messagefoundry 0.2.9__tar.gz → 0.2.11__tar.gz

{messagefoundry-0.2.9 → messagefoundry-0.2.11}/.github/workflows/ci.yml

@@ -5,9 +5,27 @@ on:
     branches: [main]
   pull_request:
   workflow_dispatch:
+  schedule:
+    # Nightly (03:17 UTC — off the top-of-hour rush) run of the long load-smoke legs ONLY. These were
+    # previously run on EVERY push to main; main still gets the full functional `test` matrix + the
+    # server-DB suites per push, but the multi-minute load runs (serve an engine + drive a load profile,
+    # x2 for the SQL Server majors) now run once a night instead of once per commit.
+    #   IMPORTANT: this cron must NOT drag the rest of the workflow along. Only `load-test` and
+    #   `load-test-sqlserver` fire on `schedule` (their `if:` is `schedule || workflow_dispatch`). Every
+    #   OTHER heavy job (test, ide, sqlserver-store, postgres-store, windows-service-smoke, docker-smoke)
+    #   gates its push/dispatch arm as `push || workflow_dispatch` — deliberately EXCLUDING `schedule` —
+    #   so the nightly run does not re-execute the full functional matrix + server-DB + 2x-Windows
+    #   service smoke (which would COST more than the per-push load savings; the original `!= 'pull_request'`
+    #   form would have swept them all into the cron). Trigger an on-demand load run with
+    #   `gh workflow run ci.yml --ref main` (workflow_dispatch) — that DOES run everything, by design.
+    - cron: "17 3 * * *"
 
 concurrency:
-  group: ci-${{ github.ref }}
+  # Per-ref group so a new push/PR-update supersedes its own in-flight run. The nightly `schedule` run
+  # gets a SEPARATE group (…-nightly): without this it would share `ci-refs/heads/main` with push-to-main
+  # and a routine daytime push would cancel-in-progress the in-flight nightly LOAD run — silently killing
+  # the very long-running coverage the cron exists to provide. Scheduled and push runs no longer collide.
+  group: ci-${{ github.ref }}${{ github.event_name == 'schedule' && '-nightly' || '' }}
   cancel-in-progress: true
 
 # Least privilege: every job here only reads the repo and runs tests/builds (no gh writes, no git push,
@@ -22,6 +40,12 @@ jobs:
   # version we ship on the OS we ship it on is worth the minutes.
   test:
     name: test (${{ matrix.os }}, py${{ matrix.python-version }})
+    # `needs: changes` for the docs-only short-circuit ONLY — this REQUIRED job still RUNS on every PR
+    # and ALWAYS reports its context. On a docs-only PR `changes.outputs.code == 'false'` and the
+    # expensive steps (install/lint/type/test) are skipped, so the leg goes green in seconds; the
+    # required `test (…, py3.14)` context stays present + green. (changes never fails, so this needs
+    # edge can't wedge the required context.)
+    needs: changes
     runs-on: ${{ matrix.os }}
     # Wall-clock backstop: bound each leg so a hung test fails in minutes, not the 6h default. Three
     # nested watchdogs catch a hang at increasing scope (#55): the pytest-timeout per-test cap (60s,
@@ -48,17 +72,32 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
-          cache-dependency-path: pyproject.toml
+          # Key the pip cache on BOTH the project metadata and the resolved lockfile, so a dep bump (or a
+          # re-lock that only moves transitive pins) busts the cache and a no-op change reuses it. The
+          # install is `pip install -e ".[...]"` (reads pyproject); requirements.lock tracks the resolved
+          # graph CI actually exercises, so hashing it keeps the cache correct across re-locks.
+          cache-dependency-path: |
+            pyproject.toml
+            requirements.lock
+
+      # Everything below is gated on `code` (docs-only short-circuit) OR a push-to-main / on-demand run
+      # (full coverage). On a docs-only PR these steps no-op and the REQUIRED leg reports green in seconds.
+      # The job itself (and the Python/cache setup above) still runs, so the required context is always
+      # present. NB: the gate is duplicated per-step (a job-level `if` would SKIP the whole job and remove
+      # the required context) — keep the condition identical on each. The push/dispatch arm is written
+      # `push || workflow_dispatch` (NOT `!= 'pull_request'`) so the nightly `schedule` event does NOT
+      # re-run this full functional matrix — the cron is reserved for the long load legs only.
 
       # PySide6's offscreen platform plugin needs a few system libraries even
       # headless. Linux-only; Windows runners need no equivalent.
       - name: Install Qt offscreen system libraries
-        if: runner.os == 'Linux'
+        if: (needs.changes.outputs.code == 'true' || github.event_name == 'push' || github.event_name == 'workflow_dispatch') && runner.os == 'Linux'
         run: |
           sudo apt-get update
           sudo apt-get install -y libegl1 libgl1 libxkbcommon0 libdbus-1-3
 
-      - name: Install project (dev + console + fhir + dicom extras)
+      - name: Install project (dev + console + fhir + dicom + x12 + xml extras)
+        if: needs.changes.outputs.code == 'true' || github.event_name == 'push' || github.event_name == 'workflow_dispatch'
         run: |
           python -m pip install --upgrade pip
           # [fhir] so the FHIR typed-tier tests (incl. the PHI-no-leak invariant, ADR 0022) actually
@@ -66,15 +105,20 @@ jobs:
           # [dicom] (pydicom + pynetdicom; ADR 0025) does the same for the DICOM codec + C-STORE SCP
           # tests, and lets mypy type-check transports/dicom.py + parsing/dicom/ against the real
           # (py.typed) libraries rather than treating them as Any.
-          pip install -e ".[dev,console,fhir,dicom]"
+          # [x12] (pyx12) + [xml] (lxml/xmlschema/signxml) likewise so the strict X12 validation (#32)
+          # and the hardened XML/SOAP codec (#31) tests run their assertions instead of importorskip-skipping.
+          pip install -e ".[dev,console,fhir,dicom,x12,xml]"
 
       - name: Lint (ruff)
+        if: needs.changes.outputs.code == 'true' || github.event_name == 'push' || github.event_name == 'workflow_dispatch'
         run: ruff check messagefoundry tests
 
       - name: Format check (ruff)
+        if: needs.changes.outputs.code == 'true' || github.event_name == 'push' || github.event_name == 'workflow_dispatch'
         run: ruff format --check .
 
       - name: Type-check (mypy, strict)
+        if: needs.changes.outputs.code == 'true' || github.event_name == 'push' || github.event_name == 'workflow_dispatch'
         run: mypy messagefoundry
 
