messagefoundry 0.2.4__tar.gz → 0.2.6__tar.gz

{messagefoundry-0.2.4 → messagefoundry-0.2.6}/.github/dependabot.yml

@@ -18,7 +18,10 @@ updates:
     # behavior), so a real advisory fix still arrives immediately. Pairs with the auto-merge
     # workflow: routine patches auto-merge AFTER aging; security patches auto-merge now.
     cooldown:
-      default-days: 3
+      # ~5-day aging window (DEPENDENCY-POSTURE-REVIEW.md) lengthens the malicious-fresh-publish
+      # dodge on the routine VERSION track; the SECURITY track still bypasses cooldown (Dependabot
+      # design), now backstopped by the published-GHSA gate in dependabot-auto-merge.yml (SEC-007 #2).
+      default-days: 5
       semver-major-days: 7
     groups:
       # Version-update grouping (applies-to defaults to version-updates).

{messagefoundry-0.2.4 → messagefoundry-0.2.6}/.github/workflows/ci.yml

@@ -10,6 +10,11 @@ concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
+# Least privilege: every job here only reads the repo and runs tests/builds (no gh writes, no git push,
+# no secrets), so a read-only default token is sufficient. A job needing more declares its own block.
+permissions:
+  contents: read
+
 jobs:
   # Lint + type-check + unit tests. The project supports a single Python — 3.14 — so every leg runs it.
   # Linux carries the cheap breadth (1x minutes); Windows Server 2022 + 2025 is the primary deployment
@@ -809,9 +814,13 @@ jobs:
         if: >-
           contains(needs.*.result, 'failure') ||
           contains(needs.*.result, 'cancelled')
+        env:
+          # Pass the needs context via env, not inline ${{ }} in the run block (defense-in-depth against
+          # template injection — a job output could in theory carry a quote that breaks out of echo).
+          NEEDS_JSON: ${{ toJSON(needs) }}
         run: |
           echo "::error::A gated CI leg failed or was cancelled."
-          echo '${{ toJSON(needs) }}'
+          echo "$NEEDS_JSON"
           exit 1
 
       - name: Gated legs OK

{messagefoundry-0.2.4 → messagefoundry-0.2.6}/.github/workflows/codeql.yml

@@ -56,12 +56,12 @@ jobs:
         with:
           persist-credentials: false # CodeQL uploads via the job token, not a persisted git credential
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3 # TODO: SHA-pin (repo convention)
+        uses: github/codeql-action/init@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2
         with:
           languages: ${{ matrix.language }}
           # security-extended adds higher-recall security queries on top of the default suite.
           queries: security-extended
       - name: Analyze
-        uses: github/codeql-action/analyze@v3 # TODO: SHA-pin (repo convention)
+        uses: github/codeql-action/analyze@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2
         with:
           category: "/language:${{ matrix.language }}"

messagefoundry-0.2.6/.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,165 @@
+name: Dependabot auto-merge
+
+# Scoped auto-merge for Dependabot PRs (A4 of the dependency fast-response plan).
+#
+# SAFE because main's required status checks are the gate: the full pytest suite, pip-audit, the
+# DEP-1 lock-sync check (incl. the A3 lock-resync commit), bandit/semgrep/gitleaks all must pass
+# before GitHub completes the merge. A bad bump turns CI red and never merges — auto-merge only
+# removes the human-latency on the safe, common case, not the safety net.
+#
+# IN SCOPE (auto-merged):
+#   - any PATCH update (incl. security patches — most security fixes are patches)
+#   - MINOR updates of DEV-only dependencies
+# OUT OF SCOPE (left for human review, surfaced same-day by the daily security cron + alerts):
+#   - MINOR/MAJOR updates of runtime deps, and ALL MAJOR updates
+#
+# Fresh-release supply-chain poisoning is handled upstream by the dependabot.yml `cooldown`
+# (routine updates age before a PR opens); SECURITY updates bypass cooldown by design, so a real
+# advisory fix still arrives immediately and (if a patch) auto-merges.
+#
+# SECURITY-TRACK GUARDRAILS (DEPENDENCY-POSTURE-REVIEW.md #2 and #3 — close SEC-007, CWE-829):
+#   #3 DENY-LIST — the auth/token/crypto stack (cryptography, argon2-cffi, fastapi, …) is NEVER
+#      auto-merged, not even for a patch: any such dep routes the PR to MANUAL review. A grouped
+#      PR that includes ANY denied dep is denied WHOLE (fail-safe — never partial-merge a group).
+#   #2 PUBLISHED-GHSA GATE — a SECURITY-track PR (which bypasses the cooldown by Dependabot design)
+#      auto-merges ONLY when a real, published, non-withdrawn advisory is confirmed against the
+#      dependency's PREVIOUS version (the axios-1.14.1 pattern). The advisory lookup FAILS CLOSED:
+#      a rate-limit/API error or no-matching-advisory routes to manual review, never auto-merge.
+#      The non-security VERSION track keeps its cooldown-aged auto-merge unchanged (already aged by
+#      dependabot.yml, so it does not need the GHSA gate).
+#
+# RESIDUAL ACCEPTED RISK: a malicious patch that BOTH rides a real concurrent published advisory
+# AND is not on the deny-list would still auto-merge. The deny-list shields the highest-value
+# (auth/crypto) deps unconditionally; the GHSA gate blocks the no-advisory fast-publish poison on
+# the security track; main's required CI (pip-audit/bandit/tests/lock-sync) backstops both.
+#
+# Why `pull_request` (not pull_request_target): a Dependabot `pull_request` run gets a read-only
+# GITHUB_TOKEN by default, which the `permissions:` block below elevates to exactly what the merge
+# API needs — no untrusted-code-with-secrets exposure, no GitHub App required. This is the pattern
+# GitHub documents for Dependabot auto-merge.
+
+on: pull_request
+
+permissions:
+  contents: write # complete the merge
+  pull-requests: write # enable auto-merge on the PR
+  security-events: read # read Dependabot alerts for the published-GHSA gate (#2)
+
+concurrency:
+  group: dependabot-automerge-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    # Only Dependabot's own PRs. pull_request.user.login is the immutable PR author, so an A3
+    # lock-resync `synchronize` (pushed by the App) still satisfies this — the author stays
+    # dependabot[bot] even though the triggering actor is the App.
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    timeout-minutes: 10
+    steps:
+      - name: Fetch Dependabot metadata
+        id: meta
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      # Guardrail #3 (DEPENDENCY-POSTURE-REVIEW.md): the auth/token/crypto stack NEVER auto-merges,
+      # not even a patch. dependency-names is comma-separated for grouped PRs; we deny the WHOLE
+      # group if ANY token matches (fail-safe — never partial-merge a group). Exact token match on
+      # the comma-split names (not a naive substring) so 'cffi' does not match 'argon2-cffi-bindings'
+      # and vice-versa.
+      - name: Reject security-critical deps (deny-list)
+        id: denylist
+        env:
+          DEP_NAMES: ${{ steps.meta.outputs.dependency-names }}
+        run: |
+          # Single source of truth for the security-critical deny-list.
+          denylist="cryptography argon2-cffi argon2-cffi-bindings paramiko ldap3 pyspnego \
+            fastapi starlette uvicorn pydantic pydantic-core python-jose pyjwt passlib bcrypt cffi"
+          deny=false
+          IFS=',' read -ra names <<< "$DEP_NAMES"
+          for raw in "${names[@]}"; do
+            # trim surrounding whitespace and lowercase
+            name="$(echo "$raw" | tr '[:upper:]' '[:lower:]' | xargs)"
+            [ -z "$name" ] && continue
+            for crit in $denylist; do
+              if [ "$name" = "$crit" ]; then
+                echo "::notice::'$name' is a security-critical dependency — routing to manual review (no auto-merge)."
+                deny=true
+              fi
+            done
+          done
+          echo "deny=$deny" >> "$GITHUB_OUTPUT"
+
+      # Guardrail #2 (DEPENDENCY-POSTURE-REVIEW.md): a SECURITY-track PR auto-merges ONLY when a
+      # real, published, non-withdrawn advisory covers the dependency's PREVIOUS version. The
+      # security track is detected by Dependabot's `dependency-group` (python-security/ide-security)
+      # — a security-update group — falling back to a present-but-empty group meaning version track.
+      # The advisory lookup FAILS CLOSED: any error or no-match leaves advisory_ok=false.
+      - name: Verify a published advisory backs the security track
+        id: ghsa
+        env:
+          DEP_NAMES: ${{ steps.meta.outputs.dependency-names }}
+          DEP_GROUP: ${{ steps.meta.outputs.dependency-group }}
+          PREV_VERSION: ${{ steps.meta.outputs.previous-version }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -u
+          # Is this the security track? Dependabot tags security-update grouped PRs with a
+          # *-security dependency-group. A non-security (version) PR has no security group.
+          is_security=false
+          case "$DEP_GROUP" in
+            *security*) is_security=true ;;
+          esac
+
+          if [ "$is_security" != "true" ]; then
+            # Version track: already cooldown-aged by dependabot.yml — the GHSA gate does not apply.
+            echo "security_track=false" >> "$GITHUB_OUTPUT"
+            echo "advisory_ok=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "security_track=true" >> "$GITHUB_OUTPUT"
+
+          # Require at least one matching published (non-withdrawn) advisory for EVERY named dep at
+          # the previous version. Query the global advisories endpoint (ecosystem pip — Python
+          # advisories are pip-keyed). Fail closed on any error.
+          advisory_ok=true
+          IFS=',' read -ra names <<< "$DEP_NAMES"
+          for raw in "${names[@]}"; do
+            name="$(echo "$raw" | tr '[:upper:]' '[:lower:]' | xargs)"
+            [ -z "$name" ] && continue
+            count="$(gh api -X GET /advisories \
+              -f ecosystem=pip \
+              -f affects="${name}@${PREV_VERSION}" \
+              --jq '[.[] | select(.withdrawn_at == null)] | length' 2>/dev/null || echo "ERR")"
+            if [ "$count" = "ERR" ] || [ -z "$count" ]; then
+              echo "::warning::advisory lookup failed for '$name' — failing closed (manual review)."
+              advisory_ok=false
+              break
+            fi
+            if [ "$count" -lt 1 ]; then
+              echo "::warning::no published advisory covers '${name}@${PREV_VERSION}' — failing closed (manual review)."
+              advisory_ok=false
+              break
+            fi
+            echo "::notice::published advisory confirmed for '${name}@${PREV_VERSION}'."
+          done
+          echo "advisory_ok=$advisory_ok" >> "$GITHUB_OUTPUT"
+
+      - name: Enable auto-merge for in-scope updates
+        # Auto-merge only when: (a) the update is an in-scope type (any patch, or a dev-only minor),
+        # AND (b) no security-critical dep is involved (deny-list #3), AND (c) for the SECURITY track
+        # ONLY, a published advisory is confirmed (#2). A non-security (version-track) patch keeps its
+        # cooldown-aged auto-merge — advisory_ok is not required there.
+        if: >-
+          steps.denylist.outputs.deny != 'true' &&
+          (steps.ghsa.outputs.security_track != 'true' ||
+           steps.ghsa.outputs.advisory_ok == 'true') &&
+          (steps.meta.outputs.update-type == 'version-update:semver-patch' ||
+           (steps.meta.outputs.update-type == 'version-update:semver-minor' &&
+            steps.meta.outputs.dependency-type == 'direct:development'))
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

