docs(release): prep v3.2.0 — changelog, narrative, curated notes, version bumps

Release preparation for the v3.2.0 minor (991 commits / 44 closed epics since v3.1.0). The tag itself is deliberately NOT cut — operator approval step per the release skill (tag + push publishes via GoReleaser). - CHANGELOG.md + docs/CHANGELOG.md: new [3.2.0] stanza (verification- keystone narrative; absorbs the former [Unreleased] Wave A-F content). - docs/3.2.md: release narrative page (3.0 -> 3.1 -> 3.2 series). - docs/releases/2026-07-03-v3.2.0-notes.md: curated notes — PASSES scripts/validate-release-notes.sh v3.2.0 --since v3.1.0 (tier minor, coverage green; the publish job's hard gate). - Version bumps 3.1.0 -> 3.2.0: .claude-plugin/plugin.json, .claude-plugin/marketplace.json (metadata + plugins[0]), .agy-plugin/plugin.json, .codex-plugin/plugin.json, images/gemini/plugin.json, images/claude/verify.sh expected-version default; installer example refs freshened (install-claude/install-agy). ao --version stays tag-injected via goreleaser ldflags (no static file). Known issues recorded honestly in the notes: images/{claude,gemini} IMAGE-CORE acceptance recipes lag the 105->63 skill consolidation (age-085q; not in the publish path), env-local full-tier reds (worktree-disposition age-ym4b, memrl-health), the single 5b064b28b author residual (age-jhal), the cold >65KB review bound, and strict quorum honest-UNAVAILABLE. Verified: validate-release-notes PASS, tests/docs/validate-doc-release.sh PASS (0 broken links), make regen-check ALL GREEN, three-gap supergate PASS, heal --strict clean, check-go-lint clean. Refs: age-hl9q, age-61ci, age-085q
2026-09-14 15:08:13 +08:00 · 2026-07-02 23:44:21 -04:00
parent 4d1dd7edd1
commit 8f198ef4a4
12 changed files with 317 additions and 28 deletions
@@ -1,6 +1,6 @@
 {
  "name": "agentops-antigravity-core",
-  "version": "3.1.0",
+  "version": "3.2.0",
  "description": "AgentOps core operator skills packaged for Google Antigravity with Agent Mail MCP and AgentOps guard hooks.",
  "skills": "./skills",
  "agents": "./agents",
@@ -6,13 +6,13 @@
  },
  "metadata": {
    "description": "The operational layer for coding agents. Bookkeeping, validation, and flows that compound knowledge between sessions.",
-    "version": "3.1.0"
+    "version": "3.2.0"
  },
  "plugins": [
    {
      "name": "agentops",
      "description": "The operational layer for coding agents. Bookkeeping, validation, and flows that compound knowledge between sessions.",
-      "version": "3.1.0",
+      "version": "3.2.0",
      "source": "./",
      "author": {
        "name": "Boden Fuller",
@@ -1,6 +1,6 @@
 {
  "name": "agentops",
-  "version": "3.1.0",
+  "version": "3.2.0",
  "description": "The operational layer for coding agents. Bookkeeping, validation, and flows that compound knowledge between sessions.",
  "author": {
    "name": "Boden Fuller",
@@ -1,6 +1,6 @@
 {
  "name": "agentops",
-  "version": "3.1.0",
+  "version": "3.2.0",
  "description": "The operational layer for coding agents. Bookkeeping, validation, and flows that compound knowledge between sessions.",
  "skills": "./skills-codex",
  "interface": {
@@ -7,18 +7,59 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+## [3.2.0] - 2026-07-03
+
+AgentOps 3.2 is the **verification-keystone** minor: the cross-family review loop became the product's front door. `ao verify` is the canonical verb over the pawl engine (with `init` making the pre-push verdict ratchet portable to any repo, `stats` pricing the cost of verified-done, and `receipts` rendering the proof), `ao done` makes bead closes verdict-referenced, and the reviewer hardened into a standing multi-model service with honest degradation — outage-only failover, REBOUND re-authorization for byte-identical rebases, and an opt-in strict two-family quorum that reports honest-UNAVAILABLE rather than fake redundancy. The membrane gained memory (`ao membrane catch/recall/triage`) and its escape→derived-check loop is proven end-to-end on the shipped binary, including constraint travel to CI. Around that core the CLI shed the cathedral: the default build is the verification + bookkeeping spine (corpus-flywheel and legacy families behind `-tags "flywheel legacy"`, ADR-0012), the `ao rpi` surface and v1 memory experiment are removed, the bd/Dolt tracker is retired for `br`+`bv`, and the skill catalog consolidated 105→63. See [docs/3.2.md](https://github.com/boshu2/agentops/blob/main/docs/3.2.md) for the release narrative.
+
+### Added
+
+- **`ao verify` — the verification front door** (age-wedge-all-in-dyr0, age-rk3r): `ao verify` reviews a change and binds the verdict to the provenance ledger; `ao verify init` installs the portable pre-push verdict ratchet + chain verify in any repo; `ao verify stats` reports dispositions, refute rate, rounds, duration, degraded share, and re-review waste from the ledger; `ao verify receipts` renders the proof page from the embedded bundle; per-repo config file + `--show-config`.
+- **`ao done`** — verdict-referenced bead close with a warn-first close-rate gate, falling back to the origin/main ledger when the local one lags (age-wedge-all-in-dyr0.4, age-lw4c); **`ao provenance show`** (per-SHA/bead verdict lineage) and **`ao provenance mine-session`**.
+- **Standing pawl service** (age-standing-pawl-service-ml8): `ao pawl up/down/health/route/metrics` with warm tri-model panes (Claude + Codex + AGY), capability-adaptive routing, self-healing respawn/reroute, p50/p95 + agreement SLOs; `ao pawl review` runs zero-config on a stranger's repo (age-a9iv).
+- **Verdict-integrity layers** (age-rk3r): REBOUND patch-id verdicts authorize byte-identical rebases without a re-review (honored by the portable push-gate and CI with Go-side lineage+proof re-validation, plus a keep-ref so CI can re-verify an orphaned reviewed commit); opt-in strict two-family cold quorum that refuses to degrade (honest-UNAVAILABLE); outage-only cold reviewer failover chain with explicit degraded labels; evidence-quality floor for CONFIRMED; live-smoke verify mode; provenance v1.1 verdict-edge enrichment (reviewer_family, degraded, rounds, duration_s, evidence_path).
+- **Membrane memory** (age-zpj5, age-membrane-memory-arch-tz2s): `ao membrane catch` records panel catches (class key + affected paths), `ao membrane recall --include-catches` retrieves them by domain into prompts, `ao membrane triage` reports honest two-axis recurrence; the escape→derived-check loop is proven end-to-end on the shipped binary (`scripts/em-loop-donetest.sh`) with learned constraints traveling to CI and clean clones.
+- **`ao wiki`** — the OpenKB port (age-port-openkb-into-agentops-go-5qw): `init/use/add/remove/recompile/lint/status`, gold-wiki compilation from `.agents/` with sanitize+mine, and verdict-gated publish bound to a content digest; retrieval integration via `ao lookup --gold` and `--pointers` bounded retrieval with a cold-start ε-exploration floor.
+- **Plan-pawl duel** (age-plan-pawl-9yib): `ao plan-pawl decide` deterministic duel decider; `/discovery` gains `--duel/--no-duel/--duel-rounds`; pre-mortem gains the duel checklist; ApprovalEdge records two judge panes.
+- **Real token accounting + governor**: per-bead token capture kills the hardcoded zeros, `ao yield tokens` parses Claude and Codex transcripts (deduped by response id, loud on absent usage), and `ao governor budget` adds an SPC error-budget with a two-sided noise band (age-membrane-memory-arch-tz2s.3, .7).
+- **Gate wave** (age-gate-the-ungated-egwt, age-push-equals-ci-0ua): full `-race` suite on push-to-main, provenance hash-chain gate at the pre-push boundary, `docs.cli-snippets` (live docs resolve against the cobra tree), `docs.skill-refs --all-docs`, `docs.demoted-claims` honesty lexicon, script-preamble ratchet, ADR-registry check, fail-closed pinned golangci-lint, static shell-portability gate, jsonl-scanner ratchet, and a report-only CI verdict backstop (age-wedge-all-in-dyr0.9).
+- **Land pipeline** (agentops-2pl, age-genn, age-qeqv, age-tkxq): single-writer land lane with branch submit queue and default-deny gh shim, deterministic land wrapper, staged-scope pre-commit guard against concurrent-lane contamination, first-class per-item consumed markers in next-work.
+- **Eval instruments** (age-cwo, age-7q7d, age-kf-s1-close-loop-0ly): verification-membrane eval (false-done catch rate over deterministic oracles + cross-family verifiers), real-false-done trap tasks, escape-harvest tooling, measured local-MLX eval membrane (100% per-task concordance vs codex; eval-path only), scenario-ab environment-level arm isolation (macOS sandbox-exec), deterministic answer-key grading, ceiling pre-screen, absolute task-success judging.
+- **Codex runtime hardening** (ag-p273x, ag-codex-runtime-enhancement-o0nds): task-packet and run-receipt JSON Schemas enforced at runtime, `required_commands` executed and recorded, dispatch paths bounded to cwd/`allowed_paths`, packet-injected auth env rejected, dispatch receipts, image health doctor with per-check timeouts.
+- **ms integration**: the `ms` skill (meta_skill search/load doctrine), session-bootstrap surfacing, `ms-reindex` wrapper + post-merge hook installer, and "ms search first" folded into discovery/plan/skill-builder (age-l6y3, age-22g0, age-50pr).
+- **15-skill spine partition**: `spine: true` frontmatter with a behavioral GOALS gate, plus `flywheel`/`legacy` archive build tags — the default `ao` build omits archived families (age-focus-membrane-bookkeeper-m1wg.12/.23, ADR-0012).
+
 ### Changed

