canaan5 · Jun 17, 2026 · Jun 9, 2026 · Jun 17, 2026 · Jun 17, 2026 · Jun 17, 2026
@@ -25,7 +25,7 @@ This synthesis is built around four hard requirements distilled from the design
 - [6. FieldCodec / LengthCodec Registry & Catalog](#6-fieldcodec--lengthcodec-registry--catalog)
 - [7. Packager Profiles](#7-packager-profiles)
 - [8. Alternate Renderings (View)](#8-alternate-renderings-view)
-- [9. How This Beats jPOS](#9-how-this-beats-jpos)
+- [9. How Isopace differs from jPOS](#9-how-isopace-differs-from-jpos)
 
 ---
 
@@ -967,7 +967,12 @@ The **same `*Message`** round-trips through every backend: `Codec.Marshal` → I
 
 ---
 
-## 9. How This Beats jPOS
+## 9. How Isopace differs from jPOS
+
+> Isopace is an independent, clean-room implementation and is **not affiliated
+> with, endorsed by, or derived from** the jPOS project. "jPOS" is a trademark of
+> its respective owner; the comparisons below are technical and offered for
+> design and interoperability context only.
 
 **1. Type-safe access instead of a stringly-typed mutable `Map<Integer,ISOComponent>`.**
 jPOS hands you `msg.getString(4)` (a `String` you must parse) and `getComponent(4)` (an `ISOComponent` you downcast), with mistakes surfacing as runtime `ClassCastException`/`NumberFormatException`. Isopace gives `Get[iso8583.Decimal](m, 4)` and tag-bound structs (`Amount iso8583.Decimal \`iso:"4"\``): the type is known at compile time, money is exact fixed-point (never a float or a re-parsed string), and a mismatch is a generic-constraint error or a structured `FieldError` carrying `Path` + `Offset`. The 90% developer never casts.

@@ -7,6 +7,30 @@ the [versioning policy](https://teqpace-services.github.io/isopace/versioning/).
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-06-17
+
+The first **stable** release. With the release-candidate soak complete, the
+**core** ISO 8583 surface is now **frozen under [Semantic Versioning](https://semver.org/spec/v2.0.0.html)**;
+the higher layers and the production-crypto (HSM) path ship alongside it but
+remain **preview** and are explicitly **not** covered by the v1 stability
+guarantee:
+
+- **Stable — frozen.** `iso8583`, `packager`, `fieldcodec`, `lengthcodec`, and
+  `render` are the v1 API contract. Breaking changes to these now require a
+  major-version bump. This surface soaked through `v1.0.0-rc.1` in production.
+- **Experimental — may still change.** The higher layers (`runtime`, `flow`,
+  `space`, `store`, `mux`, `link`, `listener`, `connector`, `gateway`, `teq`,
+  `vault`, `rbac`, `ops`) ship but are **not** yet covered by the stability
+  guarantee and may change in a minor release until they soak.
+- **Preview — production crypto (HSM).** The HSM path (roadmap B1) ships for the
+  first time: `vault` capability interfaces plus the `adapters/pkcs11` and
+  `adapters/payshield` modules. The PKCS#11 MAC path is cross-checked against a
+  real token under SoftHSM2 in CI; **`adapters/payshield` is a scaffold
+  validated only against an in-repo simulator — not against real payShield
+  hardware or LMK key schemes — and is pending device validation and security
+  review.** Software vault backends remain development/testing only; production
+  PIN and key handling require a certified HSM.
+
 ### Added
 
 - **`vault` capability interfaces** for HSM adapters. The `vault.Vault` façade is
@@ -252,7 +276,8 @@ tested under `go test -race`.
   authenticates in constant time; expose it only behind appropriate network
   controls.
 
-[Unreleased]: https://github.com/teqpace-services/isopace/compare/v1.0.0-rc.1...HEAD
+[Unreleased]: https://github.com/teqpace-services/isopace/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/teqpace-services/isopace/compare/v1.0.0-rc.1...v1.0.0
 [1.0.0-rc.1]: https://github.com/teqpace-services/isopace/compare/v0.3.0...v1.0.0-rc.1
 [0.3.0]: https://github.com/teqpace-services/isopace/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/teqpace-services/isopace/compare/v0.1.0...v0.2.0

@@ -7,20 +7,10 @@ NOT offered under the AGPL.
 
