Ignixa L1: FHIRPath provider seam by brendankowitz · Pull Request #5801 · microsoft/fhir-server

Brendan Kowitz (brendankowitz) · 2026-09-10T21:42:38Z

Summary

L1 of the incremental Ignixa SDK migration, targeting main from feature/ignixa-sdk/l1-fhirpath-seam.

Introduce independently selectable Firely/Ignixa FHIRPath providers, retaining Firely as the default.
Route evaluating call sites and indexing/reindexing through the seam, with explicit failure handling and a bounded concurrency-safe compile cache.
Preserve Firely-backed FHIRPath Patch node selection until mutable-node identity can migrate safely.
Keep the single high-level ADR: docs/arch/adr-2608-ignixa-sdk-migration.md.
Retain the requested isolated STU3/R4 SQL vNext canary lanes and their provider/database-isolation guards.

Scope cleanup

The incident-recovery mode (buildImages / imageTagOverride) and the broad pipeline-shape/Bicep test harness have been removed. Focused provider, database-plan and topology behavioral tests now run together in Test-AcaSqlCanaryConfiguration.ps1 in the existing Guardian job, without a separate CI job or Python/PyYAML/Azure CLI/Bicep dependency for these checks. Canary deployment and E2E stages remain unchanged.

Relationship to previous work

This replaces #5776, now closed as superseded; its historical discussion and review context remain available.

Reconciled with main, including #5791, Ignixa 0.6.74, SDK 10.0.400, the newer runtime-state configuration, and SMART compartment regressions. The new SMART materialization fixture is wired to the FHIRPath provider and failure-metrics dependencies.

AB#206672 — story 1.1, under feature 180726.

Configuration

"FhirSdkProvider": {
  "Default": "Firely",
  "Import": "Firely",
  "FhirPath": "Ignixa"
}

Each capability is selected at startup. There is no silent runtime fallback. Serialization, no-op write compatibility, native import-write performance, projection, and validation remain separate layers. Previously reverted ABTestRunner changes remain excluded.

Local evidence

Reconciliation checks: targeted core/API runs across STU3, R4, R4B and R5 — 355 cases, 351 passed, 4 expected version-specific skips, no failures.
Affected core/API projects, R4 integration project and resource-parser tool built successfully with the pinned SDK.
The streamlined, credential-free canary configuration tests pass. YAML comparison confirms unchanged retained canary stages and restored pre-recovery default deployment behavior.
Live SQL/Cosmos E2E and the SQL SMART integration suite were not executed locally; their results are not implied by the project builds.

Merge prerequisite: persistent vNext CI resources

The retained main-CI vNext stages require their persistent STU3/R4 apps, databases and elastic pool to be provisioned before merge. Missing resources cause the canary stages to fail and may prevent the shared scale-down stage.

No shared resources were provisioned or deleted. Do not run build/ci-deploy.yml / Deploy CI if broken as part of this work: it deletes the shared CI resource group. Any required persistent provisioning is a separate coordinated operation.

Review boundaries

Local developer appsettings.json and launchSettings.json overrides are not committed.
No automatic production-default change or shared CI deployment is included.
Native stack membership is unchanged; the closed L2 PR has not been reopened or rewritten.

Specifies one narrow FHIRPath contract in Core, with Select as the sole primitive and Scalar/Predicate/IsTrue/IsBoolean derived once from it, so the two providers cannot drift on helper semantics. Records what verification turned up rather than what the prototypes assumed: Firely 5.11.4's Scalar throws on multiple results where SDK 6 returns null; Predicate is BooleanEval, so a single false element yields false rather than the empty-implies-true rule alone; the extension path applies ToScopedNode() where the indexer does not; FHIRPath Patch mutates the ElementNode instances Select returns and so cannot cross the Ignixa adapter at all. Also corrects the migration's performance story for this phase: with ingress and read codecs still Firely, evaluation runs through a per-call adapter, so Ignixa's native-element benchmark does not describe this path and the gate must measure adapter-input evaluation specifically. Updates ADR 2607 where 2608 supersedes it: the provider setting becomes a nested per-seam section, and Phase 3 lands as one PR rather than three. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5c56feff-ca9b-48b2-a23a-739fbfc6e7dd