       # Step-level watchdog UNDER the 15-min job cap (#55): the windows-2022 leg intermittently
@@ -93,6 +137,7 @@ jobs:
       # The step `timeout-minutes: 13` is the outer backstop, well under the job's 15-min cap, so a
       # hang both watchdogs somehow miss still fails the STEP (not the whole job at the silent cap).
       - name: Tests (pytest)
+        if: needs.changes.outputs.code == 'true' || github.event_name == 'push' || github.event_name == 'workflow_dispatch'
         timeout-minutes: 13
         env:
           QT_QPA_PLATFORM: offscreen
@@ -108,6 +153,13 @@ jobs:
   # deployment target.
   ide:
     name: ide build (${{ matrix.os }})
+    # `ide` is NOT a required check, so it may be SKIPPED at the job level on a docs-only PR (saves a
+    # Linux + a 2x-billed Windows leg every docs PR). It still runs on push-to-main / on-demand and on
+    # any code PR. ci-gate does NOT `needs: ide`, so a job-level skip here can't wedge any required
+    # context. The push/dispatch arm is `push || workflow_dispatch` (NOT `!= 'pull_request'`) so the
+    # nightly `schedule` event does NOT re-run the IDE build — the cron is reserved for the load legs.
+    needs: changes
+    if: needs.changes.outputs.code == 'true' || github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -153,18 +205,45 @@ jobs:
     outputs:
       serverdb: ${{ steps.f.outputs.serverdb }}
       docker: ${{ steps.f.outputs.docker }}
+      # `code` is the docs-only short-circuit signal: TRUE unless this PR touches ONLY non-code paths
+      # (Markdown / docs / licence / editorconfig / git metadata). It gates the EXPENSIVE STEPS of the
+      # required `test` legs (and the whole `ide` job) — the jobs still run + report their (required)
+      # context, but on a docs-only PR they skip install+lint+type+test and go green in seconds. TRUE on
+      # push-to-main / workflow_dispatch (full coverage); FALSE on the nightly `schedule` (load-legs-only
+      # cron — the functional matrix must not re-run nightly).
+      code: ${{ steps.f.outputs.code }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - id: f
+        # Hoist the two workflow expressions into env (zizmor: no `${{ }}` interpolated into the run body
+        # — a branch name / base sha is attacker-influenceable on a fork PR, so it must arrive as data).
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: |
-          if [ "${{ github.event_name }}" != "pull_request" ]; then
+          # Full coverage on a push-to-main or a manual dispatch: force every gate true so the whole
+          # workflow runs. The NIGHTLY `schedule` event is deliberately NOT here — on the cron only the
+          # two load legs should run, so `changes` reports code/serverdb/docker=FALSE and every job that
+          # ORs in one of these outputs (test steps, sqlserver-store, docker-smoke) stays skipped. This is
+          # the source-of-truth half of the "cron runs only the load legs" guard (the other half is each
+          # heavy job gating its push arm as `push || workflow_dispatch`, never `!= 'pull_request'`).
+          if [ "$EVENT_NAME" = "push" ] || [ "$EVENT_NAME" = "workflow_dispatch" ]; then
             echo "serverdb=true" >> "$GITHUB_OUTPUT"
             echo "docker=true" >> "$GITHUB_OUTPUT"
+            echo "code=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
-          changed=$(git diff --name-only "${{ github.event.pull_request.base.sha }}...HEAD")
+          if [ "$EVENT_NAME" = "schedule" ]; then
+            # Nightly load-only run: nothing here should trigger the functional / container legs.
+            echo "serverdb=false" >> "$GITHUB_OUTPUT"
+            echo "docker=false" >> "$GITHUB_OUTPUT"
+            echo "code=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          # Remaining case: pull_request. Compute the path-based filters from the PR diff.
+          changed=$(git diff --name-only "$BASE_SHA...HEAD")
           if echo "$changed" | grep -qE '^(messagefoundry/store/|messagefoundry/pipeline/cluster|messagefoundry/transports/database|tests/test_(sqlserver|postgres|cluster|database_connector)|\.github/workflows/ci\.yml)'; then
             echo "serverdb=true" >> "$GITHUB_OUTPUT"
           else
@@ -177,6 +256,26 @@ jobs:
           else
             echo "docker=false" >> "$GITHUB_OUTPUT"
           fi
+          # `code`: CONSERVATIVE docs-only detector. Default to running everything (code=true), and only
+          # short-circuit when EVERY changed path matches the docs/non-code allowlist below. We compute it
+          # by inverting: list the files that are NOT docs-only; if that list is empty (and the diff is
+          # non-empty), it's a docs-only PR. Anything outside the allowlist — any *.py, ide/**, config,
+          # lockfiles, OTHER workflows, scripts, samples, harness — counts as CODE and runs the full suite.
+          # A path appears in `changed` even if only deleted/renamed, so a pure doc rename still short-
+          # circuits, and a code deletion still runs.
+          #   Allowlisted (docs-only) paths: any *.md anywhere, docs/**, top-level LICENSE/NOTICE/AUTHORS,
+          #   .editorconfig, .gitignore/.gitattributes, .github/{ISSUE_TEMPLATE,PULL_REQUEST_TEMPLATE,...}.md.
+          # Be conservative: when in doubt a path is CODE. Empty diff (shouldn't happen on a PR) => code=true.
+          noncode='(\.md$|^docs/|^LICENSE$|^NOTICE$|^AUTHORS$|^\.editorconfig$|^\.gitignore$|^\.gitattributes$|^\.github/(ISSUE_TEMPLATE/|PULL_REQUEST_TEMPLATE))'
+          if [ -z "$changed" ]; then
+            echo "code=true" >> "$GITHUB_OUTPUT"
+          elif echo "$changed" | grep -qvE "$noncode"; then
+            # At least one changed path is NOT docs-only -> run the full suite.
+            echo "code=true" >> "$GITHUB_OUTPUT"
+          else
+            # Every changed path is docs-only -> short-circuit the expensive steps.
+            echo "code=false" >> "$GITHUB_OUTPUT"
+          fi
 
