messagefoundry 0.2.8__tar.gz → 0.2.10__tar.gz

{messagefoundry-0.2.8 → messagefoundry-0.2.10}/.github/workflows/ci.yml

@@ -23,9 +23,11 @@ jobs:
   test:
     name: test (${{ matrix.os }}, py${{ matrix.python-version }})
     runs-on: ${{ matrix.os }}
-    # Wall-clock backstop: bound each leg so a hung test fails in minutes, not the 6h default. The
-    # pytest-timeout watchdog (60s/test) should catch a culprit first; this is the belt-and-suspenders cap
-    # if a whole process ever deadlocks below pytest.
+    # Wall-clock backstop: bound each leg so a hung test fails in minutes, not the 6h default. Three
+    # nested watchdogs catch a hang at increasing scope (#55): the pytest-timeout per-test cap (60s,
+    # pyproject addopts) + the faulthandler belt fire FIRST and name the stuck frame; the pytest STEP
+    # has its own `timeout-minutes: 13` so a process-level deadlock below pytest fails the step fast;
+    # this job cap is the outermost belt if even that is somehow out-raced.
     timeout-minutes: 15
     strategy:
       fail-fast: false
@@ -56,7 +58,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libegl1 libgl1 libxkbcommon0 libdbus-1-3
 
-      - name: Install project (dev + console + fhir + dicom extras)
+      - name: Install project (dev + console + fhir + dicom + x12 + xml extras)
         run: |
           python -m pip install --upgrade pip
           # [fhir] so the FHIR typed-tier tests (incl. the PHI-no-leak invariant, ADR 0022) actually
@@ -64,7 +66,9 @@ jobs:
           # [dicom] (pydicom + pynetdicom; ADR 0025) does the same for the DICOM codec + C-STORE SCP
           # tests, and lets mypy type-check transports/dicom.py + parsing/dicom/ against the real
           # (py.typed) libraries rather than treating them as Any.
-          pip install -e ".[dev,console,fhir,dicom]"
+          # [x12] (pyx12) + [xml] (lxml/xmlschema/signxml) likewise so the strict X12 validation (#32)
+          # and the hardened XML/SOAP codec (#31) tests run their assertions instead of importorskip-skipping.
+          pip install -e ".[dev,console,fhir,dicom,x12,xml]"
 
       - name: Lint (ruff)
         run: ruff check messagefoundry tests
@@ -75,10 +79,27 @@ jobs:
       - name: Type-check (mypy, strict)
         run: mypy messagefoundry
 
+      # Step-level watchdog UNDER the 15-min job cap (#55): the windows-2022 leg intermittently
+      # wedges ~25% in (a Windows ProactorEventLoop listener-teardown / socket wait that the shared
+      # session event loop can't get past), emits no output for ~12 min, then the JOB cap CANCELS it
+      # — a red ✗ with no stack and no named test. Two belts make that fail FAST and NAMED instead:
+      #   * `--timeout-method=thread` (the ONLY method on Windows — SIGALRM is POSIX-only) dumps ALL
+      #     thread stacks at the per-test cap (60s, set in pyproject addopts), naming the stuck frame.
+      #   * PYTHONFAULTHANDLER=1 + `-o faulthandler_timeout=90` is the belt that fires even when the
+      #     thread-timer CANNOT interrupt a main-thread C-level wait (a Proactor overlapped op /
+      #     blocking accept / subprocess.wait): pytest's faulthandler plugin arms a separate watchdog
+      #     thread that dumps the NATIVE stack of every thread at 90s (> the 60s pytest-timeout, so the
+      #     per-test dump is attributed first; this is the last-resort stack when the thread method is
+      #     itself out-raced). NB the plugin exposes this as the `faulthandler_timeout` ini key, not a
+      #     `--faulthandler-*` CLI flag, so it is passed with `-o`; it only DUMPS (never kills), safe.
+      # The step `timeout-minutes: 13` is the outer backstop, well under the job's 15-min cap, so a
+      # hang both watchdogs somehow miss still fails the STEP (not the whole job at the silent cap).
       - name: Tests (pytest)
+        timeout-minutes: 13
         env:
           QT_QPA_PLATFORM: offscreen
-        run: pytest -q
+          PYTHONFAULTHANDLER: "1"
+        run: pytest -q -o faulthandler_timeout=90
 
   # Build + type-check the VS Code extension, and run its integration tests. The Python jobs never
   # touch ide/, so a dep bump or IDE code change that breaks the bundle or the types would otherwise
@@ -592,7 +613,14 @@ jobs:
           # install-service.ps1 -Environment threads it into the service command + resolves
           # environments/prod.toml). INFO not DEBUG: `serve` refuses DEBUG in prod (Gate #1 — DEBUG can
           # surface PHI); INFO is enough to smoke service start + MLLP.
-          .\scripts\service\install-service.ps1 -AppExe $exe -LogLevel INFO -Environment prod
+          # -LockConfigDir: the runner checks out samples/config with the default ACL, which grants
+          # BUILTIN\Users (S-1-5-32-545) write. The in-process config-source trust guard (SEC-003,
+          # wiring._assert_safe_config_source_windows) then REFUSES to load it ("writable-by-others
+          # path") and `serve` crash-loops to SERVICE_PAUSED, so /health never comes up. Locking the
+          # config dir (strip inheritance -> SYSTEM/Administrators only; the LocalSystem service still
+          # reads it) is the production-correct posture docs/SERVICE.md prescribes, and exercises the
+          # real -LockConfigDir install path rather than the MEFOR_ALLOW_INSECURE_CONFIG_SOURCE dev escape.
+          .\scripts\service\install-service.ps1 -AppExe $exe -LogLevel INFO -Environment prod -LockConfigDir
           # The shipped samples graph includes a mutual-TLS WS-* SOAP feed (IB_IMMUNIZATION_VXU) whose
           # connector LOADS its client cert at wiring time, so the engine refuses to start the graph
           # without a readable cert+key. Mint a throwaway pair for the smoke — the smoke sends only an

