From f679b2f10a4781063c5f405459cc63c1ff7e6bf0 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Tue, 18 Aug 2026 10:01:48 -0400 Subject: [PATCH] =?UTF-8?q?docs(plans):=20annotate=20the=20r3=20register?= =?UTF-8?q?=20=E2=80=94=20browse-transit-below-realm-root=20closed=20by=20?= =?UTF-8?q?89630ee4+ff9d617a?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/plans/2026-08-17-perf-followups-r3.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docs/plans/2026-08-17-perf-followups-r3.md b/docs/plans/2026-08-17-perf-followups-r3.md index ece17990..8bec97cd 100644 --- a/docs/plans/2026-08-17-perf-followups-r3.md +++ b/docs/plans/2026-08-17-perf-followups-r3.md @@ -818,6 +818,17 @@ round-2 register. **None of these blocks the branch.** Client.CLI's own default recursive browse. Discovered by the T7 live gate. **RECOMMEND filing a Gitea issue before anyone enables `Security:Acl:Enabled` in production.** Likely fix: mark the realm-root container browse-transit whenever any grant resolves beneath it. + - **Closed by `89630ee4` + `ff9d617a` (branch `fix/acl-anchor-browse-transit`, 2026-08-18)** — no + Gitea issue needed; fixed directly. The actual mechanism was one step off the guess above: the + trie's zero-segment realm-root branch already existed and was correct — nothing ever *produced* + that scope, because the shared anchor's identifier (`s=OtOpcUa`, now `V3NodeIds.SharedRootFolderId`) + split into a one-segment scope no grant path contains. `DataPlaneAuthorizer.BuildScope` now maps + the anchor (realm-qualified: Raw namespace only) onto the zero-segment scope, and `Evaluate` adds + a Browse-only second walk against the zero-segment **Uns** scope — the single anchor fronts both + trees, so a UNS-only grant holder must also get through. 11 new tests (3 trie pins, 7 authorizer + incl. falsification of the OR-leg and of the realm qualification, 1 e2e browse-succeeds-and-still- + filters through a booted server). Full high-risk chain: spec ✅, code CHANGES REQUESTED (stale + "two namespace root folders" XML remark) → fixed → delta re-APPROVED. - **`ns=0` standard nodes are ungated — the boot warning overstates.** With the gate on, both the key and anonymous read `i=2256` and browse `i=2253` successfully: those are served by the SDK's `CoreNodeManager` and never reach `DataPlaneAuthorizer`. Defensible (standard server