- **Out-of-session substrate wording reconciled (Wave F).** Live multi-agent orchestration is documented as **NTM/ATM + Agent Mail**; Gas City remains an optional reference SDK, not the default operator substrate. Historical 3.0.0 CHANGELOG entries that name Gas City as primary orchestration are superseded by this note for current doctrine — see [`docs/3.0.md`](docs/3.0.md) and [`docs/architecture/codebase-overview.md`](docs/architecture/codebase-overview.md).
+- **The ship path routes to the Go release authority** — `ao gate check` is the default gate on the ship path (age-fkps), `#trivial` waivers verify the diff is genuinely provenance-only (age-u43w), and non-trivial commits hidden behind a `#trivial` tip are gated individually (age-8ais).
+- **The default pawl routes through the standing service** when it is up, with size-scaled review timeouts for large read-files packets (age-standing-pawl-service-ml8.7, age-wedge-all-in-dyr0.11).
+- **Skill catalog consolidated hard**: the corpus prune folded 39 sources into 21 targets (105→65, ag-s43tg), then 70→63 with six skills folded into canonical owners (#889); six corpus-flywheel skills plus `evolve`/`autodev`/`acfs` demoted to a new experimental tier; substrate skills folded 13→5; `ao skills retire` makes retirement deterministic via the dispositions ledger; all 50 trigger-marker offenders cleared behind a new `skill.triggers` gate.
+- **Codex twins are generated self-contained** from source with pointer exemptions, a byte-verify drift gate, and content-divergence gates extended to SKILL.md bodies and references; twin regeneration scoped to the spine set (~70% regen cut) (age-8wm, age-codex-twin-generator-qlj, age-k2ag, age-focus-membrane-bookkeeper-m1wg.18).
+- **CLI consolidation**: session-continuity commands under `ao session`, eval-family commands under `ao eval`, an experimental help group for corpus/flywheel surfaces, and a quick-start that lands the first verdict in one command (age-focus-membrane-bookkeeper-m1wg.16/.17, age-h4y3, age-wedge-all-in-dyr0.5).
+- **Storage discipline**: canonical `storage.AtomicWriteFile` (quest/llmwiki/doctor/wiki delegate), exported JSONL helpers with a loud-failure buffer policy, fsync-safe atomic writes + parent-dir fsync, and tar extraction containment (age-3azc, age-uja6, age-storage-hardening-roxg, age-y9jy).
+- **Out-of-session substrate wording reconciled (Wave F).** Live multi-agent orchestration is documented as **NTM/ATM + Agent Mail**; Gas City remains an optional reference SDK, not the default operator substrate. Historical 3.0.0 CHANGELOG entries that name Gas City as primary orchestration are superseded by this note for current doctrine — see [`docs/3.0.md`](https://github.com/boshu2/agentops/blob/main/docs/3.0.md) and [`docs/architecture/codebase-overview.md`](https://github.com/boshu2/agentops/blob/main/docs/architecture/codebase-overview.md).
+- **Doc-debt reconciliation waves A–F (2026-06-16)**: `cli/AGENTS.md` br pointer stub + `cli.agents-tracker` drift gate; RPI terminology glossary; `ports-and-adapters.md` + BC5 + hookless framing with a `docs.architecture-drift` gate; worktree disposition audit (dry-run); `skill-probe-i0.sh` + `check-provenance-orphans.sh` registered in the Go gate registry; skill-disposition triage checklist.
+- **Root agent docs reconciled to executable truth** (age-2d8m) — source-of-truth precedence stated inline; stale hook-era/`bd` wording swept; README claims PMF-linted with evidence citations (age-ejk).

