release: finalize DetFuzz v1.0.2 maintenance release

Author: rootverdict

README.md

@@ -35,10 +35,15 @@ rule-resilience finding, not a claim that the fixture is malicious.
 
 ## V1 status
 
-V1.0.1 is complete and locally verified on 2026-08-13 with the pinned
-development toolchain. It adds fail-closed suite-health, clock-status, and
-report-contract hardening while preserving the same deliberately narrow V1
-experiment.
+V1.0.2 is the current maintenance release. It was locally verified on
+2026-08-28 with the pinned development toolchain. It preserves the deliberately
+narrow V1 experiment while adding fail-closed XML parsing, explicit handling of
+malformed caller-supplied telemetry, and stricter security-lint enforcement.
+
+The latest live Windows experiment remains the V1.0.1 run from 2026-08-13. Its
+bundle is retained unchanged rather than being relabeled as V1.0.2 evidence;
+the maintenance release changes parser failure handling and project hardening,
+not the recorded lab result below.
 
 The latest end-to-end run produced:
 
@@ -261,10 +266,13 @@ Ruff: all checks passed
 mypy: no issues found in 31 source files
 ```
 
-The v1.0.1 release was validated at 95 tests; the three additional tests cover
-the DOCTYPE rejection added after that release. `docs/v1-local-validation.md`
-and the release manifest retain the 95/94 figures deliberately, as a
-point-in-time record of the validated run rather than a claim about this tree.
+The v1.0.1 live release was validated at 95 tests. V1.0.2 adds three DOCTYPE
+tests and hardens missing/non-numeric Event IDs, mid-poll parse failures, and the
+`evaluate-detection` CLI error path. `docs/v1-local-validation.md` and the
+release manifest retain the historical 95/94 figures deliberately, as a
+point-in-time record of the validated VM run rather than a claim about this
+tree. See [`docs/v1.0.2-maintenance-release.md`](docs/v1.0.2-maintenance-release.md)
+for the maintenance-release boundary.
 
 ## V1 boundary
 

docs/README.md

@@ -12,6 +12,8 @@ documentation for DetFuzz V1.
   validated finding.
 - [`v1-local-validation.md`](v1-local-validation.md): latest live Windows
   validation record.
+- [`v1.0.2-maintenance-release.md`](v1.0.2-maintenance-release.md): current
+  maintenance-release changes and their validation boundary.
 
 ## Operations and evidence
 

docs/v1.0.2-maintenance-release.md

@@ -0,0 +1,45 @@
+# DetFuzz V1.0.2 Maintenance Release
+
+V1.0.2 is a code-hardening maintenance release built on the V1.0.1 experiment.
+It does not relabel or rewrite the retained V1.0.1 Windows evidence.
+
+## Changes
+
+- Reject XML documents containing a DTD before `xml.etree.ElementTree` parses
+  them, closing the entity-expansion path for caller-supplied XML.
+- Treat a missing or non-numeric Sysmon `EventID` as an invalid event instead of
+  raising an uncaught exception.
+- Tolerate malformed XML returned during telemetry polling and retry until the
+  normal deadline.
+- Make `evaluate-detection` return structured `XML_PARSE_FAILED` output and a
+  nonzero exit instead of a traceback for malformed input.
+- Enable Ruff's blind-except, stale-suppression, and security rule families so
+  future broad exception handlers, subprocess calls, and XML parsing changes
+  require explicit review.
+- Remove a dead calibration parameter and correct the documented timeout
+  selection formula.
+- Commit the historical V1.0.1 evidence bundle with a pinned SHA-256 digest so
+  the evidence referenced by the repository is available from a clone.
+
+## Verification
+
+Verified locally on 2026-08-28 with the pinned development toolchain:
+
+```text
+98 tests run; 97 passed and 1 expected dependency-path test skipped
+Ruff: all checks passed
+mypy: no issues found in 31 source files
+```
+
+The package version and CLI report `1.0.2`. The historical live evidence remains
+`artifacts/detfuzz-v1.0.1-release.zip`, whose digest is pinned by
+`artifacts/detfuzz-v1.0.1-release.sha256.txt`. That bundle records the
+2026-08-13 V1.0.1 VM run and is intentionally unchanged.
+
+## Claim boundary
+
+V1.0.2 is locally verified for unit-tested behavior, linting, type checking,
+packaging, and CLI smoke checks. The live Windows classification results cited
+by the project are still the retained V1.0.1 results. A future live rerun should
+receive a new evidence bundle and validation record rather than modifying the
+historical one.

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "detfuzz"
-version = "1.0.1"
+version = "1.0.2"
 description = "Detection rule mutation and resilience testing platform."
 readme = "README.md"
 requires-python = ">=3.11"

src/detfuzz/version.py

@@ -1,3 +1,3 @@
 """DetFuzz package version."""
 
-__version__ = "1.0.1"
+__version__ = "1.0.2"

tests/test_cli.py

@@ -33,7 +33,7 @@ def test_version_reports_v1_release(self) -> None:
             main()
 
         self.assertEqual(raised.exception.code, 0)
-        self.assertEqual(stdout.getvalue().strip(), "detfuzz 1.0.1")
+        self.assertEqual(stdout.getvalue().strip(), "detfuzz 1.0.2")
 
     def test_failed_clock_preflight_exits_nonzero(self) -> None:
         args = argparse.Namespace(powershell_path="powershell.exe")