fi-fhir Roadmap

Last Updated: 2026-09-27 Tier: 1 (see workspace AGENTS.md "Portfolio Tiers") Tracking issue: https://gitlab.flexinfer.ai/libs/fi-fhir/-/issues/19 Completion spec: .loom/20-product-spec-integration-engine-ide-completion.md Execution plan: .loom/30-implementation-plan-integration-engine-ide-completion.md Plan store: plan-complete-fi-fhir-as-a-production-integration-engine-and-ide-341d98

Current Status

fi-fhir implements profile-driven parsing, canonical events, durable ingestion and delivery, and a Mapping Studio for authoring and operating integrations. It remains pre-1.0: implemented capabilities and repository tests do not certify all supported deployment profiles or every vendor feed.

The merged runtime includes authenticated HTTP and MLLP ingestion, S3/SFTP batch processing, PostgreSQL acceptance and replay, durable Integration Sessions, workflow simulation, reviewable publication, deployment controls, and identity and PHI policy. Kafka, Redis Streams, and Google Cloud Pub/Sub share event handlers and acknowledgment-aware consumers. FHIR transactions use a shared projector across workflow actions and durable destinations.

Delivered FHIR Bundles are validated offline by the HL7 official validator in CI against pinned R4 4.0.1 and US Core 9.0.0 packages; the findings ledger is checked in and held by exact equality.

The Mapping Studio reports what its API grants it: /api/auth/status carries the caller's roles, derived capabilities and missing roles, and every operator, streaming and Copilot surface renders the honest state from that contract instead of failing. The deployed shape is proven in CI by a blocking Playwright smoke gate against the built UI, the production nginx template and real API processes, with negative controls. The production deployment grants every IDE identity the operator bundle and runs the Integration Session workspace with SSE streaming on (2026-09-26).

The Mapping Studio was redesigned on 2026-09-26 (.loom/37): a design system of neutral tokens and shared primitives, a single-row shell with access and connection in the status bar, and every route rebuilt as a toolbar over tables with details panes. No surface shows simulated data. test:ui-e2e now captures every route at 1440×900 as review evidence and fails if the retired marketing copy returns.

Source and destination connections are authorable in the IDE since 2026-09-27 (.loom/38): a durable catalog of drafts that compile, with the existing document constructors, into the exact revision bytes serve mounts, labelled against what each replica actually mounted, plus an Engine view of the replica's composition and sample intake from a live source into an Integration Session. Activation stays a GitOps rollout; whether the catalog should ever activate configuration is the open question in .loom/39.

This update records repository state through merge b365f9511 on 2026-09-27. Pipeline 29328 built and deployed the redesigned UI (v0.1.29328, merge 4480af9ab); Pipeline 29194 is the last main pipeline that built the API image, including the browser smoke gate, the offline official validator, live HAPI FHIR read-back, Kafka/Redis, PostgreSQL/MinIO, and two-replica tests. These are internal GitLab records. Production activation and release certification remain separate decisions; this documentation update does not assert a new clinical-runtime deployment.

Delivered — Sprint 6 and clinical delivery (2026-09-20)

• S6-0 merge surface — CI includes, proof targets, and lane boundaries merged in MR !202.
• S6-A Slice 4.1c-c FHIR destination class — conditional-write transaction Bundles and durable delivery provenance, merged in MR !206.
• S6-C legacy E2E repair — a blocking service-backed test job, merged in MR !204. MR !211 adds live HAPI acceptance with fourteen top-level tests and no skips.
• S6-D Slice 5.1b — pinned R4 4.0.1 and US Core 9.0.0 archives plus structural validation, merged in MR !205. Official validator evidence is still required for conformance.
• Broker processors and common handlers — Kafka, Redis Streams, Pub/Sub, workflow queue drivers, workflow consume, and the outbox adapter, merged in MR !210. See event backends.
• CDA profile event selection — profile-configured emitted event types, merged in MR !209.
• Clinical FHIR delivery — condition, procedure, immunization, vital sign, medication request, and allergy intolerance events reach both delivery paths. Workflow selection and Patient/Encounter references are resolved; issue #20 is closed. Merged in MR !211. See FHIR output.

Delivered — Sprint 7 (2026-09-24 → 2026-09-25)

Spec: .loom/35-sprint7-execution-specs.md (MR !214).

• Slice 5.1c-α mapper cardinality gaps — the seven US Core cardinality violations the structural validator recorded in Slice 5.1b are closed from event data or US Core's unknown data-absent reason, never invented; a DocumentReference with no attachment is no longer emitted; Encounter.type derives from PV1-2 through the pinned US Core binding; recordedCardinalityGaps() is empty and all 25 fixtures validate clean. Merged in MR !216.
• Slice 5.1c-β official validator gate — HL7 validator_cli.jar 6.10.4 runs offline in the blocking test:fhir-official job over all 25 mapper fixtures and the 11 transaction Bundles the durable fhir transport actually delivers, against R4 4.0.1 and US Core 9.0.0 with the full 23-archive package closure pinned by digest. Findings are held to an exact-equality ledger (testdata/fhir/official/findings.ledger.txt) that can only shrink deliberately; a negative control proves the gate is live. Merged in MR !219. See conformance matrix §5.2.
• Slice 4.2c FHIR operator trace — OperatorDeliveryAttempt.deliveries projects the destination provenance ledger (transport, outcome, verified revision, endpoint and certificate advisories, and the FHIR resource types, entry count, and OperationOutcome issue codes) into the operator message trace and delivery console; ledger-only, clinical-content-free by construction. Merged in MR !217.
• Performance harness fix (S6-B, partial) — the report script could set certified: true on the runner variable alone, comparing no measurement to any budget; it now requires budget 1's p95/p99 to be met on the tagged runner in a non-regression build, records the negative control and runner id, and reports budget 3 as not_measured. Merged in MR !215. Nothing is certified: see Now.
• CI: MinIO service images mirrored — quay.io and Docker Hub withdrew minio/minio; both pinned service images now come from the internal registry by digest. Merged in MR !218.
• Close-out (docs/sprint7-close-out) — this roadmap, the plan's 5.1 block, one CHANGELOG block, and Lane S7-A's banked one-liner: fhirout.mapEvent now tells the mapper the event source, so the legacy workflow fhir action's raw Encounter carries the same urn:fi-fhir:source:<source> identifier system the durable transport already added through ensureIdentifier; the official-validator ledger is byte-identical.
• S6-B budget 1 certified on runner 8 (2026-09-25) — the negative control ran first (job 308698, -tags perfregress, certified: false, failed_budget: 1), then three plays on identical main code (jobs 308841, 309005, 309029, all certified: true, runner id 8): serial accept p95 under 10 ms and parallel under 51 ms against a 250 ms target. Serial-path spread ≤ 1.06× across runs; HTTP-parallel spread 1.24× is reported, not certified. The run window was opened by lowering the resident model pod's memory request in place, with no model restart. See SUPPORTED-1.0 rows 1–3.

Delivered — IDE repair program (2026-09-25 → 2026-09-26)

Spec: .loom/36-ide-repair-execution-specs.md (MR !223, corrections in MR !224). Every symptom was measured against the live deployment from the LAN before a lane was launched; none was in the trusted-network path itself.

