feat(r2-04): PrimaryGatePolicy - membership-aware default-deny + denial meter (03/S4)

2026-07-13 10:55:46 -04:00
parent edbbc0438c
commit f2e899aaad
4 changed files with 73 additions and 1 deletions
@@ -0,0 +1,28 @@
+using ZB.MOM.WW.OtOpcUa.Commons.Messages.Redundancy;
+
+namespace ZB.MOM.WW.OtOpcUa.Runtime.Drivers;
+
+/// <summary>
+///     Single decision point for the Primary data-plane gates (inbound device writes, native alarm acks,
+///     fleet-wide alerts publishes). A KNOWN role wins outright; an UNKNOWN role (no redundancy snapshot
+///     yet, or the snapshot never mentioned this node — the 03/S5 identity-mismatch shape) is resolved by
+///     cluster membership: a single-driver cluster stays default-ALLOW (no peer exists — the
+///     boot-window / single-node posture), a multi-driver cluster is default-DENY (a real Primary peer
+///     exists; do not touch the shared field device until the redundancy snapshot proves this node is it).
+///     Fixes archreview 03/S4 (primary gate defaulted to allow while role unknown → dual-primary window).
+/// </summary>
+public static class PrimaryGatePolicy
+{
+    /// <summary>Decide whether this node should service a Primary-only data-plane operation.</summary>
+    /// <param name="localRole">This node's last-known redundancy role, or <c>null</c> when unknown
+    /// (no snapshot received yet, or the snapshot omitted this node).</param>
+    /// <param name="driverMemberCount">Count of Up cluster members carrying the <c>driver</c> role.</param>
+    /// <returns><c>true</c> to service as Primary; <c>false</c> to deny.</returns>
+    public static bool ShouldServiceAsPrimary(RedundancyRole? localRole, int driverMemberCount) =>
+        localRole switch
+        {
+            RedundancyRole.Primary => true,
+            RedundancyRole.Secondary or RedundancyRole.Detached => false,
+            _ => driverMemberCount <= 1,   // unknown: allow only when no driver peer exists
+        };
+}