release: v0.10.2

[Rome-1]

Patch release bundling the one unreleased change on main since 0.10.1.

Why this release exists

npm @rafter-security/cli 0.10.1 and PyPI rafter-cli 0.10.1 were published 2026-09-09T01:59:14Z from gitHead 2a83cf04 (#237). #233 — the global command-policy floor fix — merged over an hour later, at 03:10:49Z, and is now the tip of main. The published 0.10.1 artifact does not contain it, and because #233 landed after 0.10.1 was already cut, main and the published package are both labelled 0.10.1 — --version cannot tell them apart. This release exists to make that distinguishable.

Verified: gh api repos/Raftersecurity/rafter-cli/compare/12a1429f...2a83cf04 (main HEAD vs. published gitHead) returns diverged, 35 ahead / 3 behind. Positive control gh api .../compare/31f9c114...2a83cf04 (#238, which is in the release) returns ahead, 36/0.

Contents

• fix(policy): make the global command policy a floor a project cannot lower (sable-nz4y, rf-adth) #233 — fix(policy): make the global command policy a floor a project cannot lower (rf-adth, sable-nz4y). A repo-supplied .rafter.yml could replace the machine owner's global command policy wholesale instead of only tightening it; the global config is now a floor (union on blockedPatterns/requireApproval, mode accepted only when at least as strict).

That is the only unreleased change with any effect on shipped behavior. The one other commit ahead of the published gitHead, #240 (ci: add the Node 18 smoke test that 5409a84 left missing), is CI-only and not user-facing — not included in the CHANGELOG entry, consistent with how this repo has treated CI-only PRs in every prior release.

Release mechanics

• Bumps node/package.json + python/pyproject.toml → 0.10.2 (parity checked), and both rafter-security-skill.md frontmatter versions (node + python).
• Adds ## [0.10.2] - 2026-09-09 to CHANGELOG.md with the fix(policy): make the global command policy a floor a project cannot lower (sable-nz4y, rf-adth) #233 entry.
• Also adds the ## [0.10.1] - 2026-09-09 heading that 0.10.1 never got — the [Unreleased] section had accumulated the 0.10.1-era entries (rf-ss67, sable-l10k ×4, the Action timeout/retry changes) but nothing renamed the heading when 0.10.1 was cut (its version bump was folded into fix(security): CLI ship set — classifier + install/verify hardening (rf-6pqx, rf-3rsj, sable-c6an, rf-7dda, rf-er8a, rf-fuwy) #235 rather than a standalone release commit, and that commit only added bullets under [Unreleased] without renaming it). This closes that gap so [0.10.2]'s own heading has something correct to sit above. Note this does not backfill the 0.10.1 entries that were never written in the first place — PR fix(security): CLI ship set — classifier + install/verify hardening (rf-6pqx, rf-3rsj, sable-c6an, rf-7dda, rf-er8a, rf-fuwy) #235's ship set (rf-6pqx, rf-3rsj, sable-c6an, rf-7dda, rf-er8a, rf-fuwy) and fix: stop sending the API key across redirects (sable-2s6p) #223/fix: an unreadable scan report is not a clean scan (sable-fgk7) #224 have no CHANGELOG entries under [0.10.1] even though they shipped in it. Flagging that gap here rather than silently patching it in, since backfilling accurate descriptions of already-shipped changes is a separate piece of work from cutting this release.
• Version-only + changelog change; no source/behavior changes beyond fix(policy): make the global command policy a floor a project cannot lower (sable-nz4y, rf-adth) #233, which already merged separately.

What else is on main beyond #233

Full accounting, everything merged after the published gitHead 2a83cf04:

PR	Merged	Title	Ships in 0.10.2?
#240	2026-09-09T01:55:03Z	ci: add the Node 18 smoke test that 5409a84 left missing	Yes (CI-only, no behavior change)
#233	2026-09-09T03:10:49Z	fix(policy): make the global command policy a floor a project cannot lower	Yes — the reason for this release

Nothing else sits on main unreleased.

Validation

• Node build (tsc) clean.
• pnpm exec vitest run (full suite, maxWorkers=4) — see CI / session notes for pass/fail counts.
• pytest tests/ (full suite) — see CI / session notes for pass/fail counts.
• Version parity: node == python == skill manifests == 0.10.2.

After merge, promote main → prod to trigger the npm + PyPI publish (OIDC). Verify the artifact, not the workflow exit code: npm view @rafter-security/cli version must read 0.10.2 and pip index versions rafter-cli (or the PyPI JSON API) must show 0.10.2 before considering this shipped.

Not merged, not tagged, not published by this PR — review and merge is Rome's call.