• R-0 the operator bundle (platform/gitops MR 805) — the deployment granted only the transport grant graphql:operator, so the gate admitted every operator query and the service refused every one. Every IDE identity (static bearer, trusted network, both Access principals) now holds integration.operator, integration.delivery.operator and integration.deployment.operator as well. No code change; decision "Grant the operator bundle rather than alias the transport grant".
• R-A the auth capabilities contract — /api/auth/status reports principal, roles, derived capabilities (operator read/delivery/ deployment, clinical read, integration sessions, streaming, the allowlisted subscriptions, llm.configured) and missingRoles, checked in tests against the real operator service; serve warns once per identity holding the grant without the bundle. Merged in MR !225.
• R-B honest surfaces — the operator page pre-flights on capabilities.operatorRead and names the missing roles; streaming surfaces are keyed per subscription root and the four legacy panels never subscribe (the SSE allowlist admits only the two session roots by design); the session engine runs only when the build flag is on and the API reports integrationSessions; the Copilot runs on the backend LLM capability, the loom platform chrome hides unless PUBLIC_LOOM_ENDPOINT is set; the Problems badge counts only a live draft. Merged in MR !226.
• R-C streaming on, repo side — ui/Dockerfile ships the session engine on; production and runbook sections in docs/operations; the SSE client keeps the FORBIDDEN code the server's catalog-safe presenter leaves in place of the stream-specific message; an end-to-end "flag on, API off" test through the real gate, store and pages. Merged in MR !228.
• Production streaming (platform/gitops MR 811) — one env entry, FI_FHIR_INTEGRATION_SESSION_ENABLED=true; the store migrated itself into the durable PostgreSQL; no retention key (raw retention stays refused), signed publication off. Verified from the LAN: integrationSessionEvents answers 200 text/event-stream. Decision "Streaming flips before the UI image; the stream allowlist stays narrow".
• R-D the browser smoke gate — blocking test:ui-e2e: Playwright against the built UI served by the production nginx template in front of three real fi-fhir serve stacks on PostgreSQL (the bundle with sessions on; the bundle minus integration.operator; sessions off), with an existence guard so a renamed check cannot make the gate greener; make ui-e2e mirrors it. First CI run 7/7 in 249 s. Merged in MR !227.
• R-E HL7 intake line endings (R-D's finding) — intake sends CR-terminated segments on every path whatever the editor holds, and the built-in sample is an executable ADT^A01 for the first time (its separators were the literal characters \r). The kernel's strict line-ending gate is unchanged. Merged in MR !229.
• Close-out (docs/ide-repair-close-out) — this roadmap, one CHANGELOG block, the decision entry, and ci/test-ui-e2e.yml running when its own definition changes.

Delivered — IDE design uplift (2026-09-26)

Spec: .loom/37-ide-design-uplift-execution-specs.md (MR !232). The brief was that the Mapping Studio "looks like a toy". The evidence was 1440×900 screenshots of every route in production: four navigation layers above the content, marketing copy, simulated alerts on the home page, and gradients, glows, pills and cards where records belonged. The direction is calm, dense and precise; every lane attached before/after screenshots and was reviewed screenshots first, then diff.

• U-0 design system — dark-first neutral tokens with one accent reserved for focus, selection and primary actions; 13 px UI type, 4 px grid, 28 px controls, 36 px toolbars; primitives in ui/src/lib/ui/primitives/ (Button, IconButton, Tabs, Badge, Panel, Toolbar, Table, Field/Input/Select/ Textarea, EmptyState, KeyValue, Popover, Icon), Lucide icons, a dev-only /design gallery and ui/docs/DESIGN.md. Merged in MR !233.
• U-1 shell — one 40 px header with the five-stage control, a breadcrumb and Commands; access and connection live in the status bar (the credential strip and journey band are gone, the bearer entry is a centred dialog); document types with no editor removed; a layout saved on Operator restores. Merged in MR !235.
• U-2 home, events, operator — Home is Recent, Integrations, Health and Alerts on real sources; the simulated observability fallback is deleted, so no surface can show invented alerts; Events and Operator are toolbars over tables with details panes. Merged in MR !236.
• U-3 intake, workflows, profiles, terminology — HL7 intake is editor-first with one status line; workflows, profiles and terminology are toolbars over tables with details panes. Review found a failed preview invisible with the session engine on and a lost per-row sample edit; both fixed before merge. Merged in MR !234.
• U-4 visual evidence in the gate — test:ui-e2e captures 1440×900 PNGs of every route as job artifacts and fails if the retired marketing copy returns; no pixel goldens. Merged in MR !237.
• Production — UI v0.1.29328 verified from the LAN at 1440×900 on every route, including an HL7 Preview on the session engine.
• Close-out (docs/ide-uplift-close-out) — this roadmap, one CHANGELOG block and the worklog entry.

