0.16.1 — 2026-10-18 Carries 0.16.0, whose tag was never published, and pins deploy/example to the release image. Adds `contract/`, which pins what the portal depends on in an Ory config, and `check-ory`, an opt-in validator for a deployment's own finished files. A deployment that renders its configs needs no change. - `contract/` holds the Kratos and Hydra schemas the portal depends on. `node dist/server/config.mjs check-ory` validates a deployment's own `kratos.yml`, `hydra.yml`, identity schema and recovery-gate hook against it. - The OTLP endpoint is quoted in the `tracing` blocks of `kratos.yml` and `hydra.yml`. Optional: `git diff v0.15.0..v0.16.1 -- kratos hydra`. - Hardening: identity headers with underscores in their names are dropped at the edge, and the device verify rate limit also matches a trailing path. - Render refuses more line-break characters in values, and a failed render clears the earlier output. - Deployment: non-breaking; `check-ory` is opt-in, see Config changes in CHANGELOG.md.