{messagefoundry-0.2.8 → messagefoundry-0.2.10}/CHANGELOG.md

@@ -6,6 +6,121 @@ All notable changes to MessageFoundry are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.2.10] — 2026-06-27 — Early Access
+
+The **Plan-5 "v0.3 candidate" wave** — completing the deferred connector/codec set and the Corepoint
+parity gaps, built across two multisession waves (L1–L9) and adversarially reviewed. All on-prem,
+code-first, no behavior change to existing graphs.
+
+### Added
+- **Inbound HTTP / REST listener** (#7, [ADR 0023](docs/adr/0023-inbound-http-listener.md)) — a
+  connector-owned bound `asyncio` HTTP/1.1 socket **source** in `transports/` (not `api/`), feeding the
+  payload-agnostic ingress (ADR 0004) as a `RawMessage`. ACK-on-receipt (respond-with-receipt **after** the
+  raw is durably committed), with oversize/malformed/slow-loris hardening surfaced as `connection_event`s;
+  new `ConnectorType.HTTP`. The substrate for the future inbound FHIR facade (#20) / DICOMweb receiver (#24).
+  *(SOAP-envelope sync-reply, intake-socket auth, and method/path routing metadata are deferred follow-ons.)*
+- **`fhir_lookup(connection, query)`** (#58, [ADR 0043](docs/adr/0043-fhir-read-lookup.md)) — a Handler-callable,
+  **read-only** FHIR read/search that extends the ADR 0010 `db_lookup` carve-out to FHIR: off the event loop,
+  raises on a Router / in dry-run, reuses the SMART Backend bearer (ADR 0024) + `[egress].allowed_http`, GET-only.
+- **Email / SMTP outbound destination** (#23, [ADR 0029](docs/adr/0029-email-smtp-destination.md)) — a stdlib
+  `Email()`/`SMTP()` connector; STARTTLS-by-default, AUTH-over-TLS-only, a new deny-by-default
+  `[egress].allowed_smtp` arm. (IMAP/POP read + XOAUTH2 is a deferred Phase 2.)
+- **X12 strict implementation-guide validation** via `pyx12` (#32) behind the tolerant `X12Peek`/`X12Message`
+  hot path (`messagefoundry[x12]`; yields 997/999 acks), and a **structured `[xml]` codec layer** (#31) —
+  `XmlMessage` (XPath read/set + ns-aware re-encode) over **hardened lxml** + optional `xmlschema`/`signxml`
+  (`messagefoundry[xml]`; XXE / entity-expansion / external-DTD refused).
+- **Operator alert-state** (#56, [ADR 0044](docs/adr/0044-operator-alert-state.md)) — a new `alert_instance`
+  store table (open / acknowledged / resolved + first/last-seen + count) across all three backends, de-duped on
+  the ADR-0014 throttle key; `GET /alerts/active` + ack/resolve (RBAC `MONITORING_DIAGNOSE`); the per-connection
+  `alerts_active` count is now real; a console Alerts tab. Metadata-only.
+- **User-definable custom RBAC roles** (#57, [ADR 0045](docs/adr/0045-custom-rbac-roles.md)) — an admin-defined
+  named role = a chosen **subset** of the existing Permission catalog (no new permission kinds), persisted via an
+  additive `roles` migration (3 backends), gated by `USERS_MANAGE`; the six built-ins stay; narrowing revokes on
+  live sessions.
+- **Message-content search** (#51, [ADR 0046](docs/adr/0046-message-content-search.md)) — HL7 field-path /
+  raw-content matching by **scan-and-decrypt-per-row** (the store is AES-GCM-encrypted at rest, so a plain `LIKE`
+  is impossible): metadata-pre-filtered, hard row/result caps (truncate-and-tell), decrypt off the event loop,
+  behind `messages:view_*` + **step-up** + a `message_search` audit row that never logs the search needle.
+- **HL7 timestamp helpers on `Message`** (#59) — `age`-from-DOB, length-of-stay, and the tolerant HL7-TS parse
+  surfaced on the `Message` API (reusing `timezone.py`; no duplicate parser).
+- **`messagefoundry support-bundle`** CLI (#49) — a PHI-safe diagnostic zip (no message bodies, no secrets;
+  redacted log tail) — and a **zero-egress version update-check** (#30,
+  [ADR 0026](docs/adr/0026-off-box-egress-update-check.md)): a no-network pinned-vs-current diff surfaced as a
+  `/status` field + an `update_available` alert + a console banner (on by default; `mode=live` rejected at load).
+
+### Changed
+- `[egress]` gains `allowed_smtp` (email); the read-only-lookup carve-out (CLAUDE.md §2/§8) now names
+  `fhir_lookup` alongside `db_lookup`.
+- New connectors/codecs are documented in [`docs/CONNECTIONS.md`](docs/CONNECTIONS.md) and the update-check in
+  [`docs/CONFIGURATION.md`](docs/CONFIGURATION.md) (`[update_check]`).
+
+### Security
+- All new live-lookup / search paths stay on-prem and gated: `fhir_lookup` and the update-check are zero-/
+  allow-listed-egress; content search is step-up-gated + audited and never weakens at-rest encryption (the
+  cleartext key-field index was **declined**; a keyed-token index is a deferred 2nd slice). New crypto sites
+  (`transports/http_listener.py` TLS) are registered in the ASVS-11.1.3 crypto inventory.
+
+### Dependencies
+- New optional extras only: `messagefoundry[x12]` (`pyx12`) and `messagefoundry[xml]`
+  (`lxml`/`xmlschema`/`signxml`); the base install is unchanged. Lockfile re-exported.
+
+## [0.2.9] — 2026-06-27 — Early Access
+
+A retention + security-hardening + observability release: per-connection retention and
+embedded-document pruning windows, dual-control config reloads with startup code-attestation,
+operational-health metrics, and a fix for the intermittent Windows listener-teardown / CI hang.
+
+### Added
+- **Per-connection retention windows (ADR 0027).** Optional `messages_days` (inbound) and
+  `dead_letter_days` (outbound) on a connection, layered over the global `[retention]` window and
+  authored on the connection spec or `connections.toml` (the same override idiom as the delivery
+  knobs): `None` inherits the global window, `0` keeps forever. The `RetentionRunner` threads a
+  per-connection cutoff through the body and dead-letter purge on **all three** store backends; the
+  never-purge-an-in-flight-body guard and the single per-pass audit row (now recording the overrides)
+  are unchanged. (#34)
+- **Embedded-document pruning (ADR 0042).** Optional `prune_documents_after` (+ a size threshold)
+  per inbound connection: after the window, bulky **base64 embedded documents** — HL7 **OBX-5 ED**
+  and the generic `mfb64:v1:` carriage — are stripped **in place** to a small size/content-type
+  tombstone (via the parsed model / codec, **never** string-slicing HL7), keeping the rest of the
+  message parseable; the row is never deleted and a `documents_pruned` flag is set. All three
+  backends. (The ingest-time offload variant remains deferred.) (#47)
+- **Dual-control `config:reload` (ADR 0041 D2).** `config_reload` is now a gateable
+  `[approvals].operations` op — a **distinct** second approver must release a live config reload
+  (the requester can never self-approve; both identities land in the hash-chained audit). Opt-in /
+  deny-by-default, so single-operator deployments are unchanged. (#53)
+- **Startup code self-attestation (ADR 0041 D3).** At startup the engine hashes its loaded modules
+  against the wheel's `dist-info/RECORD`; on drift it records a hash-chained, off-box-teed
+  `startup_integrity` audit row and raises an alert (**alert-only by default**; opt-in
+  `[integrity].fail_closed_on_drift` refuses to start). A no-op on an editable (`pip install -e .`)
+  install, so development is never bricked. (#54)
+- **Operational-health metrics.** `GET /status` now meters the app-log directory's disk usage
+  alongside the database, and a per-connection **message-stall** alert rule fires when a connection's
+  oldest-undelivered age crosses a configurable threshold. (#50)
+
+### Changed
+- **Non-editable, hash-locked wheel is the enforced production default (ADR 0017 amendment).** The
+  prior recommendation is now the default for production deployments; editable installs remain a
+  no-op for development. (#54)
+
+### Fixed
+- **Intermittent Windows listener-teardown hang.** `MLLPSource` / `TcpSource` / `X12Source` no longer
+  `await server.wait_closed()` / `writer.wait_closed()` **unbounded** on the Windows Proactor loop
+  during teardown — a wait that never completes can no longer stall a shared event loop (the same
+  class as the resolved py3.11 hang). Added CI guards (a per-test `faulthandler` stack dump and a
+  step-level watchdog) so a future hang fails fast and names itself instead of silently timing out. (#55)
+
+### Docs
+- Refreshed `benchmarks/TUNING-BASELINE.md` with measured multi-process sharding throughput from the
+  Windows Server 2025 box (η ≈ 0.85 speedup shape; per-shard E_core ≈ 42 msg/s — a test-box SQLite
+  floor), plus the still-unmeasured hardware-gated follow-ups (enterprise E_core, the shared-DB
+  commit-wall sweep). (#28, #29)
+- Authored **ADR 0027** (per-connection retention) and **ADR 0042** (embedded-document pruning); added
+  EARS acceptance criteria to **ADR 0041** D2/D3; amended **ADR 0017** for the enforced wheel.
+
+### CI
+- Locked the smoke job's config directory (#603) and skipped a mirror-only Dependabot guardrail test
+  on the OSS mirror (#606), greening `main` CI post-0.2.8.
+
 ## [0.2.8] — 2026-06-27 — Early Access
 
