[djh58]

Summary

This PR prepares v1.1.0-rc1 from 1.1.0 for the hybrid post-quantum v2 transport release (#184, gate #222). It is a draft until the maintainer checklist below is resolved.

• Mainnet posture gate for 1.1.0 (ci: check mainnet publication posture for 1.1.0):

  • Core Checks' "Classify release target" step set mainnet_publish_gate_required only for target branch 1.0.0, so the mainnet publication posture job never ran for 1.1.0. It now runs for 1.0.0 and 1.1.0.
  • The job's if: and the Core Checks Gate both read that output, so a posture failure now blocks the gate for source and release-policy changes into 1.1.0, including this PR.
  • The workflow contract test pins both branches. doc/release/release-process.md, which names the branches, is updated; doc/release-trust-1.0.0.md is a historical record and is left alone.

• Version metadata (build: bump version to v1.1.0-rc1):

  • CLIENT_VERSION_MINOR=1, CLIENT_VERSION_BUILD=0 and CLIENT_VERSION_RC=1. CLIENT_VERSION_IS_RELEASE stays true, as in release: prepare v1.0.1 #181.
  • The seven man pages are regenerated with help2man 1.49.3 from a build with the GUI, the wallet and every tool. Besides the version and date lines, qbitd.1 and qbit-qt.1 gain -v2pqtransport, exactly as -help prints it. -mlkemportable and the new -test values are debug options that only -help-debug lists, so the pages don't show them.
  • The util_tests/test_FormatSubVersion fix is release: prepare v1.0.1 #181's hunk, byte for byte (same resulting blob, d3317cbe1a), so merging 1.x.x later brings an identical change.

• Release notes doc/release-notes-1.1.0.md (doc: draft v1.1.0 release notes):

  • They cover every change merged to 1.1.0 since it branched from 1.x.x at 45e9e72c2d: the parts and fixes merged through Hybrid post-quantum v2 transport (#184) — integration #233 (i2p: request post-quantum leasesets (6,4) and retry once with 4,0 on explicit rejection #223 to test: end a failed v2 handshake without resetting the connection #254, per its tables) and depends: upgrade OpenSSL for photon from 3.0.15 to 3.5.9 #249.
  • Behavior changes come first: the hybrid transport on by default and how to switch it off, the numeric -v2pqtransport value, the single I2P session-creation limit (i2p: request post-quantum leasesets (6,4) and retry once with 4,0 on explicit rejection #223, i2p, test: steady SAM creation deadline, test framework fixes #246), and qbit-photon no longer loading OpenSSL engines or providers (depends: upgrade OpenSSL for photon from 3.0.15 to 3.5.9 #249).
  • A compatibility table states how v1.1.0 interoperates with v1.0.0 and v1.0.1 nodes and over v1, in both directions, as p2p_v2_previous_release.py and rpc_pqtransport.py test it.
  • The only performance figures are the handshake benchmark results published in doc, bench: operator guide, release note and handshake benchmark for hybrid v2 transport #240. No speedup is claimed.
  • The fragments release-notes-223.md, -240.md and -249.md are folded in and deleted. The operator guide's and the specification's three links to release-notes-240.md now point at the new notes' #hybrid-post-quantum-v2-transport section. The v1.0.0 fragments (95, 102, 128, 132) and the v1.0.1 fragments (150, 151) are left alone.

• A stale comment (net: say how the load-shedding threshold was set): DEFAULT_PQ_SHED_THRESHOLD_PER_S said release: hybrid v2 transport release gate and default-on (#184 part 9) #222's flood measurement (R3) would set its final value. R3 was settled with CPU benchmarks, and the threshold stays at 1,000 per second, as the notes say.

Maintainer checklist (must be resolved before tagging or publishing)

The publisher does not enforce any of this: it only checks that the notes file is UTF-8.

