31 Commits

Author	SHA1	Message	Date
Joseph Doherty	04fa2f5cb2	Merge R2-07 Surgical pure-adds (arch-review round 2) [PR #436] ... Finding 03/P1: surgical in-place address-space adds/removals skip full rebuilds (AddressSpaceChangeClassifier default-closed to Rebuild). 3 new ISurgicalAddressSpaceSink remove members, guard-first + forwarded through DeferredAddressSpaceSink (F10b inertness net green). T5/T6/T12/T14 over-the-wire + docker-dev gates deferred. Auto-merged OtOpcUaNodeManager.cs with R2-08; verified OpcUaServer.Tests 341/341 + forwarding guard 3/3. Build clean.	2026-07-13 12:27:59 -04:00
Joseph Doherty	ded0595ca7	test+docs: mixed-deploy survival, STATUS/P1 close-out (R2-07 T14)	2026-07-13 12:24:50 -04:00
Joseph Doherty	354d74d370	docs: ServerHistorian HistoryRead knobs + Security:Ldap resilience keys; R2-08 status (03/S2, 03/S3)	2026-07-13 12:21:33 -04:00
Joseph Doherty	f4ea834fac	test(opcua): subscription-survival on pure-remove + live-verify note (R2-07 T12)	2026-07-13 12:19:36 -04:00
Joseph Doherty	4f1853b21f	docs(archreview): record R2-07 Phase 1 (offline-verified; live gate deferred) in STATUS.md	2026-07-13 12:02:16 -04:00
Joseph Doherty	1a698cbb97	Merge R2-11 TagConfig consolidation (arch-review round 2) [PR #434] ... Findings 01/C-1, 01/P-1 (single TagConfigIntent.Parse in Commons, 4 copies delegate, parse-once) + 05 CONV-2/UNDER-1/UNDER-6 (shared strict TagConfigJson readers, per-driver Inspect() + writable key, FOCAS capability pre-flight, Modbus probe timeoutMs, deploy-gate Warn|Error). Phase C runtime-strict flip deferred. T22/T24 deferred. Auto-merged AddressSpaceApplier.cs + DriverHostActor.cs with R2-04/R2-10; verified OpcUaServer.Tests 286/286 + Runtime.Tests 396/396. Build clean.	2026-07-13 11:29:32 -04:00
Joseph Doherty	7fc3b19961	docs: R2-11 TagConfig consolidation + strictness rollout decisions	2026-07-13 11:24:39 -04:00
Joseph Doherty	1e3552dbd5	docs(archreview): R2-10 resilience observability shipped	2026-07-13 10:50:02 -04:00
Joseph Doherty	46fedda3e4	Merge R2-02 ResilienceConfig hardening (arch-review round 2) [PR #431] ... Findings 01/S-6 (High — clamp hostile ResilienceConfig, no ValidationException driver-brick), 01/U-6 (delete dead bulkhead knob), 01/S-8=03/S12 (Write/Ack non-idempotent + retry->0), 04/C-7 (JsonObject round-trip preserves unknown keys), 01/S-7=03/S13 (per-Create options-generation kills respawn cache race). T15/T18 deferred. STATUS.md conflict resolved additively. Build clean.	2026-07-13 10:29:43 -04:00
Joseph Doherty	dd82e74011	docs(r2-02): record R2-02 resilience hardening pass in STATUS.md + execution deviations	2026-07-13 10:27:08 -04:00
Joseph Doherty	901d4e6ed3	Merge R2-03 Virtual-Tag failure quality (arch-review round 2) [PR #430] ... Findings 02/S13 (VT failure/timeout degrades node to Bad quality, no stale-Good forever), 02/S12 (evaluator retry-once on disposed-race), 02/P7 (compile-cache clear gated on changed expression set). T11/T12 deferred. STATUS.md conflict resolved additively. Build clean.	2026-07-13 10:20:43 -04:00
Joseph Doherty	534e03bc74	docs(archreview): record R2-03 (02/S13+S12+P7) fixed on branch; full VT suites green	2026-07-13 10:18:10 -04:00
Joseph Doherty	fea6477f45	Merge R2-01 S7 fault-path hardening (arch-review round 2) [PR #429] ... Findings 05/STAB-14 (High regression — connect-timeout OCE no longer silently kills S7 subscriptions), STAB-15 (framing/desync + mid-PDU cancel fatal classification), STAB-8 seam note. All prod changes in S7Driver.cs; T11 live outage gate deferred. STATUS.md conflict resolved additively. Build clean.	2026-07-13 10:14:59 -04:00