Delivered — Connections and engine properties (2026-09-26 → 2026-09-27)

Spec: .loom/38-connections-execution-specs.md (MR !240). The brief was to view and configure the engine's properties, define source and destination connections, and sample messages from a source to build a profile against. Connections had no durable home and no API: sources, destinations and definitions were immutable JSON documents serve mounted at startup. The program makes them authorable, compilable, exportable, and honestly labelled against what the running replica mounted; it does not hot-load anything (Decision 1).

• C-0 connection catalog, engine runtime, capabilities — internal/integration/connection, the seventh forward-only ledger (integration_connection_schema_migrations): drafts under an optimistic version, append-only revisions compiled by the existing MLLP, batch and destination constructors (plus a new content-addressed HTTP source document) and stored as exact bytes, the capture audit table, secret bindings as references only with a write gate that refuses secret material; GraphQL catalog fields and the allowlisted, secret-free engineRuntime; /api/auth/status gains connectionsRead, connectionsWrite, controlPlane and connectionCatalog; test:connection-catalog. Merged in MR !241.
• C-1 /connections — Sources, Destinations and Engine tabs built only from the design-system primitives: tables with the honest status (Draft, Compiled rN, Referenced, Deployed, Mounted here), a settings form generated from each kind's spec with server problems on their fields, a Secrets table with no value column, reason-required save/compile/archive, Download and Copy JSON of the exact revisionJson, and an Engine view with the env key behind every property. Merged in MR !243.
• C-2 sample intake backend — peekBatchConnection (no lease, checkpoint, archive or delete; proved byte-identical on MinIO) and an admission-time capture tap on the MLLP listener and HTTP ingress that never changes a result, ACK or receipt, with a 2 s armed-capture cache, a SKIP LOCKED slot protocol, one armed capture per source, a superset capture redactor (113 Safe Harbor fields, dates whole), a peek secret allow-list, and test:connection-capture. Merged in MR !242.
• C-3 sample intake UI — From connection… in HL7 intake's Samples panel: mounted and catalog sources with their state, an armed-capture row that polls while armed, audited batch browse and read, and captured samples that open from redactedPayload and preview by sampleId. Merged in MR !245.
• C-4 close-out (docs/connections-4-close-out) — the Connections guide, Connection catalog operations, the lifecycle doc's exposure line, seven ledgers in AGENTS.md, this roadmap, the decision and worklog entries, and the new captures in ui/docs/DESIGN.md. Merged in MR !248.
• .loom/39 configuration-plane brainstorm — reopens Decision 1 deliberately; see Then. Merged in MR !244.

