messagefoundry 0.2.14__tar.gz → 0.3.0__tar.gz

{messagefoundry-0.2.14 → messagefoundry-0.3.0}/CHANGELOG.md

@@ -6,6 +6,196 @@ All notable changes to MessageFoundry are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.3.0] — 2026-07-13 — Early Access
+
+Highlights since 0.2.15 — streaming attachments end-to-end, a copy-on-Send message model, richer
+connectivity, and a run of security hardening. (Concise highlights; the git history is the full change set.)
+
+### Added
+- **Streaming large attachments end-to-end** (#149, ADR 0105) — very-large OBX-5 documents are detached from
+  the message skeleton at ingress and streamed through routing → transform → delivery on all three stores
+  (SQLite / SQL Server / Postgres), with an operator read/download surface.
+- **Copy-on-Send message model** (ADR 0104) — `Send` snapshots the message at construction (opt-in
+  `[pipeline].snapshot_on_send`), plus `Message.copy()` and a recognition-first `message_type_of(accepts=)`
+  predicate; and in the IDE, a point-and-click HL7 field picker and the Steps-view authoring palette
+  (ADR 0103 / 0106).
+- **Connectivity** — generic HTTP auth (OAuth 2.0 client-credentials + Digest) and HTTP response-header
+  capture (#154, #65); a connector `SecretProvider` seam with a HashiCorp Vault backend (#196).
+- **Monitoring** — an engine-wide KPI roll-up with a saturation-derivative alert and DB-pool metrics (#93).
+
+### Changed
+- **pipeline: `batch_handoff_statements` now defaults ON on SQL Server** ([ADR 0075](docs/adr/0075-per-hop-sql-statement-batching.md))
+  — per-hop SQL statement batching (a **distance-insurance** lever: folds each message's per-hop store round-trips
+  into the fewest `pyodbc.execute()` T-SQL batches, cutting **network round-trips, NOT transactions** — the
+  single per-hop `COMMIT` is untouched, `commits/msg` stays 2.000) now activates **by default** on the SQL Server
+  store. Promoted 2026-07-08 after Bench B showed **harmless-near** (batch ON vs OFF within ±0.4% at ~0.28 ms RTT,
+  zero-loss) and **helps-far** (constant ~−18% ACK-p99, absolute saving widening with RTT: −84 ms @ +20 ms,
+  −212 ms @ +50 ms) over a green SS correctness precondition (`tests/test_adr0075_batch_sqlserver.py`, 9 passed).
+  **Fail-closed + SQL-Server-only** — Postgres (asyncpg) and SQLite are byte-identical no-ops; the flag is retained
+  **only as an emergency off-switch**: set `[pipeline].batch_handoff_statements = false` to disable.
+
+### Security
+- **The published PyPI source distribution no longer ships the whole repo** (#1020) — the sdist is pinned to
+  the `messagefoundry` package + its metadata, with a fail-closed "sdist is package-only" gate in the release
+  workflow. No release ever exposed PHI or customer data.
+- **Transport hardening** — certificate-revocation refusal extended to outbound-connector TLS (#201); in-use
+  memory protection for the store (#198); the publish deny-list is read from the ref being published (#983).
+
+### Fixed
+- **CI reliability** — bound PHI-retention on the Windows service smoke (#1011); wrap pyodbc-heavy SQL Server
+  steps with a native-crash retry (#1010); multi-message finalizers take their per-message locks in canonical
+  order (#980).
+
+## [0.2.15] — 2026-07-06 — Early Access
+
+**Thread-hop fusion (ADR 0071 B5, flagged default-OFF) + the browser ops dashboard, pooled-claimer
+primitives, and opt-in persistent outbound MLLP.** The headline engine change is **B5 thread-hop fusion** —
+a SQL-Server-only path that fuses each off-loop CPU stage with its store handoff onto one synchronous-pyodbc
+worker hop to cut the per-completion executor→loop marshaling wall; it ships **behind
+`[pipeline].fuse_thread_hops` (default off)** pending the SQL-Server throughput bench. Everything else below
+is additive / opt-in.
+
+### Added
+- **pipeline: thread-hop fusion — B5, opt-in** ([ADR 0071](docs/adr/0071-cut-executor-round-trips-b5.md);
+  `[pipeline].fuse_thread_hops` default **off**, SQL Server + `pooled` claim mode only) — fuses each off-loop
+  CPU stage (`route_only` / `transform_one`) with its adjacent store handoff onto **one** synchronous-pyodbc
+  worker hop, so a multi-statement aioodbc handoff marshals back to the loop **once** instead of per
+  statement (attacks the per-completion marshaling ceiling the 2026-07-04 profile named). Fuses **thread
