COVERAGE_MIN=` only for a documented one-off).
+- **Lint:** `make lint` (`gofmt -s`, `go vet ./...`, gocyclo ≤ 14). Fix format: `make lint-fix`.
+- **Security:** `make security` (govulncheck; filtered advisories in `.govulncheck-ignore.yaml`).
+- **Docker image scan:** `make docker-scan` (Grype on built image; requires Docker).
+- **Integration (optional):** `make test-kind` — kind cluster smoke (see `testing/kind/`).
+- **Before release:** **`make release-check`** — validates **`VERSION`** semver + man **`.TH`**, then lint, test, cover-check, security, docker-scan. **Requires Docker.**
+
+Install tooling to `$GOBIN`: `make tools` (govulncheck, gocyclo).
+
+## Git flow
+
+- **Branches:** Day-to-day work on **`develop`**. Topic branch → **PR into `develop`** (green CI, merge, delete branch). Production: **PR `develop` → `main`**, then annotated tag **`v<semver>`** on **`main`** only.
+- **Never** merge to **`main`**, create/push a release tag, or run **`make release`** / trigger GoReleaser **without explicit user approval** in the current conversation — even if `release-check` is green.
+- **Commits:** Show the proposed commit message and wait for user approval before `git commit` (see `.cursor/rules/commit-message-review.mdc` locally).
+- **Language:** English only for code, comments, commit messages, docs, and UI strings.
+
+## Version bump (on `develop`, before merge/tag)
+
+Do the **VERSION bump as a dedicated change on `develop`** after feature work lands, **before** proposing `make release-check` → merge to `main` → annotated tag. **Stop and ask** before merge/tag steps.
+
+| # | Artifact | Action |
+|---|----------|--------|
+| 1 | **`VERSION`** | New semver without `v` (e.g. `1.1.1`) |
+| 2 | **`README.md`** | Static **Version** badge `version-<semver>`; update “Shipped” / release tables if present |
+| 3 | **`CHANGELOG.md`** | Move `[Unreleased]` into `## [X.Y.Z] - YYYY-MM-DD`; update compare links at bottom |
+| 4 | **`contrib/man/man1/kzero.1`** | `.TH` line: month/year + `kzero v<VERSION>`; new CLI flags/commands |
+| 5 | **`docs/demo.gif`** | Re-record when CLI output, version string, or demo scenario changed (`bash -c "vhs docs/demo.tape"` — see [docs/README.md](docs/README.md)) |
+| 6 | **BSD ports** | `make port-freebsd-sync` and/or `make port-openbsd-sync` |
+| 7 | **`docs/ROADMAP.md`** | **Last reviewed** date; shipped highlights; tick completed bands |
+| 8 | **Gate** | `make release-check` — run only after user asks |
+| 9 | **Ship** | Merge `develop` → `main`, annotated tag `v<semver>`, push tag — **only after user explicitly approves** |
+
+**Follow-ups (other repos, after GitHub Release is green):** pin app version in **[kzero-selfhosted](https://github.com/hrodrig/kzero-selfhosted)**; marketing/install sites on GitLab (`kzero-hermesrodriguez-com`, `get-kzero-hermesrodriguez-com`) if they hard-code a release.
+
+## Man page sync
+
+Keep **`contrib/man/man1/kzero.1`** aligned with the CLI. GoReleaser gzips it for packages; **`release-check`** fails if **`.TH`** version drifts from **`VERSION`**.
+
+**Source of truth:** `internal/cli/`, `cmd/kzero/main.go`, [SPECIFICATIONS.md](SPECIFICATIONS.md).
+
+## Docker
+
+- Local image: `make docker-build` → `kzero:local`.
+- Release image: **`ghcr.io/hrodrig/kzero`** (GoReleaser on tag push). Dockerfile uses pinned Go toolchain (keep in sync with `go.mod`).
+
+## Repository structure
+
+- `cmd/kzero/` — main package and black-box CLI tests.
+- `internal/config/` — YAML load, validation, env overrides.
+- `internal/engine/` — pipeline runner, dry-run, live execution, watchdog.
+- `internal/executor/` — step types (workload, helm, pvc, exec, job, cronjob, shell, …).
+- `internal/cli/` — Cobra commands (`analyze`, `diff`, `doctor`, `down`, `up`, `reset`, …).
+- `docs/` — specifications index, examples, VHS demo (`docs/demo.tape` → `docs/demo.gif`), diagrams.
+- `contrib/` — man page, FreeBSD/OpenBSD ports, packaging helpers.
+- `testing/kind/` — optional kind e2e (not required for every PR; CI runs integration on `develop`/`main`).
+
+## Skills
+
+- **golang-pro** (`.agents/skills/golang-pro/SKILL.md` in a local clone): idiomatic Go, table-driven tests, concurrency, interfaces — use for non-trivial Go changes.
+
+## Other instructions
+
+- **README:** Keep badges and version badge in sync with **`VERSION`** (see `docs/readme-badges.md`).
+- **CHANGELOG:** User-facing changes under `[Unreleased]`; finalize on release (`.cursor/rules/changelog.mdc` locally).
+- **Supply chain:** Prefer resolving dependency work inside the clone (`go get`, `go mod tidy`, `go test ./...`). Do not disable checksum verification or use untrusted proxies unless the user explicitly accepts the risk.
+- When adding dependencies: `go mod tidy` and ensure tests still pass.

