Release v1.0.0

Ante 1.0.0: the configuration, contracts and host protocol are now stable. Everything below is compatible with 0.17 deployments: nothing needs draining, and no host has to change.

Changed

• Invitation tokens are isolated per deployment by default (#69). Every token carries this deployment's issuer and audience, and exchange always requires them. Leave Ante:Invitations:Token:Issuer/Audience empty and Ante derives urn:cratis:ante:{EventStore}:{Namespace} (and …:lobby), so two deployments never accept each other's tokens, even when they share a key. The effective values are logged at startup. If your proxy checks issuer and audience, set the proxy to those values, or set them explicitly in Ante.
• Upgrade without draining. A token issued before 1.0 has no issuer or audience. It keeps working for one token lifetime (Expiry) after the deployment first starts on 1.0, as long as a trusted key signed it and it predates that start. After that it is refused.
• A deployment without a signing key starts with a warning, as before. /healthz/ready now reports an invitation-signing check as degraded (still HTTP 200), and incoming invitations wait until a key is configured. Deployments that only do self-service registration need no key.

Added

• Tokens carry a kid header (RFC 7638 thumbprint) naming the key that signed them. Ante:Invitations:Token:PreviousPublicKeyPems keeps earlier keys trusted during a rotation.
• Integration specs restart Ante mid-onboarding and while a host publishes (#67). No state was lost, so Ante needs no extra activation worker.

Not in 1.0

• Durable, host-signed provisioning outcomes (#60) and the "needs a new invitation" state (#61). These are opt-in and additive, planned for a minor release. The host-outcome check (Ante:HostOutcomeUrl) covers the need until then.
• The operator diagnostics API (#62) is built when a host adopts it. Automated erasure (#64) remains the documented manual procedure. The Norwegian translation awaits native review (#84).