diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e48b85..714c39e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,23 +10,15 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
 ### Added
 
-- Initial selective pinned engineering Standards Adoption.
-- Composer and package identity foundation for `maatify/php-return-target`.
-- Runtime foundation: `ReturnTargetConfig`, `ReturnTargetExceptionInterface`, and `InvalidReturnTargetConfigurationException`.
-- PHPStan maximum-level configuration covering the real `src/` and `tests/` paths.
-- Canonical internal `rt1` HMAC token codec, internal `VerifiedTokenPayloadDTO`, and `ReturnTargetCryptoConfigurationException`.
-- Runtime requirements for `ext-hash`, `ext-json`, and `maatify/crypto` `^1.0`.
-- Public `ReturnTargetServiceInterface` and canonical `HmacReturnTargetService`.
-- Canonical target validation, optional restrict-only policy, `VerifiedReturnTargetDTO`, and shared `ClockInterface` expiry integration.
-- Direct Runtime dependency on `maatify/shared-common` `^1.0`.
-- Reproducible external Consumer Verification Harness with two clean-state runs.
-- GitHub Actions CI for PHP 8.4 and 8.5, latest/lowest dependencies, Composer 2.10 policy audit, syntax, whitespace, PHPStan max, formatting, tests, examples, and workflow lint.
-- Stable `Final Gate` aggregate CI job and immutable action pins.
-- Consumer Usage Guide, runnable Public API example, `llms.txt`, and synchronized Package Reference/README workflow documentation.
-- Security policy with private reporting through `support@maatify.dev`.
-- CONTRIBUTING guide covering contribution paths, verification gates, testing boundaries, and reusable-library lock policy.
-- Code of Conduct and linked governance/presentation documentation surfaces.
-- Composer `support.security` metadata synchronized with the repository security policy URL.
+- Framework-agnostic stateless handling of internal return targets through the public `ReturnTargetServiceInterface` and canonical `HmacReturnTargetService`.
+- Opaque, expiring `rt1` HMAC tokens with exact original-target preservation, current-policy revalidation during verification, and `VerifiedReturnTargetDTO` results.
+- Canonical internal-target validation with an optional restrict-only Host policy, plus Host integration through `KeyProviderInterface` and `ClockInterface`.
+- Typed configuration and classified crypto-configuration failure semantics, with normal target, token, policy, and expiry rejection kept separate from unexpected provider or Host-policy failures.
+- Consumer Usage Guide, maintained runnable Public API example, external Consumer Verification Harness, and current Package Reference/README navigation.
+
+### Security
+
+- The canonical token is signed rather than encrypted and must not carry secrets or confidential data; HTTP, routing, authentication, authorization, persistence, key storage, and redirect execution remain Host-owned.
 
 [Unreleased]: https://github.com/Maatify/php-return-target/compare/v1.0.0-rc.1...HEAD
 [1.0.0-rc.1]: https://github.com/Maatify/php-return-target/releases/tag/v1.0.0-rc.1