Cuts v0.10.2 from main. The only unreleased change since the published 0.10.1 (npm/PyPI, gitHead 2a83cf0) is #233, the global command-policy floor fix (rf-adth, sable-nz4y): a repo's .rafter.yml could previously replace the machine owner's command policy wholesale rather than only tighten it. #233 merged after 0.10.1 was already cut, so main and the published 0.10.1 package share a version string despite differing in this fix — 0.10.2 makes that distinguishable again. Also folds in the CHANGELOG heading 0.10.1 never got: the Unreleased section had accumulated the 0.10.1-era entries (rf-ss67, sable-l10k x4, the Action timeout/retry changes) but was never renamed when 0.10.1 shipped, so this closes that gap before adding 0.10.2's own section. Bumps node/package.json, python/pyproject.toml, and both rafter-security-skill.md frontmatters to 0.10.2 (validate-release parity). Version-only change; no source/behavior changes beyond #233, which already merged separately. After merge, promote main -> prod to trigger the npm + PyPI publish.

Commits

Commits on Sep 10, 2026

release: v0.10.2