+  hops, not transactions** — commits/msg are identical (the poison-guard is intact); Postgres (asyncpg
+  loop-native) and SQLite (loop-affine handoff lock) keep the async path by construction. Activation is
+  fail-closed: fusion only turns on when the dedicated sync pyodbc pool + per-stage fusing executors open
+  cleanly, otherwise the async path runs unchanged. Ships with the self-contained SQLite/Proactor
+  crossing-count micro-bench + a Windows CI mechanism gate, and a connscale B0/B1 fusion A/B harness axis
+  (`fuse_ab` profile, `trials`-banked); the throughput GO/NO-GO (ship-by-default vs escalate to
+  free-threading, ADR 0053) is a separate SQL-Server bench, not a merge gate.
+  - **Promote-gate resolved 2026-07-06 — NO-GO** ([ADR 0071](docs/adr/0071-cut-executor-round-trips-b5.md)
+    §8/§10, #787): the SQL-Server `fuse_ab` bench measured a real but sub-threshold **+6.5 / +9.3 / +10.0 %**
+    lift (below the ≥10% bar; zero-loss held), so `fuse_thread_hops` **stays default-OFF** and the lever
+    escalates to free-threading (ADR 0053). Bench-SHA provenance: the run was at commit `8bab40e2`, which is
+    **not** an ancestor of `main` (PR5 was squash-merged as `90f80a3`, #780) — but `git diff 8bab40e2 90f80a3`
+    is **empty**, so the NO-GO bench ran a code tree byte-identical to merged PR5.
+- **store: pooled-claimer primitives** `claim_fifo_heads` / `list_fifo_lanes` / `release_claimed` on all
+  three backends ([ADR 0066](docs/adr/0066-pooled-stage-claimers.md) PR 2 — **now wired by the
+  `StageDispatcher` and the default claim path since #755/#744, see _Changed_ below**): a FIFO-safe
+  multi-lane head-claim (probe-then-claim, EMPTY-on-locked-head — never a #285 skip
+  to seq N+1), a read-only head-due-aware lane discovery for the pooled sweep, and an attempts-neutral
+  claim release. `claim_next_fifo` / `claim_next_fifo_batch` / `claim_ready` are untouched.
+- **pipeline: bounded pooled-mode infra-fault handling (T17)** (ADR 0070; #766) — in `pooled` mode a lane
+  whose head keeps failing on an infrastructure fault now **re-pends its head at an exponential-capped
+  backoff** (cap `[pipeline].infra_fault_backoff_cap`, default **60 s**) instead of spinning the ~4×/s
+  discovery sweep, and after `[pipeline].infra_fault_stop_after` (default **10**) consecutive zero-progress
+  faults (~4 min of wall clock) applies `[pipeline].infra_fault_policy` (default **`stop`**): STOP-the-lane
+  with a throttled `lane_stuck` alert — **never** auto-dead-letter. `retry_forever` instead keeps re-pending
+  at the cap and alerts once the horizon is crossed. `per_lane` mode is unaffected.
+- **Browser ops dashboard (read-only, M1)** (#75, [ADR 0065](docs/adr/0065-web-ops-dashboard.md)) — an
+  **opt-in** (`[api].serve_ui`, default **off**), same-origin, zero-install browser ops view served under
+  `/ui` by the engine's FastAPI app. Read-only: a live-polling connections dashboard (In/Out/Queued/
+  Errors/Last-Activity), a message log with filters, the **audited** raw-message view (reuses the exact
+  `GET /messages/{id}` PHI path — RBAC + per-access audit + redaction), and a dead-letter list. Auth is a
+  new **HttpOnly + SameSite=Strict** session cookie **confined to `/ui`** — the JSON API stays
+  Authorization-header-only, so a request bearing only the cookie is still rejected. Ships a strict CSP
+  (`script-src 'self'`, no `unsafe-*`), `Cache-Control: no-store` on `/ui` + PHI reads, and autoescape-by-
+  default rendering (a stdlib HTML builder — **no new runtime dependency, no npm**). A JSON-only
+  deployment is byte-identical (`serve_ui` off); off-loopback requires TLS (refused even under
+  `--allow-insecure-bind`).
+- **Browser ops dashboard — connection controls (M2a)** (#75, ADR 0065) — the dashboard adds **safe
+  operator actions**: inbound connection **start / stop / restart**, reusing the JSON control handlers
+  (`connections:control` + per-channel guard). CSRF is defended in depth by an **Origin / Sec-Fetch-Site**
+  same-origin check on top of the SameSite=Strict session cookie — **token-free (no crypto import)**.
+- **Browser ops dashboard — message replay + step-up re-auth (M2b)** (#75, ADR 0065) — single-message
+  **replay** from the browser (a Replay button on the message detail). Replay is `require_step_up` in the