   # SQL Server service-container leg: runs the gated suites that need a real SQL Server (Linux, so 1x
   # minutes) — the PRODUCTION store backend suite AND the PRODUCTION DATABASE connector round-trip
@@ -188,7 +287,10 @@ jobs:
   sqlserver-store:
     name: sql server (store + connector) ${{ matrix.label }}
     needs: changes
-    if: github.event_name != 'pull_request' || needs.changes.outputs.serverdb == 'true'
+    # push-to-main / on-demand (full coverage), or a PR that touches the server-DB surface. NOT on the
+    # nightly `schedule` (the cron is reserved for the load legs only) — so written `push ||
+    # workflow_dispatch`, not `!= 'pull_request'`, which would have swept this container leg into the cron.
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' || needs.changes.outputs.serverdb == 'true'
     runs-on: ubuntu-latest
     # Matrix the gated suite across every supported SQL Server major (2022 = 16.x, 2025 = 17.x) so a
     # version-specific T-SQL / engine regression can't merge. fail-fast: false keeps a 2025-only hiccup
@@ -336,7 +438,9 @@ jobs:
   # LOCKED + advisory-lock concurrency the SQLite tests can't reach.
   postgres-store:
     name: postgres store
-    if: github.event_name != 'pull_request'
+    # push-to-main + on-demand only (NOT the nightly `schedule`, which is reserved for the load legs —
+    # `push || workflow_dispatch`, not `!= 'pull_request'`, keeps this container leg out of the cron).
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     services:
       postgres:
@@ -409,7 +513,11 @@ jobs:
   # docs/LOAD-TESTING.md.
   load-test:
     name: load test (smoke, sqlite)
-    if: github.event_name != 'pull_request'
+    # Nightly schedule + on-demand only (was: every push to main). The PR gate is the in-process
+    # tests/test_load_runner.py in the `test` job; push-to-main keeps full functional + server-DB
+    # coverage. This multi-minute serve+load run no longer fires once per commit. NOT a required check,
+    # so dropping it from push is safe; ci-gate `needs` it but counts a `skipped` leg as a pass.
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -465,7 +573,10 @@ jobs:
   # runs on push to main + on-demand (workflow_dispatch). Heavier SQL Server profiles run manually.
   load-test-sqlserver:
     name: load test (smoke, sqlserver) ${{ matrix.label }}
-    if: github.event_name != 'pull_request'
+    # Nightly schedule + on-demand only (was: every push to main); same rationale as `load-test`. The
+    # end-to-end SQL Server store path is still smoked nightly (x2 majors) + on demand, and the per-push
+    # SQL Server functional coverage stays in `sqlserver-store`. NOT required; ci-gate treats skip as pass.
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     # Smoke the end-to-end SQL Server store path on every supported major (2022/2025). Push/dispatch-only,
     # so no PR cost; fail-fast: false keeps the two legs independent.
@@ -565,7 +676,10 @@ jobs:
   # minutes; runs on push to main and on-demand (workflow_dispatch).
   windows-service-smoke:
     name: windows service smoke (${{ matrix.os }}, py${{ matrix.python-version }})
-    if: github.event_name != 'pull_request'
+    # push-to-main + on-demand only (2x-billed Windows legs). NOT on the nightly `schedule` — the cron
+    # is reserved for the load legs, so this is `push || workflow_dispatch`, not `!= 'pull_request'`
+    # (which would have run these 2x-Windows legs every night for no added signal).
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -731,7 +845,10 @@ jobs:
   docker-smoke:
     name: docker image smoke (slim, linux)
     needs: changes
-    if: github.event_name != 'pull_request' || needs.changes.outputs.docker == 'true'
+    # push-to-main / on-demand (full coverage), or a PR that touches the image/locks/packaging. NOT on
+    # the nightly `schedule` (reserved for the load legs) — `push || workflow_dispatch`, not
+    # `!= 'pull_request'`, keeps the image build out of the cron.
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' || needs.changes.outputs.docker == 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