 A tooling/ops release: the load harness gains a **multi-shard driver** so one harness can drive a
@@ -339,7 +454,9 @@ tests, but the external code review + penetration test (the bar for a security-c
 - Releases are built, SBOM'd (CycloneDX), and signed with [Sigstore](https://www.sigstore.dev/) — see the
   `release` workflow.
 
-[Unreleased]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.8...HEAD
+[Unreleased]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.10...HEAD
+[0.2.10]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.9...v0.2.10
+[0.2.9]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.8...v0.2.9
 [0.2.8]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.7...v0.2.8
 [0.2.7]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.6...v0.2.7
 [0.2.6]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.5...v0.2.6

{messagefoundry-0.2.8 → messagefoundry-0.2.10}/CLAUDE.md

@@ -100,10 +100,12 @@ drains independently (a slow/failing one never blocks siblings); routing and tra
 queued stages, so a slow/hung router or transform can no longer stall intake — or each other. At-
 least-once now relies on a re-run re-deriving identical output, so **routers and transforms must be
 pure** (message in → message out, no external side effects); outbound connections must still be
-**idempotent**. *Carve-out (ADR 0010):* a Handler may make a **live, read-only** database read via
-`db_lookup(connection, statement, params)` — the result may differ on a re-run, **accepted by design**
-(it reflects the database at that pass). It is the one sanctioned non-pure input: read-only, gated by
-`[egress].allowed_db`, run **off the event loop**, and unavailable on a Router or in dry-run (it raises).
+**idempotent**. *Carve-out (ADRs 0010/0043):* a Handler may make a **live, read-only** lookup — a
+database read via `db_lookup(connection, statement, params)` (gated by `[egress].allowed_db`) or a FHIR
+read/search via `fhir_lookup(connection, query)` (ADR 0043; gated by `[egress].allowed_http`, reusing the
+SMART bearer, GET-only) — the result may differ on a re-run, **accepted by design** (it reflects the source
+at that pass). These are the sanctioned non-pure inputs: read-only, run **off the event loop**, and
+unavailable on a Router or in dry-run (they raise).
 
 **Count-and-log invariant (do not break):** **every received message is persisted before the ACK**
 (status `RECEIVED` at the ingress stage), so inbound counts still reflect the true received volume and
@@ -201,6 +203,17 @@ diverge enough to warrant it; keep this root file general.
 - Paste/point at the relevant existing code alongside a plan request; it measurably improves
   results.
 
