chirp v0.3.0

The first binaries: cmd/chirp, the one app both people run, and cmd/chirp-relay, the server. Chirp is still not a runnable product: a session has run on one machine, through the relay, not yet between two (#12; README, Status). There are no builds to download; build from source.

Breaking

• Go 1.26.9 is the declared minimum, for the standard library's security fixes.
• The relay keeps chirp.* message types to itself. Forward refuses them from a client with ErrReservedType (#60).
• A signalling message over 1 MiB closes its socket (MaxMessageSize, #60).
• The relay pings every WebSocket every 30 seconds, at most 40, and drops a peer that stops answering (#88).

New

• cmd/chirp, drawn with Fyne in the Warm look:
  • shows this machine's code and link, and takes someone else's code or pasted link; the link it copies is the whole usechirp.app/l#token (#65);
  • asks the owner for consent in Chirp's own prompt, with the controller's name shown as a claim;
  • serves an allowed session with remotekit's stream.Runner, granted exactly what the owner allowed, with STUN/TURN servers from -ice / CHIRP_ICE (#60);
  • shows the owner's screen on the controller's side with remotekit's stream.Viewer, over WebRTC only and decoded in Go, and sends mouse and keys back (#72);
  • shows the owner a bar for as long as a session lasts (#85).
• Signalling over Nostr relays, with -nostr / CHIRP_NOSTR (#43). The server only looks a code up, and never sees the signalling.
• A PAKE over the code's secret part (#21, #94). On the Nostr path a code has 6 + 4 digits, and the two Chirps run CPace over the last four before anyone is asked to consent. A link is given up after 3 failed or abandoned PAKEs.
• cmd/chirp-relay, with deploy files for a Proxmox LXC container, Podman or systemd, behind Caddy (#86; docs/relay.md). Flags: -addr (host:port, or unix:PATH), -socket-mode, -trusted-proxies, -healthcheck.
• usechirp.app, published from site/ on GitHub Pages (#64), behind Cloudflare's security headers (#74, #75).

Fixed

• The relay waits for the first owner socket before dialling a second (#70).
• The site refuses every HTML sink (#74), and Cloudflare no longer rewrites its pages (#75).
• The third-party licence gate sorts modules the same in every locale, and recognises an ISC licence written without a slash.
• The SBOM job can attach to a published release; for v0.2.0 it could not.

Decisions recorded

• usechirp.app is Chirp's domain (#62).
• Warm is the visual direction (docs/ux.md).
• Fyne's embedded fonts (OFL 1.1, Bitstream Vera) are accepted, and gated font by font (#54).
• Vulnerability reports go to security@fabrintek.com.br (#66).

Repository

• Public, with branch and release-tag rulesets (#17, #63, #68), code scanning, a Code of Conduct, issue templates and Discussions (#89, #95).
• The last release merged from develop. Since then Chirp is trunk-based: work lands on main, and a release is a tag on it (#98).

Merged in #97.