v0.3.2

Security

• Ed25519 admiral signing (TRN-136) — Admiral mail signing moved from a shared HMAC secret to Ed25519 asymmetric keys. The private key never leaves the transport (persisted at DATA_DIR/secrets/<crew_id>.admiral_secret); each crew receives only the public key, mounted as a read-only, root-owned Podman secret it cannot modify even if compromised. The X-Admiral-Sig header and verify-admiral-sig exit-code contract (0/1/2) are unchanged. Operator action required: existing crews must be nuked and relaunched to pick up the new signing scheme — a plain restart does not migrate a crew. See docs/auth.md.
• Crew proxy no longer forwards transport credentials — the crew UI/API proxy stopped forwarding the inbound Authorization and X-Transport-Token headers down to a crew's own gateway. Crew containers share the ga-starboard network with ga-transport, so a compromised crew that captured either header could previously replay it directly against the transport's own control-plane API. Neither header is used by the crew gateway, so nothing downstream depended on them.
• starlette pinned to >=1.0.1 — closes CVE-2024-47874 and CVE-2026-48710.

API

• GET /openapi.json (TRN-129) — new public, unauthenticated endpoint serving an OpenAPI 3.1.0 schema generated at startup from the live route table and MCP tool registry. Reachable through Caddy's public port as well as directly on the transport.

Fixes

• Stale active-crew counts (TRN-132) — crews() and the GA_MAX_ACTIVE_CREWS limit check now cross-reference the registry against actual Podman container state instead of trusting a potentially-stale status field. A crew stopped outside ghostship no longer inflates the active count or blocks legitimate launches.

Captain templates

• independent-review — four concurrent independent reviewers (Wraith + 3×Banshee); change_name optional — scopes to a change or reviews the entire codebase. (independent-review-all merged in and deleted.)
• sdd — change_name accepts a comma-separated list for parallel multi-change execution with automatic worktree isolation and merge reconciliation. (sdd-parallel merged in and deleted.)
• SDD reconciliation attempts conflict resolution before escalating (TRN-140) — parallel sdd Ghost task now resolves merge conflicts before escalating to the Admiral.
• transport://orders is now a summary index (TRN-135) — use transport://orders/{name} for a specific template's full text. New GA_ORDERS_DIR env var for custom templates.

Install

• --client-only flag — skips container infrastructure, wires up just the CLI and agent harness integrations for machines connecting to a remote transport.
• Transport source hash detection — forces a clean rebuild when the version matches but the source tree has changed.

Testing

• Full-suite test bootstrap stabilized (TRN-144) — shared httpx stub module fixes spurious parallel-runner failures.
• test_uninstall_auth_preservation.sh now wired into the integration suite.