diff --git a/TECHNICAL_DEBT.md b/TECHNICAL_DEBT.md
new file mode 100644
index 00000000..59cbb7a1
--- /dev/null
+++ b/TECHNICAL_DEBT.md
@@ -0,0 +1,35 @@
+# Technical Debt
+
+A living record of known gaps, shortcuts, and missing enterprise capabilities.
+
+---
+
+## AS2 Protocol
+
+### Async MDN — Inbound Callback Not Implemented
+**Priority:** High
+**Affects:** Large enterprise partners (banks, healthcare networks) that require async MDN.
+
+| Scenario | Status |
+|---|---|
+| Outbound, Sync MDN | ✅ Fully implemented |
+| Outbound, Async MDN — `Receipt-Delivery-Option` header sent correctly | ✅ Implemented |
+| Outbound, Async MDN — receiving the callback and reconciling it | ❌ Not implemented |
+| Inbound — partner requests Async MDN via `Receipt-Delivery-Option` header | ❌ Not implemented |
+
+**Required work:**
+- `services/as2_server/core/receive_as2.py`: Detect when an inbound POST is an MDN callback
+  (via `Content-Disposition: notification` or matching `Message-ID` header), route it to a
+  dedicated `MDNReconciliationUseCase` instead of treating it as new EDI.
+- `services/worker`: When `mdn_type == "ASYNC"`, after sending, write `PENDING_MDN` status and
+  store the sent `Message-ID` and `MIC` so they can be matched when the callback arrives.
+- Database: Add an `outbound_mdn_pending` table `(message_id, mic, trace_id, expires_at)`.
+
+---
+
+## Testing
+
+### No Frontend Test Runner (Vitest)
+**Priority:** Medium
+`make test` skips frontend tests with a placeholder comment.
+React component tests and TanStack Query mutation tests are not covered.
diff --git a/frontend/web/src/components/ui/edi-editor-pane.tsx b/frontend/web/src/components/ui/edi-editor-pane.tsx
new file mode 100644
index 00000000..27e2ecf9
--- /dev/null
+++ b/frontend/web/src/components/ui/edi-editor-pane.tsx
@@ -0,0 +1,127 @@
+import React, { useState } from 'react';
+import Editor from '@monaco-editor/react';
+import { UploadCloud } from 'lucide-react';
+import { registerEdiLanguageAndTheme } from '@/utils/monaco-edi';
+
+export interface EdiEditorPaneProps {
+  value: string;
+  onChange: (value: string) => void;
+  language?: 'edi' | 'json' | 'plaintext';
+  placeholder?: string;
+  cornerPlaceholder?: string;
+  className?: string;
+  acceptedFileExtensions?: string;
+}
+
+export function EdiEditorPane({ value, onChange, language = 'edi', placeholder, cornerPlaceholder, className = '', acceptedFileExtensions = ".edi,.json,.txt,.x12" }: EdiEditorPaneProps) {
+  const [isDragging, setIsDragging] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const handleDragOver = (e: React.DragEvent) => {
+    e.preventDefault();
+    setIsDragging(true);
+  };
+
+  const handleDragLeave = (e: React.DragEvent) => {
+    e.preventDefault();
+    setIsDragging(false);
+  };
+
+  const applyFile = async (file: File) => {
+    setError(null);
+    if (file.size > 1024 * 1024) {
+      setError('File size exceeds 1MB limit. Please upload a smaller file.');
+      return;
+    }
+    try {
+      const text = await file.text();
+      onChange(text);
+    } catch (err) {
+      setError(`Failed to read file: ${(err as Error).message}`);
+    }
+  };
+
+  const handleDrop = async (e: React.DragEvent) => {
+    e.preventDefault();
+    setIsDragging(false);
+    if (e.dataTransfer.files && e.dataTransfer.files.length > 0) {
+      await applyFile(e.dataTransfer.files[0]);
+    }
+  };
+
+  const handleFileUpload = async (e: React.ChangeEvent<HTMLInputElement>) => {
+    if (e.target.files && e.target.files.length > 0) {
+      await applyFile(e.target.files[0]);
+      e.target.value = '';
+    }
+  };
+
+  const handleEditorWillMount = (monaco: any) => {
+    registerEdiLanguageAndTheme(monaco);
+  };
+
+  return (
+    <div
+      className={`flex-1 p-0 bg-white min-h-[250px] flex flex-col relative group ${className}`}
+      onDragOver={handleDragOver}
+      onDragLeave={handleDragLeave}
+      onDrop={handleDrop}
+    >
+      {error && (
+        <div className="absolute top-2 right-2 left-2 z-30 p-3 bg-red-50 border border-red-200 text-red-700 text-sm rounded-md shadow-sm flex items-center justify-between">
+          <span>{error}</span>
+          <button onClick={() => setError(null)} className="text-red-500 hover:text-red-700 font-bold ml-4">
+            ×
+          </button>
+        </div>
+      )}
+      {isDragging && (
+        <div className="absolute inset-0 bg-indigo-50/90 z-20 flex flex-col items-center justify-center border-2 border-indigo-400 border-dashed m-2 rounded-lg backdrop-blur-sm transition-all duration-200">
+          <UploadCloud className="w-10 h-10 text-indigo-500 mb-3 animate-bounce" />
+          <span className="text-indigo-700 font-semibold text-lg tracking-tight">Drop file to load</span>
+        </div>
+      )}
+      {!value && !isDragging && (
+        <div className="absolute inset-0 z-10 flex flex-col items-center justify-center p-6 text-center pointer-events-none">
+          {cornerPlaceholder && (
+            <div className="absolute top-4 left-6 text-xs text-slate-400 font-mono text-left whitespace-pre-wrap pointer-events-none opacity-90">
+              {cornerPlaceholder}
+            </div>
+          )}
+          <UploadCloud className="w-12 h-12 text-slate-200 mb-4" />
+          <h3 className="text-lg font-medium text-slate-900 mb-1">Drag and drop your file here</h3>
+          <p className="text-sm text-slate-500 mb-6">{placeholder || `or upload a file, or click anywhere to paste raw ${language.toUpperCase()}`}</p>
+          <label className="pointer-events-auto cursor-pointer inline-flex items-center justify-center px-4 py-2 border border-transparent text-sm font-medium rounded-md shadow-sm text-white bg-indigo-600 hover:bg-indigo-700 transition-colors">
+            Upload File
+            <input type="file" className="hidden" accept={acceptedFileExtensions} onChange={handleFileUpload} />
+          </label>
+        </div>
+      )}
+
+      <Editor
+        height="100%"
+        language={language}
+        value={value}
+        onChange={(val) => onChange(val || '')}
+        theme="soopa-theme"
+        beforeMount={handleEditorWillMount}
+        options={{
+          automaticLayout: true,
+          minimap: { enabled: false },
+          scrollBeyondLastLine: false,
+          lineNumbersMinChars: 3,
+          wordWrap: 'on',
+          folding: true,
+          padding: { top: 16, bottom: 16 },
+          renderLineHighlight: 'none',
+          hideCursorInOverviewRuler: true,
+          overviewRulerBorder: false,
+          scrollbar: {
+            verticalScrollbarSize: 8,
+            horizontalScrollbarSize: 8,
+          },
+        }}
+      />
+    </div>
+  );
+}
diff --git a/frontend/web/src/components/ui/form-modal.tsx b/frontend/web/src/components/ui/form-modal.tsx
index 7a32d662..3eb320fb 100644
--- a/frontend/web/src/components/ui/form-modal.tsx
+++ b/frontend/web/src/components/ui/form-modal.tsx
@@ -35,7 +35,7 @@ export function FormModal({
   footerContent
 }: FormModalProps) {
   return (
-    <Dialog open={isOpen} onOpenChange={onOpenChange}>
+    <Dialog open={isOpen} onOpenChange={onOpenChange} modal={false}>
       <DialogTrigger asChild>
         <Button className="flex items-center gap-2 bg-indigo-600 hover:bg-indigo-700 text-white rounded-xl shadow-sm">
           {triggerIcon}
@@ -43,7 +43,11 @@ export function FormModal({
         </Button>
       </DialogTrigger>
 
-      <DialogContent className={`${maxWidth} rounded-2xl`} onPointerDownOutside={(e) => e.preventDefault()}>
+      <DialogContent
+        className={`${maxWidth} rounded-2xl`}
+        onPointerDownOutside={(e) => e.preventDefault()}
+        onFocusOutside={(e) => e.preventDefault()}
+      >
         <DialogHeader>
           <DialogTitle className="text-xl flex items-center gap-2">
             {icon && (
diff --git a/frontend/web/src/features/partners/api/IPartnersRepository.ts b/frontend/web/src/features/partners/api/IPartnersRepository.ts
index 4d76d061..40aed236 100644
--- a/frontend/web/src/features/partners/api/IPartnersRepository.ts
+++ b/frontend/web/src/features/partners/api/IPartnersRepository.ts
@@ -27,6 +27,7 @@ export interface IPartnersRepository {
   createPlatformPartnership(payload: CreatePartnershipPayload): Promise<Partnership>;
   updatePlatformPartnership(id: string, payload: UpdatePartnershipPayload): Promise<Partnership>;
   deletePlatformPartnership(id: string): Promise<void>;
+  testAs2PartnershipConnection(id: string, custom_payload?: string): Promise<{ success: boolean; mdn_disposition?: string | null; reason?: string | null; sent_payload?: string | null; raw_mdn?: string | null }>;
 
   // Certificates
   exportCertificates(partnerId: string): Promise<CertificatesExport>;
diff --git a/frontend/web/src/features/partners/api/partnerHooks.ts b/frontend/web/src/features/partners/api/partnerHooks.ts
index c37d175c..7698eb74 100644
--- a/frontend/web/src/features/partners/api/partnerHooks.ts
+++ b/frontend/web/src/features/partners/api/partnerHooks.ts
@@ -243,3 +243,11 @@ export function useTestExistingSftpConnectionMutation() {
       repo.testExistingSftpConnection(id, payload)
   });
 }
+
+export function useTestAs2PartnershipConnectionMutation() {
+  const repo = useRepository();
+  return useMutation({
+    mutationFn: ({ id, custom_payload }: { id: string; custom_payload?: string }) =>
+      repo.testAs2PartnershipConnection(id, custom_payload),
+  });
+}
diff --git a/frontend/web/src/features/partners/api/partnersApi.ts b/frontend/web/src/features/partners/api/partnersApi.ts
index 1ff15349..5b328b6d 100644
--- a/frontend/web/src/features/partners/api/partnersApi.ts
+++ b/frontend/web/src/features/partners/api/partnersApi.ts
@@ -103,6 +103,13 @@ class HttpPartnersRepository implements IPartnersRepository {
     });
   }
 
+  testAs2PartnershipConnection(id: string, custom_payload?: string): Promise<{ success: boolean; mdn_disposition?: string | null; reason?: string | null; sent_payload?: string | null; raw_mdn?: string | null }> {
+    return this.request(`/api/v1/platform/trading-partners/as2/partnerships/${id}/test`, {
+      method: 'POST',
+      body: custom_payload ? JSON.stringify({ custom_payload }) : undefined,
+    });
+  }
+
   // ── Certificates ───────────────────────────
   exportCertificates(partnerId: string): Promise<CertificatesExport> {
     return this.request(
diff --git a/frontend/web/src/features/partners/components/CertificateInput.tsx b/frontend/web/src/features/partners/components/CertificateInput.tsx
index e08cf652..2bb9d332 100644
--- a/frontend/web/src/features/partners/components/CertificateInput.tsx
+++ b/frontend/web/src/features/partners/components/CertificateInput.tsx
@@ -1,8 +1,4 @@
-import React, { useState, useRef } from 'react';
-import { Button } from '@/components/ui/button';
-import { UploadCloud, FileCode, ClipboardPaste } from 'lucide-react';
-
-type CertMode = 'upload' | 'paste';
+import { EdiEditorPane } from '@/components/ui/edi-editor-pane';
 
 export interface CertificateInputProps {
   value: string;
@@ -10,150 +6,19 @@ export interface CertificateInputProps {
 }
 
 /**
- * Reusable certificate input with two modes:
- *   - Upload: drag-and-drop or file picker
- *   - Paste: monospace textarea for raw PEM text
- *
- * Stateless regarding the cert value itself — parent owns it.
+ * Reusable certificate input powered by Monaco Editor.
+ * Supports drag-and-drop, file picker, and pasting raw PEM text natively.
  */
 export function CertificateInput({ value, onChange }: CertificateInputProps) {
-  const [mode, setMode] = useState<CertMode>('upload');
-  const [isDragging, setIsDragging] = useState(false);
-  const [pasteValue, setPasteValue] = useState(value);
-
-  React.useEffect(() => {
-    setPasteValue(value);
-  }, [value]);
-
-  const fileInputRef = useRef<HTMLInputElement>(null);
-
-  const readFile = (file: File) => {
-    const reader = new FileReader();
-    reader.onload = (e) => {
-      const content = e.target?.result as string;
-      if (content) onChange(content);
-    };
-    reader.readAsText(file);
-  };
-
-  const handleDrop = (e: React.DragEvent) => {
-    e.preventDefault();
-    setIsDragging(false);
-    if (e.dataTransfer.files.length > 0) readFile(e.dataTransfer.files[0]);
-  };
-
-  const handlePasteChange = (text: string) => {
-    setPasteValue(text);
-    onChange(text);
-  };
-
-  const handleClear = () => {
-    onChange('');
-    setPasteValue('');
-    if (fileInputRef.current) fileInputRef.current.value = '';
-  };
-
-  const switchMode = (next: CertMode) => {
-    setMode(next);
-  };
-
   return (
-    <div className="grid gap-2">
-      {/* Tab toggle */}
-      <div className="flex items-center gap-1 bg-slate-100 rounded-lg p-0.5 w-fit">
-        <button
-          type="button"
-          onClick={() => switchMode('upload')}
-          className={`flex items-center gap-1.5 px-3 py-1.5 rounded-md text-xs font-medium transition-all ${mode === 'upload' ? 'bg-white text-slate-800 shadow-sm' : 'text-slate-500 hover:text-slate-700'}`}
-        >
-          <UploadCloud className="h-3.5 w-3.5" />
-          Upload
-        </button>
-        <button
-          type="button"
-          onClick={() => switchMode('paste')}
-          className={`flex items-center gap-1.5 px-3 py-1.5 rounded-md text-xs font-medium transition-all ${mode === 'paste' ? 'bg-white text-slate-800 shadow-sm' : 'text-slate-500 hover:text-slate-700'}`}
-        >
-          <ClipboardPaste className="h-3.5 w-3.5" />
-          Paste
-        </button>
-      </div>
-
-      {mode === 'upload' ? (
-        <div
-          className={`relative flex flex-col items-center justify-center rounded-xl border-2 border-dashed p-6 transition-colors ${isDragging ? 'border-indigo-500 bg-indigo-50/50' : 'border-slate-200 bg-slate-50 hover:bg-slate-100'}`}
-          onDragOver={(e) => { e.preventDefault(); setIsDragging(true); }}
-          onDragLeave={(e) => { e.preventDefault(); setIsDragging(false); }}
-          onDrop={handleDrop}
-        >
-          <input
-            type="file"
-            ref={fileInputRef}
-            className="hidden"
-            accept=".cer,.crt,.pem,.txt"
-            onChange={(e) => e.target.files?.[0] && readFile(e.target.files[0])}
-          />
-
-          {value ? (
-            <div className="flex flex-col items-center gap-3">
-              <div className="flex h-12 w-12 items-center justify-center rounded-full bg-emerald-100 text-emerald-600">
-                <FileCode className="h-6 w-6" />
-              </div>
-              <div className="text-center">
-                <span className="block text-sm font-semibold text-slate-700">Certificate Loaded</span>
-                <span className="block text-xs text-slate-500 mt-1 truncate max-w-[200px]">
-                  {value.substring(0, 30)}...
-                </span>
-              </div>
-              <Button
-                type="button"
-                variant="outline"
-                onClick={handleClear}
-                className="h-8 text-xs px-3 rounded-lg mt-1 border-slate-200 hover:bg-red-50 hover:text-red-600 hover:border-red-200"
-              >
-                Replace File
-              </Button>
-            </div>
-          ) : (
-            <div
-              className="flex flex-col items-center gap-3 text-center cursor-pointer"
-              onClick={() => fileInputRef.current?.click()}
-              onKeyDown={(e) => {
-                if (e.key === 'Enter' || e.key === ' ') {
-                  e.preventDefault();
-                  fileInputRef.current?.click();
-                }
-              }}
-              tabIndex={0}
-              role="button"
-            >
-              <div className="rounded-full bg-white p-3 shadow-sm border border-slate-100">
-                <UploadCloud className="h-6 w-6 text-indigo-500" />
-              </div>
-              <div>
-                <span className="text-sm font-semibold text-indigo-600 hover:underline">Click to upload</span>
-                <span className="text-sm text-slate-500"> or drag and drop</span>
-              </div>
-              <span className="text-xs text-slate-400">PEM, CER, or CRT up to 10MB</span>
-            </div>
-          )}
-        </div>
-      ) : (
-        <div className="grid gap-1.5">
-          <textarea
-            className="w-full h-40 rounded-xl border border-slate-200 bg-slate-50 p-3 font-mono text-xs text-slate-700 resize-none focus:outline-none focus:ring-2 focus:ring-indigo-300 focus:border-indigo-400 placeholder:text-slate-400"
-            placeholder={"-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----"}
-            value={pasteValue}
-            onChange={(e) => handlePasteChange(e.target.value)}
-          />
-          {value && (
-            <div className="flex items-center gap-2 text-xs text-emerald-600 font-medium">
-              <FileCode className="h-3.5 w-3.5" />
-              Certificate detected
-            </div>
-          )}
-        </div>
-      )}
+    <div className="border border-slate-200 rounded-xl overflow-hidden h-[250px] flex flex-col">
+      <EdiEditorPane
+        value={value}
+        onChange={onChange}
+        language="plaintext"
+        placeholder="or click anywhere to paste raw PEM"
+        cornerPlaceholder={"-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----"}
+      />
     </div>
   );
 }
diff --git a/frontend/web/src/features/partners/components/CreatePartnershipModal.tsx b/frontend/web/src/features/partners/components/CreatePartnershipModal.tsx
index 4dc66f17..74e8f6e2 100644
--- a/frontend/web/src/features/partners/components/CreatePartnershipModal.tsx
+++ b/frontend/web/src/features/partners/components/CreatePartnershipModal.tsx
@@ -19,9 +19,8 @@ export function CreatePartnershipModal({ availablePartners }: CreatePartnershipM
   const [remotePartnerId, setRemotePartnerId] = useState('')
   const [mdnType, setMdnType] = useState('SYNC')
   const [mdnUrl, setMdnUrl] = useState('')
-  const [encryptionAlgorithm, setEncryptionAlgorithm] = useState('AES256_CBC')
+  const [encryptionAlgorithm, setEncryptionAlgorithm] = useState('AES256')
   const [signatureAlgorithm, setSignatureAlgorithm] = useState('SHA256')
-  const [ediVersion, setEdiVersion] = useState('X12-004010')
 
   const { data: platformConfig } = usePlatformConfig();
   const createPartnership = useCreatePlatformPartnershipMutation();
@@ -38,9 +37,8 @@ export function CreatePartnershipModal({ availablePartners }: CreatePartnershipM
     setRemotePartnerId('')
     setMdnType('SYNC')
     setMdnUrl(platformConfig?.available_as2_receive_urls?.[0] || '')
-    setEncryptionAlgorithm('AES256_CBC')
+    setEncryptionAlgorithm('AES256')
     setSignatureAlgorithm('SHA256')
-    setEdiVersion('X12-004010')
   }
 
   const handleOpenChange = (open: boolean) => {
@@ -60,7 +58,6 @@ export function CreatePartnershipModal({ availablePartners }: CreatePartnershipM
         mdn_url: mdnType === 'ASYNC' ? (mdnUrl || undefined) : undefined,
         encryption_algorithm: encryptionAlgorithm,
         signature_algorithm: signatureAlgorithm,
-        edi_version: ediVersion === "NONE" ? undefined : ediVersion,
       },
       {
         onSuccess: () => {
@@ -147,7 +144,7 @@ export function CreatePartnershipModal({ availablePartners }: CreatePartnershipM
           )}
         </div>
 
-        <div className="grid grid-cols-1 sm:grid-cols-3 gap-6">
+        <div className="grid grid-cols-1 sm:grid-cols-2 gap-6">
           <div className="grid gap-2">
             <Label className="text-slate-600 font-medium">Encryption</Label>
             <Select value={encryptionAlgorithm} onValueChange={setEncryptionAlgorithm}>
@@ -155,9 +152,9 @@ export function CreatePartnershipModal({ availablePartners }: CreatePartnershipM
                 <SelectValue placeholder="Algorithm" />
               </SelectTrigger>
               <SelectContent>
-                <SelectItem value="AES256_CBC">AES-256-CBC</SelectItem>
-                <SelectItem value="AES128_CBC">AES-128-CBC</SelectItem>
-                <SelectItem value="3DES">3DES (Legacy)</SelectItem>
+                {(platformConfig?.supported_as2_encryption_algorithms || []).map(o => (
+                  <SelectItem key={o.value} value={o.value}>{o.label}</SelectItem>
+                ))}
               </SelectContent>
             </Select>
           </div>
@@ -169,25 +166,9 @@ export function CreatePartnershipModal({ availablePartners }: CreatePartnershipM
                 <SelectValue placeholder="Algorithm" />
               </SelectTrigger>
               <SelectContent>
-                <SelectItem value="SHA256">SHA-256</SelectItem>
-                <SelectItem value="SHA1">SHA-1 (Legacy)</SelectItem>
-                <SelectItem value="MD5">MD5 (Insecure)</SelectItem>
-              </SelectContent>
-            </Select>
-          </div>
-
-          <div className="grid gap-2">
-            <Label className="text-slate-600 font-medium">EDI Version</Label>
-            <Select value={ediVersion} onValueChange={setEdiVersion}>
-              <SelectTrigger className="h-10 rounded-xl">
-                <SelectValue placeholder="Version" />
-              </SelectTrigger>
-              <SelectContent>
-                <SelectItem value="X12-004010">X12 4010</SelectItem>
-                <SelectItem value="X12-005010">X12 5010</SelectItem>
-                <SelectItem value="EDIFACT-D96A">EDIFACT D96A</SelectItem>
-                <SelectItem value="EDIFACT-D01B">EDIFACT D01B</SelectItem>
-                <SelectItem value="NONE">Not Applicable</SelectItem>
+                {(platformConfig?.supported_as2_signature_algorithms || []).map(o => (
+                  <SelectItem key={o.value} value={o.value}>{o.label}</SelectItem>
+                ))}
               </SelectContent>
             </Select>
           </div>
diff --git a/frontend/web/src/features/partners/components/PartnershipDetails.tsx b/frontend/web/src/features/partners/components/PartnershipDetails.tsx
index 3bbb29cc..88962fab 100644
--- a/frontend/web/src/features/partners/components/PartnershipDetails.tsx
+++ b/frontend/web/src/features/partners/components/PartnershipDetails.tsx
@@ -1,30 +1,36 @@
-
-import { useEffect } from 'react';
+import { useEffect, useState } from 'react';
 import { useForm, Controller } from 'react-hook-form';
 import type { Partnership } from '../context/PlatformPartnersContext';
-import { useUpdatePlatformPartnershipMutation } from '../api/partnerHooks';
+import type { AS2Partner, Partner } from '../types';
+import { useUpdatePlatformPartnershipMutation, useTestAs2PartnershipConnectionMutation } from '../api/partnerHooks';
 import { Button } from '@/components/ui/button';
 import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
-import { Loader2 } from 'lucide-react';
+import { Loader2, Zap, CheckCircle2, XCircle, Trash2 } from 'lucide-react';
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
 import { useToast } from '@/hooks/use-toast';
 import { usePlatformConfig } from '@/features/platform/api/configHooks';
 import { Combobox } from '@/components/ui/combobox';
 import { SearchableSelect } from '@/components/ui/searchable-select';
+import { EdiEditorPane } from '@/components/ui/edi-editor-pane';
 
 export interface PartnershipDetailsProps {
   partnership: Partnership;
-  availablePartners: { id: string; name: string; type: string; is_local?: boolean }[];
+  availablePartners: Partner[];
   onCancel?: () => void;
 }
 
 export function PartnershipDetails({ partnership, availablePartners, onCancel }: PartnershipDetailsProps) {
   const { toast } = useToast();
   const updatePartnership = useUpdatePlatformPartnershipMutation();
+  const testConnection = useTestAs2PartnershipConnectionMutation();
   const { data: platformConfig } = usePlatformConfig();
   const isSubmitting = updatePartnership.isPending;
 
+  // Custom Payload State
+  const [customPayload, setCustomPayload] = useState('');
+  const [showRawMdn, setShowRawMdn] = useState(false);
+
   const { register, handleSubmit, control, watch, setValue, formState: { isDirty }, reset } = useForm({
     defaultValues: {
       name: partnership.name || '',
@@ -32,21 +38,19 @@ export function PartnershipDetails({ partnership, availablePartners, onCancel }:
       remote_partner_id: partnership.remote_partner_id,
       mdn_type: partnership.mdn_type || 'SYNC',
       mdn_url: partnership.mdn_url || '',
-      encryption_algorithm: partnership.encryption_algorithm || 'AES256_CBC',
-      signature_algorithm: partnership.signature_algorithm || 'MIC_SHA256',
-      edi_version: partnership.edi_version || 'X12_004010',
+      encryption_algorithm: partnership.encryption_algorithm || 'AES256',
+      signature_algorithm: partnership.signature_algorithm || 'SHA256',
     }
   });
 
-  const mdnType = watch("mdn_type");
-  const mdnUrl = watch("mdn_url");
+  const mdnType = watch('mdn_type');
+  const mdnUrl = watch('mdn_url');
 
   useEffect(() => {
     if (mdnType === 'ASYNC' && !mdnUrl && platformConfig?.available_as2_receive_urls?.length) {
       setValue('mdn_url', platformConfig.available_as2_receive_urls[0], { shouldDirty: true });
     }
   }, [mdnType, mdnUrl, setValue, platformConfig]);
-
   const onSubmit = (formData: any) => {
     const payload: any = {};
     if (formData.name !== partnership.name) payload.name = formData.name;
@@ -56,7 +60,6 @@ export function PartnershipDetails({ partnership, availablePartners, onCancel }:
     if (formData.mdn_url !== partnership.mdn_url) payload.mdn_url = formData.mdn_url || null;
     if (formData.encryption_algorithm !== partnership.encryption_algorithm) payload.encryption_algorithm = formData.encryption_algorithm;
     if (formData.signature_algorithm !== partnership.signature_algorithm) payload.signature_algorithm = formData.signature_algorithm;
-    if (formData.edi_version !== partnership.edi_version) payload.edi_version = formData.edi_version;
 
     updatePartnership.mutate({ id: partnership.id, payload }, {
       onSuccess: () => {
@@ -69,34 +72,33 @@ export function PartnershipDetails({ partnership, availablePartners, onCancel }:
   return (
     <div className="p-6 bg-slate-50/50 border-t border-slate-100">
       <form onSubmit={handleSubmit(onSubmit)}>
-        <div className="flex justify-between items-start mb-6">
-          <div>
-            <h4 className="text-sm font-semibold text-slate-900 uppercase tracking-wider mb-1">Partnership Details</h4>
-          </div>
-          <div className="flex items-center gap-3">
+        {/* ── Header ─────────────────────────────────────────────────────── */}
+        <div className="flex justify-between items-center mb-5">
+          <h4 className="text-sm font-semibold text-slate-900 uppercase tracking-wider">Partnership Details</h4>
+          <div className="flex items-center gap-2">
             <Button
               type="button"
               variant="outline"
-              onClick={() => {
-                reset();
-                if (onCancel) onCancel();
-              }}
+              size="sm"
+              onClick={() => { reset(); if (onCancel) onCancel(); }}
               disabled={!isDirty || isSubmitting}
             >
               Cancel
             </Button>
             <Button
               type="submit"
+              size="sm"
               disabled={!isDirty || isSubmitting}
-              className="min-w-[100px]"
+              className="min-w-[80px]"
             >
               {isSubmitting ? <Loader2 className="w-4 h-4 animate-spin" /> : 'Save'}
             </Button>
           </div>
         </div>
 
