test(mqtt): C# Sparkplug edge-node simulator + §3.6 live matrix

Adds a project-owned, controllable Sparkplug B edge node (SparkplugEdgeNode) that
encodes with the SAME generated Tahu schema the driver decodes with — so the live
gate checks encode/decode symmetry rather than the driver against itself — and
drives the §3.6 matrix end-to-end over the real TLS+auth Mosquitto fixture.

The simulator frames its topics independently of SparkplugTopic.Format: a
simulator borrowing the parser's formatter could not detect a bug in it, because
both sides of the comparison would be wrong together. It registers a real NDEATH
Last Will at CONNECT, restarts seq at 0 on NBIRTH, publishes DATA metrics as
alias-only, carries bdSeq per session, and encodes signed ints as two's
complement in the unsigned proto field.

SparkplugLiveTests (Category=LiveIntegration, env-gated, skip-clean) covers:
birth -> alias-only data -> OnDataChange under the RawPath; late-join rebirth
NCMD honoured by an independent decoder; alias reuse across a rebirth routing by
metric NAME; a stale-bdSeq NDEATH ignored while the current one stales; the real
broker-published Will staling and the next birth restoring; seq wrap 255->0
requesting no rebirth while a deliberate gap does; and the browser's passive
window asserted ON THE WIRE (a third client watching spBv1.0/{group}/NCMD/#),
plus RequestRebirthAsync node-vs-group enumeration.

Two things make the suite falsifiable rather than decorative: the seq-wrap test
builds its ingestor with rebirthDebounce: TimeSpan.Zero (at the shipped 10s
default a wrap-triggered NCMD would be swallowed and the test would pass for the
wrong reason) and pairs the silence with a deliberate gap that must produce one;
and the passivity assertion observes the broker rather than the session's own
publish counter, which can only see the seam it guards.

Docker/docker-compose.yml gains a profile-gated `sparkplug-sim` service running
the same engine standalone against the same broker (TLS, CA-pinned) — a manual
driving aid for the AdminUI picker, deliberately NOT a test dependency, since the
matrix needs an edge node it can command mid-test. Its app directory is publish
output (publish-simulator.sh), gitignored like secrets/.

