fix(release): bump BOTH gated skill manifests; give every full-suite job the differential baseline

.github/workflows/publish.yaml

@@ -48,6 +48,12 @@ jobs:
         run: |
           pip install -e ".[dev]" 2>/dev/null || pip install -e .
 
+      # The rf-6pqx differential FAILS rather than skips when main's classifier is
+      # unobtainable, and this job runs the FULL suite — so the publish path needs
+      # the baseline too, or the release breaks at the moment it fires.
+      - name: Fetch main for the differential gate
+        run: git fetch --depth=1 origin main:refs/remotes/origin/main
+
       - name: Run tests
         run: pnpm exec vitest run --reporter=default --reporter=json --outputFile.json=vitest-report.json
 
@@ -85,6 +91,12 @@ jobs:
           pip install -e ".[dev]" 2>/dev/null || pip install -e .
           pip install pytest pytest-mock pytest-asyncio
 
+      # The rf-6pqx differential FAILS rather than skips when main's classifier is
+      # unobtainable, and this job runs the FULL suite — so the publish path needs
+      # the baseline too, or the release breaks at the moment it fires.
+      - name: Fetch main for the differential gate
+        run: git fetch --depth=1 origin main:refs/remotes/origin/main
+
       - name: Run all tests
         run: python -m pytest tests/ -v -o junit_family=xunit1 --junitxml=pytest-report.xml
         env:

.github/workflows/test-comprehensive.yml

@@ -404,6 +404,13 @@ jobs:
       - name: Enable pnpm
         run: corepack enable && corepack prepare pnpm@10 --activate
 
+      # The rf-6pqx differential compares this branch's classifier against main's
+      # and FAILS rather than skips when the baseline is missing — correctly, but
+      # that means EVERY job running the suite has to supply it. actions/checkout
+      # fetches only the PR ref. A depth-1 fetch is enough: one blob, not history.
+      - name: Fetch main for the differential gate
+        run: git fetch --depth=1 origin main:refs/remotes/origin/main
+
       - name: Install and build
         run: |
           pnpm install --frozen-lockfile

.github/workflows/validate-release.yml

@@ -84,6 +84,13 @@ jobs:
         with:
           python-version: "3.11"
 
+      # The rf-6pqx differential compares this branch's classifier against main's
+      # and FAILS rather than skips when the baseline is missing — correctly, but
+      # that means EVERY job running the suite has to supply it. actions/checkout
+      # fetches only the PR ref. A depth-1 fetch is enough: one blob, not history.
+      - name: Fetch main for the differential gate
+        run: git fetch --depth=1 origin main:refs/remotes/origin/main
+
       - name: Build Node package
         run: |
           cd node

node/resources/rafter-security-skill.md

@@ -1,7 +1,7 @@
 ---
 name: rafter-security
 description: Security toolkit for AI workflows. Use when scanning code or repos for vulnerabilities, auditing third-party skills/MCPs/agent configs before installing, evaluating shell commands before running them, or generating secure design questions for new features. Provides `rafter run` (remote SAST + SCA, needs RAFTER_API_KEY), `rafter secrets` (offline secrets-only), `rafter agent exec --dry-run` (command-risk classification), and `rafter skill review`.
-version: 0.10.0
+version: 0.10.1
 homepage: https://rafter.so
 metadata:
   openclaw:

python/rafter_cli/resources/rafter-security-skill.md

@@ -1,7 +1,7 @@
 ---
 name: rafter-security
 description: Security toolkit for AI workflows. Use when scanning code or repos for vulnerabilities, auditing third-party skills/MCPs/agent configs before installing, evaluating shell commands before running them, or generating secure design questions for new features. Provides `rafter run` (remote SAST + SCA, needs RAFTER_API_KEY), `rafter secrets` (offline secrets-only), `rafter agent exec --dry-run` (command-risk classification), and `rafter skill review`.
-version: 0.10.0
+version: 0.10.1
 homepage: https://rafter.so
 metadata:
   openclaw: