messagefoundry 0.2.1__tar.gz → 0.2.3__tar.gz

{messagefoundry-0.2.1 → messagefoundry-0.2.3}/.github/SECURITY.md

@@ -12,9 +12,14 @@ verify a report against current `main` before filing.
 
 **Do not open a public issue for a vulnerability.** Instead, report it privately:
 
-- Preferred: open a [GitHub private security advisory](https://github.com/wshallwshall/MessageFoundry/security/advisories/new)
-  ("Report a vulnerability"), or
-- Email the maintainer at the address on the GitHub profile.
+- **Preferred (always available, fully private):** open a [GitHub private security advisory](https://github.com/wshallwshall/MessageFoundry/security/advisories/new)
+  ("Report a vulnerability") — GitHub keeps it private to the maintainers until coordinated disclosure.
+  This is the recommended channel on both this repository and the public mirror.
+- Alternatively, email the maintainer at the address on the GitHub profile.
+
+If you cannot reach a maintainer privately within a few business days, you may request a contact via a
+**non-detail** public issue (title only, e.g. "requesting a private security contact") — **never** put
+vulnerability details, reproduction steps, or any message content in a public issue.
 
 Please include: affected component (e.g. MLLP/file transport, store, API/auth, console),
 a description and impact, and reproduction steps or a proof of concept. Do **not** include

{messagefoundry-0.2.1 → messagefoundry-0.2.3}/.github/workflows/benchmark.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
       - name: Install project (dev)
         run: |
           python -m pip install --upgrade pip
@@ -92,7 +92,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
       - name: Install project (dev + postgres)
         run: |
           python -m pip install --upgrade pip
@@ -159,7 +159,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
       - name: Install Microsoft ODBC Driver 18 + sqlcmd
         run: |
           curl -fsSL https://packages.microsoft.com/keys/microsoft.asc \

{messagefoundry-0.2.1 → messagefoundry-0.2.3}/.github/workflows/ci.yml

@@ -11,37 +11,23 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # Lint + type-check + unit tests. Linux carries the cheap breadth — the 3.11
-  # floor plus a fast early-fail leg on the newest 3.14 (1x minutes). Windows
-  # Server 2022 + 2025 is the primary deployment target, so it covers BOTH the
-  # current (3.13) and the new (3.14) deploy Python on each Server SKU, even
-  # though Windows bills at 2x — testing the version we ship on the OS we ship it
-  # on is worth the minutes.
+  # Lint + type-check + unit tests. The project supports a single Python — 3.14 — so every leg runs it.
+  # Linux carries the cheap breadth (1x minutes); Windows Server 2022 + 2025 is the primary deployment
+  # target, so 3.14 is also exercised on both Server SKUs even though Windows bills at 2x — testing the
+  # version we ship on the OS we ship it on is worth the minutes.
   test:
     name: test (${{ matrix.os }}, py${{ matrix.python-version }})
     runs-on: ${{ matrix.os }}
-    # py3.11 is a REQUIRED gate again (BACKLOG #17 RESOLVED in PR #448). The intermittent py3.11-only hang
-    # was root-caused — and reproduced on a Docker py3.11 box — as a CPython 3.11 asyncio cancellation race:
-    # cancelling a task parked in asyncio.Queue.get() can intermittently never complete (fixed in CPython
-    # 3.12, hence py3.13 was always clean and production — one long-lived loop — never hit it). TeeRelay.stop()
-    # tripped it; fixed via a sentinel shutdown in tee/relay.py, validated at 0 hangs across 24 full-suite +
-    # 40 isolated runs in the repro container and green on CI. So the advisory `continue-on-error` is removed
-    # and a py3.11 failure reds the build again. (The dormant `MEFOR_PY311_QUARANTINE` conftest lever stays as
-    # an off-by-default safety net; it is no longer needed.)
     # Wall-clock backstop: bound each leg so a hung test fails in minutes, not the 6h default. The
     # pytest-timeout watchdog (60s/test) should catch a culprit first; this is the belt-and-suspenders cap
-    # if a whole process ever deadlocks below pytest (e.g. a future regression of BACKLOG #17).
+    # if a whole process ever deadlocks below pytest.
     timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
         include:
-          - { os: ubuntu-latest, python-version: "3.11" }
-          - { os: ubuntu-latest, python-version: "3.13" }
           - { os: ubuntu-latest, python-version: "3.14" }
-          - { os: windows-2022, python-version: "3.13" }
           - { os: windows-2022, python-version: "3.14" }
-          - { os: windows-2025, python-version: "3.13" }
           - { os: windows-2025, python-version: "3.14" }
     defaults:
       run:
@@ -89,36 +75,6 @@ jobs:
           QT_QPA_PLATFORM: offscreen
         run: pytest -q
 