• Merge 1.x.x after v1.0.1 ships. Merge 1.x.x into 1.1.0, then rebase this PR.
  • Expect conflicts in CMakeLists.txt (keep 1.1.0-rc1) and in the seven man pages: regenerate them from the merged tree. The test_FormatSubVersion hunk is identical on both sides. release: prepare v1.0.1 #181 deletes the 150 and 151 fragments, and the merge brings that deletion.
  • The merge also brings doc: fix pipe rendering and tighten P2MR v1 consensus profile #252, which merged into 1.x.x after 1.1.0 branched.
  • 1.1.0 already contains v1.0.1's code changes, because it branched from 1.x.x after them. So if rc1 has to be tagged before v1.0.1's notes are published, first fold v1.0.1's behavior changes into these notes instead of pointing to them.
  • Then add 1.0.1's notes: in "Changes in v1.0.1", link release-notes-1.0.1.md and add a short section with its behavior changes (the -fallbackfee default wallet: default -fallbackfee to the minimum relay fee #151, fee-only send entries wallet: show fee-only change-only self-transfers #150, and the encryptwallet error code wallet: close races around CWallet::EncryptWallet #183). The notes already say v1.1.0 contains every v1.0.1 change; that holds only after this merge.
• R2 seeds (test: add fuzz seeds for transport paths the release campaign reached #255). Merge test: add fuzz seeds for transport paths the release campaign reached #255 into 1.1.0 before the rc1 tag, or record that it follows rc1. It adds generated fuzz seeds only. Re-check 1.1.0 for other new merges before tagging.
• release: hybrid v2 transport release gate and default-on (#184 part 9) #222 gate items.
  • R6: the short testnet4 soak across platforms, on the release candidate.
  • D4: the release candidate's Guix builds reproduce across builders, and its ELF hardening notes match v1.0.0's (IBT and SHSTK on x86_64, BTI and PAC on aarch64).
  • R7: the release-cut decision on the default. If R7 reverts net: turn hybrid v2 transport on by default #241, these change with it:
    • the notes: the intro, "How to Upgrade", the first two behavior-change bullets, and the -v2pqtransport bullet under "Hybrid post-quantum v2 transport";
    • -v2pqtransport's help text, which prints (default: 1), so the qbitd.1 and qbit-qt.1 pages must be regenerated;
    • the operator guide, the Bitcoin Core differences page and the tests that net: turn hybrid v2 transport on by default #241 changed for the new default.
• Release trust (after tagging). After v1.1.0-rc1 is tagged, open a PR adding doc/release-trust-1.1.0-rc1.md to 1.1.0, following doc/release-trust-1.0.0.md and release: prepare v1.0.1 #181's checklist. Its merge commit becomes the trusted_release_ref for publishing rc1. Repeat this for the final release.
  • Checked already: the publisher, validators and key policy are unchanged since 45e9e72c2d and include the release: fail closed when the release asset list cannot be read #170 publisher fix. contrib/keys/operator-keys/keys.json is unchanged (f04ae262…).
  • With this PR, Core Checks runs the mainnet publication posture job on pull requests into 1.1.0, so the trust doc can cite a run of it on the rc1 source.
• Publishing rc1. The publisher defaults to a non-prerelease, and publication cannot be undone. Pass --prerelease and an explicit --notes-file pointing to a publish-time copy of doc/release-notes-1.1.0.md. In that copy, "Release verification" carries Conforms to qbit P2MR v1 corpus <digest> on source commit <SHA>; independent oracle report <digest>., filled from the evidence run on the rc1 tag target (release-process.md steps 1–10).
• Platform signing (Remove unsigned platform artifact waiver after signing accounts are ready #70). Remove unsigned platform artifact waiver after signing accounts are ready #70 is still open, so the notes record the unsigned-platform waiver in "Known limitations", as release: prepare v1.0.1 #181 does. If it still applies at publication, publish with --allow-unsigned-platform-artifacts and do not pass --allow-codesigning-artifacts. If signing accounts are ready by then, remove the waiver from the notes.