CHANGELOG.md

@@ -13,6 +13,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 [↑ Back to top](#top)
 
+## [1.1.1] - 2026-09-02
+
+### Security
+
+- **Go toolchain:** bump minimum Go to **1.26.6** (`go.mod`, `Dockerfile`) — addresses Grype **High** stdlib findings on **1.26.5** images: [GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026), [GO-2026-5972](https://pkg.go.dev/vuln/GO-2026-5972), [GO-2026-6088](https://pkg.go.dev/vuln/GO-2026-6088), [GO-2026-6090](https://pkg.go.dev/vuln/GO-2026-6090), [GO-2026-5942](https://pkg.go.dev/vuln/GO-2026-5942), and [GO-2026-6218](https://pkg.go.dev/vuln/GO-2026-6218) (**Medium**).
+
+[↑ Back to top](#top)
+
 ## [1.1.0] - 2026-08-01
 
 ### Added
@@ -472,7 +480,8 @@ First **pilot-ready** operator release: safe cluster identification, env overrid
 
 [↑ Back to top](#top)
 
-[Unreleased]: https://github.com/hrodrig/kzero/compare/v1.1.0...HEAD
+[Unreleased]: https://github.com/hrodrig/kzero/compare/v1.1.1...HEAD
+[1.1.1]: https://github.com/hrodrig/kzero/compare/v1.1.0...v1.1.1
 [1.1.0]: https://github.com/hrodrig/kzero/compare/v1.0.2...v1.1.0
 [1.0.2]: https://github.com/hrodrig/kzero/compare/v1.0.1...v1.0.2
 [1.0.1]: https://github.com/hrodrig/kzero/compare/v1.0.0...v1.0.1

Dockerfile

@@ -1,7 +1,7 @@
 # kzero — minimal runtime image (build from repo root: make docker-build)
 # Final stage uses distroless (no Alpine/BusyBox) so CVEs in wget/busybox from
 # minimal Alpine bases do not apply; CA certs are included in distroless static.
-FROM golang:1.26.5-alpine3.24 AS build
+FROM golang:1.26.6-alpine3.24 AS build
 ARG VERSION=dev
 ARG COMMIT=unknown
 ARG BUILDDATE=unknown

README.md

@@ -2,9 +2,9 @@
 
 <a id="top"></a>
 
-[![Version](https://img.shields.io/badge/version-1.1.0-blue.svg)](https://github.com/hrodrig/kzero/releases)
+[![Version](https://img.shields.io/badge/version-1.1.1-blue.svg)](https://github.com/hrodrig/kzero/releases)
 [![GitHub release](https://img.shields.io/github/v/release/hrodrig/kzero)](https://github.com/hrodrig/kzero/releases)
-[![Go](https://img.shields.io/badge/Go-1.26.5-00ADD8.svg)](https://go.dev/dl/)
+[![Go](https://img.shields.io/badge/Go-1.26.6-00ADD8.svg)](https://go.dev/dl/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
 [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/hrodrig/kzero)
 [![CI](https://github.com/hrodrig/kzero/actions/workflows/ci.yml/badge.svg)](https://github.com/hrodrig/kzero/actions/workflows/ci.yml)
@@ -16,7 +16,7 @@
 [![CodeQL](https://github.com/hrodrig/kzero/actions/workflows/codeql.yml/badge.svg)](https://github.com/hrodrig/kzero/actions/workflows/codeql.yml)
 
