11 Commits

Author	SHA1	Message	Date
Joseph Doherty	adce27e7fa	refactor(drivers): delete the dead discovered-node injection path (§8.2, #507) ... #507 was filed as "injection inert in v3, re-migrate onto the raw subtree". Reading it, the retained code is not revivable: it resolves equipment from EquipmentNode.DriverInstanceId UNION EquipmentTags, and BOTH are structurally empty in v3 (AddressSpaceComposer always constructs EquipmentNode with a null DriverInstanceId; DeploymentArtifact hard-codes an empty EquipmentTags set). Removing the guard would have changed a log line and injected nothing. So it is deleted rather than fixed, and #507 closes as superseded by /raw browse-commit. Removed: HandleDiscoveredNodes, PartitionDiscoveredByDeviceHost, ShouldWarnPartition, PlansRoutingEqual, ApplyDiscoveredPlansForDriver, _discoveredByDriver, the redeploy re-inject tail, DiscoveredNodeMapper, DiscoveredInjection, AddressSpaceApplier.MaterialiseDiscoveredNodes, OpcUaPublishActor.MaterialiseDiscoveredNodes, and the Runtime-local copies of CapturingAddressSpaceBuilder/DiscoveredNode. The connect-time discovery loop goes too (StartDiscovery, RediscoverTick, HandleRediscoverAsync, DiscoveredNodesReady, TriggerRediscovery). With injection gone it had no consumer, and leaving it would either dead-letter or keep browsing real devices up to ~15x per connect to drop the result. ITagDiscovery itself stays — the /raw browse picker drives it through Commons/Browsing/DiscoveryDriverBrowser, which never went through the actor, so the picker is unaffected. deferment.md §4.4 called the 18 DiscoveryInjectionDormantV3 tests "Real — blocked on #507". They are not: they assert an equipment-rooted graft (EquipmentRootNodeId == "EQ-1") that v3 cannot produce, so they could never have unskipped as written. Deleted along with DiscoveredNodeMapperTests, the CapturingAddressSpaceBuilder tests, and the MaterialiseDiscoveredNodes tests in AddressSpaceApplierTests/OpcUaPublishActorTests. Runtime.Tests skipped: 31 -> 13. IHostConnectivityProbe is deliberately NOT resolved here. GetHostStatuses() has no production call site and nothing writes a DriverHostStatus row, but the table was re-created in the v3 initial migration, so deleting on inference would be wrong. Split to Gitea #521 with both options costed. CLAUDE.md, docs/drivers/{Galaxy,TwinCAT,MTConnect}.md updated — they described the seam as dead. Build clean; Runtime.Tests 476 passed / 13 skipped; OpcUaServer.Tests 362 passed / 4 skipped.	2026-07-27 18:57:09 -04:00
Joseph Doherty	e08855fb9d	docs: source-verified deferment register + correct 17 drifted docs ... Adds deferment.md — a source-verified inventory of new-driver status, all 17 open issues, in-code deferrals, open live gates and plan bookkeeping. Every claim was checked against src/ and git, not against documentation. Headline finding: three subsystems are authored, persisted and shipped but never executed — * Node ACLs: IPermissionEvaluator/TriePermissionEvaluator have zero production consumers and OtOpcUaNodeManager never references them, yet ClusterAcls.razor authors NodeAcl rows and ConfigComposer.cs:51 ships them in every artifact. An authored deny rule has no effect. * IRediscoverable / IHostConnectivityProbe raise into the void (#518/#507); nothing ever writes a DriverHostStatus row. * DriverTypeRegistry is vestigial, so no factory passes a tier and every driver runs Tier A with the Tier-C protections dormant. Also records the Calculation driver as picker-visible but unauthorable (DriverConfigModal has no case) — the "registered but unauthorable" class recurring after the Sql picker defect — and notes that no parity test guards DriverConfigModal/DeviceModal, which is why it survived review. Documentation corrections (source-verified): * ReadWriteOperations.md claimed "a denied read never hits the driver" via four types that do not exist in src/. Bannered + struck through; a security review reading that page would have concluded a per-node ACL gate exists. * CLAUDE.md: the Change Detection sentence was false (DriverHost consumes nothing); the mesh Phase 4 and Phase 5 live gates and the auto-down 1-vs-1 gate had all PASSED; the ScriptedAlarmState table was already dropped. * driver-expansion tracking: Modbus RTU and SQL poll are merged, not pending — its command table would have made someone rebuild two shipped drivers in a fresh worktree. * drivers/README.md: dead DriverTypeRegistry paragraph, retired SystemPlatform namespace kind, missing Sql + Calculation rows, missing Modbus RTU-over-TCP transport. * TwinCAT.md/Galaxy.md promised an address-space rebuild that never happens. * Historian.md gained the #491 unproven-value-capture pointer. * IncrementalSync.md and AddressSpace.md bannered as wholesale v2-era (the rewrite is recorded as still owed, not done here); four v2 status docs bannered as historical; three wrong-name-for-a-live-type fixes. Left deliberately untouched: the secrets NoOpSecretReplicator line, which makes a security claim and needs the real behaviour identified rather than a rename.	2026-07-27 17:26:20 -04:00
