Adopt the rails-sketch/2026-10 target profile

[raghubetina]

Summary

The CLI side of firstdraft/firstdraft#1191, which moves the Rails target from 8.1.3.1 to 8.1.4. Rails 8.1.4 dumps schema columns in declaration order and changes titleize, so on 2026-10-16 the owner gave the target a new profile ID and a new API contract. Per the recurring-changes guide, the CLI lands first.

• Profile. RAILS_TARGET_PROFILE becomes rails-sketch/2026-10. plan init writes it, and artifact validation accepts only it, so an artifact naming rails-sketch/2026-09-bookmark-assets fails as invalid_artifact. The older-profile test now uses that just-retired ID. The Plan format stays firstdraft.foundation-plan.sketch/0.23.
• Versions. CLI 0.9.0 (a pre-1.0 minor bump for a breaking change), set with npm version per RELEASING.md, with its CHANGELOG entry. requires.api_contract becomes [">= 0.8.0", "< 0.9.0"].
• Fixture digest. The plan status zero-gap digest covers the target, so it is recomputed with the Service's GapSet serialization (JSON.pretty_generate plus a newline, key order from GapSet.build); the same method reproduces the previous digest. The synthetic analyzer/compiler release pair in tests and scripts/smoke-package.js is unchanged: the CLI does not pin the Service's values, and the new Service release name is not yet known.

Runtime compatibility. The CLI still does not read FirstDraft-API-Contract. The range is enforced by the Service's release compatibility check: against today's 0.7.0 Service, script/release_compatibility_check reports "cli does not support First Draft API contract 0.7.0". At runtime, the release's protection comes from the profile:

• CLI 0.9.0 with a 0.7.x Service: a Plan from plan init should fail at plan push, because that Service's schema pins the old profile. An old-profile Project that compiles there fails at download with invalid_artifact.
• CLI 0.8.2 with a 0.8.0 Service: a Plan from plan init, or one written by the old Skill, carries the retired profile. The Service refuses it at plan push (server_rejected), and the #1191 refusal names the fix. Only a new-profile Plan driven through CLI 0.8.2 gets as far as Compile, and it then fails late with invalid_artifact. The plugin's exact CLI pin prevents that pairing.

A merge releases nothing; the tag and npm publication wait for the coordinated release. Skills follow-up when it bundles 0.9.0: the CLI pin and requires.cli, the API range, and the profile in its references and evals.

Docs: updated docs/commands.md and CHANGELOG.md

Review: Codex, approve (1 round, no findings)

Validation

At the head commit, after npm ci --ignore-scripts:

• npm audit: found 0 vulnerabilities
• npm run check: passed; 274 tests, 274 pass, 0 fail, then pack:check and pack:smoke passed