-  # BACKLOG #17 production-bug check. The intermittent py3.11 asyncio<->aiosqlite lost-wakeup hang has
-  # only ever surfaced under pytest (per-test event-loop churn + log-capture teardown are the suspected
-  # triggers). This job runs the store the way the engine does in PRODUCTION — one asyncio.run() loop,
-  # no pytest — and hammers aiosqlite with concurrent DB ops on py3.11. A clean pass is evidence the
-  # hang is a test-lifecycle artifact, not a product defect; a hang here (caught by the per-run
-  # `timeout`, exit 124) would be a real, pytest-free repro that flips it to a confirmed product bug.
-  py311-store-soak:
-    name: py3.11 store soak (BACKLOG #17)
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: Set up Python 3.11
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
-        with:
-          python-version: "3.11"
-          cache: pip
-          cache-dependency-path: pyproject.toml
-      - name: Install project (base — no pytest, no console)
-        run: |
-          python -m pip install --upgrade pip
-          pip install -e .
-      - name: Soak the aiosqlite store on one long-lived loop (5x)
-        run: |
-          for run in $(seq 1 5); do
-            echo "::group::soak run $run"
-            timeout 150 python scripts/soak/store_soak.py 64 300
-            echo "::endgroup::"
-          done
-
   # Build + type-check the VS Code extension, and run its integration tests. The Python jobs never
   # touch ide/, so a dep bump or IDE code change that breaks the bundle or the types would otherwise
   # pass CI unbuilt (this job exists because an esbuild bump merged "green" without anything having
@@ -235,7 +191,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
 
       - name: Install Microsoft ODBC Driver 18 + sqlcmd
         run: |
@@ -379,7 +335,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
 
       - name: Install project (dev + postgres extras)
         run: |
@@ -437,7 +393,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
 
       - name: Install project (dev — engine + httpx client; no Qt needed for the headless load path)
         run: |
@@ -509,7 +465,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
 
       - name: Install Microsoft ODBC Driver 18 + sqlcmd
         run: |
@@ -590,12 +546,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Windows Server 2022 + 2025 on the current deploy Python (3.13); plus the new 3.14 deploy
-        # target on 2025 (newest Server) so the real NSSM install->serve->MLLP path is validated on
-        # the version we will ship. This job is push/dispatch-only, so the extra leg costs no PR time.
+        # Windows Server 2022 + 2025 on the supported deploy Python (3.14), so the real NSSM
+        # install->serve->MLLP path is validated on the version we ship, on each Server SKU. This job
+        # is push/dispatch-only, so the Windows minutes cost no PR time.
         include:
-          - { os: windows-2022, python-version: "3.13" }
-          - { os: windows-2025, python-version: "3.13" }
+          - { os: windows-2022, python-version: "3.14" }
           - { os: windows-2025, python-version: "3.14" }
     defaults:
       run:
@@ -802,9 +757,19 @@ jobs:
           # A fully graceful shutdown exits 0 (uvicorn handles SIGTERM, runs the lifespan, returns); 143
           # (128+SIGTERM) is acceptable too. 137 = SIGKILL after the grace expired = ungraceful.
           if [ "$code" = "137" ]; then echo "FAIL: ungraceful shutdown (SIGKILL after grace)"; exit 1; fi
-          docker logs mefor 2>&1 | grep -q "Application shutdown complete" \
-            || { echo "FAIL: no clean-shutdown marker (lifespan shutdown did not complete)"; exit 1; }
-          echo "graceful shutdown verified"
+          # Poll for the marker: `docker stop` returns the instant the container exits, but the final
+          # buffered log line ("Application shutdown complete") can land in `docker logs` a beat later, so
+          # grepping once immediately is racy (a clean 143 shutdown then read as a missing marker). Retry
+          # for ~10s so a slow log flush is not misread as an incomplete lifespan shutdown.
+          for _ in $(seq 1 20); do
+            if docker logs mefor 2>&1 | grep -q "Application shutdown complete"; then
+              echo "graceful shutdown verified"; exit 0
+            fi
+            sleep 0.5
+          done
+          echo "FAIL: no clean-shutdown marker (lifespan shutdown did not complete)"
+          docker logs mefor 2>&1 | tail -20
+          exit 1
 
