20 Commits

Author	SHA1	Message	Date
Joseph Doherty	607dc51dec	feat(opcua): #85 UNS Area/Line/Equipment folder hierarchy in SDK ... Phase7Composer now carries UnsAreaProjection + UnsLineProjection lists so the applier can materialise the full UNS topology in the OPC UA address space. New IOpcUaAddressSpaceSink.EnsureFolder(folderNodeId, parentNodeId, displayName) seam (no-op default, recorded in tests, forwarded by DeferredAddressSpaceSink, implemented by SdkAddressSpaceSink). The SDK- side OtOpcUaNodeManager gains an EnsureFolder API that creates FolderState nodes with proper parent linkage; RebuildAddressSpace now clears folders too so re-applies don't accumulate stale topology. Phase7Applier.MaterialiseHierarchy walks composition.UnsAreas → composition.UnsLines → composition.EquipmentNodes, calling EnsureFolder with the correct parent at each level. Idempotent — calling twice with the same composition is a no-op. OpcUaPublishActor.HandleRebuild invokes it after Phase7Applier.Apply so OPC UA clients browsing the server now see Area/Line/Equipment as proper folders rather than flat tag ids. DeploymentArtifact.ParseComposition reads UnsAreas + UnsLines from the JSON snapshot the ControlPlane emits, populating the new fields when present. Phase7Composer.Compose now accepts UnsAreas + UnsLines; a 3-arg overload preserves the old signature for legacy callers + existing tests. The Phase7CompositionResult convenience ctor likewise keeps the planner tests working without UNS data. 3 new hierarchy tests (pure unit + boot-verify against a real OtOpcUaSdkServer); OpcUaServer suite is 48/48 green (was 45, +3), Runtime 74/74 unchanged. Closes #85.	2026-05-26 10:48:56 -04:00
Joseph Doherty	9d86287d08	test(opcua): Task 60 ServiceLevel end-to-end through SDK ... Boots a real StandardServer + OpcUaApplicationHost, wires SdkServiceLevelPublisher into a DeferredServiceLevelPublisher (production binding pattern), spawns OpcUaPublishActor against the deferred publisher, sends RedundancyStateChanged snapshots, and asserts that ServerObject.ServiceLevel.Value reflects the role-derived byte: Primary + RoleLeaderForDriver → 240 Secondary → 100 Together with the F13b endpoint-security tests (which already verify ServerConfiguration.SecurityPolicies populates the three baseline profiles), this closes Task 60's "dual-endpoint + ServiceLevel" scope. Cross-node failover tests stay in the 2-node integration harness (Task 59 / FailoverScenarioTests). Runtime suite now 74 / 74 green (+2). Closes Task 60.	2026-05-26 10:40:58 -04:00
Joseph Doherty	52997ee164	feat(observability): F13d Prometheus + OpenTelemetry instrumentation ... OtOpcUaTelemetry (Commons/Observability) centralizes the project's Meter + ActivitySource so all instrumentation points emit through a single named surface. Counters cover the hot paths: otopcua.deploy.applied (outcome=ack|reject) otopcua.deploy.apply.duration (s, histogram) otopcua.driver.lifecycle (event=spawn|spawn_stub|stop|fault) otopcua.virtualtag.eval (outcome=ok|fail|skip) otopcua.scriptedalarm.transition (state=activated|acknowledged|cleared) otopcua.opcua.sink.write (kind=value|alarm|rebuild) otopcua.redundancy.service_level_change (level=byte) Plus two ActivitySource spans: otopcua.deploy.apply wraps DriverHostActor.ApplyAndAck otopcua.opcua.address_space_rebuild wraps OpcUaPublishActor.HandleRebuild Instruments are no-op until a listener attaches, so tests + dev hosts pay nothing for unread telemetry. Host Program.cs gains AddOtOpcUaObservability() (binds the OtOpcUa Meter + ActivitySource to OpenTelemetry, attaches a Prometheus exporter) and MapOtOpcUaMetrics() (mounts /metrics scrape endpoint). Driver-side internals + ASP.NET request metrics deliberately stay off — the scrape payload is scoped to OtOpcUa signals only. Tests use MeterListener + ActivityListener to verify VirtualTagActor.eval, OpcUaPublishActor.AttributeValueUpdate, and RebuildAddressSpace actually emit on the central instruments. Runtime suite is 72 / 72 green (+3). Closes #105. Path A (F13b/c/d) complete; next batch options: #85 UNS folder hierarchy in SDK, or F8b/F9b production engine bindings.	2026-05-26 10:29:40 -04:00