Testing

• Built locally.

• Ran focused unit or functional tests for the changed area.

• Ran lint or formatting checks relevant to this change.

• Not run. Reason:

• Build: a Release build of this tree with the GUI (system Qt 6.10), the wallet, IPC and every tool. qbitd, qbit-cli, qbit-tx, qbit-util, qbit-wallet, qbit and qbit-qt print v1.1.0-rc1. A regtest node reports subversion /qbit:1.1.0-rc1/ and version 10100, and logs qbit version v1.1.0-rc1 (release build) and v2 pq: enabled arith=x86_64-avx2 keccak=x86_64-avx2.

• Mainnet posture: the job's two steps, run as written on a v0.0.0-mainnet-posture-ci.<sha> annotated tag at the version-bump commit, pass: verify_mainnet_release_posture.py reports no failures, and verify_mainnet_ci_posture.py reports publication-ready for the final policy. The classify step's script gives true for 1.0.0 and 1.1.0 with the source and release-policy profiles, and false otherwise. The classifier puts this PR in the source profile, so the job runs on it.

• Tests:

  • test_qbit --run_test=util_tests passes.
  • Functional: interface_bitcoin_cli, feature_help, feature_uacomment, rpc_net (v1 and v2), feature_pq_quickstart and rpc_pqtransport pass.
  • ci/release: 8 suites, 228 tests, plus contrib/guix/test_build_config.py. test_verify_testnet_release_posture.py needs a git config without commit signing, as on CI runners, because it makes commits in temporary repositories.
  • ci/checks: all 10 suites pass.

• Lints: actionlint 1.7.12 on core-checks.yml, lint-qbit-public-docs, lint-pq-doc-tokens (141 tokens in 3 documents, with the binaries and from the sources), the P2MR integration-matrix test the public-docs job runs, generate-pq-transport-vectors.py --check, lint-files, check-doc, the classifier tests, a relative-link and anchor check of the changed docs, and git diff --check.

• Notes review: each bullet was checked against its merged PR's description and, for numbers and names, against the code: the fallback windows, history caps, local-fault threshold, shedding threshold and quiet period, the I2P limit, the startup line, the RPC fields and the man-page help text.

• Not run: the full unit and functional suites, test_qbit-qt, Guix builds, mlc (not installed here; the relative-link check covers the changed links), codespell, and CI.

Notes for reviewers:

• v1.0.0 peers will log the informational "newer subversion … consider upgrading" message for /qbit:1.1.0-rc1/.
• No scheduled workflow validates 1.1.0 yet: ci-nightly-heavy, ibd-perf-manual and rpc-perf-manual use MAINTAINED_BRANCH: 1.x.x. Full Validation runs the hybrid functional suite on changes that need it.

Target Branch

• This PR targets main or a maintainer-requested release branch such as 0.1.x.

Targets 1.1.0.

Risk / Review Notes

• Consensus, script, crypto, wallet, P2P, release, CI, or security-sensitive behavior changed.
• No consensus, script, crypto, wallet, P2P, release, CI, or security-sensitive behavior changed.

Notes: this changes release metadata and one CI condition: the version and user agent, man pages, release notes and the mainnet posture gate's target branches. There are no code-behavior changes beyond the test expectation. The posture gate now runs on every source or release-policy PR into 1.1.0, so a later change that breaks the mainnet launch posture fails Core Checks there instead of at publication.

Docs / Process Impact

Choose exactly one:

• I updated public docs because this PR changes user-visible behavior, integration guidance, release/process guidance, or expected validation.
• No public docs update needed. Reason:

Refs #222 · Part of #184

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[djh58]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T18:47:37.246056Z	9cb480f	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: eabd5c5bfd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[qbit-reviewer]

No findings.

[qbit-reviewer]

No findings.

[djh58]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 9cb480f642

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".