From a7efb39685c7730fb102fabc587b60f387b8b2a3 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Tue, 10 Nov 2026 13:33:01 -0500 Subject: [PATCH] docs: record Astra source verdict and preserve failed lifecycle scope --- docs/plans/2026-11-10-opcua-sdk-2-evidence.md | 27 +++++++++++++ .../opcua-server-lifecycle-linux/README.md | 39 ++++++++++++++++--- 2 files changed, 61 insertions(+), 5 deletions(-) diff --git a/docs/plans/2026-11-10-opcua-sdk-2-evidence.md b/docs/plans/2026-11-10-opcua-sdk-2-evidence.md index 29773e58..8f397951 100644 --- a/docs/plans/2026-11-10-opcua-sdk-2-evidence.md +++ b/docs/plans/2026-11-10-opcua-sdk-2-evidence.md @@ -331,3 +331,30 @@ browser lifecycle run on Linux is still in progress. Its final elapsed duration, counters, resource limits and completion/exit guards must be recorded separately. A short diagnostic, a running process, or a different workload is never substituted for a required passing gate. G4 and release approval remain open. + + +## Final integrated source review and diagnostic instrumentation + +Astra (`gpt-6-astra`, xhigh) reviewed integrated source `aa9af0dc` read-only and +reported **no new must-fix migration source/security finding**. It rechecked +identity registry/rejection, scoped public peer evidence, restricted identity +behavior, actual continuation ownership/node/topology binding, temporary audit +capability, exact alarm retry guards, write/node attempt ownership and client/ +driver generation/disposal. Its independently inspected security receipt is +17/17 with zero skips. This is source/security review, **not release approval**: +Astra retains #799 and explicitly withholds G4/release approval on both platforms. +The reviewed production tree remains unchanged by later diagnostic commits. + +Test-only instrumentation now writes the complete captured resource tuple before +resource assertions and includes GC committed/heap/fragmentation, pinned/finalizer, +JIT method/IL, thread and timer counters. Explicit bounded profile mode preserves +the first original budget rejection, marks subsequent samples rejected, and +rethrows it before completion; full/diagnostic modes still fail immediately. +The full7200-second minimum and every original cap are unchanged. Both descriptor +positive/timeout controls passed again, **2/2**, at integrated `b57595cb`. +Historical failed-run hashes and source revisions remain exact; they are not +relabeled as results from this newer instrumentation. + +The pushed implementation is reviewable as +[draft PR#802](https://gitea.dohertylan.com/dohertj2/lmxopcua/pulls/802). +It is explicitly held from merge/release, and #782 remains open. diff --git a/scripts/validation/opcua-server-lifecycle-linux/README.md b/scripts/validation/opcua-server-lifecycle-linux/README.md index 7566e2f4..235a0e34 100644 --- a/scripts/validation/opcua-server-lifecycle-linux/README.md +++ b/scripts/validation/opcua-server-lifecycle-linux/README.md @@ -27,15 +27,20 @@ python3 scripts/validation/opcua-server-lifecycle-linux/run.py \ An already published artifact can be reused with `--published-app /absolute/path/to/app`. Its parent must contain the launcher's `publish-receipt.json`; the test source, apphost and test assembly hashes must -match. The recorded diagnostic artifact can be reused with: +match. Reuse only a publish produced from the current canonical test source: ```sh -python3 /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-server-lifecycle-linux/run.py \ +python3 scripts/validation/opcua-server-lifecycle-linux/run.py \ --full --duration 7200 \ - --published-app /tmp/opcua2-server-linux-diagnostic-20261110a/app \ - --output /tmp/opcua2-server-linux-full-20261110 + --published-app /absolute/path/to/current-diagnostic/app \ + --output /tmp/otopcua-server-linux-full-another-unique ``` +The historical 2026-11-10 diagnostic publish predates the later pre-assert/GC/JIT +instrumentation. Its recorded full-run command is retained in the failed-run +receipt; a current launcher correctly rejects that publish's test-source hash. +Republish to measure the current instrumented test. + The output directory must be fresh. It is mode 0700 and can contain task-owned private PKI under `task/tmp` during a run or after a failure. Never commit the entire output. The existing successful test removes its own stores. Only selected @@ -101,7 +106,31 @@ TRX result. Both descriptor tests passed: the symlink control observed was reaped in 267 ms. All quiescent logical-resource counts and PKI FDs were zero. Third-cycle to final deltas were **−145,080 managed bytes, +53,739,520 RSS bytes, and +2 FDs**, within the unchanged diagnostic limits. These short observations do -not establish a two-hour resource trend. The full Linux gate remains pending. +not establish a two-hour resource trend. The attempted full Linux gate failed as recorded below. CLI rejection of `--full --duration 90`, rejection of a short completion as a full run, and rejection of the wrong TRX executed count were also verified. Selected receipts are in `evidence/2026-11-10-diagnostic/`. + + +The actual full attempt on 2026-11-10 **failed** at 248 cycles, 61 restarts and +903.508 seconds: RSS353,931,264 exceeded351,850,496 bytes (third-cycle baseline ++128MiB). Managed memory (~20.5MB), global descriptors189, PKI descriptors0, +cached stores2 and logical collections remained bounded. This is a combined +in-process SDK client/server measurement, not standalone server attribution. +The test/container/launcher returned failure; no completion or two-hour pass +exists. Selected sanitized source/runtime/hash/TRX/resource receipts are in +[`server-linux-soak-failed.json`](../../../docs/plans/evidence/2026-11-10-opcua2/server-linux-soak-failed.json). +[#799](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/799) tracks the +cross-platform investigation; unchanged thresholds remain mandatory. + +The canonical test additionally supports explicit `OTOPCUA_SDK2_SOAK_MODE=profile` +for 60–1800 seconds when invoked directly with the same opt-in/output/build +environment. This launcher deliberately exposes diagnostic/full modes only. +Profile mode logs each captured resource tuple before assertions, including +GC committed/fragmented bytes, JIT method/IL counts, timers and threads. After a +resource-budget failure it may continue bounded diagnostic collection, labels +subsequent rows `quiescent-budget-rejected`, and rethrows the first original +assertion before any completion record. It never changes thresholds, produces a +two-hour flag, or turns a rejected run into a pass. Full/diagnostic modes retain +immediate assertion failure. Native/private/file/anonymous RSS profiling and a +matched original-SDK control are needed before attributing the failed gate.