legendko · Oct 19, 2026 · Oct 19, 2026 · Oct 19, 2026
diff --git a/gen/python/pyproject.toml b/gen/python/pyproject.toml
@@ -9,7 +9,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fora-protocol"
-version = "1.0.8"
+version = "1.1.0"
 description = "Generated types export for Python: Pydantic v2 models (wire.models, extending wire.base.WireModel), registered vocabulary constants (vocab.*) and the published per-message JSON Schemas (wire.schemas.load), generated from the proto via JSON Schema."
 readme = "README.md"
 requires-python = ">=3.9"

diff --git a/gen/ts/package-lock.json b/gen/ts/package-lock.json
diff --git a/gen/ts/package.json b/gen/ts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@fora-protocol/sdk-types",
-  "version": "1.0.8",
+  "version": "1.1.0",
   "private": true,
   "description": "Generated TypeScript types export: Zod schemas (./wire/schemas) + vocabulary constants (./vocab/*), generated from the proto via JSON Schema. Not published on its own: it ships inside @fora-protocol/sdk (built by sdk/ts/scripts/build.mjs), which exports these subpaths unchanged.",
   "license": "Apache-2.0",

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@fora-protocol/sdk-l1",
-  "version": "1.0.8",
+  "version": "1.1.0",
   "private": true,
   "type": "module",
   "sideEffects": false,

diff --git a/proto/CHANGELOG.md b/proto/CHANGELOG.md
@@ -1,6 +1,6 @@
 # FORA Protocol Changelog
 
-## Unreleased
+## v1.1.0
 
 ### Breaking against v1.0.8
 

diff --git a/sdk/python/pyproject.toml b/sdk/python/pyproject.toml
@@ -120,7 +120,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fora-protocol-sdk"
-version = "1.0.8"
+version = "1.1.0"
 description = "FORA protocol SDK for Python: the IO-free protocol mechanics (thumbprint, signed-URL verification, RFC 9421 request signing and verification, offer and acceptance signatures, cross-field validation), the key and endpoint resolvers and the Connect-unary JSON client."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -131,7 +131,7 @@ dependencies = [
   # fora-protocol. Pinned exactly: both distributions are built from the same
   # tag and the release workflow refuses a tag whose version differs from this
   # pin (scripts/release/check-versions.py).
-  "fora-protocol==1.0.8",
+  "fora-protocol==1.1.0",
   "cryptography>=44",
   # Maintained HTTP client for the L2 fetching resolvers (WBA / well-known
   # directory GETs). It owns the response state machine (status, redirects, 1xx,

diff --git a/sdk/python/uv.lock b/sdk/python/uv.lock
diff --git a/sdk/ts/package-lock.json b/sdk/ts/package-lock.json
diff --git a/sdk/ts/package.json b/sdk/ts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@fora-protocol/sdk-l1",
-  "version": "1.0.8",
+  "version": "1.1.0",
   "private": true,
   "description": "FORA protocol SDK for TypeScript — the IO-free protocol mechanics (signing, verification, canonicalization) plus the IO tiers built on them: the key/endpoint resolvers and the Connect-unary JSON client. Exposed at the repo root so plain npm — which has no git-subdirectory support — can pin the TS SDK by commit as a whole-repo git dependency (parity with the Go/pip git+subdir+rev pins). Re-exports sdk/ts, which compiles the in-repo gen/ts by relative path. Self-contained packaging and npm publish are not yet implemented.",
   "type": "module",

diff --git a/website/src/content/docs/protocol/authentication.mdx b/website/src/content/docs/protocol/authentication.mdx
@@ -88,7 +88,7 @@ The rules that make both true are in [The Web Bot Auth Profile](#the-web-bot-aut
 WBA establishes identity: this bot is who it claims to be. FORA adds the transaction layer on top of that identity: this bot is authorised to access this content at this price.
 
