[cemililik]

Summary

Release v0.11.1 — "Fail Closed": promote development to main, then tag the merge commit v0.11.1. publish.yml publishes to PyPI once the pypi environment deployment is approved.

This release is numbered as a patch by a maintainer decision, as a one-time exception. Under docs/standards/release.md's bump table this cycle would be 0.12.0, because it carries eleven breaking changes and new features. The rules are unchanged. The exception is recorded in three places:

• at the head of the [0.11.1] section in CHANGELOG.md;
• in the release record (docs/roadmap/releases.md);
• in the 2026-10-23 addendum to docs/roadmap/risks-and-decisions.md, against Phase 16 decision C-20.

A pin such as forgelm~=0.11.0 picks this release up.

What main gains

main already holds everything up to #1058 through #1061. This pull request adds:

Commit / PR	What
#1062	The PII-masking and GDPR-erasure manual pages (EN + TR) show the real ingest and audit output and drop the "identifier never leaves the terminal" claim. Invisible characters in string literals are written as escapes; this fixes CodeFactor's Bandit B613 failure on #1061.
#1063	The sync of #1061's merge commit back into development, and chore: release v0.11.1 — Fail Closed: CHANGELOG section, pyproject.toml 0.11.1, release record, site version literals, notebook pins.

The full content of the release since v0.11.0 is in CHANGELOG.md under [0.11.1], with a summary in docs/roadmap/releases.md. It has:

• eleven breaking changes;
• the .sha256 export sidecar, the issue triage and dependency gates, governance files and Dependabot;
• retention:-only purge --check-policy configs;
• corrected GDPR, PII, retention and site documentation;
• fixes for transformers 5, Llama-Guard, SLERP and the judge parser.

__api_version__ is 1.2.0.

What merging this does

• It republishes the website. site-deploy.yml runs because this touches site/ (the version literals) and docs/usermanuals/ (fix: correct two user-manual examples; write invisible characters as escapes #1062).
• Nothing reaches PyPI until the tag. After merging:
  • tag the merge commit with a GPG-signed v0.11.1 and push only the tag;
  • approve the pypi deployment of publish.yml, which builds, runs the 12-combination cross-OS install matrix and publishes.

Notes for reviewers

• Merge method: a merge commit, which the Main: preserve branch history ruleset requires. Afterwards, bring main back into development with a synchronization pull request (merge commit), and open the next development cycle ([Unreleased] already exists; pyproject.toml moves to the next rc version).
• Not in this release: Phase 16 steps S4–S16 and the remaining Wave 0 items.

Type

• CI / infrastructure (release)

Testing

• CI on development at the head of this pull request; see the checks below.
• On the release commit 531cb0e:
  • the full local gauntlet passed (32 steps, 6,671 passed);
  • the sdist and wheel built from a clean export both carry Version: 0.11.1;
  • the installed wheel prints ForgeLM 0.11.1 and passes the config_template.yaml dry run.

Checklist

• CHANGELOG section [0.11.1] — 2026-10-23
• Release record written before the tag (check_release_record_sync.py --strict)
• Site version and notebook pins at 0.11.1

🤖 Generated with Claude Code

Summary by Sourcery

Release ForgeLM v0.11.1 with fail-closed evaluation and validation behavior, corrected compatibility and compliance documentation, and strengthened project governance and CI safeguards.

New Features:

• Add fail-closed validation and evidence handling across configuration, benchmark, safety, judge, and cache workflows.
• Add valid JSON serialization for ForgeLM artifacts and expose clearer gate, error, and revert outcomes.
• Add the LLM-judge minimum-valid-evidence configuration and new governance, security, contributor, and CI safeguards.

Bug Fixes:

• Correct transformer 5 compatibility, Llama-Guard scoring, SLERP adapter preservation, export verification sidecars, and retention-only purge configurations.
• Correct GDPR, PII, retention, and site documentation to match actual behavior.

Enhancements:

• Bump the package and public API versions to 0.11.1 and 1.2.0, respectively, while recording the one-time patch-version exception and Phase 16 release scope.
• Update roadmap, release records, website version metadata, and notebook pins for the v0.11.1 release.