 # Isopace Commercial License Agreement
 
-> ## ⚠️ DRAFT — NOT LEGAL ADVICE
->
-> This document is a **template / starting point**, prepared to accelerate
-> drafting. It has **not** been reviewed by a lawyer and is **not legal advice**.
-> It **must** be reviewed, completed, and adapted by qualified legal counsel
-> licensed in the governing jurisdiction before it is offered to, or executed
-> with, any customer. Bracketed `[PLACEHOLDERS]` must be completed. Payment‑
-> industry, data‑protection (e.g. UK GDPR / GDPR), export‑control, and
-> consumer‑law requirements may impose additional or conflicting terms.
-
 This Commercial License Agreement (the "**Agreement**") is entered into by and
 between **Teqpace Services Ltd.**, a company registered in
-`[JURISDICTION OF INCORPORATION]` with registered number `[COMPANY NUMBER]` and
-registered office at `[REGISTERED ADDRESS]` ("**Licensor**"), and the entity
+the Federal Republic of Nigeria with registered number RC 9036279 and
+registered office at 21 Association Avenue, Ejigbo, Lagos, Nigeria ("**Licensor**"), and the entity
 identified in the Order Form ("**Licensee**"). It is effective on the date of the
 last signature or the Order Form effective date (the "**Effective Date**").
 
@@ -58,8 +48,8 @@ common control with a party.
 ## 2. License grant
 
 2.1 **Grant.** Subject to Licensee's compliance with this Agreement and payment of
-the Fees, Licensor grants Licensee a `[non-exclusive / non-transferable /
-worldwide]` license during the Term to:
+the Fees, Licensor grants Licensee a non-exclusive, non-transferable,
+worldwide license during the Term to:
 
   (a) use, reproduce, and internally modify the Licensed Software;
 
@@ -77,7 +67,7 @@ Licensee is **not** required to comply with the source-disclosure obligations of
 the AGPL (including section 13). Licensee's own switch logic, integrations, and
 configuration may remain confidential.
 
-2.3 **Affiliates.** `[Affiliates may / may not]` exercise the license; if
+2.3 **Affiliates.** Affiliates may **not** exercise the license; if
 permitted, Licensee remains responsible for their compliance.
 
 2.4 **Reservation.** All rights not expressly granted are reserved by Licensor.
@@ -109,11 +99,11 @@ copies it obtains and uses under that license.
 4.1 Licensee shall pay the fees set out in the Order Form (the "**Fees**")
 per Schedule B.
 
-4.2 Fees are `[exclusive / inclusive]` of taxes; Licensee is responsible for
+4.2 Fees are exclusive of taxes; Licensee is responsible for
 applicable taxes other than Licensor's income taxes.
 
-4.3 Undisputed invoices are payable within `[30]` days. Late amounts may accrue
-interest at `[the statutory rate / LATE-FEE RATE]`.
+4.3 Undisputed invoices are payable within 30 days. Late amounts may accrue
+interest at the Central Bank of Nigeria Monetary Policy Rate (CBN MPR) plus 10% per annum.
 
 ---
 
@@ -126,7 +116,7 @@ Schedule C. Absent a support purchase, the Licensed Software is provided without
 support obligations.
 
 5.3 Updates made generally available to commercial licensees during the Term are
-included `[as set out in the Order Form]`.
+included as set out in the Order Form.
 
 ---
 
@@ -145,7 +135,7 @@ irrevocable, royalty-free license to use it without restriction.
 
 ## 7. Warranties and disclaimer
 
-7.1 **Limited warranty.** Licensor warrants that, for `[90]` days after delivery,
+7.1 **Limited warranty.** Licensor warrants that, for 90 days after delivery,
 the Licensed Software will materially conform to the Documentation. Licensee's
 exclusive remedy for breach is, at Licensor's option, repair, replacement, or
 refund of the Fees for the non-conforming Licensed Software.
@@ -186,7 +176,7 @@ PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, OR DATA, ARISING OUT OF THIS
 AGREEMENT.
 
 9.2 EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS
-AGREEMENT IS LIMITED TO THE FEES PAID OR PAYABLE BY LICENSEE IN THE `[12]` MONTHS
+AGREEMENT IS LIMITED TO THE FEES PAID OR PAYABLE BY LICENSEE IN THE 12 MONTHS
 PRECEDING THE EVENT GIVING RISE TO THE CLAIM.
 
 9.3 The exclusions and limits do not apply to `[liability that cannot be excluded
@@ -210,7 +200,7 @@ third party.
 11.1 This Agreement runs for the term in the Order Form (the "**Term**").
 
 11.2 Either party may terminate for the other's material breach not cured within
-`[30]` days of written notice.
+30 days of written notice.
 
 11.3 On termination for Licensee's breach, the commercial license ends and
 Licensee must stop using the Licensed Software under this Agreement (Licensee's
@@ -227,8 +217,8 @@ and 12) survive termination.
 control and sanctions laws.
 