{messagefoundry-0.2.4 → messagefoundry-0.2.6}/.github/workflows/dependabot-lock-resync.yml

@@ -75,6 +75,10 @@ jobs:
           uv export --no-emit-project --no-dev --extra sqlserver --format requirements.txt -o docker/locks/requirements-sqlserver.lock
 
       - name: Commit and push the resynced locks
+        env:
+          # Pass the PR head ref through the environment, NOT inline ${{ }} in the run block, so a branch
+          # name containing shell metacharacters can never be evaluated as code (template injection).
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
         run: |
           set -euo pipefail
           git config user.name 'dependabot[bot]'
@@ -88,4 +92,4 @@ jobs:
           # Push with the persisted App-token credential (NOT GITHUB_TOKEN). An App-token push emits a
           # synchronize event so the required checks (DEP-1, ci.yml) re-run on the new commit; a
           # GITHUB_TOKEN push would leave them pending and the PR unmergeable.
-          git push origin "HEAD:${{ github.event.pull_request.head.ref }}"
+          git push origin "HEAD:${HEAD_REF}"

messagefoundry-0.2.6/.github/workflows/freethread-smoke.yml

@@ -0,0 +1,95 @@
+# Free-threaded (no-GIL / PEP 703, cp314t) engine canary — INFORMATIONAL, NEVER BLOCKING.
+#
+# This is an EXPLORATORY signal (see docs/design/freethread.md), not a supported config. The engine
+# ships on the GIL build; this leg only tells us, on a weekly schedule, whether the engine still
+# installs + imports + smoke-tests under the free-threaded 3.14t interpreter, so a regression in a
+# dependency's cp314t wheel surfaces early. It is an early-warning tripwire, not a per-PR gate —
+# hence weekly (+ manual dispatch), not on every push/PR.
+#
+# IT MUST NEVER BLOCK A MERGE:
+#   * It is a SEPARATE workflow, deliberately not part of ci.yml's `ci-gate` (the required "CI gate"
+#     context). It is not in any `needs:` list a PR waits on.
+#   * The job AND its fragile steps are `continue-on-error: true`, so a red canary is an informational
+#     red check, never a failed required one.
+#   * DO NOT add the "freethread smoke (3.14t)" context to branch-protection required checks. The
+#     required set is the `test` matrix + bandit + pip-audit + cla — keep it that way.
+#
+# If actions/setup-python ever cannot provision 3.14t on the runner, the continue-on-error job simply
+# goes red as information; nothing downstream is gated on it.
+
+name: freethread smoke
+
+on:
+  # Weekly early-warning tripwire (Mondays 06:00 UTC) + manual dispatch. NOT per-PR/per-push: this is
+  # an informational cp314t-readiness signal, not a gate, so it doesn't need to run on every change.
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: freethread-${{ github.ref }}
+  cancel-in-progress: true
+
+# Read-only: install deps + run a pure test subset. No gh writes, no secrets.
+permissions:
+  contents: read
+
+jobs:
+  freethread:
+    name: freethread smoke (3.14t)
+    # The whole job is non-blocking: a failure here is reported but never fails the workflow's
+    # required-context resolution, so it cannot block a PR even if it is ever (mis)added to protection.
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false # read-only smoke job; don't persist the token (zizmor: artipacked)
+
+      # Provision the FREE-THREADED 3.14 interpreter (distinct cp314t ABI). `freethreaded: true` +
+      # the `t` suffix both select it; allow-prereleases covers the 3.14 line. This step is allowed to
+      # fail (continue-on-error) so a runner that cannot yet provide 3.14t never reds a blocking check.
+      - name: Set up free-threaded Python 3.14t
+        id: setup
+        continue-on-error: true
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: "3.14t"
+          freethreaded: true
+          allow-prereleases: true
+
+      # Install the CORE engine only (no Qt/SQL/DICOM/SFTP extras), so the smoke exercises the minimal
+      # free-threaded-relevant compiled surface: pydantic-core, cryptography, and the argon2-cffi + cffi
+      # chain. --prerelease handling: pip resolves the cp314t wheels; the cffi 2.0 chain may need a
+      # prerelease allowance depending on the index state at run time.
+      - name: Install the core engine (dev extra; no compiled-heavy extras)
+        if: steps.setup.outcome == 'success'
+        continue-on-error: true
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      # Prove we are actually on the no-GIL interpreter — an incompatible C extension importing can make
+      # CPython silently RE-ENABLE the GIL, which would make a "green" canary meaningless. Fail (softly)
+      # if the GIL is back on.
+      - name: Assert the GIL is actually disabled
+        if: steps.setup.outcome == 'success'
+        continue-on-error: true
+        run: |
+          python - <<'PY'
+          import sys
+          gil_on = sys._is_gil_enabled()
+          print(f"sys._is_gil_enabled() = {gil_on}")
+          print(f"sys.version = {sys.version}")
+          if gil_on:
+              raise SystemExit("GIL is ENABLED on the 3.14t build — an extension likely forced it back on")
+          PY
+
+      # Run a PURE, fast subset under 3.14t: parsing (pure HL7 library) + config wiring. This is the
+      # cheap install-and-import + smoke signal, NOT the perf experiment (that lives in the load harness,
+      # run manually — see docs/LOAD-TESTING.md / docs/design/freethread.md §4).
+      - name: Smoke a pure test subset under 3.14t
+        if: steps.setup.outcome == 'success'
+        continue-on-error: true
+        run: pytest -q tests/test_parsing.py tests/test_wiring.py

