v0.8.0-alpha

[0.8.0] — 2026-09-08

Two pieces of work. First an audit of everything 0.7.0 shipped — driving the
real CLI and the real GUI rather than reading them, with each finding raised as
an issue and fixed in its own pull request. Then a reduction pass: thirteen
slices, each merging things that did one job in several voices, each measured
against a byte-for-byte snapshot of what the previous commit wrote.

src/ fell from 52,070 lines to 42,312. Almost all of that was prose the code
did not need: docstrings narrating bug history, comments restating the line
below. Executable code fell 308 lines — far short of the plan, because the
per-slice estimates had counted prose the first slice already removed. The
consolidations are real; they simply bought fewer lines than the arithmetic
assumed. Tests gained 1,670 lines of code, because every consolidation left a
guard behind.

Nothing a user types changed. Every command, flag and default is byte-identical,
and the C-CDA digest over 6,144 generated documents is unmoved.

Added

• The rulebook and the safety net. docs/RULES.md, docs/AUDIT_LEDGER.md,
  CLAUDE.md and six skills, plus the tools that hold them: a snapshot of every
  deliverable, a prose ratchet, a floor under the regression-guard count, and a
  clock seam that makes two runs byte-comparable. (#415)
• A conservation ledger for C-CDA ingest, and a 6,144-document generated
  corpus to run it against — every element the source offered, and what became
  of it. (#309)
• A run names the inputs it was prepared under and refuses when any of them
  changed underfoot. (#348)
• What rendered is what was reviewed, and it can be named. The reviewed
  route and the run's gates ride in the manifest; an executor refuses without
  them. (#350)
• A --bundle DocumentReference for a document sitting right beside the
  chart it belongs to. (#382)
• The guided session opens on the vessel mark rather than a pipe character.

Changed

• Teach-a-format and teach-a-layout are one learn capability. Both flows
  were already analyze → confirm → emit, so they now share one command object,
  one confirm gate and one trust write. anast pack init and anast source init are unchanged — this is an internal consolidation, and the single
  anast learn front door the plan called for is not built yet.
• Both Teach modes run on one scaffold in the browser, driven by a step
  descriptor the backend returns.
• One FHIR field table replaces three hand-written mappers.
• One deliverer writes both file trees — the archive and the bundle differ
  in grouping, not in operation.
• One walk discovers template packs and destination packs.
• One seam attaches a destination, where the CLI and the GUI each had their
  own.
• QA and the verification ladder go flat: checks are functions in one file,
  and the L0–L6 ladder is a table rather than a class per level.
• The command layer left the primitives package, so core/ is leaf-only.
• The shared primitives have one implementation each — one hasher, one
  atomic write, one date parser, one identity rule.
• One HL7 II rule in one place, instead of four hand-written copies that
  had each been fixed separately and drifted apart. (#320, #393, #404, #412)
• The prose sweep: the code says less and means the same.
• The greeting mark arrives and then stops moving. It reaches the menu in
  0.86 s rather than 8.61 s; the settled mark is character- and colour-identical
  to before. (#428)
• Which visits become charts is a run's choice, not the product's opinion.
  The rules that skipped a visit are now options a person can see and switch.
  (#288)
• The browser pack's selector slots are read off the schema that declares
  them, rather than three hand-typed tuples.
• A trust hash gates execution, not editing (rule 111), and third-party pack
  code no longer runs with the desktop user's authority. (#350)
• anast upload refuses an unverified bundle. A deliberate behaviour
  change. (#350)
• The draft pack's markup lives in template files, and a half-written draft
  is no longer left behind as if it were one.
• The guided session stops telling you every destination is ready to receive
  charts when only one has a filing assistant.
• A selector under a name the loader does not know is refused, loudly.
• A layout or an export format is shown by the name its author typed. (#164)
• Every command's help says what that command does, and names a next step that
  exists. (#196, #197, #201, #203)
• anast info says what is installed; anast doctor is the command that tries
  things. (#190)
• The Uploads counters are named for what they count: charts in the record, and
  PDFs in the folder. (#214)
• Charts already in a folder answer the question being asked. (#189)
• The complexity ratchet no longer punishes a deletion.

Fixed

Identity and conservation. These are the ones that could put the wrong thing
in a chart.