       - name: Engine log (always)
         if: always()
@@ -820,7 +785,7 @@ jobs:
   #     `windows-service-smoke`) report `skipped` on every PR — never the required context a PR waits
   #     on — so requiring them either no-ops or wedges; and
   #   * the matrix legs report an UNEXPANDED name when skipped (`... ${{ matrix.label }}`) but
-  #     EXPANDED names when they run (`... 2022`/`2025`, `(windows-2022, py3.13)`), so no single
+  #     EXPANDED names when they run (`... 2022`/`2025`, `(windows-2022, py3.14)`), so no single
   #     context string matches both the skipped and the run state.
   # This gate ALWAYS runs (if: always()), so it reports ONE fixed context ("CI gate") regardless of
   # which legs ran, and fails iff a gated leg actually FAILED or was cancelled — a `skipped` leg

{messagefoundry-0.2.1 → messagefoundry-0.2.3}/.github/workflows/dependabot-lock-resync.yml

@@ -60,7 +60,7 @@ jobs:
           # code runs in this job (uv lock --check + uv export only).
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: Re-export the lock files (DEP-1 — byte-for-byte identical flags/paths)
         run: |

{messagefoundry-0.2.1 → messagefoundry-0.2.3}/.github/workflows/release-sync-check.yml

@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0 # need the vX.Y.Z tags (the private-tag side of the check)
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
       - name: Check tag / PyPI / mirror are in sync
         run: |
           # The script lives under the deny-listed scripts/publish/, so it is ABSENT on the OSS mirror;

{messagefoundry-0.2.1 → messagefoundry-0.2.3}/.github/workflows/release.yml

@@ -40,7 +40,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
 
       - name: Build sdist + wheel
         run: |

{messagefoundry-0.2.1 → messagefoundry-0.2.3}/.github/workflows/security.yml

@@ -32,7 +32,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
       - name: Check the lockfile is in sync with pyproject (DEP-1)
         run: |
           python -m pip install --upgrade pip uv
@@ -94,11 +94,14 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
       - name: Generate a CycloneDX SBOM from the lockfile
         run: |
-          python -m pip install --upgrade pip "cyclonedx-bom~=4.6"
-          cyclonedx-py requirements requirements.lock --output-format JSON --outfile sbom.cdx.json
+          # cyclonedx-bom~=7.3 (was ~=4.6): the 4.x line drags cyclonedx-python-lib 7.x → lxml<6, which
+          # has no cp314 wheel, so on the 3.14 runner pip source-builds lxml and fails. 7.3 → lxml 6.x
+          # (cp314 wheels). The 7.x `requirements` CLI renamed `--outfile` → `--output-file`.
+          python -m pip install --upgrade pip "cyclonedx-bom~=7.3"
+          cyclonedx-py requirements requirements.lock --output-format JSON --output-file sbom.cdx.json
       - name: Upload the SBOM artifact
         # SHA-pinned for supply-chain integrity, matching ci.yml's upload-artifact pin.
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -115,7 +118,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
       - name: Scan source for insecure patterns
         run: |
           # Pin bandit: an unpinned upgrade once silently changed `# nosec` parsing (1.9.x requires
@@ -162,7 +165,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
       - name: Run the MessageFoundry rules
         run: |
           python -m pip install --upgrade pip "semgrep~=1.90"
@@ -182,7 +185,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
       - name: Diff crypto call sites against the inventory
         # Stdlib-only (no install). Exits non-zero — failing the build — on any drift.
         run: python scripts/security/crypto_inventory_check.py
@@ -200,7 +203,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
       - name: Scan the publishable subset for forbidden content
         # Stdlib-only scanner (no install). Exits non-zero — failing the build — on any hit. The scanner
         # lives under the deny-listed scripts/publish/, so it is ABSENT on the OSS mirror — there's