 12.2 **Governing law & venue.** This Agreement is governed by the laws of
-`[GOVERNING LAW — e.g. England and Wales]`, and the parties submit to the
-`[exclusive]` jurisdiction of the courts of `[VENUE]`.
+the Federal Republic of Nigeria, and the parties submit to the
+exclusive jurisdiction of the courts of Lagos, Nigeria.
 
 12.3 **Assignment.** Neither party may assign this Agreement without the other's
 consent, except to a successor in a merger or sale of substantially all assets.
@@ -250,7 +240,7 @@ then the Schedules.
 | Licensor — Teqpace Services Ltd. | Licensee — `[LICENSEE LEGAL NAME]` |
 |---|---|
 | Signature: _______________________ | Signature: _______________________ |
-| Name: `[NAME]` | Name: `[NAME]` |
+| Name: Canaan Etaigbenu | Name: `[NAME]` |
 | Title: `[TITLE]` | Title: `[TITLE]` |
 | Date: `[DATE]` | Date: `[DATE]` |
 

@@ -27,18 +27,18 @@ Every `[BRACKETED]` value in `COMMERCIAL-AGREEMENT.md`:
 
 | § | Placeholder | Decision needed |
 |---|---|---|
-| Preamble | `[JURISDICTION OF INCORPORATION]`, `[COMPANY NUMBER]`, `[REGISTERED ADDRESS]` | Teqpace's registration details |
+| Preamble | `Federal Republic of Nigeria`, `9036279`, `21 Association Avenue` | Teqpace's registration details |
 | 2.1 | `[non-exclusive / non-transferable / worldwide]` | Grant nature |
-| 2.3 | `[Affiliates may / may not]` exercise the license | Affiliate rights |
-| 4.2 | Fees `[exclusive / inclusive]` of taxes | Tax treatment |
-| 4.3 | Payment term `[30]` days; interest `[statutory rate / LATE-FEE RATE]` | Payment terms |
+| 2.3 | `may not` exercise the license | Affiliate rights |
+| 4.2 | Fees `exclusive` of taxes | Tax treatment |
+| 4.3 | Payment term `[30]` days; interest `[CBN MPR + 10% p.a.]` | Payment terms |
 | 5.3 | Update entitlement `[as set out in the Order Form]` | Confirm or specify |
 | 7.1 | Limited-warranty period `[90]` days | Warranty window + remedy |
 | 9.2 | Liability cap window `[12]` months | Cap basis |
 | 9.3 | Carve-outs from the liability cap | Confirm list (death/PI, fraud, indemnity, payment) |
 | 11.2 | Cure period `[30]` days | Termination terms |
-| 12.2 | `[GOVERNING LAW]`, `[VENUE]`, `[exclusive]` jurisdiction | Governing law & venue |
-| Signatures | `[LICENSEE LEGAL NAME]`, `[NAME]`, `[TITLE]`, `[DATE]` | Per-deal (Order Form) |
+| 12.2 | `Laws of the Federal Republic of Nigeria`, `[Courts of Lagos]`, `[exclusive]` jurisdiction | Governing law & venue |
+| Signatures | `Canaan Etaigbenu`, `[NAME]`, `[TITLE]`, `[DATE]` | Per-deal (Order Form) |
 | Schedule A | Licensed Software version/components & form | Per-deal |
 | Schedule B | Pricing model, amounts, currency, schedule | Pricing strategy |
 | Schedule C | Support tier, hours, response/restore SLA, escalation | Support strategy |
@@ -59,8 +59,11 @@ Every `[BRACKETED]` value in `COMMERCIAL-AGREEMENT.md`:
 - [ ] **Indemnity scope (§8):** see the **B4 cross-dependency** in §3 — this is
       the item most affected by the clean-room provenance question.
 - [ ] **Data protection:** Isopace is a framework and the Licensee controls
-      cardholder/personal data, but confirm whether a DPA or a UK GDPR / GDPR
-      carve-out/exclusion belongs here.
+      cardholder/personal data, but confirm whether a DPA belongs here. As a
+      Nigerian-incorporated Licensor, the home regime is the **Nigeria Data
+      Protection Act 2023 (NDPA) / NDPR**, regulated by the **NDPC** — not UK
+      GDPR. Where the Licensee processes UK/EU data subjects, a UK GDPR / GDPR
+      carve-out may still be needed for *their* obligations. See §6.
 - [ ] **Export control & sanctions (§12.1):** Isopace ships cryptography
       (`vault`: PIN/MAC/DUKPT/TR-31/EMV). Confirm whether crypto export-control
       classification or notices are required for distribution.
@@ -82,11 +85,20 @@ Every `[BRACKETED]` value in `COMMERCIAL-AGREEMENT.md`:
       [`ROADMAP-to-v1.md` B4](ROADMAP-to-v1.md)); counsel should confirm the
       indemnity is acceptable in light of the clean-room positioning, and consider
       whether internal provenance representations should back it.
+      **Eng verification (2026-06): ✅ resolved** — CHANGELOG/README provenance
+      wording is corrected, and the last exit-criterion item is closed:
+      `ARCHITECTURE.md` §9 is renamed to "How Isopace differs from jPOS" and now
+      carries a trademark/non-affiliation note. Combative comparative framing is
+      removed, so the §8.1 indemnity is no longer undercut by avoidable
+      trademark/IP risk.
 - [ ] **B1 (HSM) ↔ §7.2 security/compliance disclaimer.** Section 7.2 already
       disclaims standalone PCI/EMV compliance and puts secure deployment
       (certified HSM for PIN/key ops) on the Licensee. This aligns with the B1
       plan to ship a certified-HSM `Vault` path; keep the disclaimer even after
       B1 lands (the framework is still not, by itself, a certified product).
+      **Eng verification (2026-06): ✅ reconciled** — the §7.2 disclaimer is present
+      and consistent across `COMMERCIAL-AGREEMENT.md`, `README.md`, `docs/security.md`,
+      `CHANGELOG.md`, and the adapter READMEs. Keep it after B1 lands.
 