• Two patients whose medical-record numbers collided were merged into one
  chart. Reading half an identifier made two people look like one. (#393,
  #404)
• One patient was several charts, and only one of them arrived. (#375)
• A visit named by two documents became two charts, where the source stated
  one id. (#378, #393)
• A uuid4 minted at parse time rode into every delivered bundle, so two
  loads of one document wrote two different bundles. Each fact now derives its
  id from what the source stated. (#405)
• An entry under prose was preserved by nothing, and an id-less organizer
  component doubled on export and stayed doubled. (#364, #365, #366)
• --ccda delivered a patient's chart with none of their documents on it.
  (#373)
• An upload manifest came back empty for a patient whose whole chart is
  attachments. (#374)
• A chart with no encounters was never verified. (#383)
• A positive verdict has to be backed by the thing it claims: a section that
  never looked does not get to deny. (#314)
• A vital carried by the rendered summary was graded as on no chart at all.
  (#239, #392)
• A bundle's QA report left out the verdict on the one page the bundle is
  for, and a QA context read back the first document it ever saw rather than
  the one it was asked about. (#398, #399)
• Two record-level lists never reached a FHIR bundle at all.
• Two files whose names sanitize alike could take one delivered slot; two charts
  can never land on one file. (#186)
• A re-rendered loss ledger keeps every narrative node. (#122)
• Two exports of one record are byte-identical again. (#193)
• The clinical note is verified to have reached the page. (#188)

Reading real vendor exports.

• A .ccd export was never read — the directory walk matched one extension.
  (#384)
• A vendor's value="0" date sentinel aborted the whole export. (#385)
• An encounter with no type and no note was exported by nothing. (#388)
• A migrated C-CDA chart says who wrote it again. (#312)
• A scanned chart is still a chart: an Unstructured Document carries one.
  (#313)
• A document with an empty mime type came back as a different type.
• The rail read "0 warn, 0 fail" over a chart that had abbreviated thirteen
  facts. (#271, #297)
• The corpus generator wrote four shapes C-CDA R2.1 does not permit. (#327)
• The layout you taught it is now the layout you can run.
• A destination pack can describe the filing dialog it actually meets.

The window and the terminal.

• A run that is happening now says so. (#198)
• The filing calendar is a table you read, not 42 buttons you cannot press.
  (#198)
• Escape closes what Escape opened. (#198)
• Four attributes that named nothing — a <label for> pointing at a <div>,
  among them. (#198)
• An upload that dies says so before it dies. (#117)
• A machine that cannot render charts says so once, with the remedy. (#202)
• The activity shortcut fired on the wrong keys, and the Uploads search
  truncated twice while mentioning neither cut. (#214)
• The error banner never left. (#214)

Packaging

• One build, two doors: the Windows job also emits an MSIX for the Microsoft
  Store, staged from the same build rather than a second one. (#292)
• The Windows installer stopped being rebuilt on every source merge — an
  hour of the scarcest runner class, for an artifact nobody downloaded.
• The shipped SBOMs name a version, and the installer's is generated after
  the smoke gate rather than before: an SBOM for an installer that has not been
  shown to install is a statement about nothing. (#142)
• A build-backend bump nobody could accept no longer blocks every other pip
  update. (#389)
• The installed-footprint measurement can no longer fail a release. (#142)
• A version bump read as thirty-eight changed deliverables. The snapshot
  normalised the version out of JSON but not out of archive HTML or bundle
  README.txt; it is now a token in those too, so a stamp that disappears still
  fails.

---

This Windows installer is unsigned. It carries no Authenticode signature, so Windows will not show a verified publisher. This project uses free code signing provided by SignPath.io, with certificates issued by SignPath Foundation; releases are signed once the Foundation's onboarding completes. Until then, verify the file was built by this repository's release workflow instead of trusting it on sight:

gh attestation verify Anastomosis-Setup-0.8.0.exe --repo AzalDaniel/Anastomosis
gh attestation verify Anastomosis-0.8.0-sbom.cdx.json --repo AzalDaniel/Anastomosis
gh attestation verify Anastomosis-0.8.0.msix --repo AzalDaniel/Anastomosis

The .msix is a Microsoft Store submission artifact, not a download. It is unsigned on purpose: the Store re-signs every package it ingests, which is what lets a Store install carry a trusted publisher signature. Download the Setup exe above to install Anastomosis ...

v0.7.0

[0.7.0] — 2026-08-21

The seventh alpha (0.7.0-alpha). Two arcs in one release. First the
surgery arc: scope the product to what it does best, make the repo read as a
product, close the FHIR-API delivery loop, and brand the Windows app.

Then the closure of a full-depth external audit — 22 findings, verdict
REJECT for 0.7.0 — and four internal adversarial review rounds on the
fixes themselves. Every finding was reproduced against this tree before it
was fixed and re-proven after; the review rounds found and closed residual
gaps in the fixes, including two that reopened the exact wrong-patient
collision the first fix was written to reject.

