dohertj2/lmxopcua
1
0
Fork 0
Code Issues 26 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs: reconcile SDK 2 rollout gates with local evidence

Browse Source
This commit is contained in:
Joseph Doherty
2026-11-10 13:28:16 -05:00
parent aa9af0dcff
commit a8ae19b224
1 changed files with 65 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plans/2026-11-10-opcua-sdk-2-rollout.md
+65 -22
View File
@@ -3,10 +3,12 @@
This operator runbook accompanies [#782](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/782),
the [implementation plan](2026-11-10-opcua-sdk-2-upgrade.md) and
[execution evidence](2026-11-10-opcua-sdk-2-evidence.md). Gitea is the single
status system. This draft was checked against source `a21104d2`; it does not
approve an artifact or record a deployment. The coordinator must attach final
commit-specific evidence in #782 before advancing a gate. All placeholders below
are **pending evidence**, not passing results.
status system. This runbook was reconciled with checkout `aa9af0dc` and the
commit-specific local receipts linked below. It records local validation, not
operator release approval or a fleet deployment. Receipt revisions vary; use each
report's full source/artifact identity rather than treating every result as a test
of this documentation commit. Open failures and operator gates still prevent a
release go decision.
The target is exact OPC Foundation SDK **2.0.1**; the known-good SDK baseline is
**1.5.378.182** (application baseline `83ed880e4471344deaf008da9bd028c7e170bdc7`).
@@ -19,7 +21,7 @@ Package downgrades alone cannot reverse the application/API migration.
No WinRM, psbridge or replacement remote-exec channel may be used until the user
clears a channel. UNC/SMB file copying and permitted SQL access do not authorize
service control, PowerShell execution or deployment on those hosts. Steps requiring
a command on a held host remain pending. No deployment was performed for this draft.
a command on a held host remain pending. No fleet deployment was performed.
Run the service commands below only from an approved local operator session on an
authorized Windows node. Record the node, account, channel and maintenance window
@@ -52,23 +54,60 @@ also touches gateway/retired sidecar paths outside this SDK rollout.
cluster rolling-upgrade capability is claimed. HistorianGateway Client/Contracts
**0.4.0** is already on gateway master `16111a5e` (historiangw#119 closed);
the real gateway gate historiangw#78 remains separate from package alignment.
- Certificate creation correction `bd3143b7` uses the SDK's **12-month** default
instead of treating 2048 as months. The separate RSA minimum stays 2048 bits;
existing certificates/private-key bytes and PKI identity are retained.
## Release record and preflight
Fill this record in #782 with links to immutable logs/manifests; do not paste keys,
passwords, connection strings, private certificates or unredacted environment dumps.
The following local results have recorded evidence. They do not substitute for
unexecuted operator or duration gates. Keep secrets out of logs and release records.
| Required evidence | Record to supply before release |
| Local validation | Recorded result and receipt |
|---|---|
| Candidate source and graph | Pending: full commit, clean/dirty state, SDK/runtime/OS, resolved package graph showing exact 2.0.1 |
| Known-good recovery set | Pending: deployed application version, full binary/config archive SHA-256, protected PKI backup location and permission record |
| Candidate artifacts | Pending: Windows and Linux publish directories/archives, RID/self-contained choice, SHA-256 manifest, dependencies and script-worker contents |
| G2 compilation | Pending: restore/build logs and warning/error counts at the final SHA |
| G3 behavior/security | Pending: project TRX/counts, required case results, positive and negative authorization, audit privacy, CP lifecycle and 6,144-vector comparison |
| Interoperability | Pending: baseline/candidate client-server pairs, actual ScadaBridge adapter, upstream driver/browser products and mixed-version cluster gate |
| Historian | Pending: configured SqlServer/QuestDB/Gateway capability-specific results; historiangw#78 link/evidence for live gateway |
| G4 resources/performance | Pending: baseline comparison, at least three measured runs, two-hour soak, Windows/Linux start-stop-twice smoke with preserved PKI |
| Review/operations | Pending: independent security/release review, authorized channel/window, named operator, canary/rollback results and decision |
| G2 compilation and graph | Whole-solution Release builds pass with **0 warnings/errors**; production Foundation packages are exact 2.0.1, with no runtime migration analyzer. [Build/package evidence](2026-11-10-opcua-sdk-2-evidence.md#solution-performance-and-package-evidence). |
| Security and application contracts | **17/17** final security probes; **187** wire cases; **324** Shared tests; **1115** server units with one existing skip. Seven certificate-manager/API checks are separate from network handshakes. [Case scope and provenance](2026-11-10-opcua-sdk-2-evidence.md#local-compatibility-and-security-evidence). |
| Original aggregate results | **6,144 vectors pass directly and through the production manager**. Fixture SHA-256 `2ec2a1ac97f05d199c18da55157f8bbe0276853c3ba73ebf1b509c535c5a7dd8`; [original-SDK provenance and comparison scope](2026-11-10-opcua-sdk-2-evidence.md#preserved-aggregate-algorithms-and-independent-oracles). |
| Separate-process compatibility | **62/62** baseline/candidate Shared, driver and actual CLI cases pass. Strict mutual DER trust/encrypted API-key coverage is separate from CLI autoaccept. [Matrix receipts](../../scripts/validation/opcua-sdk-compatibility/evidence/2026-11-10/). |