Joseph Doherty	50787823d3	feat(host,runtime): #108 Host DI bindings — OPC UA server + deferred sink ... Wires the OPC UA SDK into the fused Host's lifecycle on driver-role nodes + spawns OpcUaPublishActor with the proper sink/publisher/dbFactory/ applier resolution. The full read+write data path is now live in production: Deploy → DriverHost → OpcUaPublish → SDK NodeManager → subscribed OPC UA clients. DeferredAddressSpaceSink (Commons.OpcUa): - Thread-safe wrapper IOpcUaAddressSpaceSink that delegates to an inner sink swapped in at runtime. Needed because Akka actors resolve the sink at construction time, but the production sink (SdkAddressSpaceSink wrapping OtOpcUaNodeManager) only exists after the SDK StandardServer has started. - Defaults to NullOpcUaAddressSpaceSink so calls before swap are safe; SetSink(null) reverts (for graceful shutdown). OtOpcUaServerHostedService (Host.OpcUa): - IHostedService that owns the OPC UA SDK lifecycle. Reads OpcUaApplicationHostOptions from the 'OpcUa' config section, creates an OtOpcUaSdkServer, boots it through OpcUaApplicationHost, then swaps a real SdkAddressSpaceSink into the DeferredAddressSpaceSink singleton. - SDK boot failure is logged + non-fatal — the rest of the host (admin UI, driver actors) keeps running. Stop reverts to null sink. WithOtOpcUaRuntimeActors (Runtime): - Now spawns OpcUaPublishActor (new actor) + threads its ActorRef into DriverHostActor's Props so successful applies trigger the address-space rebuild pipeline. - Phase7Applier is constructed here from the resolved sink + a logger; OpcUaPublishActor takes both. - Prepends the opcua-synchronized-dispatcher HOCON so the extension is self-contained — consumers (Host, tests) don't need to redeclare the dispatcher block. - New OpcUaPublishActorKey + OpcUaPublishActorName for actor-registry resolution. - AddOtOpcUaRuntime now also TryAddSingleton's NullOpcUaAddressSpaceSink + NullServiceLevelPublisher so admin-only nodes (or tests that don't bind the Deferred sink) stay safe. Host.Program.cs (driver-role only): - Binds DeferredAddressSpaceSink as singleton + as IOpcUaAddressSpaceSink - AddHostedService<OtOpcUaServerHostedService>() Tests: OpcUaServer 24 -> 28 (+4 DeferredAddressSpaceSink unit tests), Runtime 69 -> 69 (existing ServiceCollectionExtensionsTests extended to verify the new mux + publish actor registration). All 6 v2 test suites green: 177 tests passing. Closes #108. Engine-wiring is now production-bound end-to-end on driver-role nodes — Deploy reaches real OPC UA Variable nodes that subscribed clients see.	2026-05-26 10:02:15 -04:00
Joseph Doherty	7e22e2250c	feat(runtime): #109 OpcUaPublishActor — load artifact, compose, plan-diff, apply ... Closes the loop between F10b (SDK NodeManager) and F14 (Phase7Plan + Phase7Applier). DriverHostActor's successful apply now triggers a RebuildAddressSpace on the publish actor, which loads the latest deployment artifact + walks composer → planner → applier through the sink. The OPC UA address space tracks the deployed composition. DeploymentArtifact: - New ParseComposition(blob) → Phase7CompositionResult that decodes Equipment + DriverInstance + ScriptedAlarm arrays into the projection records Phase7Planner consumes. Pascal-case property names mirror ConfigComposer.SnapshotAndFlattenAsync's output. - Each entity reader is tolerant: missing-id rows are dropped, natural-key sort matches Phase7Composer's contract. OpcUaPublishActor: - New Props params: dbFactory + applier. When