> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qwedai.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# QWED Protocol releases: SDK versions and installs

> QWED Protocol release history with download links, installation instructions, version notes, and upgrade guidance across Python, TypeScript, Go, and Rust SDKs.

## Current release

> [card] [v9.1.0 — Allowlist admission for Python code](https://github.com/QWED-AI/qwed-verification/releases/tag/v9.1.0)
>
> Minor release with one security fix (GHSA-9r7q-mx75-hcj7). `CodeVerifier` admits Python code only when the modules, builtins and special attributes it uses are listed, so code that 9.0.0 admitted may now be refused. The server reads `.env` before any of its settings. Read the [upgrade steps](https://docs.qwedai.tech/changelog.md#v9-1-0-—-allowlist-admission-for-python-code) before you upgrade.

### Install

```bash pip theme={null}
pip install qwed==9.1.0
```

```bash docker theme={null}
docker pull qwedai/qwed-verification:9.1.0
```

```bash npm theme={null}
npm install @qwed-ai/sdk@9.1.0
```

```bash cargo theme={null}
cargo add qwed@9.1.0
```

```bash go theme={null}
go get github.com/QWED-AI/qwed-verification/sdk-go/v9@v9.1.0
```

***

## Release history

> [accordion] v9.0.0 — Eleven advisories and models you configure (November 6, 2026)
>
> **Major release.** Fixes eleven advisories in code, maths, SQL and logic verification, the GitHub Action and sign-up. Each LLM provider runs the model you configure, the CSV exports change their columns, `/verify/math` runs in worker processes with a time limit, and the Go module path moves to `/v9`.
>
> [Full Release Notes →](https://docs.qwedai.tech/changelog.md#v9-0-0-—-eleven-advisories-and-models-you-configure) · [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v9.0.0)

> [accordion] v8.0.0 — Attested verdicts and upgrade guide (October 26, 2026)
>
> **Major release.** Every `VERIFIED` answer carries an ES256 attestation you can check against `/.well-known/jwks.json`, and Verification Context v1.1 documents are signed by the server that issued them. The Docker image runs the API server, and the Go module path moves to `/v8`.
>
> [Full Release Notes →](https://docs.qwedai.tech/changelog.md#v8-0-0-—-attested-verdicts-and-upgrade-guide) · [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v8.0.0)

> [accordion] v7.3.0 — Five advisories, tenant scoping and DoS hardening
>
> Fail-closed security and soundness release covering five advisories (whole-tree SQL command classification, code-verifier process/file-network sinks, sandbox namespace isolation, SQL schema and tautology checks, logic DSL string constants), plus tenant-scoped admin endpoints, denial-of-service caps and credential-handling fixes. No breaking wire changes.
>
> [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v7.3.0)

> [accordion] v7.2.3 — Code, secret, and SQL verification security release (October 13, 2026)
>
> **Fail-closed security release.** Fixes GHSA-6rxr-gq43-694g, GHSA-64xf-wffc-63fm, and GHSA-q5g6-6cw2-cjm3. A soundness eval report is attached to each release from v7.2.3 on.
>
> > [!WARNING]
> >
> > **Behaviour changes.** The code verifier never admits shell or process execution, including through aliased imports. The secret scanner detects `sk-proj-`, `sk-svcacct-`, and `sk-admin-` keys. The SQL verifier analyses MySQL/MariaDB executable comments as SQL and, with `schema_ddl`, blocks undeclared tables with `sql_verifier.schema_violation`. No response fields are removed or renamed.
>
> [Full Release Notes →](https://docs.qwedai.tech/changelog.md#v7-2-3-—-code-secret-and-sql-verification-security-release) · [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v7.2.3)

> [accordion] v7.2.2 — Verification soundness and safety hardening (October 9, 2026)
>
> **Fail-closed security release (GHSA-4v5r-g7f4-vvgc, GHSA-mfh5-3c8f-975p, GHSA-j622-qffp-rc27, GHSA-mxwv-x5qm-mrmf).** The local SDK SymPy validator rejects nested string literals. The Z3 evaluator rejects Python `and`/`or`/`not` and chained comparisons on symbolic objects, and the DSL compiler rejects string literals. `verify_math` compares at a precision scaled to the operands, beyond 15 significant digits. Compute-cost bounds now cover implicit multiplication and integer powers. No breaking wire changes.
>
> [Full Release Notes →](https://docs.qwedai.tech/changelog.md#v7-2-2-—-verification-soundness-and-safety-hardening) · [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v7.2.2)

> [accordion] v7.2.0 — Precision advisory and security hardening batch (September 7, 2026)
>
> **Fail-closed hardening batch + one additive capability.** Expression/auth/sandbox/event-loop security fixes restoring intended behavior, plus a new advisory flag for binary floating-point constants.
>
> > [!WARNING]
> >
> > **API-key migration required.** API keys issued before v7.2 stop working — re-issue them after upgrading. Self-hosted deployments must also set a distinct `QWED_API_KEY_LOOKUP_SECRET` (the server fails closed at startup without it). See [Authentication](https://docs.qwedai.tech/api/authentication.md#api-key-storage-and-migration-v7-2).
>
> [Full Release Notes →](https://docs.qwedai.tech/changelog.md#v7-2-0-—-precision-advisory-and-security-hardening-batch) · [GitHub Release](https://github.com/QWED-AI/qwed-verification/releases/tag/v7.2.0)