Now

• Stale capabilities in an open tab — a tab reads /api/auth/status once at load; after a rollback of the streaming flip, or after a bearer is entered, it keeps the capabilities it loaded with. Re-probe the status when a session mutation is refused with "legacy integration execution is unavailable" and after credential entry; until then, reload the tab (documented in INTEGRATION-SESSIONS.md).
• Copilot: enable the backend LLM in production — the IDE says "No LLM is configured for this deployment" because the runtime enables LLM features only with FI_FHIR_LLM_ENABLED=true, and the in-cluster LiteLLM refuses keyless calls (401) while fi-fhir-api carries no LLM_API_KEY. The chosen route is scoped LiteLLM virtual keys declared in GitOps (platform/gitops .loom/30-implementation-plan-litellm-scoped-keys.md, MR 815): a dedicated LiteLLM database, keys declared once as labelled SOPS secrets in each consumer namespace and reconciled by the LiteLLM manager, fi-fhir first. Implementation waits on an owner decision (it writes shared platform resources and secrets). Then verify capabilities.llm.configured: true and copilot-llm-state = ready.
• Terminology-store availability as a capability — terminology without a mapping store shows only "GraphQL request failed" and an error toast, because the API's reason ("terminology mapping store not configured") does not reach the UI. Add it to the status contract and say so on the page; then give the test:ui-e2e operator-bundle stack a mapping store so its Terminology capture shows a real Browse view. (The operator-plane half of this item closed with the Connections program: /api/auth/status reports controlPlane and connectionCatalog, so "not configured on this deployment" is told apart from "forbidden".)
• Stream capture of real ADT feeds — the v1 production kernel admits only ADT^A01 frames with MSH/EVN/PID/PV1 (+NTE); a frame carrying NK1, IN1 or any other segment is answered AR and never durably accepted, so a stream capture of a typical ADT feed sits armed with nothing captured until it expires. Batch peek is unaffected. Widening admission is a kernel change with its own profile-compile rules (processor/profile_compile.go refuses the unknown-segments tolerance).
• Engine properties the Engine tab cannot show — serve --help and the engineRuntime allowlist now cover the session, delivery identity and SFTP passphrase keys, plus FI_FHIR_CONNECTION_SECRET_* as the allowlist's one prefix rule (docs/operations/CONNECTION-CATALOG.md).
• operator-bundle e2e timing budget — check 2's 10 s waitForResponse starts before page.goto, so a slow first load on a saturated runner consumes it (one retry on MR !242's pipeline; 15/15 locally). Start the wait after navigation or give navigation its own budget.
• Events browser reads the legacy store — /events Browse, Patient Timeline and Statistics query graphql_events, which serve never writes (only the test-only legacy submitMessage path does); durable admissions land in integration_canonical_events. The views show honest empty states on every real deployment until durable admissions feed them.
• IDE polish follow-ups from the design uplift — TabItem.badge on the Tabs primitive so the bottom panel drops its own tablist; one palette registry so HL7 intake's palette also lists the workspace commands; finish or remove the split workspace (its second pane cannot show a route); restyle ConfirmModal and WarningList.svelte; count the workflow draft in Problems only once it differs from the default (opening Workflows shows "Problems 3" for an untouched draft); the workflow builder's baseline hides divergence when yamlToDraft drops nested action config; PID-3[0].1 resolves empty for the built-in sample. (The Health panel's build-tag mismatch closed in MR !238: UI and API builds now carry the Harbor tag Flux deploys.)
• Budgets 2 and 3 — budget 2 needs a one-hour, two-replica run at the declared 250 msg/s (the single-process harness cannot certify it); budget 3 needs a 1-GiB batch-import workload reading cgroup RSS on runner 8. The test:performance-profile job schedules on runner 8 only when cblevins-5930k has 11 GiB of schedulable headroom; the in-place resize recipe that opened the 2026-09-25 window is in that day's decision entry.
• Slice 5.1c-γ official-validator findings — the ledger records 157 findings (28 errors) over 36 inputs after Slice 5.1c-α: FHIRPath invariants, identifier and URL datatypes, local code-system membership, in-Bundle reference matching, and two DiagnosticReport slices. Cardinality errors are zero. Closing these is the next mapper slice; VSAC-bound value sets stay "not found" warnings under -tx n/a by decision.
• Coverage.relationship for dependents — stays unknown until EligibilityResponseEvent carries the X12 INS02 relationship code.

