chore: stamp 0.3.1 release candidate

CHANGELOG.md

@@ -4,6 +4,31 @@ History before 0.1.0 lives in git — rig grew its version surface (`VERSION`,
 `rig --version`, the side-by-side `versions/<v>` install layout; #35/#36)
 on the way to cutting its first release, and this file starts there.
 
+## 0.3.1 — 2026-07-24
+
+### Added
+
+- GitHub entry templates route humans to Discussions and prefill triage work orders and pull requests (#123)
+- Platform, drill, docs and labels changes receive dedicated scope labels (#119)
+- The `changelog-armed` guard returns, version-keyed (#112, ceremony#13)
+- The `.ceremony/` doctrine mirror, verified by `docs-sync` on every PR (#112, ceremony#19)
+- `kimi-box` joins the box tenant roles — the Kimi CLI agent guest (#109)
+- CI drills the install lifecycle against a real tree — install from the checkout, converge to an empty diff, uninstall to proven absence (#106)
+- `drill/drill.sh` — the drill has an instrument: pinned-ref assertion, a mechanical idempotence diff, and a `drills/<version>.md` record emitter (#105)
+- `rig platform` prints a stable machine `ID`, derived from `/etc/machine-id`, never the raw value (#95)
+- `rig bootstrap --undo` removes only a tailnet join rig can prove it made (#63)
+
+### Changed
+
+- Changelog entries land in per-issue fragments assembled by the release PR (#136)
+- Release and labels machinery is consumed from heavy-duty/ceremony@0.1.0 by reference — the workflows shrink to caller stubs, the guard scripts and their tests move upstream (#112, ceremony#13)
+- `bootstrap --host yes` installs a pinned box release instead of `main` (#103)
+
+### Fixed
+
+- The drill's docs no longer claim both installers default to `main` — box installs the `BOX_RELEASE` pin, rig the latest release, and its `--box-ref` example is now a tag (#133)
+- `kimi-bot-andresmgsl` is on the review panel — the roster predated it joining the bench (#120)
+
 ## 0.3.0 — 2026-07-21
 
 ### Fixed

VERSION

@@ -1 +1 @@
-0.3.1-dev
+0.3.1

changelog.d/103.md

@@ -1,3 +0,0 @@
-### Changed
-
-- `bootstrap --host yes` installs a pinned box release instead of `main` (#103)

changelog.d/105.md

@@ -1,3 +0,0 @@
-### Added
-
-- `drill/drill.sh` — the drill has an instrument: pinned-ref assertion, a mechanical idempotence diff, and a `drills/<version>.md` record emitter (#105)

changelog.d/106.md

@@ -1,3 +0,0 @@
-### Added
-
-- CI drills the install lifecycle against a real tree — install from the checkout, converge to an empty diff, uninstall to proven absence (#106)

changelog.d/109.md

@@ -1,3 +0,0 @@
-### Added
-
-- `kimi-box` joins the box tenant roles — the Kimi CLI agent guest (#109)

changelog.d/112.md

@@ -1,8 +0,0 @@
-### Added
-
-- The `changelog-armed` guard returns, version-keyed (#112, ceremony#13)
-- The `.ceremony/` doctrine mirror, verified by `docs-sync` on every PR (#112, ceremony#19)
-
-### Changed
-
-- Release and labels machinery is consumed from heavy-duty/ceremony@0.1.0 by reference — the workflows shrink to caller stubs, the guard scripts and their tests move upstream (#112, ceremony#13)

changelog.d/119.md

@@ -1,3 +0,0 @@
-### Added
-
-- Platform, drill, docs and labels changes receive dedicated scope labels (#119)

changelog.d/120.md

@@ -1,3 +0,0 @@
-### Fixed
-
-- `kimi-bot-andresmgsl` is on the review panel — the roster predated it joining the bench (#120)

changelog.d/123.md

@@ -1,3 +0,0 @@
-### Added
-
-- GitHub entry templates route humans to Discussions and prefill triage work orders and pull requests (#123)

changelog.d/133.md

@@ -1,3 +0,0 @@
-### Fixed
-
-- The drill's docs no longer claim both installers default to `main` — box installs the `BOX_RELEASE` pin, rig the latest release, and its `--box-ref` example is now a tag (#133)

changelog.d/136.md

@@ -1,3 +0,0 @@
-### Changed
-
-- Changelog entries land in per-issue fragments assembled by the release PR (#136)

changelog.d/63.md

@@ -1,3 +0,0 @@
-### Added
-
-- `rig bootstrap --undo` removes only a tailnet join rig can prove it made (#63)

changelog.d/95.md

@@ -1,3 +0,0 @@
-### Added
-
-- `rig platform` prints a stable machine `ID`, derived from `/etc/machine-id`, never the raw value (#95)