messagefoundry 0.2.5__tar.gz → 0.2.6__tar.gz

{messagefoundry-0.2.5 → messagefoundry-0.2.6}/.github/dependabot.yml

@@ -18,7 +18,10 @@ updates:
     # behavior), so a real advisory fix still arrives immediately. Pairs with the auto-merge
     # workflow: routine patches auto-merge AFTER aging; security patches auto-merge now.
     cooldown:
-      default-days: 3
+      # ~5-day aging window (DEPENDENCY-POSTURE-REVIEW.md) lengthens the malicious-fresh-publish
+      # dodge on the routine VERSION track; the SECURITY track still bypasses cooldown (Dependabot
+      # design), now backstopped by the published-GHSA gate in dependabot-auto-merge.yml (SEC-007 #2).
+      default-days: 5
       semver-major-days: 7
     groups:
       # Version-update grouping (applies-to defaults to version-updates).

messagefoundry-0.2.6/.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,165 @@
+name: Dependabot auto-merge
+
+# Scoped auto-merge for Dependabot PRs (A4 of the dependency fast-response plan).
+#
+# SAFE because main's required status checks are the gate: the full pytest suite, pip-audit, the
+# DEP-1 lock-sync check (incl. the A3 lock-resync commit), bandit/semgrep/gitleaks all must pass
+# before GitHub completes the merge. A bad bump turns CI red and never merges — auto-merge only
+# removes the human-latency on the safe, common case, not the safety net.
+#
+# IN SCOPE (auto-merged):
+#   - any PATCH update (incl. security patches — most security fixes are patches)
+#   - MINOR updates of DEV-only dependencies
+# OUT OF SCOPE (left for human review, surfaced same-day by the daily security cron + alerts):
+#   - MINOR/MAJOR updates of runtime deps, and ALL MAJOR updates
+#
+# Fresh-release supply-chain poisoning is handled upstream by the dependabot.yml `cooldown`
+# (routine updates age before a PR opens); SECURITY updates bypass cooldown by design, so a real
+# advisory fix still arrives immediately and (if a patch) auto-merges.
+#
+# SECURITY-TRACK GUARDRAILS (DEPENDENCY-POSTURE-REVIEW.md #2 and #3 — close SEC-007, CWE-829):
+#   #3 DENY-LIST — the auth/token/crypto stack (cryptography, argon2-cffi, fastapi, …) is NEVER
+#      auto-merged, not even for a patch: any such dep routes the PR to MANUAL review. A grouped
+#      PR that includes ANY denied dep is denied WHOLE (fail-safe — never partial-merge a group).
+#   #2 PUBLISHED-GHSA GATE — a SECURITY-track PR (which bypasses the cooldown by Dependabot design)
+#      auto-merges ONLY when a real, published, non-withdrawn advisory is confirmed against the
+#      dependency's PREVIOUS version (the axios-1.14.1 pattern). The advisory lookup FAILS CLOSED:
+#      a rate-limit/API error or no-matching-advisory routes to manual review, never auto-merge.
+#      The non-security VERSION track keeps its cooldown-aged auto-merge unchanged (already aged by
+#      dependabot.yml, so it does not need the GHSA gate).
+#
+# RESIDUAL ACCEPTED RISK: a malicious patch that BOTH rides a real concurrent published advisory
+# AND is not on the deny-list would still auto-merge. The deny-list shields the highest-value
+# (auth/crypto) deps unconditionally; the GHSA gate blocks the no-advisory fast-publish poison on
+# the security track; main's required CI (pip-audit/bandit/tests/lock-sync) backstops both.
+#
+# Why `pull_request` (not pull_request_target): a Dependabot `pull_request` run gets a read-only
+# GITHUB_TOKEN by default, which the `permissions:` block below elevates to exactly what the merge
+# API needs — no untrusted-code-with-secrets exposure, no GitHub App required. This is the pattern
+# GitHub documents for Dependabot auto-merge.
+
+on: pull_request
+
+permissions:
+  contents: write # complete the merge
+  pull-requests: write # enable auto-merge on the PR
+  security-events: read # read Dependabot alerts for the published-GHSA gate (#2)
+
+concurrency:
+  group: dependabot-automerge-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    # Only Dependabot's own PRs. pull_request.user.login is the immutable PR author, so an A3
+    # lock-resync `synchronize` (pushed by the App) still satisfies this — the author stays
+    # dependabot[bot] even though the triggering actor is the App.
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    timeout-minutes: 10
+    steps:
+      - name: Fetch Dependabot metadata
+        id: meta
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      # Guardrail #3 (DEPENDENCY-POSTURE-REVIEW.md): the auth/token/crypto stack NEVER auto-merges,
+      # not even a patch. dependency-names is comma-separated for grouped PRs; we deny the WHOLE
+      # group if ANY token matches (fail-safe — never partial-merge a group). Exact token match on
+      # the comma-split names (not a naive substring) so 'cffi' does not match 'argon2-cffi-bindings'
+      # and vice-versa.
