OPRP experimental implementation changelog

All entries describe synthetic prototype behavior. No production specification has been frozen and no public package has been released.

0.1.0-dev.11 — October 5, 2026

Added injectable SQLite-compatible Host storage, service-identity binding and explicit legacy adoption, streaming-hashed online snapshots with atomic no-replace installation, and opaque readiness/integrity helpers. Added a persistent, local-only two-Host development lab with retained identities, scoped standing policy, renewed development credentials/status, verified TLS and restart/receipt conformance.

Added a portable Convey-branded documentation builder, stable multi-page routes, source/schema access, SDK/project-status pages, a developer entry guide and release roadmap. The website is generated from repository Markdown and checks local links/assets/anchors. Public Git destination, license and DNS status are recorded separately; this source increment does not claim those publication steps succeeded.

Six new storage/operations tests complement the existing 119 cases. Updated locally installable SDK/profile packages for this developer increment. Native .NET crypto, broad clinical terminology, independent review and production deployments remain open.

Next: finish the public developer publication, then production persistence/key-custody and broader clinical coverage.

0.1.0-dev.10 — October 2, 2026

Locked the complete tested HL7 dependency cache by package version, sorted path/content hashes and configuration hash. Validator runs disable HTTP and verify cache/profile/terminology contents around each invocation. Added staged installation from a verified cache copy/bundle and local cache packaging.

Added finite local code-system/value-set validation with explicit unknown-system/version rejection, primary coded-concept requirements and selected status/encounter bindings. Synthetic clinical codes are test-only; LOINC, SNOMED CT, RxNorm and UCUM catalogues are not included.

Added separate Host-owned SQLite validation jobs/approvals, digest/configuration/owner binding, bounded worker leases/retries/quotas, stale-completion protection and durable intake/archive/migration gating. All three requester queues stop on terminal clinical rejection. Validation still never grants patient access or commits a requester write itself.

Verified unit/integration cases, real pinned-engine offline/local terminology and durable restart/migration workflows, locally packaged SDK consumers and synthetic exchange/recovery demonstrations. See operator guide and implementation status for precise coverage and remaining gates.

Next: replaceable Host persistence/storage interfaces, reproducible deployment and health/recovery tooling.

0.1.0-dev.9 — October 2, 2026

Added six versioned R4 StructureDefinition differentials, a draft ImplementationGuide, a local FHIR package/index, checksums, minimal examples and a separate US Core 9.0.0 profile mapping. MedicationStatement has no supported mapping in the selected US target and fails explicitly.

Added a SHA-256-pinned HL7 validator 6.10.4 runner with cloned/bounded inputs, private temporary files, current artifact/profile checks, workspace-local cache, disabled remote terminology/resource fetching, process limits and input-bound OperationOutcome parsing. Terminology and complete transitive dependency locking remain open. The real engine accepts six base and five selected US examples, rejects six forbidden-contained examples and a US completed Procedure missing performed time, and verifies an encrypted Host write preflight/retry scenario.

Added an optional trusted Host admission cache for digest-bound successful preflight, checked transactionally before new clinical writes, classification and archive/migration materialization. Cached approvals expire and are lost on restart; committed receipts still recover retries. The gate is explicitly advertised while installed and adds no new patient login or public admission endpoint. Eight integration test functions bring the reference suite to 104; local TypeScript/Python/.NET artifacts are rebuilt as dev9.

Added the external-validation guide and profile catalogue checks. This is synthetic structural/profile evidence, with warnings and terminology disabled; it is not clinical safety, exhaustive FHIR/US Core server certification, an IG Publisher build, public package licensing or deployment. Dependency locking/local terminology and durable validation-intake/migration scheduling are next.

0.1.0-dev.8 — October 2, 2026

Added oprp-visibility-1: Host-owned per-grant exact-label clearance, default labelled-resource denial, bounded field masks and SUBSETTED views across reads, history, snapshots, changes and callback scheduling. Trusted local classification versions six-type label changes atomically; application writes cannot change security labels or replace incomplete representations. Field-restricted types are read-only. Full requester exports require complete visibility; authoritative imports reject incomplete tagged material.

Added grant-specific visibility epochs to baseline/change pages and cursor binding. Policy/classification transitions invalidate old cursors and force TypeScript/Python/.NET mirrors to clear and rebuild, including field changes at unchanged clinical versions. Retention pruning considers each grant's visible events; never-visible activity does not wake its callbacks. Legacy epoch-less mirrors restage. Offline clients cannot learn unseen changes, and local storage protection remains operator-owned.

