release: cut v0.17.0 (observability + identity self-heal)

CHANGELOG.md

@@ -10,6 +10,8 @@ the PR description linked in each section.
 
 ## [Unreleased]
 
+## [v0.17.0] — 2026-07-10
+
 ### Fixed
 
 - **The "two names" identity split — self-healed at its source + made self-reporting** (#351): a Claude session's statusline showed one wire identity while the session *operated* on wire as another (confirmed live: a session whose `CLAUDE_CODE_SESSION_ID` derived `daydream-gorge` was sending/pairing as `merry-spindle`, a key matching no live session; box-wide, 115 of 434 running `wire` procs served an identity no live session used). Root cause: the long-lived `wire mcp` server resolves + **freezes** its identity at launch, but the statusline re-resolves live each render — and when the MCP boots before Claude writes its session PID-file, `resolve_session_key()` misses and the server **mints** a throwaway `mcp-proc-*` key, pins it into `WIRE_SESSION_ID`, and serves it for life. Fixes: (1) before minting, **retry the PID-file** (walk the ancestor chain once, cached — no per-hop `ps` re-fork; the #353 Windows trap avoided) so the live session is recovered instead of frozen; (2) the mint **no longer pins `WIRE_SESSION_ID`** (that slot is the operator-override/live channel — a minted value there beat the live session on re-resolve); (3) `detect_identity_split` rewritten to compare the **served** identity vs the **live** PID-file identity, so the frozen MCP itself detects the drift the old env-vs-pidfile check structurally couldn't — surfaced as an `identity_split` field on `wire_status`/`wire_whoami` so an agent self-detects at the session-start health check and recommends `/mcp reconnect`; the RFC-008 deliberate fleet-share (`WIRE_HOME` pin) is exempt. Also fixed a latent bug the redesign exposed: `handle_for_key` hashed the *sanitized* (32-char-truncated) key while homes are created from the *raw* key hash, so a 36-char session-id uuid resolved to the wrong home. (4) `wire setup` now bakes `env:{WIRE_SESSION_ID:"${CLAUDE_CODE_SESSION_ID}"}` into the MCP entry it writes, so the forward survives `--apply` (inert on non-Claude hosts). Existing frozen MCPs heal on the next `/mcp reconnect`; the self-report makes that one-command recovery visible.

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "slancha-wire"
-version = "0.16.0"
+version = "0.17.0"
 edition = "2024"
 rust-version = "1.88"
 description = "Magic-wormhole for AI agents — bilateral signed-message bus over a mailbox relay"

README.md

@@ -94,8 +94,9 @@ Knowing a handle (`alice@wireup.net`) and being able to resolve it to a signed a
 
 ## Recent releases
 
-Currently shipping **v0.16.0**. Highlights:
+Currently shipping **v0.17.0**. Highlights:
 
+- **v0.17.0** (2026-07-10) — **observability + identity self-heal**: `wire dash` (a read-only pane over every identity on the box) + reversible `wire retire`/revive for idle identities, the Nostr transport stack (RFC-007 D3 — bidirectional pair/send/pull over `wss://` with NIP-44 DMs), same-machine signed attestation for auto-pairing your own sessions (#182), sandbox hardening (Docker/OpenShell), and a self-healing fix for the "two names" split — the `wire mcp` server no longer freezes a minted identity while the live session drifts; it retries the session PID-file before minting, and `wire_status`/`wire_whoami` now self-report an `identity_split` so an agent catches a stale MCP and reconnects (#351)
 - **v0.16.0** (2026-06-14) — **the 1.0 format-freeze pass**: RFC-006 collapses the dual representations that fork-stormed (one by-key session store; `endpoints[]` the single peer-routing source), the identity layer grows on the additive v3.2 card (DNS-TXT org binding, op/org key rotation, project fan-out, per-peer block-list, DID bound to key + one-name enforced server-side), and a launch-hardening sweep lands `wire demo` (two agents talking in one command), a cleaner `wire --help`, MCP first-run fixes, and the daemon-survival fix behind the hello-world round-trip harness
 - **v0.15.0** (2026-06-07) — **the de-deprecation (BREAKING)**: removed all backwards compatibility — deprecated MCP/CLI aliases, the entire SAS code-phrase pairing flow (`wire dial` is now the sole pairing path), and dead legacy on-disk formats. New `wire nuke` clean-slate command. Agents only ever see canonical verbs
 - **v0.14.2** (2026-06-05) — multi-session supervisor + queue collapse (synchronous send/pull verdicts), dual-roots TLS, then a launch-hardening pass: `--all-sessions` fork-storm fix, hermetic tests, REUSE-compliant license, install-smoke CI