 
-**Repo:** [github.com/hrodrig/kzero](https://github.com/hrodrig/kzero) · **Releases:** [Releases](https://github.com/hrodrig/kzero/releases) · **DeepWiki:** [hrodrig/kzero](https://deepwiki.com/hrodrig/kzero)
+**Repo:** [github.com/hrodrig/kzero](https://github.com/hrodrig/kzero) · **Releases:** [GitHub Releases](https://github.com/hrodrig/kzero/releases) · **Spec:** [SPECIFICATIONS.md](SPECIFICATIONS.md) · **Operator:** [kzero-selfhosted](https://github.com/hrodrig/kzero-selfhosted) · **Changelog:** [CHANGELOG.md](CHANGELOG.md) · **Roadmap:** [ROADMAP.md](ROADMAP.md) · **DeepWiki:** [hrodrig/kzero](https://deepwiki.com/hrodrig/kzero)
 
 **The problem:** Platform maintenance often needs an **ordered** teardown and bring-up (scale down → wipe data → Helm uninstall → restore) — not continuous GitOps reconcile, not ad-hoc shell. When the API or data plane is unhealthy, recovery **inside** the same cluster shares the failure domain you are trying to fix: Jobs stall, logs vanish with the Pod, and alerts never leave the sick path.
 
@@ -45,7 +45,7 @@ Declarative **Kubernetes workload** orchestration: ordered **down** / **up** (an
 
 **Releases** ([GitHub Releases](https://github.com/hrodrig/kzero/releases)) ship **binaries**, **`.deb`** / **`.rpm`**, **`ghcr.io/hrodrig/kzero`**, and **Homebrew**. **Supply chain (v0.7.0+):** SPDX / CycloneDX SBOMs + Cosign on **`checksums.txt`** and GHCR — see [verify Cosign](#verify-cosign-v070). No Helm charts as release artifacts.
 
-Behavior and acceptance: **[SPECIFICATIONS.md](SPECIFICATIONS.md)**. **Shipped:** **v1.1.0** — Helm SDK **v4** (**#59**), native **`job`/`cronjob`** (**#29**), **`kzero diff`** (**#58**). Prior: **v1.0.2** (`command.shell` **#56**); **v1.0.0** — stable contract: default **`run.execution: native`** (**#32**), exit codes **0–4** (**#42**), product kind CI (**#34**), PVC/StatefulSet cookbook (**#33**) — [CHANGELOG.md](CHANGELOG.md). Mitigations: [pipeline-network-loss.md](docs/examples/pipeline-network-loss.md). Diagrams: **[docs/diagrams.md](docs/diagrams.md)**.
+Behavior and acceptance: **[SPECIFICATIONS.md](SPECIFICATIONS.md)**. **Shipped:** **v1.1.1** — Go **1.26.6** security (stdlib Grype fixes). Prior: **v1.1.0** — Helm SDK **v4** (**#59**), native **`job`/`cronjob`** (**#29**), **`kzero diff`** (**#58**); **v1.0.2** (`command.shell` **#56**); **v1.0.0** — stable contract: default **`run.execution: native`** (**#32**), exit codes **0–4** (**#42**), product kind CI (**#34**), PVC/StatefulSet cookbook (**#33**) — [CHANGELOG.md](CHANGELOG.md). Mitigations: [pipeline-network-loss.md](docs/examples/pipeline-network-loss.md). Diagrams: **[docs/diagrams.md](docs/diagrams.md)**.
 
 ## Table of contents
 
@@ -98,7 +98,7 @@ Host tooling depends on **`run.execution`** and your pipeline step types (see [S
 | Phase hooks, **`custom:`**, per-step **`pre`/`post`**, shell **`release.*`** `.sh` | **`command.shell`** (default **`/bin/sh`**; shebang ignored). Scripts must match that interpreter — on Ubuntu default **`/bin/sh`** is often **dash** (`pipefail` / `[[` fail). Opt-in **`command.shell: /bin/bash`**. See [SPEC — Hook and script interpreter](SPECIFICATIONS.md#hook-and-script-interpreter-commandshell). |
 
 - **RBAC** sufficient for the operations in your pipelines (for example **`get`/`patch`/`scale`**, PVC delete, Helm releases, pod exec)
-- **Go 1.26.5+** if you [build from source](#quick-start) (`make build`) or use [`go install`](#install-with-go)
+- **Go 1.26.6+** if you [build from source](#quick-start) (`make build`) or use [`go install`](#install-with-go)
 