-### Doc debt reconciliation (2026-06-16)
+### Fixed

- **Wave A:** `cli/AGENTS.md` br pointer stub; `ao session bootstrap` counts ready beads via `br ready --json`; new `cli.agents-tracker` drift gate.
- **Wave B:** RPI terminology glossary in `docs/architecture/codebase-overview.md`.
- **Wave C:** `ports-and-adapters.md`, BC5 in `bounded-contexts.yaml`, `ARCHITECTURE.md`/`CI-CD.md` hookless framing; `docs.architecture-drift` gate.
- **Wave D:** worktree disposition audit ([`docs/audits/2026-06-16-worktree-disposition-audit.md`](docs/audits/2026-06-16-worktree-disposition-audit.md)) — dry-run only.
- **Wave E:** registered `skill-probe-i0.sh` (I0 advisory) and `check-provenance-orphans.sh` in Go gate registry; deferred workflow script count 13 → 11.
- **Wave F:** disposition triage checklist ([`docs/audits/2026-06-16-skill-disposition-triage.md`](docs/audits/2026-06-16-skill-disposition-triage.md)).
+- **Pawl truthfulness arc**: each pane's ACTUAL verdict is recorded (no fabricated REFUTED from timeouts), all verdicts are collected (no first-REFUTE guillotine), cc/agy sends are delivery-based (the unreliable atm-wait engagement gate removed), cold codex reviews are echo-safe with a hardened shared `codex-exec` runner, a hijack guard refuses verdict binds when the worktree HEAD moved mid-review, and backgrounding-reap failures self-explain (age-pawl-good-bar, age-55qz.10/.11, age-sylz, age-wjp0, age-gate-the-ungated-egwt.8/.13).
+- **Full-tier gate reds greened** (age-hl9q): the flywheel proof builds its sandbox `ao` with the ADR-0012 archive tags (`PROOF_BUILD_TAGS`), `heal.sh --strict` resolves skill CLI references against the full command surface via the shared snippet resolver (third instance of the archived-command escape class), and `computeVerifyStats` was split under the gocyclo budget.
+- **macOS portability sweep**: bats suites and release scripts fixed for BSD `wc`/`stat`/`find`/`sed`/`touch` divergences; a static shell-portability gate guards regressions (age-qzvm, age-lz4b, age-m9rf, age-jtz0, age-i0ky, age-7jm6).
+- **Test isolation hardening** in `cli/cmd/ao`: cobra flag/writer state restored via `t.Cleanup`, tmux socket isolation, deterministic process-group tests, os.Setenv ratchet, and the trustworthy cmd/ao test floor restored with the gate blindness that shipped it red closed.
+- **Regen determinism**: `registry.json` drops wall-clock `generated_at` (age-9itj), the skill catalog regen folded into `regen-all`/`regen-check` (age-biop), and the catalog/registry inventory surfaces agree at 64 skills (age-61ci).
+- **Provenance integrity**: strict bead-id extraction kills false edges from prose, post-land emit is race-proof via disposable worktrees, merge_sha is trunk-bound, and ledger appends serialize under a cross-process lock.
+
+### Removed
+
+- **The `ao rpi` command surface** — ADR-0009 executed; the operating loop + process skills are the navigation path, and the engine's live helpers were extracted to `internal/worktree`, `internal/runtimecmd`, and `internal/rpi` (age-tlj6, age-3pdt).
+- **`ao recall` and `ao memory ingest-claude`** — the v1 unified-memory experiment retired; recall is consumed from the coexisting open-source tools (cass / cass-memory) rather than rebuilt in-tree (age-5nvy, age-7grl).
+- **The bd/Dolt tracker lane** — `br` (beads_rust) + `bv` are canonical over a git-JSONL ledger; bd wrappers, docs, and workflow references swept with regression gates (ag-joto6, age-m44f, age-u1u6).
+- **Archived command families** — `turn`, `harness`, `operator`, `harvest`, `refinery`, `mind`, and `curate` moved behind the `flywheel`/`legacy` build tags; the dead `ao cron` compat shim deleted (age-focus-membrane-bookkeeper-m1wg.13/.14/.15).
+- **The unproven memory-moat machinery** — retired per ADR-0004 honesty; the membrane stays, the moat claims went (age-7grl).
+
+### Security
+
+- tar extraction containment (IsAbs reject, canonical path-inside assertion, typed rejects); fail-closed full-tree pre-push path guard for private artifacts; `ao corpus scan` deny/PII leak detector; cwd-relative script execution routed through the `aoBinaryInside` trust chokepoint; Codex dispatch rejects packet-injected auth env; the SDLC provenance ledger is tamper-evident with hash-chain verification at the pre-push boundary (age-storage-hardening-roxg.2, ag-ao0eo, ag-b0x50, age-gate-the-ungated-egwt.2/.9).

