v0.10.2.

The hardening patch: the security and reliability follow-up to the 0.10.1 audit — sealed agent connection tests, stable SSO identities, and backup/restore lifecycle repairs.

Security and reliability

• Authenticate agent connection tests with a sealed challenge instead of sending the raw agent token over HTTP. Malformed operation exit codes no longer count as success. Agents must support the new agent.ping operation.
• Require proof of email ownership before automatically accepting workspace invitations, enforce the env token scope on project environment routes, and refuse SSO sign-in that bypasses local TOTP or uses a deactivated account.
• Bind SSO accounts to stable provider subjects. Existing accounts link a provider explicitly from account settings; verified email equality alone no longer merges accounts. See SSO account linking for upgrade recovery steps.
• Password-reset recovery atomically revokes sessions, API tokens, passkeys, and external identity links so an earlier account holder cannot retain an alternative sign-in method.
• Clear account-specific query caches on session changes, ignore stale authentication responses, preserve credentials during transient refresh failures, and apply the configured API origin to raw downloads and uploads.
• Preserve successful backups independently from failed attempts, stream volume downloads, validate archives before replacing volume contents, isolate database staging files, and remove partial plaintext after failed decryption.
• Preserve historical release images, use lowercase GHCR image names, serialize release checks, and run database integration checks before release image publication. Version bumps now reject formats unsupported by the installer. The server coverage floors are recalibrated to the measured 0.10.1/0.10.2 reality (functions 91.3, statements 93.3, branches 87.3) — the 0.10.1 release had shipped stale floors its own CI never reached.
• Restore the container image build: Debian trixie split the Docker CLI out of docker.io into a docker-cli package, so the runtime image installs docker-cli — the plugin stage's docker compose version verification had failed with docker: not found.
• Correct documentation that claimed automatic plaintext agent fallback and encryption of volume snapshots.

Added — template runtime verification (carried here for release-packaging completeness)

The verification work below shipped with the 0.10.0/0.10.1 binaries but was never recorded in a numbered release section; it is folded into 0.10.2's notes so the record is complete. The verification release: 101/101 templates runtime-certified, ten quietly-broken templates repaired.

• Whole-catalog runtime verification (r132). Every Hub template — all 101 — now carries a runtimeVerified badge earned from one real isolated smoke run. scripts/smoke-template-runtime.mjs grew the profiles the old runner refused: managed-database templates boot against a throwaway postgres/mysql following the ENGINES contract with databaseEnv resolved exactly like the deploy pipeline; docker-socket templates run with a read-only socket mount; compose stacks go through docker compose up with generated SERVICE_* secrets. The green run ships as runtime-verify-2026-09-16.json and the registry verification test derives the contract from that evidence — a template may only claim runtimeVerified if the committed run passed it, so the badge can no longer drift from reality.
• Placeholder consistency lint for compose stacks. A catalog compose file may no longer reference the same variable both bare ($VAR → the resolver exports '') and defaulted (${VAR:-x} → the default) — the discrepancy that crash-looped umami-stack fails the registry tests before any deploy.

Fixed

• Ten templates that could never have booted, repaired against their real upstream behavior. umami-stack built DATABASE_URL from a defaultless $POSTGRES_DB (→ empty database name → crash loop against a healthy postgres; now ${POSTGRES_DB:-umami}). activepieces requires Redis and PostgreSQL that single-container installs never provided, and its UI listens on 80 via AP_REDIS_URL (not AP_REDIS_CONNECTION_STRING) — converted to a three-service compose stack. flowise 3.x images crash upstream (connect-sqlite3: this.db.exec is not a function even without auth env) — pinned to 2.2.8. libretranslate's named volume sat at a path the image never creates, losing argostranslate's home ownership — moved to /home/libretranslate. vikunja:latest ships a root-owned files dir that uid 1000 cannot write — pinned 0.24.6. grocy declared port 9283 while its nginx listens on 80. nginx-proxy-manager refuses to boot unless /etc/letsencrypt is a real mountpoint — the single persistent volume moved there. homebox panics without a 32-byte HBOX_AUTH_API_KEY_PEPPER — now a generated secret env row. speedtest-tracker defaults to MySQL and a Docker Hub repo that no longer exists — moved to the ghcr image with a managed-MySQL databaseEnv contract. lidarr and sabnzbd pointed at Docker Hub repos that do not exist — lscr.io/linuxserver/* is where they actually publish.