[rubentalstra]

What changed and why

The owner decided on 2026-10-21 that FerroPIX is a standalone server with its cross-reference in PostgreSQL, ships two OCI images (the server and an operator console on FerroUI, the fifth console of the family), releases both at SLSA Build Level 3 through reusable workflows, files every FerroUI gap on FerroUI, and takes identifier lookups by POST (#52). The repository had no design of record for the server or the console.

• docs/architecture.md, new, in the family's architecture-document style. Every decision names a vendored section (PIXm 3.1.0, PDQm 3.2.0, PMIR 1.6.0, BALP 1.1.4, FHIR R4) or says "no specification governs this: our own design". Sections: the problem and the pins; the shape (two images, the ihe-iti server features); the process and the configuration tree (TOML, FERROPIX__ overrides, _file secrets, deny_unknown_fields); the PostgreSQL store (identifier domains with one Source each, source records with write-once versions, persons, a temporal link table, candidates with scores and evidence, reversible merges, pseudonymisation domains, the steward action trail, subscriptions), its migrations, transaction boundaries and locks; the matching in three tiers (deterministic on authoritative identifiers, Fellegi-Sunter on demographics with per-field evidence, human review between the thresholds, automatic probabilistic linking off by default); the FHIR face (ITI-83 by GET and POST, ITI-104, ITI-78, ITI-119, ITI-93, ITI-94, with a status table per case and one policy for merged and removed identifiers); the HL7 v2 listener on FerroBRIDGE's parser, cited by transaction until the TF-2 texts are vendored; pseudonyms, the BSN and the pseudo-BSN; authorization through ferrohealth-smart, BALP through ihe-atna, the health family, a request log that never records a query string or a body, and the FerroPULSE usage report; the two images, the compose quickstart, the Helm chart after FerroEHR's, and the SLSA Build Level 3 release lanes; the five CI lanes FerroPIX lacks beside FerroFED; the console (information architecture, every workflow with its screen, states, keyboard path and phone reflow, the operator API it reads, the quality bar, ASCII wireframes at 1440 and 390 px, the FerroUI component inventory per screen, and seven gaps with their API shapes: record compare, score breakdown, timeline, masked identifier with audited reveal, keyboard shortcut legend, work-list, and the FerroPIX brand theme); the workspace layout; the build order by milestone; the decision register.
• CLAUDE.md: the owner's decisions in the scope, a section pointing at the design of record, the milestones v0.0.3 to v0.0.5 as the build order, docs/architecture.md in the repo map, and the FerroUI sibling line names the decided console in place of "should FerroPIX ever get a console".
• The book: the deployment page and the "what is built and what is planned" page name the PostgreSQL store, the compose quickstart, the console and its image as planned, each section linking its milestone, so docs-claims.sh holds.
• Memory: ferroui-lockstep.md records the console as decided; the index follows.
• CHANGELOG.md: an [Unreleased] entry.

Guards run locally on the branch: writing-style.sh (the changed files and the published prose), docs-claims.sh, ihe-citations.sh (234 citations, every one in the vendored text), versions.sh and site-links.sh, all green.

Closes #55

Licensing of contributions

• I accept the terms in CONTRIBUTING.md § Licensing of contributions: I have the right to submit this work, I license it under the project licence of the version it lands in, and I grant the Licensor the relicensing right stated there.

Checklist

• Every conformance decision cites the specification (the IHE ITI Technical Framework, PIXm, PDQm, HL7 FHIR R4, HL7 v2), never memory and never another implementation.
• Rust gates pass, once the workspace has a member: no Rust changes.
• Every refusal the change adds has an asserted negative test, and no test was weakened to pass: no code changes.
• Shell and workflow files are clean: no shell or workflow changes.
• CHANGELOG.md has an [Unreleased] entry.
• The book under website/book/src is updated for every user-visible change.
• No patient data, real identifier, key, token or password in a fixture, test or example: the wireframes use the PIXm package's example names and masked values.
• Every commit is signed.
• No AI or assistant attribution anywhere in the commits or this PR.