From 7154ec8f04ee3d61bac289ad5b181487b4435215 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Mon, 13 Jul 2026 18:58:19 -0400 Subject: [PATCH] docs(archreview): record R2-06 live gate attempt (3/6 green; RuntimeDb Windows-auth + gateway EnsureTags blockers) --- ...erverhistorian-failfast-plan.md.tasks.json | 2 +- archreview/plans/STATUS.md | 47 +++++++++++++++++++ 2 files changed, 48 insertions(+), 1 deletion(-) diff --git a/archreview/plans/R2-06-serverhistorian-failfast-plan.md.tasks.json b/archreview/plans/R2-06-serverhistorian-failfast-plan.md.tasks.json index df0fa5f5..72512374 100644 --- a/archreview/plans/R2-06-serverhistorian-failfast-plan.md.tasks.json +++ b/archreview/plans/R2-06-serverhistorian-failfast-plan.md.tasks.json @@ -94,7 +94,7 @@ "T9", "T11" ], - "note": "needs live gateway over VPN; needs-user / serial live pass" + "note": "ATTEMPTED 2026-07-13 on VPN vs a real 0.2.0 gateway (deployed locally in Docker → real AVEVA historian on wonder-sql-vd03). 3/6 green (read, alarm SendEvent-ack, EnsureTags-observable). Blocked: RuntimeDb SQL path needs Windows-auth as NAM\\dohertj2 (a Linux container can't SQL-auth a WINDOWS_LOGIN) → tests 2/3; and gateway EnsureTags returns ArgumentOutOfRangeException on this deployment (gateway-side) → test 5. U-7 retype policy STILL UNDETERMINED live (EnsureTags errors before a real Float→Int1 accept/reject). Deployment fixes made: FQDN Historian__Host + libgssapi-krb5-2/gss-ntlmssp in the gateway image. Full record in STATUS.md." } ] } diff --git a/archreview/plans/STATUS.md b/archreview/plans/STATUS.md index 41061fea..a5c375a8 100644 --- a/archreview/plans/STATUS.md +++ b/archreview/plans/STATUS.md @@ -291,3 +291,50 @@ gates (R2-06 VPN, R2-08 live LDAP, R2-01 S7 blackhole) still need their infra. `using …Core.Abstractions.Historian;` in ~11 consumers (no behavioral change). **Gitea PR #438 → master `50e04707`.** Verified: Core.Abstractions `129/129` (was 128/129), Runtime historian+DI `72/72`, Gateway driver unit `102/102`, full solution build `0 errors`. + +--- + +## R2-06 live gate (T12) — attempted on the VPN, 3/6 green (2026-07-13) + +The R2-06 `Category=LiveIntegration` gate was run against a **real 0.2.0 `ZB.MOM.WW.HistorianGateway`** deployed +locally in Docker (`~/Desktop/HistorianGateway/docker`, republished at 0.2.0) pointed at the **real AVEVA +Historian** on `wonder-sql-vd03.zmr.zimmer.com:32565` + Galaxy SQL on `wonder-app-vd03`, over the corporate VPN. +OtOpcUa's `GatewayLiveFixture` connected h2c to the local gateway (`http://localhost:5221`, +`HISTGW_GATEWAY_ALLOW_UNTRUSTED=true` since h2c ⇒ no cert validation; gateway `ApiKeys:Mode=Disabled`, placeholder key). + +**Two real deployment fixes were needed** (both in the sibling `HistorianGateway/docker/`, local-only): +1. **DNS** — the base compose set the *short* name `Historian__Host: wonder-sql-vd03`, which does not resolve + inside the container; overrode it to the FQDN (Galaxy/RuntimeDb already used FQDNs). +2. **Kerberos/NTLM libs** — the historian **v6 session path** (reads + `EnsureTags`) and the SQL path authenticate + the Windows account `Historian__UserName=NAM\dohertj2` via .NET Negotiate/GSSAPI, which `aspnet:10.0` doesn't + ship. Without `libgssapi_krb5.so.2` every read/tag op failed with `InvalidOperationException`; adding + `libgssapi-krb5-2 gss-ntlmssp` to `docker/Dockerfile` fixed the historian path. (The **v8 event path** — + `SendEvent` — uses ECDH, not GSSAPI, so it worked before the fix.) + +**Result — 3/6 PASS:** +- ✅ `Galaxy_tag_read_round_trip` (ReadRaw `SysTimeSec`) — historian gRPC read path live. +- ✅ `Alarm_SendEvent_is_acked` — the alarm `SendEvent` (v8 event) path live. +- ✅ `EnsureTags_type_change_outcome_is_observable` — passes on the *observability* contract (see caveat below). + +**3/6 blocked (not OtOpcUa/R2-06 code defects):** +- ❌ `Write_then_read_on_sandbox_tag`, `Alarm_SendEvent_then_ReadEvents` — the **RuntimeDb SQL path** + (`WriteLiveValues` / SQL `ReadEvents`) must authenticate as `NAM\dohertj2`, a **WINDOWS_LOGIN** (verified via + `sys.server_principals`). A Linux container can't SQL-auth as a Windows login (host `sqlcmd` works only because + the go driver auto-negotiates NTLM); even with `gss-ntlmssp` present, `Encrypt=True` + explicit domain creds + didn't connect (`SQL event read failed` / write not acked). The account is *correct* (it has INSERT on + `Runtime.dbo.History` + SELECT on `dbo.Events`); the **auth mechanism** isn't available to a Mac container without + a `kinit` TGT against the NAM realm. Environmental, not a code defect. +- ❌ `EnsureTags_boolean_sandbox_provisions_as_Int1` — the gateway's `EnsureTags` returns + `ArgumentOutOfRangeException` for **every** definition (even a fresh Float create, reproduced directly via + `grpcurl`), *after* auth succeeds. This is a **gateway-side** issue (HistorianGateway's own live tests report + `EnsureTags` provisioning works against `wonder-sql-vd03`, so it's env/transport/version-specific — possibly the + `RemoteGrpc` transport not serving tag-config mutations); the gateway maps it to a bare type-name and logs no + stack even at Debug, so the detail isn't observable without instrumenting the gateway/histsdk itself. + +**⚠️ U-7 retype policy — still UNDETERMINED live.** Because `EnsureTags` errors on this deployment, the retype +probe (test 6) passes only by observing the generic `ArgumentOutOfRangeException` — it does **not** exercise a real +Float→Int1 accept/reject. So the 06/U-7 assessment note's three hypotheses (accepted-versioned / +accepted-retyped / rejected) remain open pending a working gateway `EnsureTags` on a real historian. The R2-06 +**code** deliverables (S-11 fail-fast + `ServerHistorianOptionsValidator`; U-7 Boolean→Int1 mapping + upsert +semantics; C-7 doc) are all unit-covered and merged; this note records that the live *policy capture* leg is +still outstanding, gated on the gateway `EnsureTags` fix + a SQL-auth path for the RuntimeDb tests.