-        <div className="grid grid-cols-2 gap-x-8 gap-y-4">
 
+        {/* ── Editable fields ─────────────────────────────────────────────── */}
+        <div className="grid grid-cols-2 gap-x-8 gap-y-4">
           <div>
             <Label className="text-xs text-slate-500 block mb-1">Local Partner</Label>
             <Controller
@@ -107,13 +109,12 @@ export function PartnershipDetails({ partnership, availablePartners, onCancel }:
                   value={field.value}
                   onChange={field.onChange}
                   options={availablePartners
-                    .filter(p => p.type === 'AS2' && p.is_local === true)
+                    .filter(p => p.type === 'AS2' && (p as AS2Partner).is_local === true)
                     .map(p => ({ label: p.name, value: p.id, searchString: p.name }))}
                 />
               )}
             />
           </div>
-
           <div>
             <Label className="text-xs text-slate-500 block mb-1">Remote Partner</Label>
             <Controller
@@ -124,18 +125,16 @@ export function PartnershipDetails({ partnership, availablePartners, onCancel }:
                   value={field.value}
                   onChange={field.onChange}
                   options={availablePartners
-                    .filter(p => p.type === 'AS2' && !p.is_local)
+                    .filter(p => p.type === 'AS2' && !(p as AS2Partner).is_local)
                     .map(p => ({ label: p.name, value: p.id, searchString: p.name }))}
                 />
               )}
             />
           </div>
-
           <div>
             <Label className="text-xs text-slate-500 block mb-1">Partnership Name</Label>
-            <Input {...register("name")} required placeholder="e.g. Acme Corp X12 Exchange" />
+            <Input {...register('name')} required placeholder="e.g. Acme Corp X12 Exchange" />
           </div>
-
           <div>
             <Label className="text-xs text-slate-500 block mb-1">MDN Type</Label>
             <Controller
@@ -143,9 +142,7 @@ export function PartnershipDetails({ partnership, availablePartners, onCancel }:
               control={control}
               render={({ field }) => (
                 <Select value={field.value} onValueChange={field.onChange}>
-                  <SelectTrigger>
-                    <SelectValue />
-                  </SelectTrigger>
+                  <SelectTrigger><SelectValue /></SelectTrigger>
                   <SelectContent>
                     <SelectItem value="SYNC">SYNC</SelectItem>
                     <SelectItem value="ASYNC">ASYNC</SelectItem>
@@ -155,7 +152,6 @@ export function PartnershipDetails({ partnership, availablePartners, onCancel }:
               )}
             />
           </div>
-
           {mdnType === 'ASYNC' && (
             <div>
               <Label className="text-xs text-slate-500 block mb-1">MDN URL</Label>
@@ -174,7 +170,6 @@ export function PartnershipDetails({ partnership, availablePartners, onCancel }:
               />
             </div>
           )}
-
           <div>
             <Label className="text-xs text-slate-500 block mb-1">Encryption</Label>
             <Controller
@@ -182,19 +177,16 @@ export function PartnershipDetails({ partnership, availablePartners, onCancel }:
               control={control}
               render={({ field }) => (
                 <Select value={field.value} onValueChange={field.onChange}>
-                  <SelectTrigger>
-                    <SelectValue />
-                  </SelectTrigger>
+                  <SelectTrigger><SelectValue /></SelectTrigger>
                   <SelectContent>
-                    <SelectItem value="AES256_CBC">AES-256-CBC</SelectItem>
-                    <SelectItem value="AES128_CBC">AES-128-CBC</SelectItem>
-                    <SelectItem value="3DES">3DES (Legacy)</SelectItem>
+                    {(platformConfig?.supported_as2_encryption_algorithms || []).map(o => (
+                      <SelectItem key={o.value} value={o.value}>{o.label}</SelectItem>
+                    ))}
                   </SelectContent>
                 </Select>
               )}
             />
           </div>
-
           <div>
             <Label className="text-xs text-slate-500 block mb-1">Signature</Label>
             <Controller
@@ -202,42 +194,128 @@ export function PartnershipDetails({ partnership, availablePartners, onCancel }:
               control={control}
               render={({ field }) => (
                 <Select value={field.value} onValueChange={field.onChange}>
-                  <SelectTrigger>
-                    <SelectValue />
-                  </SelectTrigger>
+                  <SelectTrigger><SelectValue /></SelectTrigger>
                   <SelectContent>
-                    <SelectItem value="MIC_SHA256">SHA-256</SelectItem>
-                    <SelectItem value="MIC_SHA384">SHA-384</SelectItem>
-                    <SelectItem value="MIC_SHA512">SHA-512</SelectItem>
-                    <SelectItem value="MIC_SHA1">SHA-1 (Legacy)</SelectItem>
+                    {(platformConfig?.supported_as2_signature_algorithms || []).map(o => (
+                      <SelectItem key={o.value} value={o.value}>{o.label}</SelectItem>
+                    ))}
                   </SelectContent>
                 </Select>
               )}
             />
           </div>
+        </div>
+      </form>
 
-          <div>
-            <Label className="text-xs text-slate-500 block mb-1">EDI Version</Label>
-            <Controller
-              name="edi_version"
-              control={control}
-              render={({ field }) => (
-                <Select value={field.value} onValueChange={field.onChange}>
-                  <SelectTrigger>
-                    <SelectValue />
-                  </SelectTrigger>
-                  <SelectContent>
-                    <SelectItem value="X12_004010">X12 4010</SelectItem>
-                    <SelectItem value="X12_005010">X12 5010</SelectItem>
-                    <SelectItem value="EDIFACT_D96A">EDIFACT D96A</SelectItem>
-                    <SelectItem value="EDIFACT_D01B">EDIFACT D01B</SelectItem>
-                  </SelectContent>
-                </Select>
-              )}
-            />
+      {/* ── Test Connection Section ──────────────────────────────────────── */}
+      <div className="mt-8 pt-6 border-t border-slate-200">
+        {/* Drag, Drop, Paste Area (Monaco) */}
+        <div className="flex flex-col border rounded-xl bg-white shadow-sm overflow-hidden relative h-[350px]">
+          <div className="bg-slate-50 px-4 py-2 border-b flex items-center justify-end">
+            <div className="flex items-center gap-2">
+              {isDirty && <span className="text-xs text-amber-600 font-medium mr-2">⚠️ Save changes before testing</span>}
+              <Button
+                type="button"
+                id={`test-as2-connection-${partnership.id}`}
+                variant="default"
+                size="sm"
+                className="gap-1.5 bg-indigo-600 hover:bg-indigo-700 text-white shadow-sm h-7 text-xs px-3"
+                onClick={() => {
+                  setShowRawMdn(false);
+                  testConnection.mutate({ id: partnership.id, custom_payload: customPayload || undefined });
+                }}
+                disabled={testConnection.isPending || (isDirty && !isSubmitting)}
+                title={isDirty ? "Save changes before testing" : ""}
+              >
+                {testConnection.isPending
+                  ? <Loader2 className="w-3.5 h-3.5 animate-spin" />
+                  : <Zap className="w-3.5 h-3.5 fill-current opacity-70" />}
+                Test Connection
+              </Button>
+              <div className="h-4 w-px bg-slate-300 mx-1 shrink-0" />
+              <button
+                type="button"
+                onClick={() => setCustomPayload('')}
+                className="p-1 hover:bg-slate-200 rounded text-slate-500 hover:text-red-600 transition-colors flex items-center justify-center border-slate-200"
+                title="Clear Payload"
+              >
+                <Trash2 className="w-4 h-4" />
+              </button>
+            </div>
           </div>
+          <EdiEditorPane
+            value={customPayload}
+            onChange={(val) => setCustomPayload(val)}
+            placeholder="Paste custom EDI payload here, or drag & drop a file..."
+          />
         </div>
-      </form>
+
+        {/* Results Panel */}
+        {testConnection.data && (
+          <div className="space-y-3">
+            <div className={`flex items-start gap-3 rounded-lg px-4 py-3 text-sm border ${
+              testConnection.data.success
+                ? 'bg-emerald-50 border-emerald-200 text-emerald-800'
+                : 'bg-red-50 border-red-200 text-red-800'
+            }`}>
+              {testConnection.data.success
+                ? <CheckCircle2 className="w-5 h-5 mt-0.5 shrink-0 text-emerald-600" />
+                : <XCircle className="w-5 h-5 mt-0.5 shrink-0 text-red-500" />}
+              <div>
+                <p className="font-semibold text-base">
+                  {testConnection.data.success ? 'Connection successful' : 'Connection failed'}
+                </p>
+                <p className="mt-1 opacity-90 leading-relaxed">
+                  {testConnection.data.success
+                    ? `MDN: ${testConnection.data.mdn_disposition ?? 'processed'}`
+                    : (testConnection.data.reason ?? 'Unknown error')}
+                </p>
+              </div>
+            </div>
+
+            {/* Display raw MDN if available, fallback to sent_payload if not */}
+            {(testConnection.data.raw_mdn || testConnection.data.sent_payload) && (
+              <div className="rounded-lg border border-slate-200 bg-white overflow-hidden">
+                <div className="bg-slate-50 px-4 py-2 border-b border-slate-200 flex justify-between items-center">
+                  <p className="text-xs font-semibold text-slate-600 uppercase tracking-wider">
+                    {testConnection.data.raw_mdn ? 'Received MDN' : 'Payload Sent'}
+                  </p>
+                  {testConnection.data.raw_mdn && (
+                    <Button
+                      type="button"
+                      variant="ghost"
+                      size="sm"
+                      onClick={() => setShowRawMdn(!showRawMdn)}
+                      aria-expanded={showRawMdn}
+                      aria-controls="raw-mdn-panel"
+                      className="text-xs text-slate-500 hover:text-slate-800"
+                    >
+                      {showRawMdn ? 'Hide Raw MDN' : 'View Raw MDN'}
+                    </Button>
+                  )}
+                </div>
+                {(showRawMdn || !testConnection.data.raw_mdn) && (
+                  <div id="raw-mdn-panel" role="region" className="p-4 bg-slate-50 overflow-x-auto">
+                    <pre className="text-xs font-mono text-slate-800 whitespace-pre-wrap break-all">
+                      {testConnection.data.raw_mdn || testConnection.data.sent_payload}
+                    </pre>
+                  </div>
+                )}
+              </div>
+            )}
+          </div>
+        )}
+
+        {testConnection.isError && (
+          <div className="flex items-start gap-3 rounded-lg px-4 py-3 text-sm border bg-red-50 border-red-200 text-red-800">
+            <XCircle className="w-5 h-5 mt-0.5 shrink-0 text-red-500" />
+            <div>
+              <p className="font-semibold text-base">Request failed</p>
+              <p className="mt-1 opacity-90">{testConnection.error?.message ?? 'Could not reach the server.'}</p>
+            </div>
+          </div>
+        )}
+      </div>
     </div>
   );
 }
diff --git a/frontend/web/src/features/partners/components/PartnershipsTable.tsx b/frontend/web/src/features/partners/components/PartnershipsTable.tsx
index 199a5aed..fdc273e4 100644
--- a/frontend/web/src/features/partners/components/PartnershipsTable.tsx
+++ b/frontend/web/src/features/partners/components/PartnershipsTable.tsx
@@ -47,77 +47,100 @@ function PartnershipRowActions({ partnership }: { partnership: Partnership }) {
 
 const columnHelper = createColumnHelper<Partnership>();
 
-const columns = [
+import type { Partner } from '../context/PlatformPartnersContext';
 
-  columnHelper.accessor('name', {
-    header: 'Partnership Name',
-    cell: (info) => {
-      const name = info.getValue();
-      if (!name) return (
-        <div className="flex items-center gap-3">
-          <div className="w-8 h-8 rounded-lg bg-emerald-50 flex items-center justify-center text-emerald-600">
-            <Network className="w-4 h-4" />
+export function PartnershipsTable({ data, availablePartners, isLoading }: { data: Partnership[]; availablePartners: Partner[]; isLoading: boolean }) {
+  const columns = React.useMemo(() => {
+    const getPartnerName = (id: string) => {
+      const p = availablePartners.find(ap => ap.id === id);
+      if (!p) return id.split('-')[0] + '...';
+      if (p.name) return p.name;
+      if ('as2_id' in p) return p.as2_id;
+      return id.split('-')[0] + '...';
+    };
+
+    return [
+      columnHelper.accessor('name', {
+        header: 'Partnership Name',
+        cell: (info) => {
+          const name = info.getValue();
+          if (!name) return (
+            <div className="flex items-center gap-3">
+              <div className="w-8 h-8 rounded-lg bg-emerald-50 flex items-center justify-center text-emerald-600">
+                <Network className="w-4 h-4" />
+              </div>
+              <span className="text-slate-400 text-sm">Unnamed Partnership</span>
+            </div>
+          );
+          return (
+            <div className="flex items-center gap-3">
+              <div className="w-8 h-8 rounded-lg bg-emerald-50 flex items-center justify-center text-emerald-600">
+                <Network className="w-4 h-4" />
+              </div>
+              <span className="font-medium text-sm text-slate-700">
+                {name}
+              </span>
+            </div>
+          );
+        },
+      }),
+      columnHelper.accessor('local_partner_id', {
+        header: 'Local Partner',
+        cell: (info) => {
+          const resolvedName = getPartnerName(info.getValue());
+          return (
+            <span className="text-sm font-medium text-slate-700 truncate max-w-[120px]" title={resolvedName}>
+              {resolvedName}
+            </span>
+          );
+        },
+      }),
+      columnHelper.accessor('remote_partner_id', {
+        header: 'Remote Partner',
+        cell: (info) => {
+          const resolvedName = getPartnerName(info.getValue());
+          return (
+            <span className="text-sm font-medium text-slate-700 truncate max-w-[120px]" title={resolvedName}>
+              {resolvedName}
+            </span>
+          );
+        },
+      }),
+      columnHelper.accessor('mdn_type', {
+        header: 'MDN Type',
+        cell: (info) => (
+          <span className="inline-flex items-center gap-1.5 px-2.5 py-1 rounded-full text-xs font-medium bg-indigo-50 text-indigo-700 border border-indigo-200">
+            {info.getValue()}
+          </span>
+        ),
+      }),
+      columnHelper.accessor('encryption_algorithm', {
+        header: 'Security',
+        cell: (info) => (
+          <div className="flex flex-col gap-0.5">
+            <span className="flex items-center gap-1.5 text-xs font-medium text-slate-600">
+              <ShieldCheck className="w-3.5 h-3.5 text-emerald-500" />
+              Enc: {info.getValue()}
+            </span>
+            <span className="flex items-center gap-1.5 text-xs font-medium text-slate-600">
+              <ShieldCheck className="w-3.5 h-3.5 text-indigo-500" />
+              Sig: {info.row.original.signature_algorithm}
+            </span>
           </div>
-          <span className="text-slate-400 text-sm">Unnamed Partnership</span>
-        </div>
-      );
-      return (
-        <div className="flex items-center gap-3">
-          <div className="w-8 h-8 rounded-lg bg-emerald-50 flex items-center justify-center text-emerald-600">
-            <Network className="w-4 h-4" />
+        ),
+      }),
+      columnHelper.display({
+        id: 'actions',
+        header: '',
+        cell: (info) => (
+          <div className="flex justify-end">
+            <PartnershipRowActions partnership={info.row.original} />
           </div>
-          <span className="font-medium text-sm text-slate-700">
-            {name}
-          </span>
-        </div>
-      );
-    },
-  }),
-  columnHelper.accessor('mdn_type', {
-    header: 'MDN Type',
-    cell: (info) => (
-      <span className="inline-flex items-center gap-1.5 px-2.5 py-1 rounded-full text-xs font-medium bg-indigo-50 text-indigo-700 border border-indigo-200">
-        {info.getValue()}
-      </span>
-    ),
-  }),
-  columnHelper.accessor('encryption_algorithm', {
-    header: 'Security',
-    cell: (info) => (
-      <div className="flex flex-col gap-0.5">
-        <span className="flex items-center gap-1.5 text-xs font-medium text-slate-600">
-          <ShieldCheck className="w-3.5 h-3.5 text-emerald-500" />
-          Enc: {info.getValue()}
-        </span>
-        <span className="flex items-center gap-1.5 text-xs font-medium text-slate-600">
-          <ShieldCheck className="w-3.5 h-3.5 text-indigo-500" />
-          Sig: {info.row.original.signature_algorithm}
-        </span>
-      </div>
-    ),
-  }),
-  columnHelper.accessor('edi_version', {
-    header: 'EDI Version',
-    cell: (info) => (
-      <span className="text-sm text-slate-600 font-medium">
-        {info.getValue() || 'N/A'}
-      </span>
-    ),
-  }),
-  columnHelper.display({
-    id: 'actions',
-    header: '',
-    cell: (info) => (
-      <div className="flex justify-end">
-        <PartnershipRowActions partnership={info.row.original} />
-      </div>
-    ),
-  }),
-];
-
-import type { Partner } from '../context/PartnersContext';
+        ),
+      }),
+    ];
+  }, [availablePartners]);
 
-export function PartnershipsTable({ data, availablePartners, isLoading }: { data: Partnership[]; availablePartners: Partner[]; isLoading: boolean }) {
   const table = useReactTable({
     data,
     columns,
diff --git a/frontend/web/src/features/partners/types.ts b/frontend/web/src/features/partners/types.ts
index c2f9f248..5a8e4a19 100644
--- a/frontend/web/src/features/partners/types.ts
+++ b/frontend/web/src/features/partners/types.ts
@@ -45,7 +45,7 @@ export interface Partnership {
   mdn_url?: string;
   encryption_algorithm: string;
   signature_algorithm: string;
-  edi_version?: string | null;
+
   active?: boolean;
 }
 
@@ -95,7 +95,7 @@ export interface CreatePartnershipPayload {
   mdn_type: string;
   encryption_algorithm: string;
   signature_algorithm: string;
-  edi_version?: string;
+
   mdn_url?: string;
 }
 
@@ -117,7 +117,7 @@ export interface UpdatePartnershipPayload {
   mdn_url?: string;
   encryption_algorithm?: string;
   signature_algorithm?: string;
-  edi_version?: string;
+
   advanced_flags?: Record<string, unknown>;
   active?: boolean;
 }
diff --git a/frontend/web/src/features/platform/api/configHooks.ts b/frontend/web/src/features/platform/api/configHooks.ts
index d98b209e..93bb7064 100644
--- a/frontend/web/src/features/platform/api/configHooks.ts
+++ b/frontend/web/src/features/platform/api/configHooks.ts
@@ -1,8 +1,15 @@
 import { useQuery } from '@tanstack/react-query';
 import { useAuth } from 'react-oidc-context';
 
+export interface SupportedAlgorithm {
+  value: string;
+  label: string;
+}
+
 export interface PlatformConfig {
   available_as2_receive_urls: string[];
+  supported_as2_encryption_algorithms: SupportedAlgorithm[];
+  supported_as2_signature_algorithms: SupportedAlgorithm[];
 }
 
 export const usePlatformConfig = () => {
diff --git a/frontend/web/src/routes/tenant/edi_tool.tsx b/frontend/web/src/routes/tenant/edi_tool.tsx
index 991f7ef9..ad3386a4 100644
--- a/frontend/web/src/routes/tenant/edi_tool.tsx
+++ b/frontend/web/src/routes/tenant/edi_tool.tsx
@@ -1,12 +1,14 @@
 import { useState, useEffect } from 'react';
+import { registerEdiLanguageAndTheme } from '@/utils/monaco-edi';
 import { useMutation } from '@tanstack/react-query';
 import axios from 'axios';
-import { FileCode, CheckCircle, AlertTriangle, Copy, UploadCloud, Trash2 } from 'lucide-react';
+import { FileCode, CheckCircle, AlertTriangle, Copy, Trash2 } from 'lucide-react';
 import { useToast } from '@/hooks/use-toast';
-import Editor from '@monaco-editor/react';
 import { createRoute } from '@tanstack/react-router';
 import { Route as appRoute } from '../tenant';
 import { EdiHumanReadableViewer } from './components/EdiHumanReadableViewer';
+import { EdiEditorPane } from '@/components/ui/edi-editor-pane';
+import Editor from '@monaco-editor/react';
 
 // Simple useDebounce hook for auto-running
 function useDebounce<T>(value: T, delay: number): T {
@@ -38,88 +40,11 @@ function EdiToolPage() {
   const [outputResult, setOutputResult] = useState('');
   const [validationErrors, setValidationErrors] = useState<string[]>([]);
   const [isValid, setIsValid] = useState<boolean | null>(null);
-  const [isDragging, setIsDragging] = useState(false);
-
-  const handleDragOver = (e: React.DragEvent) => {
-    e.preventDefault();
-    setIsDragging(true);
-  };
-
-  const handleDragLeave = (e: React.DragEvent) => {
-    e.preventDefault();
-    setIsDragging(false);
-  };
-
-  const applyDetectedPayload = (text: string) => {
-    try {
-      JSON.parse(text);
-      setInputFormat('JSON');
-      setOutputFormat('EDI');
-    } catch {
-      setInputFormat('EDI');
-      setOutputFormat('JSON');
-    }
-    setInputPayload(text);
-  };
-
-  const handleDrop = async (e: React.DragEvent) => {
-    e.preventDefault();
-    setIsDragging(false);
 
-    if (e.dataTransfer.files && e.dataTransfer.files.length > 0) {
-      const file = e.dataTransfer.files[0];
-      const text = await file.text();
-      applyDetectedPayload(text);
-    }
-  };
-
-  const handleFileUpload = async (e: React.ChangeEvent<HTMLInputElement>) => {
-    if (e.target.files && e.target.files.length > 0) {
-      const file = e.target.files[0];
-      const text = await file.text();
-      applyDetectedPayload(text);
-      e.target.value = ''; // Reset input so same file can be uploaded again
-    }
-  };
 
 
   const handleEditorWillMount = (monaco: any) => {
-    // Only register language if it doesn't already exist to prevent HMR errors
-    if (!monaco.languages.getLanguages().some((l: any) => l.id === 'edi')) {
-      monaco.languages.register({ id: 'edi' });
-      monaco.languages.setMonarchTokensProvider('edi', {
-        tokenizer: {
-          root: [
-            [/^[A-Z0-9]{2,3}(?=\*)/, 'keyword'],
-            [/(~\s*)([A-Z0-9]{2,3})(?=\*)/, ['delimiter', 'keyword']],
-            [/\*/, 'delimiter'],
-            [/~/, 'delimiter'],
-            [/[^*~\n\r]+/, 'string'],
-          ],
-        },
-      });
-    }
-
-    // Define our custom theme for both EDI and JSON
-    monaco.editor.defineTheme('soopa-theme', {
-      base: 'vs',
-      inherit: true,
-      rules: [
-        // EDI Theme: Blue Bold Segments, Dark Green Values, Black Delimiters
-        { token: 'keyword', foreground: '0451a5', fontStyle: 'bold' }, // Blue
-        { token: 'string', foreground: '065f46' },  // Dark Green
-        { token: 'delimiter', foreground: '000000' }, // Black
-
-        // JSON Theme: Blue Bold Keys, Dark Green String Values
-        { token: 'string.key.json', foreground: '0451a5', fontStyle: 'bold' }, // Blue
-        { token: 'string.value.json', foreground: '065f46' }, // Dark Green
-        { token: 'number.json', foreground: '065f46' }, // Dark Green
-        { token: 'keyword.json', foreground: '0451a5', fontStyle: 'bold' }, // Blue
-      ],
-      colors: {
-        'editor.background': '#ffffff',
-      }
-    });
+    registerEdiLanguageAndTheme(monaco);
   };
 
   const { toast } = useToast();
@@ -309,12 +234,7 @@ function EdiToolPage() {
 
       <div className="flex-1 grid grid-cols-2 gap-4 min-h-0">
         {/* Left Pane (Input) */}
-        <div
-          className="flex flex-col border rounded-xl bg-white shadow-sm overflow-hidden relative"
-          onDragOver={handleDragOver}
-          onDragLeave={handleDragLeave}
-          onDrop={handleDrop}
-        >
+        <div className="flex flex-col border rounded-xl bg-white shadow-sm overflow-hidden relative">
           <div className="bg-slate-50 px-4 py-2 border-b flex items-center justify-between">
             <div className="flex items-center gap-1 bg-slate-100 p-1 rounded-md border">
               <button
@@ -363,62 +283,23 @@ function EdiToolPage() {
               </button>
             </div>
           </div>
-          <div className="flex-1 p-0 bg-white min-h-0 flex flex-col relative">
-            {isDragging && (
-              <div className="absolute inset-0 bg-indigo-50/90 z-20 flex flex-col items-center justify-center border-2 border-indigo-400 border-dashed m-2 rounded-lg backdrop-blur-sm transition-all duration-200">
-                <UploadCloud className="w-10 h-10 text-indigo-500 mb-3 animate-bounce" />
-                <span className="text-indigo-700 font-semibold text-lg tracking-tight">Drop file to load</span>
-              </div>
-            )}
-            {!inputPayload && !isDragging && (
-              <div className="absolute inset-0 z-10 flex flex-col items-center justify-center p-6 text-center pointer-events-none">
-                <UploadCloud className="w-12 h-12 text-slate-200 mb-4" />
-                <h3 className="text-lg font-medium text-slate-900 mb-1">Drag and drop your file here</h3>
-                <p className="text-sm text-slate-500 mb-6">or upload a file, or click anywhere to paste raw {inputFormat}</p>
-
-                <label className="pointer-events-auto cursor-pointer inline-flex items-center justify-center px-4 py-2 border border-transparent text-sm font-medium rounded-md shadow-sm text-white bg-indigo-600 hover:bg-indigo-700 transition-colors">
-                  Upload File
-                  <input type="file" className="hidden" accept=".edi,.json,.txt" onChange={handleFileUpload} />
-                </label>
-              </div>
-            )}
-            <Editor
-              height="100%"
-              language={inputFormat === 'EDI' ? 'edi' : 'json'}
-              value={inputPayload}
-              onChange={(value: string | undefined) => {
-                const text = value || '';
-                // Auto-detect if user pasted full JSON while in EDI mode
-                if (inputFormat === 'EDI' && text.trim().startsWith('{')) {
-                  try {
-                    JSON.parse(text);
-                    setInputFormat('JSON');
-                    setOutputFormat('EDI');
-                  } catch {
-                    // Not valid JSON yet, do nothing
-                  }
+          <EdiEditorPane
+            value={inputPayload}
+            onChange={(value) => {
+              // Auto-detect if user pasted full JSON while in EDI mode
+              if (inputFormat === 'EDI' && value.trim().startsWith('{')) {
+                try {
+                  JSON.parse(value);
+                  setInputFormat('JSON');
+                  setOutputFormat('EDI');
+                } catch {
+                  // Not valid JSON yet, do nothing
                 }
-                setInputPayload(text);
-              }}
-              theme="soopa-theme"
-              beforeMount={handleEditorWillMount}
-              options={{
-                minimap: { enabled: false },
-                scrollBeyondLastLine: false,
-                lineNumbersMinChars: 3,
-                wordWrap: 'on',
-                folding: true,
-                padding: { top: 16, bottom: 16 },
-                renderLineHighlight: 'none',
-                hideCursorInOverviewRuler: true,
-                overviewRulerBorder: false,
-                scrollbar: {
-                  verticalScrollbarSize: 8,
-                  horizontalScrollbarSize: 8,
-                },
-              }}
-            />
-          </div>
+              }
+              setInputPayload(value);
+            }}
+            language={inputFormat === 'EDI' ? 'edi' : 'json'}
+          />
         </div>
 