{messagefoundry-0.2.4 → messagefoundry-0.2.6}/.github/workflows/release.yml

@@ -34,16 +34,20 @@ on:
       - "v[0-9]+.[0-9]+.[0-9]+-*"  # pre-releases: v0.1.0-rc1, …
   workflow_dispatch:
 
-permissions:
-  contents: write       # create the release + upload its assets
-  id-token: write       # Sigstore signing, PyPI Trusted Publishing, + provenance — all via the GitHub OIDC identity
-  attestations: write   # write the SLSA build-provenance attestation (actions/attest-build-provenance)
+# Deny-all at the workflow level; each job below requests only the scopes it uses (least privilege).
+permissions: {}
 
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write       # create the release + upload its assets
+      id-token: write       # Sigstore signing, PyPI Trusted Publishing, + provenance — all via the GitHub OIDC identity
+      attestations: write   # write the SLSA build-provenance attestation (actions/attest-build-provenance)
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false  # release uses GH_TOKEN env / OIDC, never the persisted git credential
 
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
@@ -113,7 +117,7 @@ jobs:
       # `github.event.repository.private` is populated on the tag-push event.
       - name: Attest build provenance (SLSA) for sdist + wheel
         if: ${{ !github.event.repository.private }}
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: "dist/*.tar.gz, dist/*.whl"
 
@@ -171,8 +175,13 @@ jobs:
     # publish — so a missing harness PyPI project can never red a release.
     needs: release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write   # gh release upload (attach the harness wheel)
+      id-token: write   # PyPI Trusted Publishing (OIDC) for the harness wheel
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false  # gh upload uses GH_TOKEN env / OIDC, never the persisted git credential
 
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6

{messagefoundry-0.2.4 → messagefoundry-0.2.6}/.github/workflows/scorecard.yml

@@ -42,7 +42,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run Scorecard
-        uses: ossf/scorecard-action@v2 # TODO: SHA-pin (repo convention)
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif
@@ -54,6 +54,6 @@ jobs:
           path: results.sarif
           retention-days: 5
       - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@v3 # TODO: SHA-pin (repo convention)
+        uses: github/codeql-action/upload-sarif@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2
         with:
           sarif_file: results.sarif

{messagefoundry-0.2.4 → messagefoundry-0.2.6}/.github/workflows/security.yml

@@ -214,12 +214,12 @@ jobs:
   zizmor:
     name: zizmor (GitHub Actions static analysis)
     runs-on: ubuntu-latest
-    # ADVISORY for its first cycle (continue-on-error): static analysis of the workflow files THEMSELVES
-    # (Trail of Bits) — template injection, over-broad GITHUB_TOKEN permissions, unpinned `uses:`,
-    # artifact poisoning. Complements (and enforces) the by-hand SHA-pinning across these workflows.
-    # Once a baseline run is reviewed/clean, DELETE `continue-on-error` to make it blocking. (It will
-    # flag the `@v3` codeql-action tags in codeql.yml — that's the intended forcing function to pin them.)
-    continue-on-error: true
+    # BLOCKING: static analysis of the workflow files THEMSELVES (Trail of Bits) — template injection,
+    # over-broad GITHUB_TOKEN permissions, dangerous triggers, artifact-credential persistence. The
+    # baseline is clean — high-confidence findings are fixed in-tree (least-privilege per-job permissions,
+    # env-passed refs, persist-credentials: false) and the few safe-by-design ones are recorded with a
+    # justification in .github/zizmor.yml — so a NEW workflow-security regression now fails the build.
+    # Tune suppressions in .github/zizmor.yml (with a reason), not by relaxing this gate.
     permissions:
       contents: read
     steps:

