chore(release): bump version to 3.2.0

[alpha1122x]

Summary

• Bump Base distribution identity from 3.1.2 → 3.2.0 so a v3.2.0 tag can cut a wheel that includes the constation/attestation modules already on main (feat(constation): production Lium image-attestation wire #41, fix(scripts): allow live prism Lium attestation e2e under PrismSettings #42).
• Latest published release v3.1.2 (2026-07-12) predates that work; consumers (e.g. prism) currently pin a git SHA and break hermetic Docker installs that lack git.

Changes

• pyproject.toml: [project] version = "3.2.0"
• src/base/challenge_sdk/release_manifest.json: artifact_version = "3.2.0", release_id = "v3.2.0"
• uv.lock: workspace package base version 3.2.0 (required — uv sync --locked / monorepo-workspace + github-release jobs fail without it; one-line identity bump only)

No functional code, dependency, or migration changes.

Why these fields move together

.github/workflows/ci.yml github-release asserts on tag v*:

project["project"]["version"] == expected
manifest["artifact_version"] == expected
manifest["release_id"] == f"v{expected}"

Test plan

• Release-job identity assert locally (3.2.0 / v3.2.0 / loaded ARTIFACT_VERSION)
• uv sync --locked --extra dev --extra master
• uv run ruff check . / ruff format --check .
• uv run mypy src tests
• monorepo-workspace pytest subset (26 passed)
• versioning/release/roles/health contracts (21 passed)
• production-policy subset (89 passed)
• full pytest --cov=base --cov-fail-under=80 → 2308 passed, 83.66% cov
• CI green on this PR head

CI

• Waiting for required checks to go green on this head SHA.

Notes

• Do not merge from this PR automation. Tagging v3.2.0 is a separate human step after merge.
• Trust model unchanged: tamper-evidence, not tamper-prevention. No TEE claims.
• Other hardcoded 3.1.2 strings left intentionally (fixture samples, prism image pins, prism Dockerfile wheel URL assertions). They are not the Base distribution identity and must not move blindly with this bump.
• Original dirty checkout on feat/agent-challenge-eval-wire-ghcr was left untouched via a separate git worktree.

Summary by CodeRabbit

• Release
  • Updated the project release version from 3.1.2 to 3.2.0.
  • Updated release metadata to reflect version 3.2.0.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0cc56144-3de4-4064-9205-02f26a3466b2

📥 Commits

Reviewing files that changed from the base of the PR and between e695169 and 4c0518f.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• pyproject.toml
• src/base/challenge_sdk/release_manifest.json

---

📝 Walkthrough

Walkthrough

The project version and release manifest were updated from 3.1.2 to 3.2.0. Contract and API version fields remain unchanged.

Changes

Release versioning

Layer / File(s)	Summary
Update release version metadata pyproject.toml, src/base/challenge_sdk/release_manifest.json	Project metadata and release manifest identifiers now use version 3.2.0; SDK contract and API versions remain unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: echobt

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: a release version bump to 3.2.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}