Delivered — Phases 0–2

• Gate 0A — secure baseline — MR !89 pipeline 18379 green on 2026-07-12; lint, govulncheck, and gosec each passed individually.
  • Go 1.26.5 in module, CI, and container builds.
  • Go-1.26-compatible golangci-lint.
  • Event-store SQL identifier injection closed with regression coverage.
  • govulncheck, gosec, tests, build, MR pipeline green.
• Gate 0B — truthful delivery — MRs !90–!92 and subsequent main pipelines proved benchmark, security, build, scan, and deployment truth; the Slice 1.1a main pipeline 18542 remained green across all 33 jobs.
  • UI, binary, smoke, live WebSocket, contract, codegen, and security jobs run when applicable and cannot pass by skipping their subject.
  • npm is the canonical UI package-manager path; frozen installs are reproducible.
  • deployment/status documentation matches executable behavior.
• Golden Path 001 foundation
  • Slice 1.0 locked the 1.0 support matrix, tenancy/identity/PHI/secret contracts, minimal immutable integration revision, and result invariants.
  • Slice 1.1a made exact profile/workflow revision resolution immutable and proved v1-after-v2 reconstruction in required PostgreSQL CI.
  • Slices 1.1b and 1.1c shipped in MR !96: one deterministic ADT A01 kernel, one authenticated typed GraphQL/IDE adapter, exact origins, memory-only browser data, and fail-closed legacy operations. MR pipeline 18604 passed 30/30 jobs; main pipeline 18621 passed 33/33 and published matching v0.1.18621 images. GitOps MRs !368 and !369 rolled out the verified digests, passed the public live gate, and resumed healthy image automation.
  • Slice 1.2 added the PostgreSQL-only production committer: one transaction records the receipt, canonical event, lineage, initial attempt, and outbox work. MR !98 job 181669 passed the blocking PostgreSQL 16 race/fault/restart proof, collapsing 64 callers to one raw-free durable admission unit.
  • Slice 1.3 added the first authenticated production adapter at exact POST /v1/hl7v2, with bearer/HMAC credentials, server-owned integration and source identity, bounded bodies, structured failures, and PHI-free durable responses. make golden-path-001 passed 20 assertions across duplicate, restart, profile-delta, PostgreSQL cardinality, IDE parity, and leakage gates. MR !99 pipeline 18898 passed 32/32; main pipeline 18951 repeated the Golden Path proof and passed 35/35 on merge commit 48d156d2.
• Phase 2 production channel runtime
  • Slice 2.1 adds digest-bound connection-validation freshness, schedules, health thresholds, and capacity to immutable integration revisions. Its PostgreSQL catalog enforces draft/validate/approve/publish/deploy/pause/ resume/retire, optimistic versions, append-only evidence, immutable release records, health projection, and deployed-only exact revision resolution;
• optional runtime-wired S3/SFTP batch ingestion now streams concatenated HL7v2 through the shared durable processor with PostgreSQL lease/checkpoint recovery, pinned SFTP host keys, and verified digest-addressed archive-before-delete; MR !101 pipeline 19014 passed 32/32, including required PostgreSQL 16 lifecycle job 183463; merge commit a95bb44f repeated that proof in main job 183702. The first main run also exposed an existing concurrent receipt primary-key arbitration defect. MR !102 fixed it, pipeline 19045 passed 24/24, and final main pipeline 19052 passed 26/26 with durable-submission job 183938 and lifecycle job 183940 independently green.
  • Slice 2.2 adds a content-addressed UTF-8 MLLP source, fragmented/multi- frame transport, TLS 1.3 mutual authentication and CIDR policy, bounded capacity, safe application/commit ACKs, and optional serve composition. Each frame starts from the lifecycle catalog's exact deployed binding and repeats authorization inside durable admission before a positive ACK. MR !104 pipeline 19175 passed 33/33, including PostgreSQL 16/TCP MLLP job 184996; merge commit 6205fa39 repeated the proof in main job 185093. Main pipeline 19193 passed 36/36. Production GitOps activation remains intentionally pending.
  • Slice 2.3 adds durable delivery attempts, bounded retry/circuit policy, DLQ replay/resubmit, and a real Kafka publisher. MR !106 pipeline 19226 passed 34/34, including kill-test job 185433; main pipeline 19235 passed 37/37 and repeated the proof in job 185505. Evidence MR !107 reconciled the exact proof on main.
  • Slice 2.4 adds exact deployed S3/SFTP sources, bounded streaming, PostgreSQL lease/checkpoint resume, deterministic admission identity, pinned host keys, and verified digest archive semantics. MR !108 pipeline 19331 passed 35/35, including required PostgreSQL 16/ MinIO/SSH-SFTP job 186259, and merged as ed32915f. Main pipeline 19344 passed 38/38 and independently repeated the proof in job 186476. Evidence MR !109 reconciles the canonical completion records. Production GitOps activation remains intentionally pending.

Delivered — Phase 3 (3.1, 3.2)

• Phase 3 Slice 3.1 restart-safe Integration Session Workspace — MR !111 pipeline 19409 passed 37/37, including required PostgreSQL restart/raw-PHI job 187425, and merged as 15746ccd. Main pipeline 19424 passed 40/40 and independently repeated the proof in job 187618.
• Phase 3 Slice 3.2 streaming diagnostics and server lineage: feature-gated authenticated GraphQL SSE, durable run reconciliation, Problems diagnostics, and canonical inspector lineage. MR !115 pipeline 19464 passed 34/34, including required session job 187950 and benchmark job 187953, and merged as 36f2bb8c. Main pipeline 19482 passed 37/37 and repeated the session proof in job 188135. Production GitOps activation remains pending.