Added

• FHIR-API delivery route: anast upload --fhir URL drives the same
  engine, ledger, skiplist, and L0-L6 ladder as the browser route. Bearer
  token via environment variable only (--fhir-token-env, default
  ANAST_FHIR_TOKEN); --create-patients (default on) for migration
  targets; ambiguous patient matches always refused. L4/L5/L6 run on this
  route (L3 skips with "no pack provided"); proven end-to-end against a
  live HAPI server in CI.
• Product branding: one SVG master (assets/icon/icon.svg) drives the
  multi-resolution exe icon, installer wizard imagery, Add/Remove Programs
  entry, and the AppUserModelID taskbar identity (tools/make_icons.py
  regenerates every rendition).
• GUI behaviour lane (tests/gui_e2e, 49 tests): headless Chromium
  drives the bundled pages through a generated pywebview-bridge stub with a
  console-error recorder and a GuiApi drift guard; runs as its own CI job.
• Installed-binary smoke (packaging/smoke_windows.py): silent install
  -> installed layout -> installed anast doctor -> the dashboard rendered
  inside the real WebView2 window (Playwright over CDP) -> silent uninstall
  with leftover check; wired into the Windows package job.
• One shared identity predicate (core/identity.py): boundary-anchored
  name, date, and value matching behind the L2/L3/L6 delivery verifier, the
  browser pack's row and banner matchers, and the QA integrity check, so the
  wrong-match defense cannot drift into a substring-loose variant in one
  place and not another. Name boundaries treat the whole Unicode
  hyphen/dash family and all three apostrophes as intra-name joiners;
  truncated values ("Ann Li...") reject as unknown identities.
• Loud refusals that reach the operator: OrphanRowsError (a row on a
  known table whose foreign key names no record), AmbiguousUnanchoredError
  (a dangling patient reference alongside several patients), and
  RedirectRefusedError (a FHIR endpoint that answers a redirect). Their
  messages carry table/resource-type names and counts only, and reach the
  CLI and GUI verbatim through a SourceDataError passthrough.
• Path budgeting for delivered trees (core/textutil.budgeted_name,
  deliver/_shared): every delivered component is capped and every full
  path budgeted, with a 64-bit distinctness tag on any cut name and a
  per-run claimed-name ledger (DeliveredNameCollision) so two different
  source ids can never merge into one delivered slot.
• Spatial rendering goldens: page-1 word bounding boxes for both packs,
  regenerated by the same tools/regen_goldens.py pass as the text goldens
  — a CSS regression that moves a value under the wrong label now fails the
  lane that page-count, geometry, and extracted text all pass.
• Third-party license texts ship with every artifact:
  assets/licenses/APACHE-2.0.txt and OFL-1.1.txt plus a top-level
  THIRD_PARTY_LICENSES.md inventory, carried in the wheel
  (PEP 639 license-files) and the installer, with a release-workflow step
  that fails the build if the wheel ever loses them.
• PayloadTooLarge preflight on the FHIR upload route: an item is
  measured before its bytes are read, so an oversized chart is refused with
  an actionable message instead of materialising several times its size in
  memory.

Changed

• The tebra destination declares its shipped browser pack in
  destinations/registry.yaml, so route planning can select browser
  automation (the GUI surfaces the pack chip; not ready until selector
  discovery).
• Verify ladder opens each PDF twice per item instead of five times;
  fuzzy_contains is linear; shared safe_name/hash_and_size/delivery
  helpers replace copy-pasted implementations; archive/bundle CLI commands
  register from one factory; duplicated page JS consolidated in shell.js.
• PyMuPDF is imported as pymupdf (the fitz alias is deprecated
  upstream); packaging ships it as bytecode (MSVC heap exhaustion) and
  force-includes the modules the pack contexts import (derived from their
  own import statements).
• Vendor EHI spec binaries (~30MB, non-redistributable) removed from the
  repository and its history; docs/vendor_refs/ cites the public Oracle
  pages instead.
• Authorship and AI-assistance attribution consolidated in DESIGN.md;
  per-file citation banners removed (tools/cs50_citations.py re-applies
  them on an academic-submission branch).
• The upload engine reads the wrong-patient banner before the duplicate
  scan: a chart's existing-documents list is never trusted until the open
  chart is confirmed to be the right patient.
• The engine threads its already-resolved DestinationPatient into
  verify_pre, so verification never re-resolves through a
  create-capable path (a second resolve could POST a duplicate patient).
• The PHI scanner is default-deny for content it cannot read: binaries
  and base64-armored payloads inside text files pass only when the whole
  file's sha256 carries a provenance entry in tools/phi_allowlist.txt.
• configure_logging brings every root handler into the redaction
  chain, including handlers a host installed before importing Anastomosis.
• Windows output-directory hardening is reset → grant → strip → verify:
  the DACL is read back and every entry checked against the granted set,
  and an unparseable or unexpected descriptor fails closed.
• CI's mypy lane installs the documented .[dev,gui] environment through
  packaging/constraints.txt; the gui extra is bounded
  pywebview>=6.2,<7.0 (6.2.1 breaks Nuitka-frozen Windows builds,
  upstream #1817) and the package build pins ==6.2.
• README states what the runtime does: migrate writes a structured C-CDA
  payload, the FHIR seam is the CLI upload route today, and per-route L-level
  coverage is named honestly.

Fixed

• anast --help no longer advertises commands that do not exist.
• Segment toggles were mouse-dead under pointer capture; pages without a
  log strip now surface errors in the banner; an inline style refused by
  the pages' CSP is set via CSSOM (gui/web/shell.js).
• The exe version-info and installer copyright name the project's actual
  license (AGPL-3.0-or-later, not MIT).
• Dead surface removed (verified unreferenced): bmi_imperial,
  RenderIndex.unattributed, ~300 lines of orphaned GUI CSS, unused pack
  tokens, entry-point pack discovery, the parallel upload runner, and the
  never-populated HealthConcern/ImplantableDevice/LabOrder model family
  (their PF chart sections render statically; golden output byte-identical).
• Wrong-patient collisions at every identity gate: an expected
  "Ann Li" matched inside "Joann Liang", "Mary-Ann Li-Wong" (any
  hyphen codepoint), and "O'Brien"-style compounds, while a colliding
  unpadded date of birth matched inside a longer one — each accepted the
  wrong chart at the browser row, the banner readback, and the L2 fast path.
  A reordered compound surname passed the row matcher; the resolver clicked
  row 0 regardless of which row it had matched.
• Silent data loss across three adapters and the exporter: rows whose
  foreign key named no record, surplus columns on demographics side rows,
  unread name sub-keys and US Core race codes, section narratives the
  structural parsers could not consume (including duplicate section codes
  that overwrote each other), and record-level extensions that never
  reached the C-CDA loss narrative. The declared-loss oracle was
  value-in-haystack and masked real losses through cross-field collisions;
  it is now path-aware.
• The Windows GUI now starts and renders in the shipped WebView2 window:
  pywebview 6.2.1 failed to import from the frozen build (pinned to 6.2),
  the smoke discarded the only diagnostic the dying app produced (both
  streams are captured and printed on failure), and its CDP attach could
  never work — pywebview sets WebView2's browser arguments programmatically,
  so the environment variable the smoke relied on was ignored. The
  debugging port is now an opt-in, diagnostics-only setting.
• safe_name returned unbounded components, so a long source id produced a
  path the filesystem refused; the chart-PDF copy was unbudgeted and its
  failure was logged and skipped past — a chart silently missing from a
  delivered tree.
• The uninstall leftover check asked only for *.exe, missing DLLs, fonts,
  bundled Chromium data, and logs.

Security

• The FHIR client refuses every redirect. urllib's default opener
  follows redirects and re-attaches request headers, so a server-chosen
  target could receive the endpoint's bearer authorization; the client now
  raises rather than follow, and the operator is told to configure the
  final URL.
• Both release workflows pass ref and tag names to shell steps as quoted
  environment values. Git permits quotes, semicolons, and backticks in a
  ref name and the v* filter accepts them, so interpolating a tag into a
  run: block was shell injection inside jobs holding id-token: write.
• The PyPI release refuses a tag that does not name the version the source
  builds, before anything is built — the invariant the Windows release path
  already enforced.

What's Changed

• Radical surgery: scope to strengths, close the FHIR l...

v0.6.0

[0.6.0] — 2026-07-12

The sixth alpha (0.6.0-alpha). Closes the external v0.5.0 review's four
P1 truth defects — every one a case of a claim exceeding the runtime, the
exact defect class this product exists to prevent — plus its confirmed P2s.
Finding-by-finding adjudication (including two partial refutations) is
recorded in docs/reviews/2026-07-12-alpha6-adjudication.md.