+      - name: Reject security-critical deps (deny-list)
+        id: denylist
+        env:
+          DEP_NAMES: ${{ steps.meta.outputs.dependency-names }}
+        run: |
+          # Single source of truth for the security-critical deny-list.
+          denylist="cryptography argon2-cffi argon2-cffi-bindings paramiko ldap3 pyspnego \
+            fastapi starlette uvicorn pydantic pydantic-core python-jose pyjwt passlib bcrypt cffi"
+          deny=false
+          IFS=',' read -ra names <<< "$DEP_NAMES"
+          for raw in "${names[@]}"; do
+            # trim surrounding whitespace and lowercase
+            name="$(echo "$raw" | tr '[:upper:]' '[:lower:]' | xargs)"
+            [ -z "$name" ] && continue
+            for crit in $denylist; do
+              if [ "$name" = "$crit" ]; then
+                echo "::notice::'$name' is a security-critical dependency — routing to manual review (no auto-merge)."
+                deny=true
+              fi
+            done
+          done
+          echo "deny=$deny" >> "$GITHUB_OUTPUT"
+
+      # Guardrail #2 (DEPENDENCY-POSTURE-REVIEW.md): a SECURITY-track PR auto-merges ONLY when a
+      # real, published, non-withdrawn advisory covers the dependency's PREVIOUS version. The
+      # security track is detected by Dependabot's `dependency-group` (python-security/ide-security)
+      # — a security-update group — falling back to a present-but-empty group meaning version track.
+      # The advisory lookup FAILS CLOSED: any error or no-match leaves advisory_ok=false.
+      - name: Verify a published advisory backs the security track
+        id: ghsa
+        env:
+          DEP_NAMES: ${{ steps.meta.outputs.dependency-names }}
+          DEP_GROUP: ${{ steps.meta.outputs.dependency-group }}
+          PREV_VERSION: ${{ steps.meta.outputs.previous-version }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -u
+          # Is this the security track? Dependabot tags security-update grouped PRs with a
+          # *-security dependency-group. A non-security (version) PR has no security group.
+          is_security=false
+          case "$DEP_GROUP" in
+            *security*) is_security=true ;;
+          esac
+
+          if [ "$is_security" != "true" ]; then
+            # Version track: already cooldown-aged by dependabot.yml — the GHSA gate does not apply.
+            echo "security_track=false" >> "$GITHUB_OUTPUT"
+            echo "advisory_ok=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "security_track=true" >> "$GITHUB_OUTPUT"
+
+          # Require at least one matching published (non-withdrawn) advisory for EVERY named dep at
+          # the previous version. Query the global advisories endpoint (ecosystem pip — Python
+          # advisories are pip-keyed). Fail closed on any error.
+          advisory_ok=true
+          IFS=',' read -ra names <<< "$DEP_NAMES"
+          for raw in "${names[@]}"; do
+            name="$(echo "$raw" | tr '[:upper:]' '[:lower:]' | xargs)"
+            [ -z "$name" ] && continue
+            count="$(gh api -X GET /advisories \
+              -f ecosystem=pip \
+              -f affects="${name}@${PREV_VERSION}" \
+              --jq '[.[] | select(.withdrawn_at == null)] | length' 2>/dev/null || echo "ERR")"
+            if [ "$count" = "ERR" ] || [ -z "$count" ]; then
+              echo "::warning::advisory lookup failed for '$name' — failing closed (manual review)."
+              advisory_ok=false
+              break
+            fi
+            if [ "$count" -lt 1 ]; then
+              echo "::warning::no published advisory covers '${name}@${PREV_VERSION}' — failing closed (manual review)."
+              advisory_ok=false
+              break
+            fi
+            echo "::notice::published advisory confirmed for '${name}@${PREV_VERSION}'."
+          done
+          echo "advisory_ok=$advisory_ok" >> "$GITHUB_OUTPUT"
+
+      - name: Enable auto-merge for in-scope updates
+        # Auto-merge only when: (a) the update is an in-scope type (any patch, or a dev-only minor),
+        # AND (b) no security-critical dep is involved (deny-list #3), AND (c) for the SECURITY track
+        # ONLY, a published advisory is confirmed (#2). A non-security (version-track) patch keeps its
+        # cooldown-aged auto-merge — advisory_ok is not required there.
+        if: >-
+          steps.denylist.outputs.deny != 'true' &&
+          (steps.ghsa.outputs.security_track != 'true' ||
+           steps.ghsa.outputs.advisory_ok == 'true') &&
+          (steps.meta.outputs.update-type == 'version-update:semver-patch' ||
+           (steps.meta.outputs.update-type == 'version-update:semver-minor' &&
+            steps.meta.outputs.dependency-type == 'direct:development'))
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

