Merge branch 'fix/archreview-c1-wire-analyzer'

2026-07-09 06:07:33 -04:00
parent 9cad9ed0fc f0082af5b9
commit 7834b3b71f
17 changed files with 119 additions and 0 deletions
@@ -30,4 +30,23 @@
  <ItemGroup>
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
  </ItemGroup>
+
+  <!--
+    Wire the custom OTOPCUA0001 analyzer (UnwrappedCapabilityCallAnalyzer) into every project so
+    the CapabilityInvoker-wrapping rule is enforced tree-wide, not just against the analyzer's own
+    unit tests (arch-review 07/C-1 — the "built-but-never-wired" failure mode). Analyzer projects
+    target netstandard2.0 and are loaded into the compiler host, so OutputItemType="Analyzer" +
+    ReferenceOutputAssembly="false" is the correct incantation (the DLL is not linked). Excluded
+    from the analyzer project itself (self-reference cycle) and its test project (which already
+    references the analyzer directly). OTOPCUA0001 defaults to Warning; projects with genuine
+    intentional unwrapped calls (unit tests exercising drivers at the wire level, the invoker's own
+    internals) carry a scoped NoWarn / pragma — see the per-project suppressions.
+  -->
+  <ItemGroup Condition="'$(MSBuildProjectName)' != 'ZB.MOM.WW.OtOpcUa.Analyzers'
+                        and '$(MSBuildProjectName)' != 'ZB.MOM.WW.OtOpcUa.Analyzers.Tests'">
+    <ProjectReference Include="$(MSBuildThisFileDirectory)src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/ZB.MOM.WW.OtOpcUa.Analyzers.csproj"
+                      OutputItemType="Analyzer"
+                      ReferenceOutputAssembly="false"
+                      PrivateAssets="all" />
+  </ItemGroup>
 </Project>
@@ -68,7 +68,9 @@ public class GenericDriverNodeManager(IDriver driver) : IDisposable
            throw new NotSupportedException($"Driver '{Driver.DriverInstanceId}' does not implement ITagDiscovery.");

        var capturing = new CapturingBuilder(builder, _alarmSinks);
+#pragma warning disable OTOPCUA0001 // RESILIENCE-DISPATCH-GAP (07/C-1): dispatch bypasses CapabilityInvoker — Phase 6.1 pipeline built but never wired into GenericDriverNodeManager; tracked, NOT intentional.
        await discovery.DiscoverAsync(capturing, ct);
+#pragma warning restore OTOPCUA0001

        if (Driver is IAlarmSource alarmSource)
        {
@@ -1,5 +1,12 @@
 <Project Sdk="Microsoft.NET.Sdk">

+  <!-- OTOPCUA0001 (arch-review 07/C-1): this manual-testing CLI invokes driver capability methods
+       DIRECTLY for one-shot probe/read/write/subscribe diagnostics — not the resilient runtime dispatch
+       path, so CapabilityInvoker wrapping does not apply. Suppressed project-wide. -->
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);OTOPCUA0001</NoWarn>
+  </PropertyGroup>
+
    <PropertyGroup>
        <OutputType>Exe</OutputType>
        <TargetFramework>net10.0</TargetFramework>
@@ -1,5 +1,12 @@
 <Project Sdk="Microsoft.NET.Sdk">

+  <!-- OTOPCUA0001 (arch-review 07/C-1): this manual-testing CLI invokes driver capability methods
+       DIRECTLY for one-shot probe/read/write/subscribe diagnostics — not the resilient runtime dispatch
+       path, so CapabilityInvoker wrapping does not apply. Suppressed project-wide. -->
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);OTOPCUA0001</NoWarn>
+  </PropertyGroup>
+
    <PropertyGroup>
        <OutputType>Exe</OutputType>
        <TargetFramework>net10.0</TargetFramework>
@@ -1,5 +1,12 @@
 <Project Sdk="Microsoft.NET.Sdk">