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc0f8fb-a736-41f8-a238-98a5ced56336

Keep TRX comparison and detailed CSV labels short and stable while retaining verbose image and provider descriptions for ingestion reports. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc0f8fb-a736-41f8-a238-98a5ced56336

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc0f8fb-a736-41f8-a238-98a5ced56336

Redact persisted probe values and isolate credential-free self-test artifacts. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc0f8fb-a736-41f8-a238-98a5ced56336

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5c56feff-ca9b-48b2-a23a-739fbfc6e7dd

Use lock-free concurrent lookups for compiled expressions while serializing only cache misses and FIFO eviction. Add a bounded cold-cache concurrency test across shared FHIR versions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5c56feff-ca9b-48b2-a23a-739fbfc6e7dd

Use non-resetting path joins, remove test-only generic catches, and assert the SMART access contract instead of a stale aggregate count. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1bbbbddc-baea-4d84-8111-55fe485c5485

Assert the newly indexed Patient A Immunization and deterministic total, and document that compile and evaluation failures are intentionally contained for observable write availability. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1bbbbddc-baea-4d84-8111-55fe485c5485

Record the measured provider-versus-legacy index difference and cancellation behavior at the FHIRPath failure boundary. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5c56feff-ca9b-48b2-a23a-739fbfc6e7dd

Consume the compiled FHIRPath correctness fixes, recursive schema resolution, and element-model performance improvements released in Ignixa 0.6.73. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5c56feff-ca9b-48b2-a23a-739fbfc6e7dd

Add isolated STU3 and R4 SQL canaries using Ignixa, shared deployment defaults, provider assertions, and deployed-app E2E coverage in PR and main CI. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc0f8fb-a736-41f8-a238-98a5ced56336

Provision persistent main canaries and isolated small vNext pools, preserve configured SDK providers, and validate the complete deployment flow in PR and main CI. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc0f8fb-a736-41f8-a238-98a5ced56336

Propagate optional topology expectations through shared E2E templates and fail vNext jobs before execution when the deployed Key Vault, SQL database, server, or elastic pool differs from the intended lane. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc0f8fb-a736-41f8-a238-98a5ced56336

Resolve cloud-specific Key Vault and SQL DNS suffixes from the active Azure environment, reject lookalike hosts, and mask emitted Key Vault pipeline variables. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc0f8fb-a736-41f8-a238-98a5ced56336

Wrap Azure environment resolution failures with actionable service-connection guidance while preserving the original exception. Cover null, missing, blank, thrown, and leading-dot suffix metadata behavior. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc0f8fb-a736-41f8-a238-98a5ced56336

Raise only the isolated vNext pool, compile-time gate integration jobs, and make credential-free plan prerequisites explicit. Clarify that E2E Key Vault variables are secret and masked while preserving legacy provisioning behavior. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc0f8fb-a736-41f8-a238-98a5ced56336

Allow the persistent CI environment to deploy existing images without compiling version or Docker stages, while preserving the default image-build flow. Validate both compiled plans and reject blank recovery tags before provisioning. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc0f8fb-a736-41f8-a238-98a5ced56336

Retain Ignixa 0.6.74 and current main regression coverage. Adapt the new SMART indexing fixture to the provider seam, preserve runtime-state configuration, and reconcile the updated SMART resource corpus. Prepares AB#206672 without publishing or changing shared CI. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5c56feff-ca9b-48b2-a23a-739fbfc6e7dd

+            catch (Exception ex)
+            {
+                _logger.LogWarning(
+                    ex,
+                    "Failed to extract search parameter '{SearchParameterDefinitionUrl}' using '{FhirPathExpression}' against '{ElementType}'.",
+                    searchParameterDefinitionUrl,
+                    fhirPathExpression,
+                    element.InstanceType);
+                _failureMetricHandler.EmitException(
+                    new ExceptionMetricNotification
+                    {
+                        OperationName = "FhirPathSearchIndexEvaluation",
+                        ExceptionType = ex.GetType().Name,
+                        Severity = LogLevel.Warning.ToString(),
+                    });
+
+                return Array.Empty<ITypedElement>();
+            }