Fixed

• migrate no longer reports route availability as delivery
  (core/migration_status.py) — a chosen route classified the run as
  DELIVERED even though run_migration executes no route (and Tebra's
  ccda_import is a manual in-product import). New three-outcome contract:
  PREPARED (route chosen; charts, C-CDA payload, upload manifest, and route
  plan written — delivery NOT executed) is what the flow earns today;
  DELIVERED is reserved for a future destination executor with a durable
  receipt, and a test pins that classification never returns it until then.
  Both frontends print an actionable prepared-notice; exit codes unchanged.
• --render ccda-standard no longer bypasses requested QA
  (core/migrate.py) — the mode ignored --qa entirely (no events, no
  report, exit 0). The document-generic checks (data-integrity leak
  detection, layout/pagination) now run per rendered patient document,
  qa_report.json is written, FAIL exits nonzero, and the encounter/pack-
  scoped checks are recorded as skipped with a reason.
• GUI no longer displays failed uploads as success
  (core/upload_command.py) — the CLI failed non-clean terminal counts
  while the GUI checked only the abort reason, so a wrong-chart
  PRE_VERIFY_FAILED run read "upload complete". The verdict (is_clean,
  exit_code, PHI-safe non-clean summary) now lives on
  UploadCommandResult in the shared core; both frontends consume it.
• No operator output path in logs (deliver/ccda_export/deliverer.py) —
  the export-complete log carried the full output directory; operators name
  directories after patients. Count-only now, with caplog regressions.
• Cross-page GUI events (gui/events.py) — every event now carries a
  flow tag and each page filters to its own flow, so navigating mid-run
  can no longer make the wizard announce another flow's completion; the
  window's close path now refuses to silently interrupt a running job.
• Pack-trust hash gate is race-free (reconstruct/packtrust.py) — the
  external-pack hash was computed from one read and the code executed from a
  second, so a local writer could swap content between check and use. The
  executable surface (context.py) is now execution-pinned to the same
  single-read snapshot the hash covered, and pack.yaml is parsed from
  pinned bytes; template.html contributes to the hash and is
  presence-checked but still renders from disk (a bounded, non-importing
  Jinja surface — render-from-snapshot is on the backlog), and auxiliary
  assets are documented as outside the hash. Trust-store writes re-read,
  merge, and atomically replace under the repo file lock.
• Upload resources register with the ExitStack the instant they are
  owned (core/upload_command.py) — a ledger/verifier construction
  failure used to leak the attached Playwright driver.
• Unsourced README statistics removed — the "73% of organizations" and
  "$5,000–$150,000" figures traced to phantom citations with no primary
  source; the problem statement now makes the qualitative case on cited,
  peer-reviewed evidence (as paper/paper.md always did).

Changed

• PF mapper builds its encounter link-table indexes once per run (the
  two per-encounter whole-table rescans the earlier hoists never covered) —
  ~9× faster encounter mapping on a 300-encounter probe, output
  byte-identical by goldens.
• QA extracts each PDF once per run instead of up to four times (one
  snapshot per document cached on the context, with a fallback so
  third-party QA packs keep working) — report byte-identical.
• FHIR Bulk ingest streams NDJSON into the grouping index instead of
  double-buffering per file; the memory expectation (resident memory scales
  with export size; spooling is roadmap) is documented instead of implied
  away.
• C-CDA conformance claims aligned to the code: the export is validated by
  round-trip with this repo's own parser; CDA XSD structural validation is
  blocked on two now-documented exporter gaps (mandatory author/
  custodian participations, OID id roots) and recorded, with full
  Schematron conformance, on the backlog.
• python-dateutil removed (declared, never imported); predecessor
  line-reference comments (gpdfs:) and stale worklog tags rewritten as
  present-tense invariants, with the archaeology guard extended to ban the
  tokens.

What's Changed

• release: 0.6.0 — the sixth alpha (0.6.0-alpha): claims match the runtime by @AzalDaniel in #99

Full Changelog: v0.5.0...v0.6.0

v0.5.0

[0.5.0] — 2026-07-03

The fifth alpha (0.5.0-alpha). Two fixes from the external alpha-4 review
plus the piece that makes the Windows app real for users: a release path that
actually ships the installer. Adjudication of the review is recorded in
docs/reviews/2026-07-03-alpha5-adjudication.md.

