Roo4L · Roo4L · May 3, 2026
diff --git a/.planning/STATE.md b/.planning/STATE.md
@@ -6,7 +6,7 @@ status: defining_requirements
 previous_milestone: v0.3.0
 previous_milestone_status: feature-complete (awaits v0.3.0-rc1 tag push as shipping event)
 stopped_at: Milestone v0.4.0 (Open-Source Release) planned 2026-04-26 — PROJECT.md / MILESTONES.md / REQUIREMENTS.md / ROADMAP.md written. Five phases (7. License & Public-Ready Documentation; 8. Secret Scanning & History Audit; 9. Repository Hygiene & Artifact Cleanup; 10. Public CI/CD Verification & Branch Protection; 11. Public Visibility Flip & Smoke Test). 18 requirements across LIC / SEC / CLEAN / CIPUB / PUB categories, all mapped 1:1 to phases. Phase numbering continues from v0.3.0 (last phase 6 → next phase 7); v0.3.0 phase directories preserved until rc1 tag push. Earlier (v0.3.0): Plan 06-04 complete — Phase 6 Wave 3 release pipeline landed (TST-05, TST-08, INST-03, CAT-05). Two atomic commits (0352842 feat Task 1 .github/workflows/release.yml 4-gate pipeline: gate-1-precommit + gate-2-docker matrix × {22.04,24.04} + gate-3-qemu matrix × {22.04,24.04} with /dev/kvm udev + actions/cache@v4 keyed on tests/qemu/cloud-images.txt + gate-4-pinned-combo ubuntu-24.04 Docker + build with sha256sum -c verify + publish softprops/action-gh-release@v2.6.2 Node-20 pin + files glob tarball/.sha256/catalog-*.json/.deb + concurrency cancel-in-progress:false Pitfall 9 + startsWith(refs/tags/v) publish guard; af7edc2 ci Task 2 .github/workflows/deploy.yml added Pattern 5 `cp packaging/curl-installer/install.sh install.sh` step pre-upload-pages-artifact + .gitignore install.sh anti-drift gitignore). ~12 min total static work. Review loop clean (bash-engineer + security-engineer + qa-engineer + catalog-auditor applied inline per Phase 2-5 precedent): default permissions contents:read + publish override contents:write; every third-party action pinned (softprops@v2.6.2, actions/*@v4/v5); TAG passed via env not inline ${{ }} (injection-safe); set -euo pipefail on every inline run block; fail-fast:false on matrix jobs; timeouts on every job; artifact upload on QEMU failure only; build-step sha256sum -c round-trips tarball before upload (T-06-08); dist/catalog-${TAG}.json verified -s non-empty (Pitfall 8); files glob fail_on_unmatched_files:false tolerates SKIP_DEB path. Static gates all green: python3 -c 'import yaml; yaml.safe_load' OK on both workflows; actionlint 1.7.12 clean on release.yml + deploy.yml; pre-commit check-yaml + trailing-whitespace + end-of-file-fixer + detect-private-key + check-added-large-files + check-merge-conflict Passed (biome-check skipped — broken nodeenv in this env, runs on CI runners); every plan-spec grep token present (concurrency, cancel-in-progress:false, gate-1..4, softprops@v2.6.2, tests/qemu/boot.sh, tests/docker/run.sh, scripts/build-release.sh, hashFiles('tests/qemu/cloud-images.txt'), needs:[resolve,gate-4-pinned-combo], catalog-*.json, startsWith(github.ref)). Runtime verification (workflow_dispatch dry-run + v0.3.0-rc1 tag push + softprops end-to-end) deferred per VALIDATION.md §Manual-Only Verifications row 3 — first tag push is the shipping event. Pre-commit hook installed in .git/hooks/pre-commit (was not installed at session start). Plan requires autonomous:false checkpoint gate on real v0.3.0-rc1 tag-push exercise before v0.3.0 final. Next: Plan 06-05 (DOC-01 user README + release-ready).
