Steer, Matthew 2026-09-23: "So long as I can see everything is basically running and up-to-date then that is all
we need right now — we can only build whatever controls we may be able to have once we have this in place — so as basic
as it can be will be enough."
Part 1 of two. This spec is the backend half only: the view in https://gp.veripath.co.uk/ from which the
configured NHSBSA feeds are seen to be running and current. Part 2 — which pharmacy surface displays the data to
pharmacy staff (D1: answered 2026-09-23 as a read-only product-information view in the pharmacy application) — is
spec'd separately: Data Feeds — Pharmacy View. Parent: Central Reference Data
(§5.12 the management view, §6 phases 1–2, D5 who may publish, D13 where the view lives).
Inside the existing backend area at /infrastructure/reference-data/ (a Reference Data tab in the backend
nav), behind PlatformAdminRequiredMixin (D13). No new top-level area, no new permission, and nothing client-facing
(D5): no tenant account can upload, publish or roll back, and a client only ever sees published data with its label.
The four screens already exist and render for a platform admin (checked live 2026-09-23): releases list
(/), Freshness & health (/health/), upload (/upload/), licence register (/licences/).
The store is live and correct: dmd is published (release 3170926, publication date 2026-09-21, age 2 days,
next expected 2026-09-28); drug_tariff and price_concessions have no release yet. What a reader cannot do is
answer "is everything running and up to date?" in one look, because the page reports three alerts and a credential
column that are wrong for two of the three feeds:
health.key_status() tests TRUD configuration globally, so it is applied to every source. Drug Tariffhealth.alerts() raises "no published live release yet" as a warning for any source without a live release.The rule this spec enforces: a feed must never look broken because a routine that does not exist has not run.
ReferenceSource (e.g.routine, choices trud_pull / none), set by seed_reference_sources — never inferred from free text such asdistribution_route. Today dmd = trud_pull; drug_tariff and price_concessions = none. Phases 4 and 5 flipnone. dm+d keeps the TRUD key state (not_configured / untested / invalid /not_subscribed / accepted).routine = none reads "Not automated yet" and raises no warning or danger — including when it3170926, published 21/09/2026, next expected 28/09/2026) and flipsreference_data health tests plus tests for the new states./infrastructure/reference-data/, …/health/, …/upload/, …/licences/ remain 403 to anonymous andPer-feed run controls; Drug Tariff and Price Concessions ingestion (phases 4–5, and CPE consent D10 for
publication); the pharmacy-side display (Part 2 / D1); the live TRUD pull itself (D12, Matthew's account);
who may upload or publish (D5, unchanged); any renaming of the backend (D7, deferred).
Built by OpenCode on feature/reference-feed-status @ 91b9399 (off 82871c4) — 73 tests OK (1 skipped),
makemigrations --check clean, one migration (reference_data.0005_referencesource_routine).
Deployed and verified live — 2026-09-23 (Hermes). App host 82871c4 → 91b9399 as a git bundle (Forgejo
unreachable from the host), containers restarted, the entrypoint applying 0005 — "Applying
reference_data.0005_referencesource_routine... OK" — and gp_booking_app healthy. Read as a platform admin and at the
ORM, against §4:
| §4 | Result |
|---|---|
| 1. Only dm+d names a credential | PASS — key_status() returns None for both monthly feeds, the health table's key column reads "not used", and the only key text on the surface is dm+d's |
2. routine = none never warns |
PASS — both monthly feeds read Not automated yet, level secondary; the health page header reads "No action needed." with the three notes informational (the two false alerts are gone) |
| 3. Landing summary + per-feed line | PASS — "All configured feeds are current", then a card per feed: state, last successful fetch, live release + publication date, next expected. (Wording nit below.) |
| 4. dm+d reads Current; flips correctly | PASS — Current (release 3170926, published 21/09/2026, age 2 days, next expected 28/09/2026); feed_state(dmd, today=2026-10-30) → Not running — no key; the overdue branch is covered by the new test_health.py cases |
| 5. Guards unchanged | PASS — /, /health/, /upload/, /licences/ all 403 to anonymous; Fetch now and Purge old rows untouched |
routine backfill confirmed on the live rows: dmd = trud_pull, drug_tariff = none, price_concessions = none
(0005 does it, so the page is correct immediately after migrate, before the seed is re-run).
One wording nit handed back — not behaviour. The per-feed cards show "Last successful fetch: never" for all
three feeds: meaningless for the two with no routine (the card already says Not automated yet), and true but odd
beside dm+d's green Current (its live release was imported by hand, no pull has ever succeeded). Suggested:
show the line only where a routine exists, and for dm+d state the truth rather than the bare "never".
Nit fixed and redeployed — 2026-09-23 (45b8dd8). OpenCode's fix (gp_booking_app 91b9399 → 45b8dd8, 73 tests
OK) shown live and confirmed by me: the dm+d card now reads "Last successful fetch: never — the live release was
imported manually (21/09/2026)", and the two feeds with no routine have dropped the line entirely. Deployed by git
bundle, containers restarted, app healthy; spec §4 behaviour otherwise unchanged (dm+d Current, the other two
Not automated yet, "No action needed.").
Deploy note (current reality): the app host has the repo as a git checkout bind-mounted at /app, so a code
change needs a restart, not a rebuild — but Forgejo is not reachable from the app host, so commits travel as a
git bundle (how phase 1, the nit fix and this view all landed on 2026-09-23). Containers: gp_booking_app,
gp_booking_celery_worker, gp_booking_celery_beat.
5d64c4f)Two readings on this page were wrong, and both were the rule, not the data. Fixed in code, deployed, and the two
data steps applied the same day.
20260923, next expected 23/10, overdue from 28/10.publish_release() refuses it outright — so the legacy2026-09 mailbox release was discarded (reason recorded; the September notice release remains superseded), andreference-data-pull-snomed-daily, 03:30 UTC, daily because the edition's datealready_held with no download, after the live release's provenance was backfilled touk_sct2cl_43.0.0_20260923000001Z.zip).3081026 (next 19/10), Drug Tariff 2026-10 (next 01/11), notices 2026-10, MHRA WDA wda-2026-10-17 (next 19/10).