wired, RebuildAddressSpace does: 1. LoadLatestArtifact (most recent Sealed Deployment.ArtifactBlob) 2. ParseComposition → Phase7CompositionResult 3. Phase7Planner.Compute(lastApplied, next) → Phase7Plan 4. Empty plan ⇒ no-op (deploy of unchanged composition is benign) 5. applier.Apply(plan) drives sink.RebuildAddressSpace + WriteAlarmState for removed nodes 6. lastApplied = next so the next rebuild diffs forward - Without dbFactory/applier wiring, falls back to raw sink.RebuildAddressSpace — the dev/Mac path before #108 binds prod. DriverHostActor: - New Props param opcUaPublishActor (IActorRef?). After successful ApplyAndAck (status Applied, ACK sent), tells the publish actor RebuildAddressSpace with the same correlation id so the audit trail threads through. Null publish actor ⇒ no trigger (admin-only nodes). Tests: Runtime 63 -> 69 (+6): - ParseComposition reads Equipment/Driver/Alarm sorted by natural key - ParseComposition returns empty for empty blob - Rebuild with dbFactory + sealed deployment artifact triggers exactly one sink.Rebuild call (Equipment topology added) - Rebuild with no artifact is idempotent no-op - Second rebuild with same composition is empty-plan no-op - Rebuild without dbFactory falls back to raw sink.Rebuild (legacy path) All 6 v2 test suites green: 173 tests passing. Closes #109. Engine-wiring data flow is now end-to-end through: Deploy → DriverHostActor.ApplyAndAck → driver spawn + ACK + RebuildAddressSpace → OpcUaPublishActor → Phase7Applier → SDK NodeManager → subscribed OPC UA clients see the change.	2026-05-26 09:55:11 -04:00
Joseph Doherty	7fa863f6da	feat(runtime): #113 DependencyMuxActor — drivers → virtual-tag fan-out ... End-to-end data path is now wired on the read side: driver subscriptions fire AttributeValuePublished → DriverHostActor → DependencyMuxActor → DependencyValueChanged to every interested VirtualTagActor. Previously the publish hit a dead-letter at the host. DependencyMuxActor: - Per-node fan-out router. Maintains tagRef → Set<IActorRef> with a reverse subscriber → refs index so unregister/replace are O(refs). - Watches subscribers; Terminated triggers automatic unregister so dead virtual-tag actors stop receiving publishes. - Re-register replaces the prior interest set — no stale-ref leaks on actor restart. - Drops publishes for refs with no interested subscribers. VirtualTagActor: - New Props params: dependencyRefs + mux ActorRef. - PreStart sends RegisterInterest to the mux; PostStop sends UnregisterInterest. Default both null so older callers stay quiet. DriverHostActor: - New dependencyMux Props param. Steady + Applying states now receive AttributeValuePublished from their DriverInstance children and forward to the mux. Null mux is a no-op (dev/Mac). ServiceCollectionExtensions: - WithOtOpcUaRuntimeActors spawns DependencyMuxActor before DriverHostActor and threads its ActorRef into the host's Props. New DependencyMuxActorKey + DependencyMuxActorName. Tests: Runtime 57 -> 63 (+6): - Mux forwards to only subscribers interested in each ref - Publish for unregistered ref is dropped silently - Unregister stops forwarding - Re-register replaces prior interest set - VirtualTagActor PreStart registration drives end-to-end eval (uses AwaitAssert to race-safely settle the PreStart Tell) - DriverHostActor forwards AttributeValuePublished through to mux All 6 v2 test suites green: 163 tests passing. F8 (#79) state updated — dep subscribe seam shipped, Core.VirtualTags production engine binding (compile + ITagUpstreamSource subscribe) is the residual.	2026-05-26 09:43:06 -04:00