> [accordion] v7.1.0 — Verification Context v1.0 Rollout (August 16, 2026)
>
> **Verification Context (VC) v1.0 shipped end-to-end (PRs #302–#316).** A formal specification with a machine-readable JSON Schema, a typed document model with fail-closed invariants, public [`proof_ref`](https://docs.qwedai.tech/api/endpoints#verification-context-endpoints) generation and resolution, `to_verification_context()` across the verifier classes (Math and the secure code executor convert through `POST /verification-context/from-diagnostic`), dedicated API endpoints, the `qwed context` CLI group, SDK re-exports on the Python client, and Docker-action VC outputs. Additive semver minor — no breaking wire changes.
>
> > [!NOTE]
> >
> > **Fail-closed conversion:** a `VERIFIED` diagnostic without a valid attestation fails closed to `BLOCKED` in the VC document; malformed diagnostics convert to `BLOCKED` instead of crashing.
>
> [Full Release Notes →](https://docs.qwedai.tech/changelog.md#v7-1-0-—-verification-context-v1-0-rollout) · [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v7.1.0)

> [accordion] v7.0.0 — Full DiagnosticResult Engine Conformance (August 8, 2026)
>
> **Engine migration to `DiagnosticResult` complete (META #216).** [`SchemaVerifier`](https://docs.qwedai.tech/engines/schema), [`SQLVerifier`](https://docs.qwedai.tech/engines/sql), [`CodeVerifier` and `SecureCodeExecutor`](https://docs.qwedai.tech/engines/code#security-scanning-codeverifier), and [`StatsVerifier`](https://docs.qwedai.tech/engines/stats) — plus fact/image batch verification — now return the unified `DiagnosticResult` contract. Truth and admission are separated: proven-unsafe code and proven-malicious SQL are `VERIFIED` (the proof succeeded) with an explicit `admission: BLOCKED`, and successful stats execution is `UNVERIFIABLE` because execution is not verification. SDK 6.0.0 → 7.0.0 across Python, TypeScript, and Rust.
>
> > [!WARNING]
> >
> > **Breaking wire changes:**`POST /verify/code` returns `VERIFIED` for proven-unsafe code (gate on `admission` / `developer_fields.is_valid`, not `status`), and `POST /verify/stats` returns the `DiagnosticResult` shape with `UNVERIFIABLE` on execution success instead of the legacy `SUCCESS` shape.
>
> [Full Release Notes →](https://docs.qwedai.tech/changelog.md#v7-0-0-—-full-diagnosticresult-engine-conformance) · [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v7.0.0)

> [accordion] v6.0.0 — Trust Boundary Completion (August 2, 2026)
>
> **Trust Boundary Completion epic closed (Issue #263, 12/12 sub-issues, 21 PRs).** All `/verify/*` endpoints return unified [`DiagnosticResult`](https://docs.qwedai.tech/advanced/diagnostics). Control plane requires and verifies attestation at the admission boundary before admitting `VERIFIED`. VERIFIED is a protocol guarantee backed by deterministic `proof_ref` — heuristic and advisory analysis now reports `UNVERIFIABLE` with structured `advisory_checks`. Covers [consensus](https://docs.qwedai.tech/engines/consensus.md), [batch math](https://docs.qwedai.tech/api/endpoints.md#post-%2Fverify%2Fbatch), [control-plane attestation](https://docs.qwedai.tech/advanced/attestations.md), and [agent state](https://docs.qwedai.tech/advanced/agent-state-guard.md). SDK 5.3.0 → 6.0.0 across Python, TypeScript, Rust, Docker, and Kubernetes.
>
> > [!WARNING]
> >
> > **Breaking change:**`/verify/*` responses now use the unified `DiagnosticResult` schema. Migrate consumers of the previous ad-hoc dict responses.
>
> [Full Release Notes →](https://docs.qwedai.tech/changelog.md#v6-0-0-—-trust-boundary-completion) · [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v6.0.0)

> [accordion] v5.2.0 — Structured Verification Diagnostics (June 19, 2026)
>
> Unified 3-layer `DiagnosticResult` model with `agent_message` (agent-safe), `developer_fields` (structured evidence), and `proof_ref` (sha256 proof hash — the authority bit). Tri-state status only (VERIFIED / UNVERIFIABLE / BLOCKED). Frozen dataclasses prevent post-construction bypass. Advisory checks structurally separated from verdicts. Migration helper for legacy engine dicts. 83 tests. Additive — no breaking changes.
>
> [Full Release Notes →](https://docs.qwedai.tech/changelog.md) · [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v5.2.0)

