Open Exchange v0.4.0-beta: the money release
Open Exchange v0.4.0-beta is tagged across all five repositories. Five, not four: the Assets Engine, the deterministic money ledger we have been building alongside the stack, joins as a first-class repo with this release.
v0.3 was about proving the engine survives failure. v0.4 is about the money itself: where it lives, how every movement is recorded, and how you answer "why is this balance what it is" with a replay instead of a shrug.
Money gets its own cluster
The Assets Engine is a deterministic ledger running as its own Aeron Raft cluster. Every hold, settle, and release is a state-machine transition, replicated across three nodes before it takes effect, driven by the same replicated-log discipline as the matching engine. The OMS now does its money accounting against it through a small seam, and the old in-process double-entry path is deleted, not deprecated. Money has one authority now.
Around that authority: a reconciler that sweeps for holds it can prove were never submitted, a settle that can never drive a locked balance negative, and a fix for an out-of-order fill storm that used to swallow roughly 16% of trades under stress testing. We found that last one with the same storm tests that earned v0.3 its beta label. They keep paying rent.
Every money movement, replayable
Two journals landed. The settlement journal is a lossless per-node record of every trade and terminal event, carrying the OMS order ids: the key you actually need when you reconcile engine history against OMS state. The money journal records every applied money movement per node in a replayable archive, with a projector that follows it into Postgres for querying. Neither is a log file you grep and hope; both are replayable records with watermark-gated retention.
Egress you can sort
Every trade and order-status message now carries its position in the replicated log (egressSeq). Two subscribers replaying the same market can no longer disagree about what happened in which order, across leader elections included. The wire protocol moved from SBE v5 to v7 along the way: engine reject reasons now ride the status egress, and trades carry the taker side.
Market data went to the edge
The cluster publishes market data once; Cloudflare fans it out to every viewer from the edge, and candles now land in TimescaleDB so history survives restarts. This shipped gradually since the demo went live, and v0.4.0-beta is the first tag that contains all of it.
Release-day photobombs
Between the changelog freeze and the tag, three HIGH severity advisories landed in our dependency tree: netty (CVE-2026-44891), jackson-core, and gRPC-Go. All three fixes are in the tag, not in a follow-up release.
What beta still doesn't mean
No external security audit has happened yet. That remains the biggest single item between here and anything that holds real funds, and we'd rather keep saying it plainly than let a version number imply otherwise. Open Exchange remains infrastructure: KYC, custody, fiat rails, and licenses are still yours. That line stays in every post until it stops being true.
Try it
The quick start goes from a fresh clone to a running exchange on one Linux box in a few minutes; it's five clones now instead of four. The release notes have the full changelog, per repo. If you build something on it, or try to break it, we want to hear either way.