 [↑ Back to top](#top)
 
@@ -143,18 +143,18 @@ Paste the block **as a whole**, or chain with `&&`, so **`apt` does not run** af
 
 ### Fixed-tag examples (copy from the release page if you prefer)
 
-| Format | Example (tag **`v1.0.0`** in the URL path; artifact basename includes the same **`v1.0.0`**) |
+| Format | Example (tag **`v1.1.1`** in the URL path; artifact basename includes the same **`v1.1.1`**) |
 |--------|------------------------------------------------------------------|
-| **`.deb`** | `curl -fsSL -o /tmp/kzero_v1.0.0_linux_amd64.deb https://github.com/hrodrig/kzero/releases/download/v1.0.0/kzero_v1.0.0_linux_amd64.deb` then `sudo apt install /tmp/kzero_v1.0.0_linux_amd64.deb` |
-| **`.rpm`** | `curl -fsSLO https://github.com/hrodrig/kzero/releases/download/v1.0.0/kzero_v1.0.0_linux_amd64.rpm` then `sudo rpm -Uvh kzero_v1.0.0_linux_amd64.rpm` or `sudo dnf install ./kzero_v1.0.0_linux_amd64.rpm` |
-| **`.tar.gz` (Linux)** | `curl -fsSLO https://github.com/hrodrig/kzero/releases/download/v1.0.0/kzero_v1.0.0_linux_amd64.tar.gz` then `tar xzf kzero_v1.0.0_linux_amd64.tar.gz` and run **`./kzero`** from the extracted tree (see **`share/examples/kzero/kzero.sample.yml`**) |
-| **`.tar.gz` (macOS)** | `curl -fsSLO https://github.com/hrodrig/kzero/releases/download/v1.0.0/kzero_v1.0.0_darwin_amd64.tar.gz` (or **`…_darwin_arm64.tar.gz`** on Apple silicon) |
+| **`.deb`** | `curl -fsSL -o /tmp/kzero_v1.1.1_linux_amd64.deb https://github.com/hrodrig/kzero/releases/download/v1.1.1/kzero_v1.1.1_linux_amd64.deb` then `sudo apt install /tmp/kzero_v1.1.1_linux_amd64.deb` |
+| **`.rpm`** | `curl -fsSLO https://github.com/hrodrig/kzero/releases/download/v1.1.1/kzero_v1.1.1_linux_amd64.rpm` then `sudo rpm -Uvh kzero_v1.1.1_linux_amd64.rpm` or `sudo dnf install ./kzero_v1.1.1_linux_amd64.rpm` |
+| **`.tar.gz` (Linux)** | `curl -fsSLO https://github.com/hrodrig/kzero/releases/download/v1.1.1/kzero_v1.1.1_linux_amd64.tar.gz` then `tar xzf kzero_v1.1.1_linux_amd64.tar.gz` and run **`./kzero`** from the extracted tree (see **`share/examples/kzero/kzero.sample.yml`**) |
+| **`.tar.gz` (macOS)** | `curl -fsSLO https://github.com/hrodrig/kzero/releases/download/v1.1.1/kzero_v1.1.1_darwin_amd64.tar.gz` (or **`…_darwin_arm64.tar.gz`** on Apple silicon) |
 
 **Update:** download a newer release and run the same install command again (`rpm -Uvh`, `apt install` over the `.deb`, or replace the tarball tree).
 
-**Windows:** use the **`.zip`** asset for your arch (for example **`kzero_v1.0.0_windows_amd64.zip`**), unpack, run **`kzero.exe`** where **`kubectl`** is available.
+**Windows:** use the **`.zip`** asset for your arch (for example **`kzero_v1.1.1_windows_amd64.zip`**), unpack, run **`kzero.exe`** where **`kubectl`** is available.
 