Joseph Doherty	12b3206555	Merge R2-05 AdminUI authorization (arch-review round 2) [PR #428] ... Finding 04/C-1 (High): explicit named-policy gating on all 38 AdminUI pages via new AdminUiPolicies (ConfigEditor + AuthenticatedRead) + anti-drift reflection guard. T15 live pass deferred (docker-dev auto-admin can't observe deny). STATUS.md conflict resolved additively. Build clean.	2026-07-13 10:12:57 -04:00
Joseph Doherty	479057097a	Merge R2-06 ServerHistorian fail-fast + 0.2.0 DataType (arch-review round 2) [PR #427] ... Findings 06/S-11 (fail-fast ServerHistorianOptionsValidator, no UriFormatException crash-loop), 06/U-7 (0.2.0 Boolean->Int1 explicit-presence + retype probe), 06/C-7 (keep-populating decision doc). T12 live VPN gate deferred. STATUS.md conflict (R2-12 bookkeeping) resolved additively. Build clean.	2026-07-13 10:10:48 -04:00
Joseph Doherty	bdb7ed412d	docs(archreview): R2-01 S7 fault-path hardening complete — STAB-14/15 fixed, STAB-8 seam documented (task 12)	2026-07-13 10:09:03 -04:00
Joseph Doherty	fc38cee00e	docs(r2-06): record S-11/U-7/C-7 remediation in STATUS.md + 06 report rows (06/S-11,U-7,C-7)	2026-07-13 10:07:00 -04:00
Joseph Doherty	04a9edab7e	docs(r2-12): record R2-12 repo-hygiene execution + open follow-ups in STATUS.md	2026-07-13 10:02:38 -04:00
Joseph Doherty	dad783514a	docs(security): document AdminUI policy tiers (ConfigEditor/AuthenticatedRead) + R2-05 status	2026-07-13 10:01:52 -04:00
Joseph Doherty	1891f5d6a7	docs(archreview): 2026-07-12 re-review at f6eaa267 + 12 round-2 remediation plans ... Re-ran all seven domain reviews at master f6eaa267 (reports rewritten in place, each with a prior-finding status table): all 4 round-1 Criticals verified closed; new top findings are the S7 connect-timeout OCE regression (05/STAB-14), the ResilienceConfig operator-authorable brick (01/S-6), and a batch of resilience-seam Mediums. 00-OVERALL.md carries the updated maturity matrix + 12-item action list. Adds R2-01..R2-12 design/implementation plans (one per action item, house format + bite-sized TDD task breakdowns + co-located .tasks.json; 193 tasks, ~18-24 dev-days). STATUS.md updated: round-1 topology marked historical (all merged+pushed), re-review findings table + plan pointers added.	2026-07-12 23:52:23 -04:00
Joseph Doherty	357709bc71	docs(archreview): docker-dev ServerHistorian rig bug FIXED (branch fix/docker-dev-serverhistorian-stale-keys 7233e2ba) ... Flip the #12 rig-bug note from 'recommend fixing' to fixed: FOLLOWUP-10 + STATUS task #12 + new branch topology row. central-1 verified booting clean with the committed compose.	2026-07-08 23:43:56 -04:00
Joseph Doherty	347446d627	docs(archreview #12): record live-gate outcome (DI wiring confirmed live; behavioral log a disciplined stop) ... Ran the #10 live gate: built the Host image from source (crit13 tip; Gitea feed answers 200 anonymously so restore worked), stood up the docker-dev rig, central-1 booted healthy on the new invoker wiring. Prod DI binds the REAL DriverCapabilityInvokerFactory — confirmed live + by a new deterministic guard (ResilienceInvokerFactoryRegistrationTests, crit13 8a8b9ec5). The behavioral retry/breaker log-line was NOT observed: reading the Modbus driver showed its cheap paths don't throw a wrapped exception (Discover offline, Subscribe lazy, reads non-wrapped) — only an idempotent write-to-dead-endpoint or S7 does, not worth the multi-dependency chase since the retry behavior is deterministically proven. Also found a rig bug: docker-dev compose's retired Wonderware ServerHistorian keys (Host/Port/SharedSecret, Enabled=true) crash the Host at bring-up (historian-gateway cutover now reads Endpoint -> empty UriFormatException). Worked around with an override; recommend fixing the committed compose. FOLLOWUP-10 + STATUS updated; crit13 topology head -> 8a8b9ec5.	2026-07-08 23:25:31 -04:00