+  <!-- OTOPCUA0001 (arch-review 07/C-1): this manual-testing CLI invokes driver capability methods
+       DIRECTLY for one-shot probe/read/write/subscribe diagnostics — not the resilient runtime dispatch
+       path, so CapabilityInvoker wrapping does not apply. Suppressed project-wide. -->
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);OTOPCUA0001</NoWarn>
+  </PropertyGroup>
+
    <PropertyGroup>
        <OutputType>Exe</OutputType>
        <TargetFramework>net10.0</TargetFramework>
@@ -1,5 +1,12 @@
 <Project Sdk="Microsoft.NET.Sdk">

+  <!-- OTOPCUA0001 (arch-review 07/C-1): this manual-testing CLI invokes driver capability methods
+       DIRECTLY for one-shot probe/read/write/subscribe diagnostics — not the resilient runtime dispatch
+       path, so CapabilityInvoker wrapping does not apply. Suppressed project-wide. -->
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);OTOPCUA0001</NoWarn>
+  </PropertyGroup>
+
    <PropertyGroup>
        <OutputType>Exe</OutputType>
        <TargetFramework>net10.0</TargetFramework>
@@ -1,5 +1,12 @@
 <Project Sdk="Microsoft.NET.Sdk">

+  <!-- OTOPCUA0001 (arch-review 07/C-1): this manual-testing CLI invokes driver capability methods
+       DIRECTLY for one-shot probe/read/write/subscribe diagnostics — not the resilient runtime dispatch
+       path, so CapabilityInvoker wrapping does not apply. Suppressed project-wide. -->
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);OTOPCUA0001</NoWarn>
+  </PropertyGroup>
+
    <PropertyGroup>
        <OutputType>Exe</OutputType>
        <TargetFramework>net10.0</TargetFramework>
@@ -1,5 +1,12 @@
 <Project Sdk="Microsoft.NET.Sdk">

+  <!-- OTOPCUA0001 (arch-review 07/C-1): this manual-testing CLI invokes driver capability methods
+       DIRECTLY for one-shot probe/read/write/subscribe diagnostics — not the resilient runtime dispatch
+       path, so CapabilityInvoker wrapping does not apply. Suppressed project-wide. -->
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);OTOPCUA0001</NoWarn>
+  </PropertyGroup>
+
    <PropertyGroup>
        <OutputType>Exe</OutputType>
        <TargetFramework>net10.0</TargetFramework>
@@ -146,7 +146,9 @@ internal sealed class AbCipAlarmProjection : IAsyncDisposable
        // Best-effort — the driver's WriteAsync returns per-item status; individual ack
        // failures don't poison the batch. Swallow the return so a single faulted ack
        // doesn't bubble out of the caller's batch expectation.
+#pragma warning disable OTOPCUA0001 // Driver-INTERNAL self-call: the projection is owned by AbCipDriver; CapabilityInvoker wraps the driver from the dispatch layer OUTWARD, so a driver's own internal ack path must NOT re-wrap. Intentional, not a dispatch gap.
        _ = await _driver.WriteAsync(requests, cancellationToken).ConfigureAwait(false);
+#pragma warning restore OTOPCUA0001
    }

    /// <summary>Releases all resources associated with this alarm projection.</summary>
@@ -225,7 +227,9 @@ internal sealed class AbCipAlarmProjection : IAsyncDisposable
        {
            try
            {
+#pragma warning disable OTOPCUA0001 // Driver-INTERNAL self-call: the projection is owned by AbCipDriver; CapabilityInvoker wraps the driver from the dispatch layer OUTWARD, so a driver's own internal poll path must NOT re-wrap. Intentional, not a dispatch gap.
                var results = await _driver.ReadAsync(refs, ct).ConfigureAwait(false);
+#pragma warning restore OTOPCUA0001
                Tick(sub, results);
            }
            catch (OperationCanceledException) when (ct.IsCancellationRequested) { break; }
@@ -1294,7 +1294,9 @@ public sealed class S7Driver

