docs: retain backend benchmark and actual publish evidence
This commit is contained in:
Joseph Doherty
@@ -0,0 +1,65 @@
|
||||
# Local historian backend matrix — 2026-11-10
|
||||
|
||||
Candidate a8e1082d69a112ea0e16788f023067979698527a (SDK 2.0.1) compared with baseline 83ed880e4471344deaf008da9bd028c7e170bdc7 (SDK 1.5.378.182). This is the existing direct backend integration test matrix over real local SQL Server and QuestDB. It is not an OPC UA wire test, AVEVA validation, or stress/soak approval. No source edits, expected-value changes, new skips, suppressions, issue updates, pushes, or commits were made for this task.
|
||||
|
||||
| Version | Backend | Passed | Failed | Skipped | Build / test / guard exit |
|
||||
|---|---|---:|---:|---:|---|
|
||||
| candidate | SqlServer | 195 | 0 | 0 | 0 / 0 / 0 |
|
||||
| candidate | QuestDb | 233 | 0 | 1 | 0 / 0 / 0 |
|
||||
| baseline | SqlServer | 195 | 0 | 0 | 0 / 0 / 0 |
|
||||
| baseline | QuestDb | 233 | 0 | 1 | 0 / 0 / 0 |
|
||||
|
||||
Every invocation was unfiltered, used a fresh SHA/project run directory and TRX, preserved the dotnet test exit status, and ran the repository MIN_EXECUTED=1 guard. Project builds were serial within each worktree; test invocations were serial against the same isolated fixture endpoints. Exact commands, UTC start/end, SDK dependency versions and test/SDK binary SHA-256 hashes are in each result.json.
|
||||
|
||||
Candidate positive coverage includes, on each backend, 13 raw-read, 14 AtTime, 11 modified-value, 7 event-read, 12 update, 64 processed-read, 6 bounding-value and 4 quality-contract conformance cases, plus backend-specific schema, write, provisioning, retention (SQL), tombstone/index/TTL (QuestDB), and alarm-writer tests.
|
||||
|
||||
SqlServer: baseline/candidate display names and outcomes identical = True across 195 discovered cases. Baseline failures: 0; candidate failures: 0.
|
||||
QuestDb: baseline/candidate display names and outcomes identical = True across 234 discovered cases. Baseline failures: 0; candidate failures: 0.
|
||||
|
||||
No PercentGood failure appeared in these selected integration suites. Their empty failure sets match where both versions have completed; there is no failing message pair to compare. This does not resolve or replace the separate standalone SDK-oracle PercentGood issue #796.
|
||||
|
||||
The existing QuestDB LiveWriteReadRaceStressTests.Per_sample_reads_of_a_tag_being_written_never_fault_and_never_return_a_valueless_non_bad_result case skips because HISTORIAN_QUESTDB_STRESS_SECONDS is unset. It was not enabled, shortened, reclassified, or replaced by a normal passing case. No five-million-row workload or two-hour stress/soak was run. Those gates remain pending.
|
||||
|
||||
## Fixture ownership and exact images
|
||||
|
||||
SQL Server: existing otopcua-dev-sql-1, endpoint 127.0.0.1:14330. Its documented local dev credential was read from docs/Historian.md and supplied only via environment; the password and full secret-bearing connection string were not printed or included in the report. SqlHistorianFixture was verified before execution: it forces master only for CREATE/DROP, generates OtOpcUaHistorian_T_<GUID>, directs all test schemas into that new database, clears its pools, and drops only its generated name. The fixture source is unchanged between baseline and candidate. Five preexisting OtOpcUaHistorian_T_GUID databases were recorded and were never dropped by this task.
|
||||
|
||||
SQL container ID: `74ea75e5904c647f18e89b8b14c9ac385d7149c0484fbf13f6c16ec00cf3e24f`; image ID: `sha256:a2fbff321505724b8a271a214d4dec020a8e7a745c83eede0b9d762b51a9ab34`.
|
||||
|
||||
QuestDB: new task-owned otopcua-sdk2-questdb, loopback-only PG port 32770 and HTTP port 32771, new storage volume `otopcua-sdk2-questdb-data-20261110t170141z`. No existing QuestDB service or volume was used. Connection settings use ServerCompatibilityMode=NoTypeLoading and Maximum Pool Size=16; the fixture applies its existing one-second idle pruning. QuestDbFixture assigns unique t<12 hex>_ prefixes, validates them, locates owned tables with starts_with (not wildcard LIKE), and drops only those prefixes. The same unchanged fixture source and image were used by both versions.