| Actual ScadaBridge adapter | **18 None/API-key cases pass**, nine against each server. Encrypted attempts fail against both due to the preexisting own-certificate configuration gap, [ScadaBridge#121](https://gitea.dohertylan.com/dohertj2/ScadaBridge/issues/121); secure interoperability is blocked. [Consumer receipts](../../scripts/validation/scadabridge-sdk-compatibility/). |
| Local historian backends | SQL Server **195/195** on each version; QuestDB **233 passed, 0 failed, 1 existing opt-in race-stress skip** on each. Case outcomes match. [Backend matrix](evidence/2026-11-10-opcua2/backend-matrix.md). This is not live AVEVA evidence. |
| Bounded performance subset | Three warmed measurements per version: median rebuild **17→15 ms**, removal **81→80 ms**, equal visit counts. [Benchmark scope/load caveats](evidence/2026-11-10-opcua2/lock-benchmarks.md); these are not full wire-throughput, p95 or steady-RSS approval. |
| Publish/package and Linux smoke | **Four** self-contained Linux ARM64/Windows x64 Host/CLI publishes pass. Actual Linux full Host passes **two start/stop cycles**, strict security/health checks and unchanged PKI. [Per-artifact revisions, SHA-256 manifests and runtime receipts](evidence/2026-11-10-opcua2/publish-smoke.md). Windows execution is still pending. |
| Source review | Independent reviews covered identity, ownership, aggregate preservation, hierarchy and filtered audit paths. [Review scope](2026-11-10-opcua-sdk-2-evidence.md#integrated-implementation-and-source-reviews). Source review is not release approval. |
The second full CI-equivalent run completed with **63 TRX, 19,121 discovered,
18,486 executed, 18,475 passed, 11 failed and 635 existing skips**. Test exit was
**1**; execution guard exit was **0** at floor 12,000. It is not green: the exact
failures are ten unchanged PercentGood cases and one ShadowMode 250 ms timing
assertion (585.7377 ms), independently reproduced on baseline, with no new failure
classes. Summary: `/tmp/opcua2-ci2-summary.json`; final provenance is in the
[main evidence](2026-11-10-opcua-sdk-2-evidence.md#solution-performance-and-package-evidence).
The ten PercentGood failures are tracked in
[#796](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/796), and the separately
reproduced baseline ScriptWorker timing failure is
[#798](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/798).
The opaque scripted-alarm narrow-scope denial is a separate preexisting functionality
gap, [#797](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/797), not a new
SDK incompatibility or an approved synthetic-ID workaround.
**The server resource gate failed.** The Mac restart soak failed twice around
17 minutes at the unchanged RSS cap. The same-cap self-contained Linux server
workload also failed at **248 cycles / 903.5 seconds**: RSS **353,931,264 bytes**
exceeded **351,850,496 bytes**. Its retained result is
`/tmp/opcua2-server-linux-full-20261110/task/results/soak.trx`.
[#799](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/799) owns investigation;
no cap waiver or two-hour server pass is recorded. The distinct actual-production
Shared/driver/reinitialize/browser two-hour Linux lifecycle run is still active;
its partial duration is not a pass. See [long-run scope](2026-11-10-opcua-sdk-2-evidence.md#resource-finding-and-long-run-scope)
for instrumentation limitations and final-result updates.
| Operator release field | Still required before its release decision |
|---|---|
| Recovery set and candidate selection | Actual deployed known-good application/config archive hashes, protected PKI/permission backup, selected complete candidate artifact and matching source/manifest. Local artifact manifests above are available; a fleet recovery set is not inferred. |
| Windows runtime/service | Approved-node installation, service account/ACL checks, preserved-PKI two-start/stop and protocol checks: [#800](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/800). Cross-publishing does not satisfy this. |
| Live AVEVA/consumer/pair | Licensed gateway/backend, remaining secure consumer work and mixed-version Akka/config/failover validation: [#801](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/801), with historiangw#78 and ScadaBridge#121 linked as applicable. No rolling-safe claim. |
| Resource/performance acceptance | Resolve #799, record completed required-duration runs and remaining representative load/budget evidence; no shortened run or changed cap substitutes. |
| Rollout/rollback authorization and results | Named operator, cleared channel, environment/window, actual schema/serialization assessment, canary/rollback checks and final review/go decision in #782. The wonder-box hold remains binding. |
Before staging:
@@ -277,8 +316,12 @@ thresholds or count absent environments as passed.
## Results handoff
Pending: coordinator to attach the final SHA, artifact hashes, TRX counts/skips,
interoperability/performance/runtime evidence, reviews and per-environment operator
records in #782. This document makes no claim of a passing build, test, ScadaBridge,
Windows/Linux smoke, live backend, soak or deployment. Required inaccessible steps
remain open gates unless formally separated into linked issues with accurate scope.
Local build, security/wire, aggregate, backend, compatibility, publish and Linux
smoke evidence is linked above with its actual scope and revisions. The server
RSS gate is failed (#799), full CI retains the 11 baseline failures (#796/#798),
the client lifecycle run is still active, secure ScadaBridge interoperability is
blocked (ScadaBridge#121), and
Windows/live AVEVA/pair/operator gates remain pending (#800/#801). No fleet rollout
or rollback has been executed. The coordinator records the final client-lifecycle result
and remaining decisions in #782 and the main evidence; none is inferred from a
passing subset or cross-published artifact.