+  JSON API, so the /ui route uses a cookie-world step-up gate (`require_ui_step_up`): if the session hasn't
+  recently stepped up it **redirects to a /ui re-auth page** (password, + TOTP when MFA is required)
+  instead of a 403 header a browser can't act on; after re-auth the browser **auto-retries** the pending
+  replay. The re-auth `next` target is validated to be a /ui replay action only (anti open-redirect).
+- **Browser ops dashboard — dead-letter bulk replay (M3)** (#75, ADR 0065) — a per-channel **Replay all
+  dead** action on the dead-letters page, re-queuing every dead delivery for a channel via the JSON
+  `replay_dead_letters` handler. Same step-up gate as message replay (`require_ui_step_up` → /ui re-auth +
+  auto-retry; the channel is in the action **path** so the body-less re-POST carries it), and it honors the
+  **dual-control approval gate** — when a replay is held for a second approver it surfaces a "held for
+  approval" page instead of redirecting.
+- **Browser ops dashboard — live `/ws/stats` channel (M-ws)** (#75, ADR 0065) — the dashboard now shows a
+  live queue-status strip pushed over the engine's `/ws/stats` WebSocket (previously only the desktop
+  path existed and it was unused). A browser can't set the WS `Authorization` header, so a **same-origin
+  browser handshake authenticates via the `mf_session` cookie** it carries; **CSWSH is defended** by a
+  same-origin `Origin`-vs-`Host` check plus the `SameSite=Strict` cookie (a cross-site handshake carries no
+  cookie). The native (header) path is unchanged — a client without an `Origin` falls through to it. The
+  the WS strip degrades to empty if the socket can't connect. The **connections table itself now updates
+  live over the socket** too: the server pushes the rendered (already-escaped) connections fragment, the
+  client swaps it in and stops polling, and polling resumes as a fallback if the socket drops.
+- **Browser ops dashboard — HL7 parse-tree view** (#75, ADR 0065) — the message-detail page links to a
+  `GET /ui/messages/{id}/parse-tree` view that renders the HL7 segment/field tree server-side via the pure
+  `parsing` lib. It reuses the **single audited** `GET /messages/{id}` PHI path (no new PHI egress), every
+  field value is escaped (attacker-influenced HL7 can't inject markup), and a non-HL7 body (X12/DICOM/
+  binary) surfaces a "no parse tree" notice rather than an error.
+- **Browser ops dashboard — per-destination dead-letter replay** (#75, ADR 0065) — the dead-letters page
+  now offers **Replay per (channel, destination)** buttons alongside the per-channel "Replay all dead"
+  (`POST /ui/dead-letters/{channel_id}/{destination_name}/replay`), same step-up + approval-gate + path-
+  based auto-retry as the channel-wide action. `is_safe_ui_action` was widened to the two-segment path and
+  hardened to reject any `..` traversal marker.
+- **Browser ops dashboard — off-loopback exposure via `[api].public_origin`** (#75, ADR 0065) — a new
+  opt-in `[api].public_origin` (e.g. `https://ops.example.com`) makes the dashboard's same-origin **CSRF**
+  and **CSWSH** checks work when `/ui` is reached off-loopback through a reverse proxy that doesn't preserve
+  the `Host` header: the browser `Origin` is matched against the configured public origin instead of the
+  request `Host`. Default (unset) is unchanged — loopback / Host-preserving-proxy behavior. The safe
+  defaults stand: `[api].host` is `127.0.0.1`, and `serve_ui` off-loopback still requires TLS
+  (`exposure_protected`), refused even under `--allow-insecure-bind`. (Phishing-resistant MFA / managed-
+  admin-host controls for off-loopback admin remain a separate posture decision — WebAuthn #11 + the ASVS
+  8.4.2 residual.)
+- **mllp: persistent outbound connections — OPT-IN** ([ADR 0067](docs/adr/0067-persistent-outbound-mllp.md);
+  `persistent=false` default **this release**, per-outbound opt-in via `persistent=true`) — the MLLP
+  destination can reuse **one** lazily-established connection across deliveries (with
+  `idle_timeout_seconds` / `max_connection_age_seconds` freshness knobs and reconnect-before-first-byte),
+  eliminating the per-message TCP/TLS handshake and the `TIME_WAIT` ephemeral-port exhaustion measured on
+  the 2026-07-02 load campaign. It ships **opt-in**: the default stays connect-per-message (today's proven