|
||||
|
||||
QuestDB image: `questdb/questdb:10.0.1`; immutable image ID `sha256:41ceca901724ad10a0035da0cb0c1f99f88bf3692abdc9090baabdfff1d215f9`; digest `questdb/questdb@sha256:67eaed863ebb2383227919ea9a5499a4a39ceca3862c20b974c84a10e11cdf89`.
|
||||
|
||||
## Run evidence
|
||||
|
||||
| Version / backend | UTC start | UTC end | Directory |
|
||||
|---|---|---|---|
|
||||
| candidate SqlServer | 2026-11-10T17:03:02.101289+00:00 | 2026-11-10T17:03:52.950418+00:00 | `/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/a8e1082d/backend-matrix-20261110T170141Z/SqlServer` |
|
||||
| candidate QuestDb | 2026-11-10T17:03:58.392642+00:00 | 2026-11-10T17:11:13.275488+00:00 | `/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/a8e1082d/backend-matrix-20261110T170141Z/QuestDb` |
|
||||
| baseline SqlServer | 2026-11-10T17:11:19.005717+00:00 | 2026-11-10T17:12:11.817250+00:00 | `/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/83ed880e/backend-matrix-20261110T170141Z/SqlServer` |
|
||||
| baseline QuestDb | 2026-11-10T17:12:16.867323+00:00 | 2026-11-10T17:19:37.746023+00:00 | `/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/83ed880e/backend-matrix-20261110T170141Z/QuestDb` |
|
||||
|
||||
Session index / fixture metadata / aggregate results / exact failure-set comparison:
|
||||
|
||||
/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/a8e1082d/backend-matrix-20261110T170141Z
|
||||
|
||||
Each project directory contains build.log, test.log, a fresh TRX, guard.log and result.json. Candidate directories also contain class-counters.json. The session has fixture-metadata.json and readiness/WAL snapshots; cleanup.json and questdb-container.log are written after final cleanup.
|
||||
|
||||
## Cleanup
|
||||
|
||||
Completed at 2026-11-10T17:19:44.751608+00:00. SQL GUID-database inventory unchanged: True; SQL container ID unchanged: True. QuestDB tables remaining after all tests: 0. Task-owned container absent: True; task-owned volume absent: True. Only the captured task container ID and its verified task-labelled volume were removed. No other container, volume or database was removed.
|
||||
|
||||
## Reproduction and remaining gates
|
||||
|
||||
Completed scripts (kept in /tmp; they create new timestamped evidence directories and protect ownership):
|
||||
|
||||
```bash
|
||||
python3 /tmp/opcua2-backend-setup.py
|
||||
python3 /tmp/opcua2-backend-matrix.py
|
||||
python3 /tmp/opcua2-backend-cleanup.py
|
||||
python3 /tmp/opcua2-backend-report.py
|
||||
```
|
||||
|
||||
For each version/backend the actual commands were dotnet build <owning-project.csproj> -c Release, then dotnet test <owning-project.csproj> -c Release --no-build --no-restore --logger trx --results-directory <fresh-directory>, with only the appropriate real connection environment variable set. Guard: MIN_EXECUTED=1 bash scripts/ci/assert-not-all-skipped.sh <fresh-directory>/*.trx. The orchestration preserves nonzero test and guard statuses instead of overwriting them. SQL connection acquisition is from the documented local dev recipe without echo; QuestDB endpoints are obtained from the newly created task container.
|
||||
|
||||
AVEVA/HistorianGateway live read/write/alarm/provisioning and licensed backend validation remain external and pending. The separate SDK-oracle issue #796, wire/security interoperability, five-million-row workload, two-hour stress/soak and release/performance gates are not completed by these local backend runs.
|
||||
@@ -0,0 +1,60 @@
|
||||
# OPC UA SDK lock benchmark diagnostic — 2026-11-10
|
||||
|
||||
Compared baseline `83ed880e4471344deaf008da9bd028c7e170bdc7` (SDK 1.5.378.182) with candidate `a8e1082d69a112ea0e16788f023067979698527a` (SDK 2.0.1). Both Release project builds passed with 0 warnings/errors. No source edits or new commits were made for this evidence task.