+### Prefer Ultracode for substantive work
+- Before starting any substantive / non-trivial task, **check whether ultracode is enabled this
+  session** (an `ultracode` system-reminder confirms it). If it is **not**, **warn the user up
+  front and offer to do the work in ultracode** — a **Workflow** (multi-agent, adversarially
+  verified) is the preferred mode here — before proceeding.
+- You **cannot enable ultracode yourself**: it is **session-only** and opt-in by keyword. So the
+  offer is *re-send the request with the keyword "ultracode"*, **or** confirm they want to proceed
+  solo — never claim to "switch it on", and don't auto-run a Workflow without the opt-in.
+- **Solo only on conversational turns or trivial mechanical edits** — don't nag there. The warn-
+  and-offer gate is for non-trivial build/design/debug work, alongside the planning gate above.
+
 ### Keep context clean
 - One logical task per session. After ~two failed attempts at the same problem, `/clear` and
   restart with a better prompt incorporating what was learned — don't grind in a polluted
@@ -319,8 +332,9 @@ python samples/send_mllp.py samples/messages/adt_a01.hl7
 - **Preserve the original raw message** in the store alongside the transformed form, so an
   operator always sees what actually arrived.
 - Keep transforms **pure where possible**: message in → message out; side effects (DB, network)
-  belong in connections/transports. The one sanctioned exception is a **read-only** `db_lookup` (ADR
-  0010) for live enrichment/gating (provider/eligibility lookups) — never a write or other side effect.
+  belong in connections/transports. The sanctioned exceptions are the **read-only** `db_lookup` (ADR
+  0010) and `fhir_lookup` (ADR 0043) for live enrichment/gating (provider/eligibility lookups) — never a
+  write or other side effect.
 - **ACK/NAK:** generate proper AA/AE/AR for MLLP inbound connections; the ack mode (original vs
   enhanced vs none) is **configurable per inbound connection** (`AckMode`). Under the staged
   pipeline the ACK is **on receipt** (`ack_after=ingest`, the default — `AckAfter`): decode/parse/

{messagefoundry-0.2.8 → messagefoundry-0.2.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: messagefoundry
-Version: 0.2.8
+Version: 0.2.10
 Summary: Open-source healthcare integration engine — route, transform, and validate messages across many formats and connection types
 Project-URL: Homepage, https://messagefoundry.org/
 Project-URL: Documentation, https://messagefoundry.org/
@@ -66,6 +66,12 @@ Provides-Extra: sftp
 Requires-Dist: paramiko>=5.0; extra == 'sftp'
 Provides-Extra: sqlserver
 Requires-Dist: aioodbc>=0.5; extra == 'sqlserver'
+Provides-Extra: x12
+Requires-Dist: pyx12>=4.0.0; extra == 'x12'
+Provides-Extra: xml
+Requires-Dist: lxml>=6.0.0; extra == 'xml'
+Requires-Dist: signxml>=4.0.0; extra == 'xml'
+Requires-Dist: xmlschema>=4.0.0; extra == 'xml'
 Description-Content-Type: text/markdown
 
 # MessageFoundry

{messagefoundry-0.2.8 → messagefoundry-0.2.10}/docs/BACKLOG.md

@@ -37,10 +37,10 @@ code has since been removed** (per-lane ownership, the `renew_leases` heartbeat,
 > - **Workstream G** (console HA operability) — **DONE**: leader/cluster view on Engine Status + off-thread
 >   reads (#299), with the per-page off-thread polling completed in #341 — which also closes deferred **#2**.
 >
-> The public `0.1.0` tag shipped **without** gating on the licensing/legal decision (#13) — that formal
-> counsel review is **deferred to v0.2 as a dated accepted-risk decision (2026-06-17)**: `v0.1.0` shipped on
-> the drafted AGPL-3.0-or-later + `NOTICE`/`COMMERCIAL-LICENSE`/`CLA` posture **without** counsel sign-off
-> (see #13). *Optional non-gating follow-up:* re-run the Postgres failover after fix #293 to refresh the
+> The public `0.1.0` tag shipped **without** gating on the licensing/legal decision — that formal
+> counsel review was **deferred as a dated accepted-risk decision (2026-06-17)**: `v0.1.0` shipped on
+> the drafted AGPL-3.0-or-later + `NOTICE`/`COMMERCIAL-LICENSE`/`CLA` posture **without** counsel sign-off.
+> *Optional non-gating follow-up:* re-run the Postgres failover after fix #293 to refresh the
 > published ~60 s recovery figure (the hard conformance tier — zero loss, order-preserving, drain-to-zero —
 > passes on all three backends regardless).
 
@@ -52,7 +52,7 @@ With `v0.1.0` shipped, the active priority moves to **v0.2**. Its headline is th
 client (#20)** plus the operator-visibility quick wins — **observability/metrics export (#21)**, the
 **console Alerts/Dead-Letters pages (#22)**, and the **user guide (#19)**. The candidate work is the
 Mirth feature-gap items **#20–#27** below, plus deferred **#3** (per-key ordering), **#16** (Corepoint
-event-log parity, ADRs 0020/0021), the licensing counsel review (**#13**), and the security-posture
+event-log parity, ADRs 0020/0021), and the security-posture
 follow-ups below. **Active-active horizontal scale-out is dropped and its code removed** — no longer a
 planned milestone (2026-06-18). Full build sequencing across parallel sessions:
 [`releases/MULTISESSION-PLAN-3.md`](releases/MULTISESSION-PLAN-3.md) (the living plan; supersedes
@@ -75,9 +75,9 @@ separate owner exercise** — this is the candidate set, not a committed plan.
 
