Record dependency refresh and coordinated release rollout

DEPENDENCIES.md

@@ -0,0 +1,80 @@
+# September 2026 dependency refresh
+
+This refresh covers all ten repositories in `treetop-policy-engine`. Package
+registries, upstream releases, and action commits were checked on 2026-09-19.
+The implementation updates were squash-merged in dependency order on 2026-09-19.
+Core and Bundle 0.2.0 are published; the other updates are on `main` and await
+separate versioned releases.
+
+## Repository status
+
+| Repository | Review | Scope and publication status |
+| --- | --- | --- |
+| Core | [#66](https://github.com/treetop-policy-engine/treetop-core/pull/66) | Merged; [Core 0.2.0 published](https://crates.io/crates/treetop-core/0.2.0), with Cedar 4.13.0 and refreshed dependencies/actions |
+| Bundle | [#12](https://github.com/treetop-policy-engine/treetop-bundle/pull/12) | Merged; [Bundle 0.2.0 and native CLI published](https://github.com/treetop-policy-engine/treetop-bundle/releases/tag/v0.2.0) |
+| REST | [#82](https://github.com/treetop-policy-engine/treetop-rest/pull/82) | Merged; published Core/Bundle 0.2.0 and Cedar 4.13.0; application/fuzz lockfiles and action updates |
+| Rust client | [#16](https://github.com/treetop-policy-engine/treetop-client/pull/16) | Merged; dependencies, fuzz lockfile, actions, and Rust 1.93.1 minimum |
+| Python client | [#16](https://github.com/treetop-policy-engine/treetop-client-python/pull/16) | Merged; build/type-check tools, lockfile, and actions |
+| Go client | [#5](https://github.com/treetop-policy-engine/treetop-client-go/pull/5) | Merged; security and Markdown tools; no external module dependencies; actions already current |
+| CLI | [#10](https://github.com/treetop-policy-engine/treetop-cli/pull/10) | Merged; dependencies, lockfile, actions, and pinned Rust builder image |
+| Frontend | [#5](https://github.com/treetop-policy-engine/treetop-frontend/pull/5) | Merged; npm dependencies, lockfile, supported Node versions, and actions |
+| Bundle Action | [#9](https://github.com/treetop-policy-engine/treetop-bundle-action/pull/9) | Merged; Bundle CLI 0.2.0 default, immutable release source, action pins, and artifact upload example |
+| Organization | [#4](https://github.com/treetop-policy-engine/.github/pull/4) | Documentation and action dependencies checked; existing pins already current |
+
+A merged dependency update does not create a versioned release. REST, clients,
+CLI, frontend, and Bundle Action retain their existing published releases until
+separate release preparation and publication. The [previous coordinated release](MIGRATION.md) remains
+the migration reference for those artifacts.
+
+## Core, Bundle, and REST rollout
+
+1. Completed: Core 0.2.0 is published from verified main commit
+   `6ebef45b46b1b725e48ab5704a64cf266da25860`.
+2. Completed: Bundle 0.2.0 uses the published Core crate and is released from
+   verified main commit `20c4661296cc23381bbce1d86a94949311823a11`. All four
+   native CLI archives and `SHA256SUMS` are published.
+3. Completed: REST's merged update resolves both published crates, with registry
+   checksums in its application and fuzz lockfiles. Prepare and release the next
+   server version separately.
+4. Completed: Bundle Action's merged update defaults to published CLI 0.2.0 and
+   verifies its exact release source. This archive-compatibility change requires
+   a new major Action release. Existing v2/v2.0.0 contracts remain fixed; users can
+   explicitly select `binary-version: 0.2.0` with the published action.
+
+Rebuild and re-sign policy archives with Bundle CLI 0.2.0 before deploying the
+updated REST server. Archive generator metadata must match Bundle/Core 0.2.0
+and Cedar 4.13.0 exactly; editing a signed archive is not a migration. Manifest
+and signature format 2 and declared label targets remain unchanged. Cedar JSON
+consumers must support array-valued `attr` for nested `has` expressions.
+
+Cedar 4.13 classifies invalid action applications as warnings. Core and Bundle
+preserve Treetop's strict validation contract by rejecting these diagnostics as
+errors. Other Bundle warnings retain their existing `deny_warnings` behavior.
+
+## Merge order
+
+Core and Bundle were merged and released first. The remaining implementation PRs
+were then squash-merged as REST, Rust/Python/Go clients, CLI, frontend, and Bundle
+Action, followed by this organization record. Each merge used the verified PR
+head and retained substantive rationale and migration notes in its squash body.
+Published REST/client integration pins remain intentional prerequisites for
+consumer checks; merging a newer implementation does not move those releases.
+
+## Toolchain and compatibility constraints
+
+- The Rust client now requires Rust 1.93.1. Its current test and transitive
+  dependency graph cannot support the former Rust 1.85 minimum. CLI retains its
+  separately verified Rust 1.89 minimum against the published client 0.1.0.
+- The frontend requires Node `^22.22.2 || ^24.15.0 || >=26` for its updated tools.
+  TypeScript stays at 5.9.3: current `openapi-typescript` 7.13.0 requires TypeScript
+  5.x, and `typescript-eslint` 8.70.0 excludes TypeScript 6.1 and later. Installing
+  TypeScript 7.0.2 would violate those peer contracts. Revisit this holdback when
+  both tools support it.
+- Third-party actions and reusable workflows use immutable reviewed commits.
+  Rust toolchain actions tracking upstream `master` explicitly select `stable`.
+- Existing released REST images/source and client versions remain valid pinned
+  integration prerequisites. An unpublished branch is not a new release.
+
+Each implementation PR records its own verification. Dependency updates retain
+formatting, lint, test, documentation, audit, package, and performance gates;
+local environmental limitations are documented rather than treated as passes.