|
||||
|
||||
Same Mac16,7, 14 logical/physical CPU cores, 48 GiB RAM, .NET SDK 10.0.403. OS details and exact assembly SHA-256 hashes are in metadata.json. All runs used OTOPCUA_BENCH=1 and the existing NodeManagerLockTimeBenchmarkTests class. Scenario sizes and assertions are identical; the only benchmark source differences are SDK-required OperationContext.RequestLifetime.None and IAsyncNodeManager interface changes. Each test boots a private server with its own temporary PKI and probed port. No containers or global fixture were used.
|
||||
|
||||
One warmup invocation per version was followed by three recorded invocations per version, alternating baseline/candidate with 25 seconds between processes. Each invocation is a fresh process; warmup primes host/file caches, not persistent in-process JIT state. Default xUnit test order varied. Warmups are excluded from the medians.
|
||||
|
||||
| Recorded metric | Baseline runs | SDK 2 runs | Baseline median | SDK 2 median | Change |
|
||||
|---|---|---|---:|---:|---:|
|
||||
| Rebuild 10k-tag folder | 18, 15, 17 | 15, 15, 14 | 17 ms | 15 ms | -11.76% |
|
||||
| Remove 200 equipment / 50k nodes | 81, 50, 86 | 80, 68, 80 | 81 ms | 80 ms | -1.23% |
|
||||
| Visits for 10 removals / 50 conditions | 10, 10, 10 | 10, 10, 10 | 10 visits | 10 visits | +0.00% |
|
||||
| OS command maximum resident set size | 385.17, 136.20, 136.30 | 136.39, 136.81, 136.80 | 136.30 MiB | 136.80 MiB | +0.37% |
|
||||
|
||||
The median teardown timings do not exceed the provisional +15% latency-growth reference. Their inverse-time local teardown-rate proxies change by +13.33% (rebuild) and +1.25% (removal), so neither shows a >10% drop in this subset. These derived rates are not wire throughput, and three samples do not establish p95 latency. Command maximum-RSS median rose 0.37%, below the +15% reference, but it does not measure steady server RSS. No change to budgets or acceptance decision is implied.
|
||||
|
||||
All eight invocations passed all three cases: 24 passed, 0 failed, 0 skipped (18 recorded case executions plus 6 warmup). Every test exit and MIN_EXECUTED=3 guard exit was 0; aggregate orchestrator exit was 0. The original 5000 ms opt-in teardown assertions remained enforced; the largest recorded operation was 86 ms. The strict, hardware-independent visit counter was exactly 10 in all eight invocations.
|
||||
|
||||
Host-load caveat: other solution testing/build activity shared this host. Initial preparation saw load averages 19.78/30.02/23.48 on 14 cores; per-run before/after uptime snapshots are retained in result.json. Recorded one-minute load ranged 5.58–10.90; five-minute load ranged 15.26–20.32 and fifteen-minute load 18.45–20.56. BENCH uses integer-millisecond Stopwatch output. Timing spread, quantization and changing xUnit ordering preclude a stable performance claim. OS /usr/bin/time -l maximum RSS is command-invocation rusage, not isolated teardown allocation or steady server RSS; baseline run1 is an outlier and is included unchanged. GC/allocation counters are not exposed by the existing harness and were not measured. This subset does not complete wire throughput, p50/p95/p99 latency, allocation, steady RSS, history-page throughput, load, soak, publish, or resource-lifecycle gates.