 | Item | Value | Verdict | Effort | Why / trigger |
 |---|---|---|---|---|
-| **Meta — lock v0.2 scope** | Med | **do-now** | S | Ratify #20–#27 as committed (marquee shipped, declines recorded, **#24 promoted 2026-06-20 — ADR 0025, adopter-driven**); decide #22b ship-or-slip. Governance, not a feature. Don't let the open #13 counsel review be a false blocker (dated accepted-risk). |
-| **#28 load test** | Med | **do-now** | S | Run the built no-loss harness — regression-guards the active-active-removal claim-path rework + gives pilot perf evidence. Pair with #29 in one run window. |
-| **#29 throughput test** | Med | **do-now** | S | Refresh the stale `TUNING-BASELINE.md`; same harness/run as #28. Measure-and-publish, **not** premature perf-tuning. |
+| **Meta — lock v0.2 scope** | Med | **do-now** | S | Ratify #20–#27 as committed (marquee shipped, declines recorded, **#24 promoted 2026-06-20 — ADR 0025, adopter-driven**); decide #22b ship-or-slip. Governance, not a feature. |
+| **#28 load test** | Med | **done** | S | ✅ Executed on the local test boxes (2026-06-27) — no-loss/latency result in `TUNING-BASELINE.md`. These are the **consumer-hardware floor**; the enterprise-hardware run is slated for the **#40** self-hosted box. |
+| **#29 throughput test** | Med | **done** | S | ✅ Re-measured on the local test boxes + `TUNING-BASELINE.md` refreshed (2026-06-27). Consumer-hardware floor numbers; the enterprise re-measure is slated for the **#40** self-hosted box. |
 | **#22b Alerts GUI page** | Med | do-next | S | Endpoint `/alerts/rules` shipped (#415); thin console page in flight (PR #420). Operator-parity polish, not a migration-unblocker. |
 | **#33 config-UX audit** | Med | do-next | M | Right timing to audit config sprawl — but value realizes **only if** the spawned follow-ups are funded. Keep bounded to transport/service config (logic stays code-first — never drift toward #26). |
 | **FEATURE-MAP refresh** | Med | do-next → **done** | S | Verified stale (Dead-Letters row); ASVS score synced to 212/0/0/133 (#425). |
@@ -85,7 +85,6 @@ separate owner exercise** — this is the candidate set, not a committed plan.
 | **#16 eventlog (0021 half)** | Med | on-trigger | L | Trigger: a partner needs ACK-reconciliation evidence. 0021 (inbound ACK "Response Sent") is cheap (extends ADR 0013); **0020 (raw protocol-trace) = near-drop** (new raw-PHI-at-rest tier nobody named). The #14 tee already surfaces ACK signal. |
 | **#34 per-connection retention** | Med | on-trigger | M | Trigger: a real multi-feed estate needs differential windows (keep ADT 90d, prune a chatty lab feed 7d). Bounded; follows the per-connection-over-global pattern. |
 | **least-priv service-account default** | Med | on-trigger | S | Account + ACLs already built; only the default flip off LocalSystem remains. Ride the next green `windows-service-smoke`. |
-| **#13 licensing close-out** | Med | on-trigger | S | Blocked on counsel's reply; owner can only chase, not build (v0.1.0 already shipped the posture as accepted risk). |
 | **#11 WebAuthn (WP-14b)** | Low | on-trigger | L | Buys **zero** ASVS movement (6.3.3 already Pass via TOTP); only on off-loopback exposure. |
 | **connector SecretProvider seam** | Low | on-trigger | M | Already a conditional Pass; managed-identity (gMSA/Entra) covers the audience. Build on real Vault/KMS demand. |
 | **#31 `.xml()` accessor** | Low | on-trigger | S | Trigger: the first inbound XML feed (lands with #7). Core `.xml()` only, hardened defaults — **no** `[xml]`/lxml SOAP/CDA model. |
@@ -96,7 +95,6 @@ separate owner exercise** — this is the candidate set, not a committed plan.
 | **#24 DICOM** | **Med–High** | **done (Phases 1 + 2)** | L | **Adopter-driven** — a radiology practice on Corepoint DICOM Gear wants to adopt. ✅ **Phases 1 + 2 SHIPPED** ([ADR 0025](adr/0025-dicom-codec-store-connectors.md) Accepted): pure codec + DIMSE **C-STORE SCP** + code-first SR→HL7 Handler (Phase 1, PR #439); **C-STORE SCU + C-ECHO + DICOMweb STOW-RS** outbound (Phase 2, `rest.py` reuse — no new dep). **MWL/Q-R/inbound-DICOMweb declined/deferred.** Did **not** need #7. |
 | **Meta — v0.3 cut** | Low | defer | S | Don't formalize now — a themed candidate set anchored on **ADR 0023 / inbound-HTTP**, gated on real feeds. |
 | **#30 dependency-update check** | Low | defer → drop | M | Zero demand; an outbound PyPI call **tensions the on-prem/no-egress identity**. `requirements.lock` + DEP-1 already cover it. |
-| **#9 ASVS `.docx` re-stamp** | Low | **drop** | S | Out-of-repo pandoc run before a CISO meeting — not backlog work (the in-repo assessment is already current). |
 | **ASVS 11.7.1 in-use memory encryption** | Low | **drop (N/A)** | XL | Already scored **N/A** — a hardware/OS/hypervisor capability, unachievable for pure-Python on-prem. |
 | **#18 git-offering** | Low | **confirm-decline** | M | Buyers already run git/ADO/GHE — a non-problem. Fold conventions into #33; AGPL-compat entanglement. |
 | **#25 JMS** | Low | **confirm-decline** (as named) | M | Java-broker artifact vs the **no-broker identity** (the staged SQLite queue *is* the durability story). Keep only a *generic* AMQP/Kafka on-trigger candidate. |
@@ -612,37 +610,6 @@ wanted, gating the approve route with `require_step_up` too is a one-line change
 