Fixed

• Raw source identifiers no longer enter logs (core/logutil.py
safe_log_id()) — the log contract said "opaque ids", but the ids being
  logged were the source systems' own GUIDs (PatientPracticeGuid,
  PERSON_ID, encounter/event ids, and the upload item_key that embeds an
  encounter GUID) — linkable, not opaque, on the machine where the export
  lives. Every logging site that interpolated one now routes it through
  safe_log_id(): an HMAC-SHA256 surrogate keyed per process, so log lines
  about the same record still correlate within a run but are unlinkable
  across runs and cannot be confirmed against the export. Display surfaces
  (CLI failure lines, upload console, resumability ledger) deliberately keep
  real ids — they are operator working surfaces inside hardened directories,
  not logs. SECURITY.md states the contract precisely; the caplog tests
  assert the surrogate form and the absence of the raw id.
• The PHI scanner works without a git checkout (tools/phi_scan.py) —
  it enumerated files via git ls-files, so users running the test suite
  from a source ZIP or sdist got a scanner crash instead of a scan. When git
  enumeration is unavailable it now falls back to a deterministic recursive
  walk with an explicit prune set (VCS/cache/venv/build directories); under
  git, behavior is unchanged. A scanner that silently skipped non-git users
  would have been a hole, not a fallback.

Added

• Publish a release from the Actions tab — the Windows-package and PyPI
  workflows gain a guarded workflow_dispatch publish mode (main-only,
  version-asserted) in which the release action creates the v<version> tag
  itself. The 0.4.0 installer was built and CI-validated but never reached
  the Releases page because publishing required a terminal tag push; that
  hard dependency is gone.
• Installer polish (packaging/anastomosis.iss) — optional desktop-icon
  task, UninstallDisplayIcon, and the AGPL license page in the wizard. The
  launch-Anastomosis-on-finish checkbox already existed. Known GA gaps,
  documented: code signing (needs a purchased certificate; SmartScreen
  guidance is in the README) and a bespoke application icon.

What's Changed

• release: 0.5.0 — the fifth alpha (0.5.0-alpha) by @AzalDaniel in #98

Full Changelog: alpha4...v0.5.0

v0.4.0-alpha

What's Changed

• release: 0.4.0 — the fourth alpha (0.4.0-alpha) by @AzalDaniel in #96
• ci(release): flag pre-1.0 GitHub releases as pre-release by @AzalDaniel in #97

