buildepicshit/Wick

First stable release. Wick.Runtime is now on NuGet: https://www.nuget.org/packages/Wick.Runtime/1.0.0

dotnet add package Wick.Runtime

Closes the post-v0.5 external engineering audit (canonical report at analysis/reports/Wick-analysis.md). 1 P0 + every P1 + most P2/P3 resolved in PR #54 + #55. 240/240 tests passing on ubuntu/windows/macos. 0 warnings.

Highlights

New

• Wick.Runtime 1.0.0 on nuget.org — the in-process companion that catches AppDomain.UnhandledException + TaskScheduler.UnobservedTaskException and exposes live scene state to the MCP server. dotnet add package Wick.Runtime.
• In-process bridge auth — WickBridgeServer now requires a 256-bit shared-secret token on every request (constant-time compare, env-propagated to spawned games via WICK_BRIDGE_TOKEN). WICK_BRIDGE_AUTH_DISABLED=1 for migration.
• Cross-OS CI — ubuntu-latest, windows-latest, macos-latest matrix with NuGet cache + TRX artifact upload.
• Tag-driven NuGet release pipeline — push a vX.Y.Z tag, package ships.

Fixed

• GodotBridgeManager.GetSceneContext() was hardcoded to return null, breaking the headline demo claim. Now async, queries editor_scene_tree with a 1.5s bounded timeout.
• runtime_launch_game previously silent-failed when WICK_GODOT_BIN was unset; now preflights and surfaces a structured godot_binary_not_found response. runtime_status exposes the resolved binary path.
• docs/tools-reference.md was advertising ~70% wrong tool names — fully regenerated from DefaultToolGroups.cs.
• docs/getting-started.md documented WickRuntime.Initialize() (does not exist) and omitted the required Tick() call. Replaced with the canonical example.
• Verbose JSON-RPC tracing (every frame including file contents) was always-on to stderr; now defaults off, opt-in via WICK_RPC_TRACE.
• Content-Length capped at 16 MiB in CSharpLspClient + GodotDapClient (was unbounded → OOM-by-peer).
• Windows-CI flake in ExceptionPipelineTests (fixed Task.Delay replaced with poll-until-ready).

Removed

• Legacy Wick.sln (only registered 2 of 6 source projects).

Security

• New explicit threat model in SECURITY.md — in-scope vs out-of-scope, with the in-process bridge auth in scope and GDScript-side editor / runtime bridges (ports 6505 / 7777) on the v1.x roadmap.

Full changelog

See CHANGELOG.md.

Compatibility

• Wick.Runtime targets net8.0 (Godot 4.6.1 mono runtime constraint).
• Wick MCP server targets net10.0.