release: 0.9.2 — honest changelog + version unit

[ManningWorks]

Change

RELEASE-UNIT PR (VERSION + CHANGELOG + SKILL.md move together per
AGENTS.md). Cuts 0.9.2 to close the changelog/version mismatch:
since tag v0.9.1, master accumulated F2/F3/F4 + the v4 outbound fix +
the --help wording fix, all of it recorded under the SHIPPED
[0.9.0] section. This PR makes the changelog and the tags tell the
same story.

Problem

[0.9.0] - 2026-09-25 contained four entries (F1, F2, F3, F4), but
tag v0.9.0 (1bc0ad4) shipped only F1 — F2/F3/F4 merged to master after
the v0.9.0 tag was cut (PRs #46/#51/#52) and were logged under
[0.9.0] at merge time. VERSION has sat at 0.9.1 ever since (v0.9.1
was a patch: the lock-gate exit-75 fix, PR #47), while the four post-
v0.9.1 features/fixes had no section of their own. The changelog's
[0.9.0] section no longer described what v0.9.0 actually shipped.

Additionally, two things merged since v0.9.1 were never recorded
anywhere: the v4 outbound peer-column fix (issue #53, PR #54) and the
--help wording fix (PR #56/#57).

Fix

Three files, one commit, one unit — no other file changes:

1. VERSION: 0.9.1 → 0.9.2
2. CHANGELOG.md (the load-bearing part):
   • new ## [0.9.2] - 2026-09-28 section at the top
   • moved verbatim from [0.9.0] into [0.9.2] ### Added:
     Fail2ban jail discovery (F2), Webhook severity floor (F3),
     IPv6 outbound parity (F4) (F4 in the PR docs(changelog): reword F4 entry — 'identically to before' overstates on iproute2 6.x #55-reworded wording)
   • [0.9.0] now contains exactly ONE entry —
     --init idempotency report (F1) — what tag v0.9.0 (1bc0ad4)
     actually shipped. Its date (2026-09-25) and every other section
     are untouched.
   • new ### Fixed in [0.9.2]:
     • v4 outbound peer-column fix (issue v4 outbound check dead on iproute2 6.x: peer column is 4, not 5 #53, PR fix(security): resolve v4 outbound peer column from the ss header #54): the v4
       established-outbound remote extraction hardcoded the 5th awk
       field; on iproute2 6.x ss suppresses the State column so field
       5 is the Process column and the check extracted nothing (false
       "outbound remote: none"). Now resolves the peer column from the
       ss header via ss_peer_column() (5 on 5.x, 4 on 6.x) in a new
       ss_v4_remote_ips(); v6 path unaffected; tier-1 property test
       (RED on master / GREEN on fix) + tier-2 seeded 6.x proof.
     • --help usage block (PR docs(help): --json no longer "always exits 0" in usage block #56): the --json parenthetical no
       longer claims "always exits 0".
3. skills/box-audit/SKILL.md frontmatter version: 0.9.1 →
   0.9.2 (hand-synced per AGENTS.md — easy to miss, CI will not
   catch it).

Test

Docs/version-only change — no code path touched.

• bash test/all.sh on this head (release/0.9.2 @ f8234d7, from
  master 5dfb212 = post-PR docs(help): --json no longer "always exits 0" in usage block — rebased #57): all: 4 passed (tiers 1+2+3, no
  skips) — run in the local privileged docker.
• Moved entries verified byte-identical to their text in master's
  [0.9.0] section (script-checked, not eyeballed).
• --version prints box-audit 0.9.2+replay from the working tree.

Release tail (post-review, maintainer)

Merge house-style; annotate tag v0.9.2 ON THE MERGE COMMIT and
push; empty commit to re-trigger release-check. Post-merge verify:
VERSION=0.9.2 on origin/master, v0.9.2 on origin, release-check green,
and v0.9.0=1bc0ad4 + v0.9.1=d543e5f unchanged (never move an
existing tag).

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 48aa2213-8a08-4de3-ba49-3a4310543dea

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}