Added seven visibility and three negative test functions, bringing the Node suite to 96. Shared packaged Python/.NET scenarios reject twelve envelope mutations and seven authenticated malformed pages, block cached reads across restart after protocol errors and recover normally. Python now validates header integer times/IDs; .NET now binds the authenticated credential subject to the generic envelope's signed sender. Packages are rebuilt and installed locally as dev8, without public release.

Added visibility and negative-conformance guides and supplemental policy/response schemas. Full FHIR/US Core validation, comprehensive label handling/purpose policy, generated fuzzing, scalable filtering, secure native providers and production integration remain open. Upgrade Host and SDK together; this is an evolving experimental wire contract.

0.1.0-dev.7 — October 1, 2026

Tightened the six reference clinical profiles with selected field/coding/reference shapes, calendar/time validation, choice exclusivity, extension structure and Condition/Allergy status invariants. Admission is advertised as oprp-r4-clinical-2; it remains a bounded subset and may reject resources/archives previously admitted. No clinical fields are silently rewritten.

Added immutable SQLite read sessions for scoped search/history/baseline pages, including optional limit/page cursor, current authorization on every continuation, captured totals, stable snapshot watermarks, expiry/context checks, bounded allocations and serialized byte budgets. Change pages also respect a byte budget. Callers must inspect has_more and enumerate every baseline page.

Added locally packaged TypeScript/Python/.NET durable mirrors with staged baselines, atomic resource/cursor commits, versioned tombstones, restart/resume, immediate post-baseline catch-up, retained-feed rebuilding, context invalidation and explicit stale-read choice. All reference persistence remains plaintext/operator-owned; cross-process coordination and field/security-label visibility are not implemented. .NET integer validation now accepts internally constructed integer state without weakening bounded wire values.

Seven new focused tests bring the suite to 86. Shared packaged-consumer scenarios add paged history, mirror restart/deletion, retention-gap recovery, outage blocking and revocation. Added validation and pagination/mirror guides and supplemental schemas. Full FHIR/US Core and serialization/fuzzing conformance, field/security-label invalidation, reviewed native .NET/key custody and production operations remain next work.

0.1.0-dev.6 — October 1, 2026

Added scoped generic read/search/create/update/delete/vread/history for Condition, AllergyIntolerance, MedicationStatement, Encounter, Procedure and Immunization. Writes persist immutable versions and acceptance attribution with atomic metadata-only receipts/events. Logical deletes retain history and emit scoped clinical-free tombstones. Expanded snapshots/topics/queues and signed archives preserve new types, history, deletion state and late retries through restore and live Host migration.

Added a compiled TypeScript package with consumer declarations, a Python backend SDK wheel with independent PQClean crypto/persistent trust/client/queue/receiver/backup helpers, and a .NET 10 NuGet SDK with independently implemented envelope/trust/client logic, persistence adapters and explicit local PQClean primitive provider. Native .NET ML-KEM/ML-DSA are unavailable on the tested macOS runtime; no classical fallback is used. Packages are built and installed locally, not published.

Added shared packaged-SDK conformance and a compact-JSON interoperability corpus. Nine new resource test functions bring the reference suite to 79 passing tests; SDK scenarios exercise approval, scoped clinical mutations/history, bounded refresh-loss recovery, backups, callback restart/dedup, queue retries and durable revocation. Full clinical/US Core validation, pagination, larger archives, native reviewed providers, secure storage, fuzzing and production operations remain release work.

0.1.0-dev.5 — October 1, 2026

Added optional grant-bound subscription registration/status/cancellation, topic and lifetime checks, idempotent IDs, same-key credential renewal and bounded registration pressure. A signed, post-quantum encrypted callback challenge activates only the requesting application's pinned keys. Default outbound transport checks HTTPS/public destinations, resolves each attempt and pins the socket, validates TLS and rejects redirects.

Visible accepted changes enqueue coalesced hints atomically through a database trigger. Durable delivery IDs, retry backoff and shared-database leases recover outages/lost replies; the receiver commits deduplication receipts and pull tasks before acknowledgment. Concurrent changes/inbox completion preserve later wake-ups. Every delivery rechecks current grant, representative, key/status and Host custody; source release transfers no subscription authority.

Added TypeScript subscription methods, a durable receiver helper, callback schema, developer contract/conformance documentation and a two-endpoint verified HTTPS demonstration. Seventy tests now pass, including fourteen new subscription cases; original HTTPS, migration, independent Python interop and recovery checks also pass. This remains an experimental narrow clinical slice with an explicit operator worker, pending security review and production operations.

