From 66d1e2d261394881c22ea6f3f9b79cb0be9fa49d Mon Sep 17 00:00:00 2001
From: Efi Jeremiah <efi.jeremiah@gmail.com>
Date: Thu, 1 Oct 2026 05:10:06 +0300
Subject: [PATCH] release: v3.2.0

Cloud audit logs as a second witness (#67), delta runs with signed and
proven rounds (#68), and the Cmd/Ctrl+K command palette (#69).

Co-Authored-By: Claude <noreply@anthropic.com>
---
 CHANGELOG.md                | 5 +++++
 docs/index.html             | 4 ++--
 internal/version/version.go | 2 +-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fc1f379..d971b98 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,11 @@ and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## [3.2.0] — 2026-10-01
+
+Cloud audit logs become a second witness, repeat runs are a true delta,
+and Cmd/Ctrl+K opens a real command palette.
+
 Lessons from the 2026 agent-driven cloud attacks: Microsoft's Storm-3168,
 Sysdig's JADEPUFFER and Sygnia's AI-assisted intrusion.
 
diff --git a/docs/index.html b/docs/index.html
index e946836..4955193 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -435,7 +435,7 @@
       <a href="#docs">Docs</a>
     </nav>
     <div class="nav-r">
-      <a class="ver" href="https://github.com/efij/AgentDFIR/releases/latest">v3.1.0</a>
+      <a class="ver" href="https://github.com/efij/AgentDFIR/releases/latest">v3.2.0</a>
       <a class="btn" href="https://github.com/efij/AgentDFIR">
         <svg width="16" height="16" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M12 .5C5.65.5.5 5.65.5 12c0 5.08 3.29 9.39 7.86 10.91.58.11.79-.25.79-.55v-2.17c-3.2.7-3.87-1.36-3.87-1.36-.52-1.33-1.28-1.68-1.28-1.68-1.04-.71.08-.7.08-.7 1.15.08 1.76 1.19 1.76 1.19 1.03 1.75 2.69 1.25 3.35.95.1-.75.4-1.25.72-1.54-2.55-.29-5.24-1.28-5.24-5.68 0-1.26.45-2.28 1.19-3.09-.12-.29-.52-1.46.11-3.05 0 0 .97-.31 3.18 1.18a11.1 11.1 0 0 1 5.79 0c2.2-1.49 3.17-1.18 3.17-1.18.63 1.59.23 2.76.12 3.05.74.81 1.18 1.83 1.18 3.09 0 4.41-2.69 5.38-5.25 5.66.41.35.77 1.05.77 2.12v3.15c0 .3.21.66.8.55A11.51 11.51 0 0 0 23.5 12C23.5 5.65 18.35.5 12 .5z"/></svg>
         GitHub
@@ -450,7 +450,7 @@
   <div class="wrap">
     <div class="hero-grid">
       <div>
-        <a class="status" href="https://github.com/efij/AgentDFIR/blob/main/CHANGELOG.md"><i aria-hidden="true"></i>v3.1.0 — apply and undo guardrails from the browser</a>
+        <a class="status" href="https://github.com/efij/AgentDFIR/blob/main/CHANGELOG.md"><i aria-hidden="true"></i>v3.2.0 — cloud audit logs as a second witness, and a ⌘K command palette</a>
         <h1 id="h1">Incident response for <span class="a">AI agents</span>.</h1>
         <p class="sub">Claude Code, Codex, Cursor and eleven other agents run shell commands, read credentials and call MCP servers with your privileges. AgentDFIR acquires what they leave on disk into sealed, hash-chained evidence, reconstructs the attack chain, and puts the exact log line behind every finding.</p>
         <div class="ctas">
diff --git a/internal/version/version.go b/internal/version/version.go
index 2bf8a13..cd47173 100644
--- a/internal/version/version.go
+++ b/internal/version/version.go
@@ -3,7 +3,7 @@ package version
 
 // Version is the collector version. Overridable at build time via
 // -ldflags "-X github.com/efij/AgentDFIR/v3/internal/version.Version=vX.Y.Z".
-var Version = "3.1.2"
+var Version = "3.2.0"
 
 // ADFIRVersion is the evidence package format version this binary writes.
 //