Prepare v0.6.1 summary-reader hardening release

CHANGELOG.md

@@ -4,6 +4,10 @@ Notable user-visible changes are recorded here, newest first.
 
 ## Unreleased
 
+## [0.6.1] - 2026-10-11
+
+See the [release notes](docs/releases/v0.6.1.md) for upgrade details.
+
 - Upgrade llm-sketchkit to v0.2.3 for parser allocation limits, more efficient
   summary combination and safer secret/error diagnostics. Keep the existing
   x/text v0.41.0 normalization dependency, identities and summary wire format.

SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported Versions
 
-Security fixes target the latest patch in the `0.5.x` release line and `main`.
+Security fixes target the latest patch in the `0.6.x` release line and `main`.
 Use the newest patch and record its version and revision when running trials.
 Older patches and development snapshots do not receive routine backports.
 Dependencies and the Go toolchain are reviewed on an ongoing basis.

docs/OPERATIONS.md

@@ -8,7 +8,7 @@ unprivileged. All input and output stays on your machine.
 
 The initial supported targets are Linux and macOS on AMD64 and ARM64. Native
 Windows binaries are not provided. Download a binary from the
-[release page](https://github.com/llm-measurement/fleetdiff/releases/tag/v0.6.0).
+[release page](https://github.com/llm-measurement/fleetdiff/releases/tag/v0.6.1).
 Go is not needed to run it. The commands below use `curl` for downloading and
 the [GitHub CLI](https://cli.github.com/) for provenance verification.
 
@@ -20,7 +20,7 @@ subshell stops on any download or verification failure:
 ```sh
 (
 set -eu
-version=v0.6.0
+version=v0.6.1
 case "$(uname -s)" in
   Linux) os=linux ;;
   Darwin) os=darwin ;;
@@ -54,7 +54,7 @@ From a reviewed repository checkout, the same download and verification steps
 are available as a script (no Go compiler needed):
 
 ```sh
-sh scripts/install.sh v0.6.0 ./fleetdiff-install
+sh scripts/install.sh v0.6.1 ./fleetdiff-install
 ./fleetdiff-install/fleetdiff --version
 ```
 
@@ -65,7 +65,7 @@ curl --fail --location --proto '=https' --tlsv1.2 \
   https://raw.githubusercontent.com/llm-measurement/fleetdiff/e75518e1b62ead77a6870cfeabd3ddae944a1e0a/scripts/install.sh \
   --output fleetdiff-install.sh
 less fleetdiff-install.sh
-sh fleetdiff-install.sh v0.6.0 ./fleetdiff-install
+sh fleetdiff-install.sh v0.6.1 ./fleetdiff-install
 ./fleetdiff-install/fleetdiff --version
 ```
 
@@ -115,7 +115,7 @@ Install a published version with a currently patched Go 1.26 or later toolchain:
 go install github.com/llm-measurement/fleetdiff/cmd/fleetdiff@latest
 ```
 
-Use `@v0.6.0` instead of `@latest` to pin that release. The binary is installed
+Use `@v0.6.1` instead of `@latest` to pin that release. The binary is installed
 under `GOBIN`, or `$(go env GOPATH)/bin` when unset; put that directory on `PATH`.
 This path uses Go module verification rather than the archive attestation above,
 and does not include unreleased checkout features.
@@ -136,7 +136,7 @@ Check `--version` on the binary you actually run:
 | Build | Version | Revision |
 |---|---|---|
 | Unstamped checkout build above | Go's embedded module/VCS version, or `dev` when unavailable | `unknown` |
-| Tagged `go install ...@v0.6.0` | `v0.6.0`, from Go's module metadata | `unknown` |
+| Tagged `go install ...@v0.6.1` | `v0.6.1`, from Go's module metadata | `unknown` |
 | Verified release archive | Stamped release version | Stamped source revision |
 
 A checkout may report a pseudo-version and `+dirty`, depending on the Go toolchain

docs/releases/v0.6.1.md

@@ -0,0 +1,29 @@
+# v0.6.1 Release Notes
+
+This patch brings llm-sketchkit v0.2.3 hardening to fleetdiff's summary readers:
+parser allocation limits, more efficient summary combination, and safer
+secret and error diagnostics.
+
+## Compatibility
+
+Existing identities, summary wire formats and accounting remain unchanged.
+The build keeps `golang.org/x/text` v0.41.0. This is the identity-preserving
+sketchkit backport, not its v0.3.0 migration. Readers reject oversized or malformed
+encodings according to sketchkit's
+[resource limits](https://github.com/llm-measurement/llm-sketchkit/blob/v0.2.3/docs/OPERATIONS.md).
+
+The LiteLLM spend importer and the summary, trace and configuration commands
+keep their v0.6.0 behavior. Replace the verified executable; no collector
+upgrade, key rotation or window reset is required.
+
+## Install And Verify
+
+Use the [verified installer](../OPERATIONS.md#install-and-verify) with
+`v0.6.1`, or verify the release archives before extracting them. Linux and macOS
+archives cover AMD64 and ARM64, built with Go 1.26.9, with dependency licenses,
+checksums, an SBOM and signed build provenance.
+
+The release workflow tests the packaged commands on all four platforms and
+exercises the pinned LiteLLM SQL export through the packaged importer. The
+installer's default is now v0.6.1. Release automation and the synthetic capture
+recipe also include the reviewed dependency updates merged since v0.6.0.

scripts/install.sh

@@ -6,11 +6,11 @@ umask 077
 
 usage() {
   printf '%s\n' 'Usage: sh scripts/install.sh [VERSION [NEW_DIRECTORY]]' \
-    'Defaults: v0.6.0 ./fleetdiff-install. Requires curl, gh, shasum, and tar.'
+    'Defaults: v0.6.1 ./fleetdiff-install. Requires curl, gh, shasum, and tar.'
 }
 case "${1:-}" in --help|-h) usage; exit 0 ;; esac
 if [ "$#" -gt 2 ]; then usage >&2; exit 2; fi
-version=${1-v0.6.0}
+version=${1-v0.6.1}
 destination=${2-./fleetdiff-install}
 case "$version" in
   ''|*[!a-zA-Z0-9.-]*) printf '%s\n' 'Supply a release version such as v0.3.0.' >&2; exit 2 ;;

scripts/install_test.go

@@ -15,7 +15,7 @@ import (
 	"testing"
 )
 
-const installTestVersion = "v0.6.0"
+const installTestVersion = "v0.6.1"
 
 func TestInstallDefaultVersion(t *testing.T) {
 	root, env := installEnvironment(t, "Darwin", "arm64", "darwin_arm64", "")