From 7deab25093a56217927461a04860d458b93379ed Mon Sep 17 00:00:00 2001
From: Marius Ciepluch <11855163+norandom@users.noreply.github.com>
Date: Fri, 6 Nov 2026 14:11:48 +0100
Subject: [PATCH] chore(release): prepare v2.1.0-alpha.1 checkpoint

---
 CITATION.cff                  | 21 +++++++++++++++++++++
 README.md                     |  4 +++-
 RELEASE_NOTES.md              | 20 ++++++++++++++++++++
 pyproject.toml                |  2 +-
 src/openultrasast/__init__.py |  2 +-
 uv.lock                       |  2 +-
 6 files changed, 47 insertions(+), 4 deletions(-)
 create mode 100644 CITATION.cff

diff --git a/CITATION.cff b/CITATION.cff
new file mode 100644
index 0000000..627b03c
--- /dev/null
+++ b/CITATION.cff
@@ -0,0 +1,21 @@
+cff-version: 1.2.0
+message: "If you use OpenUltraSAST, please cite it using the metadata below."
+title: "OpenUltraSAST"
+type: software
+authors:
+  - family-names: "Ciepluch"
+    given-names: "M"
+version: "2.1.0-alpha.1"
+date-released: 2026-11-06
+abstract: >-
+  An experimental static security analyser for evidence-gated analysis of
+  repositories and Git pushes, including pattern rules, syntax overlays, code
+  property graphs, and optional model-assisted decisions.
+keywords:
+  - "static application security testing"
+  - "static analysis"
+  - "software security"
+  - "SAST"
+license: "Apache-2.0"
+repository-code: "https://github.com/norandom/OpenUltraSAST"
+url: "https://norandom.github.io/OpenUltraSAST/"
diff --git a/README.md b/README.md
index 57db4ad..dc2fb4b 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # OpenUltraSAST
 
+[![Zenodo](https://img.shields.io/badge/Zenodo-OpenUltraSAST-1682D4?logo=zenodo)](https://zenodo.org/account/settings/github/repository/norandom/OpenUltraSAST)
+
 OpenUltraSAST is an experimental static security analyser. It aims to check security on
 repositories it has never seen. It scans a checkout or the commits a `git push` would publish. It
 distinguishes what it can prove from what it suspects.
@@ -28,7 +30,7 @@ The site is published at <https://norandom.github.io/OpenUltraSAST/>. Its source
 
 ## Status
 
-**v2.0.1, state as of 2026-10-08.** The pre-push safety net is **not yet released**. Blocking on
+**v2.1.0-alpha.1 checkpoint, state as of 2026-11-06.** The pre-push safety net is **not yet released**. Blocking on
 the static analyser by hand is **NO-GO** against every M4 gate, and the project no longer tries to
 meet those gates that way.
 
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index 968852d..d3836bf 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,3 +1,23 @@
+# v2.1.0-alpha.1 (2026-11-06)
+
+This is an intermediate archival prerelease: a citable checkpoint for the generalized detection-core work. It
+does not enable a blocking pre-push capability, claim useful unseen-repository detection performance, or consume
+a new admission population.
+
+- **General detection core.** Adds family-neutral evidence, provenance, semantic-transition, readiness, budget,
+  model-corroboration, proof, measurement, admission, replay, and fitted-consumer contracts with strict canonical
+  identities and failure-visible validation.
+- **Reviewed family knowledge.** Migrates access-control entry knowledge behind reviewed fact-pack authority and
+  publishes the corresponding family conformance handoff without making that family a release gate.
+- **Next evaluation boundary specified.** The additive evaluation-admission V3 and valid-detection-benchmark
+  specifications define exact arm-and-scope denominators, atomic spend authority, complete replay, and durable
+  benchmark custody. These are approved implementation plans, not shipped benchmark orchestration.
+- **Citation metadata.** Adds `CITATION.cff` with M Ciepluch as the author and a Zenodo badge. The prerelease exists
+  to obtain the first archived DOI for this repository.
+
+The existing authorization arm remains parked after its recorded NO-GO result. Detection-core task 11.4 remains
+blocked on benchmark lifecycle governance and is not represented as completed by this prerelease.
+
 # v2.0.1 (2026-10-02)
 
 v2.0.0 was tagged but never published: its release job stopped at the format check (see below). v2.0.1 is
diff --git a/pyproject.toml b/pyproject.toml
index c9ef92c..cadf667 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "openultrasast"
-version = "2.0.1"
+version = "2.1.0a1"
 description = "OpenCode-oriented SAST harness for evidence-gated security analysis"
 readme = "README.md"
 license = "Apache-2.0"
diff --git a/src/openultrasast/__init__.py b/src/openultrasast/__init__.py
index d360fc2..61b55df 100644
--- a/src/openultrasast/__init__.py
+++ b/src/openultrasast/__init__.py
@@ -2,4 +2,4 @@
 
 __all__ = ["__version__"]
 
-__version__ = "2.0.1"
+__version__ = "2.1.0a1"
diff --git a/uv.lock b/uv.lock
index b76fa2b..96cc5d3 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1024,7 +1024,7 @@ wheels = [
 
 [[package]]
 name = "openultrasast"
-version = "2.0.1"
+version = "2.1.0a1"
 source = { editable = "." }
 dependencies = [
     { name = "pyyaml" },