-last_updated: "2026-04-26T13:30:00.000Z"
+last_updated: "2026-05-03T11:00:00.000Z"
 last_activity: 2026-04-26 — v0.4.0 (Open-Source Release) milestone planned via /gsd-new-milestone (issue AGE-6). PROJECT.md / MILESTONES.md / REQUIREMENTS.md / ROADMAP.md written; v0.3.0 artifacts archived to .planning/milestones/v0.3.0-{REQUIREMENTS,ROADMAP}.md. Five phases (7-11), 21 requirements across LIC/SEC/CLEAN/CIPUB/PUB (4+5+4+4+4). Earlier: 2026-04-20 — Plan 06-04 complete. Two `type="auto"` tasks + one `type="checkpoint:human-verify"` (blocking checkpoint deferred to first real tag push) = two atomic commits 0352842 + af7edc2, ~12 min total static work. .github/workflows/release.yml grew from 60-line Phase 1 scaffold to 294-line full 4-gate orchestrator (resolve → gate-1-precommit → gate-2-docker matrix × {22.04,24.04} → gate-3-qemu matrix × {22.04,24.04} → gate-4-pinned-combo → build → publish). .github/workflows/deploy.yml added a single 2-line Pattern 5 `cp packaging/curl-installer/install.sh install.sh` step between checkout and configure-pages (anti-drift: repo-root install.sh gitignored so only packaging/ copy is editable). Review loop clean first pass (bash-engineer + security-engineer + qa-engineer + catalog-auditor — rubrics applied inline): default contents:read + publish-only contents:write; softprops/action-gh-release pinned to v2.6.2 per Standard Stack; TAG via env:, not inline expansion (injection-safe); set -euo pipefail on every inline run block; artifact upload on QEMU failure only; build-step sha256sum -c round-trips before upload (T-06-08); catalog snapshot presence verified (Pitfall 8); files glob tolerates missing .deb (SKIP_DEB path). Runtime verification (workflow_dispatch dry-run + v0.3.0-rc1 tag push + softprops end-to-end publish) deferred to first real CI run per 06-VALIDATION.md Manual-Only row 3. Next: Plan 06-05 (DOC-01 user README + release-ready).
 progress:
   total_phases: 6
@@ -287,6 +287,7 @@ None. Roadmap created; all 46 requirements mapped; Phase 1 is ready to plan.
 |---|-------------|------|--------|-----------|
 | 260502-i4p | Add stop hook reminding Claude to run review loop (AL-23) and amend ADR-010 | 2026-05-02 | af9bd74 | [260502-i4p-add-stop-hook-reminding-claude-to-run-re](./quick/260502-i4p-add-stop-hook-reminding-claude-to-run-re/) |
 | 260503-8z4 | Add session-tracker Stop hook (AL-24) — second instance of ADR-010 reminder-hook pattern | 2026-05-03 | _pending_ | [260503-8z4-al-24-add-stop-hook-for-session-tracking](./quick/260503-8z4-al-24-add-stop-hook-for-session-tracking/) |
+| 260503-dtx | Cut v0.3.2-rc1 release candidate (AL-18 / AL-21) — version bump 0.3.0 → 0.3.2 across plugin source + bats; tag pushed; release.yml triggered; Docker dogfood instructions filed (Path A curl-pipe-bash + Path B local tarball, Ubuntu 22.04 / 24.04 / 26.04). Filed AL-29 follow-up for version-string SoT consolidation (8 hardcoded sites). | 2026-05-03 | 49b8c22 | [260503-dtx-cut-v0-3-2-rc1-release-candidate-bump-ve](./quick/260503-dtx-cut-v0-3-2-rc1-release-candidate-bump-ve/) |
 
 ## Deferred Items
 

diff --git a/...ng/quick/260503-dtx-cut-v0-3-2-rc1-release-candidate-bump-ve/260503-dtx-PLAN.md b/...ng/quick/260503-dtx-cut-v0-3-2-rc1-release-candidate-bump-ve/260503-dtx-PLAN.md
@@ -0,0 +1,157 @@
+---
+quick_id: 260503-dtx
+description: Cut v0.3.2-rc1 release candidate (bump versions, push tag, document Docker dogfood test)
+status: planned
+date: 2026-05-03
+jira: AL-18
+---
+
+# Quick Task 260503-dtx: v0.3.2-rc1 Release Candidate
+
+## Context
+
+- Last release: **v0.3.1** (2026-05-02). First dogfood test against v0.3.1 failed.
