chore(release): prepare v2.1.0-alpha.1 checkpoint

CITATION.cff

@@ -0,0 +1,21 @@
+cff-version: 1.2.0
+message: "If you use OpenUltraSAST, please cite it using the metadata below."
+title: "OpenUltraSAST"
+type: software
+authors:
+  - family-names: "Ciepluch"
+    given-names: "M"
+version: "2.1.0-alpha.1"
+date-released: 2026-11-06
+abstract: >-
+  An experimental static security analyser for evidence-gated analysis of
+  repositories and Git pushes, including pattern rules, syntax overlays, code
+  property graphs, and optional model-assisted decisions.
+keywords:
+  - "static application security testing"
+  - "static analysis"
+  - "software security"
+  - "SAST"
+license: "Apache-2.0"
+repository-code: "https://github.com/norandom/OpenUltraSAST"
+url: "https://norandom.github.io/OpenUltraSAST/"

README.md

@@ -1,5 +1,7 @@
 # OpenUltraSAST
 
+[![Zenodo](https://img.shields.io/badge/Zenodo-OpenUltraSAST-1682D4?logo=zenodo)](https://zenodo.org/account/settings/github/repository/norandom/OpenUltraSAST)
+
 OpenUltraSAST is an experimental static security analyser. It aims to check security on
 repositories it has never seen. It scans a checkout or the commits a `git push` would publish. It
 distinguishes what it can prove from what it suspects.
@@ -28,7 +30,7 @@ The site is published at <https://norandom.github.io/OpenUltraSAST/>. Its source
 
 ## Status
 
-**v2.0.1, state as of 2026-10-08.** The pre-push safety net is **not yet released**. Blocking on
+**v2.1.0-alpha.1 checkpoint, state as of 2026-11-06.** The pre-push safety net is **not yet released**. Blocking on
 the static analyser by hand is **NO-GO** against every M4 gate, and the project no longer tries to
 meet those gates that way.
 

RELEASE_NOTES.md

@@ -1,3 +1,23 @@
+# v2.1.0-alpha.1 (2026-11-06)
+
+This is an intermediate archival prerelease: a citable checkpoint for the generalized detection-core work. It
+does not enable a blocking pre-push capability, claim useful unseen-repository detection performance, or consume
+a new admission population.
+
+- **General detection core.** Adds family-neutral evidence, provenance, semantic-transition, readiness, budget,
+  model-corroboration, proof, measurement, admission, replay, and fitted-consumer contracts with strict canonical
+  identities and failure-visible validation.
+- **Reviewed family knowledge.** Migrates access-control entry knowledge behind reviewed fact-pack authority and
+  publishes the corresponding family conformance handoff without making that family a release gate.
+- **Next evaluation boundary specified.** The additive evaluation-admission V3 and valid-detection-benchmark
+  specifications define exact arm-and-scope denominators, atomic spend authority, complete replay, and durable
+  benchmark custody. These are approved implementation plans, not shipped benchmark orchestration.
+- **Citation metadata.** Adds `CITATION.cff` with M Ciepluch as the author and a Zenodo badge. The prerelease exists
+  to obtain the first archived DOI for this repository.
+
+The existing authorization arm remains parked after its recorded NO-GO result. Detection-core task 11.4 remains
+blocked on benchmark lifecycle governance and is not represented as completed by this prerelease.
+
 # v2.0.1 (2026-10-02)
 
 v2.0.0 was tagged but never published: its release job stopped at the format check (see below). v2.0.1 is

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "openultrasast"
-version = "2.0.1"
+version = "2.1.0a1"
 description = "OpenCode-oriented SAST harness for evidence-gated security analysis"
 readme = "README.md"
 license = "Apache-2.0"

src/openultrasast/__init__.py

@@ -2,4 +2,4 @@
 
 __all__ = ["__version__"]
 
-__version__ = "2.0.1"
+__version__ = "2.1.0a1"

uv.lock

@@ -1024,7 +1024,7 @@ wheels = [
 
 [[package]]
 name = "openultrasast"
-version = "2.0.1"
+version = "2.1.0a1"
 source = { editable = "." }
 dependencies = [
     { name = "pyyaml" },