> ## Documentation Index
> Fetch the complete documentation index at: https://jephalabs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> Release status and where the release record lives

# Changelog

QTG is **pre-1.0** and has no published release yet. Tagged releases go to the
[OSS repo](https://github.com/jephalabs/quant-transfer-guard); `CHANGELOG.md` in that
repository is the release record, structured per release as security-relevant changes,
runtime safety, provider/adapter work, breaking config or migration steps, evidence,
and known limitations.

Until the first tagged release, this documentation describes the current state of the
development line rather than a version you can pin. Nothing here carries a
compatibility promise yet.

<Warning>
  Pre-1.0 means interfaces move without deprecation cycles — the HMAC canonical string,
  the template schema, and the executor protocol have all changed within a single month.
  Read [Security Tradeoffs](/security-tradeoffs) before pointing this at real funds.
</Warning>

## Boundary changes worth knowing

**Signer lifecycle administration moved to Pro.**
Shared schema, signer adapters, and movement-time safety remain Free — an OSS
deployment still signs, still enforces the address allowlist, still re-derives the
recipient from the signed artifact. What moved is the administrative surface:
generic signer reads and the shared dashboard no longer expose lifecycle history.

**The HMAC middleware refuses requests served under an ASGI path prefix.** The signature
covers `scope["path"]`, which excludes the prefix, so a prefixed deployment would have
accepted unsigned requests. It now returns `503` instead. Put QTG behind a proxy that
forwards the original path.