messagefoundry-0.2.11/.github/workflows/manifest-lint.yml

@@ -0,0 +1,114 @@
+# Kubernetes manifest schema + policy lint (ADR 0047 AC-4 / AC-5).
+#
+# Validates the docker/k8s/*.yaml manifests against the upstream Kubernetes JSON schemas (kubeconform)
+# and asserts a few ADR-0047 HA-policy invariants on the multi-replica reference manifest, so the
+# manifests cannot silently drift from the engine's validators / the documented HA shape.
+#
+# GATED SENSIBLY — additive, NOT a required check:
+#   * It runs ONLY when a manifest, this workflow, or the docker/ docs change (paths filter), so docs/code
+#     PRs that don't touch manifests skip it entirely.
+#   * It is a SEPARATE workflow, deliberately not part of ci.yml's required `ci-gate`. The required set
+#     stays: the `test` matrix + bandit + pip-audit + cla (see docs/.. main required-checks). Do NOT add
+#     "manifest lint" to branch-protection required checks unless the owner decides to promote it.
+#   * It is fast + dependency-light (a single static binary + grep assertions), so it is cheap to run.
+
+name: manifest lint
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docker/k8s/**.yaml"
+      - "docker/README.md"
+      - ".github/workflows/manifest-lint.yml"
+  pull_request:
+    paths:
+      - "docker/k8s/**.yaml"
+      - "docker/README.md"
+      - ".github/workflows/manifest-lint.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: manifest-lint-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  kubeconform:
+    name: kubeconform + HA policy lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false # read-only lint job; don't persist the token (zizmor: artipacked)
+
+      # kubeconform = a fast, offline-capable schema validator for Kubernetes manifests. Pin the release
+      # by VERSION, then verify the downloaded tarball against the checksum the release itself publishes
+      # (CHECKSUMS file) — reproducible + tamper-evident without hardcoding a hash that would silently
+      # break on a version bump. Bump KUBECONFORM_VERSION deliberately.
+      - name: Install kubeconform
+        env:
+          KUBECONFORM_VERSION: "0.6.7"
+        run: |
+          set -euo pipefail
+          base="https://github.com/yannh/kubeconform/releases/download/v${KUBECONFORM_VERSION}"
+          # Keep the tarball's canonical name so the CHECKSUMS line ("<sha256>  kubeconform-linux-amd64.tar.gz")
+          # refers to a file that actually exists in cwd — sha256sum -c verifies by the name in the line.
+          curl -fsSL "${base}/kubeconform-linux-amd64.tar.gz" -o kubeconform-linux-amd64.tar.gz
+          curl -fsSL "${base}/CHECKSUMS" -o CHECKSUMS
+          grep ' kubeconform-linux-amd64.tar.gz$' CHECKSUMS | sha256sum -c -
+          tar -xzf kubeconform-linux-amd64.tar.gz kubeconform
+          sudo install -m 0755 kubeconform /usr/local/bin/kubeconform
+          kubeconform -v
+
+      # Schema-validate every manifest. -strict rejects unknown fields (catches typos);
+      # -summary prints a per-file pass/fail roll-up. The Deployment/StatefulSet/Service/PDB kinds are all
+      # in the bundled upstream schemas, so no extra schema location is needed.
+      - name: Validate docker/k8s manifests (kubeconform -strict)
+        run: |
+          set -euo pipefail
+          kubeconform -strict -summary -verbose \
+            docker/k8s/statefulset.yaml \
+            docker/k8s/ha-postgres.yaml
+
+      # ADR-0047 HA-policy assertions on the multi-replica reference manifest. These are the artifact
+      # locks for AC-4 (PDB maxUnavailable:1 + grace > lease TTL) and AC-5 (no HPA, no L7 ingress for
+      # MLLP). Lightweight grep checks — they guard against the manifest drifting away from the decision.
+      - name: HA policy lint (ADR 0047 AC-4 / AC-5)
+        run: |
+          set -euo pipefail
+          M=docker/k8s/ha-postgres.yaml
+          fail=0
+          assert_present() {  # $1 = regex, $2 = message
+            if ! grep -Eq "$1" "$M"; then echo "FAIL: $2 (expected /$1/ in $M)"; fail=1; fi
+          }
+          assert_absent() {   # $1 = regex, $2 = message (ignores commented lines)
+            if grep -Ev '^\s*#' "$M" | grep -Eq "$1"; then echo "FAIL: $2 (unexpected /$1/ in $M)"; fail=1; fi
+          }
+
+          assert_present 'replicas:\s*3'                  "multi-replica HA must declare replicas: 3"
+          assert_present 'kind:\s*PodDisruptionBudget'    "must ship a PodDisruptionBudget"
+          assert_present 'maxUnavailable:\s*1'            "PDB must set maxUnavailable: 1 (AC-4)"
+          assert_present 'terminationGracePeriodSeconds:\s*[0-9]+' "must set terminationGracePeriodSeconds (> lease TTL, AC-4)"
+          assert_present 'MEFOR_CLUSTER_ENABLED'          "must enable [cluster] (HA leader election)"
+          assert_present 'MEFOR_STORE_BACKEND'            "must set a server-DB backend (SQLite is refused under [cluster])"
+
+          # AC-5 prohibitions: no HPA object, and no L7/HTTP Ingress for MLLP. An UNcommented occurrence fails.
+          assert_absent 'kind:\s*HorizontalPodAutoscaler' "no HPA for MLLP (active-passive; FIFO/single-writer) — AC-5"
+          assert_absent 'kind:\s*Ingress'                 "no L7/HTTP Ingress for the MLLP data plane — AC-5"
+
+          # terminationGracePeriodSeconds must exceed the default leader_lease_ttl (30s) — a numeric check.
+          grace=$(grep -Eo 'terminationGracePeriodSeconds:\s*[0-9]+' "$M" | grep -Eo '[0-9]+' | head -1)
+          if [ "${grace:-0}" -le 30 ]; then
+            echo "FAIL: terminationGracePeriodSeconds=$grace must be > leader_lease_ttl_seconds (30s default) — AC-4"
+            fail=1
+          fi
+
+          if [ "$fail" -ne 0 ]; then
+            echo "::error::ADR-0047 HA policy lint failed — see FAIL lines above"
+            exit 1
+          fi
+          echo "ADR-0047 HA policy lint: OK"

