From 14094e3a187612667380e648cd0a428532552315 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Thu, 20 Aug 2026 10:06:00 -0400 Subject: [PATCH] docs(archreview): file R3-05 residuals R1/R2 (Gitea #562/#563); execution notes --- .../plans/R3-05-acl-hot-path-expiry-plan.md | 32 +++++++++++++++++++ ...-05-acl-hot-path-expiry-plan.md.tasks.json | 2 +- 2 files changed, 33 insertions(+), 1 deletion(-) diff --git a/archreview/plans/R3-05-acl-hot-path-expiry-plan.md b/archreview/plans/R3-05-acl-hot-path-expiry-plan.md index 420f325c..6352f8f7 100644 --- a/archreview/plans/R3-05-acl-hot-path-expiry-plan.md +++ b/archreview/plans/R3-05-acl-hot-path-expiry-plan.md @@ -749,3 +749,35 @@ for the orchestrator. - **Beyond the plan's file list:** `docs/Configuration.md` gained rows for all three new keys. It carries the field-by-field tables for `Security:ApiKeys` and `Security:Acl`, so shipping the knobs without them would have been the exact doc drift this plan's cross-cutting requirement is about. + +### T12 — residuals filed + +- **R1** → Gitea **#562** — *ACL: event/alarm monitored items are revalidated by neither trigger* + (`https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/562`). +- **R2** → Gitea **#563** — *ACL: an expired API key keeps its session's roles while + `Security:Acl:Enabled` is false* (`https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/563`). +- **R3** (activation-time revocation now bounded by `StoreCacheSeconds`) needs no issue — it is documented + behaviour after T10, in both `docs/security.md` and `docs/Configuration.md`. + +### T11 — LIVE GATE + +**Left `pending` for the orchestrator**, per the execution brief. Nothing in this branch has been run +against the docker-dev rig; the nine-step recipe in Finding 2 → Live gate is unchanged and still applies. +Two notes for whoever runs it: + +- `Security:Acl:RevalidationIntervalSeconds` defaults to 60, so step 6's "within one revalidation + interval" is ≤ 60 s unless the rig overrides it. Setting it to `15` shortens the wall-clock wait without + changing what is proven. +- Step 8's cache-hit leg reads `otopcua.opcua.apikey_store.bounded{outcome=cache_hit}`; the instrument only + exists on an **admin/fused** node, since the artifact store is not wrapped. + +### Summary of what a reviewer should look at + +1. **`Program.cs` → `DataPlaneAuthRegistration`** (T1): a verbatim move of the authorizer + key-store + branches out of top-level statements so they could be guarded. Confirm no branch changed. +2. **`OtOpcUaServerHostedServiceRevalidationTests`** (T8): the plan's dispose-**before**-`SetDataPlaneAuthorizer(null)` + ordering is guaranteed structurally but **not asserted** — see T8's notes for why it is unobservable. +3. **`BoundedApiKeyStore.IsExpired`** (T3): a two-line fail-closed addition beyond the plan, so the TTL + cannot resurrect a clock-expired key. +4. New public members added purely so wiring could be pinned by reference: `DataPlaneAuthorizer.Clock`, + `BoundedApiKeyStore.Inner` / `.Clock`. diff --git a/archreview/plans/R3-05-acl-hot-path-expiry-plan.md.tasks.json b/archreview/plans/R3-05-acl-hot-path-expiry-plan.md.tasks.json index 46077638..82045b5b 100644 --- a/archreview/plans/R3-05-acl-hot-path-expiry-plan.md.tasks.json +++ b/archreview/plans/R3-05-acl-hot-path-expiry-plan.md.tasks.json @@ -94,7 +94,7 @@ { "id": "T12", "subject": "File residuals R1 (event monitored items revalidated by nothing) and R2 (expired key retains roles while Security:Acl:Enabled=false)", - "status": "pending", + "status": "done", "blockedBy": [] } ]