Joseph Doherty	f427dc4f26	feat(runtime): #112 ScriptedAlarmActor state persistence via IAlarmActorStateStore ... ScriptedAlarmActor now survives actor restart: PreStart loads from the configured store + restores in-memory state; every Transition() fires a fire-and-forget save. ActiveState still re-derives from the evaluator on first tick (Phase 7 decision #14), but Acked state + lastAckUser persist verbatim so operators don't re-ack across an outage. Three pieces: - IAlarmActorStateStore seam in Commons.Engines, with the AlarmActorStateSnapshot record (alarmId / state / lastTransitionUtc / lastAckUser) and NullAlarmActorStateStore default. - EfAlarmActorStateStore in Runtime.ScriptedAlarms — production adapter over the existing ScriptedAlarmState table in ConfigDb. Maps the actor's 3-state enum to the table's AckedState column (Active⇒Unacknowledged, Acknowledged⇒Acknowledged, Inactive⇒ Acknowledged). Concurrency conflicts are logged + dropped — the next transition writes again. - ScriptedAlarmActor PreStart load (async, piped back as StateRestored) + Transition save. New Props overload takes the store; default is NullAlarmActorStateStore so tests stay quiet. Tests: Runtime 52 -> 57 (+5): - Transition writes Active then Acknowledged snapshots with lastAckUser populated - PreStart with persisted Active state restores so a subsequent AcknowledgeAlarm fires (not ignored as it would be from Inactive) - Empty store boots Inactive (AcknowledgeAlarm correctly ignored) - EfAlarmActorStateStore Save + Load round-trips via in-memory EF - Load for unknown alarmId returns null All 6 v2 test suites green: 157 tests passing. Closes #112. F9 (#80) remaining residual is predicate binding to Core.ScriptedAlarms.ScriptedAlarmEngine — split as F9b in tasks JSON.	2026-05-26 09:34:37 -04:00
Joseph Doherty	3e3f7588bd	feat(runtime,host): close F7 — driver subscribe + write paths + Host DI ... Three pieces landed in one batch, closing F7-residual + Host DI #106: Runtime/DriverInstanceActor: - Subscribe / Unsubscribe message contracts; the Connected state handles them via IDriver.ISubscribable. On every OnDataChange event the actor publishes AttributeValuePublished to its parent (DriverHostActor → OpcUaPublishActor). OPC UA StatusCode is mapped to the 3-state OpcUaQuality enum via severity bits (00=Good, 01=Uncertain, 10/11=Bad). - DetachSubscription tears the handler off the driver on DisconnectObserved, Unsubscribe, and PostStop so a stale handler never pushes to a dead actor. - WriteAttribute now dispatches IWritable.WriteAsync (batch of one) with a 5s CancellationTokenSource; status-code propagated to WriteAttributeResult on non-Good results. Host: - New ProjectReferences to Core + every cross-platform driver assembly (AbCip/AbLegacy/FOCAS/Galaxy/Modbus/S7/TwinCAT). Galaxy is net10 (gRPC client to mxaccessgw); the COM-bound net48 Wonderware Historian driver stays out of the Host's reference closure — its .Client gRPC wrapper is what binds for historian needs. - New DriverFactoryBootstrap.AddOtOpcUaDriverFactories() registers a singleton DriverFactoryRegistry, invokes each driver's Register(registry, loggerFactory), and binds IDriverFactory to DriverFactoryRegistryAdapter. Replaces the F7 NullDriverFactory default so deploys actually materialise real IDriver instances on driver-role nodes. ShouldStub() still gates per-platform behaviour at spawn time. - Program.cs wires AddOtOpcUaDriverFactories() before AddAkka so the runtime extension can resolve IDriverFactory from DI. Tests: Runtime 46 -> 52 (+6): - Write returns success when StatusCode = Good - Write propagates non-Good status code in failure Reason - Subscribe forwards OnDataChange to parent as AttributeValuePublished - Quality translation: Uncertain (0x40...) and Bad (0x80...) - Subscribe against non-ISubscribable returns failure - DisconnectObserved detaches handler so late events are dropped All 6 v2 test suites green: 152 tests passing. Closes F7. F7-residual sub-tasks #110 (subscribe) and #111 (write) both shipped. Host DI binding #106 shipped.	2026-05-26 09:28:34 -04:00
