Resolve all 46 low-severity architecture review findings

2026-09-09 22:56:36 -04:00
parent fef3e7675f
commit 9ee402bbcd
139 changed files with 2621 additions and 1082 deletions
@@ -499,3 +499,16 @@ mapped gRPC methods can execute on the control-plane socket; they are rejected o
 sockets. Dedicated metrics sockets expose metrics and health only. Decisions use LocalPort and
 endpoint metadata, never the caller's Host/authority header. The env2 central/site pairs now enable
 the same deterministic bootstrap guard as the main rig for simultaneous container recreation.
+
+
+### Transport hardening (2026-09-09 Low review)
+
+Central and site Kestrel servers use the same HTTP/2 keepalive settings. Central's optional
+metrics listener exposes metrics/health only under listener isolation; it does not grant access
+to the control plane or UI. The gRPC socket likewise rejects ordinary HTTP endpoints.
+`ScadaBridge:Communication:ConnectedHeaderTimeout` (default 10 seconds) belongs to each client;
+when headers do not arrive, only an actual first event signals a connected stream.
+Reconciliation pulls accept 1–2000 rows and also obey the serialized wire-byte budget.
+SiteStreamService's legacy ingest RPCs return `Unimplemented`; central ingestion uses
+CentralControlService. Replaced channel pairs remain parked until both the idle grace and
+all current calls have finished, including long attribute waits.