    private async Task PollOnceAsync(SubscriptionState state, bool forceRaise, CancellationToken ct)
    {
+#pragma warning disable OTOPCUA0001 // Driver-INTERNAL self-call: S7Driver's own poll loop reading via its own ReadAsync; CapabilityInvoker wraps the driver from the dispatch layer OUTWARD, so the driver's internal poll must NOT re-wrap. Intentional, not a dispatch gap.
        var snapshots = await ReadAsync(state.TagReferences, ct).ConfigureAwait(false);
+#pragma warning restore OTOPCUA0001
        for (var i = 0; i < state.TagReferences.Count; i++)
        {
            var tagRef = state.TagReferences[i];
@@ -572,7 +572,9 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
        using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(5));
        try
        {
+#pragma warning disable OTOPCUA0001 // RESILIENCE-DISPATCH-GAP (07/C-1): dispatch bypasses CapabilityInvoker — Phase 6.1 pipeline built but never wired into DriverInstanceActor; tracked, NOT intentional.
            var results = await writable.WriteAsync(request, cts.Token);
+#pragma warning restore OTOPCUA0001
            if (results is { Count: 1 } && IsGoodStatus(results[0].StatusCode))
            {
                replyTo.Tell(new WriteAttributeResult(true, null));
@@ -620,7 +622,9 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
        using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(5));
        try
        {
+#pragma warning disable OTOPCUA0001 // RESILIENCE-DISPATCH-GAP (07/C-1): dispatch bypasses CapabilityInvoker — Phase 6.1 pipeline built but never wired into DriverInstanceActor; tracked, NOT intentional.
            await src.AcknowledgeAsync(request, cts.Token);
+#pragma warning restore OTOPCUA0001
            _log.Info("DriverInstance {Id}: acknowledged native condition {Cond} by {User}",
                _driverInstanceId, msg.ConditionId, msg.OperatorUser);
        }
@@ -657,8 +661,10 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
            subscribable.OnDataChange += _dataChangeHandler;

            using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+#pragma warning disable OTOPCUA0001 // RESILIENCE-DISPATCH-GAP (07/C-1): dispatch bypasses CapabilityInvoker — Phase 6.1 pipeline built but never wired into DriverInstanceActor; tracked, NOT intentional.
            _subscriptionHandle = await subscribable
                .SubscribeAsync(msg.FullReferences, msg.PublishingInterval, cts.Token);
+#pragma warning restore OTOPCUA0001

            replyTo.Tell(new SubscriptionEstablished(_subscriptionHandle.DiagnosticId, msg.FullReferences.Count));
            _log.Info("DriverInstance {Id}: subscribed to {Count} refs ({Diag})",
@@ -682,7 +688,9 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
        try
        {
            using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(5));
+#pragma warning disable OTOPCUA0001 // RESILIENCE-DISPATCH-GAP (07/C-1): dispatch bypasses CapabilityInvoker — Phase 6.1 pipeline built but never wired into DriverInstanceActor; tracked, NOT intentional.
            await subscribable.UnsubscribeAsync(_subscriptionHandle, cts.Token);
+#pragma warning restore OTOPCUA0001
        }
        catch (Exception ex)
        {
@@ -759,7 +767,9 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
        using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
        try
        {
+#pragma warning disable OTOPCUA0001 // RESILIENCE-DISPATCH-GAP (07/C-1): dispatch bypasses CapabilityInvoker — Phase 6.1 pipeline built but never wired into DriverInstanceActor; tracked, NOT intentional.
            _alarmSubscriptionHandle = await src.SubscribeAlarmsAsync(refs, cts.Token);
+#pragma warning restore OTOPCUA0001
            _log.Info("DriverInstance {Id}: native-alarm subscription established for {Count} alarm ref(s) ({Diag})",
                _driverInstanceId, refs.Count, _alarmSubscriptionHandle.DiagnosticId);
        }
@@ -818,7 +828,9 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
            // resume on the actor task scheduler so the Context.Parent.Tell + Timers calls below run with a
            // live ActorContext. ConfigureAwait(false) would resume off-context and throw
            // NotSupportedException("no active ActorContext") — see the same warning on HandleSubscribeAsync.
+#pragma warning disable OTOPCUA0001 // RESILIENCE-DISPATCH-GAP (07/C-1): dispatch bypasses CapabilityInvoker — Phase 6.1 pipeline built but never wired into DriverInstanceActor; tracked, NOT intentional.
            await discovery.DiscoverAsync(builder, cts.Token);
+#pragma warning restore OTOPCUA0001
            nodes = builder.Nodes.ToArray();   // immutable snapshot — never hand the builder's live list across actors
        }
        catch (Exception ex)
@@ -7,6 +7,11 @@
        <IsPackable>false</IsPackable>
        <IsTestProject>true</IsTestProject>
        <RootNamespace>ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms.Tests</RootNamespace>
+        <!-- OTOPCUA0001 (arch-review 07/C-1): these tests invoke ScriptedAlarmSource's IAlarmSource
+             methods DIRECTLY to exercise its wire-level behavior, which is the analyzer's own documented
+             intentional case ("a unit test invoking the driver directly ... move the suppression into a
+             NoWarn for the test project"). Genuinely intentional — not a resilience-dispatch gap. -->
+        <NoWarn>$(NoWarn);OTOPCUA0001</NoWarn>
    </PropertyGroup>

