Release v3.2.0

Guild v3.2.0

Dispatch reliability, security and config hardening, nine fixes reported from consuming repos, and three newly supported hosts.

Highlights

• New hosts: cursor, opencode and rovo-dev are publicly supported as verified wrapped hosts, each backed by a live smoke receipt and a committed floor (#285).
• Dispatch: same-role lanes, receipt wait and idle-gated pane send so lanes always return receipts (#237 #138 #179); dispatch identity requires the env producer marker and the settings snapshot is integrity-bound (#144 #146).
• Security and config: wiki and run prose is refused, never rewritten in place (#108); config provenance names the layer each leaf value came from (#145); high npm advisories cleared in the MCP servers (#280).
• Runtime CLIs and state: --help on every runtime CLI with no side effects, --cwd <path> accepted, trace-summarize reads v1.4 event logs (#269 #270 #274); deterministic, re-checkable layout upgrade at run start and migrate-guild --mode=verify (#271 #275 #276); run-trace close --run-id (#277); the workspace root keeps its wiki and root scans skip registered sub-guilds (#272 #273).
• Learn and evidence: deterministic bare /guild:learn router; source-bound host-smoke receipts with isolated real install; R-DECL compares parsed YAML values.

Release evidence

Hash-bound full-suite 31/31 activated-host conformance for guild-3.2.0 @ 7e26078, captured on live Claude Code and Codex hosts, 18/18 planted refusal controls refusing, signed by the three attestor roots (.guild/artifacts/release/v3.2.0/{conformance,promotion}.json, #286).

🤖 Generated with Claude Code

Full Changelog: v3.1.0...v3.2.0