+  posture — no behavior change for existing deployments), and `persistent=true` is a documented opt-in for
+  sustained high-rate lanes.
+  - **Shipped default: `persistent=false` (connect-per-message).** Existing outbounds are byte-for-byte
+    unchanged. Set `persistent = true` on an `MLLP()` destination to opt into connection reuse (recommended
+    on sustained high-rate lanes; see [docs/SERVICE.md](docs/SERVICE.md) "High-delivery-rate TCP tuning").
+    The default flips to `persistent=true` in a subsequent release once the ADR 0067 §8 trigger is met:
+    a real deployment runs `persistent=true` clean on a live feed **and** the mid-transaction stray-frame
+    correctness edge is closed (a test / the MSA-2↔MSH-10 correlation, BACKLOG #82) or field-confirmed benign.
+
+### Removed
+- **Frozen zero-Python Windows console installer retired** (#39, [ADR 0032 Phase B](docs/adr/0032-console-desktop-launch.md)
+  *Amendment (2026-07-01)*). The PyInstaller `--onedir` + Inno Setup channel added in 0.2.11 is removed:
+  `packaging/console-installer/`, the `release-console-installer` job in the release workflow, and its
+  AC-linked tests are deleted, along with the Qt-LGPL frozen-binary written-offer/bundled-license apparatus
+  and the pending Authenticode signing-cert requirement. **Rationale:** zero uptake (the CI leg failed on
+  every tag release since it merged; one out-of-band `.exe` with no downloads), the no-Python/no-IT demand
+  gate never fired (adopters are pip + IT-covered), and it only ever shipped unsigned. **The desktop console
+  is unaffected** — it stays installable via `pip install messagefoundry[console]` + the ADR 0032 Phase A
+  `gui-script` and shortcut scripts; only the *frozen, zero-Python* conveyance is gone. The zero-install
+  audience is now served by the browser ops dashboard ([BACKLOG #75](docs/BACKLOG.md)).
+
+### Changed
+- **Server-DB store opens now skip the schema DDL batch when it already ran** ([ADR 0064](docs/adr/0064-schema-init-fastpath.md)).
+  A single-row `schema_meta` marker records the content hash of the shipped DDL batch; a re-open of a
+  current database skips the whole guarded batch **and** the exclusive schema lock (previously every
+  open re-ran dozens of check-then-create statements under `sp_getapplock`/the schema advisory lock —
+  the measured N≥4 co-start convoy of the WS-B bench, and wasted round-trips on every single-engine
+  restart). Any edit to the DDL batch changes the hash and forces exactly one full idempotent run, so
+  upgraded databases still adopt on-open migrations (ADR 0060) unchanged. **Operational note:**
+  out-of-band schema surgery is no longer self-healed at the next restart — run
+  `DELETE FROM schema_meta` afterward to force one full run. SQLite is unaffected.
+- **Startup crash recovery (`reset_stale_inflight`) is now index-seekable** ([ADR 0064](docs/adr/0064-schema-init-fastpath.md)):
+  the all-stages pass runs one UPDATE per pipeline stage against the existing
+  `ix_queue_ready(stage, status, …)` index instead of one unindexed status-only full scan of the
+  queue (Postgres additionally drops an unsargable `OR $n IS NULL` form). Same rows recovered, same
+  single transaction — all three backends.
+- **Default staged-pipeline claim path flipped to pooled per-stage claimers**
+  ([ADR 0066](docs/adr/0066-pooled-stage-claimers.md); `[pipeline].claim_mode` default `per_lane` →
+  **`pooled`** — issue #744, shipped via PR #765). The `StageDispatcher` was first wired in behind
+  `[pipeline].claim_mode` **default-OFF** (#755, ADR 0066 PR4) and is now the **default** claim topology:
+  one dispatcher per stage running a handful of pooled claimer tasks over the `claim_fifo_heads` /
+  `list_fifo_lanes` / `release_claimed` primitives (batch-claiming head-prefixes across lanes), collapsing
+  the ~4,500 per-(lane×stage) claim loops that saturated a shared server DB at high fan-out and holding
+  zero-loss where `per_lane` dropped messages. **`per_lane` stays fully selectable as the byte-identical
+  opt-out** (`[pipeline].claim_mode = "per_lane"`), enforced by the zero-pooled-construction test sentinel.
+  Reliability-core — read once at engine start (a `/config/reload` does not toggle it; restart to change).
+  Single-node scope; the at-least-once / per-lane-FIFO / poison-guard invariants are unchanged in both modes.
+
 ## [0.2.14] — 2026-07-01 — Early Access
 
