v0.2.12

v0.2.12

Consent-era foundation: every request now carries a mandatory Ed25519 signature (legacy token-only clients get 401 missing_signature).

• Stable-key TOFU: GET /v1/identity serves the relay RSA public key; clients pin the SHA-256 fingerprint before sending any credentials
• Client transport hardening: redirect refusal, challenge/nonce equality, fail-closed on 503 / missing identity material / transport errors (Flint review F1-F5, R1-R6)
• CLI sends the configured User-Agent on the identity check (Cloudflare 403s bare Python-urllib)
• Enrollment telemetry (enroll_gate/enroll_ip/last_poll_at/last_send_at), reserved peer names
• bind config knob (default 127.0.0.1); Docker packaging on bridge networking
• Atomic config writes, SIGHUP guard for Windows

Verified live on https://relay.tryclack.com (fingerprint sha256:bdc8a616f41b4397): PoW enrollment + signed send/poll/ACK.

Known issue: intermittent dropped connections at the Cloudflare edge under investigation; client retries safely.

Full test suite green (132/132).