messagefoundry-0.2.6/.github/workflows/freethread-smoke.yml

@@ -0,0 +1,95 @@
+# Free-threaded (no-GIL / PEP 703, cp314t) engine canary — INFORMATIONAL, NEVER BLOCKING.
+#
+# This is an EXPLORATORY signal (see docs/design/freethread.md), not a supported config. The engine
+# ships on the GIL build; this leg only tells us, on a weekly schedule, whether the engine still
+# installs + imports + smoke-tests under the free-threaded 3.14t interpreter, so a regression in a
+# dependency's cp314t wheel surfaces early. It is an early-warning tripwire, not a per-PR gate —
+# hence weekly (+ manual dispatch), not on every push/PR.
+#
+# IT MUST NEVER BLOCK A MERGE:
+#   * It is a SEPARATE workflow, deliberately not part of ci.yml's `ci-gate` (the required "CI gate"
+#     context). It is not in any `needs:` list a PR waits on.
+#   * The job AND its fragile steps are `continue-on-error: true`, so a red canary is an informational
+#     red check, never a failed required one.
+#   * DO NOT add the "freethread smoke (3.14t)" context to branch-protection required checks. The
+#     required set is the `test` matrix + bandit + pip-audit + cla — keep it that way.
+#
+# If actions/setup-python ever cannot provision 3.14t on the runner, the continue-on-error job simply
+# goes red as information; nothing downstream is gated on it.
+
+name: freethread smoke
+
+on:
+  # Weekly early-warning tripwire (Mondays 06:00 UTC) + manual dispatch. NOT per-PR/per-push: this is
+  # an informational cp314t-readiness signal, not a gate, so it doesn't need to run on every change.
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: freethread-${{ github.ref }}
+  cancel-in-progress: true
+
+# Read-only: install deps + run a pure test subset. No gh writes, no secrets.
+permissions:
+  contents: read
+
+jobs:
+  freethread:
+    name: freethread smoke (3.14t)
+    # The whole job is non-blocking: a failure here is reported but never fails the workflow's
+    # required-context resolution, so it cannot block a PR even if it is ever (mis)added to protection.
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false # read-only smoke job; don't persist the token (zizmor: artipacked)
+
+      # Provision the FREE-THREADED 3.14 interpreter (distinct cp314t ABI). `freethreaded: true` +
+      # the `t` suffix both select it; allow-prereleases covers the 3.14 line. This step is allowed to
+      # fail (continue-on-error) so a runner that cannot yet provide 3.14t never reds a blocking check.
+      - name: Set up free-threaded Python 3.14t
+        id: setup
+        continue-on-error: true
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: "3.14t"
+          freethreaded: true
+          allow-prereleases: true
+
+      # Install the CORE engine only (no Qt/SQL/DICOM/SFTP extras), so the smoke exercises the minimal
+      # free-threaded-relevant compiled surface: pydantic-core, cryptography, and the argon2-cffi + cffi
+      # chain. --prerelease handling: pip resolves the cp314t wheels; the cffi 2.0 chain may need a
+      # prerelease allowance depending on the index state at run time.
+      - name: Install the core engine (dev extra; no compiled-heavy extras)
+        if: steps.setup.outcome == 'success'
+        continue-on-error: true
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      # Prove we are actually on the no-GIL interpreter — an incompatible C extension importing can make
+      # CPython silently RE-ENABLE the GIL, which would make a "green" canary meaningless. Fail (softly)
+      # if the GIL is back on.
+      - name: Assert the GIL is actually disabled
+        if: steps.setup.outcome == 'success'
+        continue-on-error: true
+        run: |
+          python - <<'PY'
+          import sys
+          gil_on = sys._is_gil_enabled()
+          print(f"sys._is_gil_enabled() = {gil_on}")
+          print(f"sys.version = {sys.version}")
+          if gil_on:
+              raise SystemExit("GIL is ENABLED on the 3.14t build — an extension likely forced it back on")
+          PY
+
+      # Run a PURE, fast subset under 3.14t: parsing (pure HL7 library) + config wiring. This is the
+      # cheap install-and-import + smoke signal, NOT the perf experiment (that lives in the load harness,
+      # run manually — see docs/LOAD-TESTING.md / docs/design/freethread.md §4).
+      - name: Smoke a pure test subset under 3.14t
+        if: steps.setup.outcome == 'success'
+        continue-on-error: true
+        run: pytest -q tests/test_parsing.py tests/test_wiring.py

{messagefoundry-0.2.5 → messagefoundry-0.2.6}/.github/workflows/release.yml

@@ -117,7 +117,7 @@ jobs:
       # `github.event.repository.private` is populated on the tag-push event.
       - name: Attest build provenance (SLSA) for sdist + wheel
         if: ${{ !github.event.repository.private }}
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: "dist/*.tar.gz, dist/*.whl"
 