 **Delta security-audit remediation.** A focused security audit of the surface added since the

{messagefoundry-0.2.14 → messagefoundry-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: messagefoundry
-Version: 0.2.14
+Version: 0.3.0
 Summary: Open-source healthcare integration engine — route, transform, and validate messages across many formats and connection types
 Project-URL: Homepage, https://messagefoundry.org/
 Project-URL: Documentation, https://messagefoundry.org/
@@ -32,17 +32,13 @@ Requires-Dist: hl7>=0.4.5
 Requires-Dist: hl7apy>=1.3
 Requires-Dist: ldap3>=2.9
 Requires-Dist: prometheus-client>=0.20
+Requires-Dist: psutil>=6.0
 Requires-Dist: pydantic>=2.6
 Requires-Dist: pyspnego>=0.10
 Requires-Dist: starlette>=1.3.1
 Requires-Dist: tomlkit>=0.12
 Requires-Dist: tzdata>=2024.1
 Requires-Dist: uvicorn[standard]>=0.29
-Provides-Extra: console
-Requires-Dist: httpx>=0.27; extra == 'console'
-Requires-Dist: keyring>=24.0; extra == 'console'
-Requires-Dist: pyside6>=6.6; extra == 'console'
-Requires-Dist: truststore>=0.10; extra == 'console'
 Provides-Extra: dev
 Requires-Dist: httpx>=0.27; extra == 'dev'
 Requires-Dist: mypy>=1.10; extra == 'dev'
@@ -57,6 +53,10 @@ Requires-Dist: pynetdicom<4,>=3.0.4; extra == 'dicom'
 Provides-Extra: fhir
 Requires-Dist: fhir-resources>=7.1.0; extra == 'fhir'
 Requires-Dist: fhirpathpy>=2.2.0; extra == 'fhir'
+Provides-Extra: harness
+Requires-Dist: httpx>=0.27; extra == 'harness'
+Requires-Dist: pyside6>=6.6; extra == 'harness'
+Requires-Dist: truststore>=0.10; extra == 'harness'
 Provides-Extra: otel
 Requires-Dist: opentelemetry-exporter-otlp>=1.20; extra == 'otel'
 Requires-Dist: opentelemetry-sdk>=1.20; extra == 'otel'
@@ -66,6 +66,10 @@ Provides-Extra: sftp
 Requires-Dist: paramiko>=5.0; extra == 'sftp'
 Provides-Extra: sqlserver
 Requires-Dist: aioodbc>=0.5; extra == 'sqlserver'
+Provides-Extra: vault
+Requires-Dist: hvac>=2.3.0; extra == 'vault'
+Provides-Extra: webauthn
+Requires-Dist: webauthn<4,>=3.0.0; extra == 'webauthn'
 Provides-Extra: x12
 Requires-Dist: pyx12>=4.0.0; extra == 'x12'
 Provides-Extra: xml
@@ -92,7 +96,8 @@ guided tooling or extend it in Python; it runs on SQLite, PostgreSQL, or SQL Ser
 authentication, RBAC, audit logging, and encryption-at-rest built in.
 