         {/* Right Pane (Output) */}
diff --git a/frontend/web/src/utils/monaco-edi.ts b/frontend/web/src/utils/monaco-edi.ts
new file mode 100644
index 00000000..d31a38b3
--- /dev/null
+++ b/frontend/web/src/utils/monaco-edi.ts
@@ -0,0 +1,32 @@
+export function registerEdiLanguageAndTheme(monaco: any) {
+  if (!monaco.languages.getLanguages().some((l: any) => l.id === 'edi')) {
+    monaco.languages.register({ id: 'edi' });
+    monaco.languages.setMonarchTokensProvider('edi', {
+      tokenizer: {
+        root: [
+          [/^[A-Z0-9]{2,3}(?=\*)/, 'keyword'],
+          [/(~\s*)([A-Z0-9]{2,3})(?=\*)/, ['delimiter', 'keyword']],
+          [/\*/, 'delimiter'],
+          [/~/, 'delimiter'],
+          [/[^*~\n\r]+/, 'string'],
+        ],
+      },
+    });
+  }
+  monaco.editor.defineTheme('soopa-theme', {
+    base: 'vs',
+    inherit: true,
+    rules: [
+      { token: 'keyword', foreground: '0451a5', fontStyle: 'bold' },
+      { token: 'string', foreground: '065f46' },
+      { token: 'delimiter', foreground: '000000' },
+      { token: 'string.key.json', foreground: '0451a5', fontStyle: 'bold' },
+      { token: 'string.value.json', foreground: '065f46' },
+      { token: 'number.json', foreground: '065f46' },
+      { token: 'keyword.json', foreground: '0451a5', fontStyle: 'bold' },
+    ],
+    colors: {
+      'editor.background': '#ffffff',
+    }
+  });
+}
diff --git a/libs/as2_core/src/as2_core/__init__.py b/libs/as2_core/src/as2_core/__init__.py
index 50ad9f80..c8f65318 100644
--- a/libs/as2_core/src/as2_core/__init__.py
+++ b/libs/as2_core/src/as2_core/__init__.py
@@ -4,7 +4,7 @@
 """
 
 from .builder import OutboundAS2Message, build_outbound_message
-from .mdn import Disposition, calculate_mic, generate_mdn
+from .mdn import Disposition, build_mdn, calculate_mic, generate_mdn
 from .message import AS2MDN, AS2Message
 from .parser import parse_as2_request, parse_mdn
 
@@ -16,6 +16,7 @@
     "parse_as2_request",
     "parse_mdn",
     "generate_mdn",
+    "build_mdn",
     "calculate_mic",
     "Disposition",
 ]
diff --git a/libs/as2_core/src/as2_core/builder.py b/libs/as2_core/src/as2_core/builder.py
index 9cc47ac2..426f78eb 100644
--- a/libs/as2_core/src/as2_core/builder.py
+++ b/libs/as2_core/src/as2_core/builder.py
@@ -17,6 +17,14 @@
 from .mdn import calculate_mic
 
 
+def _ensure_crlf(data: bytes) -> bytes:
+    """
+    Normalizes line endings to CRLF for MIME canonicalization, as required by
+    AS2/S/MIME signatures.
+    """
+    return data.replace(b"\r\n", b"\n").replace(b"\r", b"\n").replace(b"\n", b"\r\n")
+
+
 @dataclass
 class OutboundAS2Message:
     """
@@ -65,12 +73,27 @@ def build_outbound_message(
     Returns:
         OutboundAS2Message with body bytes and AS2 HTTP headers.
     """
-    # ── Step 1: Compute MIC on the *raw* payload before any wrapping ─────────
+    # ── Step 1: Normalize Payload Line Endings & Construct Inner Entity ───────
+    # AS2 requires CRLF line endings for signature calculation
+    payload = _ensure_crlf(payload)
+
+    if sign_fn is not None or encrypt_fn is not None:
+        # RFC 4130 specifies that the data to be signed/encrypted MUST be a fully
+        # formed MIME entity with its own Content-Type header.
+        mime_headers = f"Content-Type: {content_type}\r\n"
+        mime_headers += "Content-Transfer-Encoding: binary\r\n\r\n"
+        payload = mime_headers.encode("ascii") + payload
+
+    # ── Step 2: Compute MIC on the inner MIME entity ──────────────────────────
+    # The MIC is calculated over the entire MIME entity (including the headers
+    # prepended in Step 1) before signing or encryption, per RFC 4130.
     mic = calculate_mic(payload, mic_alg)
 
-    # ── Step 2: Optionally sign ───────────────────────────────────────────────
+    # ── Step 3: Optionally sign ───────────────────────────────────────────────
     current_payload = payload
     current_content_type = content_type
+    current_cte: str | None = None
+    current_cd: str | None = None
     is_signed = False
 
     if sign_fn is not None:
@@ -80,10 +103,14 @@ def build_outbound_message(
         msg = email.message_from_bytes(current_payload)
         signer_ct = msg.get("Content-Type")
         current_content_type = signer_ct or "multipart/signed"
+        if msg.get("Content-Transfer-Encoding"):
+            current_cte = msg.get("Content-Transfer-Encoding")
+        if msg.get("Content-Disposition"):
+            current_cd = msg.get("Content-Disposition")
 
         is_signed = True
 
-    # ── Step 3: Optionally encrypt ────────────────────────────────────────────
+    # ── Step 4: Optionally encrypt ────────────────────────────────────────────
     is_encrypted = False
     if encrypt_fn is not None:
         current_payload = encrypt_fn(current_payload)  # type: ignore[operator]
@@ -97,9 +124,14 @@ def build_outbound_message(
                 "application/pkcs7-mime; smime-type=enveloped-data; name=smime.p7m"
             )
 
+        if msg.get("Content-Transfer-Encoding"):
+            current_cte = msg.get("Content-Transfer-Encoding")
+        if msg.get("Content-Disposition"):
+            current_cd = msg.get("Content-Disposition")
+
         is_encrypted = True
 
-    # ── Step 4: Build HTTP Headers ────────────────────────────────────────────
+    # ── Step 5: Build HTTP Headers ────────────────────────────────────────────
     message_id = f"<{uuid.uuid4()}@soopaedi>"
     headers: dict[str, str] = {
         "AS2-Version": "1.2",
@@ -112,6 +144,11 @@ def build_outbound_message(
         "Disposition-Notification-Options": f"signed-receipt-protocol=required, pkcs7-signature; signed-receipt-micalg=optional, {mic_alg}",
     }
 
+    if current_cte:
+        headers["Content-Transfer-Encoding"] = current_cte
+    if current_cd:
+        headers["Content-Disposition"] = current_cd
+
     if mdn_url:
         # Async MDN: send back to this URL
         headers["Receipt-Delivery-Option"] = mdn_url
@@ -124,6 +161,20 @@ def build_outbound_message(
     if is_signed:
         security_note_parts.append("signed")
 
+    # ── Step 5: Strip Outer MIME Headers from Body ────────────────────────────
+    if is_encrypted or is_signed:
+        # RFC 5322 specifies \r\n\r\n (or \n\n) as the delimiter between headers and body.
+        # While it might be tempting to use Python's `email.message.Message.get_payload()`,
+        # doing so on a multipart/signed S/MIME payload causes the `email` module to
+        # reconstruct boundaries and standardize newlines, which silently invalidates
+        # the cryptographic signature.
+        # Performing a raw binary split is the enterprise-standard approach for AS2
+        # to guarantee 100% byte-for-byte preservation of the cryptographic payload.
+        if b"\r\n\r\n" in current_payload:
+            _, current_payload = current_payload.split(b"\r\n\r\n", 1)
+        elif b"\n\n" in current_payload:
+            _, current_payload = current_payload.split(b"\n\n", 1)
+
     return OutboundAS2Message(
         body=current_payload,
         headers=headers,
diff --git a/libs/as2_core/src/as2_core/mdn.py b/libs/as2_core/src/as2_core/mdn.py
index 71e6c359..c930c39a 100644
--- a/libs/as2_core/src/as2_core/mdn.py
+++ b/libs/as2_core/src/as2_core/mdn.py
@@ -4,7 +4,11 @@
 """
 
 import base64
+import email
 import hashlib
+import uuid
+from collections.abc import Callable
+from dataclasses import dataclass
 from enum import StrEnum
 
 from .message import AS2MDN, AS2Message
@@ -59,3 +63,82 @@ def generate_mdn(original_message: AS2Message, disposition: str, mic_alg: str =
         mic=mic,
         is_signed=False,  # Will be signed later if requested via disposition-notification-options
     )
+
+
+@dataclass
+class MDNResponse:
+    body: bytes
+    headers: dict[str, str]
+
+
+def build_mdn(
+    as2_to: str,
+    as2_from: str,
+    message_id: str,
+    disposition: str,
+    mic: str | None = None,
+    sign_fn: Callable[[bytes], bytes] | None = None,
+) -> MDNResponse:
+    boundary = f"----=_Part_{uuid.uuid4().hex}"
+
+    lines = []
+    lines.append(f"--{boundary}")
+    lines.append("Content-Type: text/plain; charset=us-ascii")
+    lines.append("Content-Transfer-Encoding: 7bit")
+    lines.append("")
+    lines.append("The AS2 message has been received successfully.")
+    lines.append("")
+    lines.append(f"--{boundary}")
+    lines.append("Content-Type: message/disposition-notification")
+    lines.append("Content-Transfer-Encoding: 7bit")
+    lines.append("")
+    lines.append("Reporting-UA: SoopaEDI")
+    lines.append(f"Original-Recipient: rfc822; {as2_to}")
+    lines.append(f"Final-Recipient: rfc822; {as2_to}")
+
+    # if message_id isn't wrapped in <>, wrap it, otherwise use it directly
+    message_id_str = f"<{message_id}>" if not message_id.startswith("<") else message_id
+
+    lines.append(f"Original-Message-ID: {message_id_str}")
+    lines.append(f"Disposition: {disposition}")
+    if mic:
+        lines.append(f"Received-Content-MIC: {mic}")
+    lines.append("")
+    lines.append(f"--{boundary}--")
+    lines.append("")
+
+    # Construct the inner multipart/report body and headers
+    inner_body = "\r\n".join(lines).encode("ascii")
+    inner_content_type = (
+        f'multipart/report; report-type=disposition-notification; boundary="{boundary}"'
+    )
+
+    headers = {
+        "AS2-From": as2_to,
+        "AS2-To": as2_from,
+        "Message-ID": f"<mdn-{uuid.uuid4()}@soopa>",
+        "Connection": "close",
+    }
+
+    if sign_fn:
+        # Wrap inner body into a proper MIME entity
+        mime_entity = f"Content-Type: {inner_content_type}\r\n"
+        mime_entity += "Content-Transfer-Encoding: binary\r\n\r\n"
+        wrapped_body = mime_entity.encode("ascii") + inner_body
+
+        signed_body = sign_fn(wrapped_body)
+
+        # Parse the signer's output to extract the correct Content-Type (which includes micalg and signature boundary)
+        msg = email.message_from_bytes(signed_body)
+        signer_ct = msg.get("Content-Type") or "multipart/signed"
+        headers["Content-Type"] = signer_ct
+
+        if msg.get("Content-Transfer-Encoding"):
+            headers["Content-Transfer-Encoding"] = str(msg.get("Content-Transfer-Encoding"))
+        if msg.get("Content-Disposition"):
+            headers["Content-Disposition"] = str(msg.get("Content-Disposition"))
+
+        return MDNResponse(body=signed_body, headers=headers)
+    else:
+        headers["Content-Type"] = inner_content_type
+        return MDNResponse(body=inner_body, headers=headers)
diff --git a/libs/as2_core/test_parse_smime.py b/libs/as2_core/test_parse_smime.py
new file mode 100644
index 00000000..4734e621
--- /dev/null
+++ b/libs/as2_core/test_parse_smime.py
@@ -0,0 +1,12 @@
+import email
+
+smime = b"""MIME-Version: 1.0
+Content-Disposition: attachment; filename="smime.p7m"
+Content-Type: application/pkcs7-mime; smime-type=enveloped-data; name="smime.p7m"
+Content-Transfer-Encoding: base64
+
+MIIBkwYJKoZIhvc=
+"""
+msg = email.message_from_bytes(smime)
+print("CT:", msg.get("Content-Type"))
+print("CTE:", msg.get("Content-Transfer-Encoding"))
diff --git a/libs/database/src/database/migrations/global/versions/142d93fd6c4c_global_initial_schema.py b/libs/database/src/database/migrations/global/versions/142d93fd6c4c_global_initial_schema.py
index 1f3cdcc8..6a4cb06e 100644
--- a/libs/database/src/database/migrations/global/versions/142d93fd6c4c_global_initial_schema.py
+++ b/libs/database/src/database/migrations/global/versions/142d93fd6c4c_global_initial_schema.py
@@ -185,7 +185,6 @@ def upgrade() -> None:
         sa.Column("mdn_url", sa.String(length=1024), nullable=True),
         sa.Column("encryption_algorithm", sa.String(length=50), nullable=False),
         sa.Column("signature_algorithm", sa.String(length=50), nullable=False),
-        sa.Column("edi_version", sa.String(length=50), nullable=True),
         sa.Column("advanced_flags", postgresql.JSONB(astext_type=sa.Text()), nullable=True),
         sa.Column("active", sa.Boolean(), nullable=False),
         sa.Column("created_at", sa.DateTime(), nullable=False),
diff --git a/libs/database/src/database/migrations/tenant/versions/34e9d4ab146a_tenant_initial_schema.py b/libs/database/src/database/migrations/tenant/versions/34e9d4ab146a_tenant_initial_schema.py
index 6a88984a..fed366dc 100644
--- a/libs/database/src/database/migrations/tenant/versions/34e9d4ab146a_tenant_initial_schema.py
+++ b/libs/database/src/database/migrations/tenant/versions/34e9d4ab146a_tenant_initial_schema.py
@@ -111,7 +111,7 @@ def upgrade() -> None:
         sa.Column("interchange_control_no", sa.String(length=255), nullable=True),
         sa.Column("transaction_type", sa.String(length=50), nullable=True),
         sa.Column("format_standard", sa.String(length=50), nullable=True),
-        sa.Column("edi_data", sa.String(length=1024), nullable=False),
+        sa.Column("edi_data", sa.Text(), nullable=False),
         sa.Column("file_size_bytes", sa.BigInteger(), nullable=True),
         sa.Column("status", sa.String(length=50), nullable=False),
         sa.Column("created_at", sa.DateTime(), nullable=False),
@@ -215,7 +215,6 @@ def upgrade() -> None:
         sa.Column("mdn_url", sa.String(length=1024), nullable=True),
         sa.Column("encryption_algorithm", sa.String(length=50), nullable=False),
         sa.Column("signature_algorithm", sa.String(length=50), nullable=False),
-        sa.Column("edi_version", sa.String(length=50), nullable=True),
         sa.Column("advanced_flags", postgresql.JSONB(astext_type=sa.Text()), nullable=True),
         sa.Column("active", sa.Boolean(), nullable=False),
         sa.Column("tenant_id", sa.Integer(), nullable=False),
diff --git a/libs/database/src/database/models/control_plane.py b/libs/database/src/database/models/control_plane.py
index 01d3c172..6ea874af 100644
--- a/libs/database/src/database/models/control_plane.py
+++ b/libs/database/src/database/models/control_plane.py
@@ -146,7 +146,6 @@ class AS2Partnership(GlobalBase):
     mdn_url: Mapped[str | None] = mapped_column(String(1024), nullable=True)
     encryption_algorithm: Mapped[str] = mapped_column(String(50), nullable=False, default="AES256")
     signature_algorithm: Mapped[str] = mapped_column(String(50), nullable=False, default="SHA256")
-    edi_version: Mapped[str | None] = mapped_column(String(50), nullable=True)
 
     # Advanced OpenAS2 settings
     advanced_flags: Mapped[dict[str, Any] | None] = mapped_column(JSONB, nullable=True)
diff --git a/libs/database/src/database/models/data_plane.py b/libs/database/src/database/models/data_plane.py
index efb78b62..c6164cef 100644
--- a/libs/database/src/database/models/data_plane.py
+++ b/libs/database/src/database/models/data_plane.py
@@ -16,10 +16,31 @@
 from sqlalchemy.dialects.postgresql import JSONB, UUID
 from sqlalchemy.orm import DeclarativeBase, Mapped, declared_attr, mapped_column
 from sqlalchemy.sql import func, text
+from sqlalchemy.types import TypeDecorator
 
 from .common import OutboxMixin
 
 
+class SanitizedText(TypeDecorator):  # type: ignore
+    """
+    Enterprise-grade Text type that enforces PostgreSQL compliance
+    by automatically stripping NUL bytes (\\x00) and safely decoding
+    bytes with errors='replace'.
+    """
+
+    impl = Text
+    cache_ok = True
+
+    def process_bind_param(self, value, dialect):  # type: ignore
+        if value is None:
+            return value
+        if isinstance(value, bytes):
+            return value.replace(b"\x00", b"").decode("utf-8", errors="replace")
+        elif not isinstance(value, str):
+            value = str(value)
+        return value.replace("\x00", "")
+
+
 class TenantBase(DeclarativeBase):
     pass
 
@@ -83,7 +104,6 @@ class AS2Partnership(TenantBase, TenantAwareMixin):
     mdn_url: Mapped[str | None] = mapped_column(String(1024), nullable=True)
     encryption_algorithm: Mapped[str] = mapped_column(String(50), nullable=False, default="AES256")
     signature_algorithm: Mapped[str] = mapped_column(String(50), nullable=False, default="SHA256")
-    edi_version: Mapped[str | None] = mapped_column(String(50), nullable=True)
 
     advanced_flags: Mapped[dict[str, Any] | None] = mapped_column(JSONB, nullable=True)
 
@@ -238,7 +258,7 @@ class EdiMessage(TenantBase, TenantAwareMixin):
     transaction_type: Mapped[str | None] = mapped_column(String(50), nullable=True)
     format_standard: Mapped[str | None] = mapped_column(String(50), nullable=True)
 
-    edi_data: Mapped[str] = mapped_column(String(1024), nullable=False)
+    edi_data: Mapped[str] = mapped_column(SanitizedText, nullable=False)
     file_size_bytes: Mapped[int | None] = mapped_column(BigInteger, nullable=True)
 
     status: Mapped[str] = mapped_column(String(50), nullable=False, default="RECEIVED")
diff --git a/libs/database/src/database/repository.py b/libs/database/src/database/repository.py
index 592ced07..e92d9bb6 100644
--- a/libs/database/src/database/repository.py
+++ b/libs/database/src/database/repository.py
@@ -1,3 +1,4 @@
+from typing import Any
 from uuid import UUID
 
 from sqlalchemy import select
@@ -23,6 +24,42 @@ async def find_by_as2_id(self, tenant_id: int, as2_id: str) -> AS2Partner | None
         return result.scalar_one_or_none()
 
 
+class PartnershipRepository:
+    def __init__(self, session: AsyncSession):
+        self.session = session
+
+    async def get_partnership_by_as2_ids(
+        self, as2_from: str, as2_to: str
+    ) -> tuple[Any, Any, Any] | None:
+        from sqlalchemy import func
+        from sqlalchemy.orm import aliased
+
+        from .models.control_plane import AS2Partnership
+
+        LocalPartner = aliased(AS2Partner)
+        RemotePartner = aliased(AS2Partner)
+
+        stmt = (
+            select(AS2Partnership, LocalPartner, RemotePartner)
+            .join(LocalPartner, AS2Partnership.local_partner_id == LocalPartner.id)
+            .join(RemotePartner, AS2Partnership.remote_partner_id == RemotePartner.id)
+            .where(
+                func.lower(LocalPartner.as2_id) == as2_to.lower(),
+                func.lower(RemotePartner.as2_id) == as2_from.lower(),
+                AS2Partnership.active.is_(True),
+                LocalPartner.active.is_(True),
+                RemotePartner.active.is_(True),
+            )
+        )
+
+        result = await self.session.execute(stmt)
+        row = result.first()
+        if not row:
+            return None
+
+        return row[0], row[1], row[2]
+
+
 class EdiMessageRepository:
     def __init__(self, session: AsyncSession):
         self.session = session
diff --git a/libs/database/tests/test_encryption.py b/libs/database/tests/test_encryption.py
new file mode 100644
index 00000000..2d6f3e98
--- /dev/null
+++ b/libs/database/tests/test_encryption.py
@@ -0,0 +1,70 @@
+import os
+from unittest import mock
+
+import pytest
+from cryptography.fernet import Fernet, InvalidToken
+from database.encryption import DBEncryptionAdapter
+
+
+@pytest.fixture
+def adapter():
+    return DBEncryptionAdapter()
+
+
+def test_fernet_initialization_with_key(adapter):
+    key = Fernet.generate_key().decode("utf-8")
+    with mock.patch.dict(os.environ, {"DB_ENCRYPTION_KEY": key}):
+        fernet = adapter.fernet
+        assert fernet is not None
+        assert adapter._initialized is True
+
+
+def test_fernet_initialization_without_key(adapter):
+    with mock.patch.dict(os.environ, {}, clear=True):
+        fernet = adapter.fernet
+        assert fernet is None
+        assert adapter._initialized is False
+
+
+def test_fernet_initialization_with_invalid_key(adapter):
+    with mock.patch.dict(os.environ, {"DB_ENCRYPTION_KEY": "invalid_key"}):
+        fernet = adapter.fernet
+        assert fernet is None
+        assert adapter._initialized is False
+
+
+def test_encrypt_decrypt_success(adapter):
+    key = Fernet.generate_key().decode("utf-8")
+    with mock.patch.dict(os.environ, {"DB_ENCRYPTION_KEY": key}):
+        # Trigger initialization
+        assert adapter.fernet is not None
+        original_data = "sensitive_secret"
+        encrypted = adapter.encrypt(original_data)
+        assert encrypted != original_data
+        decrypted = adapter.decrypt(encrypted)
+        assert decrypted == original_data
+
+
+def test_encrypt_without_key_raises_error(adapter):
+    with mock.patch.dict(os.environ, {}, clear=True):
+        # Trigger initialization attempt
+        _ = adapter.fernet
+        with pytest.raises(RuntimeError, match="DB_ENCRYPTION_KEY not configured"):
+            adapter.encrypt("data")
+
+
+def test_decrypt_without_key_raises_error(adapter):
+    with mock.patch.dict(os.environ, {}, clear=True):
+        # Trigger initialization attempt
+        _ = adapter.fernet
+        with pytest.raises(RuntimeError, match="DB_ENCRYPTION_KEY not configured"):
+            adapter.decrypt("token")
+
+
+def test_decrypt_with_invalid_token(adapter):
+    key = Fernet.generate_key().decode("utf-8")
+    with mock.patch.dict(os.environ, {"DB_ENCRYPTION_KEY": key}):
+        # Trigger initialization
+        assert adapter.fernet is not None
+        with pytest.raises(InvalidToken):
+            adapter.decrypt("invalid_token_format")
diff --git a/libs/patches/src/patches/cryptography.py b/libs/patches/src/patches/cryptography.py
new file mode 100644
index 00000000..a16d9b12
--- /dev/null
+++ b/libs/patches/src/patches/cryptography.py
@@ -0,0 +1,52 @@
+"""
+Monkey-patch for cryptography
+
+Context
+-------
+The `cryptography` library explicitly restricts PKCS#7 / S/MIME EnvelopedData
+encryption to AES128 and AES256 due to security deprecations of 3DES.
+However, in B2B AS2 integrations, 3DES remains a mandatory legacy requirement
+for interoperability with older Remote Trading Partners.
+
+This patch bypasses the Python-level type check inside `set_content_encryption_algorithm`.
+The underlying Rust/C bindings actually still support TripleDES, so removing the
+Python type restriction is all that's required to restore functionality.
+
+Upstream logic: https://github.com/pyca/cryptography/blob/main/src/cryptography/hazmat/primitives/serialization/pkcs7.py
+"""
+
+import logging
+
+from cryptography.hazmat.primitives.serialization import pkcs7
+
+logger = logging.getLogger(__name__)
+
+_PATCH_APPLIED = False
+
+
+def apply_legacy_3des_support() -> None:
+    """
+    Restore 3DES support to PKCS7EnvelopeBuilder.
+    This function is idempotent — calling it multiple times is safe.
+    """
+    global _PATCH_APPLIED
+    if _PATCH_APPLIED:
+        return
+
+    def _patched_set_content_encryption_algorithm(self, algorithm):  # type: ignore
+        # We completely bypass the strict type check to allow TripleDES (and others)
+        # to pass down to the native Rust backend, which still supports it.
+        self._algorithm = algorithm
+        return self
+
+    pkcs7.PKCS7EnvelopeBuilder.set_content_encryption_algorithm = (  # type: ignore
+        _patched_set_content_encryption_algorithm
+    )
+
+    _PATCH_APPLIED = True
+    logger.debug("cryptography: legacy 3DES PKCS7 envelope support enabled")
+
+
+# Apply automatically on import so callers can simply do:
+#   import patches.cryptography
+apply_legacy_3des_support()
diff --git a/libs/security/pyproject.toml b/libs/security/pyproject.toml
index af3b72ef..bdd83b67 100644
--- a/libs/security/pyproject.toml
+++ b/libs/security/pyproject.toml
@@ -7,6 +7,7 @@ authors = [
 ]
 requires-python = ">=3.11"
 dependencies = [
+    "asn1crypto>=1.5.1",
     "cryptography>=44.0.0",
     "pyopenssl>=26.3.0",
 ]
diff --git a/libs/security/src/security/smime.py b/libs/security/src/security/smime.py
index 91c43722..3a7df092 100644
--- a/libs/security/src/security/smime.py
+++ b/libs/security/src/security/smime.py
@@ -6,15 +6,104 @@
 No private keys or payloads are ever written to disk.
 """
 
-import os
-import subprocess
-import tempfile
+import contextlib
+import email
+import logging
+import re
+from email import policy
 
+import patches.cryptography  # noqa: F401 - applies legacy 3DES patch
 from cryptography import x509
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.ciphers import algorithms
 from cryptography.hazmat.primitives.serialization import pkcs7
 