|
||||
|
||||
## Recorded invocations
|
||||
|
||||
| Version / phase | UTC start | UTC end | Test / guard exit | Evidence directory |
|
||||
|---|---|---|---|---|
|
||||
| baseline warmup | 2026-11-10T16:54:37.980941+00:00 | 2026-11-10T16:54:42.012296+00:00 | 0 / 0 | `/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/83ed880e/lock-bench-20261110T165437Z/warmup` |
|
||||
| candidate warmup | 2026-11-10T16:55:07.020267+00:00 | 2026-11-10T16:55:11.610491+00:00 | 0 / 0 | `/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/a8e1082d/lock-bench-20261110T165437Z/warmup` |
|
||||
| baseline run1 | 2026-11-10T16:55:36.615335+00:00 | 2026-11-10T16:55:40.023724+00:00 | 0 / 0 | `/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/83ed880e/lock-bench-20261110T165437Z/run1` |
|
||||
| candidate run1 | 2026-11-10T16:56:05.032437+00:00 | 2026-11-10T16:56:09.352092+00:00 | 0 / 0 | `/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/a8e1082d/lock-bench-20261110T165437Z/run1` |
|
||||
| baseline run2 | 2026-11-10T16:56:34.361326+00:00 | 2026-11-10T16:56:37.712286+00:00 | 0 / 0 | `/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/83ed880e/lock-bench-20261110T165437Z/run2` |
|
||||
| candidate run2 | 2026-11-10T16:57:02.720388+00:00 | 2026-11-10T16:57:06.894343+00:00 | 0 / 0 | `/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/a8e1082d/lock-bench-20261110T165437Z/run2` |
|
||||
| baseline run3 | 2026-11-10T16:57:31.903230+00:00 | 2026-11-10T16:57:35.306953+00:00 | 0 / 0 | `/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/83ed880e/lock-bench-20261110T165437Z/run3` |
|
||||
| candidate run3 | 2026-11-10T16:58:00.315244+00:00 | 2026-11-10T16:58:04.720985+00:00 | 0 / 0 | `/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/a8e1082d/lock-bench-20261110T165437Z/run3` |
|
||||
|
||||
Each directory contains a fresh TRX (BENCH stdout attached to individual test results), test.log, resource.log, guard.log, and result.json. Session metadata/results/summary:
|
||||
|
||||
/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/a8e1082d/lock-bench-20261110T165437Z
|
||||
|
||||
Reproduction (in each version worktree; choose a new, nonexistent absolute result directory each invocation):
|
||||
|
||||
```bash
|
||||
OPC_RUN_DIR=/absolute/fresh/result/directory
|
||||
test ! -e "$OPC_RUN_DIR" || exit 2
|
||||
mkdir -p "$OPC_RUN_DIR" || exit
|
||||
opc_test_status=0
|
||||
OTOPCUA_BENCH=1 /usr/bin/time -l dotnet test \
|
||||
tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests.csproj \
|
||||
-c Release --no-build --no-restore \
|
||||
--filter FullyQualifiedName~NodeManagerLockTimeBenchmarkTests \
|
||||
--logger trx --logger "console;verbosity=detailed" \
|
||||
--results-directory "$OPC_RUN_DIR" \
|
||||
> "$OPC_RUN_DIR/test.log" 2> "$OPC_RUN_DIR/resource.log" || opc_test_status=$?
|
||||
opc_guard_status=0
|
||||
MIN_EXECUTED=3 bash scripts/ci/assert-not-all-skipped.sh "$OPC_RUN_DIR"/*.trx \
|
||||
> "$OPC_RUN_DIR/guard.log" 2>&1 || opc_guard_status=$?
|
||||
if [ "$opc_test_status" -ne 0 ]; then exit "$opc_test_status"; fi
|
||||
exit "$opc_guard_status"
|
||||
```
|
||||
|
||||
Exact completed orchestration script: /tmp/opcua2-lock-bench.py. It records environment, SDK dependencies, assembly hashes, start/end UTC, host load, metrics, counts and statuses, and alternates the eight invocations with 25-second gaps.
|
||||
@@ -0,0 +1,70 @@
|
||||
# Actual Host / CLI publish and runtime smoke — 2026-11-10
|
||||
|
||||
Linux ARM64 actual full Host start/stop smoke PASSED. Windows x64 cross-publish and static inspection PASSED. Windows runtime/service installation remains a formal pending operator gate; this report does not complete Gate G4.
|
||||
|
||||
Reproducible probe commit: `3a11087b37728b4a97c2884d55f2d7d9949923b9`. Only four new files under scripts/validation/opcua-publish-smoke were added. No production, existing documentation, package policy, fleet, sister-repository or issue changes were made by this lane. Root commits 2d75cecb and bd3143b7 were merged into the isolated checkout before the applicable publishes.
|
||||
|
||||
## Published artifacts
|
||||
|
||||
The repository install recipe documents dotnet publish -c Release -r win-x64 --self-contained. The four commands used that setting, with PublishSingleFile=false and PublishTrimmed=false explicitly retained, one MSBuild node and new output folders. The Linux RID matches the cached ARM64 container. No Native AOT was attempted. All four actual publish exits were zero.