 ## [3.1.0] - 2026-06-08

@@ -0,0 +1,70 @@
+# AgentOps 3.2: the verification keystone
+
+> **3.2 is a minor on top of [3.1](3.1.md) and [3.0](3.0.md).** The north star is unchanged — AgentOps is the in-session operating loop plus the verification membrane that proves work is done. Read [3.0.md](3.0.md) for *what AgentOps is* and [3.1.md](3.1.md) for how it became installable and gate-disciplined. This page covers *what 3.2 adds*: verification becomes the **front door**, the reviewer becomes **standing infrastructure**, the membrane **remembers**, and the CLI **sheds the cathedral**. When this page and 3.0 disagree on the core thesis, 3.0 wins.
+
+3.1 proved the gate; 3.2 makes the gate the product you can hold. Four moves:
+
+1. **`ao verify` is the front door.** One canonical verb over the cross-family review engine — review a change, get a CONFIRMED/REFUTED verdict bound to the provenance ledger, and prove it later.
+2. **The reviewer is standing infrastructure.** A warm multi-model service with self-healing routes and honest failure labels, not a hand-rolled per-review invocation.
+3. **The membrane remembers.** Catches are recorded, recalled by domain, and honestly triaged; the escape→derived-check loop is proven end-to-end on the shipped binary.
+4. **The cathedral is shed.** The default build is the verification + bookkeeping spine; speculative surfaces moved behind build tags or out of the tree entirely.
+
+---
+
+## The verify story (the front door)
+
+Before 3.2, the cross-family review lived in scripts an operator had to know about. Now it is a product surface:
+
+- **`ao verify`** reviews a commit through the pawl engine and binds the verdict to `docs/provenance/ledger.jsonl` — the same ledger the close gate and the receipts read. No verdict = not done, now with a front door.
+- **`ao verify init`** installs the portable pre-push verdict ratchet in *any* repo — the membrane is no longer something only this repo has. `ao verify receipts` renders a proof page from the embedded bundle; `ao done` closes a bead only with a verdict reference.
+- **`ao verify stats`** prices the loop: dispositions, refute rate, rounds, wall-time, degraded share by reviewer family, and a re-review (rebase-waste) gauge — the instrument for the standing north star of driving the **cost of verified-done** toward the cost of unverified-done.
+
+The waste killer is **REBOUND**: a byte-identical rebase (same patch-id, lineage intact, gate green) re-authorizes an existing verdict instead of burning a fresh cross-family round. Measured re-reviews of unchanged diffs were pure waste; now they are a ledger disposition with Go-side lineage re-validation in the push gate and CI, plus a keep-ref so CI can re-verify an orphaned reviewed commit.
+
+## The standing reviewer (honest degradation everywhere)
+
+The reviewer had a structural single point of failure: cold reviews were codex-only, and a codex outage stalled all validation. 3.2 answers with layers, each honest about what it is:
+
+- A **standing pawl service** (`ao pawl up/down/health/route/metrics`) keeps warm tri-model panes (Claude + Codex + AGY) with capability-adaptive routing, self-healing respawn/reroute, and p50/p95 + agreement SLOs. The default review routes through it when it is up.
+- A **cold failover chain** engages only on outage and labels its verdicts `degraded` — the fallback never masquerades as the primary.
+- An opt-in **strict two-family cold quorum** refuses to degrade at all: until a second strict-eligible reviewer family is graduated, it reports honest-UNAVAILABLE rather than pretending redundancy exists.
+- An **evidence-quality floor** requires a finding-or-attestation plus a genuine-run marker before CONFIRMED counts, and a **live-smoke mode** puts runtime evidence in the packet — the membrane reviews more than the diff.
+
+Reliability fixes landed with the layers: verdicts are what panes actually said (never fabricated from a timeout), all panes are collected (no first-REFUTE guillotine), sends are delivery-based, and cold codex invocations share one hardened stall/echo-defended runner.
+
+## The membrane remembers
+
+3.2 closes the loop the product has claimed since the escape thesis was written:
+
+- **`ao membrane catch`** records a panel catch at the verdict chokepoint with a class key and affected paths; **`ao membrane recall`** retrieves catches by domain and can inject them into pre-work prompts; **`ao membrane triage`** reports recurrence on two honest axes instead of a vanity counter.
+- The **EM loop is proven on the shipped binary**: a false CONFIRMED becomes a domain-tagged escape, the escape compiles into a draft constraint, activation enforces it at the gate, the derived check auto-loads by domain citing the escape — and the learned constraint **travels** to CI and clean clones.
+- Real token accounting replaced the hardcoded zeros: per-bead capture, `ao yield tokens` across Claude and Codex transcripts, and an SPC governor over the error budget.
+
+What 3.2 deliberately does **not** claim: that the escape corpus compounds (ADR-0011) or that the knowledge corpus is a moat (ADR-0004). Those remain demoted hypotheses — and a new honesty gate mechanically bans unproven-claim language from live docs.
+
+## Shedding the cathedral
+
+The consolidation minor inside the minor:
+
+- **Spine partition.** Fifteen skills carry `spine: true` and a behavioral gate; the default `ao` build ships the verification + bookkeeping core. Corpus-flywheel and legacy families (`harvest`, `refinery`, `mind`, `turn`, `harness`, `operator`, `curate`) build only with `-tags "flywheel legacy"` (ADR-0012). Codex twin regeneration scoped to the spine cut routine regen ~70%.
+- **Removals.** The `ao rpi` command surface is gone (ADR-0009 executed; the operating loop is the navigation path). `ao recall` and `ao memory ingest-claude` are gone — recall is consumed from the coexisting open-source memory tools rather than rebuilt in-tree. The bd/Dolt tracker is retired; `br` + `bv` over a git-JSONL ledger are canonical.
+- **Skill corpus.** The prune folded 39 sources into 21 targets (105→65), then consolidation reached 63 with `ao skills retire` making retirement deterministic through the dispositions ledger.
+- **`ao wiki`.** The OpenKB port compiles `.agents/` into a sanitized gold wiki with verdict-gated, digest-bound publishing — the one knowledge surface that survived the consolidation because it feeds retrieval (`ao lookup --gold`).
+
+## What 3.2 does NOT change
+
+- **The 3.0 thesis stands.** In-session loop, hookless by default, no daemon, no telemetry; state stays in `.agents/` and the ledger.
+- **Verification is the proven product; the rest is honestly labeled.** Experimental tiers, demoted claims, and honest-UNAVAILABLE labels are load-bearing, not decoration.
+- **Out-of-session orchestration stays a substrate concern** (NTM/ATM + Agent Mail + managed agents), not an in-repo daemon.
+
+---
+
+## Cutting the release
+
+Mechanics are unchanged from 3.1: `ao --version` is injected at build time from the **git tag** via goreleaser ldflags — there is no static version file. The plugin manifests (`.claude-plugin`, `.agy-plugin`, `.codex-plugin`, `images/gemini/plugin.json`) carry `3.2.0` on `main`; the curated notes live at `docs/releases/2026-07-03-v3.2.0-notes.md` and pass the hard notes gate. Cutting the `v3.2.0` tag is the single load-bearing release step: it turns the landed content into a shipped 3.2 and drives the goreleaser release assets + Homebrew tap.
+
+> **Tag-cut status:** the 3.2 content is fully landed and locally gated; the `v3.2.0` annotated tag + push is the one downstream action the release owner performs to publish.
+
+---
+
+*Canonical references: [3.0.md](3.0.md) · [3.1.md](3.1.md) · [CHANGELOG](CHANGELOG.md) · [operating-loop](architecture/operating-loop.md) · `docs/releases/2026-07-03-v3.2.0-notes.md`*
@@ -7,18 +7,59 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+## [3.2.0] - 2026-07-03
+
+AgentOps 3.2 is the **verification-keystone** minor: the cross-family review loop became the product's front door. `ao verify` is the canonical verb over the pawl engine (with `init` making the pre-push verdict ratchet portable to any repo, `stats` pricing the cost of verified-done, and `receipts` rendering the proof), `ao done` makes bead closes verdict-referenced, and the reviewer hardened into a standing multi-model service with honest degradation — outage-only failover, REBOUND re-authorization for byte-identical rebases, and an opt-in strict two-family quorum that reports honest-UNAVAILABLE rather than fake redundancy. The membrane gained memory (`ao membrane catch/recall/triage`) and its escape→derived-check loop is proven end-to-end on the shipped binary, including constraint travel to CI. Around that core the CLI shed the cathedral: the default build is the verification + bookkeeping spine (corpus-flywheel and legacy families behind `-tags "flywheel legacy"`, ADR-0012), the `ao rpi` surface and v1 memory experiment are removed, the bd/Dolt tracker is retired for `br`+`bv`, and the skill catalog consolidated 105→63. See [docs/3.2.md](https://github.com/boshu2/agentops/blob/main/docs/3.2.md) for the release narrative.
+
+### Added
+
+- **`ao verify` — the verification front door** (age-wedge-all-in-dyr0, age-rk3r): `ao verify` reviews a change and binds the verdict to the provenance ledger; `ao verify init` installs the portable pre-push verdict ratchet + chain verify in any repo; `ao verify stats` reports dispositions, refute rate, rounds, duration, degraded share, and re-review waste from the ledger; `ao verify receipts` renders the proof page from the embedded bundle; per-repo config file + `--show-config`.
+- **`ao done`** — verdict-referenced bead close with a warn-first close-rate gate, falling back to the origin/main ledger when the local one lags (age-wedge-all-in-dyr0.4, age-lw4c); **`ao provenance show`** (per-SHA/bead verdict lineage) and **`ao provenance mine-session`**.
+- **Standing pawl service** (age-standing-pawl-service-ml8): `ao pawl up/down/health/route/metrics` with warm tri-model panes (Claude + Codex + AGY), capability-adaptive routing, self-healing respawn/reroute, p50/p95 + agreement SLOs; `ao pawl review` runs zero-config on a stranger's repo (age-a9iv).
+- **Verdict-integrity layers** (age-rk3r): REBOUND patch-id verdicts authorize byte-identical rebases without a re-review (honored by the portable push-gate and CI with Go-side lineage+proof re-validation, plus a keep-ref so CI can re-verify an orphaned reviewed commit); opt-in strict two-family cold quorum that refuses to degrade (honest-UNAVAILABLE); outage-only cold reviewer failover chain with explicit degraded labels; evidence-quality floor for CONFIRMED; live-smoke verify mode; provenance v1.1 verdict-edge enrichment (reviewer_family, degraded, rounds, duration_s, evidence_path).
+- **Membrane memory** (age-zpj5, age-membrane-memory-arch-tz2s): `ao membrane catch` records panel catches (class key + affected paths), `ao membrane recall --include-catches` retrieves them by domain into prompts, `ao membrane triage` reports honest two-axis recurrence; the escape→derived-check loop is proven end-to-end on the shipped binary (`scripts/em-loop-donetest.sh`) with learned constraints traveling to CI and clean clones.
+- **`ao wiki`** — the OpenKB port (age-port-openkb-into-agentops-go-5qw): `init/use/add/remove/recompile/lint/status`, gold-wiki compilation from `.agents/` with sanitize+mine, and verdict-gated publish bound to a content digest; retrieval integration via `ao lookup --gold` and `--pointers` bounded retrieval with a cold-start ε-exploration floor.
+- **Plan-pawl duel** (age-plan-pawl-9yib): `ao plan-pawl decide` deterministic duel decider; `/discovery` gains `--duel/--no-duel/--duel-rounds`; pre-mortem gains the duel checklist; ApprovalEdge records two judge panes.
+- **Real token accounting + governor**: per-bead token capture kills the hardcoded zeros, `ao yield tokens` parses Claude and Codex transcripts (deduped by response id, loud on absent usage), and `ao governor budget` adds an SPC error-budget with a two-sided noise band (age-membrane-memory-arch-tz2s.3, .7).
+- **Gate wave** (age-gate-the-ungated-egwt, age-push-equals-ci-0ua): full `-race` suite on push-to-main, provenance hash-chain gate at the pre-push boundary, `docs.cli-snippets` (live docs resolve against the cobra tree), `docs.skill-refs --all-docs`, `docs.demoted-claims` honesty lexicon, script-preamble ratchet, ADR-registry check, fail-closed pinned golangci-lint, static shell-portability gate, jsonl-scanner ratchet, and a report-only CI verdict backstop (age-wedge-all-in-dyr0.9).
+- **Land pipeline** (agentops-2pl, age-genn, age-qeqv, age-tkxq): single-writer land lane with branch submit queue and default-deny gh shim, deterministic land wrapper, staged-scope pre-commit guard against concurrent-lane contamination, first-class per-item consumed markers in next-work.
+- **Eval instruments** (age-cwo, age-7q7d, age-kf-s1-close-loop-0ly): verification-membrane eval (false-done catch rate over deterministic oracles + cross-family verifiers), real-false-done trap tasks, escape-harvest tooling, measured local-MLX eval membrane (100% per-task concordance vs codex; eval-path only), scenario-ab environment-level arm isolation (macOS sandbox-exec), deterministic answer-key grading, ceiling pre-screen, absolute task-success judging.
+- **Codex runtime hardening** (ag-p273x, ag-codex-runtime-enhancement-o0nds): task-packet and run-receipt JSON Schemas enforced at runtime, `required_commands` executed and recorded, dispatch paths bounded to cwd/`allowed_paths`, packet-injected auth env rejected, dispatch receipts, image health doctor with per-check timeouts.
+- **ms integration**: the `ms` skill (meta_skill search/load doctrine), session-bootstrap surfacing, `ms-reindex` wrapper + post-merge hook installer, and "ms search first" folded into discovery/plan/skill-builder (age-l6y3, age-22g0, age-50pr).
+- **15-skill spine partition**: `spine: true` frontmatter with a behavioral GOALS gate, plus `flywheel`/`legacy` archive build tags — the default `ao` build omits archived families (age-focus-membrane-bookkeeper-m1wg.12/.23, ADR-0012).
+
 ### Changed

- **Out-of-session substrate wording reconciled (Wave F).** Live multi-agent orchestration is documented as **NTM/ATM + Agent Mail**; Gas City remains an optional reference SDK, not the default operator substrate. Historical 3.0.0 CHANGELOG entries that name Gas City as primary orchestration are superseded by this note for current doctrine — see [`docs/3.0.md`](docs/3.0.md) and [`docs/architecture/codebase-overview.md`](docs/architecture/codebase-overview.md).
+- **The ship path routes to the Go release authority** — `ao gate check` is the default gate on the ship path (age-fkps), `#trivial` waivers verify the diff is genuinely provenance-only (age-u43w), and non-trivial commits hidden behind a `#trivial` tip are gated individually (age-8ais).
+- **The default pawl routes through the standing service** when it is up, with size-scaled review timeouts for large read-files packets (age-standing-pawl-service-ml8.7, age-wedge-all-in-dyr0.11).
+- **Skill catalog consolidated hard**: the corpus prune folded 39 sources into 21 targets (105→65, ag-s43tg), then 70→63 with six skills folded into canonical owners (#889); six corpus-flywheel skills plus `evolve`/`autodev`/`acfs` demoted to a new experimental tier; substrate skills folded 13→5; `ao skills retire` makes retirement deterministic via the dispositions ledger; all 50 trigger-marker offenders cleared behind a new `skill.triggers` gate.
+- **Codex twins are generated self-contained** from source with pointer exemptions, a byte-verify drift gate, and content-divergence gates extended to SKILL.md bodies and references; twin regeneration scoped to the spine set (~70% regen cut) (age-8wm, age-codex-twin-generator-qlj, age-k2ag, age-focus-membrane-bookkeeper-m1wg.18).
+- **CLI consolidation**: session-continuity commands under `ao session`, eval-family commands under `ao eval`, an experimental help group for corpus/flywheel surfaces, and a quick-start that lands the first verdict in one command (age-focus-membrane-bookkeeper-m1wg.16/.17, age-h4y3, age-wedge-all-in-dyr0.5).
+- **Storage discipline**: canonical `storage.AtomicWriteFile` (quest/llmwiki/doctor/wiki delegate), exported JSONL helpers with a loud-failure buffer policy, fsync-safe atomic writes + parent-dir fsync, and tar extraction containment (age-3azc, age-uja6, age-storage-hardening-roxg, age-y9jy).
+- **Out-of-session substrate wording reconciled (Wave F).** Live multi-agent orchestration is documented as **NTM/ATM + Agent Mail**; Gas City remains an optional reference SDK, not the default operator substrate. Historical 3.0.0 CHANGELOG entries that name Gas City as primary orchestration are superseded by this note for current doctrine — see [`docs/3.0.md`](https://github.com/boshu2/agentops/blob/main/docs/3.0.md) and [`docs/architecture/codebase-overview.md`](https://github.com/boshu2/agentops/blob/main/docs/architecture/codebase-overview.md).
+- **Doc-debt reconciliation waves A–F (2026-06-16)**: `cli/AGENTS.md` br pointer stub + `cli.agents-tracker` drift gate; RPI terminology glossary; `ports-and-adapters.md` + BC5 + hookless framing with a `docs.architecture-drift` gate; worktree disposition audit (dry-run); `skill-probe-i0.sh` + `check-provenance-orphans.sh` registered in the Go gate registry; skill-disposition triage checklist.
+- **Root agent docs reconciled to executable truth** (age-2d8m) — source-of-truth precedence stated inline; stale hook-era/`bd` wording swept; README claims PMF-linted with evidence citations (age-ejk).

-### Doc debt reconciliation (2026-06-16)
+### Fixed

- **Wave A:** `cli/AGENTS.md` br pointer stub; `ao session bootstrap` counts ready beads via `br ready --json`; new `cli.agents-tracker` drift gate.
- **Wave B:** RPI terminology glossary in `docs/architecture/codebase-overview.md`.
- **Wave C:** `ports-and-adapters.md`, BC5 in `bounded-contexts.yaml`, `ARCHITECTURE.md`/`CI-CD.md` hookless framing; `docs.architecture-drift` gate.
- **Wave D:** worktree disposition audit ([`docs/audits/2026-06-16-worktree-disposition-audit.md`](docs/audits/2026-06-16-worktree-disposition-audit.md)) — dry-run only.
- **Wave E:** registered `skill-probe-i0.sh` (I0 advisory) and `check-provenance-orphans.sh` in Go gate registry; deferred workflow script count 13 → 11.
- **Wave F:** disposition triage checklist ([`docs/audits/2026-06-16-skill-disposition-triage.md`](docs/audits/2026-06-16-skill-disposition-triage.md)).
+- **Pawl truthfulness arc**: each pane's ACTUAL verdict is recorded (no fabricated REFUTED from timeouts), all verdicts are collected (no first-REFUTE guillotine), cc/agy sends are delivery-based (the unreliable atm-wait engagement gate removed), cold codex reviews are echo-safe with a hardened shared `codex-exec` runner, a hijack guard refuses verdict binds when the worktree HEAD moved mid-review, and backgrounding-reap failures self-explain (age-pawl-good-bar, age-55qz.10/.11, age-sylz, age-wjp0, age-gate-the-ungated-egwt.8/.13).
+- **Full-tier gate reds greened** (age-hl9q): the flywheel proof builds its sandbox `ao` with the ADR-0012 archive tags (`PROOF_BUILD_TAGS`), `heal.sh --strict` resolves skill CLI references against the full command surface via the shared snippet resolver (third instance of the archived-command escape class), and `computeVerifyStats` was split under the gocyclo budget.
+- **macOS portability sweep**: bats suites and release scripts fixed for BSD `wc`/`stat`/`find`/`sed`/`touch` divergences; a static shell-portability gate guards regressions (age-qzvm, age-lz4b, age-m9rf, age-jtz0, age-i0ky, age-7jm6).
+- **Test isolation hardening** in `cli/cmd/ao`: cobra flag/writer state restored via `t.Cleanup`, tmux socket isolation, deterministic process-group tests, os.Setenv ratchet, and the trustworthy cmd/ao test floor restored with the gate blindness that shipped it red closed.
+- **Regen determinism**: `registry.json` drops wall-clock `generated_at` (age-9itj), the skill catalog regen folded into `regen-all`/`regen-check` (age-biop), and the catalog/registry inventory surfaces agree at 64 skills (age-61ci).
+- **Provenance integrity**: strict bead-id extraction kills false edges from prose, post-land emit is race-proof via disposable worktrees, merge_sha is trunk-bound, and ledger appends serialize under a cross-process lock.
+
+### Removed
+
+- **The `ao rpi` command surface** — ADR-0009 executed; the operating loop + process skills are the navigation path, and the engine's live helpers were extracted to `internal/worktree`, `internal/runtimecmd`, and `internal/rpi` (age-tlj6, age-3pdt).
+- **`ao recall` and `ao memory ingest-claude`** — the v1 unified-memory experiment retired; recall is consumed from the coexisting open-source tools (cass / cass-memory) rather than rebuilt in-tree (age-5nvy, age-7grl).
+- **The bd/Dolt tracker lane** — `br` (beads_rust) + `bv` are canonical over a git-JSONL ledger; bd wrappers, docs, and workflow references swept with regression gates (ag-joto6, age-m44f, age-u1u6).
+- **Archived command families** — `turn`, `harness`, `operator`, `harvest`, `refinery`, `mind`, and `curate` moved behind the `flywheel`/`legacy` build tags; the dead `ao cron` compat shim deleted (age-focus-membrane-bookkeeper-m1wg.13/.14/.15).
+- **The unproven memory-moat machinery** — retired per ADR-0004 honesty; the membrane stays, the moat claims went (age-7grl).
+
+### Security
+
+- tar extraction containment (IsAbs reject, canonical path-inside assertion, typed rejects); fail-closed full-tree pre-push path guard for private artifacts; `ao corpus scan` deny/PII leak detector; cwd-relative script execution routed through the `aoBinaryInside` trust chokepoint; Codex dispatch rejects packet-injected auth env; the SDLC provenance ledger is tamper-evident with hash-chain verification at the pre-push boundary (age-storage-hardening-roxg.2, ag-ao0eo, ag-b0x50, age-gate-the-ungated-egwt.2/.9).

 ## [3.1.0] - 2026-06-08

@@ -0,0 +1,137 @@
+# AgentOps v3.2.0
+
+## Highlights
+
+AgentOps 3.2 is the **verification-keystone** minor: the cross-family review loop that guards this repo is now a first-class, portable product surface. `ao verify` becomes the canonical front door — one verb to review a change, bind the verdict to the provenance ledger, and prove it later — with `ao verify init` installing the same pre-push verdict ratchet in any repo, `ao verify stats` pricing the cost of verified-done, and `ao verify receipts` rendering the proof page. Behind that front door the reviewer hardened into a standing multi-model service with honest failure labels (outage-only failover, REBOUND re-authorization for byte-identical rebases, an opt-in strict two-family quorum), and the membrane gained memory: catches are recorded, recalled by domain, and honestly triaged, with the escape→derived-check loop proven end-to-end on the shipped binary. Around that core the CLI shed the cathedral — the default build is now the verification + bookkeeping spine, the speculative corpus-flywheel moved behind build tags, and `ao rpi`, `ao recall`, and the bd/Dolt tracker are gone. See [docs/3.2.md](../3.2.md) for the full narrative.
+
+## Upgrade Notes
+
+- Standard installs upgrade in place — `brew upgrade agentops` or re-run the install one-liner for your runtime (README §Install). No data migration.
+- Removed: the `ao rpi` command surface (ADR-0009 executed). The operating loop ([docs/architecture/operating-loop.md](../architecture/operating-loop.md)) plus the process skills are the navigation path; `/rpi` remains as a skill.
+- Removed: `ao recall` and `ao memory ingest-claude` (the v1 unified-memory experiment). Recall is consumed from the coexisting open-source tools (cass / cass-memory) rather than rebuilt in-tree.
+- Removed: the bd/Dolt tracker lane. `br` (beads_rust) + `bv` are canonical; the issue ledger is git-JSONL. `bd` wrappers and docs were swept.
+- Changed: the default `ao` build ships the spine only. Corpus-flywheel and legacy command families (`harvest`, `refinery`, `mind`, `turn`, `harness`, `operator`, `curate`) now require an explicit `-tags "flywheel legacy"` build; the default binary omits them and `ao --help` groups experimental surfaces separately.
+- Deprecated: `ao inject` as the context query door — skills and docs now point to `ao lookup` (the command itself still ships in 3.2).
+- New verbs worth adopting: `ao verify`, `ao done` (verdict-referenced bead close), `ao provenance show`, `ao pawl {up,health,route,metrics}`, `ao wiki`, `ao plan-pawl decide`.
+
+## At a Glance
+
+| Product Area | Added | Changed | Refactored | Fixed | Deprecated/Removed |
+|---|---:|---:|---:|---:|---:|
+| Install, Upgrade, and Distribution | 1 | 3 | 0 | 1 | 0 |
+| CLI and Operator Commands | 6 | 2 | 0 | 1 | 3 |
+| Skills and Workflows | 4 | 4 | 0 | 2 | 1 |
+| Codex and Runtime Integrations | 3 | 2 | 0 | 2 | 0 |
+| Knowledge Flywheel, Search, and Memory | 3 | 2 | 0 | 1 | 1 |
+| Eval, Validation, and Release Gates | 7 | 3 | 0 | 3 | 0 |
+| Docs and Onboarding | 2 | 2 | 0 | 1 | 0 |
+| Security, Privacy, and Supply Chain | 0 | 0 | 0 | 0 | 0 |
+| Contributor/Internal Refactors | 0 | 0 | 2 | 1 | 0 |
+
+## Product Areas
+
+### Install, Upgrade, and Distribution
+
+- Added: a spine-only install tier — the default `ao` build carries the verification + bookkeeping core, with corpus-flywheel and legacy commands behind `flywheel`/`legacy` build tags.
+- Changed: the pre-push path is safer under load — installs are worktree-safe with a self-healing hook chainer and `core.bare` heal, concurrent local pushes serialize, and installed fast-forward hook candidates are preserved.
+- Changed: `ms-reindex` ships with a post-merge hook installer so the skill-search index stays current mechanically.
+- Changed: GitHub Actions checkout bumped from v4 to v7 across workflows.
+- Fixed: workflow install/drift validation scripts guard the `.claude/workflows` install path against marker and content drift.
+
+### CLI and Operator Commands
+
+- Added: `ao verify` — the canonical verification verb over the cross-family review engine, with `init` (portable pre-push verdict ratchet + chain verify for any repo), `stats` (cost-of-verified-done from the ledger), `receipts` (portable proof page), and a per-repo config file with `--show-config`.
+- Added: `ao done` — verdict-referenced bead close with a warn-first close-rate gate; falls back to the origin/main ledger when the local one lags.
+- Added: `ao pawl` service surface — `up/down/health/route/metrics` for the standing reviewer service, plus `ao pawl review` for one-shot reviews that work zero-config on a stranger's repo.
+- Added: `ao provenance show` (per-SHA/bead verdict lineage) and `ao provenance mine-session` (native incremental session-log miner).
+- Added: `ao wiki` — the OpenKB port: `init/use/add/remove/recompile/lint/status`, gold-wiki compilation from `.agents/`, and verdict-gated publish bound to a content digest.
+- Added: `ao plan-pawl decide` (deterministic duel decider), `ao governor budget` (error-budget burn-rate), `ao scenario evaluate`, `ao worktree create`, `ao beads verify-acceptance`, `ao rehydrate`, and `ao skills retire`.
+- Changed: session-continuity commands consolidated under `ao session`; eval-family commands consolidated under `ao eval`; the quick-start reaches a first verdict in one command.
+- Changed: `--config` is fail-closed — the flag names THE config file, with no silent home-directory leak.
+- Fixed: gate checks accept `--scope range` and emit non-empty `--json` FAIL detail for landing loops.
+- Removed: the `ao rpi` command surface — the operating loop and skills are the navigation path (ADR-0009).
+- Removed: `ao recall` and `ao memory ingest-claude` — recall is consumed from cass/cass-memory instead of rebuilt in-tree.
+- Removed: the dead `ao cron` compatibility shim; `turn`, `harness`, `operator`, `harvest`, `refinery`, `mind`, and `curate` moved behind archive build tags.
+
+### Skills and Workflows
+
+- Added: a durable 15-skill spine partition (`spine: true` with a behavioral GOALS gate) separating the proven product loop from experimental skills.
+- Added: the `ms` skill — meta_skill search/load doctrine (MCP consume, CLI writes) — surfaced in session bootstrap and folded into the discovery/plan/skill-builder decision points.
+- Added: plan-pawl duel integration — `/discovery` gains `--duel/--no-duel/--duel-rounds`, pre-mortem gains the duel checklist, and fanout-class plans get a cross-family acceptance gate before beads are written.
+- Added: `behavior-first-planning` and `pre-land-refuters` skills; `dual-pane-atm` absorbs the mixed-model duel; `account-rotation` unifies host-routed account switching.
+- Changed: the skill catalog was consolidated hard — the corpus prune folded 39 sources into 21 targets (105→65), then 70→63 with six skills folded into canonical owners; `ao skills retire` makes retirement deterministic via the dispositions ledger.
+- Changed: six corpus-flywheel skills plus `evolve`/`autodev`/`acfs` demoted to a new experimental tier (Codex twins dropped for demoted skills).
+- Changed: substrate-skill sprawl folded 13→5 via the dispositions ledger.
+- Changed: all 50 trigger-marker offenders cleared and held by a new `skill.triggers` gate; folded-skill redirects are gate-checked for validity.
+- Fixed: retired `bd` tracker vocabulary swept for `br` across the skill corpus and workflows, with a regression gate.
+- Fixed: skill fences avoid start-of-line `#` comments that the ms normalizer garbles.
+- Removed: the standalone `caam` skill (folded into `account-rotation`) and other retired slugs per the dispositions ledger.
+
+### Codex and Runtime Integrations
+
+- Added: task-packet and run-receipt JSON Schemas enforced at runtime — dispatch validates the packet, executes `required_commands`, and records results in the receipt.
+- Added: dispatch security hardening — packet-injected auth env is rejected and dispatch paths are bounded to cwd/`allowed_paths` roots.
+- Added: a Codex image health doctor with per-check timeouts and slow-check reporting.
+- Changed: Codex twins are now generated self-contained from source (killing the hand-mirror whack-a-mole), with a pointer-exemption mechanism, byte-verify drift gate, and content-divergence gates extended to SKILL.md bodies and references.
+- Changed: twin regeneration is scoped to the spine set — a ~70% regen cut for routine landings.
+- Fixed: a shared fail-closed `codex-exec` runner library centralizes stall/echo defenses for every non-pawl caller.
+- Fixed: rebase auto-merge damage in generated Codex manifests is repaired and guarded.
+
+### Knowledge Flywheel, Search, and Memory
+
+- Added: membrane memory — `ao membrane catch` records panel catches at the verdict chokepoint, `ao membrane recall` retrieves them by domain (`--include-catches` injects them into prompts), and `ao membrane triage` is an honest two-axis recurrence instrument.
+- Added: the escape→derived-check loop is proven end-to-end on the shipped binary — an escape compiles into a draft constraint, activation enforces it at the gate, the derived check auto-loads by domain and cites the escape, and learned constraints travel to CI and clean clones.
+- Added: real token accounting — per-bead token capture, `ao yield tokens` (Claude and Codex transcripts, deduped by response id, loud on absent usage), and an SPC governor (`ao governor budget`) with a two-sided noise band.
+- Changed: retrieval gained a gold layer — `ao lookup --gold` reads the OKF gold wiki compiled from `.agents/`, `--pointers` gives bounded retrieval, and a cold-start ε-exploration floor keeps low-traffic knowledge reachable.
+- Changed: gold findings are ranked by utility with token-match relevance weighting so natural-language queries surface them.
+- Fixed: the provenance ledger append is serialized under a cross-process lock — no more chain forks under concurrent landings.
+- Removed: the unproven memory-moat machinery (per ADR-0004 honesty) — the membrane stays; the moat claims went.
+
+### Eval, Validation, and Release Gates
+
+- Added: REBOUND verdicts — a byte-identical rebase re-authorizes via patch-id + lineage + gate-green instead of burning a full re-review; honored by the portable push-gate and CI, with keep-ref re-verification for orphaned reviewed commits.
+- Added: an opt-in strict two-family cold quorum that refuses to degrade (honest-UNAVAILABLE until a second strict-eligible family exists), plus an outage-only cold reviewer failover chain with an explicit degraded label.
+- Added: an evidence-quality floor for CONFIRMED verdicts (finding-or-attestation + genuine-run marker) and a live-smoke verify mode that puts runtime evidence in the review packet.
+- Added: the verification-membrane eval — false-done catch rate over deterministic oracles with cross-family verifiers, real-false-done trap tasks, escape-harvest tooling, and a measured local-MLX eval membrane (100% per-task concordance vs codex on the eval path; prod gate stays frontier cross-family).
+- Added: scenario A/B got environment-level arm isolation (macOS sandbox-exec), deterministic answer-key grading, a ceiling pre-screen, and absolute task-success judging; moat-claim scorecards hard-reject ineligible evidence.
+- Added: a wave of deterministic gates — full race suite on push-to-main, provenance hash-chain verification, live-doc CLI-snippet resolution, skill-refs across all docs, a demoted-claims honesty lexicon, a script-preamble ratchet, an ADR-registry check, fail-closed pinned golangci-lint, and a shell-portability gate.
+- Added: the land pipeline hardened — a single-writer land lane with a branch submit queue, deterministic land wrapper, staged-scope pre-commit guard against concurrent-lane contamination, and first-class per-item consumed markers in the next-work queue.
+- Changed: the default gate routes to the Go release authority (`ao gate check`) on the ship path, and a report-only CI verdict backstop re-verifies tip verdicts.
+- Changed: pawl reviews scale their timeout with diff size, and `#trivial` waivers verify the diff is genuinely provenance-only.
+- Changed: the standing pawl service is the default review route — warm tri-model panes (Claude + Codex + AGY) with capability-adaptive routing, self-healing respawn/reroute, and p50/p95 + agreement SLO metrics.
+- Fixed: the pawl records each pane's actual verdict instead of fabricating REFUTED from a timeout, collects all verdicts instead of guillotining on the first REFUTE, and uses delivery-based sends after the unreliable engagement gate was removed.
+- Fixed: cold codex reviews are echo-safe with self-explaining diagnostics on backgrounding-reap, and a hijack guard refuses verdict binds when the worktree HEAD moved mid-review.
+- Fixed: a macOS portability sweep across the bats suites and release scripts (BSD `wc`/`stat`/`find`/`sed` divergences) — the full suite passes on both platforms.
+
+### Docs and Onboarding
+
+- Added: [docs/3.2.md](../3.2.md) — the release narrative — plus a quickstart that lands the first verdict in one command.
+- Added: a loop-map doc indexing the five loop framings, and §6 conformance pattern documentation for workflow authors.
+- Changed: root agent docs reconciled to executable truth (source-of-truth precedence stated inline; stale `bd`/hook-era wording swept).
+- Changed: README claims are PMF-linted and cite evidence docs; unproven-claim language is now mechanically banned from live docs by the demoted-claims gate.
+- Fixed: a doc-lifecycle sweep deleted byte-duplicates, renumbered a duplicate ADR, fixed broken architecture links, and excised a career-page leak.
+- Docs: `ms` CLI-search footgun corrected (hybrid is BM25-only upstream) so operators don't chase phantom semantic modes.
+
+### Security, Privacy, and Supply Chain
+
+- Security: tar extraction gained explicit containment — absolute paths rejected, canonical path-inside assertion, typed rejects.
+- Security: a fail-closed pre-push path guard scans the full tree for private artifacts, and `ao corpus scan` detects deny-listed/PII content before it ships.
+- Security: cwd-relative script execution routes through a trust chokepoint (`aoBinaryInside` guard), and Codex dispatch rejects packet-injected auth environment variables.
+- Security: the SDLC provenance ledger is tamper-evident — hash-chain verification runs as a local gate at the pre-push boundary and ledger appends serialize under a cross-process lock.
+- Security: JSONL storage helpers moved to a loud-failure buffer policy with fsync-safe atomic writes and parent-dir fsync after rename.
+
+### Contributor/Internal Refactors
+
+- Refactored: the retired rpi orchestration engine was dismantled — live helpers extracted to `internal/worktree`, `internal/runtimecmd`, and `internal/rpi`, dead engine surfaces deleted.
+- Refactored: atomic file writes canonicalized on `storage.AtomicWriteFile` (quest, llmwiki, doctor, wiki writers all delegate).
+- Fixed: test-isolation hardening across `cli/cmd/ao` — cobra flag/writer state restored via `t.Cleanup`, tmux socket isolation, deterministic process-group tests, and a trustworthy cmd/ao test floor with the gate blindness that shipped it red closed.
+
+## Known Issues
+
+- The full-tier local gate (`ao gate check --full`) carries two environment-dependent reds on the primary dev machine — `full.worktree-disposition` (many attached session worktrees; janitor tracked in age-ym4b) and `doctrine.memrl-health` (local `.agents` citation-feedback backlog) — both green on a fresh clone, and the push-path gate set is green. The four tree-level reds age-hl9q tracked (go.lint, skill.heal-strict, doctrine.flywheel-proof, always.three-gap-supergate) were fixed in this release.
+- The IMAGE-CORE acceptance recipes (`images/claude`, `images/gemini`) still reference the pre-consolidation skill corpus, so their `verify.sh` acceptance checks fail against the 64-skill tree (12 retired slugs; stale 65-slug count). The live install manifests (`.claude-plugin`, `.agy-plugin`, `.codex-plugin`) are correct and the publish path does not run these verifiers; the recipe refresh is tracked in age-085q.
+- One historical commit on main (5b064b28b) carries a wrong author email from a lane that predated the identity fix; it is cosmetic (GitHub misattribution on that single commit) and deliberately accepted rather than rewriting released history (age-jhal).
+- Cold cross-family review cannot verdict diffs whose `git show` exceeds ~65KB (deletion-heavy commits); the warm service handles larger diffs, and the strangler-split landing pattern is documented for the rest.
+- The strict two-family cold quorum reports honest-UNAVAILABLE until a second strict-eligible reviewer family is graduated (AGY remains benched for strict validation).
+
+[Full changelog](../CHANGELOG.md)
@@ -60,7 +60,7 @@ fi
 # Version guard: the Claude marketplace plugin manifest is the install entrypoint
 # for this image. Assert .claude-plugin/plugin.json declares the expected version
 # so a stale-version drift (plugin.json behind the release) fails the gate.
-EXPECTED_VERSION="${AGENTOPS_EXPECTED_VERSION:-3.1.0}"
+EXPECTED_VERSION="${AGENTOPS_EXPECTED_VERSION:-3.2.0}"
 plugin_manifest="$repo_root/.claude-plugin/plugin.json"
 if [ ! -f "$plugin_manifest" ]; then
  echo "FAIL: Claude plugin manifest not found: $plugin_manifest" >&2
@@ -1,6 +1,6 @@
 {
  "name": "agentops-core-gemini",
-  "version": "3.1.0",
+  "version": "3.2.0",
  "description": "AgentOps 65-skill image (61 CORE + 4 AGY operator) packaged for Google Antigravity (AGY) / Gemini. Portable SKILL.md set (identical to the Claude image — zero conversion) wrapped in an Antigravity plugin, with Agent Mail MCP and AgentOps guard/evidence hooks.",
  "skills": "./skills",
  "agents": "./agents",
@@ -3,7 +3,7 @@
 #
 # Usage:
 #   curl -fsSL https://raw.githubusercontent.com/boshu2/agentops/main/scripts/install-agy.sh | bash
-#   curl -fsSL https://raw.githubusercontent.com/boshu2/agentops/main/scripts/install-agy.sh | bash -s -- --ref v3.1.0
+#   curl -fsSL https://raw.githubusercontent.com/boshu2/agentops/main/scripts/install-agy.sh | bash -s -- --ref v3.2.0

 set -euo pipefail
 shopt -s lastpipe 2>/dev/null || true
@@ -26,7 +26,7 @@ Install the AgentOps Gemini/Antigravity image bundle.

 Usage:
  curl -fsSL https://raw.githubusercontent.com/boshu2/agentops/main/scripts/install-agy.sh | bash
-  curl -fsSL https://raw.githubusercontent.com/boshu2/agentops/main/scripts/install-agy.sh | bash -s -- --ref v3.1.0
+  curl -fsSL https://raw.githubusercontent.com/boshu2/agentops/main/scripts/install-agy.sh | bash -s -- --ref v3.2.0

 Options:
  --ref <ref>       Git ref to install. Defaults to AGENTOPS_INSTALL_REF or main.
@@ -4,7 +4,7 @@
 # Usage:
 #   curl -fsSL https://raw.githubusercontent.com/boshu2/agentops/main/scripts/install-claude.sh | bash
 #   curl -fsSL https://raw.githubusercontent.com/boshu2/agentops/main/scripts/install-claude.sh | bash -s -- --update
-#   curl -fsSL https://raw.githubusercontent.com/boshu2/agentops/main/scripts/install-claude.sh | bash -s -- --ref v3.1.0
+#   curl -fsSL https://raw.githubusercontent.com/boshu2/agentops/main/scripts/install-claude.sh | bash -s -- --ref v3.2.0

 set -euo pipefail
 shopt -s lastpipe 2>/dev/null || true
@@ -13,7 +13,7 @@ umask 022
 MARKETPLACE="${AGENTOPS_CLAUDE_MARKETPLACE:-boshu2/agentops}"
 MARKETPLACE_NAME="${AGENTOPS_CLAUDE_MARKETPLACE_NAME:-agentops-marketplace}"
 PLUGIN_KEY="${AGENTOPS_CLAUDE_PLUGIN_KEY:-agentops@agentops-marketplace}"
-# --ref pins the marketplace source to a tagged release (e.g. v3.1.0) for parity
+# --ref pins the marketplace source to a tagged release (e.g. v3.2.0) for parity
 # with install-agy.sh. Empty = track the marketplace's default branch.
 INSTALL_REF="${AGENTOPS_INSTALL_REF:-}"
 DRY_RUN=0
@@ -32,7 +32,7 @@ Usage:

 Options:
  --update      Update marketplace metadata and the installed plugin.
-  --ref <ref>   Pin the marketplace source to a git ref (e.g. v3.1.0).
+  --ref <ref>   Pin the marketplace source to a git ref (e.g. v3.2.0).
                Defaults to AGENTOPS_INSTALL_REF or the marketplace default branch.
  --dry-run     Print the commands that would run without changing anything.
  --quiet       Reduce progress output.