Full Changelog: https://github.com/AzalDaniel/Anastomosis/commits/alpha4

v0.3.0-alpha

What's Changed

• M0–M1: bootstrap, canonical model, PF/Tebra adapter, reconstruction engine, pipeline CLI by @AzalDaniel in #1
• M1.5a: FHIR R4 export/ingest with exact round-trip losslessness by @AzalDaniel in #8
• M1.5b: C-CDA ingest, hardened XML parser, dev-process skills, SECURITY.md by @AzalDaniel in #9
• M1.8: archive + bundle deliverers — Archivist vertical complete by @AzalDaniel in #10
• release: v0.1.0 — changelog, install docs, PyPI Trusted Publishing workflow by @AzalDaniel in #11
• paper: JOSS submission draft (paper.md + verified paper.bib) by @AzalDaniel in #12
• M2.10a: browser-delivery safety spine — 15-state machine + WAL tracking ledger by @AzalDaniel in #13
• M2.10b: upload engine — verified lifecycle, retries, wrong-patient abort by @AzalDaniel in #14
• M2.10c: parallel workers, session manager, CDP attach, run reports by @AzalDaniel in #15
• M2.11: L0–L6 verification — the layered wrong-chart defense by @AzalDaniel in #16
• M2.12a: capability registry + shortest-path router — evidence-or-refuse by @AzalDaniel in #17
• M2.12b: browser destination packs + tebra scaffold + selector-discovery wizard by @AzalDaniel in #18
• M2.13a: FHIR R4 API pusher — modern delivery over the same verified stack by @AzalDaniel in #19
• M2.13b: C-CDA export — the inverse adapter with a declared-loss ledger (completes M2) by @AzalDaniel in #20
• M1.5: golden rendering tests (pinned Chromium) + Synthea external-evidence e2e lane by @AzalDaniel in #21
• M3.14: packgen extract + infer — the layout learner's analysis half by @AzalDaniel in #22
• M3.15: packgen emit + pack-init wizard — the layout learner writes packs (completes M3) by @AzalDaniel in #23
• M4.17: GUI shell + controller + liquid-glass pipeline dashboard by @AzalDaniel in #24
• M4.18-19: migration wizard, section matrix, upload console, packgen UI (completes M4) by @AzalDaniel in #25
• M5.20: CS50 packaging — README finale, demo storyboard, submission kit (completes M5) by @AzalDaniel in #26
• registry: 12-vendor EHI survey — 7 new destinations, all cited by @AzalDaniel in #27
• docs: Oracle EHI schema brief — verified spec for the Cerner adapter by @AzalDaniel in #28
• sources/oracle_ehi: Cerner Millennium V500 ingest adapter (cited-schema build) by @AzalDaniel in #29
• docs: README install section reflects the live PyPI release by @AzalDaniel in #30
• gui: carry the real Liquid Glass design system from the predecessor by @AzalDaniel in #31
• fidelity: port the predecessor's clinical code tables and behaviors by @AzalDaniel in #32
• packs: the Practice Fusion SOAP-note forensic replica by @AzalDaniel in #33
• test: make the PF golden date-independent (render-day 'as of') by @AzalDaniel in #34
• core: shared command layer (CLI + GUI as thin adapters) by @AzalDaniel in #35
• cli: deterministic exit-2 for operator-input errors by @AzalDaniel in #36
• deliver: single-pass per-patient bundle attribution by @AzalDaniel in #37
• packs: precompute a per-call RecordViewIndex in build_context by @AzalDaniel in #38
• deliver: atomic output writes + an output-directory lock by @AzalDaniel in #39
• packs: hash-pin external packs with explicit trust-on-first-use by @AzalDaniel in #40
• gui: fix the run_pipeline_async race and reach CLI run-parity by @AzalDaniel in #41
• chore: eliminate the GUI controller's type-ignore bandaids by @AzalDaniel in #42
• gui: per-patient run detail + run-form parity with the CLI by @AzalDaniel in #43
• sources: add a FHIR R4 / US Core ingest adapter (any-EHR-in) by @AzalDaniel in #44
• reconstruct: standard C-CDA render path (vendor HL7 CDA.xsl) by @AzalDaniel in #45
• migrate: from-X-to-Y composition (CLI + GUI) by @AzalDaniel in #46
• upload: anast upload CLI + manifest persistence (browser delivery) by @AzalDaniel in #47
• pipeline: clean errors on bad/empty/no-route input + lock all output dirs by @AzalDaniel in #48
• sources: learn a new structured export format from an example by @AzalDaniel in #49
• gui: source-learning wizard (GuiController.source_init + source.html) by @AzalDaniel in #50
• packinit: shared pack-init command core + async GUI variant by @AzalDaniel in #51
• gui: migrate-wizard parity — pack-dir/trust/force/sections/qa levers by @AzalDaniel in #52
• perf: build the per-record render index once per record, not per encounter by @AzalDaniel in #53
• gui: drive the upload engine from the console (start/stop/monitor) by @AzalDaniel in #54
• release: cut 0.2.0 + professionalize the docs by @AzalDaniel in #55
• fix: ASCII-safe console glyphs so the CLI never crashes on a non-UTF-8 terminal by @AzalDaniel in #56
• fix: surface a no-route migration in the GUI, not a silent success (CLI/GUI parity) by @AzalDaniel in #57
• refactor: one shared upload command for the CLI and GUI (unify attempts, skiplist, lock-then-read) by @AzalDaniel in #58
• refactor: one shared learn-a-source command for the CLI and GUI by @AzalDaniel in #59
• gui: drive the learn-a-source wizard asynchronously (daemon worker + events) by @AzalDaniel in #60
• perf: build the flowsheet's vital-by-encounter scan once per record, not per encounter by @AzalDaniel in #61
• refactor: decompose build_context into focused, output-preserving helpers by @AzalDaniel in #62
• feat: app frozen-readiness — GUI entry point + anast doctor bundled-asset self-check (PKG-1) by @AzalDaniel in #63
• 0.3.0: installable Windows app, CLI/GUI parity, and pre-release remediation by @AzalDaniel in #64
• Resolve the second objective review: P0 data-loss + unsafe-upload, P1s by @AzalDaniel in #65
• docs: finalize 0.3.0 — verify-default wording reconciled by @AzalDaniel in #66