+logger = logging.getLogger(__name__)
+
+
+def _manual_asn1crypto_decrypt(encrypted_data: bytes, private_key) -> bytes | None:  # type: ignore
+    """
+    Ultimate pure-Python native fallback for BouncyCastle BER envelopes.
+    Bypasses cryptography's strict Rust PKCS7 parser entirely by manually
+    extracting the symmetric key and decrypting the payload using raw primitives.
+    """
+    from asn1crypto import cms, pem  # type: ignore
+    from cryptography.hazmat.primitives.asymmetric import padding
+    from cryptography.hazmat.primitives.ciphers import Cipher, modes
+
+    content_info = None
+
+    # 1. Try raw bytes (BER/DER)
+    with contextlib.suppress(Exception):
+        content_info = cms.ContentInfo.load(encrypted_data)
+
+    # 2. Try S/MIME payload extraction
+    if not content_info:
+        try:
+            msg = email.message_from_bytes(encrypted_data, policy=policy.HTTP)
+            pl = msg.get_payload(decode=True)
+            if pl:
+                content_info = cms.ContentInfo.load(pl)
+        except Exception:
+            pass
+
+    # 3. Try PEM unarmoring
+    if not content_info:
+        try:
+            _, _, der_bytes = pem.unarmor(encrypted_data)
+            content_info = cms.ContentInfo.load(der_bytes)
+        except Exception:
+            pass
+
+    try:
+        if not content_info:
+            raise ValueError(
+                "asn1crypto could not parse the payload in any format. Is the binary corrupted?"
+            )
+
+        if content_info["content_type"].native != "enveloped_data":
+            raise ValueError(f"Expected enveloped_data, got {content_info['content_type'].native}")
+
+        enveloped_data = content_info["content"]
+        recipient_infos = enveloped_data["recipient_infos"]
+
+        # Extract the RSA encrypted key
+        ktri = recipient_infos[0].chosen
+        encrypted_key = ktri["encrypted_key"].native
+
+        # Decrypt symmetric key using RSA Private Key
+        symmetric_key = private_key.decrypt(
+            encrypted_key,
+            padding.PKCS1v15(),  # AS2 PKCS7 always uses PKCS1.5 padding for key transport
+        )
+
+        # Get Encrypted Content
+        eci = enveloped_data["encrypted_content_info"]
+        content_enc_alg = eci["content_encryption_algorithm"]
+        alg_oid = content_enc_alg["algorithm"].native
+        iv = content_enc_alg["parameters"].native
+        ciphertext = eci["encrypted_content"].native
+
+        # Map OID to Cipher
+        cipher_class = _ASN1_OID_TO_CIPHER_REGISTRY.get(alg_oid)
+        if not cipher_class:
+            raise ValueError(f"Unsupported manual cipher OID: {alg_oid}")
+
+        cipher = Cipher(cipher_class(symmetric_key), modes.CBC(iv))
+        decryptor = cipher.decryptor()
+        padded_plaintext = decryptor.update(ciphertext) + decryptor.finalize()
+
+        # Remove PKCS7 padding
+        pad_len = padded_plaintext[-1]
+        if pad_len < 1 or pad_len > cipher_class.block_size // 8:  # type: ignore[operator]
+            raise ValueError("Invalid PKCS7 padding length")
+        if padded_plaintext[-pad_len:] != bytes([pad_len]) * pad_len:
+            raise ValueError("Invalid PKCS7 padding bytes")
+        return padded_plaintext[:-pad_len]
+    except Exception as e:
+        logger.debug(f"Manual ASN.1 decryption failed: {e}")
+        return None
+
 
 def decrypt_payload(encrypted_data: bytes, private_key_pem: bytes, public_cert_pem: bytes) -> bytes:
     """
@@ -24,10 +113,34 @@ def decrypt_payload(encrypted_data: bytes, private_key_pem: bytes, public_cert_p
     private_key = serialization.load_pem_private_key(private_key_pem, password=None)
     cert = x509.load_pem_x509_certificate(public_cert_pem)
 
-    return pkcs7.pkcs7_decrypt_smime(encrypted_data, cert, private_key, options=[])  # type: ignore[arg-type]
+    strategies = [
+        ("DER", pkcs7.pkcs7_decrypt_der),
+        ("SMIME", pkcs7.pkcs7_decrypt_smime),
+        ("PEM", pkcs7.pkcs7_decrypt_pem),
+    ]
 
+    for strat_name, strat_func in strategies:
+        try:
+            return strat_func(encrypted_data, cert, private_key, options=[])  # type: ignore[arg-type]
+        except Exception as e:
+            logger.debug(f"{strat_name} decryption failed: {e}")
+
+    # Enterprise Fallback: Manually parse the ASN.1 tree and decrypt using primitives
+    # This completely eliminates the need for OpenSSL shell commands, bypassing Rust strictness.
+    try:
+        manual_decrypted = _manual_asn1crypto_decrypt(encrypted_data, private_key)
+        if manual_decrypted:
+            logger.info("Successfully decrypted payload using pure Python ASN.1 manual primitives.")
+            return manual_decrypted
+    except Exception as e:
+        logger.debug(f"Manual fallback decryption failed: {e}")
 
-def sign_payload(payload: bytes, private_key_pem: bytes, public_cert_pem: bytes) -> bytes:
+    raise ValueError("All native decryption strategies failed.")
+
+
+def sign_payload(
+    payload: bytes, private_key_pem: bytes, public_cert_pem: bytes, algorithm: str = "sha256"
+) -> bytes:
     """
     Signs a payload for AS2 transmission (S/MIME multipart/signed).
     Uses native cryptography.hazmat to keep private keys in memory.
@@ -35,13 +148,58 @@ def sign_payload(payload: bytes, private_key_pem: bytes, public_cert_pem: bytes)
     private_key = serialization.load_pem_private_key(private_key_pem, password=None)
     cert = x509.load_pem_x509_certificate(public_cert_pem)
 
+    alg_map = {
+        "sha1": hashes.SHA1(),
+        "sha256": hashes.SHA256(),
+        "sha384": hashes.SHA384(),
+        "sha512": hashes.SHA512(),
+    }
+    alg_key = algorithm.lower()
+    if alg_key not in alg_map:
+        raise ValueError(f"Unsupported signature algorithm: {algorithm}")
+    hash_alg = alg_map[alg_key]
+
     builder = pkcs7.PKCS7SignatureBuilder().set_data(payload)
-    builder = builder.add_signer(cert, private_key, hash_algorithm=hashes.SHA256())  # type: ignore[arg-type]
+    builder = builder.add_signer(cert, private_key, hash_algorithm=hash_alg)  # type: ignore[arg-type]
 
     # AS2 requires S/MIME encoding for the signed payload
     return builder.sign(serialization.Encoding.SMIME, options=[])
 
 
+# Supported ciphers registry for S/MIME encryption
+_CIPHER_REGISTRY = {
+    "AES256": algorithms.AES256,
+    "AES-256": algorithms.AES256,
+    "AES256_CBC": algorithms.AES256,
+    "AES128": algorithms.AES128,
+    "AES-128": algorithms.AES128,
+    "AES128_CBC": algorithms.AES128,
+}
+
+# ASN.1 OID to cryptography primitive mapping for native decryption
+_ASN1_OID_TO_CIPHER_REGISTRY = {
+    "aes256_cbc": algorithms.AES256,
+    "aes128_cbc": algorithms.AES128,
+}
+
+try:
+    from cryptography.hazmat.decrepit.ciphers.algorithms import TripleDES
+
+    _CIPHER_REGISTRY.update({"3DES": TripleDES, "DES3": TripleDES, "TRIPLEDES": TripleDES})  # type: ignore
+    _ASN1_OID_TO_CIPHER_REGISTRY.update({"des_ede3_cbc": TripleDES, "tripledes_3key": TripleDES})  # type: ignore
+except ImportError:
+    _CIPHER_REGISTRY.update(
+        {
+            "3DES": algorithms.TripleDES,  # type: ignore
+            "DES3": algorithms.TripleDES,  # type: ignore
+            "TRIPLEDES": algorithms.TripleDES,  # type: ignore
+        }
+    )
+    _ASN1_OID_TO_CIPHER_REGISTRY.update(
+        {"des_ede3_cbc": algorithms.TripleDES, "tripledes_3key": algorithms.TripleDES}  # type: ignore
+    )
+
+
 def encrypt_payload(
     payload: bytes,
     public_cert_pem: bytes,
@@ -50,63 +208,142 @@ def encrypt_payload(
     """
     Encrypts a payload for AS2 transmission using S/MIME CMS enveloped data.
     Uses PKCS7EnvelopeBuilder — fully native, in-memory, zero subprocess.
-
-    Args:
-        payload: The raw EDI or content bytes to encrypt.
-        public_cert_pem: The Trading Partner's public certificate in PEM format.
-        algorithm: The symmetric cipher algorithm (AES256 or AES128).
-
-    Returns:
-        S/MIME-encoded enveloped bytes ready for transmission.
     """
     cert = x509.load_pem_x509_certificate(public_cert_pem)
 
-    if algorithm.upper() in ("AES256", "AES-256", "AES256_CBC"):
-        cipher: type[algorithms.AES128] | type[algorithms.AES256] = algorithms.AES256
-    elif algorithm.upper() in ("AES128", "AES-128", "AES128_CBC"):
-        cipher = algorithms.AES128
-    else:
-        raise ValueError(f"Unsupported encryption algorithm: {algorithm!r}. Use AES256 or AES128.")
+    cipher_class = _CIPHER_REGISTRY.get(algorithm.upper())
+    if not cipher_class:
+        raise ValueError(
+            f"Unsupported encryption algorithm: {algorithm!r}. Supported: {list(_CIPHER_REGISTRY.keys())}"
+        )
 
     return (
         pkcs7.PKCS7EnvelopeBuilder()
         .set_data(payload)
         .add_recipient(cert)
-        .set_content_encryption_algorithm(cipher)
+        .set_content_encryption_algorithm(cipher_class)  # type: ignore
         .encrypt(serialization.Encoding.SMIME, options=[])
     )
 
 
-def verify_signature(signed_data: bytes, public_cert_pem: bytes) -> tuple[bool, bytes]:
+# ---------------------------------------------------------------------------
+# Native Signature Verification Core Logic
+# ---------------------------------------------------------------------------
+
+
+def _extract_smime_signature_parts(signed_data: bytes) -> tuple[bytes, bytes]:
     """
-    Verifies an S/MIME detached or attached signature.
-    Since native cryptography does not yet support signature verification,
-    we use OpenSSL via subprocess.
-    Public certificates are safely written to a temp file, and payload is piped via stdin.
+    Safely extracts the raw payload and the binary signature from an S/MIME multipart.
+    Returns (raw_signed_content, binary_signature).
     """
-    with tempfile.NamedTemporaryFile(delete=False) as cert_file:
-        cert_file.write(public_cert_pem)
-        cert_file.flush()
+    msg = email.message_from_bytes(signed_data, policy=policy.default)
+    boundary = msg.get_boundary()
+    if not boundary:
+        raise ValueError("Not a valid multipart/signed entity (missing boundary)")
+
+    boundary_bytes = b"--" + boundary.encode("ascii")
+    pattern = re.compile(b"(?:\r\n|\n)" + re.escape(boundary_bytes) + b"(?:\r\n|\n|--)")
+    parts = pattern.split(signed_data)
+
+    if len(parts) < 3:
+        raise ValueError("Invalid S/MIME structure (could not split boundary)")
+
+    raw_signed_content = parts[1]
+    sig_part_raw = parts[2]
+
+    sig_msg = email.message_from_bytes(sig_part_raw, policy=policy.default)
+    binary_sig = sig_msg.get_payload(decode=True)
+    if not binary_sig:
+        # Fallback if it's not base64 or quoted-printable
+        binary_sig = sig_msg.get_payload().encode("utf-8")  # type: ignore
+
+    return raw_signed_content, binary_sig  # type: ignore
 
+
+def _inject_certificate_into_cms(binary_sig: bytes, cert_bytes: bytes) -> bytes:
+    """
+    Forces our trusted public certificate into the ASN.1 CMS bag.
+    This guarantees verification succeeds even if the sender omitted their cert.
+    """
     try:
-        result = subprocess.run(
-            [
-                "openssl",
-                "smime",
-                "-verify",
-                "-certfile",
-                cert_file.name,
-                "-noverify",  # AS2 often uses self-signed, trust is handled at the DB level
-                "-inform",
-                "SMIME",
-            ],
-            input=signed_data,
-            capture_output=True,
-            check=True,
-            timeout=10.0,
+        from asn1crypto import cms, pem, x509
+
+        content_info = cms.ContentInfo.load(binary_sig)
+        signed_data_cms = content_info["content"]
+
+        c_bytes = cert_bytes if b"BEGIN" not in cert_bytes else pem.unarmor(cert_bytes)[2]
+        parsed_cert = x509.Certificate.load(c_bytes)
+        choice = cms.CertificateChoices(name="certificate", value=parsed_cert)
+
+        if not signed_data_cms["certificates"]:
+            signed_data_cms["certificates"] = [choice]
+        else:
+            existing_serials = [
+                c.chosen.serial_number
+                for c in signed_data_cms["certificates"]
+                if c.name == "certificate"
+            ]
+            if parsed_cert.serial_number not in existing_serials:
+                signed_data_cms["certificates"].append(choice)
+
+        return content_info.dump()  # type: ignore
+    except Exception as e:
+        logger.debug(f"Failed to inject certificate into CMS: {e}")
+        return binary_sig
+
+
+def _execute_endesive_verification(
+    binary_sig: bytes, raw_signed_content: bytes, cert_bytes: bytes
+) -> bool:
+    """
+    Executes the actual cryptographic verification using endesive.
+    Safely captures stdout to suppress CA error noise and catches deprecation warnings.
+    """
+    import contextlib
+    import io
+    import warnings
+
+    import endesive.verifier  # type: ignore
+    from cryptography.utils import CryptographyDeprecationWarning
+
+    with warnings.catch_warnings():
+        warnings.simplefilter("ignore", category=CryptographyDeprecationWarning)
+        with contextlib.redirect_stdout(io.StringIO()):
+            hashok, sigok, certok = endesive.verifier.verify(
+                binary_sig, raw_signed_content, [cert_bytes]
+            )
+
+    if not (hashok and sigok):
+        raise ValueError(f"Hash Match: {hashok}, Signature Match: {sigok}")
+
+    return True
+
+
+def verify_signature(
+    signed_data: bytes,
+    public_cert_pem: str | bytes,
+) -> tuple[bool, bytes]:
+    """
+    Verifies an S/MIME signature (multipart/signed) natively using endesive.
+    Returns a tuple of (is_valid, verified_payload).
+    """
+    try:
+        # 1. Extract bytes
+        raw_signed_content, binary_sig = _extract_smime_signature_parts(signed_data)
+
+        # 2. Prepare certificate
+        cert_bytes = (
+            public_cert_pem
+            if isinstance(public_cert_pem, bytes)
+            else public_cert_pem.encode("utf-8")
         )
-        return True, result.stdout
-    except (subprocess.CalledProcessError, subprocess.TimeoutExpired):
-        return False, b""
-    finally:
-        os.unlink(cert_file.name)
+
+        # 3. Inject certificate into ASN.1 structure to prevent crashes
+        binary_sig = _inject_certificate_into_cms(binary_sig, cert_bytes)
+
+        # 4. Mathematically verify
+        is_valid = _execute_endesive_verification(binary_sig, raw_signed_content, cert_bytes)
+
+        return is_valid, raw_signed_content
+    except Exception as e:
+        raise ValueError(f"Native Signature Verify Error: {e}") from e
diff --git a/libs/security/tests/test_smime.py b/libs/security/tests/test_smime.py
new file mode 100644
index 00000000..69250db9
--- /dev/null
+++ b/libs/security/tests/test_smime.py
@@ -0,0 +1,81 @@
+import datetime
+
+from cryptography import x509
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.x509.oid import NameOID
+from security.smime import decrypt_payload, encrypt_payload, sign_payload
+
+
+def test_encrypt_decrypt_smime():
+    # 1. Generate keys
+    private_key = rsa.generate_private_key(
+        public_exponent=65537, key_size=2048, backend=default_backend()
+    )
+    public_key = private_key.public_key()
+    subject = issuer = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "test")])
+    cert = (
+        x509.CertificateBuilder()
+        .subject_name(subject)
+        .issuer_name(issuer)
+        .public_key(public_key)
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(datetime.datetime.now(datetime.UTC))
+        .not_valid_after(datetime.datetime.now(datetime.UTC) + datetime.timedelta(days=10))
+        .sign(private_key, hashes.SHA256(), default_backend())
+    )
+
+    private_pem = private_key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption(),
+    )
+    cert_pem = cert.public_bytes(serialization.Encoding.PEM)
+
+    payload = b"test EDI payload data"
+
+    # 2. Encrypt
+    encrypted_data = encrypt_payload(payload, cert_pem, "AES256")
+
+    # 3. Decrypt
+    decrypted = decrypt_payload(encrypted_data, private_pem, cert_pem)
+
+    assert payload in decrypted
+
+
+def test_sign_verify_smime():
+    private_key = rsa.generate_private_key(
+        public_exponent=65537, key_size=2048, backend=default_backend()
+    )
+    public_key = private_key.public_key()
+    subject = issuer = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "test")])
+    cert = (
+        x509.CertificateBuilder()
+        .subject_name(subject)
+        .issuer_name(issuer)
+        .public_key(public_key)
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(datetime.datetime.now(datetime.UTC))
+        .not_valid_after(datetime.datetime.now(datetime.UTC) + datetime.timedelta(days=10))
+        .sign(private_key, hashes.SHA256(), default_backend())
+    )
+
+    private_pem = private_key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption(),
+    )
+    cert_pem = cert.public_bytes(serialization.Encoding.PEM)
+
+    payload = b"test EDI payload data to be signed"
+
+    signed_data = sign_payload(payload, private_pem, cert_pem)
+
+    assert b"test EDI payload data to be signed" in signed_data
+
+    from security.smime import verify_signature
+
+    is_valid, verified_payload = verify_signature(signed_data, cert_pem)
+    assert is_valid is True
+    assert verified_payload == payload
diff --git a/libs/security/tests/test_smime_verify.py b/libs/security/tests/test_smime_verify.py
new file mode 100644
index 00000000..721d680e
--- /dev/null
+++ b/libs/security/tests/test_smime_verify.py
@@ -0,0 +1,62 @@
+import datetime
+
+import endesive.signer
+from cryptography import x509
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.x509.oid import NameOID
+from security.smime import verify_signature
+
+
+def test_verify_signature_native_endesive():
+    private_key = rsa.generate_private_key(
+        public_exponent=65537, key_size=2048, backend=default_backend()
+    )
+    public_key = private_key.public_key()
+
+    subject = issuer = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "soopaedi test")])
+
+    cert = (
+        x509.CertificateBuilder()
+        .subject_name(subject)
+        .issuer_name(issuer)
+        .public_key(public_key)
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(datetime.datetime.now(datetime.UTC))
+        .not_valid_after(datetime.datetime.now(datetime.UTC) + datetime.timedelta(days=10))
+        .sign(private_key, hashes.SHA256(), default_backend())
+    )
+
+    cert_pem = cert.public_bytes(serialization.Encoding.PEM)
+
+    raw_payload = (
+        b"Content-Type: text/plain\r\n\r\nHello World! This is a simple English sentence payload."
+    )
+
+    datas = endesive.signer.sign(raw_payload, private_key, cert, [], "sha256")
+
+    boundary = b"----Boundary_Test_12345"
+
+    entity = (
+        b'Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="'
+        + boundary[4:]
+        + b'"\r\n'
+        b"\r\n"
+        b"--" + boundary[4:] + b"\r\n" + raw_payload + b"\r\n"
+        b"--" + boundary[4:] + b"\r\n"
+        b'Content-Type: application/pkcs7-signature; name="smime.p7s"\r\n'
+        b"Content-Transfer-Encoding: binary\r\n"
+        b'Content-Disposition: attachment; filename="smime.p7s"\r\n'
+        b"\r\n" + datas + b"\r\n"
+        b"--" + boundary[4:] + b"--\r\n"
+    )
+
+    is_valid, extracted_payload = verify_signature(entity, cert_pem)
+
+    assert is_valid is True
+    assert extracted_payload == raw_payload
+
+
+if __name__ == "__main__":
+    test_verify_signature_native_endesive()
diff --git a/pyproject.toml b/pyproject.toml
index 6650165b..cfccc966 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -8,6 +8,7 @@ authors = [
 requires-python = ">=3.11"
 dependencies = [
     "cryptography>=49.0.0",
+    "endesive>=2.19.3",
 ]
 
 [tool.uv.workspace]
diff --git a/scratch/test_email.py b/scratch/test_email.py
new file mode 100644
index 00000000..fa5817e3
--- /dev/null
+++ b/scratch/test_email.py
@@ -0,0 +1,13 @@
+import email
+from email import policy
+
+boundary = b"----Boundary_Test_12345"
+entity = (
+    b'Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="'
+    + boundary[4:]
+    + b'"\r\n'
+    b"\r\n"
+)
+msg = email.message_from_bytes(entity, policy=policy.HTTP)
+print(msg.get_boundary())
+print(msg.items())
diff --git a/scripts/build_frontend_dictionary.py b/scripts/build_frontend_dictionary.py
index a862984d..4e6fc0f7 100644
--- a/scripts/build_frontend_dictionary.py
+++ b/scripts/build_frontend_dictionary.py
@@ -3,7 +3,7 @@
 import xml.etree.ElementTree as ET
 
 
-def build_dictionary():
+def build_dictionary() -> None:
     xml_path = "libs/edi_grammar/src/edi_grammar/x12/5011/X12.Segment"
     output_path = "frontend/web/public/edidescription/x12_5011.json"
 
diff --git a/scripts/build_registry.py b/scripts/build_registry.py
index fa6caeb2..a3b4d8ef 100644
--- a/scripts/build_registry.py
+++ b/scripts/build_registry.py
@@ -1,7 +1,7 @@
 from pathlib import Path
 
 
-def build_registry():
+def build_registry() -> None:
     base_dir = Path(__file__).parent.parent / "libs" / "edi_grammar" / "src" / "edi_grammar"
     registry = {}
 
diff --git a/services/api/src/api/adapters/http/dtos.py b/services/api/src/api/adapters/http/dtos.py
index 9710ee88..958b30a8 100644
--- a/services/api/src/api/adapters/http/dtos.py
+++ b/services/api/src/api/adapters/http/dtos.py
@@ -33,9 +33,6 @@ class CreateAS2PartnershipRequest(BaseModel):
     mdn_url: HttpUrl | None = Field(None, description="MDN URL for ASYNC")
     encryption_algorithm: str = Field("AES256", max_length=50, description="Encryption Algorithm")
     signature_algorithm: str = Field("SHA256", max_length=50, description="Signature Algorithm")
-    edi_version: Literal["X12-004010", "X12-005010", "EDIFACT-D96A", "EDIFACT-D01B"] | None = Field(
-        None, description="EDI Version (e.g. X12 5010)"
-    )
     advanced_flags: dict[str, Any] | None = Field(None, description="Advanced OpenAS2 JSON flags")
 
 
@@ -76,6 +73,18 @@ class TestConnectionResponse(BaseModel):
     reason: str | None = None
 
 
+class TestAS2ConnectionRequest(BaseModel):
+    custom_payload: str | None = Field(None, description="Optional custom EDI payload to send")
+
+
+class TestAS2ConnectionResponse(BaseModel):
+    success: bool
+    mdn_disposition: str | None = None
+    reason: str | None = None
+    sent_payload: str | None = None
+    raw_mdn: str | None = None
+
+
 class CreateWebhookRequest(BaseModel):
     name: str = Field(..., max_length=255, description="Name of the Webhook partner")
     url: HttpUrl = Field(..., description="Webhook endpoint URL")
@@ -112,9 +121,6 @@ class UpdateAS2PartnershipRequest(BaseModel):
     mdn_url: HttpUrl | None = Field(None)
     encryption_algorithm: str | None = Field(None, max_length=50)
     signature_algorithm: str | None = Field(None, max_length=50)
-    edi_version: (
-        Literal["X12-004010", "X12-005010", "EDIFACT-D96A", "EDIFACT-D01B", "NONE"] | None
-    ) = Field(None)
     advanced_flags: dict[str, Any] | None = Field(None)
     active: bool | None = Field(None)
 
@@ -280,7 +286,7 @@ class AS2PartnershipResponse(BaseModel):
     mdn_url: str | None = None
     encryption_algorithm: str
     signature_algorithm: str
-    edi_version: str | None = None
+
     status: str
     active: bool = False
 
diff --git a/services/api/src/api/adapters/httpx_as2_tester.py b/services/api/src/api/adapters/httpx_as2_tester.py
new file mode 100644
index 00000000..d877d4d8
--- /dev/null
+++ b/services/api/src/api/adapters/httpx_as2_tester.py
@@ -0,0 +1,127 @@
+"""
+Httpx-based AS2 connection tester adapter.
+
+Sends a minimal synthetic X12 ISA envelope to the partner's AS2 URL,
+then parses the synchronous MDN response. Used exclusively for the
+"Test AS2 Partnership" support tool; never called in the production pipeline.
+"""
+
+import functools
+import logging
+
+import httpx
+from as2_core import build_outbound_message, parse_mdn
+from security import encrypt_payload, sign_payload
+
+logger = logging.getLogger(__name__)
+
+
+def build_synthetic_ping(as2_from: str, as2_to: str) -> bytes:
+    """
+    Builds a minimal, structurally valid X12 ISA/IEA envelope used as a test ping.
+    Contains no real business data; purely for connectivity verification.
+    """
+    # X12 ISA requires exactly 15 characters, padded with spaces
+    sender = as2_from.ljust(15)[:15]
+    receiver = as2_to.ljust(15)[:15]
+    return (
+        f"ISA*00*          *00*          *ZZ*{sender}*ZZ*{receiver}"
+        "*240101*1200*^*00501*000000001*0*T*:\n"
+        "IEA*0*000000001\n"
+    ).encode("ascii")
+
+
+class HttpxAS2TesterAdapter:
+    """
+    Adapter that implements AS2TesterPort using httpx for the HTTP transport
+    and the shared as2_core / security libraries for signing and encryption.
+
+    Responsibility: transport only.
+    - Returns (True, raw_mdn_disposition) when the remote partner responds with HTTP 200.
+    - Returns (False, error_reason) on any transport or parse failure.
+    The caller (router) is responsible for interpreting whether the MDN disposition
+    constitutes a business-level success.
+    """
+
+    async def test_connection(
+        self,
+        remote_url: str,
+        as2_from: str,
+        as2_to: str,
+        local_private_key_pem: bytes | None,
+        local_cert_pem: bytes | None,
+        remote_cert_pem: bytes | None,
+        encryption_algorithm: str,
+        signature_algorithm: str,
+        custom_payload: str | None = None,
+    ) -> tuple[bool, str | None, str | None, str | None]:
+        # Build sign/encrypt callables only if keys are available
+        sign_fn = (
+            functools.partial(
+                sign_payload,
+                private_key_pem=local_private_key_pem,
+                public_cert_pem=local_cert_pem,
+                algorithm=signature_algorithm,
+            )
+            if (local_private_key_pem and local_cert_pem)
+            else None
+        )
+        encrypt_fn = (
+            functools.partial(
+                encrypt_payload,
+                public_cert_pem=remote_cert_pem,
+                algorithm=encryption_algorithm,
+            )
+            if remote_cert_pem
+            else None
+        )
+
+        payload_bytes = (
+            custom_payload.encode("utf-8")
+            if custom_payload
+            else build_synthetic_ping(as2_from, as2_to)
+        )
+        payload_str = payload_bytes.decode("utf-8", errors="replace")
+
+        try:
+            as2_msg = build_outbound_message(
+                payload=payload_bytes,
+                as2_from=as2_from,
+                as2_to=as2_to,
+                content_type="application/edi-x12",
+                sign_fn=sign_fn,
+                encrypt_fn=encrypt_fn,
+            )
+        except Exception as e:
+            logger.warning(f"as2_test_build_failed: {e}")
+            return False, f"Failed to build AS2 message: {e}", payload_str, None
+
+        try:
+            async with httpx.AsyncClient(timeout=30.0) as client:
+                response = await client.post(
+                    remote_url,
+                    content=as2_msg.body,
+                    headers=as2_msg.headers,
+                )
+        except httpx.ConnectError as e:
+            return False, f"Connection refused: {e}", payload_str, None
+        except httpx.TimeoutException:
+            return False, "Connection timed out after 30 seconds", payload_str, None
+        except Exception as e:
+            return False, f"HTTP error: {e}", payload_str, None
+
+        raw_resp = response.content.decode("utf-8", errors="replace")
+        headers_str = "\n".join(f"{k}: {v}" for k, v in response.headers.items())
+        full_mdn = headers_str + "\n\n" + raw_resp
+
+        if not (200 <= response.status_code < 300):
+            return False, f"Remote returned HTTP {response.status_code}", payload_str, full_mdn
+
+        try:
+            mdn = parse_mdn(dict(response.headers), response.content)
+            # Return raw disposition string — the caller decides if it is a success.
+            # e.g. "automatic-action/MDN-sent-automatically; processed"
+            return True, mdn.disposition or "", payload_str, full_mdn
+        except Exception as e:
+            logger.warning(f"as2_test_mdn_parse_failed error={e}")
+            return False, f"MDN parse error: {e}", payload_str, full_mdn
diff --git a/services/api/src/api/adapters/repository.py b/services/api/src/api/adapters/repository.py
index 482a20b1..1b569d60 100644
--- a/services/api/src/api/adapters/repository.py
+++ b/services/api/src/api/adapters/repository.py
@@ -34,6 +34,7 @@
     Webhook,
 )
 from database.models.control_plane import Outbox as GlobalOutbox
+from database.models.data_plane import EdiMessage
 from sqlalchemy import delete, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -42,6 +43,14 @@ class SqlAlchemyControlPlaneRepository(ControlPlaneRepositoryPort):
     def __init__(self, session: AsyncSession) -> None:
         self.session = session
 
