codeforester · Sep 28, 2026 · Sep 28, 2026
diff --git a/.release/release-bom.json b/.release/release-bom.json
@@ -2,18 +2,18 @@
   "schema_version": 1,
   "release": {
     "repository": "basefoundry/base-demo",
-    "version": "0.1.0",
-    "tag": "v0.1.0",
-    "commit": "b8ac2ae490e4965b8131195a11377fd0bd787daf"
+    "version": "0.2.0",
+    "tag": "v0.2.0",
+    "commit": "40ba3e32a93a495fc3fe934d088c34fa4f36531d"
   },
   "components": [
     {
       "repository": "basefoundry/base-demo",
-      "version": "0.1.0",
-      "tag": "v0.1.0",
-      "commit": "b8ac2ae490e4965b8131195a11377fd0bd787daf",
+      "version": "0.2.0",
+      "tag": "v0.2.0",
+      "commit": "40ba3e32a93a495fc3fe934d088c34fa4f36531d",
       "source_mode": "release",
-      "api_schema_version": "base-demo-release@0.1.0",
+      "api_schema_version": "base-demo-release@0.2.0",
       "platforms": [
         "macos-14",
         "ubuntu-24.04"

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -10,6 +10,8 @@ and versions are tracked in the repo-root `VERSION` file.
 Changes after the latest published release belong here. The release workflow
 promotes this section into a dated version heading before tagging.
 
+## [0.2.0] - 2026-09-28
+
 ### Changed
 
 - Aligned current source with the supported Base 1.9.0, base-cli 0.4.3 and

diff --git a/README.md b/README.md
@@ -2,9 +2,9 @@
 
 ![Tests](https://github.com/basefoundry/base-demo/actions/workflows/tests.yml/badge.svg)
 ![Platform: macOS + Ubuntu/Debian](https://img.shields.io/badge/platform-macOS%20%2B%20Ubuntu%2FDebian-lightgrey)
-![Version](https://img.shields.io/badge/version-0.1.0-blue)
+![Version](https://img.shields.io/badge/version-0.2.0-blue)
 
-[Current release: v0.1.0](https://github.com/basefoundry/base-demo/releases/tag/v0.1.0) · [Release policy](docs/release.md)
+[Current release: v0.2.0](https://github.com/basefoundry/base-demo/releases/tag/v0.2.0) · [Release policy](docs/release.md)
 
 Reference Base-managed project and representative demo environment.
 

diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-0.1.0
+0.2.0
diff --git a/docs/contracts.md b/docs/contracts.md
@@ -33,7 +33,7 @@ evidence, and intentionally deferred capabilities.
 | `runtime-platform-env` | The `env` command prints `BASE_OS`, `BASE_PLATFORM`, `BASE_HOST_ENV`, and `BASE_HOST` with the other Base runtime values. | `src/env.sh` | `tests/validate.sh`, `tests/demo_test.bats`, `demo/demo.sh` | Learners cannot discover the current Base runtime platform and host-environment contract from base-demo. | Runtime |
 | `python-env-privacy` | The Python `env` command exposes only documented public Base diagnostics, renders secret-looking `BASE_*` names as `[REDACTED]`, and the walkthrough sanitizes captured environment output before displaying it. | `lib/python/base_demo_cli/__main__.py`, `demo/demo.sh` | `lib/python/base_demo_cli/tests/test_cli.py`, `tests/demo_test.bats`, `tests/validate.sh` | Project or workflow credentials can leak through direct inspection or the interactive and non-interactive walkthrough. | Security |
 | `maintenance-prompt-safety` | The walkthrough inventories repo-owned prompts, displays the already-redacted `config show` output, and previews cleanup with `clean --keep-last 1 --dry-run`; it never renders a large prompt or deletes runtime artifacts. | `demo/demo.sh`, `README.md` | `tests/demo_test.bats`, `tests/validate.sh`, `.github/workflows/tests.yml` | The reference walkthrough can leak machine-local configuration, become noisy or unstable from generated prompt contents, or delete local runtime state while demonstrating maintenance tooling. | Security |
-| `installer-checksum` | Release-mode bootstrap uses the reviewed Base installer and commit selected by `.release/supported-dependencies.json` plus the base-demo v0.1.0 release commit, verifies the installer checksum, and refuses to move divergent existing checkouts. Explicit `--dev` or `BASE_DEMO_DEV_MODE=1` reuses local contributor checkouts without pulling or switching revisions and visibly permits moving-source overrides. | `install.sh` | `tests/install_test.bats`, `docs/release.md` | Two users can receive different bootstrap code, a release installer can execute an unverified input, or a contributor's feature branch can be silently switched or updated. | Security / Release |
+| `installer-checksum` | Release-mode bootstrap uses the reviewed Base installer and commit selected by `.release/supported-dependencies.json` plus the base-demo v0.2.0 release commit, verifies the installer checksum, and refuses to move divergent existing checkouts. Explicit `--dev` or `BASE_DEMO_DEV_MODE=1` reuses local contributor checkouts without pulling or switching revisions and visibly permits moving-source overrides. | `install.sh` | `tests/install_test.bats`, `docs/release.md` | Two users can receive different bootstrap code, a release installer can execute an unverified input, or a contributor's feature branch can be silently switched or updated. | Security / Release |
 | `service-log-permissions` | Process-backed service log files are created or corrected to mode `0600` before writes. | `bin/base-demo-services` | `tests/services_test.bats` | Service logs can expose local process output through permissive file modes. | Security |
 | `service-catalog-schema` | Canonical `services/catalog.json` and custom `--catalog` inputs use one validator for the root object, services array, object entries, safe unique names, and known scalar/nested field types; malformed input returns a field-specific usage error without a traceback. | `bin/base_demo_environment.py`, `bin/base-demo-services`, `services/catalog.json` | `tests/services_test.bats`, `tests/environments_test.bats`, `tests/validate.sh` | Malformed user input can reach lifecycle code, expose Python tracebacks, or behave differently depending on whether the catalog is canonical or custom. | Runtime |
 | `service-state-containment` | Canonical and custom catalog names are safe lowercase slugs; process state and log files remain direct, non-symlink children of the configured state directory, use mode `0600`, and state updates replace complete temporary files atomically. | `bin/base-demo-services`, `bin/base_demo_environment.py` | `tests/services_test.bats`, `tests/environments_test.bats` | Crafted catalog names or filesystem links can redirect lifecycle writes outside the state directory, expose process metadata, or leave partial state. | Security |

diff --git a/install.sh b/install.sh
@@ -16,8 +16,8 @@ BASE_INSTALL_URL="${BASE_INSTALL_URL:-https://raw.githubusercontent.com/basefoun
 # The empty-value form is intentional: an explicit empty checksum must not
 # silently restore the release checksum and bypass the release-mode guard.
 BASE_INSTALL_SHA256="${BASE_INSTALL_SHA256-f0522bf20b13e2f487767324f4688f1b1ed33b1c1bc1158a404f0e428ea3e993}"
-PROJECT_RELEASE_REF="${PROJECT_RELEASE_REF:-v0.1.0}"
-PROJECT_RELEASE_COMMIT="${PROJECT_RELEASE_COMMIT:-b8ac2ae490e4965b8131195a11377fd0bd787daf}"
+PROJECT_RELEASE_REF="${PROJECT_RELEASE_REF:-v0.2.0}"
+PROJECT_RELEASE_COMMIT="${PROJECT_RELEASE_COMMIT:-40ba3e32a93a495fc3fe934d088c34fa4f36531d}"
 BASE_DEMO_DEV_MODE="${BASE_DEMO_DEV_MODE:-false}"
 RUN_UPDATE_PROFILE="${RUN_UPDATE_PROFILE:-true}"
 

diff --git a/pyproject.toml b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "base-demo"
-version = "0.1.0"
+version = "0.2.0"
 description = "Reference Base-managed project and representative demo environment."
 requires-python = ">=3.13,<3.14"
 dependencies = ["base-cli==0.4.3", "click", "PyYAML"]

diff --git a/services/demo-console/package-lock.json b/services/demo-console/package-lock.json
diff --git a/services/demo-console/package.json b/services/demo-console/package.json
@@ -1,6 +1,6 @@
 {
   "name": "base-demo-console",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": true,
   "type": "module",
   "packageManager": "npm@10.9.4",

diff --git a/uv.lock b/uv.lock