Joseph Doherty	08a6551360	docs(phase4b): Modbus driver-type canonical + Galaxy nesting + FOCAS auto-scale (managed-backend caveat)	2026-06-16 19:58:11 -04:00
Joseph Doherty	d2cc4a1222	test+docs(galaxy): verify alarm acknowledger recovers after transient fault; document alarm-client reconnect	2026-06-11 11:12:49 -04:00
Joseph Doherty	521ee75355	docs: redundancy primary-only alarm emission/historization, redundancy-state NodeId+heartbeat fixes, Galaxy reconnect, live-pill	2026-06-11 10:18:25 -04:00
Joseph Doherty	d731ed98fa	docs(audit): drivers/Galaxy.md — interface list + accuracy pass ... CODE-REALITY (known defect): the capability-surface declaration line omitted IAlarmSource and IAsyncDisposable. GalaxyDriver.cs:39 actually declares: IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IRediscoverable, IHostConnectivityProbe, IAlarmSource, IDisposable, IAsyncDisposable. Doc line corrected to match exactly, and an IAlarmSource row added to the capability table (Runtime/GatewayGalaxyAlarmFeed.cs + Runtime/GatewayGalaxyAlarmAcknowledger.cs). STALE-STATUS: the v1-doc move note claimed Galaxy-Repository.md / Galaxy-Test-Fixture.md 'are being moved to docs/v1/ by a parallel cleanup track' — that move is complete; they live at docs/v1/drivers/. Rewrote to present tense and linked the real targets. Verified against source: deploy-watch is a gRPC stream (GatewayGalaxyDeployWatchSource forwards WatchDeployEventsAsync via GalaxyRepositoryClient, not a direct DB poll); contained-name<->tag-name translation (GalaxyDiscoverer.cs:49,60); DataTypeMap at Browse/DataTypeMap.cs; IGalaxyHierarchySource / IGalaxyDeployWatchSource / DeployWatcher all present. check_links.py: zero rows for docs/drivers/Galaxy.md.	2026-06-03 15:58:32 -04:00
Joseph Doherty	969b0847a1	docs: update path references for module-folder reorganization ... Rewrite src/ and tests/ project paths in docs, CLAUDE.md, README.md, and test-fixture READMEs to the new module-folder layout (Core/Server/Drivers/ Client/Tooling). References to retired v1 projects (Galaxy.Host/Proxy/Shared, the legacy monolithic test projects) are left untouched. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-17 02:10:29 -04:00
Joseph Doherty	89004c052c	docs: alarms-over-gateway completion banner + AlarmTracking v2 (PR B.5) ... Sixteenth PR of the alarms-over-gateway epic (docs/plans/alarms-over-gateway.md). Closes the documentation sweep the plan calls for. - docs/AlarmTracking.md — promoted top-level v2-final architecture doc (was a worktree-only draft pre-epic). Covers the three alarm sources (Galaxy MxAccess driver-native / Galaxy sub-attribute fallback / scripted alarms), how they converge on AlarmConditionService, the Acknowledge routing decision in DriverNodeManager (driver-native preferred over IWritable sub-attribute fallback), the sidecar historian write-back path for non-Galaxy producers, and cross-references to the plan + v1 archive. - docs/v1/AlarmTracking.md — banner pointing readers at the v2 doc; preserved as historical record. - docs/drivers/Galaxy.md — capability list updated to include IAlarmSource (now eight capabilities, restored by B.2). Replaced the "IAlarmSource retired in 7.2" sentence with the restoration note + cross-link to docs/AlarmTracking.md. - docs/plans/alarms-over-gateway.md — completion banner at the top of the plan, marking 14 of 16 PRs shipped 2026-04-30 and noting that A.2 + A.4 + D.1 are the hardware-gated follow-up. Memory entries updated separately: - project_alarms_over_gateway_epic.md (new) — epic summary + per-PR digest. - project_galaxy_via_mxgateway.md — added "Alarms restored" bullet pointing at the new architecture. - project_server_history_alarm_subsystems.md — bullet 2 updated to describe the new ack-routing decision (B.3) + bullet 3 added describing the historian write-back path that B.4 + C.1 + C.2 light up. - MEMORY.md index — new pointer entry. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-30 21:09:04 -04:00