    <ItemGroup>
@@ -7,6 +7,11 @@
        <IsPackable>false</IsPackable>
        <IsTestProject>true</IsTestProject>
        <RootNamespace>ZB.MOM.WW.OtOpcUa.Core.VirtualTags.Tests</RootNamespace>
+        <!-- OTOPCUA0001 (arch-review 07/C-1): these tests invoke VirtualTagSource's IReadable/ISubscribable
+             methods DIRECTLY to exercise its wire-level behavior, which is the analyzer's own documented
+             intentional case ("a unit test invoking the driver directly ... move the suppression into a
+             NoWarn for the test project"). Genuinely intentional — not a resilience-dispatch gap. -->
+        <NoWarn>$(NoWarn);OTOPCUA0001</NoWarn>
    </PropertyGroup>

    <ItemGroup>
@@ -1,5 +1,12 @@
 <Project Sdk="Microsoft.NET.Sdk">

+  <!-- OTOPCUA0001 (arch-review 07/C-1): this suite invokes driver capability methods DIRECTLY to
+       exercise wire-level behavior — the analyzer's documented intentional case ("move the suppression
+       into a NoWarn for the test project"). Not a resilience-dispatch gap. -->
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);OTOPCUA0001</NoWarn>
+  </PropertyGroup>
+
    <PropertyGroup>
        <TargetFramework>net10.0</TargetFramework>
        <Nullable>enable</Nullable>
@@ -1,5 +1,12 @@
 <Project Sdk="Microsoft.NET.Sdk">

+  <!-- OTOPCUA0001 (arch-review 07/C-1): this suite invokes driver capability methods DIRECTLY to
+       exercise wire-level behavior — the analyzer's documented intentional case ("move the suppression
+       into a NoWarn for the test project"). Not a resilience-dispatch gap. -->
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);OTOPCUA0001</NoWarn>
+  </PropertyGroup>
+
    <PropertyGroup>
        <TargetFramework>net10.0</TargetFramework>
        <Nullable>enable</Nullable>
@@ -1,5 +1,12 @@
 <Project Sdk="Microsoft.NET.Sdk">

+  <!-- OTOPCUA0001 (arch-review 07/C-1): this suite invokes driver capability methods DIRECTLY to
+       exercise wire-level behavior — the analyzer's documented intentional case ("move the suppression
+       into a NoWarn for the test project"). Not a resilience-dispatch gap. -->
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);OTOPCUA0001</NoWarn>
+  </PropertyGroup>
+
    <PropertyGroup>
        <TargetFramework>net10.0</TargetFramework>
        <Nullable>enable</Nullable>
@@ -1,5 +1,12 @@
 <Project Sdk="Microsoft.NET.Sdk">

+  <!-- OTOPCUA0001 (arch-review 07/C-1): this suite invokes driver capability methods DIRECTLY to
+       exercise wire-level behavior — the analyzer's documented intentional case ("move the suppression
+       into a NoWarn for the test project"). Not a resilience-dispatch gap. -->
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);OTOPCUA0001</NoWarn>
+  </PropertyGroup>
+
    <PropertyGroup>
        <TargetFramework>net10.0</TargetFramework>
        <Nullable>enable</Nullable>