 ---
 
-## 9. Regenerate the InfoSec standards-conformance deliverables to ASVS L3
-
-> ✅ **DONE (2026-06-17), then advanced.** The in-repo **`docs/security/ASVS-L3-STATUS.md`** memo was
-> re-stamped — first to **186 / 21 / 5 / 133** (post-WP-14 MFA, 6.3.3 MFA-as-Fail framing rewritten), then
-> to **189 / 20 / 3 / 133** after WP-L3-13 admin defense (8.4.2) and sec-offbox-log off-box
-> forwarding (16.4.3 + 16.2.4) landed. The OneDrive reviewer-facing `.docx` deliverables (the ASVS-L3 status memo, the InfoSec
-> standards summary, and the executive summary) were re-stamped to the same scorecard via pandoc
-> (originals backed up `*.pre-restamp.docx`). **Note (current posture, 2026-06-19):** the score has since
-> advanced to **212 / 0 / 0 / 133** (16.4.3 + 16.2.4 closed by sec-offbox-log → 189/20/3/133; the 4.1.5 #378,
-> 12.1.4 #376, 13.3.3 #377 Fail→Pass flips → 192/20/0/133; then the #383 partials sweep closed the last 20
-> Partials with documented residuals → 212/0/0/133); the in-repo
-> `ASVS-L3-STATUS.md` / `ASVS-L3-ASSESSMENT.md` are updated, but the OneDrive `.docx` set needs another re-stamp.
-> *(The `STANDARDS-CONFORMANCE-SUMMARY.md` named below was never committed to the repo — the canonical
-> source of truth is `ASVS-L3-ASSESSMENT.md`; the summaries live in the OneDrive deliverable set.)*
-
-**Type:** documentation / reviewer-facing deliverable refresh. No code.
-
-**What:** `docs/security/STANDARDS-CONFORMANCE-SUMMARY.md` and its two `.docx` companions still carry
-the **L2** headline (`138 Pass / 18 Partial / 2 Fail / 95 N-A`) and L2 framing. The assessment was
-re-targeted to **Level 3** (PR #273) and the L3 remediation arc is largely closed — the current
-combined scorecard is **212 Pass / 0 Partial / 0 Fail / 133 N-A** (345 reqs — 0 open Fails *and* 0 open Partials after the #383 partials sweep, atop sec-offbox-log off-box forwarding + the 4.1.5 #378 / 12.1.4 #376 / 13.3.3 #377 Fail→Pass flips). Regenerate the summary +
-Word deliverables against `ASVS-L3-ASSESSMENT.md` / `ASVS-L3-REMEDIATION-PLAN.md` (re-run the
-`infosec-standards-doc` workflow), keeping the point-in-time SELF-assessment disclaimer.
-
-**Why deferred:** a derived deliverable, not a gate — regenerate when next presenting to a
-reviewer/CISO so the numbers don't drift again mid-arc.
-
-**Source:** ASVS L2→L3 re-target (PR #273) + the L3 remediation arc (#284 / #305 / #308 / #312).
-
----
-
 ## 10. Worktree tooling: `new.ps1 -Base` resolves the *local* branch, which can lag `origin`
 
 > ✅ **DONE (2026-06-17, PR #348).** `new.ps1`/`spawn.ps1` now `git fetch origin` first and default `-Base`
@@ -728,40 +695,6 @@ traced.
 
 ---
 
-## 13. Licensing posture — config-as-separate-work + commercial edition (counsel review deferred to v0.2 — accepted risk)
-
-> 📂 **ENGAGEMENT OPENED 2026-06-19 (coordinator), PR #406.** The formal counsel review is now scoped and
-> opened — see [`COUNSEL-ENGAGEMENT-BRIEF.md`](COUNSEL-ENGAGEMENT-BRIEF.md), packaging the four review
-> artifacts (CLA, COMMERCIAL-LICENSE, ADR 0017 §6, DUAL_LICENSING_PLAN) + 11 questions for counsel (the six
-> plan questions incl. config-as-separate-work, plus five surfaced: no Corporate CLA, comment-assent
-> enforceability, the §3 patent grant, the steward's own §13, dependency license-compat). Doc-only; recording
-> counsel's answers + lifting "pending legal review" is the deferred close-out (Lane L).
-
-> **⚠️ DECISION 2026-06-17 (owner — accepted risk), CARRIED OUT 2026-06-18:** the formal licensing/counsel
-> review was **deferred to v0.2**, and **`v0.1.0` was not gated on it**. `v0.1.0` was cut and published
-> 2026-06-18 on the drafted **AGPL-3.0-or-later** posture (`NOTICE`, per-file SPDX headers, `CLA.md`,
-> `COMMERCIAL-LICENSE.md` — landed in #350). The owner **accepted the risk** that publishing `v0.1.0` and
-> reserving the package name — effectively irreversible, setting the licensing precedent adopters build on —
-> happened **before** counsel reviews ADR 0017 decision #6. This superseded the "settle with counsel *before*
-> first public release" stance recorded below (and ADR 0017 §6); the review moves to the v0.2 cycle.
-
-**Type:** licensing / release-gating decision. No code.
-
-**What:** ADR 0017's ratified **decision #6** — adopter **config is a "separate work"** from the AGPL
-engine, paired with a planned **commercial edition** — is recorded as **PENDING LEGAL REVIEW**. The
-licensing posture (how the AGPL engine, an adopter's own private config repo, and a possible commercial
-offering relate) should be settled with counsel **before** the first public release: publishing a version
-and reserving the package name is effectively irreversible and sets the licensing precedent adopters build
-on.
-
-**Why deferred:** it is a legal/business decision, not engineering — it gates *how* the licensing posture is
-counsel-blessed, not *whether* the engine works. **Per the 2026-06-17 decision above it did not hold the
-`v0.1.0` tag** (accepted-risk — `v0.1.0` shipped 2026-06-18); the review is rescheduled to the v0.2 cycle.
-
-**Source:** ADR 0017 ("Ratified decisions", decision #6); the v0.1 release-readiness discussion.
-
----
-
 ## 14. Parallel-run "tee" for the Corepoint → MEFOR cutover
 
 > ✅ **BUILT — shipped #335 (relay) + #340 (purge/export).** The standalone, dependency-free MLLP tee relay
@@ -1087,7 +1020,7 @@ adopter supplies git out-of-band.
   embedded lightweight git server for the config repo, or just documented git conventions + IDE wiring
   over the adopter's existing remote — these are very different commitments.
 - **Licensing fit:** any bundled component must be license-compatible with the AGPL engine and the
-  config-as-separate-work posture (ties into **#13** / ADR 0017 decision #6, pending legal).
+  config-as-separate-work posture (ties into ADR 0017 decision #6, pending legal).
 - **Dependency/footprint cost:** adding a git dependency to the base install vs. keeping the engine
   lean and leaving VCS to the operator.
 
@@ -1416,6 +1349,13 @@ priority; situational.
 