Joseph Doherty	051a59845d	docs(archreview): record #13 IMPLEMENTED (ResilienceConfig read-path plumbing) ... - New FOLLOWUP-13: the DriverInstance.ResilienceConfig column was authored/persisted and already in the artifact; only the driver-node read path dropped it. Read-path plumbing + invalidate-on-change + respawn-on-change; deterministic verification. - FOLLOWUP-10 sub-gap (a) 'tier-defaults only' → RESOLVED by #13 (sub-gap (b) tracker reader still open). - STATUS.md: task #13 → completed; crit13 branch topology row; Completed-table row; findings #10 bullet updated; FOLLOWUP-13 linked.	2026-07-08 22:51:15 -04:00
Joseph Doherty	e233db7456	docs(archreview): record #11 CORRECTED (Crit-1 premise) + track residual #12/#13 ... - FOLLOWUP-11 → IMPLEMENTED with outcome (docs/comment-only, no code revert; the four corrected sites; Cluster.Tests 29/29). - STATUS.md: task #11 → completed; crit1 branch head → eaf78aad; Completed-table row; Findings #11 bullet flipped to CORRECTED; added task rows #12 (live gate) + #13 (ResilienceConfig-in-artifact).	2026-07-08 22:36:10 -04:00
Joseph Doherty	877cb9bc56	docs(archreview): record #10 IMPLEMENTED (Core.Abstractions seam) + residual findings ... Updates FOLLOWUP-10 + STATUS.md now that #10 is wired: - The filed "thread CapabilityInvoker into the actor" was infeasible — Runtime is deliberately Polly-free (refs Core.Abstractions, not Core). Shipped a seam mirroring IDriverFactory (branch fix/archreview-crit10-wire-capability-invoker @ 62556c24). - Triage corrections: only 6 of 7 sites are real (GenericDriverNodeManager is test-only scaffolding, re-annotated); tier-defaults only (ResilienceConfig not in the artifact). - Observability finding: the resilience-status tracker has no reader (Stream E.2/E.3 never shipped) → added retry/breaker logging as the interim surface + live-verify enabler. - Verification: negative-control, recording-invoker routing, real-invoker actor-context, analyzer + logging tests; clean solution build; Runtime 358 / Core 238 / Analyzers 32. - Residual: live behavioral gate (rig recipe recorded) + the ResilienceConfig-in-artifact sub-gap follow-up.	2026-07-08 21:42:17 -04:00
Joseph Doherty	9cd1f8c4e7	docs(archreview): file follow-up records for open decisions #10 (RESILIENCE-DISPATCH-GAP) + #11 (Crit-1 SBR premise)	2026-07-08 20:06:15 -04:00
Joseph Doherty	14f0cae7d9	docs(archreview): mark guards 07/C-1, 07/S-1,S-2,S-4 + #9 failover done; record findings #10, #11	2026-07-08 18:27:16 -04:00
Joseph Doherty	a203950848	docs(archreview): mark guard 03/U2 (deferred-sink forwarding test) done	2026-07-08 17:38:58 -04:00
Joseph Doherty	26c9d28b69	docs(archreview): mark Critical 4 (TwinCAT notification replay / STAB-2) done ... All 4 Criticals complete. crit4 branch af318fb4: replayable-intent store + reconnect-replay + probe-recycle, 4 unit guards + 174/174 (unit-only, no TC3 fixture). Next: systemic guards (task 6 forwarding test first) + Critical-1 failover harness (task 9).	2026-07-08 17:21:13 -04:00
Joseph Doherty	fcd36bd53d	docs(archreview): mark Critical 3 (S7 reconnect / STAB-1) done + live-verified ... STATUS.md + 05 plan banner: crit3 branch 25c0c6f6, IS7Plc seam + lazy reconnect, 4 unit guards + full S7 suite, LIVE snap7 container-bounce proof (recovers with no redeploy). Next: Critical 4 (TwinCAT ADS re-registration, unit-only — no TC3 fixture).	2026-07-08 17:05:51 -04:00
Joseph Doherty	e31d29c04c	docs(archreview): add STATUS.md handoff + per-plan status banners ... Track remediation progress: 2 of 4 Criticals done (03/S1 split-brain resolver; 02/U2+U3 VT timeout+ALC) + both CLAUDE.md doc-drifts fixed. STATUS.md is the single source of truth (branch topology, completed items, task list, next-up, resume facts). Each plan carries a status banner.	2026-07-08 16:25:39 -04:00