Changelog

What each release means for a user of Quitanza.

v0.7 2026-06-11

Anyone can verify a quitanza, no account, no key: POST /v1/verify checks a posted proof against the published issuer keys, and quitanza.com/verify.html does it in the browser.
A transparency log: every issued quitanza is a leaf of an append-only Merkle log with signed tree heads, public inclusion proofs, and consistency proofs between any two checkpoints. Rotation does not revoke; a checkpointed log answers later questions about a key.
The SDK verifies log inclusion and consistency offline; the CLI proves a quitanza's place in the log with one command.
Security disclosures have an address: /.well-known/security.txt, RFC 9116.
The browser surface hardened: a strict content security policy, HSTS, and the rest of the modern header set.
Operators see their deployment in one page: escrows by state, proofs issued, log size, webhook and rate-limit counters, behind the admin key.

Issuer key rotation: a deployment can retire its signing key without orphaning a single proof. Every key era stays published, and old quitanzas keep verifying by the key that signed them.
Dispute rulings can split: signed basis points on the ruling and on the quitanza, honored exactly at settlement.
Settlement failures are loud and recoverable: an escrow only reaches a terminal state after custody confirms, failures surface as custody_failed with a retry path, and no quitanza exists before the funds moved.
Every escrow's full event history is replayable at /v1/escrows/{id}/events, exactly as webhooks delivered it.
Every error is one envelope: a stable code, a human message, and a docsUrl into the error taxonomy.
Storage is an append-only journal with periodic snapshots: crash-safe by construction, with automatic migration from earlier deployments.
Multiple bearer keys: the deployment key can mint, list, and revoke scoped keys, stored only as hashes, each with an optional rate limit of its own.
The SDK retries where repeating is safe, times out per attempt, and throws typed errors. The CLI exits honestly and speaks machine-stable JSON under --json.
A runnable examples gallery: agent pays agent, the x402 handshake, and a dispute decided by an arbiter.

Issuer keys are published at /.well-known/quitanza-issuer.json, so a quitanza can be verified against the quitanza.com domain with no prior key exchange.
The SDK and the CLI verify a quitanza offline against a domain's published keys.
Registering the same mandate twice now returns the existing record: one authority per signed mandate, however many times it is submitted.
Settlement custody is pluggable. An EVM adapter drives the QuitanzaEscrow contract on a local development chain, and a quitanza settled that way carries an anchor block naming the chain, contract, escrow reference, and transaction hash.
The changelog you are reading became curated release notes.

Quitanza went live at quitanza.com: the documentation site and the hosted API, deployed automatically on every change.
Hosted API access requires a bearer key, with per-client rate limits.
An adversarial security review hardened money handling, amount validation, and hashing. Findings and fixes are part of the test suite.
QuitanzaEscrow.sol: the settlement discipline as a contract, with a fuzzed Foundry test suite. Local rails only.

Silence always resolves: every escrow carries per-stage deadlines, and a sweep closes anything left past one, ending in a quitanza.
Webhooks are durable and signed: retries with backoff, a dead-letter list, and a verification helper in the SDK.
Idempotency keys on escrow creation and funding: a retried request can never create a duplicate.
Mandates: principal-signed spending caps, enforced at escrow creation.
Dispute rulings require both parties' signatures or the named arbiter's. The platform never rules.
The API is described by a hand-written OpenAPI 3.1 document; the reference page is generated from it.
The quitanza format specification, version 1, with a worked example verifiable using only a standard library.
A command line client: create, fund, deliver, status, verify.

State survives restarts: escrows, proofs, and keys persist to disk and restore on boot.
Client-side signing: agents keep their private keys and submit signatures. The sandbox holding keys is now a convenience, not the only path.
An x402 adapter settles the HTTP 402 payment handshake through escrow, on simulated rails.
An MCP server gives any MCP-capable agent five settlement tools over stdio.

The first release: non-custodial escrow with machine-readable terms, deterministic verification, structured disputes, and a hash-chained evidence trail.
Every closed matter issues a quitanza: a signed settlement proof anyone can verify offline.
An HTTP API, a TypeScript SDK, and this documentation site.