v0.1.0 — initial release Spec-first IBKR HTTP API wrapper. OpenAPI 3.1.0 source-of-truth at api/v1.yaml drives FastAPI server stubs + Go + Python clients via `make generate`. 42 operations across stocks / options / futures / cfd / forex / crypto / orders / history / system, all under /v1/. Stack: Python 3.12 + FastAPI + ib_async + Linux-native IB Gateway (gnzsnz image with IBC auto-login). Loopback-only by default; bearer auth via Authorization header, constant-time compare. 93 tests pass (mocked ib_async). Bandit + ruff clean. SHA-pinned base images, hash-locked requirements with 7-day age-gate. Supply chain audited at release: `make audit` (pip-audit) + `make audit-go` (govulncheck) + `make audit-compose` (banned settings + pin discipline) all clean. Compose hardened with isolated networks, cap_drop:[ALL], no-new-privileges, read_only + tmpfs, per-service resource caps + healthchecks. Generated clients import paths: Go: github.com/psyb0t/ibkr-httpapi/pkg/clients/go Python: pip install "git+https://github.com/psyb0t/ibkr-httpapi.git#subdirectory=pkg/clients/python/ibkr-httpapi-client"