+    async def get_partnership_by_as2_ids(
+        self, as2_from: str, as2_to: str
+    ) -> tuple[Any, Any, Any] | None:
+        from database.repository import PartnershipRepository
+
+        repo = PartnershipRepository(self.session)
+        return await repo.get_partnership_by_as2_ids(as2_from, as2_to)
+
     async def create_as2_identity(self, tenant_id: int, cmd: CreateAS2TradingPartnerCmd) -> UUID:
         partner_id = uuid.uuid4()
         record = AS2Partner(
@@ -116,7 +125,6 @@ async def create_as2_partnership(self, tenant_id: int, cmd: CreateAS2Partnership
             mdn_url=cmd.mdn_url,
             encryption_algorithm=cmd.encryption_algorithm,
             signature_algorithm=cmd.signature_algorithm,
-            edi_version=cmd.edi_version,
             active=False,
         )
         self.session.add(record)
@@ -160,8 +168,7 @@ async def update_as2_partnership(
                 partnership.encryption_algorithm = cmd.encryption_algorithm
             if cmd.signature_algorithm is not UNSET:
                 partnership.signature_algorithm = cmd.signature_algorithm
-            if cmd.edi_version is not UNSET:
-                partnership.edi_version = cmd.edi_version
+
             if cmd.active is not UNSET:
                 partnership.active = cmd.active
         await self.session.flush()
@@ -594,6 +601,30 @@ class SqlAlchemyDataPlaneRepository(DataPlaneRepositoryPort):
     def __init__(self, session: AsyncSession) -> None:
         self.session = session
 
+    async def create_edi_message(self, tenant_id: int, payload: dict[str, Any]) -> UUID:
+        msg = EdiMessage(tenant_id=tenant_id, **payload)
+        self.session.add(msg)
+        await self.session.flush()
+        return msg.id
+
+    async def create_outbox_event(
+        self, tenant_id: int, event_type: str, payload: dict[str, Any]
+    ) -> UUID:
+        from database.models.data_plane import Outbox
+
+        event_id = uuid.uuid4()
+        record = Outbox(
+            id=event_id,
+            tenant_id=tenant_id,
+            idempotency_key=uuid.uuid4(),
+            event_type=event_type,
+            payload=payload,
+            status="PENDING",
+        )
+        self.session.add(record)
+        await self.session.flush()
+        return event_id
+
 
 class SqlAlchemyTenantRepository(TenantRepositoryPort):
     def __init__(self, session: AsyncSession) -> None:
diff --git a/services/api/src/api/adapters/vault.py b/services/api/src/api/adapters/vault.py
index 5d91d8c5..da4243b1 100644
--- a/services/api/src/api/adapters/vault.py
+++ b/services/api/src/api/adapters/vault.py
@@ -53,9 +53,10 @@ def store_private_key(self, private_key_pem: bytes, alias_prefix: str = "as2_key
         )
         return path
 
-    def retrieve_private_key(self, vault_ref: str) -> bytes:
+    def retrieve_secret(self, vault_ref: str, field: str | None = None) -> bytes:
         """
-        Retrieves a private key from Vault.
+        Retrieves any secret (private key, certificate, or credential) from Vault.
+        This is the canonical retrieval method; retrieve_private_key() delegates here.
         """
         read_response = self.client.secrets.kv.v2.read_secret_version(
             path=vault_ref, mount_point=self.mount_point
@@ -71,12 +72,20 @@ def retrieve_private_key(self, vault_ref: str) -> bytes:
         if not isinstance(inner_data, dict):
             raise TypeError("Expected Vault inner 'data' to be a dictionary")
 
-        pem_str = inner_data.get("private_key_pem")
+        pem_str = inner_data.get(field) if field else next(iter(inner_data.values()), None)
+
         if not isinstance(pem_str, str):
-            raise TypeError("Expected private_key_pem to be a string")
+            raise TypeError("Expected secret value to be a string")
 
         return pem_str.encode("utf-8")
 
+    def retrieve_private_key(self, vault_ref: str) -> bytes:
+        """
+        Retrieves a private key from Vault.
+        Delegates to retrieve_secret() — kept for backward compatibility.
+        """
+        return self.retrieve_secret(vault_ref, field="private_key_pem")
+
     def delete_secret(self, vault_ref: str) -> None:
         """
         Deletes a secret from Vault.
diff --git a/services/api/src/api/dependencies.py b/services/api/src/api/dependencies.py
index e8bec40f..92e78e62 100644
--- a/services/api/src/api/dependencies.py
+++ b/services/api/src/api/dependencies.py
@@ -9,6 +9,7 @@
 from identity.dependencies import get_current_tenant_id, get_raw_jwt, get_tenant_session
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from api.adapters.httpx_as2_tester import HttpxAS2TesterAdapter
 from api.adapters.paramiko_sftp_tester import ParamikoSftpTesterAdapter
 from api.adapters.repository import (
     SqlAlchemyControlPlaneRepository,
@@ -19,6 +20,7 @@
 from api.adapters.vault import vault
 from api.core.authorization import AuthorizationService
 from api.core.uow import UnitOfWork
+from api.ports.as2_tester import AS2TesterPort
 from api.ports.message_queue import MessageQueuePort
 from api.ports.repository import (
     ControlPlaneRepositoryPort,
@@ -35,6 +37,12 @@ def get_sftp_tester() -> SftpTesterPort:
     return ParamikoSftpTesterAdapter()
 
 
+@lru_cache
+def get_as2_tester() -> AS2TesterPort:
+    """Returns the httpx-based AS2 connection tester."""
+    return HttpxAS2TesterAdapter()
+
+
 def get_vault() -> VaultPort:
     return vault
 
diff --git a/services/api/src/api/domain/models.py b/services/api/src/api/domain/models.py
index 31c8dd96..d1bd79f4 100644
--- a/services/api/src/api/domain/models.py
+++ b/services/api/src/api/domain/models.py
@@ -51,7 +51,7 @@ class CreateAS2PartnershipCmd:
     mdn_url: str | None = None
     encryption_algorithm: str = "AES256"
     signature_algorithm: str = "SHA256"
-    edi_version: str | None = None
+
     advanced_flags: dict[str, Any] | None = None
 
 
@@ -65,7 +65,7 @@ class UpdateAS2PartnershipCmd:
     mdn_url: str | None | UnsetType = UNSET
     encryption_algorithm: str | UnsetType = UNSET
     signature_algorithm: str | UnsetType = UNSET
-    edi_version: str | None | UnsetType = UNSET
+
     advanced_flags: dict[str, Any] | None | UnsetType = UNSET
     active: bool | UnsetType = UNSET
 
diff --git a/services/api/src/api/main.py b/services/api/src/api/main.py
index ade2baec..08be2c04 100644
--- a/services/api/src/api/main.py
+++ b/services/api/src/api/main.py
@@ -19,7 +19,7 @@
 from api import cdc_relay
 from api.dependencies import get_current_user_profile
 from api.routers import edi_tools, routes, trading_partners, webhooks
-from api.routers.trading_partners import platform
+from api.routers.trading_partners import as2_receive, platform
 
 logger = logging.getLogger(__name__)
 
@@ -84,6 +84,7 @@ async def validation_exception_handler(
 app.include_router(platform.router)
 app.include_router(routes.router)
 app.include_router(edi_tools.router)
+app.include_router(as2_receive.router, prefix="/api/v1")
 
 
 @app.get("/api/me", tags=["Identity"])
diff --git a/services/api/src/api/ports/as2_tester.py b/services/api/src/api/ports/as2_tester.py
new file mode 100644
index 00000000..b1fab07f
--- /dev/null
+++ b/services/api/src/api/ports/as2_tester.py
@@ -0,0 +1,27 @@
+from typing import Protocol
+
+
+class AS2TesterPort(Protocol):
+    async def test_connection(
+        self,
+        remote_url: str,
+        as2_from: str,
+        as2_to: str,
+        local_private_key_pem: bytes | None,
+        local_cert_pem: bytes | None,
+        remote_cert_pem: bytes | None,
+        encryption_algorithm: str,
+        signature_algorithm: str,
+        custom_payload: str | None = None,
+    ) -> tuple[bool, str | None, str | None, str | None]:
+        """
+        Sends a synthetic AS2 ping to the remote partner's URL.
+
+        Responsibility: transport only.
+        Returns:
+            (True, raw_mdn_disposition, sent_payload, raw_mdn)
+            (False, error_reason, sent_payload, raw_mdn)
+
+        The caller is responsible for interpreting the MDN disposition as a business success or failure.
+        """
+        ...
diff --git a/services/api/src/api/ports/repository.py b/services/api/src/api/ports/repository.py
index 60c5e6d6..2005a5d8 100644
--- a/services/api/src/api/ports/repository.py
+++ b/services/api/src/api/ports/repository.py
@@ -17,11 +17,7 @@
 )
 
 
-class ControlPlaneRepositoryPort(Protocol):
-    """
-    Port for the Control Plane repository, handling Global AS2 configs and Tenant configs as SoT.
-    """
-
+class AS2TradingPartnerRepositoryPort(Protocol):
     async def create_as2_identity(
         self, tenant_id: int, cmd: CreateAS2TradingPartnerCmd
     ) -> UUID: ...
@@ -30,6 +26,11 @@ async def update_as2_identity(
     ) -> None: ...
     async def get_as2_partner(self, tenant_id: int, partner_id: UUID) -> Any: ...
     async def delete_as2_identity(self, tenant_id: int, partner_id: UUID) -> None: ...
+    async def get_as2_partners_by_ids(self, tenant_id: int, ids: list[UUID]) -> dict[UUID, str]: ...
+    async def list_as2_partners(self, tenant_id: int) -> Sequence[Any]: ...
+
+
+class AS2PartnershipRepositoryPort(Protocol):
     async def create_as2_partnership(
         self, tenant_id: int, cmd: CreateAS2PartnershipCmd
     ) -> UUID: ...
@@ -38,13 +39,12 @@ async def update_as2_partnership(
     ) -> None: ...
     async def get_as2_partnership(self, tenant_id: int, partnership_id: UUID) -> Any: ...
     async def delete_as2_partnership(self, tenant_id: int, partnership_id: UUID) -> None: ...
-    async def get_as2_partners_by_ids(self, tenant_id: int, ids: list[UUID]) -> dict[UUID, str]: ...
-    async def list_as2_partners(self, tenant_id: int) -> Sequence[Any]: ...
-    async def create_outbox_event(
-        self, tenant_id: int, event_type: str, payload: dict[str, Any]
-    ) -> UUID: ...
+    async def get_partnership_by_as2_ids(
+        self, as2_from: str, as2_to: str
+    ) -> tuple[Any, Any, Any] | None: ...
 
-    # SFTP Partners
+
+class SFTPPartnerRepositoryPort(Protocol):
     async def create_sftp_partner(self, tenant_id: int, cmd: CreateSFTPPartnerCmd) -> UUID: ...
     async def update_sftp_partner(
         self, tenant_id: int, partner_id: UUID, cmd: UpdateSFTPPartnerCmd
@@ -56,32 +56,71 @@ async def get_sftp_partners_by_ids(
         self, tenant_id: int, ids: list[UUID]
     ) -> dict[UUID, str]: ...
 
-    # Webhook Partners
+
+class WebhookRepositoryPort(Protocol):
     async def create_webhook(self, tenant_id: int, cmd: CreateWebhookCmd) -> UUID: ...
-    async def get_webhook(self, tenant_id: int, partner_id: UUID) -> Any: ...
+    async def get_webhook(self, tenant_id: int, webhook_id: UUID) -> Any: ...
     async def list_webhooks(self, tenant_id: int) -> Sequence[Any]: ...
     async def get_webhooks_by_ids(self, tenant_id: int, ids: list[UUID]) -> dict[UUID, str]: ...
 
-    # Routes
+
+class RouteRepositoryPort(Protocol):
     async def create_inbound_route(self, tenant_id: int, cmd: CreateInboundRouteCmd) -> UUID: ...
     async def update_inbound_route(
         self, tenant_id: int, route_id: UUID, cmd: UpdateInboundRouteCmd
     ) -> bool: ...
     async def delete_inbound_route(self, tenant_id: int, route_id: UUID) -> bool: ...
+
     async def create_outbound_route(self, tenant_id: int, cmd: CreateOutboundRouteCmd) -> UUID: ...
     async def update_outbound_route(
         self, tenant_id: int, route_id: UUID, cmd: UpdateOutboundRouteCmd
     ) -> bool: ...
     async def delete_outbound_route(self, tenant_id: int, route_id: UUID) -> bool: ...
+
     async def get_all_routes(self, tenant_id: int) -> dict[str, list[Any]]: ...
 
 
+class OutboxRepositoryPort(Protocol):
+    async def create_outbox_event(
+        self, tenant_id: int, event_type: str, payload: dict[str, Any]
+    ) -> UUID: ...
+
+
+class ControlPlaneRepositoryPort(
+    AS2TradingPartnerRepositoryPort,
+    AS2PartnershipRepositoryPort,
+    SFTPPartnerRepositoryPort,
+    WebhookRepositoryPort,
+    RouteRepositoryPort,
+    OutboxRepositoryPort,
+    Protocol,
+):
+    """
+    Aggregate Port for the Control Plane repository, handling Global AS2 configs and Tenant configs as SoT.
+    This maintains backward compatibility while segregating interfaces.
+    """
+
+    pass
+
+
 class DataPlaneRepositoryPort(Protocol):
     """
     Port for the Data Plane repository, handling Operational Data.
     """
 
-    pass
+    async def create_edi_message(self, tenant_id: int, payload: dict[str, Any]) -> UUID:
+        """
+        Saves a new EdiMessage record to the Data Plane.
+        """
+        ...
+
+    async def create_outbox_event(
+        self, tenant_id: int, event_type: str, payload: dict[str, Any]
+    ) -> UUID:
+        """
+        Saves an outbox event to the Data Plane.
+        """
+        ...
 
 
 class TenantRepositoryPort(Protocol):
diff --git a/services/api/src/api/ports/vault.py b/services/api/src/api/ports/vault.py
index 0960785c..aa798c3e 100644
--- a/services/api/src/api/ports/vault.py
+++ b/services/api/src/api/ports/vault.py
@@ -8,9 +8,18 @@ def store_private_key(self, private_key_pem: bytes, alias_prefix: str = "as2_key
         """
         ...
 
+    def retrieve_secret(self, vault_ref: str) -> bytes:
+        """
+        Retrieves any secret (private key, certificate, or credential) from Vault.
+        The semantically correct method for generic secret retrieval — use this
+        instead of retrieve_private_key() when fetching public certificates.
+        """
+        ...
+
     def retrieve_private_key(self, vault_ref: str) -> bytes:
         """
         Retrieves a private key from Vault.
+        Delegates to retrieve_secret() — kept for backward compatibility.
         """
         ...
 
diff --git a/services/api/src/api/routers/trading_partners/as2_receive.py b/services/api/src/api/routers/trading_partners/as2_receive.py
new file mode 100644
index 00000000..4fc7518f
--- /dev/null
+++ b/services/api/src/api/routers/trading_partners/as2_receive.py
@@ -0,0 +1,93 @@
+import logging
+
+from database.session import get_global_session
+from fastapi import APIRouter, Depends, HTTPException, Request, Response
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from api.dependencies import get_vault
+from api.ports.vault import VaultPort
+from api.services.as2_receive_service import As2ReceiveService
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(tags=["Platform - AS2 Receive"])
+
+
+@router.post("/as2/receive")
+async def receive_as2_message(
+    request: Request,
+    global_session: AsyncSession = Depends(get_global_session),
+    vault: VaultPort = Depends(get_vault),
+) -> Response:
+    """
+    AS2 HTTP Adapter.
+    Strictly handles HTTP parsing and delegates all business logic to the Application Service.
+    """
+    body_bytes = await request.body()
+    headers = dict(request.headers)
+
+    # Instantiate the application service (Use Case)
+    service = As2ReceiveService(
+        global_session=global_session, vault=vault, db_router=request.app.state.db_router
+    )
+
+    # Extract headers for MDN generation in case of failure
+    as2_to_hdr = headers.get("as2-to") or headers.get("AS2-To")
+    as2_from_hdr = headers.get("as2-from") or headers.get("AS2-From")
+    msg_id_hdr = headers.get("message-id") or headers.get("Message-ID")
+
+    try:
+        # Delegate to the Hexagonal Architecture Use Case
+        mdn_body, mdn_headers = await service.process_inbound_message(
+            headers=headers, body_bytes=body_bytes
+        )
+    except ValueError as e:
+        logger.warning(f"Business logic rejection: {e}")
+        if as2_to_hdr and as2_from_hdr and msg_id_hdr:
+            from as2_core import build_mdn
+
+            error_msg = str(e).lower()
+            if "decrypt" in error_msg:
+                modifier = "error: decryption-failed"
+            elif "authentic" in error_msg or "sign" in error_msg or "cert" in error_msg:
+                modifier = "error: authentication-failed"
+            elif "integr" in error_msg or "mic" in error_msg:
+                modifier = "error: integrity-check-failed"
+            else:
+                modifier = "error: unexpected-processing-error"
+
+            mdn = build_mdn(
+                as2_to=as2_to_hdr,
+                as2_from=as2_from_hdr,
+                message_id=msg_id_hdr,
+                disposition=f"automatic-action/MDN-sent-automatically; processed/{modifier}",
+            )
+            return Response(
+                content=mdn.body,
+                media_type=mdn.headers.get("Content-Type", "multipart/report"),
+                headers=mdn.headers,
+            )
+        raise HTTPException(status_code=400, detail=str(e)) from e
+    except Exception as e:
+        logger.error(f"Internal server error: {e}")
+        if as2_to_hdr and as2_from_hdr and msg_id_hdr:
+            from as2_core import build_mdn
+
+            mdn = build_mdn(
+                as2_to=as2_to_hdr,
+                as2_from=as2_from_hdr,
+                message_id=msg_id_hdr,
+                disposition="automatic-action/MDN-sent-automatically; processed/error: unexpected-processing-error",
+            )
+            return Response(
+                content=mdn.body,
+                media_type=mdn.headers.get("Content-Type", "multipart/report"),
+                headers=mdn.headers,
+            )
+        raise HTTPException(status_code=500, detail="Internal server error") from e
+
+    return Response(
+        content=mdn_body,
+        media_type=mdn_headers.get("Content-Type", "multipart/report"),
+        headers=mdn_headers,
+    )
diff --git a/services/api/src/api/routers/trading_partners/platform/as2_partnerships.py b/services/api/src/api/routers/trading_partners/platform/as2_partnerships.py
index a3ce5371..a52ff0d1 100644
--- a/services/api/src/api/routers/trading_partners/platform/as2_partnerships.py
+++ b/services/api/src/api/routers/trading_partners/platform/as2_partnerships.py
@@ -10,22 +10,130 @@
 from api.adapters.http.dtos import (
     AS2PartnershipResponse,
     CreateAS2PartnershipRequest,
+    TestAS2ConnectionRequest,
+    TestAS2ConnectionResponse,
     UpdateAS2PartnershipRequest,
 )
 from api.core.uow import UnitOfWork
 from api.dependencies import (
+    get_as2_tester,
     get_uow,
+    get_vault,
 )
 from api.domain.models import (
     CreateAS2PartnershipCmd,
     UpdateAS2PartnershipCmd,
 )
+from api.ports.as2_tester import AS2TesterPort
+from api.ports.vault import VaultPort
 
 logger = logging.getLogger(__name__)
 
 router = APIRouter(tags=["Platform Partners - AS2 Partnerships"])
 
 
+@router.post(
+    "/as2/partnerships/{partnership_id}/test",
+    response_model=TestAS2ConnectionResponse,
+    status_code=status.HTTP_200_OK,
+)
+async def test_as2_partnership_connection(
+    partnership_id: UUID,
+    request: TestAS2ConnectionRequest | None = None,
+    uow: UnitOfWork = Depends(get_uow),
+    as2_tester: AS2TesterPort = Depends(get_as2_tester),
+    vault_port: VaultPort = Depends(get_vault),
+) -> Any:
+    """
+    Tests an AS2 connection for a configured partnership.
+
+    Sends a synthetic AS2 ping (or custom payload) to the remote partner's URL
+    using the partnership's configured cryptographic material.
+    """
+    async with uow:
+        partnership = await uow.control_plane.get_as2_partnership(
+            tenant_id=0, partnership_id=partnership_id
+        )
+        if not partnership:
+            raise HTTPException(status_code=404, detail="Partnership not found")
+
+        local_partner = await uow.control_plane.get_as2_partner(
+            tenant_id=0, partner_id=partnership.local_partner_id
+        )
+        remote_partner = await uow.control_plane.get_as2_partner(
+            tenant_id=0, partner_id=partnership.remote_partner_id
+        )
+
+    if not local_partner:
+        return TestAS2ConnectionResponse(
+            success=False, reason="Local AS2 partner not found for this partnership."
+        )
+    if not remote_partner:
+        return TestAS2ConnectionResponse(
+            success=False, reason="Remote AS2 partner not found for this partnership."
+        )
+    if not remote_partner.url:
+        return TestAS2ConnectionResponse(
+            success=False, reason="Remote partner has no URL configured."
+        )
+
+    # Resolve cryptographic material from Vault or inline PEM
+    local_private_key_pem: bytes | None = None
+    local_cert_pem: bytes | None = None
+    remote_cert_pem: bytes | None = None
+
+    try:
+        if local_partner.private_key_vault_ref:
+            local_private_key_pem = vault_port.retrieve_secret(local_partner.private_key_vault_ref)
+        if local_partner.public_cert_vault_ref:
+            local_cert_pem = vault_port.retrieve_secret(local_partner.public_cert_vault_ref)
+        elif local_partner.public_cert_pem:
+            local_cert_pem = local_partner.public_cert_pem.encode()
+        if remote_partner.public_cert_vault_ref:
+            remote_cert_pem = vault_port.retrieve_secret(remote_partner.public_cert_vault_ref)
+        elif remote_partner.public_cert_pem:
+            remote_cert_pem = remote_partner.public_cert_pem.encode()
+    except Exception as e:
+        return TestAS2ConnectionResponse(
+            success=False, reason=f"Failed to retrieve cryptographic material: {e}"
+        )
+
+    transport_ok, raw_disposition, sent_payload, raw_mdn = await as2_tester.test_connection(
+        remote_url=str(remote_partner.url),
+        as2_from=local_partner.as2_id,
+        as2_to=remote_partner.as2_id,
+        local_private_key_pem=local_private_key_pem,
+        local_cert_pem=local_cert_pem,
+        remote_cert_pem=remote_cert_pem,
+        encryption_algorithm=partnership.encryption_algorithm or "AES256",
+        signature_algorithm=partnership.signature_algorithm or "SHA256",
+        custom_payload=request.custom_payload if request else None,
+    )
+
+    if not transport_ok:
+        return TestAS2ConnectionResponse(
+            success=False, reason=raw_disposition, sent_payload=sent_payload, raw_mdn=raw_mdn
+        )
+
+    # Business rule (RFC 4130): MDN disposition must start with "processed"
+    disposition = raw_disposition or ""
+    parts = disposition.split(";", 1)
+    status_part = parts[1].strip().lower() if len(parts) == 2 else disposition.strip().lower()
+    is_success = (
+        status_part.startswith("processed")
+        and "error" not in status_part
+        and "failed" not in status_part
+    )
+
+    return TestAS2ConnectionResponse(
+        success=is_success,
+        mdn_disposition=status_part,
+        reason=None if is_success else status_part or disposition,
+        sent_payload=sent_payload,
+        raw_mdn=raw_mdn,
+    )
+
+
 @router.post("/as2/partnerships", response_model=Any, status_code=status.HTTP_201_CREATED)
 async def create_platform_as2_partnership(
     request: CreateAS2PartnershipRequest,
@@ -45,7 +153,6 @@ async def create_platform_as2_partnership(
                 mdn_url=str(request.mdn_url) if request.mdn_url else None,
                 encryption_algorithm=request.encryption_algorithm,
                 signature_algorithm=request.signature_algorithm,
-                edi_version=request.edi_version,
                 advanced_flags=request.advanced_flags,
             )
 