 ## 28. Run a load test (execute the load harness on the current build)
 
+> ✅ **DONE — executed on the local test boxes (2026-06-27).** The no-loss / latency-under-load harness was
+> run against the current `0.2.9` build and [`benchmarks/TUNING-BASELINE.md`](benchmarks/TUNING-BASELINE.md)
+> carries the result. **Caveat:** these are the **consumer-hardware floor** figures (a ~15 W APU + consumer
+> SSD with the engine + DB co-located — a deliberately conservative floor, *not* the enterprise number). A
+> single-box-NVMe / enterprise-shaped run to pin the real ceiling is **slated for #40** (the self-hosted
+> Windows Server 2025 + SQL Server 2025 CI leg), which will be the standing home for the recurring perf runs.
+
 **Type:** validation / verification — *running* existing tooling, not new code. The load harness is
 **BUILT** ([`harness/load/`](../harness/load/), [`docs/LOAD-TESTING.md`](LOAD-TESTING.md)) and a Gate-#3
 baseline is published ([`benchmarks/TUNING-BASELINE.md`](benchmarks/TUNING-BASELINE.md)).
@@ -1435,6 +1375,12 @@ pass is the evidence for a pilot/cutover and the regression guard for pipeline/s
 
 ## 29. Run a throughput test (re-measure + refresh the tuning baseline)
 
+> ✅ **DONE — re-measured on the local test boxes (2026-06-27).** Throughput (msg/s + p50/p95/p99) was
+> re-run across the store backends and [`benchmarks/TUNING-BASELINE.md`](benchmarks/TUNING-BASELINE.md)
+> refreshed. As with #28 these are the **consumer-hardware floor** numbers; the enterprise-hardware
+> re-measure is **slated for #40** (the self-hosted Windows Server 2025 + SQL Server 2025 leg), the standing
+> home for recurring throughput runs.
+
 **Type:** validation / benchmark — *running* the existing benchmark, not new tooling.
 
 **What:** re-run the throughput benchmark (msg/sec + p50/p95/p99 latency) across the supported store
@@ -1975,6 +1921,9 @@ dedicated Windows Server + SQL Server test box and add a leg that:
 - runs the SQL Server store + coordinator + DATABASE-connector suites against the **local SQL Server
   2025** instance (`MEFOR_TEST_SQLSERVER=1`, real DSN) — exercising RCSI on a real engine, real
   `db_lookup`, and the AVX-capable hardware 2025 requires.
+- hosts the recurring **load + throughput runs (#28 / #29)** — the local-box runs published the
+  consumer-hardware *floor*; this box is where the enterprise-hardware *ceiling* gets pinned on a
+  recurring basis.
 
 **Scope / open questions (when built):**
 - **Self-hosted runner security:** it executes repo code — gate to **push / `workflow_dispatch` on
@@ -2501,6 +2450,141 @@ attachment-handler + data-pruner behavior researched the same day (citations abo
 
