Merge pull request #209 from Priivacy-ai/codex/dependency-bounds-2x

release: v2.0.2 tracker + dependency floor hardening

Author: robertDouglass

CHANGELOG.md

@@ -9,6 +9,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.0.2] - 2026-02-27
+
+### ✅ Added
+
+- **Flag-gated tracker command group**: added `spec-kitty tracker ...` commands behind `SPEC_KITTY_ENABLE_SAAS_SYNC`, including provider listing, bind/unbind, mapping, local sync pull/push/run, and snapshot publish.
+- **Tracker host-local persistence + credentials support**: added CLI-owned tracker SQLite cache/checkpoints and provider credential handling consistent with existing Spec Kitty host persistence patterns.
+
+### 🔧 Changed
+
+- **Dependency floor hardening for 2.x installs**: added explicit lower bounds for previously unbounded core CLI direct dependencies to reduce resolver drift in fresh environments.
+- **Workflow review lane guard**: review start now requires a valid `for_review` lane state before progressing.
+
 ## [2.0.1] - 2026-02-26
 
 ### 🐛 Fixed

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "spec-kitty-cli"
-version = "2.0.1"
+version = "2.0.2"
 description = "Spec Kitty, a tool for Specification Driven Development (SDD) agentic projects, with kanban and git worktree isolation."
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -49,11 +49,11 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "typer",
-    "rich",
-    "httpx[socks]",
-    "platformdirs",
-    "readchar",
+    "typer>=0.24.1",
+    "rich>=14.3.3",
+    "httpx[socks]>=0.28.1",
+    "platformdirs>=4.9.2",
+    "readchar>=4.2.1",
     "truststore>=0.10.4",
     "pyyaml>=6.0",
     "ruamel.yaml>=0.18.0",