Versions, migrations, and changelog

OpenAPI operations, Webhook payloads, controlled extension schemas, and app manifests are independently versioned. An installed app remains bound to its approved immutable app version until a merchant authorizes an upgrade. New optional fields are additive; removed fields, changed meanings, new required scopes, and changed signatures require a versioned migration.

Current documentation release: 0.1.0. It introduces the public Docus site, OpenAPI drift gate, third-party Nuxt Storefront, PKCE guidance, installation Webhooks, inventory loop prevention, and automatic-fulfillment reconciliation. This is documentation and static-example evidence—not production Provider certification.

Before upgrading, compare the published OpenAPI snapshot hash and changelog, test in sandbox, rotate secrets without dropping the overlap window, and preserve idempotency state. Sandbox credentials and data never authorize production.