cppa-cursor-browser: cut the v0.2.1 tag and GitHub Release

[clean6378-max-it]

Sprint Item

is-10 of 13 — Task — Wednesday PR 4 of 4 (the release)

Block Relations

Blocked by	is-9 (hard) — Release notes come from the [0.2.1] changelog section; is-8 (soft) — merged workflow means artifacts attach automatically
Blocks	—
Repo/day	Independent of is-1–is-6 and is-11–is-13

Calendar Day

Wednesday, July 29, 2026 (PR 4 of 4) — not Thursday. Eleven Releases across the portfolio in four days is the plan's single largest concentration of risk; the stated mitigation is to cut each release as soon as its repo's fixes merge rather than batching to Thursday afternoon.

Planned Effort

1 story point (Task) — sprint item is-10

Problem

pyproject.toml still declares version = "0.2.0" (line 7) and no v0.2.1 tag exists. Six merged PRs from the Week 30 browser-security sweep, plus this week's summary-cache fix, are unreleased.

The repository cannot reach production-ready status for the end-of-July deadline without a version bump, an annotated tag, and a GitHub Release.

Goal

The repository's v0.2.1 Release, covering the entire Week 30 browser-security sweep plus item is-7.

Scope

Part A — version bump

• Bump pyproject.toml version to 0.2.1.
• pyproject.toml is the sole version source — there is no __version__ in app.py.

Part B — tag

• Push an annotated tag v0.2.1 to origin, pointing at the release commit.

Part C — Release

• Publish a GitHub Release with notes copied from the [0.2.1] CHANGELOG section — via the UI or gh release create v0.2.1 --notes-file ....

Part D — artifacts

• If is-8 is merged, the tag push triggers release.yml and the wheel, sdist and Windows PyInstaller zip attach automatically.
• If is-8 is not merged, attach the artifacts manually or note the gap explicitly in the Release body. Do not ship a Release that silently lacks its artifacts.

Versioning policy

Follow the SemVer patch-bump policy in the README: pre-1.0 patch means backward-compatible fixes only.

Out of scope

• Any code change. This is a release step.

Acceptance Criteria

• pyproject.toml version is bumped to 0.2.1.
• An annotated git tag v0.2.1 is pushed to origin, pointing at the release commit.
• A GitHub Release for v0.2.1 is published with notes copied from the [0.2.1] CHANGELOG section.
• If item is-8 is merged, the release workflow attaches the wheel, sdist and Windows PyInstaller zip; otherwise the gap is noted in the Release body.
• Tests green on the release commit.
• PR approved by at least 1 reviewer.

Verification

# from the cppa-cursor-browser checkout root
git tag -n v0.2.1
git describe --tags
gh release view v0.2.1

• The GitHub Release exists as a Release object, not a bare tag.
• The Release notes match the [0.2.1] CHANGELOG section.
• Release assets are present, or their absence is stated in the body.

Close-out gate (Chen owns this repository)

Column	Status
No Critical/High/Medium-High open	Item is-7 closes the only one
Release cut	This issue — v0.2.1
Actions green	Tests green on the release commit
No new Critical/High found Thursday	Fresh re-scan required Thursday — re-run the review tooling against Thursday's HEAD

References

• Sprint: Week 31 (Jul 27–31, 2026) — Chen item is-10 (1 pt, Task)
• Week 31 weekly plan — cppa-cursor-browser
• Week 31 issue descriptions — cppa-cursor-browser, v0.2.1 release
• Eval finding: n/a
• Files: pyproject.toml:7; CHANGELOG.md; .github/workflows/release.yml
• Companion: Wednesday is-7 summary-cache lock, is-8 release workflow, is-9 changelog backfill
• Success definition: "SRI and CSP and proven-safe rendering, typed boundary, programmatic error codes, multi-worker honesty" — v0.2.1