 :::caution[Profile change in progress]
-The next SDK release implements this profile in Go, Python and TypeScript. The SDKs released as v1.0.8 do not. They send `Signature-Agent` as a bare, unquoted URL rather than a dictionary, set no `tag`, generate a 16-byte nonce, and refuse any signature that does not cover all five FORA components. The reference implementation's directories are served as `application/jwk-set+json` and unsigned until it adopts that release. The change is a hard cut with no transition window: verifiers of the new release refuse the bare unquoted `Signature-Agent` that v1.0.8 sends and a directory served under the old media type, so a v1.0.8 client must upgrade to keep working. The SDKs and the reference implementation change together; the [changelog](/reference/changelog/) lists each difference.
+The SDKs released as v1.1.0 implement this profile in Go, Python and TypeScript. The SDKs released as v1.0.8 do not. They send `Signature-Agent` as a bare, unquoted URL rather than a dictionary, set no `tag`, generate a 16-byte nonce, and refuse any signature that does not cover all five FORA components. The reference implementation's directories are served as `application/jwk-set+json` and unsigned until it adopts that release. The change is a hard cut with no transition window: verifiers from v1.1.0 refuse the bare unquoted `Signature-Agent` that v1.0.8 sends and a directory served under the old media type, so a v1.0.8 client must upgrade to keep working. The SDKs and the reference implementation change together; the [changelog](/reference/changelog/) lists each difference.
 :::
 
 #### Where FORA departs from WG-00

diff --git a/website/src/content/docs/protocol/standards-layering.mdx b/website/src/content/docs/protocol/standards-layering.mdx
@@ -33,7 +33,7 @@ C2PA and FORA are orthogonal: C2PA proves **what content IS** (provenance, creat
 
 The IETF [webbotauth working group](https://datatracker.ietf.org/wg/webbotauth/about/) is standardising cryptographic bot identity: bots sign HTTP requests with RFC 9421 HTTP Message Signatures and publish their keys in a directory at a well-known path. Its only adopted document is [draft-ietf-webbotauth-httpsig-protocol-00](https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/00/) (1 September 2026), and that version is the one FORA targets.
 
-Every FORA request signature is a conformant signature under that draft, so a CDN or origin that verifies Web Bot Auth can verify a FORA agent without FORA-specific integration. In the other direction, FORA accepts signatures from any Web Bot Auth library, with or without `alg`, provided that on a FORA RPC the signature also covers the request method, target URI, body digest and `Authorization` header, its key is Ed25519, and the signer's key directory meets the rules where FORA departs from the draft. FORA asks for those components through Web Bot Auth's own `Accept-Signature` mechanism. Conformance does not come from sharing the cryptography: it depends on the header forms, the covered components, the signature parameters and the directory format, which [Authentication](/protocol/authentication/#the-web-bot-auth-profile) specifies, together with the [three places FORA departs from the draft](/protocol/authentication/#where-fora-departs-from-wg-00), all in the key directory. The SDKs released as v1.0.8 do not implement that profile yet, and Authentication lists the differences. Web Bot Auth solves identity (Layer 2); FORA adds the transaction layer (Layer 4) on top of that identity.
+Every FORA request signature is a conformant signature under that draft, so a CDN or origin that verifies Web Bot Auth can verify a FORA agent without FORA-specific integration. In the other direction, FORA accepts signatures from any Web Bot Auth library, with or without `alg`, provided that on a FORA RPC the signature also covers the request method, target URI, body digest and `Authorization` header, its key is Ed25519, and the signer's key directory meets the rules where FORA departs from the draft. FORA asks for those components through Web Bot Auth's own `Accept-Signature` mechanism. Conformance does not come from sharing the cryptography: it depends on the header forms, the covered components, the signature parameters and the directory format, which [Authentication](/protocol/authentication/#the-web-bot-auth-profile) specifies, together with the [three places FORA departs from the draft](/protocol/authentication/#where-fora-departs-from-wg-00), all in the key directory. The SDKs implement that profile from v1.1.0; those released as v1.0.8 do not, and Authentication lists the differences. Web Bot Auth solves identity (Layer 2); FORA adds the transaction layer (Layer 4) on top of that identity.
 
 ## How They Compose
 

diff --git a/website/src/content/docs/reference/changelog.mdx b/website/src/content/docs/reference/changelog.mdx
@@ -6,7 +6,7 @@ description: "FORA protocol changelog"
 This page contains curated public release notes. For the exhaustive maintainer
 and protocol history, see [`proto/CHANGELOG.md`](https://github.com/FORA-Protocol/protocol/blob/main/proto/CHANGELOG.md).
 
-## Unreleased
+## v1.1.0
 
 ### Breaking against v1.0.8