messagefoundry-0.2.6/.github/zizmor.yml

@@ -0,0 +1,31 @@
+# zizmor configuration — https://docs.zizmor.sh/configuration/
+#
+# Each entry below is a REVIEWED, justified non-finding for this repo. Real fixes live in the workflow
+# files themselves (least-privilege permissions, env-passed refs, persist-credentials: false); this file
+# is only for findings that are safe-by-design here. Keep it small and commented — a suppression without
+# a reason is a latent vulnerability.
+rules:
+  dangerous-triggers:
+    ignore:
+      # A CLA assistant REQUIRES pull_request_target to record signatures + comment on fork PRs. This
+      # workflow never checks out untrusted PR code, pins the third-party action by SHA, and gates on the
+      # immutable comment body / event name — so the usual pull_request_target risk (running attacker
+      # code with a write token) does not apply. See the SECURITY note in cla.yml.
+      - cla.yml
+
+  artipacked:
+    ignore:
+      # artipacked flags a checkout that persists the token's git credential — a risk only if that
+      # credential can leak into an uploaded artifact. The jobs below do not push and never upload the
+      # repo/.git tree, so the persisted credential is inert noise here.
+      #
+      # NOT suppressed (fixed at the source instead): release.yml sets persist-credentials: false on both
+      # checkouts because it DOES upload build artifacts. dependabot-lock-resync.yml persists a
+      # narrowly-scoped App token ON PURPOSE to push the resynced locks (documented inline) and is listed
+      # here for that reason.
+      - benchmark.yml
+      - ci.yml
+      - dependabot-lock-resync.yml
+      - release-sync-check.yml
+      - security.yml
+      - vuln-metrics.yml