MIGRATION.md

@@ -2,6 +2,8 @@
 
 Released 2026-09-06 after coordinated review and verification. This document is
 the organization announcement, breaking migration guide, and upgrade order.
+For the later Core/Bundle 0.2.0 and Cedar 4.13 refresh, see the
+[dependency rollout notes](DEPENDENCIES.md).
 
 Early Treetop releases prioritize correctness over compatibility across every
 repository. Breaking changes must be intentional, tested, announced, and supplied

README.md

@@ -65,11 +65,18 @@ and attribute. Early Treetop releases prioritize correctness over compatibility;
 ambiguous ownership, deprecated aliases, and old-format defaults are removed.
 Bundle/module format 2 requires rebuilt and re-signed archives.
 
-Core, Bundle, REST, Rust/Python clients, CLI, and Workbench are released as 0.1.0;
+The September 6 release shipped Core, Bundle, REST, Rust/Python clients, CLI, and Workbench as 0.1.0;
 the Go client is 0.3.0 and Bundle Action is v2. See the
 [breaking migration and release set](./MIGRATION.md) for the new syntax, required consumer
 updates, published artifacts, and upgrade order.
 
+## September 2026 dependency refresh
+
+Core and Bundle 0.2.0 are published with Cedar 4.13.0. The
+[dependency refresh status and migration notes](./DEPENDENCIES.md) track every repository,
+release prerequisites, and toolchain changes. The dependency updates are merged;
+versioned releases beyond Core and Bundle remain separate.
+
 ## Projects
 
 All repositories below are maintained parts of the Treetop project. Together they provide the REST

profile/README.md

@@ -18,11 +18,18 @@ and attribute. Early Treetop releases prioritize correctness over compatibility;
 ambiguous ownership, deprecated aliases, and old-format defaults are removed.
 Bundle/module format 2 requires rebuilt and re-signed archives.
 
-Core, Bundle, REST, Rust/Python clients, CLI, and Workbench are released as 0.1.0;
+The September 6 release shipped Core, Bundle, REST, Rust/Python clients, CLI, and Workbench as 0.1.0;
 the Go client is 0.3.0 and Bundle Action is v2. See the
 [breaking migration and release set](../MIGRATION.md) for the new syntax, required consumer
 updates, published artifacts, and upgrade order.
 
+## September 2026 dependency refresh
+
+Core and Bundle 0.2.0 are published with Cedar 4.13.0. The
+[dependency refresh status and migration notes](../DEPENDENCIES.md) track every repository,
+release prerequisites, and toolchain changes. The dependency updates are merged;
+versioned releases beyond Core and Bundle remain separate.
+
 ## Projects
 
 These repositories are all maintained parts of Treetop, covering the runtime, policy delivery,