{messagefoundry-0.2.1 → messagefoundry-0.2.3}/.github/workflows/vuln-metrics.yml

@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
       - name: Compute the metrics (real Dependabot PRs + CISA KEV + FIRST EPSS)
         env:
           GH_TOKEN: ${{ github.token }} # gh auth for the read-only Dependabot-PR query

{messagefoundry-0.2.1 → messagefoundry-0.2.3}/.gitignore

@@ -74,3 +74,9 @@ TRANSCRIPTS.md
 /docs/security/DEPENDENCY-RESPONSE-A4-HANDOFF.md
 # vuln_metrics.py local CSV output (the CI run uploads it as an artifact; not committed)
 /docs/security/metrics/
+
+# Operator-local load/throughput profiles — tuned to a specific deployment's volume; kept OUT of the
+# OSS repo + public mirror (the plan itself lives on the operator share, WIN2025-LOAD-THROUGHPUT-MATRIX.md).
+# Still usable by name (they sit in PROFILES_DIR) and copy-on to the test box.
+/harness/load/profiles/hospital-baseline.toml
+/harness/load/profiles/soak-12h.toml

{messagefoundry-0.2.1 → messagefoundry-0.2.3}/CHANGELOG.md

@@ -6,6 +6,87 @@ All notable changes to MessageFoundry are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.2.3] — 2026-06-26 — Early Access
+
+A bug-fix + feature release: the SQL Server store no longer raises "connection busy" errors under
+concurrent load, plus connection/transport event logging, GUI-managed translation tables, and inbound
+listener port-conflict detection.
+
+### Fixed
+- **SQL Server: "Connection is busy with results for another command" under concurrent load (EF-6).**
+  `claim_next_fifo` — and three sibling sites (`_maybe_finalize`, `consume_recovery_code_hash`,
+  `consume_totp_step`) — read a result-set-returning statement with a lone `fetchone()` and could return
+  the pooled connection to the pool with the result set still pending, so the next borrower's first
+  command raced an `HY000` busy error (ODBC Driver 18, no MARS). All affected sites now fully drain the
+  result set (`fetchall`) before commit/release. SQLite and PostgreSQL were unaffected (asyncpg
+  materializes rows; SQLite has no shared pooled-connection single-result-set constraint). (#543)
+
+### Added
+- **Connection/transport event log + "Response Sent" ACK capture** (ADR 0020 / ADR 0021). A new id-keyed,
+  metadata-only `connection_event` table records inbound connection lifecycle, pre-ingress failures, and
+  outbound lane transitions, with a `[diagnostics]` config block (per-connection overrides + retention),
+  a `GET /events` read API, and a console **Event Log** page. Event reasons are scrubbed and encrypted at
+  rest. (#541)
+- **GUI-managed translation tables (code sets)** (ADR 0033). A code-set CLI + writer and a VS Code
+  extension grid editor / **Translation Tables** view for maintaining code-set mappings. (#540)
+- **Inbound listener port-conflict detection** — static + runtime checks that flag two inbound
+  connections bound to the same host:port before they collide at startup. (#538)
+
+### Changed
+- Docs: README install instructions are now version-agnostic and link the website docs; the roadmap
+  section is replaced with a features summary. (#542, #544)
+
+## [0.2.2] — 2026-06-24 — Early Access
+
+A security-hardening release: PHI-at-rest encryption is closed across every backend, the active-passive
+cluster gains a store-checked split-brain fence, outbound delivery is effectively-once, and the at-rest
+cipher becomes crypto-agile — all additive, with the on-disk `mfenc:v1` format byte-identical.
+
+### Changed
+- **BREAKING — Python 3.14 is now the only supported runtime.** `requires-python` is raised to `>=3.14`
+  (was `>=3.11`), and the ruff/mypy targets, CI matrix (Linux + Windows Server 2022/2025, all on 3.14),
+  Docker base image, lockfiles, and adopter scaffold move with it. **Adopters and engine hosts must be on
+  Python 3.14** — a 3.11/3.12/3.13 host will refuse to install the wheel. The 3.11/3.12/3.13-specific test
+  apparatus is retired with this change (the `MEFOR_PY311_QUARANTINE` conftest lever, the `py3.11 store
+  soak` CI job, and `scripts/soak/store_soak.py`; the underlying BACKLOG #17 asyncio↔aiosqlite concern is
+  still mitigated by the shared session loop in `pyproject.toml`).
+
+### Security
+- **PHI-at-rest encryption closed across all three backends.** The patient `summary` (MRN + name) and
+  `metadata` columns are now encrypted at rest (previously cleartext even with encryption enabled), and the
+  SQL Server `error` / `last_error` / `message_events.detail` columns are brought to parity with SQLite and
+  Postgres — every cipher column is now AES-256-GCM at rest. Coverage is surfaced by a new authenticated,
+  audited `GET /security/posture` route (reports the active-key fingerprint + per-backend column coverage;
+  never key bytes).
+- **Fail-closed for PHI without a key.** An instance declared `data_class = phi` now **refuses to start**
+  without an encryption key (previously it started in cleartext with a warning), unless explicitly overridden
+  by the new, audited `[store].allow_unencrypted_phi`.
+- **Crypto-agility marker (additive).** The at-rest cipher marker is now version/algorithm-aware
+  (`mfenc:v2:<alg>:…`) so a future algorithm can be introduced without a data migration. The `mfenc:v1`
+  format is byte-identical and AES-256-GCM remains the only algorithm; decryption fails closed on an unknown
+  marker version or algorithm.
+- **Database-TLS hardening.** A new `[store].ssl_root_cert` pins a private database CA (Postgres), with
+  machine-store CA-import and certificate-rotation operator runbooks. The DPAPI key file's ACL now grants the
+  service account read access without broadening exposure.
+
+### Added
+- **Active-passive split-brain fence.** A monotonic leader-epoch fencing token on the leadership lease,
+  validated inside the FIFO claim transaction, so a superseded or paused ex-leader that resumes is fenced out
+  (it claims nothing) — backed by continuous "at most one leader" SLO checks and a real-handover failover
+  test. SQLite (single-node) behavior is unchanged.
+- **Effectively-once outbound delivery.** A same-transaction idempotency ledger skips re-delivery of an
+  already-delivered message after a failover or crash-recovery re-claim, without re-ordering a lane; an
+  operator-initiated replay still re-sends.
+- **Pre-side-effect leadership re-checks** so a node that loses leadership between claiming and sending
+  re-queues the work rather than emitting it as a stale leader.
+- `messagefoundry verify --check-disposition` for post-deploy disposition validation.
+
+### Fixed
+- CycloneDX SBOM generation on Python 3.14.
+- PyPI long-description rendering (version pins, links).
+- De-flaked several intermittent CI tests (failover-load timeouts, a harness server port-bind race, the
+  startup fault-isolation recovery assertion, and the docker-smoke shutdown-marker check).
+
 ## [0.2.1] — 2026-06-23 — Early Access
 