Joseph Doherty	006af51768	docs: post-PR-7.2 cleanup — audit + three-track scrub ... Audit (three parallel agent passes) found 43 markdown files carrying stale references to the deleted Galaxy.Host/Proxy/Shared projects after the v2-mxgw merge. This commit lands the prioritized fixes. Track 1 — high-traffic in-place rewrites (3 files, ~454 lines deleted) - README.md (202 → 91 lines): drops .NET 4.8 / x86 / TopShelf install text; leads with the multi-driver .NET 10 server identity and points at scripts/install/Install-Services.ps1 and the parity rig. - docs/v2/driver-specs.md §1 Galaxy (~289 → ~66 lines): replaces the Tier-C out-of-process spec with a Tier-A in-process description matching the current GalaxyDriver code, with the four-section GalaxyDriverOptions JSON shape pulled verbatim from Config/GalaxyDriverOptions.cs. - docs/drivers/Galaxy.md (211 → 92 lines): full rewrite around the current Browse/Runtime/Health/Config sub-folders. Track 2 — historical banners (5 files) - lmx_mxgw.md, lmx_mxgw_impl.md, lmx_backend.md, docs/v2/Galaxy.ParityMatrix.md, docs/v2/implementation/phase-2-galaxy-out-of-process.md each get a "✅ Completed 2026-04-30 — historical record" banner block. lmx_mxgw.md also fixes two dead links (`docs/Galaxy.Driver.md` and `docs/v2/Galaxy.Driver.md`) → `docs/drivers/Galaxy.md`. Track 3 — v1 archive sweep (10 git mv + 1 new index + 2 in-place scrubs) - Moved 10 v1 docs under docs/v1/ preserving subpath structure: AlarmTracking, Configuration, DataTypeMapping, HistoricalDataAccess, Subscriptions (top-level); drivers/Galaxy-Repository, drivers/Galaxy-Test-Fixture; reqs/GalaxyRepositoryReqs, reqs/MxAccessClientReqs, reqs/ServiceHostReqs. - New docs/v1/README.md is the shared archive banner + per-file table. - docs/README.md repointed to the v1 paths and updated to reflect the v2 two-process deploy shape (Server + Admin + optional OtOpcUaWonderwareHistorian). - docs/v2/Galaxy.ParityRig.md got a historical banner + four inline scrubs marking the OtOpcUaGalaxyHost service / Driver.Galaxy.Host EXE / Driver.Galaxy.ParityTests project as deleted-in-PR-7.2. The repo's live-reading surface (README + CLAUDE.md + docs/v2/) now describes only the post-PR-7.2 architecture. v1 docs are preserved as a labelled archive under docs/v1/. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-30 08:59:59 -04:00
Joseph Doherty	d11dd0520b	Galaxy IPC unblock — live dev-box E2E path ... Three root-cause fixes to get an elevated dev-box shell past session open through to real MXAccess reads: 1. PipeAcl — drop BUILTIN\Administrators deny ACE. UAC's filtered token carries the Admins SID as deny-only, so the deny fired even from non-elevated admin-account shells. The per-connection SID check in PipeServer.VerifyCaller remains the real authorization boundary. 2. PipeServer — swap the Hello-read / VerifyCaller order. ImpersonateNamedPipeClient returns ERROR_CANNOT_IMPERSONATE until at least one frame has been read from the pipe; reading Hello first satisfies that rule. Previously the ACL deny-first path masked this race — removing the deny ACE exposed it. 3. GalaxyIpcClient — add a background reader + single pending-response slot. A RuntimeStatusChange event between OpenSessionRequest and OpenSessionResponse used to satisfy the caller's single ReadFrameAsync and fail CallAsync with "Expected OpenSessionResponse, got RuntimeStatusChange". The reader now routes response kinds (and ErrorResponse) to the pending TCS and everything else to a handler the driver registers in InitializeAsync. The Proxy was already set up to raise managed events from RaiseDataChange / RaiseAlarmEvent / OnHostConnectivityUpdate — those helpers had no caller until now. 4. RedundancyPublisherHostedService — swallow BadServerHalted while polling host.Server.CurrentInstance. StandardServer throws that code during startup rather than returning null, so the first poll attempt crashed the BackgroundService (and the host) before OnServerStarted ran. This race was latent behind the Galaxy init failure above. Updates docs that described the Admins deny ACE + mandatory non-elevated shells, and drops the admin-skip guards from every Galaxy integration + E2E fixture that had them (IpcHandshakeIntegrationTests, EndToEndIpcTests, ParityFixture, LiveStackFixture, HostSubprocessParityTests). Adds GalaxyIpcClientRoutingTests covering the router's request/response match, ErrorResponse, event-between-call, idle event, and peer-close paths. Verified live on the dev box against the p7-smoke cluster (gen 6): driver registered=1 failedInit=0, Phase 7 bridge subscribed, OPC UA server up on 4840, MXAccess read round-trip returns real data with Status=0x00000000. Task #112 — partial: Galaxy live stack is functional end-to-end. The supplied test-galaxy.ps1 script still fails because the UNS walker encodes TagConfig JSON as the tag's NodeId instead of the seeded TagId (pre-existing; separate issue from this commit). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-24 16:30:16 -04:00