 > Python import package: `messagefoundry`. Built with **hl7apy** + **python-hl7** (HL7 parsing/
-> validation), **FastAPI** (engine API), and **PySide6** (admin console).
+> validation), **FastAPI** (engine API + the same-origin `/ui` web console), and **PySide6** (the
+> standalone test harness).
 
 ## What it is
 
@@ -105,8 +110,8 @@ control; either way the configuration is version-controlled and yours.
 ## Architecture
 
 **Engine-as-library + localhost API.** The engine is an importable Python package.
-The PySide6 console talks to it over a localhost HTTP + WebSocket API — the same way
-whether the engine runs in-process, as a local daemon, or (later) on a remote host.
+A browser **web console** (served same-origin at `/ui`) talks to it over a localhost HTTP + WebSocket
+API — the same way whether the engine runs in-process, as a local daemon, or (later) on a remote host.
 No hand-rolled IPC; the deployment split is a config choice, not an architectural fork.
 
 See **[docs/architecture-diagram.md](https://github.com/MEFORORG/MessageFoundry/blob/main/docs/architecture-diagram.md)** for the rendered diagrams —
@@ -147,7 +152,7 @@ Full documentation lives on **[messagefoundry.org](https://messagefoundry.org/)*
 
 - **[Mental map](https://messagefoundry.org/assets/docs/MessageFoundry-Mental-Model.pdf)** — an
   orientation guide to how the pieces fit: Connections → Router → Handlers → Connections, with the
-  headless engine and the console/IDE that drive it.
+  headless engine and the web console/IDE that drive it.
 - **[Install Guide](https://messagefoundry.org/assets/docs/MessageFoundry-Install-Guide.pdf)** — install,
   configure, secure, and roll out to production.
 - **[User Guide](https://messagefoundry.org/assets/docs/MessageFoundry-User-Guide.pdf)** — author and
@@ -177,19 +182,21 @@ deliberate — replace `<version>` with the current release shown at the top of
 needs (each is opt-in and lazy-imported):
 
 ```bash
-pip install "messagefoundry[console]==<version>"     # admin console (PySide6 GUI) — the operator UI; most operators want this
+pip install "messagefoundry-webconsole==<version>"   # the browser web console (/ui) — the operator UI; most operators want this
 pip install "messagefoundry[postgres]==<version>"    # PostgreSQL store backend (production server DB)
 pip install "messagefoundry[sqlserver]==<version>"   # SQL Server store backend (+ OS-level ODBC Driver 18)
 pip install "messagefoundry[sftp]==<version>"        # SFTP transport for the REMOTEFILE connector
 pip install "messagefoundry[dicom]==<version>"       # DICOM codec + C-STORE SCP (pydicom + pynetdicom)
+pip install "messagefoundry[harness]==<version>"     # the standalone PySide6 test harness GUI
 ```
 
-**What's in the `messagefoundry` package — and what isn't.** It is the **engine plus the admin
-console**: the console ships in the same wheel, with its PySide6/GUI dependencies as the opt-in
-`[console]` extra, so a headless server, container, or adopter install stays lean — the console is one
-flag away (`messagefoundry[console]`) when you want the operator UI. The **VS Code extension is a
-separate product, not on PyPI** (a VS Code extension is a different ecosystem); see *VS Code extension &
-test harness* below for where to get it.
+**What's in the `messagefoundry` package — and what isn't.** It is the **engine**; the operator UI is
+the browser **web console** served same-origin at `/ui`, which ships as a separate, version-matched
+wheel (`messagefoundry-webconsole`) the engine mounts in-process (turn it on with `[api].serve_ui`), so
+a headless server, container, or adopter install stays lean. (The former PySide6 desktop console was
+retired in favour of the web console — BACKLOG #103; PySide6 now backs only the opt-in `[harness]` test
+tooling.) The **VS Code extension is a separate product, not on PyPI** (a VS Code extension is a
+different ecosystem); see *VS Code extension & test harness* below for where to get it.
 
