v0.16.0

What's Changed

• feat(session): RFC-008 §C session-key precedence over legacy-shape WIRE_HOME (re-open from #224 closure) by @WILLARDKLEIN in #234
• docs(rfc-006): D1 NIP-44 DM-encryption implementation design (ultra-reviewed) by @laulpogan in #230
• fix(group): reject path-traversal in group id (arbitrary-path-write via join code) by @laulpogan in #238
• fix(cli): five operator-input/IO error-path bugs in cli.rs (TDD'd) by @laulpogan in #239
• refactor(cli): split the 15.7k-line cli.rs monolith into a src/cli/ module tree by @laulpogan in #242
• test(cli): backfill deadline error-path + group-family integration coverage by @laulpogan in #241
• fix: kill the three engines that kept taking the dev host's wire down by @laulpogan in #243
• fix(identity): bind DID to key, enforce one-name server-side, verify ack before trust by @laulpogan in #244
• fix(status): scope orphan-daemon detection to the current WIRE_HOME (fresh-install false alarm) by @laulpogan in #248
• fix: launch-hardening onboarding — stale breadcrumbs, default toasts, doctor blind spot by @laulpogan in #249
• fix: MCP agent first-run — kill the dial dead-end, arm the daemon, add wire_here by @laulpogan in #250
• docs(cli): clean up wire --help — start-here footer + intent-first verbs by @laulpogan in #251
• feat(cli): wire demo — see two agents talk in one command by @laulpogan in #253
• docs: lead the hello-world with wire demo by @laulpogan in #254
• docs(mcp): sync agent-facing tool docs with the live catalog + guard by @laulpogan in #255
• feat(identity): per-peer block-list (RFC-001 §T16 rogue-admin containment) by @laulpogan in #256
• feat(identity): project routing fan-out — wire send-project + wire project (RFC-001 §6) by @laulpogan in #257
• docs(rfc-005): amendment — Phase 4 KILL_CRITERION fire (2 of 4 shims preserved as live) by @WILLARDKLEIN in #235
• docs(rfc): RFC-008 session-key precedence + WIRE_HOME pin observability (was RFC-005/006; renumbered twice after #220 + #221 slot collisions) by @WILLARDKLEIN in #211
• RFC-001 amendment: same-machine session auto-pair (Option C from #182) by @WILLARDKLEIN in #188
• feat(identity): DNS-TXT org binding — wire org bind/list/forget (RFC-001 §2 floor) by @laulpogan in #258
• feat(identity): op/org key rotation via succession-cert (RFC-001 §T19/§T20) by @laulpogan in #259
• fix(daemon): stop wire up's daemon self-aborting on its own singleton pidfile by @laulpogan in #263
• test(tooling): salvage the hello-world round-trip validation harness by @laulpogan in #262
• refactor(cli): init/up surface cleanup — no name inputs, one onboarding verb by @laulpogan in #270
• refactor(session): RFC-006 Part A — collapse to a single by-key session store by @laulpogan in #269
• test(it): poll post-accept VERIFIED check (fix cross-process race) by @laulpogan in #271
• feat(rfc-006): Part B — endpoints[] is the single peer-routing source by @laulpogan in #268
• docs(rfc-006): accept collapse as 1.0 format-freeze gate + scope Part B (footgun fix) by @laulpogan in #267
• docs(security): threat-model truth pass for 1.0 — honest DM-sealing posture by @laulpogan in #266
• fix(landing): correct wireup.net to v0.15 reality (one-name, wire up, no SAS) by @laulpogan in #264
• chore(docs): declutter root — drop scratch/stale-spec .md, archive history to docs/history/ by @laulpogan in #265
• test(it): remote-relay (non-loopback) federation integration test by @laulpogan in #272
• release: cut v0.16.0 — RFC-006 format freeze + onboarding cleanup by @laulpogan in #273

Full Changelog: v0.15.0...v0.16.0