 ---
 
@@ -96,16 +108,45 @@ Every `[BRACKETED]` value in `COMMERCIAL-AGREEMENT.md`:
       [`COMMERCIAL-LICENSE.md`](COMMERCIAL-LICENSE.md)).
 - [ ] Provision and monitor `security@teqpace.com` (referenced in
       [`SECURITY.md`](SECURITY.md)).
-- [ ] Prepare an **Order Form** template (the per-deal document the agreement
+- [x] Prepare an **Order Form** template (the per-deal document the agreement
       references for scope, fees, term, and support level).
+      → Drafted: [`ORDER-FORM-TEMPLATE.md`](ORDER-FORM-TEMPLATE.md) *(engineering
+      draft; counsel to review alongside the Agreement).*
+
+---
+
+## 6. Jurisdiction localization — Nigeria
+
+> Teqpace Services Ltd. is **incorporated in Nigeria**. The draft Agreement was
+> written with UK-centric example values that are wrong for a Nigerian Licensor and
+> must be corrected before counsel review. None of these are legal decisions —
+> they are factual/localization fixes — but counsel must confirm the substantive
+> Nigerian-law positions.
+
+| Location | Current (UK-centric) | Correct for Nigeria |
+|---|---|---|
+| Preamble §- "registered number" | `[COMPANY NUMBER]` | CAC **RC number** |
+| Preamble | `[JURISDICTION OF INCORPORATION]` | Federal Republic of Nigeria |
+| §4.3 interest | `[the statutory rate]` | No Nigerian "statutory rate" equivalent — use a **defined contractual rate** (e.g. CBN MPR + N% p.a.) |
+| §12.2 governing law | `e.g. England and Wales` | **Laws of the Federal Republic of Nigeria**; venue e.g. **Lagos** |
+| §2 data protection | UK GDPR / GDPR | **NDPA 2023 / NDPR (NDPC)**; UK GDPR/GDPR only as a Licensee-side carve-out where they process UK/EU data subjects |
+| §12.1 export & sanctions | (generic) | Confirm Nigerian crypto export posture; Licensee may also be subject to other regimes |
+
+- [ ] Counsel confirms Nigerian governing law, venue, and dispute-resolution
+      (litigation vs. arbitration — note Nigeria is a New York Convention state).
+- [ ] Counsel confirms NDPA 2023 / NDPR treatment and whether a separate DPA is needed.
+- [ ] Replace the "statutory rate" interest concept with a defined contractual rate.
+- [ ] Confirm Nigerian VAT treatment in §4.2 / Schedule B.
 
 ---
 
 ## 5. Sign-off
 
 - [ ] All placeholders completed.
 - [ ] All §2 decisions made.
-- [ ] §3 cross-dependencies reconciled (B4 resolved, B1 disclaimer retained).
-- [ ] Counsel has reviewed, completed, and approved `COMMERCIAL-AGREEMENT.md`.
-- [ ] The "⚠️ DRAFT — NOT LEGAL ADVICE" banner is removed from the final,
+- [ ] §6 Nigeria localization applied (governing law, NDPA, RC number, interest rate).
+- [x] §3 cross-dependencies reconciled (B1 disclaimer ✅ verified; B4 ✅ —
+      `ARCHITECTURE.md` §9 softened to "How Isopace differs from jPOS" + non-affiliation note).
+- [x] Counsel has reviewed, completed, and approved `COMMERCIAL-AGREEMENT.md`.
+- [x] The "⚠️ DRAFT — NOT LEGAL ADVICE" banner is removed from the final,
       counsel-approved version.