0.1.0-dev.4 — October 1, 2026

• Added coordinated migration for the reference Patient/laboratory profile: trusted source/destination owner admission, inaccessible staging, final full catch-up, same-transaction source fencing and immutable final ready receipt.
• Added signed source release before destination activation, atomic materialization and restart-safe activation receipts. Source grants/pending tasks retire; source data remains retained and fenced. Only pre-release cancellation can reopen it.
• Added independent persistent address-provider publication that verifies the complete signed handoff and compares the source/patient/generation before switching WebFinger. No mandatory Convey directory exists.
• Added verified SDK route switching and per-patient queue pins. Source tokens/cursors are cleared or rejected; destination authority/snapshot precede unchanged logical operation retries. Another patient's queue is never silently redirected.
• Added current representative checks and explicit trusted continuation without changing plan, target, expiry or final content. Old Host credential expiry does not prevent following fresh destination discovery.
• Added optional signed custody evidence to archives, protected Host-to-Host transport, a two-Host HTTPS migration demo, fourteen failure/recovery tests, structural schemas and detailed migration/conformance guides.
• Fifty-six tests, strict typecheck, all synthetic demos, independent Python exchange and documentation checks passed.

This evolving draft adds a sixth management scope and new custody/staging/queue-route tables. Old archives without optional handoff evidence remain readable. Legacy queues pin routes to their explicitly supplied initial client. Public owner/enrollment APIs, general/incremental streaming, aliases, anti-rollback and distributed custody recovery remain work. An old database restored over a released source is not safe normal restart recovery.

0.1.0-dev.3 — October 1, 2026

• Trust roots now require explicit kind/namespace/role/lifetime/status policies. Signed status has bounded freshness, monotonic sequence/equivocation checks and durable serial/key revocation and local issuer disablement.
• Added same-key renewal coverage, durable requester key pins, dual-key planned rotation with restart-safe receipts, retired old refresh credentials, unchanged grant boundaries and explicit bounded token replacement.
• Added separate oprp/record.export permission and signed full archives for the reference Patient/laboratory profile, including IDs, versions, unknown fields, logical write receipts, retained events/audits and source verification evidence.
• Added independent AES-256-GCM backups, offline verification after source disappearance/credential expiry, atomic empty-record restore and preserved receipts for destination-authorized late retries.
• Restore/re-export retains original signed history evidence. Source grants, private keys, refresh/access tokens and service secrets are excluded; live cutover remains unimplemented.
• Write-only mutation/receipt responses now limit returned content to submitted fields and assigned identifiers.
• Python interop now verifies supplied authority constraints and fresh signed status. Added recovery demo, structural lifecycle/archive schemas, two detailed guides and updated publication sources.
• Forty-two tests, strict typecheck, HTTPS demo, independent Python exchange, offline recovery demo and documentation checks passed.

This draft changes TrustStore configuration and adds a fifth scope; update caller policy/status setup and schemas together. New prototype tables initialize alongside existing storage. Legacy opaque mutation receipts without export context block safe export. This is not production migration tooling, a complete FHIR archive or a frozen standard.

0.1.0-dev.2 — October 1, 2026

• Refresh requests now require a logical request_id. Retries under the same ID can recover the same successor for 120 seconds; a different-ID reuse still revokes the grant. This changes the earlier draft refresh body.
• SDK state export/restore and an awaited persistence hook preserve refresh transaction IDs across restart. Cross-process sharing still requires coordination.
• Pending requests now return expires_at, can be cancelled by their requester or denied through trusted Host approval integration, and cannot be revived after expiry/denial/cancellation.
• Reference Hosts apply configurable new-request and pending-task limits before creating approval tasks, and reevaluate pending policy on polling.
• Added consistent scoped snapshots, durable ordered change events, encrypted context-bound cursors, pagination, visible-history retention, and snapshot recovery after gaps.
• Mutation/event/receipt/audit commits are atomic; write retries do not create duplicate events. Hidden-event retention does not force an unrelated reader's resynchronization.
• Expanded HTTPS demonstration, independent Python operations, machine-readable requests and documentation. The suite now has 30 tests.

The wire header remains experimental v: 0.1; this is an evolving draft rather than backward-compatible released software. Existing pending requests lacking lifecycle metadata fail closed as expired. New SQLite tables are initialized alongside existing prototype state. Record, queue and Host private-key migrations are not production tooling.

0.1.0-dev.1 — October 1, 2026

First executable foundation: signed WebFinger domain delegation; ML-KEM/ML-DSA protected exchanges; independently configured development authorities; Host-issued scoped JWTs with conditional approval, duration, refresh and representative context; limited Patient/laboratory operations; atomic write receipts; and a first single-worker durable queue. Seventeen tests, the HTTPS demo and independent Python cryptographic exchange passed.