chore: prepare v0.3.2 release

Author: yhay81

.github/workflows/azure-integration.yml

@@ -358,7 +358,7 @@ jobs:
           fi
           jq --exit-status '
             .object == "portable_hosted_semantic_proof" and
-            .hayasend_version == "0.3.1" and
+            .hayasend_version == "0.3.2" and
             .database.major_version == 18 and
             .checks.scheduled_horizon_seconds == 2592000 and
             .checks.atomic_delivery_commit == true and

.github/workflows/cloud-run-integration.yml

@@ -237,7 +237,7 @@ jobs:
           fi
           jq --exit-status \
             '.object == "portable_hosted_semantic_proof" and
-              .hayasend_version == "0.3.1" and
+              .hayasend_version == "0.3.2" and
               .database.major_version == 18 and
               .checks.scheduled_horizon_seconds == 2592000 and
               .checks.atomic_delivery_commit == true and

.github/workflows/railway-integration.yml

@@ -221,7 +221,7 @@ jobs:
             | tee "$RUNNER_TEMP/railway-portable-proof.json"
           jq --exit-status \
             '.object == "portable_hosted_semantic_proof" and
-              .hayasend_version == "0.3.1" and
+              .hayasend_version == "0.3.2" and
               .database.major_version == 18 and
               .checks.scheduled_horizon_seconds == 2592000 and
               .checks.atomic_delivery_commit == true and

.github/workflows/vercel-integration.yml

@@ -361,7 +361,7 @@ jobs:
             | tee "$RUNNER_TEMP/vercel-current-deployment.txt"
           health="$(curl --fail --silent --show-error "$HAYASEND_VERCEL_API_URL/healthz")"
           jq --exit-status \
-            '.ok == true and .service == "hayasend" and .version == "0.3.1"' \
+            '.ok == true and .service == "hayasend" and .version == "0.3.2"' \
             <<<"$health" >/dev/null
           echo "validated=true" >> "$GITHUB_OUTPUT"
 
@@ -381,7 +381,7 @@ jobs:
               > "$RUNNER_TEMP/vercel-portable-proof.json"
           jq --exit-status '
             .object == "portable_hosted_semantic_proof" and
-            .hayasend_version == "0.3.1" and
+            .hayasend_version == "0.3.2" and
             .database.major_version == 18 and
             .checks.scheduled_horizon_seconds == 2592000 and
             .checks.schedule_exceeds_seven_days == true and

CHANGELOG.md

@@ -6,6 +6,21 @@ minor releases before v1.0.
 
 ## Unreleased
 
+## 0.3.2 - 2026-07-29
+
+- Add a plan-first AWS lifecycle with a reusable least-privilege deployment
+  bootstrap, termination protection, retained-resource stack policy, drift
+  inspection, canary rollback, backup/restore proof, and verified zero-residue
+  deletion for the dedicated test account.
+- Add fail-closed Resend migration inventory, controlled canary, and readiness
+  report commands that require reconciliation, mailbox evidence, rollback,
+  SES production access, and sustained dogfood evidence before declaring GO.
+- Keep idempotent relative schedules stable across retries by hashing the
+  caller's original schedule while storing and executing one resolved instant.
+- Confine CLI-selected files to the current working tree with lexical and
+  canonical boundary checks, symlink-escape refusal, race-safe descriptors,
+  regular-file checks, and bounded reads.
+
 ## 0.3.1 - 2026-07-29
 
 - Add a provider-neutral, console-only hosted semantic proof for portable

README.md

@@ -331,14 +331,14 @@ docker run --rm \
   --cap-drop ALL \
   --security-opt no-new-privileges \
   -p 127.0.0.1:8787:8787 \
-  ghcr.io/haya-inc/hayasend:0.3.1
+  ghcr.io/haya-inc/hayasend:0.3.2
 ```
 
 Verify that the image was built by this repository before deploying it:
 
 ```bash
 gh attestation verify \
-  oci://ghcr.io/haya-inc/hayasend:0.3.1 \
+  oci://ghcr.io/haya-inc/hayasend:0.3.2 \
   --repo haya-inc/hayasend
 ```
 

conformance/deployments/aws-ses.v1.json

@@ -1,16 +1,16 @@
 {
   "schema_version": "1.0.0",
   "deployment": "aws-ses",
-  "adapter_version": "0.3.1",
+  "adapter_version": "0.3.2",
   "checked_at": "2026-07-28",
   "runtime": {
     "profile": "aws-native",
-    "adapter_version": "0.3.1",
+    "adapter_version": "0.3.2",
     "capability_document": "conformance/runtimes/aws-native.v1.json"
   },
   "transport": {
     "provider": "aws-ses",
-    "adapter_version": "0.3.1",
+    "adapter_version": "0.3.2",
     "capability_document": "conformance/providers/aws-ses.v1.json"
   },
   "maturity": {

conformance/deployments/azure-container-apps-acs.v1.json

@@ -1,16 +1,16 @@
 {
   "schema_version": "1.0.0",
   "deployment": "azure-container-apps-acs",
-  "adapter_version": "0.3.1",
+  "adapter_version": "0.3.2",
   "checked_at": "2026-07-29",
   "runtime": {
     "profile": "portable-postgres",
-    "adapter_version": "0.3.1",
+    "adapter_version": "0.3.2",
     "capability_document": "conformance/runtimes/portable-postgres.v1.json"
   },
   "transport": {
     "provider": "azure-communication-services",
-    "adapter_version": "0.3.1",
+    "adapter_version": "0.3.2",
     "capability_document": "conformance/providers/azure-communication-services.v1.json"
   },
   "maturity": {

conformance/deployments/cloud-run-sendgrid.v1.json

@@ -1,16 +1,16 @@
 {
   "schema_version": "1.0.0",
   "deployment": "cloud-run-sendgrid",
-  "adapter_version": "0.3.1",
+  "adapter_version": "0.3.2",
   "checked_at": "2026-07-29",
   "runtime": {
     "profile": "portable-postgres",
-    "adapter_version": "0.3.1",
+    "adapter_version": "0.3.2",
     "capability_document": "conformance/runtimes/portable-postgres.v1.json"
   },
   "transport": {
     "provider": "sendgrid",
-    "adapter_version": "0.3.1",
+    "adapter_version": "0.3.2",
     "capability_document": "conformance/providers/sendgrid.v1.json"
   },
   "maturity": {

conformance/deployments/cloudflare-email.v1.json

@@ -1,16 +1,16 @@
 {
   "schema_version": "1.0.0",
   "deployment": "cloudflare-email",
-  "adapter_version": "0.3.1",
+  "adapter_version": "0.3.2",
   "checked_at": "2026-07-28",
   "runtime": {
     "profile": "cloudflare-native",
-    "adapter_version": "0.3.1",
+    "adapter_version": "0.3.2",
     "capability_document": "conformance/runtimes/cloudflare-native.v1.json"
   },
   "transport": {
     "provider": "cloudflare-email",
-    "adapter_version": "0.3.1",
+    "adapter_version": "0.3.2",
     "capability_document": "conformance/providers/cloudflare-email.v1.json"
   },
   "maturity": {