chore: release v0.32.0

[Daniel Meppiel (danielmeppiel)]

ship(release): prepare v0.32.0

TL;DR

Cut release 0.32.0 from the 18 PRs merged since v0.31.0.
Bump the project version and its lockfile entry, and publish the approved
2026-09-25 changelog with 12 user-facing entries and migration notes.
This PR changes release metadata only; it does not tag or publish.

Important

Post-merge: a maintainer must tag v0.32.0 to trigger the release workflow.
Local lint passed; GitHub CI is not claimed green by this preparation run.

Problem (WHY)

• [Unreleased] included internal maintainer machinery and an issue number
  presented as a PR reference; fix(installer): correct prebuilt Linux glibc minimum to 2.38 #2931 and fix(marketplace): authenticate default-host checks #2917 were filed under v0.31.0
  despite merging after that tag.
• pyproject.toml and uv.lock still identified the project as 0.31.0.

Release preparation follows the Agent Skills validation loop:
"do the work, run a validator (a script, a reference checklist, or a self-check), fix any issues, and repeat until validation passes."
The merged-PR inventory, version agreement, changelog scope, and local lint
were checked before pushing. The operator approved both the version and
the complete changelog diff.

Why MINOR (0.32.0), not PATCH (0.31.1)

The cycle rejects previously accepted unsafe dependency aliases and adds
the 0.1.41 schema/lock alias contract (#2901). These user-facing input and
contract changes justify a minor release while APM is pre-1.0; this does
not declare 1.0 stability. Internal maintainer tooling does not influence
the version decision.

Migration notes

• Replace bare ./.. dependency aliases with a safe name and reinstall;
  choose a safe destination instead of an unsafe symlink. Opting into the
  0.1.41 manifest schema requires a supporting client. See
  alias migration.
• Incompatible immutable dependency requirements now fail rather than
  silently selecting one version. Align root/parent refs and run
  apm install without --frozen to regenerate the lockfile.

Approach (WHAT)

• Keep one concise entry per user-facing PR and preserve external credit.
• Omit two internal maintainer-tooling PRs and four routine dependency chores;
  retain the setuptools security fix.
• Correct release placement and references without changing runtime code.
• Keep [Unreleased] empty for the next cycle and leave tagging to a human.

Implementation (HOW)

File	Change
CHANGELOG.md	Add the dated 0.32.0 section, exclude internal maintainer machinery, mark migrations, correct #2941's reference, and move #2931/#2917 into their actual release cycle.
pyproject.toml	Change project version from 0.31.0 to 0.32.0.
uv.lock	Change only the editable apm-cli version; all dependency versions, sources, and hashes remain unchanged.

Diagrams

Omitted for this mechanical metadata change: no runtime relationships or
release workflow steps change.

Trade-offs

• Use the asset-bump-only Scenario Evidence exemption: the release PR
  packages already-merged behavior, rather than implementing or retesting
  it. The release procedure does not run the test suite or build binaries.
• Prefer concise user-facing notes over a complete maintenance log; all 18
  merged PRs were assessed, but two internal maintainer-tooling PRs and four
  routine dependency chores are omitted.

Benefits

1. Both version-bearing files agree on 0.32.0 with no dependency churn.
2. Twelve release entries each map to one merged PR.
3. Two misplaced fixes and one incorrect PR reference are corrected.

Validation

Local lint ran against current main at cb911e10d5.
The release mirror and the current canonical coverage both passed,
including architecture scripts, auth boundaries, YAML I/O safety,
the 2100-line limit, and portable-relative-path checks.

Local setup and command evidence

Public artifact downloads initially failed in this environment.
Frozen dev requirements were exported with hashes and installed through
the locally configured Microsoft proxy using uv pip sync --require-hashes.
Lint then used UV_NO_SYNC=1 with that verified environment; no proxy
URLs or configuration are included in the commit.

uv pip check --python .venv/bin/python:

Checked 96 packages in 57ms
All installed packages are compatible

UV_NO_SYNC=1 bash .agents/skills/cut-release/scripts/verify-lint-mirror.sh
(summary):

=== verify-lint-mirror summary ===
  ruff check                     PASS
  ruff format --check            PASS
  pylint R0801 duplication       PASS
  auth-signals boundary          PASS
[+] all lint-mirror checks PASSED

UV_NO_SYNC=1 uv run --extra dev ruff format --check src/ tests/ scripts/lint_architecture_boundaries.py scripts/architecture_linter/:

1881 files already formatted

uv lock --check --offline --default-index https://pypi.org/simple:

Resolved 107 packages in 70ms

A byte-for-byte comparison against the base lockfile, allowing only the
project version replacement, passed. The new changelog section also passed
checks for 12 unique merged-PR references, ASCII, and an empty [Unreleased].
git diff --check passed.

How to test

• Review git diff main...HEAD: only the three release files should change.
• Run uv lock --check: expect a current lockfile with project version 0.32.0.
• Verify the dated changelog has 12 entries and the migration notes above.
• Run the canonical lint contract in .apm/instructions/linting.instructions.md; expect all checks to pass.
• Wait for the PR's GitHub checks before merging; do not tag the unmerged branch.

Post-merge

From updated main, tag v0.32.0 to trigger build-release.yml:

git tag v0.32.0
git push origin v0.32.0

No tag was created by this preparation run.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Daniel Meppiel (danielmeppiel)]

Docs sync advisory

Verdict: no_change * Pages affected: 0 * LLM calls: 1/15 * Took: 1.23s (deterministic gate)

No documentation changes needed for this release-preparation PR. Its diff contains only CHANGELOG.md, the project version in pyproject.toml, and the editable project version in uv.lock. All three paths match the docs index no-impact gate; no runtime surface or documentation contract changes here.

Classification: L0, high confidence; schema validated. No documentation panel was needed. One delegated classifier attempt lacked tools; the orchestrator completed the deterministic path gate directly.

This advisory does not gate merge.

[Copilot]

Copilot review overview

🟡 Changes recommended

Correct the CHANGELOG.md entry to use the merged PR reference as required.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Use merged PR reference at end of changelog entry · New

What changed in this PR

Prepares the v0.32.0 release by updating version metadata and finalizing the dated changelog.

Changes:

• Bumps project and lockfile versions to 0.32.0.
• Adds 14 release entries and migration guidance.
• Leaves [Unreleased] empty.

File	Description
CHANGELOG.md	Adds v0.32.0 release notes and migration details.
pyproject.toml	Bumps the project version.
uv.lock	Updates the editable package version.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.