New Contributors

• @AzalDaniel made their first contribution in #1

Full Changelog: https://github.com/AzalDaniel/Anastomosis/commits/alpha3

v0.2.0-alpha

What's Changed

• docs: Oracle EHI schema brief — verified spec for the Cerner adapter by @AzalDaniel in #28
• sources/oracle_ehi: Cerner Millennium V500 ingest adapter (cited-schema build) by @AzalDaniel in #29
• docs: README install section reflects the live PyPI release by @AzalDaniel in #30
• gui: carry the real Liquid Glass design system from the predecessor by @AzalDaniel in #31
• fidelity: port the predecessor's clinical code tables and behaviors by @AzalDaniel in #32
• packs: the Practice Fusion SOAP-note forensic replica by @AzalDaniel in #33
• test: make the PF golden date-independent (render-day 'as of') by @AzalDaniel in #34
• core: shared command layer (CLI + GUI as thin adapters) by @AzalDaniel in #35
• cli: deterministic exit-2 for operator-input errors by @AzalDaniel in #36
• deliver: single-pass per-patient bundle attribution by @AzalDaniel in #37
• packs: precompute a per-call RecordViewIndex in build_context by @AzalDaniel in #38
• deliver: atomic output writes + an output-directory lock by @AzalDaniel in #39
• packs: hash-pin external packs with explicit trust-on-first-use by @AzalDaniel in #40
• gui: fix the run_pipeline_async race and reach CLI run-parity by @AzalDaniel in #41
• chore: eliminate the GUI controller's type-ignore bandaids by @AzalDaniel in #42
• gui: per-patient run detail + run-form parity with the CLI by @AzalDaniel in #43
• sources: add a FHIR R4 / US Core ingest adapter (any-EHR-in) by @AzalDaniel in #44
• reconstruct: standard C-CDA render path (vendor HL7 CDA.xsl) by @AzalDaniel in #45
• migrate: from-X-to-Y composition (CLI + GUI) by @AzalDaniel in #46
• upload: anast upload CLI + manifest persistence (browser delivery) by @AzalDaniel in #47
• pipeline: clean errors on bad/empty/no-route input + lock all output dirs by @AzalDaniel in #48
• sources: learn a new structured export format from an example by @AzalDaniel in #49
• gui: source-learning wizard (GuiController.source_init + source.html) by @AzalDaniel in #50
• packinit: shared pack-init command core + async GUI variant by @AzalDaniel in #51
• gui: migrate-wizard parity — pack-dir/trust/force/sections/qa levers by @AzalDaniel in #52
• perf: build the per-record render index once per record, not per encounter by @AzalDaniel in #53
• gui: drive the upload engine from the console (start/stop/monitor) by @AzalDaniel in #54
• release: cut 0.2.0 + professionalize the docs by @AzalDaniel in #55

Full Changelog: v0.1.0...alpha

v0.1.0-alpha

What's Changed

• M0–M1: bootstrap, canonical model, PF/Tebra adapter, reconstruction engine, pipeline CLI by @AzalDaniel in #1
• M1.5a: FHIR R4 export/ingest with exact round-trip losslessness by @AzalDaniel in #8
• M1.5b: C-CDA ingest, hardened XML parser, dev-process skills, SECURITY.md by @AzalDaniel in #9
• M1.8: archive + bundle deliverers — Archivist vertical complete by @AzalDaniel in #10
• release: v0.1.0 — changelog, install docs, PyPI Trusted Publishing workflow by @AzalDaniel in #11
• paper: JOSS submission draft (paper.md + verified paper.bib) by @AzalDaniel in #12
• M2.10a: browser-delivery safety spine — 15-state machine + WAL tracking ledger by @AzalDaniel in #13
• M2.10b: upload engine — verified lifecycle, retries, wrong-patient abort by @AzalDaniel in #14
• M2.10c: parallel workers, session manager, CDP attach, run reports by @AzalDaniel in #15
• M2.11: L0–L6 verification — the layered wrong-chart defense by @AzalDaniel in #16
• M2.12a: capability registry + shortest-path router — evidence-or-refuse by @AzalDaniel in #17
• M2.12b: browser destination packs + tebra scaffold + selector-discovery wizard by @AzalDaniel in #18
• M2.13a: FHIR R4 API pusher — modern delivery over the same verified stack by @AzalDaniel in #19
• M2.13b: C-CDA export — the inverse adapter with a declared-loss ledger (completes M2) by @AzalDaniel in #20
• M1.5: golden rendering tests (pinned Chromium) + Synthea external-evidence e2e lane by @AzalDaniel in #21
• M3.14: packgen extract + infer — the layout learner's analysis half by @AzalDaniel in #22
• M3.15: packgen emit + pack-init wizard — the layout learner writes packs (completes M3) by @AzalDaniel in #23
• M4.17: GUI shell + controller + liquid-glass pipeline dashboard by @AzalDaniel in #24
• M4.18-19: migration wizard, section matrix, upload console, packgen UI (completes M4) by @AzalDaniel in #25
• M5.20: CS50 packaging — README finale, demo storyboard, submission kit (completes M5) by @AzalDaniel in #26
• registry: 12-vendor EHI survey — 7 new destinations, all cited by @AzalDaniel in #27

Full Changelog: https://github.com/AzalDaniel/Anastomosis/commits/v0.1.0