-**Docker:** `docker pull ghcr.io/hrodrig/kzero:v1.0.0` (match the image tag to the **[release](https://github.com/hrodrig/kzero/releases)** you want). Published images use **`gcr.io/distroless/static-debian13:nonroot`** (static **`kzero`** binary only: no shell, no BusyBox/Alpine runtime). **`Dockerfile`** in this repo uses the same final stage. Package: [ghcr.io/hrodrig/kzero](https://github.com/hrodrig/kzero/pkgs/container/kzero).
+**Docker:** `docker pull ghcr.io/hrodrig/kzero:v1.1.1` (match the image tag to the **[release](https://github.com/hrodrig/kzero/releases)** you want). Published images use **`gcr.io/distroless/static-debian13:nonroot`** (static **`kzero`** binary only: no shell, no BusyBox/Alpine runtime). **`Dockerfile`** in this repo uses the same final stage. Package: [ghcr.io/hrodrig/kzero](https://github.com/hrodrig/kzero/pkgs/container/kzero).
 
 **Homebrew** and **BSD packaging** helpers: see **[Install or update](#install-or-update)** and **`contrib/README.md`**.
 
@@ -225,13 +225,13 @@ If you installed from **[Releases](#install-or-update)** or **`go install`** (be
 
 ### Install with Go
 
-From any machine with Go **1.26.5+** (installs to `$(go env GOPATH)/bin`; ensure that directory is on your `PATH`):
+From any machine with Go **1.26.6+** (installs to `$(go env GOPATH)/bin`; ensure that directory is on your `PATH`):
 
 ```bash
 go install github.com/hrodrig/kzero/cmd/kzero@latest
 ```
 
-Use a **release tag** instead of `@latest` if you want a pinned version (for example `@v1.0.0`). Module reference: [pkg.go.dev/github.com/hrodrig/kzero](https://pkg.go.dev/github.com/hrodrig/kzero).
+Use a **release tag** instead of `@latest` if you want a pinned version (for example `@v1.1.1`). Module reference: [pkg.go.dev/github.com/hrodrig/kzero](https://pkg.go.dev/github.com/hrodrig/kzero).
 
 **End-to-end operator profile** (maintenance reset: truncate, Helm infra, PVC wipe, **`infra_probe`**, notify): **[kzero-selfhosted — full-reset-example](https://github.com/hrodrig/kzero-selfhosted/tree/main/run/examples/full-reset-example)** with [validation runbook](https://github.com/hrodrig/kzero-selfhosted/blob/main/run/docs/full-reset-validation.md).
 

ROADMAP.md

@@ -9,7 +9,7 @@ This file is the **in-repo** source of truth for **planned** work and known gaps
 
 When a roadmap item ships, update **CHANGELOG** and tick or remove the item here (or move it to a “Completed” subsection with the release tag).
 
-**Last reviewed:** 2026-08-01 (**v1.1.0** shipped on develop: **#59** Helm v4, **#29** job/cronjob MVP, **#58** `diff`, grpc **v1.82.1**; next: tag **`v1.1.0`**; follow-ups **#29b** / **#57** deferred / **#55** parked)
+**Last reviewed:** 2026-09-02 (**v1.1.1** security: Go **1.26.6**; **v1.1.0** shipped **#59** Helm v4, **#29** job/cronjob MVP, **#58** `diff`; follow-ups **#29b** / **#57** deferred / **#55** parked; brainstorm backlog TBD)
 
 ### Versioning note
 
@@ -78,6 +78,7 @@ The v1 engine runs **`deployment` / `statefulset`** steps via **`run.execution`*
 | **1.0.1** | **Retry:** classify **`connection lost`** / **`http2: client connection lost`** as transient for live step retry and shell **`ErrTransient`**. |
 | **1.0.2** | **`command.shell`** (#56) opt-in hook/script interpreter; pin **`golang.org/x/crypto` v0.54.0** + Grype ignore hygiene (GO-2026-5932 until Helm v4 #59); README badge/docs hygiene. |
 | **1.1.0** | **Helm SDK v4** (#59); native **`job`/`cronjob`** (#29 MVP); **`kzero diff --phase`** (#58); **`google.golang.org/grpc` v1.82.1** (Dependabot #8). |
+| **1.1.1** | **Security patch:** Go **1.26.6** (stdlib Grype **High**/**Medium** on **1.26.5** images). |
 
 ---
 

VERSION

@@ -1 +1 @@
-1.1.0
+1.1.1

contrib/freebsd/Makefile

@@ -1,5 +1,5 @@
 PORTNAME=	kzero
-PORTVERSION=	1.1.0
+PORTVERSION=	1.1.1
 DISTVERSIONPREFIX=	v
 CATEGORIES=	sysutils
 # Local test before release: copy the tarball into DISTDIR (see `make -V DISTDIR`