Build:

• Raise dependency floors to address published transformer advisories and update release metadata.

CI:

• Add a CI guard that detects failure masking in workflows, scripts, and validation commands.

Deployment:

• Prepare the v0.11.1 release and associated site publication metadata.

Documentation:

• Add the v0.11.1 changelog and release record, update roadmap decisions, and refresh English and Turkish compliance and PII-masking guidance.

Tests:

• Expand the release validation baseline and update tests for escaped invisible-character handling.

Chores:

• Add governance, maintainer, citation, Dependabot, private security reporting, issue triage, and dependency-gating project files.

[coldtea-pr-lens]

Note

The title starts with Release, so PR Lens left this pull request undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}

[sourcery-ai]

Sorry @cemililik, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 2 days and 17 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Essentials
• Run ID: dcf9dd6a-7975-42fc-9b21-027363ad9586

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's Guide

This release packages the previously implemented fail-closed validation and evaluation behavior as v0.11.1, records its exceptional patch numbering and Phase 16 scope, and synchronizes release-facing documentation, site versions, and notebook pins; the diff shown is primarily release metadata, documentation corrections, and invisible-character normalization rather than the underlying gate implementations.

Sequence diagram for the v0.11.1 fail-closed release

sequenceDiagram
    participant Maintainer
    participant Development
    participant Main
    participant SiteDeploy as site-deploy.yml
    participant Publish as publish.yml
    participant PyPI

    Maintainer->>Main: Merge development with merge commit
    Main->>SiteDeploy: Trigger site deployment for site and docs changes
    SiteDeploy-->>Main: Website republished
    Maintainer->>Main: Create GPG-signed tag v0.11.1
    Maintainer->>Publish: Push tag and approve pypi deployment
    Publish->>Publish: Build package and run cross-OS install matrix
    Publish->>PyPI: Publish v0.11.1

Loading

File-Level Changes

Change	Details	Files
Promote the release metadata and documentation for v0.11.1, including the one-time patch-version exception and partial Phase 16 delivery.	Set the package version to 0.11.1 and API version to 1.2.0. Add changelog, release record, roadmap, and decision-log entries documenting the eleven breaking changes and exception. Update site version markers, quickstart pins, and notebook installation pins. Replace invisible characters in literals with escaped forms without changing behavior.	CHANGELOG.md docs/roadmap.md docs/roadmap-tr.md docs/roadmap/phase-16-trust-surface-hardening.md docs/roadmap/releases.md docs/roadmap/risks-and-decisions.md forgelm/_version.py forgelm/ingestion.py pyproject.toml notebooks/data_curation.ipynb notebooks/dpo_alignment.ipynb notebooks/galore_memory_optimization.ipynb notebooks/grpo_reasoning.ipynb notebooks/ingestion_playground.ipynb notebooks/kto_binary_feedback.ipynb notebooks/multi_dataset.ipynb notebooks/post_training_workflow.ipynb notebooks/quickstart_sft.ipynb notebooks/safety_evaluation.ipynb notebooks/synthetic_data_training.ipynb site/compliance.html site/contact.html site/features.html site/guide.html site/index.html site/js/translations.js site/privacy.html site/quickstart.html site/terms.html tests/test_ingestion_reliability.py tests/test_issue_dependencies.py tests/test_safety_advanced.py
Correct the English and Turkish manuals to reflect actual PII ingestion, audit, and GDPR-erasure behavior.	Show real ingest and audit output using raw versus masked corpora. Clarify that identifiers are entered on the command line, salted digests are audited, and reverse-Pii output is unmasked.	docs/usermanuals/en/compliance/gdpr-erasure.md docs/usermanuals/en/data/pii-masking.md docs/usermanuals/tr/compliance/gdpr-erasure.md docs/usermanuals/tr/data/pii-masking.md

Possibly linked issues

• #Wave 4: The PR documents v0.11.1’s breaking changes in the changelog and release record, addressing CR-A16-057’s recommended documentation alternative.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.