@@ -67,7 +174,6 @@ async def create_platform_as2_partnership(
                 mdn_url=p.mdn_url,
                 encryption_algorithm=p.encryption_algorithm,
                 signature_algorithm=p.signature_algorithm,
-                edi_version=p.edi_version,
                 status="active" if p.active else "inactive",
                 active=p.active,
             )
@@ -107,7 +213,6 @@ def get_val(field: str) -> Any:
                 mdn_url=mdn_url_val,
                 encryption_algorithm=get_val("encryption_algorithm"),
                 signature_algorithm=get_val("signature_algorithm"),
-                edi_version=get_val("edi_version"),
                 advanced_flags=get_val("advanced_flags"),
                 active=get_val("active"),
             )
@@ -132,7 +237,6 @@ def get_val(field: str) -> Any:
                 mdn_url=p.mdn_url,
                 encryption_algorithm=p.encryption_algorithm,
                 signature_algorithm=p.signature_algorithm,
-                edi_version=p.edi_version,
                 status="active" if p.active else "inactive",
                 active=p.active,
             )
@@ -192,7 +296,6 @@ async def list_platform_as2_partnerships(
                 mdn_url=p.mdn_url,
                 encryption_algorithm=p.encryption_algorithm,
                 signature_algorithm=p.signature_algorithm,
-                edi_version=p.edi_version,
                 status="active" if p.active else "inactive",
                 active=p.active,
             )
diff --git a/services/api/src/api/routers/trading_partners/platform/config.py b/services/api/src/api/routers/trading_partners/platform/config.py
index 7edc7dc9..a0f7e2a0 100644
--- a/services/api/src/api/routers/trading_partners/platform/config.py
+++ b/services/api/src/api/routers/trading_partners/platform/config.py
@@ -7,8 +7,15 @@
 router = APIRouter(tags=["Platform Config"])
 
 
+class SupportedAlgorithm(BaseModel):
+    value: str
+    label: str
+
+
 class PlatformConfigResponse(BaseModel):
     available_as2_receive_urls: list[str]
+    supported_as2_encryption_algorithms: list[SupportedAlgorithm]
+    supported_as2_signature_algorithms: list[SupportedAlgorithm]
 
 
 @router.get("/config", response_model=PlatformConfigResponse)
@@ -18,4 +25,16 @@ async def get_platform_config() -> Any:
     # We strip trailing slashes to ensure consistent path appending
     base_url = settings.server.external_url.rstrip("/")
 
-    return PlatformConfigResponse(available_as2_receive_urls=[f"{base_url}/api/v1/as2/receive"])
+    return PlatformConfigResponse(
+        available_as2_receive_urls=[f"{base_url}/api/v1/as2/receive"],
+        supported_as2_encryption_algorithms=[
+            SupportedAlgorithm(value="AES256", label="AES-256-CBC"),
+            SupportedAlgorithm(value="AES128", label="AES-128-CBC"),
+            SupportedAlgorithm(value="3DES", label="3DES (Legacy)"),
+        ],
+        supported_as2_signature_algorithms=[
+            SupportedAlgorithm(value="SHA256", label="SHA-256"),
+            SupportedAlgorithm(value="SHA1", label="SHA-1 (Legacy)"),
+            SupportedAlgorithm(value="MD5", label="MD5 (Legacy)"),
+        ],
+    )
diff --git a/services/api/src/api/services/as2_receive_service.py b/services/api/src/api/services/as2_receive_service.py
new file mode 100644
index 00000000..46f5daae
--- /dev/null
+++ b/services/api/src/api/services/as2_receive_service.py
@@ -0,0 +1,347 @@
+import email
+import logging
+import re
+import uuid
+from email import policy
+from typing import Any
+
+from api.adapters.repository import SqlAlchemyDataPlaneRepository
+from api.core.uow import UnitOfWork
+from api.ports.vault import VaultPort
+from as2_core.mdn import build_mdn, calculate_mic
+from as2_core.message import AS2Message
+from as2_core.parser import parse_as2_request
+from database.models.control_plane import DatabaseShard, Tenant
+from security.smime import decrypt_payload, verify_signature
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+logger = logging.getLogger(__name__)
+
+
+class As2ReceiveService:
+    """
+    Application Service (Use Case Layer) for handling inbound AS2 messages.
+    Strictly follows Single Responsibility Principle and encapsulates business logic.
+    """
+
+    def __init__(self, global_session: AsyncSession, vault: VaultPort, db_router: Any):
+        self.global_session = global_session
+        self.vault = vault
+        self.db_router = db_router
+        self.uow = UnitOfWork(global_session=global_session)
+
+    async def process_inbound_message(
+        self, headers: dict[str, str], body_bytes: bytes
+    ) -> tuple[bytes, dict[str, str]]:
+        """
+        Orchestrates the entire inbound AS2 flow:
+        1. Parse HTTP Request
+        2. Lookup Partnership
+        3. Retrieve Keys
+        4. Cryptographic Pipeline (Decrypt -> Verify)
+        5. Save to Data Plane (Multi-Tenant)
+        6. Generate MDN Response
+
+        Returns: (MDN Body Bytes, MDN Headers Dict)
+        """
+        # 1. Parse Request
+        as2_msg = self._parse_request(headers, body_bytes)
+        logger.info(f"Looking up partnership: from '{as2_msg.as2_from}' to '{as2_msg.as2_to}'")
+
+        # 2. Lookup Partnership
+        partnership, local_partner, remote_partner = await self._lookup_partnership(
+            as2_msg.as2_from, as2_msg.as2_to
+        )
+
+        # 3. Retrieve Keys
+        local_priv_key, local_cert, remote_cert = self._retrieve_keys(local_partner, remote_partner)
+
+        # 4. Cryptographic Pipeline (Unbox)
+        final_payload, mic = self._unbox_payload(
+            as2_msg, headers, local_priv_key, local_cert, remote_cert
+        )
+
+        # 5. Extract Pure EDI
+        pure_edi_bytes = self._extract_pure_edi(final_payload)
+
+        # 6. Save to DB
+        await self._save_to_data_plane(
+            partnership=partnership, as2_msg=as2_msg, pure_edi_bytes=pure_edi_bytes
+        )
+
+        # 7. Generate MDN
+        disposition = "automatic-action/MDN-sent-automatically; processed"
+
+        sign_fn = None
+        requires_signed = any(
+            k.lower() == "disposition-notification-options" for k in as2_msg.headers
+        )
+        if requires_signed:
+            local_priv, local_cert, _ = self._retrieve_keys(
+                local_partner=partnership.local_partner, remote_partner=partnership.remote_partner
+            )
+            if local_priv and local_cert:
+                import functools
+
+                from security.smime import sign_payload
+
+                sign_fn = functools.partial(
+                    sign_payload,
+                    private_key_pem=local_priv,
+                    public_cert_pem=local_cert,
+                    algorithm=partnership.signature_algorithm or "sha256",
+                )
+
+        mdn = build_mdn(
+            as2_to=as2_msg.as2_to,
+            as2_from=as2_msg.as2_from,
+            message_id=as2_msg.message_id,
+            disposition=disposition,
+            mic=mic,
+            sign_fn=sign_fn,
+        )
+
+        return mdn.body, mdn.headers
+
+    def _parse_request(self, headers: dict[str, str], body_bytes: bytes) -> AS2Message:
+        try:
+            return parse_as2_request(headers, body_bytes)
+        except ValueError as e:
+            logger.warning(f"Failed to parse AS2 request: {e}")
+            raise ValueError(f"Bad Request: {e}") from e
+
+    async def _lookup_partnership(self, as2_from: str, as2_to: str):  # type: ignore
+        async with self.uow:
+            match = await self.uow.control_plane.get_partnership_by_as2_ids(
+                as2_from=as2_from, as2_to=as2_to
+            )
+            if not match:
+                logger.error(f"Partnership not found in Control Plane for {as2_from} -> {as2_to}")
+                raise ValueError("Partnership not configured")
+            return match
+
+    def _retrieve_keys(  # type: ignore
+        self, local_partner, remote_partner
+    ) -> tuple[bytes | None, bytes | None, bytes | None]:
+        local_priv_key = None
+        local_cert = None
+        remote_cert = None
+
+        if local_partner.private_key_vault_ref:
+            local_priv_key = self.vault.retrieve_secret(local_partner.private_key_vault_ref)
+        if local_partner.public_cert_vault_ref:
+            local_cert = self.vault.retrieve_secret(local_partner.public_cert_vault_ref)
+        elif local_partner.public_cert_pem:
+            local_cert = local_partner.public_cert_pem.encode()
+
+        if remote_partner.public_cert_vault_ref:
+            remote_cert = self.vault.retrieve_secret(remote_partner.public_cert_vault_ref)
+        elif remote_partner.public_cert_pem:
+            remote_cert = remote_partner.public_cert_pem.encode()
+
+        if not local_priv_key:
+            logger.warning("Local private key not configured — skipping decryption")
+
+        return local_priv_key, local_cert, remote_cert
+
+    def _unbox_payload(
+        self,
+        as2_msg: AS2Message,
+        original_headers: dict[str, str],
+        local_priv_key: bytes | None,
+        local_cert: bytes | None,
+        remote_cert: bytes | None,
+    ) -> tuple[bytes, str | None]:
+        """
+        Executes the cryptographic pipeline sequentially: Decrypt -> Re-evaluate Sign -> Verify -> MIC.
+        """
+        current_entity = as2_msg.payload
+        is_encrypted = as2_msg.is_encrypted
+        is_signed = as2_msg.is_signed
+
+        # Decryption Step
+        if is_encrypted:
+            if not local_priv_key:
+                raise ValueError("Message is encrypted but local private key is missing.")
+            current_entity = self._decrypt_entity(
+                current_entity, original_headers, local_priv_key, local_cert
+            )
+
+            if not is_signed:
+                # Re-evaluate signing status on decrypted inner payload
+                parsed_inner = email.message_from_bytes(current_entity, policy=policy.HTTP)
+                inner_ct = parsed_inner.get_content_type()
+                if inner_ct in ("multipart/signed", "application/pkcs7-signature"):
+                    is_signed = True
+
+        # Verification Step
+        mic = None
+        if is_signed:
+            if not remote_cert:
+                raise ValueError("Message is signed but remote public certificate is missing.")
+            if not is_encrypted:
+                verify_entity = self._reconstruct_smime_headers(original_headers) + current_entity
+            else:
+                verify_entity = current_entity
+
+            mic, raw_signed_content = self._verify_and_calculate_mic(
+                verify_entity, remote_cert, as2_msg.message_id
+            )
+            current_entity = raw_signed_content
+        else:
+            mic = calculate_mic(current_entity, "sha256")
+            logger.info(f"Calculated MIC (sha256) for unsigned message {as2_msg.message_id}: {mic}")
+
+        return current_entity, mic
+
+    def _decrypt_entity(
+        self,
+        current_entity: bytes,
+        original_headers: dict[str, str],
+        priv_key: bytes,
+        cert: bytes | None,
+    ) -> bytes:
+        try:
+            decrypted = decrypt_payload(
+                current_entity,
+                private_key_pem=priv_key,
+                public_cert_pem=cert,  # type: ignore
+            )
+            if decrypted:
+                return decrypted
+        except Exception as e:
+            import logging
+
+            logger = logging.getLogger(__name__)
+            logger.debug(f"Initial decryption attempt failed (will try fallback): {e}")
+            pass
+
+        # Fallback to prepending headers for openssl parsing
+        smime_headers = self._reconstruct_smime_headers(original_headers)
+        try:
+            decrypted = decrypt_payload(
+                smime_headers + current_entity,
+                private_key_pem=priv_key,
+                public_cert_pem=cert,  # type: ignore
+            )
+            if decrypted:
+                return decrypted
+            raise ValueError("Decryption returned empty")
+        except Exception as e:
+            logger.error(f"Decryption failed after fallback: {e}")
+            raise ValueError(f"Decryption failed: {e}") from e
+
+    def _reconstruct_smime_headers(self, headers: dict[str, str]) -> bytes:
+        smime_headers = ""
+        has_cte = False
+        for header_name in ["content-type", "content-transfer-encoding", "content-disposition"]:
+            if header_name in headers:
+                if header_name == "content-transfer-encoding":
+                    has_cte = True
+                smime_headers += f"{header_name.title()}: {headers[header_name]}\r\n"
+        if not has_cte:
+            smime_headers += "Content-Transfer-Encoding: binary\r\n"
+        smime_headers += "\r\n"
+        return smime_headers.encode("utf-8")
+
+    def _verify_and_calculate_mic(
+        self, verify_entity: bytes, remote_cert: bytes, message_id: str
+    ) -> tuple[str, bytes]:
+        msg = email.message_from_bytes(verify_entity, policy=policy.HTTP)
+        boundary = msg.get_boundary()
+
+        mic = None
+        if boundary:
+            boundary_bytes = b"--" + boundary.encode("ascii")
+            pattern = re.compile(b"(?:\r\n|\n)" + re.escape(boundary_bytes) + b"(?:\r\n|\n|--)")
+            parts = pattern.split(verify_entity)
+            if len(parts) >= 3:
+                raw_signed_content = parts[1]
+                mic = calculate_mic(raw_signed_content, "sha256")
+            else:
+                mic = calculate_mic(verify_entity, "sha256")
+        else:
+            mic = calculate_mic(verify_entity, "sha256")
+
+        logger.info(f"Calculated MIC (sha256) for signed message {message_id}: {mic}")
+
+        try:
+            is_valid, verified_payload = verify_signature(
+                verify_entity, public_cert_pem=remote_cert
+            )
+            if not is_valid:
+                raise ValueError("Signature verification mathematically failed")
+            return mic, verified_payload
+        except Exception as e:
+            logger.error(f"Signature verification failed: {e}")
+            raise ValueError(f"Signature verification failed: {e}") from e
+
+    def _extract_pure_edi(self, final_payload_bytes: bytes | str | Any) -> bytes:
+        if not isinstance(final_payload_bytes, bytes):
+            final_payload_bytes = final_payload_bytes.as_bytes()  # type: ignore
+
+        parsed_msg = email.message_from_bytes(final_payload_bytes, policy=policy.HTTP)
+        if "content-type" in parsed_msg:
+            decoded_payload = parsed_msg.get_payload(decode=True)
+            if decoded_payload is not None:
+                return decoded_payload  # type: ignore
+            return parsed_msg.as_bytes()
+        return final_payload_bytes
+
+    async def _save_to_data_plane(  # type: ignore
+        self, partnership, as2_msg: AS2Message, pure_edi_bytes: bytes
+    ) -> str:
+        edi_record = {
+            "trace_id": uuid.uuid4(),
+            "direction": "INBOUND",
+            "connection_type": "AS2",
+            "sender_id": as2_msg.as2_from,
+            "receiver_id": as2_msg.as2_to,
+            "message_id": as2_msg.message_id,
+            "mdn_mode": partnership.mdn_type,
+            "signature_algorithm": partnership.signature_algorithm,
+            "encryption_algorithm": partnership.encryption_algorithm,
+            "edi_data": pure_edi_bytes,
+            "status": "RECEIVED",
+        }
+
+        # Infrastructure logic encapsulated in the service layer
+        stmt = (
+            select(Tenant, DatabaseShard)
+            .join(DatabaseShard, Tenant.shard_id == DatabaseShard.id)
+            .where(Tenant.id == partnership.tenant_id)
+        )
+        result = await self.global_session.execute(stmt)
+        row = result.first()
+        if not row:
+            logger.error(f"Tenant {partnership.tenant_id} not found in global DB")
+            raise ValueError("Tenant routing failed")
+
+        tenant, shard = row
+        async_gen_tenant = self.db_router.get_tenant_session(
+            partnership.tenant_id, shard.name, shard.dsn
+        )
+        tenant_session = await anext(async_gen_tenant)
+        try:
+            dp_repo = SqlAlchemyDataPlaneRepository(tenant_session)
+            msg_id = await dp_repo.create_edi_message(
+                tenant_id=partnership.tenant_id, payload=edi_record
+            )
+
+            outbox_payload = {
+                "edi_message_id": str(msg_id),
+                "sender_id": as2_msg.as2_from,
+                "receiver_id": as2_msg.as2_to,
+                "status": "RECEIVED",
+            }
+            await dp_repo.create_outbox_event(
+                tenant_id=partnership.tenant_id,
+                event_type="edi_message.received",
+                payload=outbox_payload,
+            )
+
+            await tenant_session.commit()
+            return str(msg_id)
+        finally:
+            await async_gen_tenant.aclose()
diff --git a/services/api/tests/api_fakes.py b/services/api/tests/api_fakes.py
index ad7faa9f..1d691d19 100644
--- a/services/api/tests/api_fakes.py
+++ b/services/api/tests/api_fakes.py
@@ -74,7 +74,8 @@ class FakePartner:
                     active = p.get("status", "INACTIVE") == "ACTIVE"
                     private_key_vault_ref = None
                     prev_private_key_vault_ref = None
-                    public_cert_pem = None
+                    public_cert_pem = p["cmd"].public_cert_pem
+                    public_cert_vault_ref = p["cmd"].public_cert_vault_ref
                     prev_public_cert_pem = None
 
                 return FakePartner()
@@ -94,7 +95,7 @@ class FakePartnership:
                     mdn_url = p["cmd"].mdn_url
                     encryption_algorithm = p["cmd"].encryption_algorithm
                     signature_algorithm = p["cmd"].signature_algorithm
-                    edi_version = p["cmd"].edi_version
+
                     active = p.get("status", "INACTIVE") == "ACTIVE"
                     private_key_vault_ref = None
                     prev_private_key_vault_ref = None
@@ -382,7 +383,7 @@ def __init__(self):
                     self.mdn_url = None
                     self.encryption_algorithm = "AES256"
                     self.signature_algorithm = "SHA256"
-                    self.edi_version = None
+
                     self.active = True
 
