diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index bd8ed3d..1b1704a 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -48,6 +48,12 @@ jobs:
         run: |
           pip install -e ".[dev]" 2>/dev/null || pip install -e .
 
+      # The rf-6pqx differential FAILS rather than skips when main's classifier is
+      # unobtainable, and this job runs the FULL suite — so the publish path needs
+      # the baseline too, or the release breaks at the moment it fires.
+      - name: Fetch main for the differential gate
+        run: git fetch --depth=1 origin main:refs/remotes/origin/main
+
       - name: Run tests
         run: pnpm exec vitest run --reporter=default --reporter=json --outputFile.json=vitest-report.json
 
@@ -85,6 +91,12 @@ jobs:
           pip install -e ".[dev]" 2>/dev/null || pip install -e .
           pip install pytest pytest-mock pytest-asyncio
 
+      # The rf-6pqx differential FAILS rather than skips when main's classifier is
+      # unobtainable, and this job runs the FULL suite — so the publish path needs
+      # the baseline too, or the release breaks at the moment it fires.
+      - name: Fetch main for the differential gate
+        run: git fetch --depth=1 origin main:refs/remotes/origin/main
+
       - name: Run all tests
         run: python -m pytest tests/ -v -o junit_family=xunit1 --junitxml=pytest-report.xml
         env:
diff --git a/.github/workflows/test-comprehensive.yml b/.github/workflows/test-comprehensive.yml
index d9096f4..0aa3be0 100644
--- a/.github/workflows/test-comprehensive.yml
+++ b/.github/workflows/test-comprehensive.yml
@@ -404,6 +404,13 @@ jobs:
       - name: Enable pnpm
         run: corepack enable && corepack prepare pnpm@10 --activate
 
+      # The rf-6pqx differential compares this branch's classifier against main's
+      # and FAILS rather than skips when the baseline is missing — correctly, but
+      # that means EVERY job running the suite has to supply it. actions/checkout
+      # fetches only the PR ref. A depth-1 fetch is enough: one blob, not history.
+      - name: Fetch main for the differential gate
+        run: git fetch --depth=1 origin main:refs/remotes/origin/main
+
       - name: Install and build
         run: |
           pnpm install --frozen-lockfile
diff --git a/.github/workflows/validate-release.yml b/.github/workflows/validate-release.yml
index 96e4037..903fb4b 100644
--- a/.github/workflows/validate-release.yml
+++ b/.github/workflows/validate-release.yml
@@ -84,6 +84,13 @@ jobs:
         with:
           python-version: "3.11"
 
+      # The rf-6pqx differential compares this branch's classifier against main's
+      # and FAILS rather than skips when the baseline is missing — correctly, but
+      # that means EVERY job running the suite has to supply it. actions/checkout
+      # fetches only the PR ref. A depth-1 fetch is enough: one blob, not history.
+      - name: Fetch main for the differential gate
+        run: git fetch --depth=1 origin main:refs/remotes/origin/main
+
       - name: Build Node package
         run: |
           cd node
diff --git a/node/resources/rafter-security-skill.md b/node/resources/rafter-security-skill.md
index 758c1d5..84445a0 100644
--- a/node/resources/rafter-security-skill.md
+++ b/node/resources/rafter-security-skill.md
@@ -1,7 +1,7 @@
 ---
 name: rafter-security
 description: Security toolkit for AI workflows. Use when scanning code or repos for vulnerabilities, auditing third-party skills/MCPs/agent configs before installing, evaluating shell commands before running them, or generating secure design questions for new features. Provides `rafter run` (remote SAST + SCA, needs RAFTER_API_KEY), `rafter secrets` (offline secrets-only), `rafter agent exec --dry-run` (command-risk classification), and `rafter skill review`.
-version: 0.10.0
+version: 0.10.1
 homepage: https://rafter.so
 metadata:
   openclaw:
diff --git a/python/rafter_cli/resources/rafter-security-skill.md b/python/rafter_cli/resources/rafter-security-skill.md
index 758c1d5..84445a0 100644
--- a/python/rafter_cli/resources/rafter-security-skill.md
+++ b/python/rafter_cli/resources/rafter-security-skill.md
@@ -1,7 +1,7 @@
 ---
 name: rafter-security
 description: Security toolkit for AI workflows. Use when scanning code or repos for vulnerabilities, auditing third-party skills/MCPs/agent configs before installing, evaluating shell commands before running them, or generating secure design questions for new features. Provides `rafter run` (remote SAST + SCA, needs RAFTER_API_KEY), `rafter secrets` (offline secrets-only), `rafter agent exec --dry-run` (command-risk classification), and `rafter skill review`.
-version: 0.10.0
+version: 0.10.1
 homepage: https://rafter.so
 metadata:
   openclaw: