Codifide Harness v3.2.0

This release is NOT cryptographically signed. Verify the download with SHA256SUMS (shasum -a 256 -c SHA256SUMS). Signed releases start once a signing key is configured.

What's new in 3.2.0

A local installer plus upgrade and uninstall paths. The steering files, hook files and four enforcement scripts are unchanged from 3.1.0.

• install.sh: copies this pinned release into a repository. Dry run by default (--apply writes). Hosts: kiro, claude, cursor, copilot, codex. Refuses to run unless it is a clean checkout of a matching tag or an unpacked release tarball. Writes .codifide/harness-version and .codifide/harness-manifest. No network, no commits, no git config changes.
• Policy files (.codifide/immutable-paths, CLAUDE.md, AGENTS.md, the enforcement workflow and others) are created only when absent. .claude/settings.json is never written; merge snippets are printed instead.
• install.sh upgrade and install.sh uninstall: manifest-driven; they only touch files that still match the recorded hash.
• tools/build-release.sh and a tag-triggered release workflow.

Verification status

• Installer suite: 367 checks pass; enforcement suite: 245 cases pass (macOS, bash 3.2).
• One cross-vendor review (gpt-6.1-sol) found 11 issues; 10 were reproduced, and 8 of those (3 major) are fixed with regression tests. A second reviewer approved the fixes; they have not had a second cold external review.
• NOT verified end to end: any host loading what the installer writes (Kiro, Claude Code, Cursor, Copilot, Codex).
• The release workflow's final step failed on its first run (gh release create had no git remote). These assets were built locally from the v3.2.0 tag with tools/build-release.sh; the workflow fix lands after this tag.