{messagefoundry-0.2.9 → messagefoundry-0.2.11}/.github/workflows/release.yml

@@ -244,3 +244,188 @@ jobs:
           packages-dir: harness-dist/
           skip-existing: true
           attestations: true
+
+  release-console-installer:
+    # Build the FOURTH distribution artifact — the frozen, zero-Python Windows admin-console installer
+    # (PyInstaller --onedir + Inno Setup, OPTIONALLY Authenticode-signed). ADR 0032 Phase B, BACKLOG #39.
+    #
+    # This is a job INSIDE release.yml (not a separate workflow) with `needs: release`, mirroring
+    # `release-harness`: the engine ships first and `gh release create` (in the `release` job) has run, so
+    # the GitHub release provably EXISTS before this job's `gh release upload` attaches the installer to it
+    # (a separate workflow on the same tag would race release creation). A failure here is ISOLATED — it
+    # never reds the engine wheel/PyPI flow (that all completes in `release` before this starts).
+    #
+    # The ~150 MB Windows freeze runs only on a tag push (uploads the installer as a release asset) and on
+    # workflow_dispatch (builds it as an inspectable artifact, no upload) — NEVER on a PR. The console is
+    # frozen from the SAME wheel the `release` job built + smoke-checked (downloaded via the
+    # release-artifacts upload), so the frozen console and the PyPI wheel are byte-identical packaging —
+    # a source-vs-wheel resource bug can't slip through.
+    #
+    # Signing is CONDITIONAL: if WINDOWS_SIGN_CERT_BASE64 is present the exe + installer are signed; if not,
+    # the leg STILL produces an UNSIGNED installer and does NOT fail (the owner provisions the cert later —
+    # ADR 0032 §(c)). Reproducibility: PyInstaller comes from the locked deps; ISCC (Inno Setup) is pinned;
+    # signtool (Windows SDK) is the runner-provided external the ADR flags as a residual.
+    needs: release
+    runs-on: windows-2025  # x64 Windows; the Windows SDK (signtool) + choco are preinstalled
+    permissions:
+      contents: write  # `gh release upload` attaches the installer to the tag's release (tag runs only)
+    # Map the signing-cert secret to a job-level boolean env ONCE, then gate the sign step on `env`.
+    # The `secrets` context is allowed in a job-level `env:` expression but NOT in a step-level `if:`
+    # (the linter/runtime reject `if: secrets.X != ''`), so this is the canonical lint-clean gate:
+    # "false" until WINDOWS_SIGN_CERT_BASE64 is provisioned -> the sign step skips, build stays green.
+    env:
+      SIGN_CONFIGURED: ${{ secrets.WINDOWS_SIGN_CERT_BASE64 != '' }}
+      # Pinned Inno Setup version (Chocolatey package `innosetup`). Bump deliberately; keep the installer
+      # reproducible alongside the wheel (ADR 0032 §(d) reproducibility hole).
+      INNO_SETUP_VERSION: "6.3.3"
+    defaults:
+      run:
+        shell: pwsh
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false  # gh upload uses GH_TOKEN env, never the persisted git credential
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: "3.14"
+
+      - name: Resolve the single-sourced version (messagefoundry.__version__)
+        id: ver
+        run: |
+          # The installer AppVersion is single-sourced from messagefoundry/__init__.py __version__ — never
+          # hard-coded in the .iss. Read it WITHOUT importing the package (no deps installed yet) so this
+          # step is cheap and import-error-proof: parse the literal from the module file.
+          $line = Select-String -Path messagefoundry/__init__.py -Pattern '^__version__\s*=\s*"([^"]+)"' | Select-Object -First 1
+          if (-not $line) { throw "could not read __version__ from messagefoundry/__init__.py" }
+          $version = $line.Matches[0].Groups[1].Value
+          Write-Host "version: $version"
+          # On a tag push, the built installer version MUST equal the tag (single-source check, mirrors
