The first frozen research release since 0.10.0 (issue #390): an exact commit that the paper, external replication and citation can reference instead of a moving master.

Frozen identity

• Commit: 340a5633bc21e2a6c810b2255273a15148410805
• Tag: annotated. Not GPG-signed — no signing key is configured in the release environment; this note states it rather than implying otherwise.
• All five mandatory CI workflows green on this exact commit: Deterministic Test Suite (run 32892286851), Quality Gates (32892286742), Supply Chain incl. SBOM + pip/npm audit + secret scan (32892286734), CodeQL (32892286863), Shadow Replay Smoke (32892286746).
• Test evidence at the tag: 6081 passed, 14 skipped (local, three consecutive green full runs); the CI matrix runs the deterministic suite on Python 3.12/3.13/3.14.

Artifacts (built from the tag)

8a67b19a1ebe27eb3cd6f13f484a8252a42b84f74a18aebeec0f0ef5f7a04f52 *remora-0.11.0-py3-none-any.whl
3e693c4620f86258983b2f0137afc21aa40a0d7f623e9876a8b7277b76135387 *remora-0.11.0.tar.gz

SBOMs for the Python and frontend dependency trees are produced by the Supply Chain workflow on this commit (run 32892286734).

What changed

See CHANGELOG.md § 0.11.0: cross-tenant hard-abstain, per-component trust-base coverage declaration, clock-consistent lease verification and in-memory-database refusal, the runtime exception taxonomy, no-silent-fallback observability, structural tracing, content-based capability freshness, the shipped-surfaces matrix, and CodeQL triage to zero open security-severity alerts.

Pending, tracked in #390

• doi: Zenodo archive of this tag (author account action).
• orcid in CITATION.cff: requires the author's ORCID iD.
• The paper's reproducibility pointer moves from review-v1 to this tag as part of the paper reframe (#389).