release: v1.2.1 — fix --verify-release crash + signing cleanup

P0: list_commits_in_range() returns List[str] but caller did .sha → AttributeError.
Signing footgun: unsigned receipt left on disk when --sign failed → now cleaned up.
MCP manifest + docs/api.md version bump.
CHANGELOG entry added.

1172 tests passing.

Author: InvariantSystems

CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.2.1] — 2026-03-09
+
+### Fixed
+
+- **`--verify-release` crash**: `list_commits_in_range()` returns plain SHA strings but the caller attempted `.sha` attribute access, causing `AttributeError` on every invocation. Fixed by removing the incorrect attribute dereference.
+- **Signing footgun**: When `--sign` failed (missing `sigstore`, network error), the unsigned receipt was left on disk. Now cleaned up on failure with a clear error message.
+- **MCP manifest description**: Aligned with canonical one-liner ("Tamper-evident receipts for commits with declared AI involvement").
+- **Positioning audit**: Updated GitHub repo description, contrib posts, and examples to use "declared AI involvement" consistently. Feature-level labels (`ai_commit_count`, `is_ai_authored`) intentionally unchanged — they describe detection results.
+
 ## [1.2.0] — 2026-03-09
 
 ### Added

aiir/__init__.py

@@ -10,7 +10,7 @@
 
 from __future__ import annotations
 
-__version__ = "1.2.0"
+__version__ = "1.2.1"
 
 # ---------------------------------------------------------------------------
 # Public API — importable via `from aiir import ...`

docs/api.md

@@ -1,6 +1,6 @@
 # AIIR Python API Reference
 
-> **Module**: `aiir` · **Version**: 1.2.0 · **License**: Apache 2.0
+> **Module**: `aiir` · **Version**: 1.2.1 · **License**: Apache 2.0
 >
 > Zero dependencies — Python standard library only.
 

mcp-manifest.json

@@ -3,7 +3,7 @@
   "name": "aiir",
   "displayName": "AIIR — AI Integrity Receipts",
   "description": "Tamper-evident receipts for commits with declared AI involvement. Detects AI-involvement signals, produces content-addressed JSON receipts, and provides cryptographic audit trails for compliance.",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "author": {
     "name": "Invariant Systems, Inc.",
     "url": "https://invariantsystems.io",