{messagefoundry-0.2.5 → messagefoundry-0.2.6}/CHANGELOG.md

@@ -6,6 +6,78 @@ All notable changes to MessageFoundry are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.2.6] — 2026-06-27 — Early Access
+
+A large release: the **throughput-maximization build** (high-fan-out store-once, multi-process
+sharding, and internal pass-through connectors with full Postgres/SQL Server parity), a console +
+IDE **"fleet" tier** for managing multiple engine shards, and a broad **security-hardening wave**
+from the 2026-06 audit.
+
+### Added
+- **Multi-process sharding (L3).** An inbound connection can carry an optional `shard` tag;
+  `serve --shard <id>` runs an engine process that owns only that shard's inbound connections
+  (outbound + routing/handlers are shared), and a new `supervise` command spawns, monitors, and
+  restarts one `serve` subprocess per shard (each with its own SQLite db file and API port).
+  Per-connection sharding parallelizes intake across CPU cores; per-channel FIFO is preserved
+  within a shard. (#584)
+- **Internal pass-through (PT) connectors (L4).** A Handler may `Send` into an internal
+  `PassThrough()` inbound that carries its own router; the message re-ingresses as a new
+  content-addressed child message inside the same transaction (at-least-once, count-and-log, and
+  single-finalizer authority all preserved), bounded by a correlation-depth loop guard. This
+  generalizes the ADR 0013 re-ingress primitive. Implemented on **all three store backends** —
+  SQLite, plus full **Postgres and SQL Server parity** for the atomic re-ingress. (#585, #590)
+- **Store-once-deliver-many (L2b).** A high-fan-out outbound now stores the message body **once**
+  (content-addressed, reference-counted `shared_body`) instead of once per destination;
+  single-destination delivery is unchanged (inline, byte-identical). (#580)
+- **Fleet tier — manage multiple engine shards.** The console can register and switch between
+  multiple engine endpoints (#582); the IDE promote flow can target a specific engine
+  instance/shard (#583).
+- **IDE editor productivity.** A MessageFoundry build toolbar + CodeLens on config files (#593),
+  an "Insert Element" quick-pick with expanded transform-idiom snippets (#595), a Wizards group
+  with collapsible Home groups (#578), and a `vsce` VSIX packaging script (#577).
+- **Config-fingerprint attestation.** Config reloads record a config fingerprint in the reload
+  audit (ADR 0041 load-path attestation). (#597)
+
+### Changed
+- **Faster fan-out.** On a fan-out the engine parses the per-message payload once where it is
+  value-identical, avoiding redundant re-parsing. (#581)
+
+### Fixed
+- **Fail-fast pass-through guard.** A graph with a PT inbound on a store backend that does not
+  implement PT re-ingress is now rejected at startup *and* on reload/dry-run (a clear configuration
+  error, HTTP 422) — before any listener binds — instead of failing at the first `Send`. (#587)
+- **Auth hardening.** Tighter field-level authorization, a last-admin guard, a corrected TOTP
+  window, and rate-limit documentation fixes. (#563)
+- **API / store.** Channel-scoped event and topology reads, faster WebSocket session revocation,
+  and atomic bootstrap-secret creation. (#565)
+- **IDE.** Workspace-trust gating, machine-scoped promote targets, and a fail-closed AI-assist
+  policy (SEC-004/005/022). (#561)
+
+### Security
+The 2026-06 security-audit remediation wave (in-repo remediation ledger, #566):
+- **Transport TLS / SSRF / injection:** FTPS TLS verification, an FHIR-path SSRF guard, and
+  read-only enforcement on `db_lookup` (SEC-001/010/009). (#560)
+- **Listener hardening:** a cleartext-bind guard plus source-IP allowlist for the raw-TCP/X12
+  listeners. (#558)
+- **DICOM:** fail-closed C-STORE SCP peer controls (calling-AE + peer-IP) and a passphrase-key
+  callback (SEC-012/016). (#559)
+- **Pipeline:** off-event-loop router/transform execution and a non-HL7 ingress size cap
+  (SEC-013/017). (#562)
+- **Config trust:** enforce Windows config-source trust and scope the sibling-helper finder
+  (SEC-003/019). (#564)
+- **PHI redaction:** narrowed a free-text PHI residual and added an advisory raise-fstring lint
+  (SEC-023). (#557)
+- **Supply chain:** Dependabot security-track guardrails and adopter-scaffold hash-pinning. (#556)
+- **Static analysis:** resolved two real CodeQL findings (webview HTML attribute escaping;
+  owner-only file-delivery fallback) (#554) and adopted a CodeQL triage policy + accepted-risk
+  register (ADR 0034). (#567)
+
+### Docs
+- ADRs 0037–0040 record the throughput-build decisions (multi-process sharding, pass-through
+  connectors, the shelved L5 DB-sharding design, and the not-adopted free-threading assessment)
+  (#591); design notes for L5 DB-sharding (#588) and cp314t readiness (#589); and the Secure
+  AI-Assisted Development Standards updated with the audit lessons (#576).
+
 ## [0.2.5] — 2026-06-26 — Early Access
 
 A bug-fix release hardening SQL Server cluster cold-start.
@@ -203,7 +275,8 @@ tests, but the external code review + penetration test (the bar for a security-c
 - Releases are built, SBOM'd (CycloneDX), and signed with [Sigstore](https://www.sigstore.dev/) — see the
   `release` workflow.
 
