From 414bca26e2da0070086e81c01216d0be760f2a4a Mon Sep 17 00:00:00 2001
From: itswl <imwl@live.com>
Date: Mon, 9 Nov 2026 13:07:05 +0800
Subject: [PATCH] =?UTF-8?q?release:=200.10.2=20=E2=80=94=20the=20quickstar?=
 =?UTF-8?q?t=20points=20at=20the=20family=20whose=20sweeps=20reach=20every?=
 =?UTF-8?q?=20record=20and=20whose=20guards=20refuse=20when=20they=20fail?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The six image lines move from 0.10.1 to the OCI index digests GHCR serves for
the 0.10.2 tags, read anonymously after the release run finished green on
every job. The comment keeps saying the file needs 0.8.0 or newer and names
what moved.

Run from an empty directory before committing: pulled by digest, the boards
answered, the three images read back the release's changes, the demo ran all
nine steps with the press executed, down -v clean.
---
 docker-compose.quickstart.yml | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/docker-compose.quickstart.yml b/docker-compose.quickstart.yml
index 200e26a..bd9e57f 100644
--- a/docker-compose.quickstart.yml
+++ b/docker-compose.quickstart.yml
@@ -46,14 +46,15 @@
 # and the opt-in dollar ceiling set below, and whose investigator refuses an
 # unsigned approve, which is why the pipe and the investigator both carry the
 # action secret. This file needs all of that, so it cannot point at anything
-# older than 0.8.0; it points at 0.10.1, whose investigator offers the model
-# a closed list of tools, because a stranger should start on the newest.
+# older than 0.8.0; it points at 0.10.2, whose sweeps reach every record and
+# whose guards refuse when they fail, because a stranger should start on the
+# newest.
 
 name: hookstack
 
 services:
   hookrelay:
-    image: ghcr.io/itswl/hookrelay:0.10.1@sha256:f1d4a5fb667f0dde54b5ed84abd731a900817d1078e29dc429bfcf533e126fe1
+    image: ghcr.io/itswl/hookrelay:0.10.2@sha256:de44165e1130a560c57d2b12bbf43c0b7a9e3d834fcf8b356a86d1184973d243
     container_name: hs-hookrelay
     restart: unless-stopped
     environment:
@@ -101,7 +102,7 @@ services:
       - sink
 
   hookjudge:
-    image: ghcr.io/itswl/hookjudge:0.10.1@sha256:bf11a11b757167023eaaf6912fcaeed6aea6ed9eea68beadf77787ed594d7a8a
+    image: ghcr.io/itswl/hookjudge:0.10.2@sha256:e41d18078578524b3fb5fb461da8bd5a7d5a9fa053e88035b2f5c910cdf20684
     container_name: hs-hookjudge
     restart: unless-stopped
     environment:
@@ -134,7 +135,7 @@ services:
   # operator would actually have received. It runs from the pipe's own image
   # because that image now carries it — one fewer thing to pull, and no mount.
   sink:
-    image: ghcr.io/itswl/hookrelay:0.10.1@sha256:f1d4a5fb667f0dde54b5ed84abd731a900817d1078e29dc429bfcf533e126fe1
+    image: ghcr.io/itswl/hookrelay:0.10.2@sha256:de44165e1130a560c57d2b12bbf43c0b7a9e3d834fcf8b356a86d1184973d243
     container_name: hs-sink
     restart: unless-stopped
     command: ["python", "-u", "/app/examples/sink.py"]
@@ -147,7 +148,7 @@ services:
   # exactly the hop a real deployment makes to a custom bot's incoming URL.
   # `ops-feishu` in the baked config is `type: bridge` and points here.
   lark-bridge:
-    image: ghcr.io/itswl/lark-bridge:0.10.1@sha256:074134267d49af5e06ecb121f3f49d3074044792cb1126cb0afb923e9ac1a479
+    image: ghcr.io/itswl/lark-bridge:0.10.2@sha256:dca92b3cc89ec93ec1fb11b1ed0ec6da3341c2bd7149b8bc90b0c52c30f0fe39
     container_name: hs-lark-bridge
     restart: unless-stopped
     environment:
@@ -165,7 +166,7 @@ services:
   # not a model: it reports itself as `stub-4o-mini`. Point the judge's AI vars
   # at a real provider and this stops being used.
   stub-ai:
-    image: ghcr.io/itswl/hookjudge:0.10.1@sha256:bf11a11b757167023eaaf6912fcaeed6aea6ed9eea68beadf77787ed594d7a8a
+    image: ghcr.io/itswl/hookjudge:0.10.2@sha256:e41d18078578524b3fb5fb461da8bd5a7d5a9fa053e88035b2f5c910cdf20684
     container_name: hs-stub-ai
     restart: unless-stopped
     command: ["python", "-u", "/app/examples/stub_ai.py"]
@@ -177,7 +178,7 @@ services:
   # pipe to the same channels; the disk alert in demo.sh also proposes a
   # two-step procedure the approve button runs against the allowlist below.
   hookprobe:
-    image: ghcr.io/itswl/hookprobe:0.10.1@sha256:3fd483ad4e52a95e2a54c5fb06ebddd668577055be44cced732dbdc3080e83f7
+    image: ghcr.io/itswl/hookprobe:0.10.2@sha256:425db2868c4b5499ed6ff46109f998ff2eeb42ee7a13d58a1b14cf34c57e87d3
     container_name: hs-hookprobe
     restart: unless-stopped
     # The agent executes arbitrary bash, so the container is bounded even in a