{messagefoundry-0.2.4 → messagefoundry-0.2.6}/CHANGELOG.md

@@ -6,6 +6,95 @@ All notable changes to MessageFoundry are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.2.6] — 2026-06-27 — Early Access
+
+A large release: the **throughput-maximization build** (high-fan-out store-once, multi-process
+sharding, and internal pass-through connectors with full Postgres/SQL Server parity), a console +
+IDE **"fleet" tier** for managing multiple engine shards, and a broad **security-hardening wave**
+from the 2026-06 audit.
+
+### Added
+- **Multi-process sharding (L3).** An inbound connection can carry an optional `shard` tag;
+  `serve --shard <id>` runs an engine process that owns only that shard's inbound connections
+  (outbound + routing/handlers are shared), and a new `supervise` command spawns, monitors, and
+  restarts one `serve` subprocess per shard (each with its own SQLite db file and API port).
+  Per-connection sharding parallelizes intake across CPU cores; per-channel FIFO is preserved
+  within a shard. (#584)
+- **Internal pass-through (PT) connectors (L4).** A Handler may `Send` into an internal
+  `PassThrough()` inbound that carries its own router; the message re-ingresses as a new
+  content-addressed child message inside the same transaction (at-least-once, count-and-log, and
+  single-finalizer authority all preserved), bounded by a correlation-depth loop guard. This
+  generalizes the ADR 0013 re-ingress primitive. Implemented on **all three store backends** —
+  SQLite, plus full **Postgres and SQL Server parity** for the atomic re-ingress. (#585, #590)
+- **Store-once-deliver-many (L2b).** A high-fan-out outbound now stores the message body **once**
+  (content-addressed, reference-counted `shared_body`) instead of once per destination;
+  single-destination delivery is unchanged (inline, byte-identical). (#580)
+- **Fleet tier — manage multiple engine shards.** The console can register and switch between
+  multiple engine endpoints (#582); the IDE promote flow can target a specific engine
+  instance/shard (#583).
+- **IDE editor productivity.** A MessageFoundry build toolbar + CodeLens on config files (#593),
+  an "Insert Element" quick-pick with expanded transform-idiom snippets (#595), a Wizards group
+  with collapsible Home groups (#578), and a `vsce` VSIX packaging script (#577).
+- **Config-fingerprint attestation.** Config reloads record a config fingerprint in the reload
+  audit (ADR 0041 load-path attestation). (#597)
+
+### Changed
+- **Faster fan-out.** On a fan-out the engine parses the per-message payload once where it is
+  value-identical, avoiding redundant re-parsing. (#581)
+
+### Fixed
+- **Fail-fast pass-through guard.** A graph with a PT inbound on a store backend that does not
+  implement PT re-ingress is now rejected at startup *and* on reload/dry-run (a clear configuration
+  error, HTTP 422) — before any listener binds — instead of failing at the first `Send`. (#587)
+- **Auth hardening.** Tighter field-level authorization, a last-admin guard, a corrected TOTP
+  window, and rate-limit documentation fixes. (#563)
+- **API / store.** Channel-scoped event and topology reads, faster WebSocket session revocation,
+  and atomic bootstrap-secret creation. (#565)
+- **IDE.** Workspace-trust gating, machine-scoped promote targets, and a fail-closed AI-assist
+  policy (SEC-004/005/022). (#561)
+
+### Security
+The 2026-06 security-audit remediation wave (in-repo remediation ledger, #566):
+- **Transport TLS / SSRF / injection:** FTPS TLS verification, an FHIR-path SSRF guard, and
+  read-only enforcement on `db_lookup` (SEC-001/010/009). (#560)
+- **Listener hardening:** a cleartext-bind guard plus source-IP allowlist for the raw-TCP/X12
+  listeners. (#558)
+- **DICOM:** fail-closed C-STORE SCP peer controls (calling-AE + peer-IP) and a passphrase-key
+  callback (SEC-012/016). (#559)
+- **Pipeline:** off-event-loop router/transform execution and a non-HL7 ingress size cap
+  (SEC-013/017). (#562)
+- **Config trust:** enforce Windows config-source trust and scope the sibling-helper finder
+  (SEC-003/019). (#564)
+- **PHI redaction:** narrowed a free-text PHI residual and added an advisory raise-fstring lint
+  (SEC-023). (#557)
+- **Supply chain:** Dependabot security-track guardrails and adopter-scaffold hash-pinning. (#556)
+- **Static analysis:** resolved two real CodeQL findings (webview HTML attribute escaping;
+  owner-only file-delivery fallback) (#554) and adopted a CodeQL triage policy + accepted-risk
+  register (ADR 0034). (#567)
+
+### Docs
+- ADRs 0037–0040 record the throughput-build decisions (multi-process sharding, pass-through
+  connectors, the shelved L5 DB-sharding design, and the not-adopted free-threading assessment)
+  (#591); design notes for L5 DB-sharding (#588) and cp314t readiness (#589); and the Secure
+  AI-Assisted Development Standards updated with the audit lessons (#576).
+
+## [0.2.5] — 2026-06-26 — Early Access
+
+A bug-fix release hardening SQL Server cluster cold-start.
+
+### Fixed
+- **SQL Server: concurrent schema-init race on a virgin DB (HA cold start).** Two cluster nodes starting
+  simultaneously against an empty database both ran the `IF OBJECT_ID(...) IS NULL CREATE TABLE` guards
+  with no cross-node lock, so both issued `CREATE` and the loser died at startup on a `2714` ("There is
+  already an object named ..."). `_ensure_schema` now takes an exclusive `sp_getapplock`
+  (`mefor:schema_init`) around the DDL — the T-SQL analog of the PostgreSQL store's existing schema
+  advisory lock — so the second node serializes and runs the now-no-op guarded CREATEs cleanly. Single-node
+  and pre-created schema are unaffected; SQLite and PostgreSQL were already race-safe. (#553)
+
+### Changed
+- Docs: the `[cluster]` settings docstring and the pool-size validation error now name both `postgres` and
+  `sqlserver` (the cross-section validator already admitted both). (#553)
+
 ## [0.2.4] — 2026-06-26 — Early Access
 
 A bug-fix release that completes the EF-6 SQL Server fix shipped in 0.2.3.
@@ -186,7 +275,9 @@ tests, but the external code review + penetration test (the bar for a security-c
 - Releases are built, SBOM'd (CycloneDX), and signed with [Sigstore](https://www.sigstore.dev/) — see the
   `release` workflow.
 
-[Unreleased]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.4...HEAD
+[Unreleased]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.6...HEAD
+[0.2.6]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.5...v0.2.6
+[0.2.5]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.4...v0.2.5
 [0.2.4]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.3...v0.2.4
 [0.2.3]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.2...v0.2.3
 [0.2.2]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.1...v0.2.2

{messagefoundry-0.2.4 → messagefoundry-0.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: messagefoundry
-Version: 0.2.4
+Version: 0.2.6
 Summary: Open-source healthcare integration engine — route, transform, and validate messages across many formats and connection types
 License-Expression: AGPL-3.0-or-later
 License-File: LICENSE