Joseph Doherty	71339307fa	Doc refresh (task #203) — driver docs split + drivers index + IHistoryProvider-aware HistoricalDataAccess ... Restructure the driver-facing docs to match the OtOpcUa v2 multi-driver reality (Galaxy, Modbus, S7, AB CIP, AB Legacy, TwinCAT, FOCAS, OPC UA Client — 8 drivers total; Galaxy ships as three projects) and the capability-interface architecture where every driver opts into IDriver + whichever of IReadable / IWritable / ITagDiscovery / ISubscribable / IHostConnectivityProbe / IPerCallHostResolver / IAlarmSource / IHistoryProvider / IRediscoverable it supports. Doc scope follows the code: one-driver-specific docs scoped to that driver, cross-driver concerns live once at the top level, per-driver specs cross-link to docs/v2/driver-specs.md rather than duplicate. What changed per file: - docs/MxAccessBridge.md -> docs/drivers/Galaxy.md (git mv + rewrite): retitled "Galaxy Driver", reframed as one of seven drivers. Added Project Split table (Shared .NET Standard 2.0 / Host .NET 4.8 x86 / Proxy .NET 10) and Why Out-of-Process section citing both the MXAccess bitness constraint and Tier C stability isolation per docs/v2/plan.md section 4. Added IPC Transport section covering pipe naming, MessagePack framing, DACL that denies Admins, shared-secret handshake, heartbeat, and CallAsync<TReq,TResp> dispatch. Moved file paths from src/ZB.MOM.WW.LmxOpcUa.Host/MxAccess/* to src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host/Backend/MxAccess/* and added the Shared + Proxy key-file tables. Added CapabilityInvoker + OTOPCUA0001 analyzer callout. Cross-linked to drivers/README.md, Galaxy-Repository.md, HistoricalDataAccess.md. - docs/GalaxyRepository.md -> docs/drivers/Galaxy-Repository.md (git mv + rewrite): retitled "Galaxy Repository — Tag Discovery for the Galaxy Driver", opened with a comparison table showing how every driver's ITagDiscovery source is different (AB CIP @tags walker, TwinCAT SymbolLoaderFactory, FOCAS CNC queries, OPC UA Client Session.Browse, etc). Repositioned GalaxyRepositoryService as the Galaxy driver's ITagDiscovery.DiscoverAsync implementation. Updated paths to Driver.Galaxy.Host/Backend/GalaxyRepository/*. Added IRediscoverable section covering the on-change-redeploy IPC path. - docs/drivers/README.md (new): index with ground-truth driver table — project path, stability tier, wire library, capability-interface list, and one notable quirk per driver. Verified against the driver csproj files and class declarations on focas-pr3-remaining-capabilities (the most recent branch containing every driver). Galaxy gets its own dedicated docs; the other seven drivers cross-link to docs/v2/driver-specs.md. Lists the full Core.Abstractions capability surface, DriverTypeRegistry, CapabilityInvoker, and OTOPCUA0001 analyzer. - docs/HistoricalDataAccess.md (rewrite): reframed around IHistoryProvider as a per-driver optional capability interface. Replaced v1 HistorianPluginLoader / AvevaHistorianPluginEntry plugin architecture with the v2 story — Historian.Aveva was merged into Driver.Galaxy.Host/Backend/Historian/ and IPC-forwarded through GalaxyProxyDriver. Documented all four IHistoryProvider methods (ReadRawAsync / ReadProcessedAsync / ReadAtTimeAsync / ReadEventsAsync), CapabilityInvoker wrapping with DriverCapability.HistoryRead, and the per-driver coverage matrix (Galaxy + OPC UA Client implement; the six protocol drivers don't and return BadHistoryOperationUnsupported). Kept the cluster-failover + health-counter + quality-mapping detail for the Galaxy Historian implementation. Flagged one gap: Proxy forwards all four history message kinds but the Host-side HistoryAggregateType -> AnalogSummary column mapping may surface GalaxyIpcException{Code="not-implemented"} on a given branch until the Phase 2 Galaxy out-of-process gate lands. Driver list built against ground truth (src on focas-pr3-remaining-capabilities): Driver.Galaxy.{Shared,Host,Proxy}, Driver.Modbus, Driver.S7, Driver.AbCip, Driver.AbLegacy, Driver.TwinCAT, Driver.FOCAS, Driver.OpcUaClient. Capability interface lists verified against each *Driver.cs class declaration. Aveva Historian ported to Driver.Galaxy.Host/Backend/Historian/; no separate Historian.Aveva assembly on v2 branches. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-20 01:33:53 -04:00