Offline: 15 skipped, 0 failed with no env set. Live: 15/15 passed against
10.100.0.35:8883. Falsifiability spot-check: mutating AliasTable.RebuildFromBirth
to merge instead of replace, and neutering SparkplugCodec.ReinterpretSigned for
Int32, turned exactly the two corresponding tests red and nothing else; both
mutations reverted.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW
This commit is contained in:
Joseph Doherty
2026-07-24 23:18:08 -04:00
parent 64ec7aa43a
commit 767e7031b3
11 changed files with 2265 additions and 4 deletions
@@ -5,6 +5,11 @@
# git; its output is regenerated per machine.
secrets/
# Build output of publish-simulator.sh — the `sparkplug-sim` service's bind-mounted app
# directory. Regenerated per machine from the SparkplugSimulator project, exactly like
# secrets/ is regenerated by gen-fixture-material.sh; the SCRIPT is the artifact in git.
simulator/app/
# Belt-and-braces: catch key/cert material written directly into this directory by a
# hand-run openssl command that forgot the secrets/ prefix.
*.key
@@ -1,4 +1,5 @@
# MQTT integration-test fixture — Eclipse Mosquitto (auth + TLS) + a JSON publisher.
# MQTT integration-test fixture — Eclipse Mosquitto (auth + TLS) + a JSON publisher
# + an optional Sparkplug B edge-node simulator.
#
# PREREQUISITE — run this first, in this directory:
#
@@ -15,9 +16,10 @@
#
# Endpoints: 10.100.0.35:8883 (TLS + auth) · 10.100.0.35:1883 (plaintext + auth, smoke)
#
# Unlike the Modbus / S7 fixtures there are no compose profiles: both services are
# always wanted together (a broker with nothing publishing into it tests nothing), and
# they bind different ports so nothing contends.
# `mosquitto` + `publisher` carry no profile: they are always wanted together (a broker
# with nothing publishing into it tests nothing) and they bind different ports so nothing
# contends. `sparkplug-sim` DOES carry one (`--profile sparkplug`), because it is a
# manual-driving aid rather than a test dependency — see its own banner.
services:
mosquitto:
image: eclipse-mosquitto:2.0.22
@@ -75,3 +77,49 @@ services:
MQTT_FIXTURE_USERNAME: ${MQTT_FIXTURE_USERNAME:?set MQTT_FIXTURE_USERNAME}
MQTT_FIXTURE_PASSWORD: ${MQTT_FIXTURE_PASSWORD:?set MQTT_FIXTURE_PASSWORD}
entrypoint: ["/bin/sh", "/publish.sh"]
# ---------------------------------------------------------------------------
# Sparkplug B edge-node simulator — the SAME `SparkplugEdgeNode` engine the live
# tests drive, run standalone (see SparkplugSimulator/Program.cs).
#
# WHAT IT IS FOR, AND WHAT IT IS NOT FOR. It exists so an operator (and the Task-26
# AdminUI `/run` verification) has a live Sparkplug plant to point the address picker
# at: NBIRTH/DBIRTH then N/DDATA every couple of seconds, honouring rebirth NCMDs.
# `SparkplugLiveTests` does NOT use it and must not — the §3.6 matrix needs an edge
# node it can command mid-test ("now reuse that alias", "now skip a seq", "now die"),
# which a container cannot be. Hence the profile: the default `docker compose up`
# leaves it out, and nothing in the test suite depends on it.
#
# PREREQUISITE: `./publish-simulator.sh` — the app directory below is build output,
# gitignored and rsynced like the rest of this folder. Without it the container has
# nothing to run.
# ---------------------------------------------------------------------------
sparkplug-sim:
image: mcr.microsoft.com/dotnet/runtime:10.0
container_name: otopcua-sparkplug-sim
profiles: ["sparkplug"]
restart: unless-stopped
labels:
project: lmxopcua
depends_on:
mosquitto:
condition: service_healthy
volumes:
# Framework-dependent publish output: portable IL, so it runs under the stock
# runtime image whatever this file was rsynced from.
- ./simulator/app:/app:ro
# The fixture CA, so the simulator PINS the broker exactly as the driver does
# rather than trusting anything. The cert's SAN list includes DNS:mosquitto (see
# gen-fixture-material.sh), which is the host name used below.
- ./secrets/ca.crt:/secrets/ca.crt:ro
environment:
MQTT_SIM_HOST: mosquitto
MQTT_SIM_PORT: "8883"
MQTT_SIM_USE_TLS: "true"
MQTT_SIM_CA_CERT: /secrets/ca.crt
MQTT_SIM_GROUP: ${MQTT_SIM_GROUP:-OtOpcUaSim}
MQTT_SIM_NODES: ${MQTT_SIM_NODES:-EdgeA,EdgeB}
MQTT_SIM_INTERVAL_SECONDS: ${MQTT_SIM_INTERVAL_SECONDS:-2}
MQTT_FIXTURE_USERNAME: ${MQTT_FIXTURE_USERNAME:?set MQTT_FIXTURE_USERNAME}
MQTT_FIXTURE_PASSWORD: ${MQTT_FIXTURE_PASSWORD:?set MQTT_FIXTURE_PASSWORD}
command: ["dotnet", "/app/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.SparkplugSimulator.dll"]
@@ -0,0 +1,41 @@
#!/usr/bin/env sh
# ---------------------------------------------------------------------------
# Publishes the Sparkplug edge-node simulator into ./simulator/app/, which the
# compose file's `sparkplug-sim` service bind-mounts and runs.
#
# WHY A PUBLISHED DIRECTORY RATHER THAN AN IMAGE BUILD. This fixture is deployed by
# rsyncing THIS directory to /opt/otopcua-mqtt on the Docker host (see the compose
# banner and infra/README.md §1) — the host never sees the repo, so a Dockerfile whose
# build context is the solution root could not run there. A framework-dependent publish
# is portable IL: it runs unchanged under the stock dotnet/runtime image on the host,
# whatever this machine's architecture is.
#
# Usage, from a checkout (needs the .NET 10 SDK):
#
# ./publish-simulator.sh
# rsync -av --exclude 'secrets/' ./ dohertj2@10.100.0.35:/opt/otopcua-mqtt/
# ssh dohertj2@10.100.0.35 'cd /opt/otopcua-mqtt \
# && MQTT_FIXTURE_USERNAME=otopcua MQTT_FIXTURE_PASSWORD=<same> \
# docker compose --profile sparkplug up -d'
#
# ./simulator/app/ is gitignored: it is build output, regenerated per machine, exactly
# like ./secrets/.
# ---------------------------------------------------------------------------
set -eu
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
PROJECT="$SCRIPT_DIR/../SparkplugSimulator/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.SparkplugSimulator.csproj"
OUT="$SCRIPT_DIR/simulator/app"
command -v dotnet >/dev/null 2>&1 || { echo "error: dotnet SDK not found on PATH." >&2; exit 2; }
[ -f "$PROJECT" ] || { echo "error: simulator project not found at $PROJECT" >&2; exit 2; }
echo "==> publishing $(basename "$PROJECT") -> $OUT"
rm -rf "$OUT"
dotnet publish "$PROJECT" -c Release -o "$OUT" --nologo
echo "==> done:"
ls -1 "$OUT" | head -20
echo
echo "Next: rsync this directory to the Docker host and bring the stack up with"
echo " docker compose --profile sparkplug up -d"