Delivered — Phase 3 (3.3, 3.4) and Phase 4 (Sprints 3–5, 2026-08-08 → 2026-09-05)

• Workflow simulation against durable session data (3.3) and reviewable bundle publication with exact-revision promotion (3.4).
• Operator control plane: GraphQL API (4.2a) and UI (4.2b) — trace browser, deployment controls, DLQ tooling.
• Identity, authorization, and PHI policy (4.1a–4.1e, including the destination identity contract 4.1c-a and the HTTPS destination consumer 4.1c-b), truthful observability and multi-replica behaviour (4.3), and the recovery/upgrade/performance family (4.4a migration compatibility, 4.4b performance harness, 4.4c chaos/DR, 4.4d structured logging, 4.4e per-deployment MLLP rate quota); purge role separation; 5.1a mapper/checker reconciliation. Execution specs .loom/31–.loom/33; evidence per slice in .loom/worklog/.

Then — the 1.0 remainder

• Integration definition editor (.loom/38 Decision 5) — bind a source connection revision, a Source Profile, a workflow and destination revisions into a definition draft in the lifecycle catalog, from the IDE. Nothing in production writes definition drafts today, so a connection's Referenced and Deployed states are honestly absent on every deployment nobody seeded. Doing it honestly also moves profile and workflow resolution off the static registry (they load only from it today), which removes the two-truths hazard between the static registry and the lifecycle catalog.
• Configuration-plane execution spec — turn .loom/39-brainstorm-config-plane-2026-09-27.md (MR !244) into a .loom/ execution spec if chosen: the recommendation is a provisioned GitOps baseline plus a catalog overlay for the hot-reloadable class, observed per replica, with operational verbs always in the database and listeners/TLS kept in GitOps (lanes: observed status, baseline import, catalog activation, promotion MR bridge). Blocked on its kill-test, not yet run: two serve replicas swap an https destination compiled in the catalog into the live delivery registry without a restart, both deliver to the new endpoint and report the new digest within 5 s, and a revision whose digest the definition does not name is refused by ValidateAgainst with the observed digest unchanged. If it fails, the catalog stays authoring-only and activation stays a rollout.
• Public demo, portfolio links and docs coverage — planned in .loom/40-public-demo-execution-specs.md (MR !247): a WASM build of the slim preview kernel in the browser (size kill-test passed; parity kill-test first), the flexinfer-site playground on the real kernel, docs coverage of the new features with a docs-sync drift check, a preview-only hosted demo with no database, and a hardening lane for the workflow debugger's caller-supplied actions and createFhirSubscription's unrestricted egress.
• 5.2 SMART Backend Services and Bulk Data 3.0.0; 5.3 extension and compatibility contract.
• Phase 6 release evidence: budget 7 on Kubernetes 1.36, all six golden journeys on the supported deployment profile, no open P0/P1.

1.0 standards and release scope

• FHIR R4 4.0.1 with pinned US Core 9.0.0 validation.
• SMART App Launch 2.2.0 and Bulk Data 3.0.0 conformance journeys.
• Supported Compose and Kubernetes deployment profiles, current/previous evergreen browsers, documented compatibility and migration policy.
• All six golden journeys and numeric security, accessibility, latency, throughput, memory, RPO/RTO, and upgrade gates pass.
• No open P0/P1 completion issue and no false production-readiness claim.

Program gates

Gate	Exit evidence
Gate 0A	Security baseline MR merged with terminal green pipeline
Gate 0B	Deliberate-failure proofs plus complete positive CI path
Engine Alpha	Golden Path 001 kill-test passes through one processor
Engine Beta	MLLP, durable delivery/replay, and operational trace pass
IDE Beta	Restart-safe author/test/publish/deploy journey passes
Release Candidate	Governance, accessibility, scale, DR, and upgrade gates pass
1.0	Six golden journeys pass on the supported deployment profile

Backlog

Full backlog: P1 issues · P2 · P3 · Milestones