             return MockResult([P()])
diff --git a/services/api/tests/test_as2_partnerships.py b/services/api/tests/test_as2_partnerships.py
new file mode 100644
index 00000000..5efbf83f
--- /dev/null
+++ b/services/api/tests/test_as2_partnerships.py
@@ -0,0 +1,230 @@
+"""
+Tests for the AS2 Partnership connection test endpoint.
+
+POST /api/v1/platform/trading-partners/as2/partnerships/{id}/test
+
+All infrastructure is injected via FakeUnitOfWork, a fixture-controlled FakeAS2Tester,
+and FakeVault — zero real network connections or Vault required.
+"""
+
+import uuid
+from collections.abc import Callable
+
+import pytest
+from api.dependencies import get_as2_tester, get_uow, get_vault, require_platform_admin
+from api.main import app
+from api_fakes import FakeUnitOfWork
+from fastapi.testclient import TestClient
+from identity.dependencies import get_current_tenant_id
+
+# ---------------------------------------------------------------------------
+# Fakes
+# ---------------------------------------------------------------------------
+
+
+class FakeAS2Tester:
+    """
+    Controllable fake for AS2TesterPort.
+    """
+
+    def __init__(self, *, transport_ok: bool, result: str) -> None:
+        self._transport_ok = transport_ok
+        self._result = result
+
+    async def test_connection(self, **kwargs) -> tuple[bool, str | None, str | None, str | None]:
+        return self._transport_ok, self._result, "mock-sent-payload", "mock-raw-mdn"
+
+
+class FakeVault:
+    def retrieve_secret(self, vault_ref: str) -> bytes:
+        return b"-----BEGIN CERTIFICATE-----\nfake\n-----END CERTIFICATE-----"
+
+    def retrieve_private_key(self, vault_ref: str) -> bytes:
+        return self.retrieve_secret(vault_ref)
+
+    def store_private_key(self, private_key_pem: bytes, alias_prefix: str = "as2_key") -> str:
+        return "fake_ref"
+
+    def delete_secret(self, vault_ref: str) -> None:
+        pass
+
+
+# ---------------------------------------------------------------------------
+# Fixtures
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture
+def fake_uow() -> FakeUnitOfWork:
+    return FakeUnitOfWork()
+
+
+@pytest.fixture
+def client_factory(fake_uow: FakeUnitOfWork) -> Callable[..., TestClient]:
+    """
+    Factory fixture that creates a TestClient with all dependency overrides
+    registered BEFORE the TestClient context is entered. This ensures no
+    global state mutation occurs inside test bodies.
+
+    Usage:
+        def test_something(client_factory, fake_uow):
+            client = client_factory(transport_ok=True, result="processed")
+    """
+    active_clients: list[TestClient] = []
+
+    def _make(*, transport_ok: bool = True, result: str = "processed") -> TestClient:
+        fake_tester = FakeAS2Tester(transport_ok=transport_ok, result=result)
+
+        app.dependency_overrides[get_uow] = lambda: fake_uow
+        app.dependency_overrides[get_current_tenant_id] = lambda: 0
+        app.dependency_overrides[require_platform_admin] = lambda: 0
+        app.dependency_overrides[get_vault] = lambda: FakeVault()
+        app.dependency_overrides[get_as2_tester] = lambda: fake_tester
+
+        ctx = TestClient(app)
+        ctx.__enter__()
+        active_clients.append(ctx)
+        return ctx
+
+    yield _make
+
+    for ctx in active_clients:
+        ctx.__exit__(None, None, None)
+    app.dependency_overrides.clear()
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+
+def _create_partnership(client: TestClient, fake_uow: FakeUnitOfWork) -> tuple[str, str, str]:
+    """
+    Creates local partner → remote partner → partnership via the real API.
+    Returns (local_id, remote_id, partnership_id).
+    """
+    local_resp = client.post(
+        "/api/v1/platform/trading-partners/as2/trading-partners",
+        json={
+            "name": "Our Company",
+            "as2_id": "OURCO",
+            "is_local": True,
+            "url": None,
+            "public_cert_pem": None,
+            "public_cert_vault_ref": None,
+            "private_key_vault_ref": None,
+        },
+    )
+    assert local_resp.status_code == 201
+    local_id = local_resp.json()["id"]
+
+    remote_resp = client.post(
+        "/api/v1/platform/trading-partners/as2/trading-partners",
+        json={
+            "name": "Mendelson",
+            "as2_id": "MENDELSON",
+            "is_local": False,
+            "url": "http://localhost:8080/as2/HttpReceiver",
+            "public_cert_pem": None,
+            "public_cert_vault_ref": None,
+            "private_key_vault_ref": None,
+        },
+    )
+    assert remote_resp.status_code == 201
+    remote_id = remote_resp.json()["id"]
+
+    partnership_resp = client.post(
+        "/api/v1/platform/trading-partners/as2/partnerships",
+        json={
+            "name": "OURCO <> Mendelson",
+            "local_partner_id": local_id,
+            "remote_partner_id": remote_id,
+            "mdn_type": "SYNC",
+            "encryption_algorithm": "AES256",
+            "signature_algorithm": "SHA256",
+        },
+    )
+    assert partnership_resp.status_code == 201
+    partnership_id = partnership_resp.json()["id"]
+    return local_id, remote_id, partnership_id
+
+
+# ---------------------------------------------------------------------------
+# Tests
+# ---------------------------------------------------------------------------
+
+
+def test_test_as2_partnership_success(client_factory, fake_uow):
+    """
+    Remote partner returns a 'processed' MDN disposition.
+    The endpoint must parse the business rule and return success=True.
+    """
+    # Adapter returns raw full disposition; router applies RFC 4130 business rule.
+    client = client_factory(
+        transport_ok=True,
+        result="automatic-action/MDN-sent-automatically; processed",
+    )
+    _, _, partnership_id = _create_partnership(client, fake_uow)
+
+    response = client.post(
+        f"/api/v1/platform/trading-partners/as2/partnerships/{partnership_id}/test"
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["success"] is True
+    assert data["mdn_disposition"] == "processed"
+    assert data["reason"] is None
+
+
+def test_test_as2_partnership_failure_mdn_auth(client_factory, fake_uow):
+    """
+    Remote partner returns an 'authentication-failed' MDN.
+    The endpoint must return success=False with the disposition as the reason.
+    """
+    client = client_factory(
+        transport_ok=True,
+        result="automatic-action/MDN-sent-automatically; processed/error: authentication-failed",
+    )
+    _, _, partnership_id = _create_partnership(client, fake_uow)
+
+    response = client.post(
+        f"/api/v1/platform/trading-partners/as2/partnerships/{partnership_id}/test"
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["success"] is False
+    assert "authentication-failed" in data["reason"]
+
+
+def test_test_as2_partnership_connection_refused(client_factory, fake_uow):
+    """
+    Transport failure (no HTTP response received).
+    The endpoint must return success=False immediately without applying MDN rules.
+    """
+    client = client_factory(
+        transport_ok=False,
+        result="Connection refused: [Errno 111] Connection refused",
+    )
+    _, _, partnership_id = _create_partnership(client, fake_uow)
+
+    response = client.post(
+        f"/api/v1/platform/trading-partners/as2/partnerships/{partnership_id}/test"
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["success"] is False
+    assert "Connection refused" in data["reason"]
+
+
+def test_test_as2_partnership_not_found(client_factory):
+    """Returns 404 when the partnership ID does not exist in the database."""
+    client = client_factory()
+
+    response = client.post(
+        f"/api/v1/platform/trading-partners/as2/partnerships/{uuid.uuid4()}/test"
+    )
+
+    assert response.status_code == 404
diff --git a/services/api/tests/test_as2_receive_service.py b/services/api/tests/test_as2_receive_service.py
new file mode 100644
index 00000000..243bad1a
--- /dev/null
+++ b/services/api/tests/test_as2_receive_service.py
@@ -0,0 +1,228 @@
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
+from api.services.as2_receive_service import As2ReceiveService
+
+
+@pytest.fixture
+def mock_session():
+    return AsyncMock()
+
+
+@pytest.fixture
+def mock_vault():
+    return MagicMock()
+
+
+@pytest.fixture
+def mock_db_router():
+    return MagicMock()
+
+
+@pytest.fixture
+def service(mock_session, mock_vault, mock_db_router):
+    svc = As2ReceiveService(mock_session, mock_vault, mock_db_router)
+    svc.uow = AsyncMock()
+    return svc
+
+
+@pytest.mark.asyncio
+async def test_process_inbound_message_bad_request(service):
+    # Test step 1 failure: Bad Request parsing
+    headers = {"AS2-From": "me", "AS2-To": "you"}
+    body_bytes = b"bad body"
+
+    with patch("api.services.as2_receive_service.parse_as2_request") as mock_parse:
+        mock_parse.side_effect = ValueError("Missing headers")
+
+        with pytest.raises(ValueError, match="Bad Request: Missing headers"):
+            await service.process_inbound_message(headers, body_bytes)
+
+
+@pytest.mark.asyncio
+async def test_process_inbound_message_partnership_not_found(service):
+    # Test step 2 failure: Partnership lookup fails
+    headers = {"AS2-From": "unknown", "AS2-To": "unknown2"}
+    body_bytes = b"valid body"
+
+    with patch("api.services.as2_receive_service.parse_as2_request") as mock_parse:
+        mock_msg = MagicMock()
+        mock_msg.as2_from = "unknown"
+        mock_msg.as2_to = "unknown2"
+        mock_parse.return_value = mock_msg
+
+        service.uow.control_plane.get_partnership_by_as2_ids.return_value = None
+
+        with pytest.raises(ValueError, match="Partnership not configured"):
+            await service.process_inbound_message(headers, body_bytes)
+
+
+@pytest.mark.asyncio
+async def test_process_inbound_message_success(service):
+    headers = {"AS2-From": "p1", "AS2-To": "p2", "Message-ID": "123"}
+    body_bytes = b"valid body"
+
+    with patch("api.services.as2_receive_service.parse_as2_request") as mock_parse:
+        mock_msg = MagicMock()
+        mock_msg.as2_from = "p1"
+        mock_msg.as2_to = "p2"
+        mock_msg.message_id = "123"
+        mock_parse.return_value = mock_msg
+
+        mock_partnership = MagicMock()
+        mock_local_partner = MagicMock()
+        mock_remote_partner = MagicMock()
+
+        service.uow.control_plane.get_partnership_by_as2_ids.return_value = (
+            mock_partnership,
+            mock_local_partner,
+            mock_remote_partner,
+        )
+
+        with (
+            patch.object(service, "_retrieve_keys") as mock_keys,
+            patch.object(service, "_unbox_payload") as mock_unbox,
+            patch.object(service, "_extract_pure_edi") as mock_extract,
+            patch.object(service, "_save_to_data_plane") as mock_save,
+        ):
+            mock_keys.return_value = (None, None, None)
+            mock_unbox.return_value = (b"unboxed_payload", "mic123")
+            mock_extract.return_value = b"ISA*EDI"
+
+            body, mdn_headers = await service.process_inbound_message(headers, body_bytes)
+
+            assert "mic123" in body.decode()
+            mock_save.assert_awaited_once_with(
+                partnership=mock_partnership, as2_msg=mock_msg, pure_edi_bytes=b"ISA*EDI"
+            )
+
+
+@pytest.mark.asyncio
+async def test_private_methods_coverage(service):
+    # Test _retrieve_keys
+    local_partner = MagicMock(private_key_vault_ref="loc_priv", public_cert_vault_ref="loc_pub")
+    remote_partner = MagicMock(public_cert_vault_ref="rem_pub")
+    service.vault.retrieve_secret.return_value = b"secret_val"
+
+    local_priv, local_cert, remote_cert = service._retrieve_keys(local_partner, remote_partner)
+    assert local_priv == b"secret_val"
+    assert local_cert == b"secret_val"
+    assert remote_cert == b"secret_val"
+
+    # Test _extract_pure_edi
+    edi = service._extract_pure_edi(b"Content-Type: text/plain\r\n\r\nISA*EDI")
+    assert edi == b"ISA*EDI"
+
+    # Test _reconstruct_smime_headers
+    headers = {"content-type": "application/pkcs7-mime", "content-disposition": "attachment"}
+    smime_hdr = service._reconstruct_smime_headers(headers)
+    assert b"Content-Type: application/pkcs7-mime" in smime_hdr
+    assert b"Content-Transfer-Encoding: binary" in smime_hdr
+
+    # Test _save_to_data_plane (failure path)
+    service.global_session.execute = AsyncMock(
+        return_value=MagicMock(first=MagicMock(return_value=None))
+    )
+    with pytest.raises(ValueError, match="Tenant routing failed"):
+        await service._save_to_data_plane(MagicMock(tenant_id=1), MagicMock(), b"")
+
+
+@pytest.mark.asyncio
+async def test_crypto_pipeline_coverage(service):
+    # Mock verify_signature for the whole test since it is an external dependency we shouldn't test deeply here
+    with patch("api.services.as2_receive_service.verify_signature") as mock_verify:
+        mock_verify.return_value = (True, b"verified payload")
+
+        # Test _verify_and_calculate_mic (unsigned payload)
+        mic, verified = service._verify_and_calculate_mic(
+            b"Content-Type: text/plain\r\n\r\nunsigned payload", b"remote_cert", "msg-1"
+        )
+        assert mic is not None
+        assert verified == b"verified payload"
+
+        # Test _verify_and_calculate_mic with mock boundary
+        verify_entity = (
+            b"Content-Type: multipart/signed; boundary=abc\r\n\r\n--abc\r\nsome content\r\n--abc--"
+        )
+        mic, payload = service._verify_and_calculate_mic(verify_entity, b"rem_cert", "msg-1")
+        assert payload == b"verified payload"
+
+    # Test _decrypt_entity (fallback)
+    with patch("api.services.as2_receive_service.decrypt_payload") as mock_decrypt:
+        # First call fails, second call (fallback) succeeds
+        mock_decrypt.side_effect = [Exception("fail"), b"decrypted"]
+        res = service._decrypt_entity(b"content", {"content-type": "app/pkcs7"}, b"priv", b"cert")
+        assert res == b"decrypted"
+
+        # Both fail
+        mock_decrypt.side_effect = [Exception("fail1"), Exception("fail2")]
+        with pytest.raises(ValueError, match="Decryption failed"):
+            service._decrypt_entity(b"content", {"content-type": "app/pkcs7"}, b"priv", b"cert")
+
+    # Test _unbox_payload
+    with (
+        patch.object(service, "_decrypt_entity") as mock_decrypt,
+        patch.object(service, "_verify_and_calculate_mic") as mock_verify,
+    ):
+        mock_decrypt.return_value = (
+            b"Content-Type: application/pkcs7-signature\r\n\r\nsigned payload"
+        )
+        mock_verify.return_value = ("mic123", b"verified")
+
+        as2_msg = MagicMock(
+            payload=b"encrypted", is_encrypted=True, is_signed=False, message_id="123"
+        )
+
+        # Unbox an encrypted but not initially signed message (it becomes signed after decryption)
+        payload, mic = service._unbox_payload(as2_msg, {}, b"priv", b"loc_cert", b"rem_cert")
+
+        assert mic == "mic123"
+        assert payload == b"verified"
+        mock_decrypt.assert_called_once()
+        mock_verify.assert_called_once()
+
+    # Test _unbox_payload (unsigned, unencrypted)
+    as2_msg_plain = MagicMock(
+        payload=b"plain", is_encrypted=False, is_signed=False, message_id="123"
+    )
+    payload, mic = service._unbox_payload(as2_msg_plain, {}, None, None, None)
+    assert payload == b"plain"
+    assert mic is not None
+
+
+@pytest.mark.asyncio
+async def test_save_to_data_plane_success(service):
+    # Test _save_to_data_plane success path
+    mock_tenant = MagicMock(id=1)
+    mock_shard = MagicMock(dsn="sqlite:///:memory:")
+    mock_shard.name = "shard1"
+
+    mock_result = MagicMock()
+    mock_result.first.return_value = (mock_tenant, mock_shard)
+    service.global_session.execute = AsyncMock(return_value=mock_result)
+
+    mock_session = AsyncMock()
+
+    async def mock_async_gen():
+        yield mock_session
+
+    service.db_router.get_tenant_session = MagicMock(return_value=mock_async_gen())
+
+    with patch("api.services.as2_receive_service.SqlAlchemyDataPlaneRepository") as mock_repo_cls:
+        mock_repo = AsyncMock()
+        mock_repo.create_edi_message.return_value = "msg-1"
+        mock_repo_cls.return_value = mock_repo
+
+        mock_partnership = MagicMock(
+            tenant_id=1,
+            mdn_type="SYNC",
+            signature_algorithm="SHA256",
+            encryption_algorithm="AES256",
+        )
+        mock_as2_msg = MagicMock(as2_from="ME", as2_to="YOU", message_id="msg-1")
+
+        res = await service._save_to_data_plane(mock_partnership, mock_as2_msg, b"EDI")
+        assert res == "msg-1"
+        mock_repo.create_edi_message.assert_awaited_once()
+        mock_repo.create_outbox_event.assert_awaited_once()
+        mock_session.commit.assert_awaited_once()
diff --git a/services/api/tests/test_httpx_as2_tester.py b/services/api/tests/test_httpx_as2_tester.py
new file mode 100644
index 00000000..e18ae916
--- /dev/null
+++ b/services/api/tests/test_httpx_as2_tester.py
@@ -0,0 +1,226 @@
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import httpx
+import pytest
+from api.adapters.httpx_as2_tester import HttpxAS2TesterAdapter
+
+
+@pytest.fixture
+def adapter():
+    return HttpxAS2TesterAdapter()
+
+
+@pytest.mark.asyncio
+async def test_test_connection_success(adapter):
+    with (
+        patch("api.adapters.httpx_as2_tester.build_outbound_message") as mock_build,
+        patch("httpx.AsyncClient") as mock_client_cls,
+        patch("api.adapters.httpx_as2_tester.parse_mdn") as mock_parse,
+    ):
+        mock_msg = MagicMock()
+        mock_msg.body = b"mock_body"
+        mock_msg.headers = {"Content-Type": "application/edi-x12"}
+        mock_build.return_value = mock_msg
+
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.content = b"mdn content"
+        mock_response.headers = httpx.Headers({"Content-Type": "multipart/report"})
+
+        mock_client = AsyncMock()
+        mock_client.post.return_value = mock_response
+
+        # Async context manager mock
+        mock_client.__aenter__.return_value = mock_client
+        mock_client.__aexit__.return_value = None
+        mock_client_cls.return_value = mock_client
+
+        mock_mdn = MagicMock()
+        mock_mdn.disposition = "processed"
+        mock_parse.return_value = mock_mdn
+
+        success, disposition, payload_str, full_mdn = await adapter.test_connection(
+            remote_url="http://test.com",
+            as2_from="ME",
+            as2_to="YOU",
+            local_private_key_pem=None,
+            local_cert_pem=None,
+            remote_cert_pem=None,
+            encryption_algorithm="AES256",
+            signature_algorithm="SHA256",
+        )
+
+        assert success is True
+        assert disposition == "processed"
+        assert payload_str is not None
+        assert full_mdn is not None
+
+
+@pytest.mark.asyncio
+async def test_test_connection_build_fail(adapter):
+    with patch("api.adapters.httpx_as2_tester.build_outbound_message") as mock_build:
+        mock_build.side_effect = ValueError("build error")
+
+        success, reason, payload, mdn = await adapter.test_connection(
+            remote_url="http://test.com",
+            as2_from="ME",
+            as2_to="YOU",
+            local_private_key_pem=None,
+            local_cert_pem=None,
+            remote_cert_pem=None,
+            encryption_algorithm="AES256",
+            signature_algorithm="SHA256",
+        )
+
+        assert success is False
+        assert "build error" in reason
+
+
+@pytest.mark.asyncio
+async def test_test_connection_http_fail(adapter):
+    with (
+        patch("api.adapters.httpx_as2_tester.build_outbound_message") as mock_build,
+        patch("httpx.AsyncClient") as mock_client_cls,
+    ):
+        mock_build.return_value = MagicMock(body=b"", headers={})
+
+        mock_client = AsyncMock()
+        mock_client.post.side_effect = httpx.ConnectError("refused")
+        mock_client.__aenter__.return_value = mock_client
+        mock_client.__aexit__.return_value = None
+        mock_client_cls.return_value = mock_client
+
+        success, reason, payload, mdn = await adapter.test_connection(
+            remote_url="http://test.com",
+            as2_from="ME",
+            as2_to="YOU",
+            local_private_key_pem=None,
+            local_cert_pem=None,
+            remote_cert_pem=None,
+            encryption_algorithm="AES256",
+            signature_algorithm="SHA256",
+        )
+
+        assert success is False
+        assert "refused" in reason
+
+
+@pytest.mark.asyncio
+async def test_test_connection_http_500(adapter):
+    with (
+        patch("api.adapters.httpx_as2_tester.build_outbound_message") as mock_build,
+        patch("httpx.AsyncClient") as mock_client_cls,
+    ):
+        mock_build.return_value = MagicMock(body=b"", headers={})
+
+        mock_response = MagicMock(status_code=500, content=b"", headers=httpx.Headers())
+        mock_client = AsyncMock()
+        mock_client.post.return_value = mock_response
+        mock_client.__aenter__.return_value = mock_client
+        mock_client.__aexit__.return_value = None
+        mock_client_cls.return_value = mock_client
+
+        success, reason, payload, mdn = await adapter.test_connection(
+            remote_url="http://test.com",
+            as2_from="ME",
+            as2_to="YOU",
+            local_private_key_pem=None,
+            local_cert_pem=None,
+            remote_cert_pem=None,
+            encryption_algorithm="AES256",
+            signature_algorithm="SHA256",
+        )
+
+        assert success is False
+        assert "HTTP 500" in reason
+
+
+@pytest.mark.asyncio
+async def test_test_connection_parse_fail(adapter):
+    with (
+        patch("api.adapters.httpx_as2_tester.build_outbound_message") as mock_build,
+        patch("httpx.AsyncClient") as mock_client_cls,
+        patch("api.adapters.httpx_as2_tester.parse_mdn") as mock_parse,
+    ):
+        mock_build.return_value = MagicMock(body=b"", headers={})
+
+        mock_response = MagicMock(status_code=200, content=b"", headers=httpx.Headers())
+        mock_client = AsyncMock()
+        mock_client.post.return_value = mock_response
+        mock_client.__aenter__.return_value = mock_client
+        mock_client.__aexit__.return_value = None
+        mock_client_cls.return_value = mock_client
+
+        mock_parse.side_effect = ValueError("parse fail")
+
+        success, reason, payload, mdn = await adapter.test_connection(
+            remote_url="http://test.com",
+            as2_from="ME",
+            as2_to="YOU",
+            local_private_key_pem=None,
+            local_cert_pem=None,
+            remote_cert_pem=None,
+            encryption_algorithm="AES256",
+            signature_algorithm="SHA256",
+        )
+
+        assert success is False
+        assert "parse fail" in reason
+
+
+@pytest.mark.asyncio
+async def test_test_connection_timeout(adapter):
+    with (
+        patch("api.adapters.httpx_as2_tester.build_outbound_message") as mock_build,
+        patch("httpx.AsyncClient") as mock_client_cls,
+    ):
+        mock_build.return_value = MagicMock(body=b"", headers={})
+
+        mock_client = AsyncMock()
+        mock_client.post.side_effect = httpx.TimeoutException("timeout")
+        mock_client.__aenter__.return_value = mock_client
+        mock_client.__aexit__.return_value = None
+        mock_client_cls.return_value = mock_client
+
+        success, reason, payload, mdn = await adapter.test_connection(
+            remote_url="http://test.com",
+            as2_from="ME",
+            as2_to="YOU",
+            local_private_key_pem=None,
+            local_cert_pem=None,
+            remote_cert_pem=None,
+            encryption_algorithm="AES256",
+            signature_algorithm="SHA256",
+        )
+
+        assert success is False
+        assert "timed out" in reason
+
+
+@pytest.mark.asyncio
+async def test_test_connection_generic_exception(adapter):
+    with (
+        patch("api.adapters.httpx_as2_tester.build_outbound_message") as mock_build,
+        patch("httpx.AsyncClient") as mock_client_cls,
+    ):
+        mock_build.return_value = MagicMock(body=b"", headers={})
+
+        mock_client = AsyncMock()
+        mock_client.post.side_effect = Exception("generic error")
+        mock_client.__aenter__.return_value = mock_client
+        mock_client.__aexit__.return_value = None
+        mock_client_cls.return_value = mock_client
+
+        success, reason, payload, mdn = await adapter.test_connection(
+            remote_url="http://test.com",
+            as2_from="ME",
+            as2_to="YOU",
+            local_private_key_pem=None,
+            local_cert_pem=None,
+            remote_cert_pem=None,
+            encryption_algorithm="AES256",
+            signature_algorithm="SHA256",
+        )
+
+        assert success is False
+        assert "HTTP error" in reason
diff --git a/services/api/tests/test_routers_as2_receive_errors.py b/services/api/tests/test_routers_as2_receive_errors.py
new file mode 100644
index 00000000..b4a85656
--- /dev/null
+++ b/services/api/tests/test_routers_as2_receive_errors.py
@@ -0,0 +1,53 @@
+from unittest.mock import AsyncMock, patch
+
+import pytest
+from api.dependencies import get_global_session, get_vault
+from api.main import app
+from fastapi.testclient import TestClient
+
+
+@pytest.fixture
+def client():
+    app.dependency_overrides[get_global_session] = lambda: AsyncMock()
+    app.dependency_overrides[get_vault] = lambda: AsyncMock()
+    app.state.db_router = AsyncMock()
+    yield TestClient(app)
+    app.dependency_overrides.clear()
+    if hasattr(app.state, "db_router"):
+        delattr(app.state, "db_router")
+
+
+def test_as2_receive_value_error_generates_negative_mdn(client):
+    with patch("api.routers.trading_partners.as2_receive.As2ReceiveService") as mock_service_cls:
+        mock_service = AsyncMock()
+        mock_service.process_inbound_message.side_effect = ValueError(
+            "Test business logic rejection"
+        )
+        mock_service_cls.return_value = mock_service
+
+        response = client.post(
+            "/api/v1/as2/receive",
+            headers={"as2-to": "MY-ID", "as2-from": "PARTNER-ID", "message-id": "12345"},
+            content=b"some content",
+        )
+
+        assert response.status_code == 200
+        assert "multipart/report" in response.headers["content-type"]
+        assert b"unexpected-processing-error" in response.content
+
+
+def test_as2_receive_generic_exception_generates_negative_mdn(client):
+    with patch("api.routers.trading_partners.as2_receive.As2ReceiveService") as mock_service_cls:
+        mock_service = AsyncMock()
+        mock_service.process_inbound_message.side_effect = Exception("Internal explosion")
+        mock_service_cls.return_value = mock_service
+
+        response = client.post(
+            "/api/v1/as2/receive",
+            headers={"AS2-To": "MY-ID", "AS2-From": "PARTNER-ID", "Message-ID": "12345"},
+            content=b"some content",
+        )
+
+        assert response.status_code == 200
+        assert "multipart/report" in response.headers["content-type"]
+        assert b"unexpected-processing-error" in response.content
diff --git a/services/as2_server/tests/test_receive_as2.py b/services/as2_server/tests/test_receive_as2.py
index 74a525a4..00a10dd5 100644
--- a/services/as2_server/tests/test_receive_as2.py
+++ b/services/as2_server/tests/test_receive_as2.py
@@ -83,15 +83,27 @@ async def test_signed_as2_message_with_valid_cert_returns_processed_mdn(
         A real multipart/signed payload from a known Trading Partner
         should be verified successfully and return disposition: processed.
         """
+        import email
+
+        msg = email.message_from_bytes(signed_as2_payload)
+        real_content_type = msg.get("Content-Type")
+
         headers = _build_as2_headers(
             as2_from=sender_keypair.as2_id,
             as2_to="SOOPAEDI-AS2-ID",
             message_id="test-signed-001",
-            content_type='multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256',
+            content_type=real_content_type,
         )
-        response = await as2_client.post("/as2", content=signed_as2_payload, headers=headers)
+
+        # Strip MIME headers generated by OpenSSL to get just the body
+        idx = signed_as2_payload.find(b"\n\n")
+        idx_rn = signed_as2_payload.find(b"\r\n\r\n")
+        split_idx = idx_rn + 4 if idx_rn != -1 else (idx + 2 if idx != -1 else 0)
+        body = signed_as2_payload[split_idx:]
+        response = await as2_client.post("/as2", content=body, headers=headers)
 
         assert response.status_code == 200
+        assert b"processed" in response.content
         assert b"test-signed-001" in response.content
 
     async def test_as2_message_from_unknown_partner_returns_security_failed_mdn(
diff --git a/services/worker/src/worker/provision/main.py b/services/worker/src/worker/provision/main.py
index 7433a51e..03fb4172 100644
--- a/services/worker/src/worker/provision/main.py
+++ b/services/worker/src/worker/provision/main.py
@@ -122,7 +122,6 @@ async def replicate_tenant_config(
                 encryption_algorithm=global_ps.encryption_algorithm,
                 signature_algorithm=global_ps.signature_algorithm,
                 advanced_flags=global_ps.advanced_flags,
-                edi_version=global_ps.edi_version,
                 active=global_ps.active,
             )
             .on_conflict_do_update(
@@ -136,7 +135,6 @@ async def replicate_tenant_config(
                     "mdn_url": global_ps.mdn_url,
                     "encryption_algorithm": global_ps.encryption_algorithm,
                     "signature_algorithm": global_ps.signature_algorithm,
-                    "edi_version": global_ps.edi_version,
                     "advanced_flags": global_ps.advanced_flags,
                     "active": global_ps.active,
                 },
diff --git a/services/worker/tests/test_provision_worker.py b/services/worker/tests/test_provision_worker.py
index 9056784c..006e10cf 100644
--- a/services/worker/tests/test_provision_worker.py
+++ b/services/worker/tests/test_provision_worker.py
@@ -92,7 +92,7 @@ async def test_replicate_tenant_config() -> None:
     mock_ps.encryption_algorithm = "AES"
     mock_ps.signature_algorithm = "SHA"
     mock_ps.advanced_flags = None
-    mock_ps.edi_version = None
+
     mock_ps.active = True
 
     # replicate_tenant_config makes 6 global_session.execute calls for replication:
diff --git a/uv.lock b/uv.lock
index 516c9d48..a866568a 100644
--- a/uv.lock
+++ b/uv.lock
@@ -360,6 +360,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/5c/0a/a72d10ed65068e115044937873362e6e32fab1b7dce0046aeb224682c989/asgiref-3.11.1-py3-none-any.whl", hash = "sha256:e8667a091e69529631969fd45dc268fa79b99c92c5fcdda727757e52146ec133", size = 24345, upload-time = "2026-02-03T13:30:13.039Z" },
 ]
 
+[[package]]
+name = "asn1crypto"
+version = "1.5.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/de/cf/d547feed25b5244fcb9392e288ff9fdc3280b10260362fc45d37a798a6ee/asn1crypto-1.5.1.tar.gz", hash = "sha256:13ae38502be632115abf8a24cbe5f4da52e3b5231990aff31123c805306ccb9c", size = 121080, upload-time = "2022-03-15T14:46:52.889Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c9/7f/09065fd9e27da0eda08b4d6897f1c13535066174cc023af248fc2a8d5e5a/asn1crypto-1.5.1-py2.py3-none-any.whl", hash = "sha256:db4e40728b728508912cbb3d44f19ce188f218e9eba635821bb4b68564f8fd67", size = 105045, upload-time = "2022-03-15T14:46:51.055Z" },
+]
+
 [[package]]
 name = "ast-serialize"
 version = "0.5.0"
@@ -969,6 +978,7 @@ version = "0.1.0"
 source = { virtual = "." }
 dependencies = [
     { name = "cryptography" },
+    { name = "endesive" },
 ]
 
 [package.dev-dependencies]
@@ -983,7 +993,10 @@ dev = [
 ]
 
 [package.metadata]
-requires-dist = [{ name = "cryptography", specifier = ">=49.0.0" }]
+requires-dist = [
+    { name = "cryptography", specifier = ">=49.0.0" },
+    { name = "endesive", specifier = ">=2.19.3" },
+]
 
 [package.metadata.requires-dev]
 dev = [
@@ -1001,6 +1014,23 @@ name = "edi-grammar"
 version = "0.1.0"
 source = { editable = "libs/edi_grammar" }
 
+[[package]]
+name = "endesive"
+version = "2.19.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "asn1crypto" },
+    { name = "cryptography" },
+    { name = "lxml" },
+    { name = "paramiko" },
+    { name = "pillow" },
+    { name = "pykcs11" },
+    { name = "requests" },
+]
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a0/c3/a0dcae019de40816352462371c473b22639cd8e68f33a5f23f07faf330fd/endesive-2.19.3-py3-none-any.whl", hash = "sha256:e5e09c1011b1977fbb9d563d672de7f17f5638304ce57a35bf7d00f3b7a3972e", size = 349181, upload-time = "2026-01-12T22:04:24.177Z" },
+]
+
 [[package]]
 name = "fastapi"
 version = "0.138.1"
@@ -2130,6 +2160,91 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/20/8b/28c4eaec9d6b036a52cb44720408f26b1a143ca9bce76cc19e8f5de00ab4/pdfminer_six-20260107-py3-none-any.whl", hash = "sha256:366585ba97e80dffa8f00cebe303d2f381884d8637af4ce422f1df3ef38111a9", size = 6592252, upload-time = "2026-01-07T13:29:10.742Z" },
 ]
 