 > **Verify before you install (supply chain).** Every release is built by a GitHub Actions workflow,
 > Sigstore-signed, and carries SLSA build-provenance + PEP 740 attestations. Verify a downloaded
@@ -224,10 +231,11 @@ python -m messagefoundry serve --config samples/config --db messagefoundry.db --
 # API on http://127.0.0.1:8765 — GET /connections, /messages, /stats, WS /ws/stats
 ```
 
-Then open the admin console (needs the `console` extra: `pip install -e ".[console]"`):
+Then open the admin console in a browser (install the web console alongside the engine —
+`pip install -e packaging/messagefoundry-webconsole` — and set `[api].serve_ui = true`):
 
 ```bash
-python -m messagefoundry.console --url http://127.0.0.1:8765
+# browse to http://127.0.0.1:8765/ui and sign in
 ```
 
 ### VS Code extension & test harness

{messagefoundry-0.2.14 → messagefoundry-0.3.0}/README.md

@@ -16,7 +16,8 @@ guided tooling or extend it in Python; it runs on SQLite, PostgreSQL, or SQL Ser
 authentication, RBAC, audit logging, and encryption-at-rest built in.
 
 > Python import package: `messagefoundry`. Built with **hl7apy** + **python-hl7** (HL7 parsing/
-> validation), **FastAPI** (engine API), and **PySide6** (admin console).
+> validation), **FastAPI** (engine API + the same-origin `/ui` web console), and **PySide6** (the
+> standalone test harness).
 
 ## What it is
 
@@ -29,8 +30,8 @@ control; either way the configuration is version-controlled and yours.
 ## Architecture
 
 **Engine-as-library + localhost API.** The engine is an importable Python package.
-The PySide6 console talks to it over a localhost HTTP + WebSocket API — the same way
-whether the engine runs in-process, as a local daemon, or (later) on a remote host.
+A browser **web console** (served same-origin at `/ui`) talks to it over a localhost HTTP + WebSocket
+API — the same way whether the engine runs in-process, as a local daemon, or (later) on a remote host.
 No hand-rolled IPC; the deployment split is a config choice, not an architectural fork.
 
 See **[docs/architecture-diagram.md](https://github.com/MEFORORG/MessageFoundry/blob/main/docs/architecture-diagram.md)** for the rendered diagrams —
@@ -71,7 +72,7 @@ Full documentation lives on **[messagefoundry.org](https://messagefoundry.org/)*
 
 - **[Mental map](https://messagefoundry.org/assets/docs/MessageFoundry-Mental-Model.pdf)** — an
   orientation guide to how the pieces fit: Connections → Router → Handlers → Connections, with the
-  headless engine and the console/IDE that drive it.
+  headless engine and the web console/IDE that drive it.
 - **[Install Guide](https://messagefoundry.org/assets/docs/MessageFoundry-Install-Guide.pdf)** — install,
   configure, secure, and roll out to production.
 - **[User Guide](https://messagefoundry.org/assets/docs/MessageFoundry-User-Guide.pdf)** — author and
@@ -101,19 +102,21 @@ deliberate — replace `<version>` with the current release shown at the top of
 needs (each is opt-in and lazy-imported):
 
 ```bash
-pip install "messagefoundry[console]==<version>"     # admin console (PySide6 GUI) — the operator UI; most operators want this
+pip install "messagefoundry-webconsole==<version>"   # the browser web console (/ui) — the operator UI; most operators want this
 pip install "messagefoundry[postgres]==<version>"    # PostgreSQL store backend (production server DB)
 pip install "messagefoundry[sqlserver]==<version>"   # SQL Server store backend (+ OS-level ODBC Driver 18)
 pip install "messagefoundry[sftp]==<version>"        # SFTP transport for the REMOTEFILE connector
 pip install "messagefoundry[dicom]==<version>"       # DICOM codec + C-STORE SCP (pydicom + pynetdicom)
+pip install "messagefoundry[harness]==<version>"     # the standalone PySide6 test harness GUI
 ```
 
-**What's in the `messagefoundry` package — and what isn't.** It is the **engine plus the admin
-console**: the console ships in the same wheel, with its PySide6/GUI dependencies as the opt-in
-`[console]` extra, so a headless server, container, or adopter install stays lean — the console is one
-flag away (`messagefoundry[console]`) when you want the operator UI. The **VS Code extension is a
-separate product, not on PyPI** (a VS Code extension is a different ecosystem); see *VS Code extension &
-test harness* below for where to get it.
+**What's in the `messagefoundry` package — and what isn't.** It is the **engine**; the operator UI is
+the browser **web console** served same-origin at `/ui`, which ships as a separate, version-matched
+wheel (`messagefoundry-webconsole`) the engine mounts in-process (turn it on with `[api].serve_ui`), so
+a headless server, container, or adopter install stays lean. (The former PySide6 desktop console was
+retired in favour of the web console — BACKLOG #103; PySide6 now backs only the opt-in `[harness]` test
+tooling.) The **VS Code extension is a separate product, not on PyPI** (a VS Code extension is a
+different ecosystem); see *VS Code extension & test harness* below for where to get it.
 
 > **Verify before you install (supply chain).** Every release is built by a GitHub Actions workflow,
 > Sigstore-signed, and carries SLSA build-provenance + PEP 740 attestations. Verify a downloaded
@@ -148,10 +151,11 @@ python -m messagefoundry serve --config samples/config --db messagefoundry.db --
 # API on http://127.0.0.1:8765 — GET /connections, /messages, /stats, WS /ws/stats
 ```
 