Codecov Comments Bot (codecov-commenter) · 2026-09-10T23:09:53Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.71%. Comparing base (ef77cdc) to head (e9c79b3).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5801      +/-   ##
==========================================
+ Coverage   78.29%   78.71%   +0.42%     
==========================================
  Files        1016     1024       +8     
  Lines       36911    37047     +136     
  Branches     5617     5643      +26     
==========================================
+ Hits        28898    29162     +264     
+ Misses       6635     6465     -170     
- Partials     1378     1420      +42

see 34 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Remove incident recovery mode and the pipeline-shape/Bicep test harness. Keep STU3/R4 canary deployment and provider/isolation checks, with focused behavioral coverage in the existing Guardian job. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5c56feff-ca9b-48b2-a23a-739fbfc6e7dd

Copilot AI and others added 29 commits August 13, 2026 12:28

Implement Ignixa FHIRPath provider seam

2e003dd

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Fix Ignixa FHIRPath seam review findings

af627ca

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Fix FHIRPath seam regressions

923c7d0

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Fix final FHIRPath seam review findings

90a67d6

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Cover composite search parameter expressions

471ff45

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Apply verified FHIRPath review fixes

001c1cf

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Fix FHIRPath residual review findings

d6e5a2b

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Update FHIRPath seam ADR status

537a338

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5c56feff-ca9b-48b2-a23a-739fbfc6e7dd

Add FHIRPath ingestion A/B workloads

66faf8a

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc0f8fb-a736-41f8-a238-98a5ced56336

Fix ingestion A/B review findings

35af5ba

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc0f8fb-a736-41f8-a238-98a5ced56336

Fix ingestion performance review findings

18f0aeb

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc0f8fb-a736-41f8-a238-98a5ced56336

Fix AB runner re-review residuals

826c39f

Redact persisted probe values and isolate credential-free self-test artifacts. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc0f8fb-a736-41f8-a238-98a5ced56336

Revert ingestion A/B runner changes

504363f

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5c56feff-ca9b-48b2-a23a-739fbfc6e7dd

Consolidate Ignixa SDK architecture decision

731a30d

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5c56feff-ca9b-48b2-a23a-739fbfc6e7dd

Document verified SMART indexing delta

a859f86

Record the measured provider-versus-legacy index difference and cancellation behavior at the FHIRPath failure boundary. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5c56feff-ca9b-48b2-a23a-739fbfc6e7dd

Brendan Kowitz (brendankowitz) changed the base branch from personal/bkowitz/ignixa-fhirpath-seam to main September 10, 2026 21:44

Brendan Kowitz (brendankowitz) mentioned this pull request Sep 10, 2026

Implement incremental Ignixa SDK adoption and FHIRPath seam #5776

Closed

github-advanced-security Bot found potential problems Sep 10, 2026

View reviewed changes

Brendan Kowitz (brendankowitz) mentioned this pull request Sep 11, 2026

Ignixa L2: Import performance baseline and compatibility corpus #5805

Closed

Brendan Kowitz (brendankowitz) added this pull request to stack #5806 September 11, 2026 02:54

Navigation Menu

Uh oh!

Ignixa L1: FHIRPath provider seam - #5801

Ignixa L1: FHIRPath provider seam#5801
Brendan Kowitz (brendankowitz) wants to merge 30 commits into
mainfrom
feature/ignixa-sdk/l1-fhirpath-seam

Brendan Kowitz (brendankowitz) commented Sep 10, 2026 •

edited

Loading

Uh oh!

Codecov Comments Bot (codecov-commenter) commented Sep 10, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

Brendan Kowitz (brendankowitz) commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Scope cleanup

Relationship to previous work

Configuration

Local evidence

Merge prerequisite: persistent vNext CI resources

Review boundaries

Uh oh!

Codecov Comments Bot (codecov-commenter) commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Brendan Kowitz (brendankowitz) commented Sep 10, 2026 •

edited

Loading

Codecov Comments Bot (codecov-commenter) commented Sep 10, 2026 •

edited

Loading