> [accordion] v5.1.2 — SymPy Expression Injection Fix (June 14, 2026)
>
> Emergency security patch fixing High severity (CVSS 8.8) authenticated RCE via unsafe SymPy `parse_expr()`. Added `safe_parse_expr()` wrapper with denylist, stripped `__builtins__`, allow-listed math namespace. Cache Redis fail-closed. CodSpeed benchmarks.
>
> [Full Release Notes →](https://docs.qwedai.tech/changelog.md) · [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v5.1.2)

> [accordion] v5.1.1 — Trust Boundary Hardening (May 22, 2026)
>
> Cache keys bound to full trust context (provider/model/policy/session) — prevents cross-context replay. Attestation path hardened with `AttestationStatus` enum and `is_issued` contract. Audit chain isolated per-org with `BEGIN IMMEDIATE` transactions. Reasoning proof prerequisites enforced. Symbolic/batch verifiers return `BLOCKED` on missing proof. Unknown agent actions denied. `additionalProperties: false` strictly enforced. SDK `5.1.1` across Python, TypeScript, Rust.
>
> [Full Release Notes →](https://docs.qwedai.tech/changelog.md) · [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v5.1.1)

> [accordion] v5.1.0 — Agent State Governance and Fail-Closed Hardening (April 19, 2026)
>
> AgentStateGuard for deterministic state verification · Legacy `CodeExecutor` hard-blocked · Default-deny for unknown tools · Bounded math tolerance · `verify_logic_rule` / `verify_identity` fail-closed · Ambiguous math expressions blocked · Schema `uniqueItems` fail-closed · SDK `5.1.0` across Python, TypeScript, Go.
>
> [Full Release Notes →](https://docs.qwedai.tech/changelog.md) · [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v5.1.0)

> [accordion] v5.0.0 — Enforcement Boundary Hardening (April 4, 2026)
>
> **98 commits** · Fail-closed verification boundary · `INCONCLUSIVE` status for LLM-translated math · `trust_boundary` metadata in responses · Mandatory `ActionContext` for agents · Replay/loop detection · Redis fail-closed rate limiting · Docker required for stats/consensus · `security_checks` field removed · Admin-only `/metrics` · SDK `5.0.0` across Python, TypeScript, Go.
>
> [Full Release Notes →](https://docs.qwedai.tech/changelog.md) · [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v5.0.0)

> [accordion] v4.0.1 — Sentinel Guard Sync (March 23, 2026)
>
> TypeScript SDK alignment · `POST /verify/process` endpoint · Agent security checks (`exfiltration`, `mcp_poison`) · Security fixes (info disclosure, symbolic precision) · `@qwed-ai/sdk@4.0.1`.
>
> [Full Release Notes →](https://docs.qwedai.tech/changelog.md) · [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v4.0.1)

> [accordion] v4.0.0 — Sentinel Edition (March 12, 2026)
>
> **147 commits** · Agentic Security Guards (RAGGuard, ExfiltrationGuard, MCP Poison Guard) · SovereigntyGuard · ToxicFlowGuard · S-CoT Guard · Process Determinism (ProcessVerifier) · Critical security fixes (eval removal, sandbox escape, CVE patches) · Docker hardening · Sentry + CircleCI + SonarCloud + Snyk integration.
>
> [Full Release Notes →](https://docs.qwedai.tech/changelog.md) · [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v4.0.0)

> [accordion] v3.0.1 — Ironclad Update (February 4, 2026)
>
> Security patch — CodeQL remediation (50+ alerts), workflow permissions lockdown, PII protection, Snyk partner attribution.
>
> [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v3.0.1)

> [accordion] v2.4.1 — The Reasoning Engine (January 20, 2026)
>
> Optimization Engine, Vacuity Checker, Dockerized GitHub Action, improved logic verifier.
>
> [GitHub Release ↗](https://github.com/QWED-AI/qwed-verification/releases/tag/v2.4.1)

***

## Links

> [card] [PyPI](https://pypi.org/project/qwed/)
>
> Python package

> [card] [Docker Hub](https://hub.docker.com/r/qwedai/qwed-verification)
>
> Container image

> [card] [npm](https://www.npmjs.com/package/@qwed-ai/sdk)
>
> TypeScript SDK

> [card] [crates.io](https://crates.io/crates/qwed)
>
> Rust SDK

> [card] [GitHub](https://github.com/QWED-AI/qwed-verification/releases)
>
> All releases

> [card] [Go Module](https://github.com/QWED-AI/qwed-verification/tree/main/sdk-go)
>
> Go SDK


## Related topics

- [Go SDK](https://docs.qwedai.tech/sdks/go.md)
- [Changelog](https://docs.qwedai.tech/changelog.md)
- [QWED MCP: verification for Model Context Protocol](https://docs.qwedai.tech/mcp/overview.md)
- [QWED MCP troubleshooting](https://docs.qwedai.tech/mcp/troubleshooting.md)
- [QWED UCP troubleshooting](https://docs.qwedai.tech/ucp/troubleshooting.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.