-Then open the admin console (needs the `console` extra: `pip install -e ".[console]"`):
+Then open the admin console in a browser (install the web console alongside the engine —
+`pip install -e packaging/messagefoundry-webconsole` — and set `[api].serve_ui = true`):
 
 ```bash
-python -m messagefoundry.console --url http://127.0.0.1:8765
+# browse to http://127.0.0.1:8765/ui and sign in
 ```
 
 ### VS Code extension & test harness

{messagefoundry-0.2.14 → messagefoundry-0.3.0}/messagefoundry/__init__.py

@@ -13,11 +13,13 @@ Config modules define the message graph against this surface::
 
 from messagefoundry.config.models import (
     AckMode,
+    BatchConfig,
     BuildupThreshold,
     ContentType,
     InternalErrorPolicy,
     OrderingMode,
     RetryPolicy,
+    SaturationThreshold,
     StallThreshold,
 )
 from messagefoundry.config.active_environment import current_environment
@@ -33,6 +35,7 @@ from messagefoundry.config.wiring import (
     DatabaseLookup,
     DatabasePoll,
     DatabaseRef,
+    Direct,
     Email,
     FhirLookup,
     File,
@@ -54,14 +57,35 @@ from messagefoundry.config.wiring import (
     Timer,
     X12,
     Send,
+    SetMeta,
     SetState,
+    MessageTypeError,
     code_set,
     env,
     handler,
     inbound,
+    message_type_of,
     outbound,
     router,
 )
+from messagefoundry.actions import (
+    append_to_field,
+    arith_field,
+    code_lookup,
+    convert_case,
+    copy_field,
+    copy_segment,
+    date_diff_field,
+    delete_segment,
+    format_date,
+    pad_field,
+    replace_literal,
+    set_field,
+    split_field,
+    substring_field,
+    trim_field,
+)
+from messagefoundry.diagnostics import checkpoint, log_note
 from messagefoundry.parsing.groups import SegmentGroup
 from messagefoundry.parsing.message import Message, RawMessage
 from messagefoundry.parsing.split import split_by_obr
@@ -74,7 +98,7 @@ from messagefoundry.timezone import (
     to_zone,
 )
 
-__version__ = "0.2.14"
+__version__ = "0.3.0"
 
 __all__ = [
     "Message",
@@ -83,6 +107,7 @@ __all__ = [
     "split_by_obr",
     "Send",
     "SetState",
+    "SetMeta",
     "state_get",
     "response_get",
     "MLLP",
@@ -94,6 +119,7 @@ __all__ = [
     "Loopback",
     "PassThrough",
     "Rest",
+    "Direct",
     "Email",
     "SMTP",
     "FHIR",
@@ -125,11 +151,32 @@ __all__ = [
     "InternalErrorPolicy",
     "BuildupThreshold",
     "StallThreshold",
+    "SaturationThreshold",
+    "BatchConfig",
     "ContentType",
     "inbound",
     "outbound",
     "router",
     "handler",
+    "message_type_of",
+    "MessageTypeError",
+    "copy_field",
+    "set_field",
+    "append_to_field",
+    "trim_field",
+    "substring_field",
+    "pad_field",
+    "replace_literal",
+    "convert_case",
+    "arith_field",
+    "format_date",
+    "date_diff_field",
+    "split_field",
+    "code_lookup",
+    "copy_segment",
+    "delete_segment",
+    "log_note",
+    "checkpoint",
     "convert_hl7_timestamp",
     "to_zone",
     "parse_hl7_timestamp",