-[Unreleased]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.5...HEAD
+[Unreleased]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.6...HEAD
+[0.2.6]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.5...v0.2.6
 [0.2.5]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.4...v0.2.5
 [0.2.4]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.3...v0.2.4
 [0.2.3]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.2...v0.2.3

{messagefoundry-0.2.5 → messagefoundry-0.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: messagefoundry
-Version: 0.2.5
+Version: 0.2.6
 Summary: Open-source healthcare integration engine — route, transform, and validate messages across many formats and connection types
 License-Expression: AGPL-3.0-or-later
 License-File: LICENSE

{messagefoundry-0.2.5 → messagefoundry-0.2.6}/docs/BACKLOG.md

@@ -2208,6 +2208,215 @@ connection-event visibility. **Trigger:** a pilot/adopter asks for a connection-
 connect?") — confirmed against `transports/mllp.py`, `transports/tcp.py`, and the `wiring_runner.py` delivery
 loop; relationship to the #16 Corepoint event-log gap analysis (2026-06-17) + ADRs 0020/0021.
 
+## 48. IDE "Insert Element" — grow the scaffold-snippet library + a most-used-idiom quick-pick (P2)
+
+**The code-first answer to Corepoint's Action List "Add Action" palette.** Handlers and Routers are the core
+authoring surface; developers repeatedly drop the same ~12–15 idioms (field copy, format, date convert, code
+lookup, loop over repetitions, decision branch, `db_lookup`). Today's IDE scaffold snippets
+(`meforinbound`/`meforoutbound`/`meforrouter`/`meforhandler`) jump-start the *module* frame but not the in-body
+idioms — authors hand-type or hunt the docs. Grounded in a catalog of Corepoint's **71 Action List actions**
+(2026-06-27) mapped to our model: the pure `have`/`snippet` ones are exactly the high-frequency transform building
+blocks (`ItemCopy`/`ItemFormat`/`ItemTransformDate`/`ItemCodeLookup`/`ForEach`/`If-Else`/`ChooseFrom`/`Filter`/
+`MsgSend`/`MsgPass`).
+
+**Proposed shape (code-first — NOT #26's declined visual/declarative builder):**
+1. **Expand `ide/snippets/messagefoundry.code-snippets`** with ~12–15 *body-level* snippets that drop real,
+   editable Python inside a handler — e.g. `ItemCopy` → `msg.set("${1:dest}", msg.field("${2:src}"))`;
+   ForEach-reps → `for rep in msg.repetitions("${1:path}"):`; code lookup → `code_set("${1:name}").get(...)`;
+   date → `convert_hl7_timestamp(...)`; a `db_lookup(...)` template; `return Send("${1:outbound}", msg)`.
+2. **Add a `messagefoundry.insertElement` Command-Palette quick-pick** grouped by category (Field / Decision /
+   Loop / Lookup / Date / Data source / Send), each choice inserting its snippet via `editor.insertSnippet()`.
+
+Lean on the existing HL7-path completion (unchanged); assume handler-body context (the `newHandler`/`newRouter`
+scaffolds still own the outer frame). No new editor toolbar or sidebar — one Command-Palette command, keybindable.
+
+**Why this is not #26:** snippets drop **editable Python**, not declarative "configure-a-step" boxes — a typing
+accelerator, not a builder. Reaffirms the code-first identity (the strategic failure mode #26 guards against).
+**Effort:** S–M (snippets + one command + offscreen tests + `ide/README.md`). **Source:** Corepoint Action List
+"Add Action" palette review (2026-06-27) + the 71-action catalog / code-first mapping.
+
+**Status / follow-up:** shipped in **#595** (14 body-level idiom snippets + a `messagefoundry.insertElement`
+quick-pick that reads the same snippets file — one source of truth). Optional follow-up: also surface
+*Insert Element…* in the editor-title MessageFoundry dropdown (#593) for discoverability — #595 ships it
+Command-Palette-only by design.
+
+## 49. Export-to-Support diagnostic bundle — PHI-safe (P3, on-trigger)
+
+Corepoint's Console exports logs + config + version info for support escalation. We have no equivalent.
+**Proposed shape:** a `messagefoundry support-bundle` CLI (and/or admin-gated, step-up `POST /support/bundle`)
+that collects the engine version/uptime, a **secret-free** config summary (inbound/outbound/router/handler
+counts), a `GET /status` snapshot (DB size, disk-free, row counts — already exposed), and recent **app-log**
+lines, run through the existing PHI redaction before zipping. **No raw message bodies.** Good for the OSS support
+story (a one-attach bundle for a GitHub issue). **Why on-trigger:** nice-to-have; pull forward when an adopter
+must escalate a production issue. **Source:** Corepoint Service-menu + connection-log "Export to Support" review