|
||||
|
||||
| RID / app | Source revision at publish | Files / bytes | SDK assemblies | Native inventory entries |
|
||||
|---|---|---:|---:|---:|
|
||||
| linux-arm64/host | `d31560cd360144132f1433a04fcb5acb25dfa3fd` | 1388 / 356618849 | 8 | 32 |
|
||||
| linux-arm64/cli | `8a1028c4e2f308a29bcc4a504596df6d667554f8` | 236 / 111341495 | 7 | 15 |
|
||||
| win-x64/host | `8a1028c4e2f308a29bcc4a504596df6d667554f8` | 1390 / 342188283 | 8 | 37 |
|
||||
| win-x64/cli | `8a1028c4e2f308a29bcc4a504596df6d667554f8` | 236 / 103181689 | 7 | 16 |
|
||||
|
||||
Linux Host was published before the root client-factory-only correction; it has no Client.Shared dependency. Both CLI publishes and Windows Host include the merged bd3143b7 correction. Host production source is unchanged across these two publish revisions. The exact per-artifact source, command and SHA-256 manifest are retained in validation-receipt.json.
|
||||
|
||||
Every OPCFoundation dependency is 2.0.1. Each SDK assembly basename appears once per application publish tree; no old SDK copy or migration analyzer runtime artifact was found. All inspected Linux native entries are AArch64 ELF and Windows entries are x86-64 PE; apphosts and bundled runtimes match their RID. Both Host publishes contain the separately self-contained script-worker. Runtimeconfig includedFrameworks records Microsoft.NETCore.App 10.0.14, plus Microsoft.AspNetCore.App 10.0.14 on Host. This validates packaging and the in-process default only; the out-of-process script execution path was not exercised here.
|
||||
|
||||
| Artifact | Apphost SHA-256 | Full-file-manifest SHA-256 |
|
||||
|---|---|---|
|
||||
| linux-arm64/host | `d97f318f268246852603166a19d66c2da788a75a7f9124b2242e6c794985dcbb` | `32ec603b22ba7f7df62904bc738e9193e0c1275fcc7a9fb5c65b9aa5d65c0f5e` |
|
||||
| linux-arm64/cli | `b4840db34c07ec7f0fa8cbc220c5552fac87527d3b222c4e47260c68c7eedb19` | `992bc65bcf74c0d57aa6d789085abdfcd2290b0496931a445a11e801de2312a6` |
|
||||
| win-x64/host | `7896ec7a0db88dd00d893ea9a55bc22e40849e7c789af7eea79a4514ed587972` | `b42baf99acbbe0646c487fbaf193f9f4fea66adfd393a41b841b55ba95d53aa0` |
|
||||
| win-x64/cli | `d880d4c83448f9ee5a2ea79c3573c1b2301b5fc17c277cf072153a589543bc5d` | `28a9872354539d600659c4af463e24c7ba40136c4ab67a5cb40c36b5d9575060` |
|
||||
|
||||
Complete paths, sizes and SHA-256 values are in the four *-sha256.json manifests. Managed SDK/package inventory is in publish-inventory.json; native paths, file-format/architecture and hashes are in native-inventory.json. Runtime-generated logs and private PKI/state are excluded from shipped-artifact manifests.
|
||||
|
||||
## Actual Linux runtime
|
||||
|
||||
Image: mcr.microsoft.com/dotnet/sdk:10.0.103-noble; cached immutable ID `sha256:b04611ee9e1b7d36797012ed921962c57189cb4dbb3dff12afb8e158110f293b`, architecture `arm64`, digest `mcr.microsoft.com/dotnet/sdk@sha256:e362a8dbcd691522456da26a5198b8f3ca1d7641c95624fadc5e3e82678bd08a`. The published self-contained OtOpcUa.Host executable was the container command; the SDK image supplies only the portable probe framework. No ProcessHost server substitute was used.
|
||||
|
||||
The real Host ran Cluster:Roles=driver, ConfigSource:Mode=FetchAndCache, a self-only otopcua Akka seed, and an unreachable loopback CentralFetchEndpoint. No ConfigDb was registered. A task-only LocalDb deployment cache was seeded through public production AddOtOpcUaLocalDb / IDeploymentArtifactCache APIs, using the public DeploymentId formatter. The artifact contains one raw folder and a real peppered HMAC API key with read/browse/subscribe grants. Production API-key authentication was used. PKI, LocalDb and encrypted secrets SQLite lived in one fresh GUID state directory. Random secrets were environment-only; none are included in this report or recorded arguments.
|
||||
|
||||
All preparation and runtime containers used --network none and task labels. HTTP, UA and Akka ports were randomly chosen within that private namespace; none were published to the host. The same task-owned container, application executable, LocalDb and GUID PKI were started and stopped twice.
