Unblocks rf-f5is. #250 merged to a PUBLIC main on 2026-09-11 and the registries have served 0.10.3 ever since — a fix disclosed and not shipped, for an EXTERNALLY reported finding. Cutting the disclosure line from the PR body did not undo the disclosure: merging to a public repo publishes a diff naming exactly which key shapes were undetected and at what lengths. CONTENTS 6839663 #250 rf-f5is OpenAI + Supabase rules in the regex engine 14eb1c6 #246 rf-3n1i command_policy.allowed_patterns in python, under the policy floor, plus two allowlist bypasses closed SCOPE OF THE BUMP — four files, found by searching for the current version rather than by trusting the validator's list, because #238 exists precisely because a partial bump PASSED validation once: node/package.json python/pyproject.toml node/resources/rafter-security-skill.md (gated ClawHub manifest) python/rafter_cli/resources/rafter-security-skill.md (gated ClawHub manifest) DELIBERATELY NOT BUMPED. The repo carries six other SKILL.md files with their own frontmatter versions — rafter-code-review at 0.7.0, rafter-secure-design, rafter-skill-review and rafter at 0.1.0/0.7.0. Those are independently versioned skill resources, not package-version mirrors; moving them to 0.10.4 would be wrong, and "every manifest" does not mean every file with a version. The two that ARE package mirrors are the two validate-release gates. VERIFIED by running validate-release's own checks locally rather than trusting the edit: node and python versions match at 0.10.4, and both gated skill manifests match the package version. Plus the check validate-release does NOT do and which is the one that actually bites — 0.10.4 is not already on the registry. main's version equalling the published version is what made the last two gaps unpublishable: validation passes and the publish job fails later, at the registry, with an error that does not say "you forgot the bump". Does not push prod. PR #251 (main -> prod) is open and is Rome's to merge.

Commits

Commits on Sep 13, 2026

release: v0.10.4