+(2026-06-27).
+
+## 50. Operational-health gaps: app-log disk metering + a message-stall alert rule (P3)
+
+Most of Corepoint's Monitor Health/Metrics surface is **already built** — `GET /status` carries DB `size_bytes` +
+`disk_free_bytes`; the Connections dashboard carries per-connection `queue_depth`/`idle`/`delivered_age`/`errored`;
+the ADR 0014 alert engine already ships `queue_buildup`/`connection_stopped` rules. Two small deltas remain:
+- **App-log storage metering** — meter the app-log directory's disk usage (`shutil.disk_usage` / `pathlib.stat`)
+  and surface it in `GET /status` alongside the DB size, so operators see log-disk growth (Corepoint's
+  "Application Log Storage" health tile). Distinct from retention **#34** (which prunes the *store*).
+- **Message-stall alert rule** — a first-class alert when a connection's oldest-undelivered age (`delivered_age`)
+  crosses a per-connection threshold (Corepoint's "Max Message Stall"). The metric already exists; this just binds
+  it as an ADR 0014 rule.
+
+**Effort:** S each. **Source:** Corepoint Monitor Health + Metrics review (2026-06-27).
+
+## 51. Message-content search — HL7 field-path / raw-content matching in Log Search (P3, needs ADR)
+
+Corepoint operators search the message store by **content** ("PID-3 = A123456", "OBX-3 contains K7"). Our Log
+Search filters on metadata (status / time / channel / control-id) plus the per-message parse tree, but not by
+field-path/content **across** the store. **Proposed shape:** extend the `/messages` query with a content filter —
+start with a bounded raw-substring match, escalate to structured `HL7-path = value` if a field index is added.
+**Needs an ADR** on the indexing strategy (scan raw vs. pre-index key fields) and on **PHI-query auditing** (every
+content search touches PHI → audit + step-up + a bounded result count, reusing the existing message-access gates).
+**Why deferred:** indexing design + PHI-audit implications; pull forward when an operator needs clinical-content
+search. **Source:** Corepoint connection-log "Message Filters (HL7 path = value)" review (2026-06-27).
+
+## 53. Dual-control `config:deploy` — require a second approver for a reload (ADR 0041 D2) (P2)
+
+`POST /config/reload` is the broadest-blast-radius runtime action (it swaps the entire live graph, including any
+planted code) yet is gated by step-up re-verification **only** — a single re-authenticated operator applies it
+alone. The dual-control maker-checker machinery already exists ([`api/approvals.py`](../messagefoundry/api/approvals.py),
+used today for bulk dead-letter replay + connection purge); `config:deploy` is simply not in the gated set.
+**Shape:** add `config_reload` to the configurable `[approvals].operations`, so a **distinct** second approver
+releases it (the requester can never self-approve; both identities written to the hash-chained audit). **Opt-in /
+deny-by-default** — single-operator deployments are unchanged until enabled. Pairs with the ADR 0041 D1 fingerprint
+(the approver sees *which bytes* they are releasing). **Source:** insider-code-tampering review (2026-06-27);
+[ADR 0041](adr/0041-load-path-attestation-and-change-attribution.md) D2.
+
+## 54. Startup engine self-attestation vs `dist-info/RECORD` + enforced non-editable wheel (ADR 0041 D3) (P2)
+
+Install-time supply-chain integrity (hash-pinned `requirements.lock`, SLSA provenance, Sigstore signing) is never
+re-checked against the *running* bytes, so an admin with venv-write + restart rights can edit installed
+`messagefoundry` code in place (e.g. neuter `field_authz` redaction or the off-box audit tee) and it runs with **no
+audit row at all** — `messagefoundry verify` checks host/flow and `integrity-check` checks the DB, neither checks the
+code. **Shape:** at startup (and on demand) hash the loaded engine module files against the wheel's
+`*.dist-info/RECORD` (a zero-new-artifact baseline already shipped in the wheel); on drift, **fail-closed or alert
+(policy-driven)** and write a `startup_integrity` row to the hash-chained, off-box-teed audit. Tighten
+[ADR 0017](adr/0017-consumer-deployment-model.md)'s non-editable, hash-locked wheel from recommendation to the
+**enforced production default** (retire editable `pip install -e .` from prod docs); the attestation must be a
+no-op/advisory off an editable dev install so it never bricks development. **Source:** insider-code-tampering review
+(2026-06-27); [ADR 0041](adr/0041-load-path-attestation-and-change-attribution.md) D3.
+
+---
+