+[[package]]
+name = "pillow"
+version = "12.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/1c/3d/bb7fca845737cf9d7dbde16ed1843984665ff2e0a518f5db43e77ec540b9/pillow-12.3.0.tar.gz", hash = "sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce", size = 47025035, upload-time = "2026-07-01T11:56:38.965Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fb/c8/0a78b0e02d7ac54bc03e5321c9220da52f0c2ea83b21f7c40e7f3169c502/pillow-12.3.0-cp311-cp311-macosx_10_10_x86_64.whl", hash = "sha256:00808c5e14ef63ac5161091d242999076604ff74b883423a11e5d7bbb38bf756", size = 5392415, upload-time = "2026-07-01T11:53:47.162Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/5b/a02d30018abd97ced9f5a6c63d28597694a00d066516b9c1c6de45859fc9/pillow-12.3.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6", size = 4785266, upload-time = "2026-07-01T11:53:49.079Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/98/766667a4be768150a202836acd9fad19c06824ca86c4286d3cf6b274964e/pillow-12.3.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:bcb46e2f9feff8d06323983bd83ed00c201fdcab3d74973e7072a889b3979fcd", size = 6263814, upload-time = "2026-07-01T11:53:51.32Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/2d/ede717bc1144f63886c21fd349bb95860b0d1a21149ff16f2bb362b612b6/pillow-12.3.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:23d27a3e0307ec2244cc51e7287b919aa68d097504ebe19df4e76a98a3eea5bd", size = 6934408, upload-time = "2026-07-01T11:53:53.487Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/48/9c58b685e69d49c31af6c8eb9012055fab7e665785165c84796e2c73ce72/pillow-12.3.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:4f883547d4b7f0495ebe7056b0cc2aea76094e7a4abc8e933540f3271df27d9c", size = 6337160, upload-time = "2026-07-01T11:53:55.457Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/fa/dc2a5c0ba6df93f67c31d34b808b7ce440b40cdbf96f0b81cde1d1e6fa93/pillow-12.3.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:236ff70b9312fb68943c703aa842ca6a758abfa45ac187a5e7c1452e96ef72b5", size = 7045172, upload-time = "2026-07-01T11:53:57.736Z" },
+    { url = "https://files.pythonhosted.org/packages/86/a5/444817a4d4c4c2417df00513086ca196f388d8f9ef40c2e4ccd1ad1af54b/pillow-12.3.0-cp311-cp311-win32.whl", hash = "sha256:10e41f0fbf1eec8cfd234b8fe17a4caac7c9d0db4c204d3c173a8f9f6ef3232b", size = 6472232, upload-time = "2026-07-01T11:53:59.767Z" },
+    { url = "https://files.pythonhosted.org/packages/63/c6/4bad1b18d132a50b27e1365e1ab163616f7a5bb56d330f66f9d1d9d4f9d4/pillow-12.3.0-cp311-cp311-win_amd64.whl", hash = "sha256:8e95e1385e4998ae9694eeaa4730ba5457ff61185b3a55e2e7bea0880aef452a", size = 7233653, upload-time = "2026-07-01T11:54:02.066Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/16/00f91ab7760dc842f5aad55217e80fc4a7067a0604535249bc8a2d6d9870/pillow-12.3.0-cp311-cp311-win_arm64.whl", hash = "sha256:ebaea975e03d3141d9d3a507df75c9b3ec90fa9d2ffd07567b3a978d9d790b26", size = 2568195, upload-time = "2026-07-01T11:54:04.622Z" },
+    { url = "https://files.pythonhosted.org/packages/37/bf/fb3ebff8ddcb76aac5a01389251bbbb9519922a9b520d8247c1ca864a25d/pillow-12.3.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:ba09209fbe443b4acccebe845d8a138b89a8f4fbaeedd44953490b5315d5e965", size = 5345969, upload-time = "2026-07-01T11:54:06.397Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/66/9a386a92561f402389a4fc70c18838bf6d35eb5eb5c6850b4b2dc64f5048/pillow-12.3.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ffd0c5368496f41b0944be820fcb7a838aa6e623d250b01acf2643939c3f99d7", size = 4780323, upload-time = "2026-07-01T11:54:09.351Z" },
+    { url = "https://files.pythonhosted.org/packages/25/27/ac8f99618ffd3dde21db0f4d4b1d2ab00c0880595bfd17df103f7f39fd0c/pillow-12.3.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d9c7f76c0673154f044e9d78c8655fb4213f6ca31a836df48b40fe5d187717b9", size = 6266838, upload-time = "2026-07-01T11:54:11.71Z" },
+    { url = "https://files.pythonhosted.org/packages/84/21/a35af28dcc61f37ed850a2d64c65c701321dfbf25085e469d5559360cbbf/pillow-12.3.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91", size = 6940830, upload-time = "2026-07-01T11:54:13.732Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/51/8b08617af3ad95e33ce6d7dd2c99ed6c8298f7fb131636303956be022e25/pillow-12.3.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:e491916b378fba47242221bb9ead245211b70d504f495d105d17b14a24b4907c", size = 6344383, upload-time = "2026-07-01T11:54:15.756Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/72/cf78ac9780bb93c28328f408973845a309d4d145041665f734572ced1b52/pillow-12.3.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:0dd2064cbc55aaec028ef5fbb60fa47bb6c3e7918e07ff17935284b227a9d2df", size = 7052934, upload-time = "2026-07-01T11:54:17.721Z" },
+    { url = "https://files.pythonhosted.org/packages/20/20/25e0f4dc178a6bc0696793720055519a0de89e7661dae886992decbd2f81/pillow-12.3.0-cp312-cp312-win32.whl", hash = "sha256:dbce0b29841537a2fa4a214c2bbf14de3587c9680caa9b4e217568472490b28f", size = 6472684, upload-time = "2026-07-01T11:54:19.839Z" },
+    { url = "https://files.pythonhosted.org/packages/45/89/da2f7971a317f83d807fdd4065c0af40208e59e692cc43d315a71a0e96d1/pillow-12.3.0-cp312-cp312-win_amd64.whl", hash = "sha256:a2b55dd6b2a4c4b7d87ffa56bdb33fdc5fdb9a462173861a7bc097f17d91cb09", size = 7227137, upload-time = "2026-07-01T11:54:22.025Z" },
+    { url = "https://files.pythonhosted.org/packages/de/47/4845a0a6c0dbf1db8456bd9fc791f13c5ced7ced20606d08a0aacfd25b49/pillow-12.3.0-cp312-cp312-win_arm64.whl", hash = "sha256:331b624368d4f1d069149002f25f44bc61c8919ce8ddb3c45bdad8f6e2d89510", size = 2568267, upload-time = "2026-07-01T11:54:24.051Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/ac/31fb64e1e7efb5a4b50cd3d92049ba89ac6e4d8d3bb6a74e15048ca3353e/pillow-12.3.0-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:21900ce7ba264168cd50defae43cd75d25c833ad4ad6e73ffc5596d12e25ac89", size = 4161684, upload-time = "2026-07-01T11:54:25.934Z" },
+    { url = "https://files.pythonhosted.org/packages/87/b4/9805e23d2b4d77842b468513841fda254ee42f0289d25088340e4ff46e2d/pillow-12.3.0-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:4e8c2a84d977f50b9daed6eeaf3baef67d00d5d74d932288f02cb94518ee3ace", size = 4255487, upload-time = "2026-07-01T11:54:27.935Z" },
+    { url = "https://files.pythonhosted.org/packages/df/39/ecf519435a200c693fe053a6ee4d835b41cf963a4dfc2551c4e637cb2a71/pillow-12.3.0-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:ae26d61dfa7a47befdc7572b521024e8745f3d809bd95ca9505a7bba9ef849ec", size = 3696433, upload-time = "2026-07-01T11:54:29.813Z" },
+    { url = "https://files.pythonhosted.org/packages/42/92/2fc3ffad878ae8dd5469ec1bc8eb83b71f48e13efdf68f02709003982a32/pillow-12.3.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:7a743ff716f746fc19a9557f60dab1600d4613255f8a7aeb3cdde4db7eb15a66", size = 5345889, upload-time = "2026-07-01T11:54:31.97Z" },
+    { url = "https://files.pythonhosted.org/packages/10/76/8803c13605b763d33d156c4678fc77f8443389c0c51c8aef707bb02015f4/pillow-12.3.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:d69141514cc30b774ceea5e3ed3a6635c8d8a96edf664689b890f4089111fb35", size = 4780109, upload-time = "2026-07-01T11:54:34.026Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/01/e18aff37cb0b4aac47ac90f016d347a49aca667ef97f190b06ac2aabc928/pillow-12.3.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f7401aebd7f581d7f83a439d87d474999317ee099218e5ad25d125290990ba65", size = 6263736, upload-time = "2026-07-01T11:54:36.131Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/62/de5bdd77d935331f4f802edc11e4d82950f642caad6cb2f949837b8560e2/pillow-12.3.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0847a763afefb695bc912d7c131e7e0632d4edc1d8698f58ddabec8e46b8b6d3", size = 6937129, upload-time = "2026-07-01T11:54:38.216Z" },
+    { url = "https://files.pythonhosted.org/packages/70/4d/105627a13300c5e0df1d174230b32fd1273062c96f7745fd552b945d1e1d/pillow-12.3.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:571b9fcb07b97ef3a492028fb3d2dc0993ca23a06138b0315286566d29ef718a", size = 6339562, upload-time = "2026-07-01T11:54:40.354Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/1d/f13de01a553988ab895ba1c722e06cf3144d4f57656fd5b81b6d881f1179/pillow-12.3.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:756c768d0c9c2955feb7a56c37ea24aea2e369f8d36a88da270b6a9f19e62b5e", size = 7049439, upload-time = "2026-07-01T11:54:42.489Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/f9/066794cca041b969964f779ee5fa66a9498bbf34248ac39c5d7954e4198f/pillow-12.3.0-cp313-cp313-win32.whl", hash = "sha256:a876864214e136f0eb367788dbd7df045f4806801518e2cfe9e13229cfe06d8f", size = 6473287, upload-time = "2026-07-01T11:54:44.9Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/9b/7a58e61d62be561da3a356fe2384d4059a6345fc130e23ef1c36a5b81d24/pillow-12.3.0-cp313-cp313-win_amd64.whl", hash = "sha256:1cca606cd25738df4ed873d5ad46bbdb3d83b5cbca291f6b4ff13a4df6b0bbe8", size = 7239691, upload-time = "2026-07-01T11:54:47.141Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/b0/c4ed4f0ef8f8fa5ee8351537db6650bb8189f7e118842978dd6589065692/pillow-12.3.0-cp313-cp313-win_arm64.whl", hash = "sha256:b629de27fda84b42cde7edef0d85f13b958b47f6e9bbcbba9b673c562a89bd8b", size = 2568185, upload-time = "2026-07-01T11:54:49.137Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/01/001f65b68192f0228cc1dbbc8d2530ab5d58b61037ba0587f946fea607cd/pillow-12.3.0-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:9cf95fe4d0f84c82d282745d9bb08ad9f926efa00be4697e767b814ce40d4330", size = 4161736, upload-time = "2026-07-01T11:54:51.156Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/d2/0219746d0fd16fc8a84498e79452375be3797d3ce4044596ce565164b84f/pillow-12.3.0-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:8728f216dcdb6e6d555cf971cb34076139ad74b31fc2c14da4fafc741c5f6217", size = 4255435, upload-time = "2026-07-01T11:54:53.414Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/02/8d0bc62ef0302318c46ff2a512822d2610e81c7aa46c9b3abe6cbaca5ad0/pillow-12.3.0-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:a45650e8ce7fafffd731db8550230db6b0d306d181a90b67d3e6bca2f1990930", size = 3696262, upload-time = "2026-07-01T11:54:55.739Z" },
+    { url = "https://files.pythonhosted.org/packages/85/e2/73c77d218410b14f5f2d565e8a998d5317b7b9c75368d29985139f7a46f0/pillow-12.3.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:ba54cfebe86920a559a7c4d6b9050791c20513650a1952ebe3368c7dc70306f8", size = 5350344, upload-time = "2026-07-01T11:54:57.657Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/da/32c752228ae345f489e3a42499d817b6c3996da7e8a3bc7a04fc806b243b/pillow-12.3.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:e158cb00350dc278f3b91551101aa7d12415a66ebf2c91d8d5ac14e56ddd3ad0", size = 4780131, upload-time = "2026-07-01T11:54:59.713Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/9d/8b2c807dbef61a5197c047afe99823787eb66f63daf9fb2432f91d6f0462/pillow-12.3.0-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e9aeb04d6aef139de265b29683e119b638208f88cf73cdd1658aa07221165321", size = 6263757, upload-time = "2026-07-01T11:55:01.778Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/44/c85361f65dbe00eea8576ee467c768d25129989efb76e94f205e9ca9bb46/pillow-12.3.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:251bf95b67017e27b13d82f5b326234ca62d70f9cf4c2b9032de2358a3b12c7b", size = 6936962, upload-time = "2026-07-01T11:55:03.93Z" },
+    { url = "https://files.pythonhosted.org/packages/18/7e/e483414b35800b86b6f08dbbc7803fb5cd52c4d6f897f47d53ea2c7e6f65/pillow-12.3.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:fe3cca2e4e8a592be0f269a1ca4835c25199d9f3ce815c8491048f785b0a0198", size = 6339171, upload-time = "2026-07-01T11:55:05.989Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/f4/68c491844841ede6bed70189546b3ee9731cf9f2cbad396faff5e1ccba45/pillow-12.3.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:23aceaa007d6172b02c277f0cd359c79492bbb14f7072b4ede9fbcaf20648130", size = 7048116, upload-time = "2026-07-01T11:55:08.131Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/34/77f3f793fed8efc7d243f21b33c5a3f0d1c97ee70346d3db855587e155ff/pillow-12.3.0-cp314-cp314-win32.whl", hash = "sha256:af8d94b0db561cf68b88a267c5c44b49e134f525d0dc2cb7ed413a66bc23559a", size = 6467209, upload-time = "2026-07-01T11:55:10.408Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/e0/492879f69d94f91f60fc8cd05ba03650e9520afebb2fb7aa12777d7c7f38/pillow-12.3.0-cp314-cp314-win_amd64.whl", hash = "sha256:fdafc9cce40277e0f7a0feabce0ee50dd2fa1800f3b38015e51296b5e814048d", size = 7237707, upload-time = "2026-07-01T11:55:12.745Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/ac/6b11f2875f1c2ac040d84e1bbf9cf22a88038f901ca1037898b280b38365/pillow-12.3.0-cp314-cp314-win_arm64.whl", hash = "sha256:e91206ee562682b51b98ef4b26a6ef48fd84e15fd4c4bc5ec768eb641d206838", size = 2565995, upload-time = "2026-07-01T11:55:14.736Z" },
+    { url = "https://files.pythonhosted.org/packages/52/69/c2208e56af9bfc1913afb24020297a691eb1d4ef688474c8a04913f65e04/pillow-12.3.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:164b31cd1a0490ab6efae01aa5df49da7061be0af1b30e035b6e9a1bfe34ee6e", size = 5352503, upload-time = "2026-07-01T11:55:17.076Z" },
+    { url = "https://files.pythonhosted.org/packages/07/70/e5686d753e898a45d778ff1718dba8516ead6ab6b95d85fc8c4b70650cf2/pillow-12.3.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:5afb51d599ea772b8365ae807ae557f18bccfe46ab261fd1c2a9ed700fc6eb17", size = 4782956, upload-time = "2026-07-01T11:55:19.448Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/37/25c6692f06927ee973ff18c8d9ee98ad0b4d84ee67a09610c2dd1447958e/pillow-12.3.0-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3edce1d53195db527e0191f84b71d02022de0540bf43a16ed734ed7537b07385", size = 6322855, upload-time = "2026-07-01T11:55:21.613Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/91/420637fcb8f1bc11029e403b4538e6694744428d8246118e45719f944556/pillow-12.3.0-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bf16ba1b4d0b6b7c8e534936632270cf70eb00dbe09005bc345b2677b726855c", size = 6989642, upload-time = "2026-07-01T11:55:24.006Z" },
+    { url = "https://files.pythonhosted.org/packages/10/08/b94d7811281ccf0d143a1cf768d1c49e1e54af63e7b708ab2ee3eb87face/pillow-12.3.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:24870b09b224f7ae3c39ed07d10e819d06f8720bc551847b1d623832b5b0e28d", size = 6391281, upload-time = "2026-07-01T11:55:26.252Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/87/24233f785f55474dc02ce3e739c5528a77e3a862e9333d1dd7a25cc31f70/pillow-12.3.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:30f2aa603c41533cc25c05acd0da21636e84a315768feb631c937177db558931", size = 7096716, upload-time = "2026-07-01T11:55:28.318Z" },
+    { url = "https://files.pythonhosted.org/packages/23/26/fcb2f6e37175b04f53570b59937867e2b80ee1685e744023153028fc14f9/pillow-12.3.0-cp314-cp314t-win32.whl", hash = "sha256:4b0a7fe987b14c31ebda6083f74f22b561fd3739bc0ac51e019622e3d72668c7", size = 6474125, upload-time = "2026-07-01T11:55:30.956Z" },
+    { url = "https://files.pythonhosted.org/packages/90/de/3634abee5f1c9e13c56787b7d5517b0ba8d6de51700b95578cf338349c9f/pillow-12.3.0-cp314-cp314t-win_amd64.whl", hash = "sha256:962864dc93511324d51ddbb5b9f8731bf71675b93ca612a07441896f4688fb8c", size = 7242939, upload-time = "2026-07-01T11:55:34.044Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/2a/fd13f8eb24de5714a6eb444a3d67e2842c6c576e159a43793adf23051351/pillow-12.3.0-cp314-cp314t-win_arm64.whl", hash = "sha256:0740a512dc522224c77d9aa5a8d70d8b7d73fb91f2c21125d8d025d3b8990e45", size = 2567506, upload-time = "2026-07-01T11:55:35.988Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/dc/8fdce34ec725a33c81c6ba122b904d6b9024e50ea9ac7bede62fab54506c/pillow-12.3.0-cp315-cp315-ios_13_0_arm64_iphoneos.whl", hash = "sha256:0feb2e9d6ad6c9e3c06effe9d00f3f1e618a6643273576b016f591e9315a7139", size = 4162063, upload-time = "2026-07-01T11:55:37.941Z" },
+    { url = "https://files.pythonhosted.org/packages/76/66/2044b9a63d3b84ff048228dfcb7cd9bf0df983e8470971bf7d4c57b693de/pillow-12.3.0-cp315-cp315-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:9e881fca225083806662a5c43d627d215f258ff43c890f831966c7d7ba9c7402", size = 4255549, upload-time = "2026-07-01T11:55:40.022Z" },
+    { url = "https://files.pythonhosted.org/packages/52/7e/1f67e6f4ece6b582ee4b539decbcc9f848dc245a93ed8cd7338bafef72f1/pillow-12.3.0-cp315-cp315-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:4998562bf62a445225f22e07c896bb04b35b1b1f2eb6d760584c9c51d7a5f78c", size = 3696331, upload-time = "2026-07-01T11:55:41.98Z" },
+    { url = "https://files.pythonhosted.org/packages/12/40/d306fc2c8e4d45d7f175c77edca7063be7b86fe7fe6e68f4353bf71d808c/pillow-12.3.0-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:dc624f6bc473dacdf7ef7eb8678d0d08edf15cd94fad6ae5c7d6cc67a4e4902f", size = 5350370, upload-time = "2026-07-01T11:55:44.028Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/44/668fb1437e8ce420f62d6106eb66e44a5971602a4d794615bdf79315d82d/pillow-12.3.0-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:71d6097b330eea8fd15097780c8e89cb1a8ce7838669f48c5bacd6f663dd4701", size = 4780147, upload-time = "2026-07-01T11:55:46.073Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/08/93fa2e70e30a2d81547e481b6ee2bb9522117221fb1e0ce4b5df70967677/pillow-12.3.0-cp315-cp315-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:28ce87c5ab450a9dd970b52e5aca5fe63ed432d18a2eaddd1979a00a1ba24ace", size = 6273659, upload-time = "2026-07-01T11:55:48.264Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/6d/043e96ff814fc31a33077e4cba86082167db520c93632afdf2042febbb0c/pillow-12.3.0-cp315-cp315-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6b02afb9b97f65fbca5f31db6a2a3ba21aa93030225f150fa3f249717e938fb4", size = 6947439, upload-time = "2026-07-01T11:55:50.503Z" },
+    { url = "https://files.pythonhosted.org/packages/af/92/ba71d2ee2ac0edf3fa33bd9d5ee9ee080da70b1766f3ca3934f9938ddac9/pillow-12.3.0-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:1182d52bc2d5e5d7d0949503aa7e36d12f42205dc287e4883f407b1988820d39", size = 6353577, upload-time = "2026-07-01T11:55:52.697Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/ce/e63064e2122923ff687c8ad792d0d736a7b3920a56a46982e81a7fdd25d6/pillow-12.3.0-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:e795b7eb908249c4e43c7c99fac7c2c75dab0c43566e37db472a355f63693d71", size = 7060394, upload-time = "2026-07-01T11:55:55.149Z" },
+    { url = "https://files.pythonhosted.org/packages/54/76/a09cc3ccc8d773a7283d34c38bec1708f9e3cc932093cbc4c5e71ac4060b/pillow-12.3.0-cp315-cp315-win32.whl", hash = "sha256:57b3d78c95ba9059768b10e28b813002261d3f3dfc55cc48b0c988f625175827", size = 6467375, upload-time = "2026-07-01T11:55:57.769Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/03/1846c49ba3b1d5550392a4bbd06d6fb4578e1cd91a803198b5c90f5f7d53/pillow-12.3.0-cp315-cp315-win_amd64.whl", hash = "sha256:fa4ecea169a355be7a3ade2c783e2ed12f0e40d2c5621cda8b3297faf7fbb9f5", size = 7237048, upload-time = "2026-07-01T11:55:59.975Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/bb/89f35dcc79610423f9f195504d7def7f0d1416a711541b42867e25fe3412/pillow-12.3.0-cp315-cp315-win_arm64.whl", hash = "sha256:877c3f311ff35410f690861c4409e7ccbf0cd2f878e50628a28e5a0bb689e658", size = 2566006, upload-time = "2026-07-01T11:56:02.143Z" },
+    { url = "https://files.pythonhosted.org/packages/30/88/707027ba09942dfa2c28759b5c222d769290a41c6d20ea60ec250801941f/pillow-12.3.0-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:e9871b1ffbfa9656b60aeee92ed5136a5742696006fa322b29ea3d8da0ecc9cf", size = 5352509, upload-time = "2026-07-01T11:56:04.2Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/6d/00352fa25332c2569cd387851f568cc5a4b75a9adbfb37ac4fbce4c02eec/pillow-12.3.0-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:53aa02d20d10c3d814d536aa4e5ac9b84ca0ff5a88377963b085ad6822f93e64", size = 4783167, upload-time = "2026-07-01T11:56:06.631Z" },
+    { url = "https://files.pythonhosted.org/packages/13/4f/9e049dfa21af7c22427275720e2490267ba8138120add5c4c574deb69782/pillow-12.3.0-cp315-cp315t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:446c34dcc4324b084a53b705127dc15717b22c5e140ae0a3c38349d4efec071e", size = 6329237, upload-time = "2026-07-01T11:56:08.868Z" },
+    { url = "https://files.pythonhosted.org/packages/36/16/cf6eeaae8d0fce8dd390a33437cf68c5d5bd73834a2bc6e2f14efda0ab45/pillow-12.3.0-cp315-cp315t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:cf1845d02ad822a369a49f2bb9345b1614744267682e7a03527dc3bf6eea1777", size = 6997047, upload-time = "2026-07-01T11:56:11.379Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/69/dbf769bdd55f48bf5733cac28edc6364ffaa072ec9ba336266e4fe66be55/pillow-12.3.0-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:186941b6aef820ad110fb01fb06eb925374dc3a21b17e37ec9a53b250c6fe2d1", size = 6400440, upload-time = "2026-07-01T11:56:13.908Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/e1/ffc9cfc2eea0d178da8018e18e959301ad9d6bc9f3edb7181e748a474b97/pillow-12.3.0-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:f13c32a3abd6079a66d9526e18dad9b6d280384d49d7c54040cd57b6424041d9", size = 7105895, upload-time = "2026-07-01T11:56:16.575Z" },
+    { url = "https://files.pythonhosted.org/packages/18/f0/a5595c1e8c3ae44b9828cb2f0fa8155e5095ef04d6327b8f61cf44a3df85/pillow-12.3.0-cp315-cp315t-win32.whl", hash = "sha256:1657923d2d45afb66526e5b933e5b3052e6bdea196c90d3abb2424e18c77dae8", size = 6474384, upload-time = "2026-07-01T11:56:18.855Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/04/62bcd9f844984c5938d3b05264a61d797a29d3e0812341a8204af70bbdee/pillow-12.3.0-cp315-cp315t-win_amd64.whl", hash = "sha256:8cd2f7bdda092d99c9fc2fb7391354f306d01443d22785d0cbfafa2e2c8bb418", size = 7243537, upload-time = "2026-07-01T11:56:21.214Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/68/1f3066acedf37673694a7141381d8f811ae97f30d34413d236abe7d489f1/pillow-12.3.0-cp315-cp315t-win_arm64.whl", hash = "sha256:06ff022112bc9cbf83b60f8e028d94ad87b60621706487e65f673de61610ab59", size = 2567491, upload-time = "2026-07-01T11:56:23.506Z" },
+    { url = "https://files.pythonhosted.org/packages/75/18/2e8b40223153ccbc60df07f9e8928dc0c76202aa4e55ae9f53962b6510d6/pillow-12.3.0-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:b3c777e849237620b022f7f297dd67705f9f5cf1685f09f02e46f93e92725468", size = 5302510, upload-time = "2026-07-01T11:56:25.736Z" },
+    { url = "https://files.pythonhosted.org/packages/46/3e/51fabf59d5ab801ceab709453d3ab6b180083496579549de4c45ced6528a/pillow-12.3.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:b343699e8308bdc51978310e1c959c584e7869cc8c40780058c87da7781a1e94", size = 4736058, upload-time = "2026-07-01T11:56:28.041Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/20/22fe9384b7949e25fb1293bcfc84fb82590ff4ea6b37c95b24d26d793d86/pillow-12.3.0-pp311-pypy311_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:fbd139c8447d25dd750ab79ee274cc5e1fe80fc56340ab10b18a195e1b6eca3e", size = 5237776, upload-time = "2026-07-01T11:56:30.263Z" },
+    { url = "https://files.pythonhosted.org/packages/08/14/f6ba68107680ffa74b39985f3f30884e41318fbc4250caa423c79b4788bb/pillow-12.3.0-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e7e480451b9fa137494bccd3a7d69adbe8ac65a87d97be61e11f1b1050a5bac3", size = 5860358, upload-time = "2026-07-01T11:56:32.68Z" },
+    { url = "https://files.pythonhosted.org/packages/36/54/0169bc772ec491108b62f644f8ecf1fe5d8ae5ebafde2ee2142210166903/pillow-12.3.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:04f01d28a6aaff387bf842a13be313df23ba0597a44f1a976c9feb3c6ff4711a", size = 7231786, upload-time = "2026-07-01T11:56:35.046Z" },
+]
+
 [[package]]
 name = "pipeline"
 version = "0.1.0"
@@ -2492,6 +2607,21 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
 ]
 
+[[package]]
+name = "pykcs11"
+version = "1.5.18"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/22/07/0c2215cb6ef70c213892571eb015e670f4d6adbecedc5eb2369f82c1c7f2/pykcs11-1.5.18.tar.gz", hash = "sha256:12fd878b369821d80c1be8a140c85e8a0fb1358fcaaba66ca66869213692f227", size = 105555, upload-time = "2025-08-03T15:50:55.622Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/39/be/ed1ea0fd3c4aa18a79caad6810ce2edddf96d17b18fefc7195ce3231013a/PyKCS11-1.5.18-cp311-cp311-win32.whl", hash = "sha256:e82b21e5fc6fd1d254c7eec782dce1f6b3ec910ddaacdf479542e5255def06b4", size = 171338, upload-time = "2025-08-03T15:52:50.81Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/c9/a31b62f330edf85d7f1f368144aa22b2f185651ce0d7bb94460d550293d7/PyKCS11-1.5.18-cp311-cp311-win_amd64.whl", hash = "sha256:110b19f3fdf53ae002440edc7e4452aad5758f200f3209afa05db0c9e43da25f", size = 203857, upload-time = "2025-08-03T15:52:49.534Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/c7/57a7187923ff8c45caf60c81a7fe5ec5c94c84c7a3674d19659a6dacde31/pykcs11-1.5.18-cp312-cp312-win32.whl", hash = "sha256:505f7c5565934dcace4e4b70404792ae0ae7208e53d5b170d31873064d3d59c4", size = 170596, upload-time = "2025-08-03T15:52:53.047Z" },
+    { url = "https://files.pythonhosted.org/packages/70/b9/9b6d97a6898e97e3a49e0b5c9cc2e95b21005579e2aa2315b57711219e52/pykcs11-1.5.18-cp312-cp312-win_amd64.whl", hash = "sha256:5e900551bde66ea470d49ec1e7981f36680c87b74d004278ea8f28e9d53c74d6", size = 202826, upload-time = "2025-08-03T15:52:52.114Z" },
+    { url = "https://files.pythonhosted.org/packages/76/79/0483f5d7eae17b9276d3a352683174bd9794fe34a5eb61305eedecd331cb/pykcs11-1.5.18-cp313-cp313-macosx_15_0_x86_64.whl", hash = "sha256:a180fb431452f4ac5f0d8c8dae7cb664803d7f692465547b7720c820bc3d77ea", size = 199973, upload-time = "2025-08-03T15:50:54.14Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/a4/aee220e20a90a8c5a7cd9b4c8769a9fb98cac9603306e6c5fc2a68909e4f/pykcs11-1.5.18-cp313-cp313-win32.whl", hash = "sha256:331326adefca73021482b2edc27a7bb896061e0bd65de503787f52818cea3629", size = 170606, upload-time = "2025-08-03T15:52:55.194Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/5d/08cbcbbd897bb681a105bd5b85018c78fc0ee907a4e6858b69e51a2808d6/pykcs11-1.5.18-cp313-cp313-win_amd64.whl", hash = "sha256:2fb89ff22c03b8358b7329cffad709838697c86cf5c9ca500dffec1a1d1c0589", size = 202838, upload-time = "2025-08-03T15:52:54.269Z" },
+]
+
 [[package]]
 name = "pynacl"
 version = "1.6.2"
@@ -2729,12 +2859,14 @@ name = "security"
 version = "0.1.0"
 source = { editable = "libs/security" }
 dependencies = [
+    { name = "asn1crypto" },
     { name = "cryptography" },
     { name = "pyopenssl" },
 ]
 
 [package.metadata]
 requires-dist = [
+    { name = "asn1crypto", specifier = ">=1.5.1" },
     { name = "cryptography", specifier = ">=44.0.0" },
     { name = "pyopenssl", specifier = ">=26.3.0" },
 ]