Joseph Doherty	a1325299ce	feat(runtime): F10 OpcUaPublishActor sink seams + redundancy-driven ServiceLevel ... OpcUaPublishActor now routes through pluggable seams instead of just incrementing a counter: - IOpcUaAddressSpaceSink (Commons.OpcUa) — WriteValue / WriteAlarmState / RebuildAddressSpace. OpcUaQuality enum moved here from the actor's nested type so producers don't have to reference the actor itself. - IServiceLevelPublisher — Publish(byte). NullServiceLevelPublisher retains the last level for inspection. - The actor subscribes to the redundancy-state DPS topic in PreStart and maps the local node's NodeRedundancyState to a coarse ServiceLevel (Primary+leader=240, Primary=200, Secondary=100, Detached=0). This keeps the local SDK's ServiceLevel node honest without round-tripping back through the admin-singleton calculator. - ServiceLevelChanged dedupes identical levels so the SDK doesn't see redundant writes. - Sink + publisher exceptions are caught and logged; the actor never crashes its own dispatcher. - PropsForTests gets optional sink/publisher/localNode params and skips the DPS subscribe so unit tests stay on a vanilla TestKit cluster. Production binding to a real SDK NodeManager + Variable nodes is the remaining residual — split as F10b. Task 60 still blocked on F10b. Tests: Runtime 40 -> 46 (+6): - AttributeValueUpdate routes to sink - AlarmStateUpdate routes to sink - RebuildAddressSpace calls sink.Rebuild - ServiceLevelChanged dedupes - RedundancyStateChanged for primary-leader publishes 240 - RedundancyStateChanged for secondary publishes 100 All 6 v2 test suites green: 132 tests passing.	2026-05-26 09:10:55 -04:00
Joseph Doherty	14fb2b05ed	feat(runtime): F8/F9 engine evaluator seams + DPS fan-out ... VirtualTagActor and ScriptedAlarmActor now route through pluggable evaluator interfaces and fan out to the cluster's live-tail topics shipped in F15.3: - IVirtualTagEvaluator + NullVirtualTagEvaluator in Commons.Engines. VirtualTagActor calls evaluator on every DependencyValueChanged, dedupes unchanged values, forwards EvaluationResult to its parent, and publishes ScriptLogEntry Warning to the script-logs DPS topic whenever the evaluator fails. - IScriptedAlarmEvaluator + NullScriptedAlarmEvaluator. ScriptedAlarmActor takes an AlarmConfig (id/name/equipment-path/severity/predicate) and publishes both an AlarmTransitionEvent (alerts topic) and a ScriptLogEntry (script-logs topic) at every transition. Manual ConditionMet/Acknowledge/Cleared still flow through the same Transition() so callers without engine bindings still drive the state machine; the legacy single-string Props() overload routes through a default AlarmConfig. The Null* defaults keep the actors safe when no engine is bound — unconfigured nodes never spuriously alarm. Production binding to Core.VirtualTags.VirtualTagEngine and Core.ScriptedAlarms is the remaining residual (F8b/F9b — split in tasks JSON). Tests: Runtime 34 -> 40 (+6): - VirtualTagActorTests x3 (evaluator drives EvaluationResult, unchanged-value dedup, failure publishes Warning ScriptLogEntry) - ScriptedAlarmActorTests x3 (engine threshold drives Activated + Cleared on alerts topic, manual Acknowledge attribution). All 6 v2 test suites green: 126 tests passing.	2026-05-26 09:05:04 -04:00