+          # the wheel smoke in the release job).
+          if ($env:GITHUB_REF_TYPE -eq 'tag') {
+            $want = $env:GITHUB_REF_NAME.TrimStart('v')
+            if ($version -ne $want) { throw "::error::__version__ $version != tag $want" }
+          }
+          "version=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+
+      # Pull the wheel the `release` job built + smoke-checked (release-artifacts, uploaded on always()).
+      # Freezing from the SAME wheel that ships to PyPI (not the source tree) keeps the frozen console and
+      # the published wheel byte-identical packaging — ADR 0032 §(d) "install … from the just-built wheel".
+      - name: Download the just-built wheel (from the release job)
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: release-artifacts
+          path: release-artifacts
+
+      - name: Install the console (+ PyInstaller) from the just-built wheel
+        run: |
+          python -m pip install --upgrade pip
+          # Install the engine wheel with its [console] extra (PySide6 pinned 6.11.1 in requirements.lock,
+          # keyring, httpx, truststore), then PyInstaller for the freeze. Installing the package itself
+          # makes `messagefoundry.console` importable to PyInstaller's analysis. Resolve the wheel the
+          # release job staged under release-artifacts/dist/.
+          $wheel = Get-ChildItem release-artifacts -Recurse -Filter "messagefoundry-*.whl" | Select-Object -First 1
+          if (-not $wheel) { throw "no messagefoundry wheel found in the release-artifacts download" }
+          Write-Host "freezing from wheel: $($wheel.FullName)"
+          pip install "$($wheel.FullName)[console]" pyinstaller
+
+      - name: Freeze the console (PyInstaller --onedir, windowed)
+        run: |
+          pyinstaller --noconfirm --clean packaging/console-installer/messagefoundry-console.spec
+          if (-not (Test-Path "dist/messagefoundry-console/messagefoundry-console.exe")) {
+            throw "PyInstaller did not produce dist/messagefoundry-console/messagefoundry-console.exe"
+          }
+          Get-ChildItem dist/messagefoundry-console | Select-Object -First 20 Name, Length
+
+      # Exercise the ACTUAL frozen exe (AC-B4 offline-launch + AC-B5 bundled-icon/nav-asset). These tests
+      # skip everywhere the freeze is absent, so they run only here, pointed at the bundle dir.
+      # -p no:cacheprovider keeps the runner workspace clean; the smoke launches Qt windowed (offscreen)
+      # so no display is needed.
+      - name: Frozen-exe launch smoke (AC-B4 / AC-B5)
+        env:
+          MEFOR_FROZEN_CONSOLE_DIR: dist/messagefoundry-console
+          QT_QPA_PLATFORM: offscreen
+        run: |
+          pip install pytest
+          python -m pytest tests/test_frozen_launch_smoke.py -v -p no:cacheprovider
+
+      - name: Install Inno Setup (pinned)
+        run: |
+          choco install innosetup --version=$env:INNO_SETUP_VERSION --no-progress -y
+          # ISCC.exe is not on PATH after a choco install; resolve + export it for the next step.
+          $iscc = "${env:ProgramFiles(x86)}\Inno Setup 6\ISCC.exe"
+          if (-not (Test-Path $iscc)) { throw "ISCC.exe not found at $iscc after choco install" }
+          "ISCC=$iscc" | Out-File -FilePath $env:GITHUB_ENV -Append
+
+      - name: Build the installer (ISCC, AppVersion injected)
+        # Pass the resolved version through the step env (NOT a ${{ }} expansion inside the run script) so
+        # the value can never be interpolated into the shell — zizmor template-injection hardening.
+        env:
+          APP_VERSION: ${{ steps.ver.outputs.version }}
+        run: |
+          & "$env:ISCC" "/DAppVersion=$env:APP_VERSION" packaging/console-installer/messagefoundry-console.iss
+          $setup = "dist/messagefoundry-console-setup-$env:APP_VERSION.exe"