 ### Fixed
@@ -90,7 +171,9 @@ tests, but the external code review + penetration test (the bar for a security-c
 - Releases are built, SBOM'd (CycloneDX), and signed with [Sigstore](https://www.sigstore.dev/) — see the
   `release` workflow.
 
-[Unreleased]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.1...HEAD
+[Unreleased]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.3...HEAD
+[0.2.3]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.2...v0.2.3
+[0.2.2]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/wshallwshall/MessageFoundry/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/wshallwshall/MessageFoundry/releases/tag/v0.1.0

{messagefoundry-0.2.1 → messagefoundry-0.2.3}/CLAUDE.md

@@ -242,7 +242,7 @@ diverge enough to warrant it; keep this root file general.
 
 ## 6. Python Code Standards
 
-- Target **Python 3.11+**. Type-hint all public functions/attributes — **mypy runs in strict
+- Target **Python 3.14+** (the project requires `>=3.14`). Type-hint all public functions/attributes — **mypy runs in strict
   mode**.
 - **asyncio core:** never block the event loop; use `aiosqlite` and async connectors. Long
   loops/workers must be **cooperatively cancellable** (respond to the connection's stop signal)

{messagefoundry-0.2.1 → messagefoundry-0.2.3}/CONTRIBUTING.md

@@ -41,7 +41,7 @@ maintainer.)
    to `main` are blocked. Keep commits coherent (one logical layer per commit) with clear messages.
 2. **Set up the environment** (Windows/PowerShell shown; adapt for your OS):
    ```powershell
-   py -3.11 -m venv .venv
+   py -3.14 -m venv .venv
    .\.venv\Scripts\Activate.ps1
    pip install -e ".[dev,console]"
    ```