+## 52. Corepoint capability-parity gaps — prioritized roadmap input (2026-06-27)
+
+**Type:** competitive analysis → roadmap input (not a single build). A capability gap analysis of
+**Corepoint Integration Engine v8.1.0** vs MessageFoundry: **393 distinct capabilities**, each classified
+**HAS / PARTIAL / GAP / EXCEEDS / DECLINED** and **grep-verified against the codebase**.
+Tally: **HAS 133 · PARTIAL 147 · GAP 65 · EXCEEDS 27 · DECLINED 21**. Full report (local-only, gitignored):
+[`marketing/corepoint-gap-analysis.md`](marketing/corepoint-gap-analysis.md).
+
+This item is the **tracking anchor + cross-reference index**; promote individual rows below to their own
+numbered items as they're scheduled. Each line notes whether it maps to an **existing** backlog item/ADR or
+is a **NEW** candidate.
+
+**Major gaps (buyer-visible).**
+- **Inbound HTTP/REST/SOAP/FHIR listener** — no message-ingest HTTP surface; outbound clients only; the lone
+  HTTP surface is the loopback management API. *Already tracked:* **#7** (inbound HTTP listener) + ADR 0023
+  facade; FEATURE-MAP REST-IN/SOAP-IN/FHIR-IN deferred.
+- **Operator alert *state*** — active-vs-unresolved alert instances, acknowledge/resolve/suspend, escalation
+  tiers, content-based (Action-Point) alerting, day/time-aware thresholds. `alerts_active` is hard-stubbed to
+  0 (`api/models.py:250`). *Partly bounded by ADR 0014 (alerting scope); the resolvable-alert-state + escalation
+  model is **NEW** candidate work.*
+- **Turnkey disaster recovery** — engine-managed scheduled/on-demand backups, standby failover/failback, DR
+  reports. Today: config DR = redeploy-from-git, DB DR delegated to the DBA. **NEW** candidate.
+
+**Moderate-gap clusters.**
+- **Declarative HL7 modeling** — persistent custom message-definition model, derivatives/inheritance tree,
+  conformance tester + auto-repair (Fix-All), CDA/C-CDA/HL7-v3, NCPDP. *XML/CDA partly **#31**; X12-strict/999
+  **#32**; the custom-definition + derivatives + NCPDP pieces are **NEW**.* (MeFor works at the data layer; this
+  is the code-first identity, but real migration friction for modeling-heavy estates.)
+- **Correlation object UX** — first-class bidirectional multi-partner *correlation* artifact, auto-match-by-
+  description, qualified/non-singular correlations, visual correlation editor (plain code sets/lookups **are**
+  covered — ADR 0006). **NEW**.
+- **Operational / monitoring** — browser/web monitor (MeFor console is PySide6 desktop), host/system metrics
+  (CPU/mem/SQL internals), historical metrics charting, live status-colored data-flow graph, bulk/multi-select
+  console connection control. *App-log disk metering + message-stall alert = **#50**; HL7-path/content log search
+  = **#51**; per-connection start/stop **API already exists** (`POST /connections/{name}/start|stop|restart`).
+  Web monitor + host metrics + historical charts + bulk console control are **NEW**.*
+- **DB & web-service breadth** — Oracle / MySQL / generic-ODBC-DSN; stored-proc OUT/return-value binding;
+  WSDL import → type-tree + validate-against-WSDL; synchronous in-transform WSCall (vs MeFor's pure-transform
+  invariant); generic OAuth2-client-credentials / Digest / NTLM; FHIR search/read + CapabilityStatement;
+  dynamic per-message HTTP headers. *FHIR base = **#20** / **#35**; Oracle/MySQL = FEATURE-MAP "Later"; the rest **NEW**.*
+- **Security** — user-definable custom RBAC roles (6 fixed roles + per-channel scope today); PKCS#12/.pfx cert
+  import + cert inventory + trust-flag UX (PEM-only today); self-signed cert generation; explicit FIPS-mode
+  attestation. **NEW** (openssl/PKI-replaceable).
+
+**Minor gaps (summarized — full list in the report).** sender inter-message pacing; MSA-2↔MSH-10 response
+matching; FTPS implicit/active-passive + SFTP keyboard-interactive; TCP keep-alive/persistent-reconnect;
+rich file-output disposition (archive-to-dated-subfolder, append, header/trailer, enqueue-empty toggle);
+SMTP/POP3-IMAP mail + S3/cloud-blob + JMS transports; HL7 timestamp/age/LOS helpers; integrated hex +
+profiling/coverage panes + HL7-aware before/after diff; inbound ACK/NAK persistence (*ADR 0021 / **#16***);
+per-connection retention windows (***#34***); embedded-doc pruning (***#47***); Export-to-Support bundle
+(***#49***); auto-generated interface docs; searchable in-product KB; edit-a-stored-message-before-resend
+(*tension with the purity/at-least-once invariant — bordering on declined*).
+
+**Declined by design (NOT gaps).** No-code / visual / template-driven authoring (***#26***, CLAUDE.md §12);
+the "channel"/"route" bundling element — hence no Org→App→Connection hierarchy/health-roll-up or subscription