+          if (-not (Test-Path $setup)) { throw "Inno Setup did not produce $setup" }
+          "SETUP_EXE=$setup" | Out-File -FilePath $env:GITHUB_ENV -Append
+
+      # Authenticode signing — CONDITIONAL on the cert secret. If WINDOWS_SIGN_CERT_BASE64 is absent the
+      # whole step is skipped (the `if:` is false), so the build NEVER fails for lack of a cert; the
+      # installer simply ships UNSIGNED until the owner provisions one (ADR 0032 §(c), AC-B3). The cert
+      # lives ONLY in CI secrets and is written to a temp file that is deleted in the same step — it
+      # never touches the workspace. Pure CI tooling (signtool) — NO Python crypto import, so the ASVS
+      # 11.1.3 crypto-inventory gate is not tripped.
+      - name: Authenticode-sign the exe + installer (if a cert secret is configured)
+        if: ${{ env.SIGN_CONFIGURED == 'true' }}
+        env:
+          SIGN_CERT_B64: ${{ secrets.WINDOWS_SIGN_CERT_BASE64 }}
+          SIGN_CERT_PASSWORD: ${{ secrets.WINDOWS_SIGN_CERT_PASSWORD }}
+        run: |
+          # signtool ships with the Windows SDK on the windows-2025 image; resolve the newest one by SDK
+          # build number (sort the numeric version dir, not the lexical path, so 10.0.26100 > 10.0.9999).
+          $signtool = Get-ChildItem "${env:ProgramFiles(x86)}\Windows Kits\10\bin\*\x64\signtool.exe" |
+            Sort-Object { [version]($_.Directory.Parent.Name) } | Select-Object -Last 1
+          if (-not $signtool) { throw "signtool.exe not found (Windows SDK missing on the runner)" }
+          Write-Host "using signtool: $($signtool.FullName)"
+          $pfx = Join-Path $env:RUNNER_TEMP "codesign.pfx"
+          try {
+            [IO.File]::WriteAllBytes($pfx, [Convert]::FromBase64String($env:SIGN_CERT_B64))
+            # $signArgs, not $args ($args is a PowerShell automatic variable — avoid the collision).
+            $signArgs = @('sign', '/f', $pfx, '/fd', 'SHA256',
+                          '/tr', 'http://timestamp.digicert.com', '/td', 'SHA256')
+            if ($env:SIGN_CERT_PASSWORD) { $signArgs += @('/p', $env:SIGN_CERT_PASSWORD) }
+            # Sign the inner frozen exe first, then the installer that wraps it.
+            & $signtool.FullName @signArgs "dist/messagefoundry-console/messagefoundry-console.exe"
+            if ($LASTEXITCODE -ne 0) { throw "signtool failed on the frozen exe" }
+            & $signtool.FullName @signArgs "$env:SETUP_EXE"
+            if ($LASTEXITCODE -ne 0) { throw "signtool failed on the installer" }
+            Write-Host "Signed the frozen exe + installer (timestamped)."
+          } finally {
+            if (Test-Path $pfx) { Remove-Item $pfx -Force }  # never leave the cert on disk
+          }
+
+      - name: Note signing status
+        run: |
+          if ($env:SIGN_CONFIGURED -eq 'true') {
+            Write-Host "Installer is SIGNED."
+          } else {
+            Write-Warning "No signing cert secret configured — the installer is UNSIGNED (SmartScreen may warn). Provision WINDOWS_SIGN_CERT_BASE64 to sign (ADR 0032 Phase B)."
+          }
+
+      # Always upload the installer as a workflow artifact (inspectable on workflow_dispatch dry-runs).
+      - name: Upload the installer artifact (dry-run / always)
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: console-installer
+          path: dist/messagefoundry-console-setup-*.exe
+          if-no-files-found: warn
+
+      # Attach to the GitHub release — TAG-GATED only (a workflow_dispatch dry-run skips this). `needs:
+      # release` guarantees `release`'s `gh release create` already ran, so the release exists; --clobber
+      # lets a re-run replace the asset.
+      - name: Attach the installer to the GitHub release
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload "$env:GITHUB_REF_NAME" "$env:SETUP_EXE" --clobber