+- Fixes shipped to master since v0.3.1 (9 commits): PR #7 (three dogfood-discovered installer-path bugs), PR #5 (Ubuntu 26.04), PR #11 (Node 24-ready actions), PR #13 (review-reminder Stop hook + ADR-010 refinement), PR #14 (workspace-cleanup skill), plus CI deploy fixes (#9, #10) and PR-preview workflow (#4).
+- A dangling `release/v0.4.1-rc1-bump` branch exists locally (bumped to 0.4.1) — superseded by user's choice of v0.3.2-rc1 (patch-level).
+- AL-18 follow-up: cut a new RC, run Docker-based dogfood against it.
+- User decisions:
+  - Version: **v0.3.2-rc1** (patch bump)
+  - Action: **Bump + push tag** (full release-pipeline flow via `release.yml`)
+
+## Constraints
+
+- `scripts/build-release.sh` enforces a three-way version lock: tag base (`0.3.2`) MUST equal `plugin/cli/package.json.version` AND `plugin/catalog/catalog.json.version`. The `-rc1` suffix is stripped before comparison (see `fix(build): allow rc / pre-release suffix in tag↔package.json version lock`).
+- Tag shape regex (curl-installer + release.yml): `^v[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.]+)?$` — `v0.3.2-rc1` matches.
+- `release.yml` triggers on `push: tags: 'v*.*.*'` → runs gate-1-precommit, gate-2-docker (22.04 + 24.04), gate-3-qemu, gate-4-pinned-combo, build, publish.
+- Discard the dangling `release/v0.4.1-rc1-bump` branch — versions there target a different minor.
+- Tag push is irreversible. User explicitly authorized.
+
+## Tasks
+
+### Task 1 — Bump versions to 0.3.2
+
+**Files:**
+- `plugin/cli/package.json` (`"version": "0.3.0"` → `"0.3.2"`)
+- `plugin/catalog/catalog.json` (`"version": "0.3.0"` → `"0.3.2"`)
+
+**Action:** Two single-line `Edit` calls.
+
+**Verify:**
+- `node -e 'console.log(require("./plugin/cli/package.json").version)'` prints `0.3.2`
+- `jq -r .version plugin/catalog/catalog.json` prints `0.3.2`
+
+**Done when:** Both files report `0.3.2`.
+
+---
+
+### Task 2 — Open release PR against master
+
+**Action:**
+1. Switch from `worktree-first-release` to a fresh branch `release/v0.3.2-rc1-bump` based on `origin/master`.
+2. Stage + commit the two version-bump files only.
+3. Push branch.
+4. Open PR with `gh pr create` titled `chore(release): bump version to 0.3.2 for rc1 release`.
+5. Wait for CI green (or surface the PR URL if user wants to gate manually).
+
+**Verify:**
+- `gh pr view --json mergeable,statusCheckRollup` reports `MERGEABLE` and all required checks `SUCCESS`.
+
+**Done when:** PR is merged into master.
+
+---
+
+### Task 3 — Build release artifacts locally (verification)
+
+**Action:**
+After bump is merged to master, on a master checkout, run:
+```
+scripts/build-release.sh v0.3.2-rc1
+```
+
+**Verify:**
+- `dist/agentlinux-v0.3.2-rc1.tar.gz` exists
+- `dist/agentlinux-v0.3.2-rc1.tar.gz.sha256` exists
+- `dist/catalog-v0.3.2-rc1.json` exists
+- `(cd dist && sha256sum -c agentlinux-v0.3.2-rc1.tar.gz.sha256)` reports `OK`
+- Re-run produces byte-identical tarball (reproducibility, T-06-08)
+
+**Done when:** Artifacts exist and sha256 round-trip passes.