 ---
 
+## 56. Operator alert-state — resolvable alert instances (ack / resolve) + a real `alerts_active` count (Corepoint parity) (P2)
+
+> 📌 **PRE-RESERVED (Plan-5, 2026-06-27).** Number reserved + ADR authored; build scheduled. See
+> [`releases/MULTISESSION-PLAN-5.md`](releases/MULTISESSION-PLAN-5.md) Lane **L7** (Wave 2) and
+> [ADR 0044](adr/0044-operator-alert-state.md) (Proposed).
+
+**Type:** feature — operator monitoring. Today alerts are stateless emit-points (ADR 0014) and the
+`ConnectionRow.alerts_active` field is **stubbed `0`**. Add a persisted `alert_instance` store table
+(open / acknowledged / resolved + first/last-seen + count) de-duped on the existing `_emit` throttle key,
+`GET /alerts/active` + ack/resolve endpoints (RBAC `MONITORING_DIAGNOSE`), the real `alerts_active` count,
+and a console Alerts-page tab. **Metadata only — no new at-rest PHI tier.** Surfaced by the #52 Corepoint
+parity gap analysis.
+
+---
+
+## 57. User-definable custom RBAC roles over the existing Permission catalog (Corepoint parity) (P2)
+
+> 📌 **PRE-RESERVED (Plan-5, 2026-06-27).** See [`releases/MULTISESSION-PLAN-5.md`](releases/MULTISESSION-PLAN-5.md)
+> Lane **L8** (Wave 2) and [ADR 0045](adr/0045-custom-rbac-roles.md) (Proposed).
+
+**Type:** feature — RBAC. Today there are **6 fixed built-in roles**. Add admin-defined named roles, each a
+chosen **subset** of the existing `Permission` catalog (no new permission kinds), persisted via a `roles`-table
+migration across all three backends (SQLite + Postgres + SQL Server), gated by `USERS_MANAGE`; the built-ins
+stay; custom roles are an additive overlay; deny-by-default preserved. Surfaced by the #52 Corepoint parity
+gap analysis.
+
+---
+
+## 58. FHIR client read / search lookup — `fhir_lookup` (read-only, like `db_lookup`) (P2)
+
+> ✅ **SHIPPED (Plan-5 Wave 1, PR #618, 2026-06-27).** `fhir_lookup(connection, query)` is built — a read-only
+> GET / search that extends the `db_lookup` carve-out to FHIR ([ADR 0043](adr/0043-fhir-read-lookup.md),
+> Accepted), off the event loop, raises on a Router / in dry-run. See
+> [`releases/MULTISESSION-PLAN-5.md`](releases/MULTISESSION-PLAN-5.md) Lane L2.
+
+**Type:** feature — live enrichment. The FHIR client (ADR 0022) is **write-only** today. Add a handler-callable,
+read-only `fhir_lookup(connection, query)` (read-by-id GET / search) that **extends** the ADR 0010 `db_lookup`
+carve-out to FHIR: reuses the SMART Backend bearer (ADR 0024) + `[egress].allowed_http`, runs off the event
+loop, raises on a Router / in dry-run, re-run-divergent by design (read-side only). GET-only — writes stay on
+`FhirDestination`. Surfaced by the #52 Corepoint parity gap analysis.
+
+---
+
+## 59. HL7 timestamp / age / length-of-stay helpers on `Message` (P3)
+
+> ✅ **SHIPPED (Plan-5 Wave 1, PR #618, 2026-06-27).** `Message` now exposes age-from-DOB, length-of-stay, and
+> the tolerant HL7-TS parse (reusing `timezone.py`, no duplicate parser). See
+> [`releases/MULTISESSION-PLAN-5.md`](releases/MULTISESSION-PLAN-5.md) Lane L1.
+
+**Type:** feature — transform ergonomics. **`messagefoundry/timezone.py` already provides the tolerant
+HL7-TS→`datetime` parse** (`_parse_hl7_timestamp` / `convert_hl7_timestamp` / `to_zone`); this item adds only
+the **new** helpers (age-from-DOB, length-of-stay between two timestamps, an `hl7_now()` / TS-format if missing)
+and surfaces the existing parser on the `Message` surface. MSH-encoding-aware, **no I/O**, console-importable
+(§4 carve-out). **Do not** build a duplicate parser. Surfaced by the #52 Corepoint parity gap analysis.
+
+---
+
+## 60. Turnkey disaster recovery — scheduled config/store backup + restore-verify (config-tier slice) (P3, owner decision)
+
+> 📌 **PRE-RESERVED (Plan-5, 2026-06-27).** See [`releases/MULTISESSION-PLAN-5.md`](releases/MULTISESSION-PLAN-5.md)
+> §G (deferred tail). **Owner-gated** (backup cadence / retention / restore-verify posture).
+
+**Type:** operations — DR. An engine-managed scheduled backup of the config bundle + store (config-tier slice
+first) with a restore-verify pass. Tracked for a future wave; **not staffed** until the owner sets the backup
+cadence / retention / restore-verify posture.
+
+---
+
+## 61. Third-tier DR standby — right-sized box that takes over when the HA pair fails, running only high-priority feeds (P3, owner decision)
+
+> 📌 **Owner-gated / NEW candidate (2026-06-27).** A **third recovery tier** *below* the shipped
+> active-passive HA — distinct from **#60** (scheduled backup + restore-verify) and from the v0.1 HA
+> failover. **Not staffed** until the owner sets the DR posture (warm vs cold, activation trigger,
+> feed-priority tiers, fail-back); wants an **ADR** before code.
+
+**Type:** operations — disaster recovery (site / HA-pair-loss tier).
+
+**What:** a **right-sized DR box** that takes over when the **HA setup itself fails** — i.e. the primary
+*and* its active-passive partner are both gone (whole-site / shared-store loss, e.g. the production database
+goes down), not just a single engine-process crash. The DR server is intentionally **under-provisioned** — a
+small box, not a second full-size hot standby that mostly sits idle — so DR survivability doesn't require
+provisioning duplicate full-capacity hardware. On activation it brings up only a **prioritized subset** of
+connections — the **high-priority feeds** — and runs in a deliberately **degraded mode**, accepting reduced
+throughput/coverage as the cost of cheap DR.
+
+**The three tiers (this item = tier 3):**
+1. **Primary** — normal operation.
+2. **Active-passive HA (shipped, v0.1)** — same-tier engine failover at *full* capacity; DB-tier HA delegated
+   to the DBA. Handles a node failure, **not** loss of the whole HA pair/site.
+3. **Third-tier DR (this item)** — a smaller box elsewhere that activates only when tier 2 is also gone, and
+   runs *less* (high-priority feeds only), not more.
+
+This is **not** active-active scale-out (dropped 2026-06-18, code removed) — DR here runs a *reduced* feed
+set on smaller hardware, the opposite of scale-out. It would **consume #60's backups** (or DB replication
+delegated to the DBA) to seed the DR store; #60 is the backup/restore mechanic, this is the
+**standby-takeover + degraded-operation** mechanic on top of it.
+
+**New building block this needs — a per-connection priority tier.** For DR to "run only the high-priority
+feeds," each Connection needs a **priority / DR-tier** classification (e.g. `priority = critical|normal|low`
+or explicit `dr_profile` membership), layered as the same **global-default + per-connection-override** model
+used for FIFO, `RetryPolicy`, `BuildupThreshold`, per-connection retention (**#34**), and embedded-doc
+pruning (**#47**). Authored on the `ConnectionSpec` and/or as `connections.toml` keys (ADR 0007) so it stays
+hand-/GUI-editable. A **DR run-profile** is then "start only connections at tier ≥ X" — leaning on the
+per-connection start + startup fault-isolation path already built (ADR 0031). The priority signal is reusable
+beyond DR (load-shedding, ordered startup, alert severity).
+
+**Open questions for the ADR:**
+- **How the DR box gets state** — DB replication to the DR site (delegated to the DBA, consistent with the
+  declined "DB-tier backup/HA/restore" stance) vs. restore-from-#60-backups; the warm/cold choice sets RPO/RTO.
+  The engine owns the feed-priority + selective-startup half, not the DB-replication half.
+- **Activation trigger & arbitration** — who declares the HA pair down and promotes DR (manual runbook vs.
+  automated probe), and how split-brain is prevented so DR and a recovering primary don't both run the
+  high-priority feeds.
+- **Degraded-mode partner behavior** — low-priority inbound feeds are *down* on DR; senders see a refused
+  connection (their own resend/queue covers the gap) vs. an explicit maintenance NAK.
+- **Fail-back** — returning to the restored primary without losing or double-processing what DR handled (the
+  at-least-once + idempotency invariants must hold across the handoff).
+
+**Why P3 / owner-gated.** DR-beyond-HA is a recognized enterprise expectation and a Corepoint-parity gap (the
+gap analysis lists "standby failover/failback"), but it's a larger build touching deployment topology, the
+store-replication boundary (partly the DBA's), and a new priority-tier config surface — and it's not an open
+exposure on the shipping config. **Trigger:** an adopter requires site / HA-pair-loss DR on a budget (no
+second full hot standby) with a defined critical-feed set.
+
+**Relation to siblings:** **#60** (backup/restore-verify — seeds the DR state), the shipped active-passive HA
+(tier 2), **#34** / **#47** (shared per-connection-override plumbing for the priority tier), **ADR 0031**
+(startup fault isolation — DR starts a *subset* of connections via the same path), **ADR 0007**
+(`connections.toml` for the GUI-editable priority key).
+
+**Source:** owner request (2026-06-27) — "a disaster recovery option beyond HA: a third tier that takes over
+when the HA pair fails (e.g. the primary database goes down). A small, right-sized DR box — not a full-size
+server sitting unused — spins up and runs only the high-priority feeds."
+
+---
+
 *Everything else from the 2026-06-10 full-codebase review (1 critical, 13 high, 33 medium, 31 low —
 78 findings) has been remediated; see the review report's §6 action order. The two items it still
 sourced — **#1 (SQL Server concurrency)** and **#2 (console off-thread)** — are now both **DONE**