+pools (CLAUDE.md §1); side-effecting / synchronous-external-call transforms incl. CommandLineCall/COM (purity
+invariant; sole carve-out = read-only `db_lookup`, ADR 0010); license-key / per-seat gating; active-active
+horizontal scale-out (dropped 2026-06-18); DB-tier backup/HA/restore mechanics (delegated to the DBA);
+serial / ASTM lab-instrument connectivity (***#27***).
+
+**Where MeFor already exceeds Corepoint (so gaps stay in context).** Broker-free transactional staged
+at-least-once pipeline; full-Python transforms (superset of the action-list DSL); git-native config/repository;
+hash-chained tamper-evident audit + off-box PHI-redacted SIEM tee; Prometheus/OTel telemetry; DICOMweb STOW-RS
++ SMART Backend Services (neither shipped by Corepoint); a real debugpy step-through debugger + Test Bench;
+fail-closed de-identification framework (ADR 0030). Across the great majority of the 16 domains MeFor matches
+or exceeds Corepoint — the gaps concentrate in inbound-HTTP, operator-alert-state, declarative
+modeling/correlation UX, and packaged DR/ops tooling.
+
+**Caveat.** Capability **presence ≠ production maturity** — a HAS/PARTIAL marks that a code-first or built
+mechanism exists, not that it is hardened or feature-complete to Corepoint's depth. Where the models differ
+structurally (code-first vs no-code; flat by-name graph vs object hierarchy; one store vs four DBs; git vs
+proprietary repository), "equivalent" means the buyer-facing *outcome* is met even when ergonomics differ.
+
+**Source:** owner request (2026-06-27) — identify the capability gaps between Corepoint and MessageFoundry.
+Per-domain gap classification, grep-verified against the codebase, with adversarial review. Relates to
+**#7**, **#16**, **#20**, **#26**, **#27**, **#31**, **#32**, **#34**, **#35**, **#46**, **#47**, **#49**,
+**#50**, **#51**, and ADRs 0010 / 0014 / 0021 / 0023.
+
+## 55. CI: intermittent `windows-2022` pytest hang — whole job times out at the 15-min cap (P2)
+
+**Symptom:** the `test (windows-2022, py3.14)` leg **intermittently hangs ~25% into the suite** and emits **no
+further output for ~12 minutes** until the job hits its 15-minute cap and is cancelled — a red ✗, not a test
+assertion failure. `pytest-timeout` does **not** fire, so the hang is something its (thread-based) method can't
+interrupt on Windows — a blocking syscall / socket-accept / subprocess wait rather than a Python-level deadlock.
+The other legs (`ubuntu`, `windows-2025`) pass.
+
+**Evidence (2026-06-27):** PR #596 — a **one-line `BACKLOG.md` edit** — timed out on `windows-2022` **twice**
+(run 28296717204, original + a `--failed` re-run), each at exactly 15m. The same suite **passed** on
+`windows-2022` for #595 minutes earlier (~5m34s). Last pytest progress line at `[ 25%]` (17:58:28), then silence
+to `##[error]The operation was canceled.` at 18:10:26. #596 was ultimately **admin-merged** past the flaky check.
+
+**Impact:** flaky red on **unrelated** PRs (incl. docs-only); because `windows-2022` is a **required** check it
+wedges merges until a re-run happens to pass or an admin override is used (~15 min burned per hang).
+
+**Prior art:** the resolved/obsolete **#17** (the old `py3.11` leg hang — a CPython 3.11 asyncio cancellation
+race in `TeeRelay.stop()`, fixed via a sentinel shutdown; the py3.11/3.13 legs were since removed). This is a
+**new** occurrence on `windows-2022` / py3.14 — same *class* (a Windows asyncio/socket hang `pytest-timeout`
+can't interrupt), different test.
+
+**Proposed (when picked up):**
+1. **Surface the culprit** — add a tight per-test `--timeout=<n>` so a hang **fails that one test fast** and
+   names it instead of silently cancelling the whole job at 15m; dump a `faulthandler` traceback on timeout to
+   pin the stuck frame. (Note the limits of `--timeout-method=thread` on Windows: a true socket-accept hang is
+   not interruptible by it.)
+2. **Find + fix the test** — the stall is ~25% into collection order on `windows-2022`; likely an MLLP/TCP
+   listener or subprocess test whose teardown wedges on that runner. Make its teardown forcibly cancel + close
+   the listener (the #17 sentinel-shutdown pattern).
+3. **CI guard** — a step-level no-output watchdog that fails the job well before 15m so a flake doesn't burn the
+   full budget.
+
+**Priority:** **P2** — intermittent, but a *required* check that wedges unrelated PRs. **Source:** #596 CI
+investigation (2026-06-27).
+
 ---
 
 *Everything else from the 2026-06-10 full-codebase review (1 critical, 13 high, 33 medium, 31 low —