+
+---
+
+### Task 4 — Tag v0.3.2-rc1 + push to origin
+
+**Action:**
+On master at the merge commit:
+```
+git tag -a v0.3.2-rc1 -m "v0.3.2-rc1 — RC for AL-18 dogfood retest
+
+Patch on top of v0.3.1 carrying:
+- PR #7 — three dogfood-discovered installer-path bugs (curl-installer ORG default,
+  --purge sudoers cleanup, GSD + Playwright CLI skill bootstrap wiring,
+  AGENTLINUX_AGENT_HOME export during purge, playwright-cli cd to writable home).
+- PR #5 — Ubuntu 26.04 (Resolute Raccoon) added to v0.3.0 supported targets.
+- PR #11 — bump GitHub Actions to Node 24-ready versions.
+- PR #13 — review-reminder Stop hook + ADR-010 refinement (AL-23).
+- PR #14 — workspace-cleanup skill.
+- PR #4/#9/#10 — CI / website deploy fixes.
+
+Refs: AL-18"
+git push origin v0.3.2-rc1
+```
+
+**Verify:**
+- `git ls-remote --tags origin v0.3.2-rc1` returns the tag SHA.
+- GitHub Actions release workflow run appears for the tag (`gh run list --workflow=release.yml --limit 1`).
+
+**Done when:** Tag pushed, release.yml run triggered.
+
+---
+
+### Task 5 — Document Docker dogfood test instructions
+
+**Action:** Write `${QUICK_DIR}/260503-dtx-SUMMARY.md` containing two dogfood paths the user can copy-paste:
+
+1. **Path A (production-realistic) — curl-pipe-bash against the published RC**, gated on the GitHub Release being live. Uses `tests/docker/Dockerfile.ubuntu-{22.04,24.04,26.04}` plus `AGENTLINUX_VERSION=v0.3.2-rc1` to override.
+2. **Path B (pre-publish) — local tarball harness**, runnable as soon as `dist/` is populated. Uses `tests/docker/run.sh` directly.
+3. Include the canonical Claude Code self-update assertion (AGT-02) so the dogfood probes the exact bug class AgentLinux exists to eliminate.
+
+**Done when:** SUMMARY.md exists with copy-pasteable commands for at least Ubuntu 22.04 + 24.04.
+
+---
+
+### Task 6 — Commit artifacts + STATE.md update
+
+**Files:**
+- `.planning/quick/260503-dtx-cut-v0-3-2-rc1-release-candidate-bump-ve/260503-dtx-PLAN.md`
+- `.planning/quick/260503-dtx-cut-v0-3-2-rc1-release-candidate-bump-ve/260503-dtx-SUMMARY.md`
+- `.planning/STATE.md` (append row to "Quick Tasks Completed" + update `Last activity`)
+
+**Action:**
+```
+gsd-sdk query commit "docs(quick-260503-dtx): cut v0.3.2-rc1 release candidate" \
+  .planning/quick/260503-dtx-cut-v0-3-2-rc1-release-candidate-bump-ve/260503-dtx-PLAN.md \
+  .planning/quick/260503-dtx-cut-v0-3-2-rc1-release-candidate-bump-ve/260503-dtx-SUMMARY.md \
+  .planning/STATE.md
+```
+
+**Done when:** Single commit lands containing all three files.
+
+## must_haves
+
+- truths:
+  - `plugin/cli/package.json.version == "0.3.2"`
+  - `plugin/catalog/catalog.json.version == "0.3.2"`
+  - `git ls-remote --tags origin v0.3.2-rc1` returns a SHA on master
+  - `release.yml` workflow run exists for tag `v0.3.2-rc1`
+- artifacts:
+  - PR (chore(release): bump version to 0.3.2 for rc1 release) merged into master
+  - `dist/agentlinux-v0.3.2-rc1.tar.gz{,.sha256}` (locally, optional after publish)
+  - `${QUICK_DIR}/260503-dtx-SUMMARY.md` with Docker dogfood instructions
+- key_links:
+  - `scripts/build-release.sh`
+  - `.github/workflows/release.yml`
+  - `tests/docker/run.sh`
+  - `packaging/curl-installer/install.sh`
+  - `plugin/cli/package.json`
+  - `plugin/catalog/catalog.json`