|
||||
|
||||
| Executed check | Actual result |
|
||||
|---|---|
|
||||
| /healthz, /health/ready and /health/active on each boot | 6 requests passed; ready/active Healthy and Akka Up |
|
||||
| Strict trusted Basic256Sha256 SignAndEncrypt + real API-key session / ServerStatus.State read | 2 passed, Good quality, peer autoaccept false |
|
||||
| Wrong secret for the same real key | 2 denied with BadIdentityTokenRejected |
|
||||
| Untrusted server certificate | Denied with BadCertificateUntrusted |
|
||||
| Untrusted client certificate | Denied with BadSecurityChecksFailed |
|
||||
| Actual published CLI --help | Exit 0 |
|
||||
| Actual published CLI encrypted API-key ServerStatus.State reads | 2 passed, Good quality, exit 0 |
|
||||
| Actual Host stop / restart / stop | Both stops exit 0; Running=false, OOMKilled=false |
|
||||
| Cache restore | Production restored-served-state log appears on both boots |
|
||||
| Required execution guard | Exactly 2 boots and 6 strict SDK probe cases executed; overall exit 0 |
|
||||
|
||||
The CLI retains its existing AutoAcceptCertificates=true behavior and has no strict-validation switch. Its successful reads are separate from the strict SDK peer-validation checks. Its matching application-name/URI certificate was prepared through the public SDK API, then trusted by the server before first boot. A closed-port CLI setup preflight intentionally returned nonzero; it is not counted as a passing connection case.
|
||||
|
||||
Application certificate SHA-256 on BOTH boots: `19000d33d71bb11c92f282724a3515b9119783e070df06667b05f49e41413640`. Preserved thumbprint on BOTH boots: `sha1 Fingerprint=DE:CB:33:B0:DE:32:9B:FB:40:FF:A8:5C:66:48:CE:44:01:2A:48:F8`. The public certificate bytes and thumbprint were unchanged; no rotation was performed.
|
||||
|
||||
Raw process stdout/stderr and this run’s appended rolling script/application/selflog bytes were scanned before sanitized copies were saved. Exact task API-key/secret, pepper, fetch key and master-key matches: zero. Successful-run appended Serilog selflog: 0 bytes. Negative authentication and certificate results remained diagnosable. The private environment file was mode 0600 and removed at the end.
|
||||
|
||||
Final successful runtime directory: `/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/publish-smoke/20261110T172336Z/runtime-8e794a04a90d4b769fd94cd330aba544`. summary.json, commands.json, health JSON, individual protocol/CLI logs, full Host logs and appended rolling-file slices contain the actual results, UTC times, statuses and exits. The task-labelled container `f725df5c31d907db6626a70446294006e9e18d6dd7efb3bc9f1f385267faf7f2` was removed after its second clean stop. No task containers remain; no existing fleet container, volume, database or PKI was modified.
|
||||
|
||||
Earlier fresh setup attempts exited nonzero and remain in sibling runtime-* directories. They exposed fixture mistakes: closed-port CLI certificate preparation, an unnecessary split cluster role, the liveness route spelling (/healthz is correct), and a hyphenated deployment identifier. Those were corrected only in the new smoke harness. The application’s configuration validator failed closed, and valid configuration subsequently passed. No SDK regression was attributed to those setup errors.
|
||||
|
||||
## Reproduction and pending operator gate
|
||||
|
||||
The committed scripts/validation/opcua-publish-smoke/README.md contains exact four-publish, probe-build and runtime commands. The runtime script requires a fresh private state directory per invocation, preserves each command exit, enforces the two-boot/six-case count and raw-log checks, and removes only its captured task-labelled container. Build/publish commands and immutable hashes for this completed run are in validation-receipt.json.
|
||||
|
||||
Evidence root: `/Users/dohertj2/.codex/worktrees/opcua2-test-convergence/OtOpcUa/artifacts/opcua2/publish-smoke/20261110T172336Z`.
|
||||
|
||||
**PENDING — Windows runtime / installation:** cross-publishing PE artifacts on macOS does not execute Windows service registration, startup, endpoint negotiation or shutdown. An operator must perform scripts/install/Install-Services.ps1 and the two-start/stop, preserved-PKI health/UA checks on an approved Windows environment. The Wonder-box remote-execution hold remains binding: no WinRM, psbridge or replacement remote-execution channel was used or is authorized by this smoke. No deployment was performed.
|
||||
|
||||
Performance/load, full driver/native transport operation, Windows service ACL/account behavior, backend/live AVEVA, failover and the two-hour lifecycle soak remain separate gates.
|
||||
Reference in New Issue
Block a user