3d1b86b451
fix(acl): authorize scripted alarm commands at their owning equipment's scope ( #797 )
...
Scripted condition NodeIds are opaque ScriptedAlarmIds, so splitting them as a
topology path could never match an Equipment grant: a narrow equipment grant was
denied while a Cluster grant passed.
- OtOpcUaNodeManager binds each LIVE scripted condition instance to the
EquipmentId it was materialised under (only when it hangs under that folder);
dropped on remove / drop-recreate / equipment-subtree removal / rebuild; a
same-id re-materialise under another equipment re-parents and re-binds.
- DataPlaneAuthoritySnapshot carries EquipmentScopePaths (EquipmentId ->
[uns, Area, Line, Equipment]) decoded from the artifact by the same
AclScopePathResolver call that plants Equipment grants.
- DataPlaneAuthorizer.AuthorizeScriptedCondition re-reads key, grant and
generation per call (uncached) and evaluates at the owner path; unbound,
replaced or unplaceable owners deny under every grant. No id-split or
realm-root fallback.
- Native conditions (RawPath) and the ACL-off role gate are unchanged.
NodeIds and AlarmCommand.AlarmId are unchanged.
Sdk2OpaqueScriptedScopeBaselineTests deliberately flipped: it pinned the denial
and now pins owner-grant allow / sibling deny / cluster allow. Follow-up #808
(folder ids + Server-object event visibility for narrow UNS grants).
2026-11-10 21:23:57 -05:00
da4e27003e
docs: record completed Linux OPC UA lifecycle diagnostic
v2-ci / unit-tests (pull_request) Waiting to run
2026-11-10 20:28:11 -05:00
1e4b017f6e
docs: retain verified Linux rehearsal and diagnostic gate
v2-ci / unit-tests (pull_request) Failing after 1h6m11s
2026-11-10 18:25:37 -05:00
681e1c1a9b
fix: bind private temp storage for read-only late-slope runs
2026-11-10 18:18:59 -05:00
6591cf1a05
docs: prepare private native retention handoff
2026-11-10 18:03:13 -05:00
d8a6959bcf
test: verify the mapped CLR inode in late-slope diagnostics
2026-11-10 18:02:33 -05:00
f4054f6201
test: enforce late-slope restart and shutdown deadlines
2026-11-10 18:01:41 -05:00
613369fc54
test: add immutable Linux late-slope diagnostic tooling
2026-11-10 17:59:55 -05:00
7023285a3e
docs: retain late-slope guard control receipts
2026-11-10 17:54:43 -05:00
cfd3cdcd13
test: compare native keychain deletion timing
2026-11-10 17:52:51 -05:00
5ea6a23f1b
test: implement fixed Linux late-slope diagnostic mode
2026-11-10 17:47:31 -05:00
1298ecc194
test: reproduce native import retention without managed caller
2026-11-10 17:42:23 -05:00
327bbdaab9
docs: record reviewed SDK2 ownership regressions and diagnostic design
2026-11-10 17:33:06 -05:00
2e4905f112
test: record partial native bridge import control
2026-11-10 17:31:50 -05:00
69dcc431ec
test: record native Apple keychain negative control
2026-11-10 16:56:31 -05:00
3e136d7367
test(opcua): distinguish baseline close semantics and terminal ownership
2026-11-10 16:51:36 -05:00
af71fb11ba
test: isolate native certificate reload retention on macOS
2026-11-10 16:37:51 -05:00
235196beb2
test: add bounded SDK2 close ownership controls
2026-11-10 16:26:26 -05:00
10adbd57b6
test(opcua): preserve original canonical adapter partial ownership proof
2026-11-10 16:08:47 -05:00
04d5513af2
test(opcua): bind saturation artifacts to gateway 1.0 and module identities
v2-ci / unit-tests (pull_request) Has been cancelled
2026-11-10 15:03:21 -05:00
d7891372f2
test(opcua): prove saturation observer runtime event delivery
2026-11-10 14:55:46 -05:00
54a4ff2149
test(opcua): add fixed candidate saturation diagnosis with observer barriers
2026-11-10 14:55:46 -05:00
ab35ddd3c2
test: retain completed two-hour client lifecycle evidence
v2-ci / unit-tests (pull_request) Has been cancelled
2026-11-10 14:54:38 -05:00
f2a8ce1305
docs: record landed historian upgrade and support migrated replays
2026-11-10 14:44:30 -05:00
dc2a60f8fc
test: record published HistorianGateway 1.0 package verification
2026-11-10 14:41:38 -05:00
215e018a48
docs: preserve historian TLS verification command exits
2026-11-10 14:36:26 -05:00
35a4612630
test: validate historian TLS migration against isolated source
2026-11-10 14:35:35 -05:00
923bc737a3
test: initialize immutable historian TLS fixture options
2026-11-10 14:27:52 -05:00
ef21571feb
test: prepare HistorianGateway 1.0 consumer TLS migration
2026-11-10 14:24:07 -05:00
12dffb9254
docs: retain reviewed memory investigation and prospective gate limits
v2-ci / unit-tests (pull_request) Waiting to run
2026-11-10 14:21:57 -05:00
6f793d2521
test(opcua): package cross-platform lifecycle memory controls
2026-11-10 14:18:10 -05:00
a1f5028fe6
test: align Linux replay guard with reviewed production source
v2-ci / unit-tests (pull_request) Has been cancelled
2026-11-10 14:03:37 -05:00
a7efb39685
docs: record Astra source verdict and preserve failed lifecycle scope
v2-ci / unit-tests (pull_request) Has been cancelled
2026-11-10 13:33:01 -05:00
ff44167926
test: record actual ScadaBridge consumer and baseline authorization gates
2026-11-10 13:17:13 -05:00
8d75ac8c6c
test: add isolated Linux server lifecycle soak launcher
2026-11-10 13:10:20 -05:00
02ea81e1cf
test: add isolated actual Host publish smoke probe
2026-11-10 12:51:24 -05:00
47a29dee2b
test: prove peer provenance and repeated alarm authority with baseline scope oracle
2026-11-10 12:50:19 -05:00
682b73bfe8
test: add production client lifecycle soak harness
2026-11-10 12:44:04 -05:00
7b353d7bae
test: record cross-version wire compatibility and warmed metrics
2026-11-10 12:26:54 -05:00
2d75cecbb9
test: add isolated cross-version application compatibility harness
2026-11-10 12:18:46 -05:00
8c422b9ccc
test: expand original SDK aggregate edge vectors
2026-11-10 11:04:53 -05:00
a5bed28765
fix: preserve baseline OPC UA aggregate algorithms under SDK 2.0
2026-11-10 10:24:19 -05:00
Joseph Doherty