Joseph Doherty	da141497f8	feat(runtime): F7 spawn lifecycle + F20 ShouldStub gate ... DriverHostActor.ApplyAndAck now reads the deployment artifact and reconciles its set of DriverInstanceActor children — spawn the missing, ApplyDelta to those with changed config, stop the removed/disabled. The diff lives in pure DriverSpawnPlanner so it can be unit-tested without an ActorSystem. Adds IDriverFactory in Core.Abstractions (consumed by Runtime) + DriverFactoryRegistryAdapter in Core.Hosting that wraps the existing v1 DriverFactoryRegistry — Runtime stays decoupled from Polly/Serilog, the Host wires the adapter once driver assemblies have registered. ShouldStub(type, roles) is now actually called on every spawn — Galaxy + Wonderware-Historian boot stubbed on macOS/Linux or whenever the host carries the dev role. Missing factory ⇒ stub fallback, never a crash. Tests: 24 → 34 in Runtime (+10): - DriverSpawnPlannerTests x7 (diff cases, type change ⇒ stop+respawn) - DeploymentArtifactTests x5 (empty/malformed/missing fields tolerant) - DriverHostActorReconcileTests x4 (spawn count, stub fallback, ShouldStub gate, second-apply stops the removed) All 6 v2 test suites green: 120 tests passing. Closes F20 (ShouldStub wired). F7 marked partial — subscription publishing + write path still stubbed in DriverInstanceActor itself.	2026-05-26 08:57:16 -04:00
Joseph Doherty	686138123f	feat(runtime): F11 — HistorianAdapterActor wired to IAlarmHistorianSink ... Reshapes the placeholder buffered-counter actor into a thin fire-and-forget bridge over the existing IAlarmHistorianSink contract. Default sink is NullAlarmHistorianSink; production deployments override the DI binding to SqliteStoreAndForwardSink wrapping WonderwareHistorianClient (the v1 components in src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware* are reused verbatim — actor is just a mailbox-friendly entry point). - HistorianAdapterActor.Props(IAlarmHistorianSink?) — null defaults to NullAlarmHistorianSink - Receive<AlarmHistorianEvent>: fire-and-forget sink.EnqueueAsync - Receive<GetStatus>: returns sink.GetStatus() (queue depth + drain state) - ServiceCollectionExtensions.AddOtOpcUaRuntime registers the default sink - WithOtOpcUaRuntimeActors spawns the actor + registers HistorianAdapterActorKey - Program.cs calls AddOtOpcUaRuntime when hasDriver Tests: 2 new (forward-to-sink + GetStatus). Runtime suite 17 → 18.	2026-05-26 07:18:08 -04:00
Joseph Doherty	b06e3ae740	feat(runtime): PeerOpcUaProbeActor real TCP-connect probe (F12) ... Replaces the Ok=true stub with a TCP connect to the peer's OPC UA port (4840 default) with a 2s timeout. A successful connect indicates the OPC UA server process is up + accepting connections — enough for the redundancy calculator to treat the peer as live. A full secure-channel Hello/Acknowledge handshake is overkill for what the redundancy calc consumes and would pull in the OPC UA Client SDK + a PKI setup. Upgrade later if a deeper liveness signal is ever required. Probe extracts the host from NodeId by stripping the :port suffix (commit 5cfbe8b encoded host:port into NodeId for cluster-member identity). Tests: 2 new tests — Ok=true against a live TcpListener on a chosen port, Ok=false against an unreachable endpoint. All 17 Runtime tests pass (was 16 covering only the message-contract surface).	2026-05-26 06:54:51 -04:00
Joseph Doherty	09d6676e1f	feat(runtime): WithOtOpcUaRuntimeActors extension for driver-role node startup (F19) ... Mirrors WithOtOpcUaControlPlaneSingletons for the driver role. Spawns DriverHostActor + DbHealthProbeActor on the host's ActorSystem and registers both under marker keys. Host's Program.cs now calls it when the node carries the driver role, so driver-only and admin+driver deployments both auto-bootstrap the per-node actors. Integration test covers the registration round-trip via Microsoft.Extensions.Hosting + Akka.Hosting AddAkka.	2026-05-26 06:09:37 -04:00
Joseph Doherty	28639cb14d	feat(runtime): HistorianAdapter + PeerOpcUaProbe + DbHealthProbe actors (engine wiring tracked as F11/F12)	2026-05-26 05:09:06 -04:00
Joseph Doherty	e115f13104	feat(runtime): OpcUaPublishActor on synchronized dispatcher (SDK wiring tracked as F10)	2026-05-26 05:09:04 -04:00
Joseph Doherty	95ef533822	feat(runtime): ScriptedAlarmActor state machine (engine wiring tracked as F9)	2026-05-26 05:09:03 -04:00
Joseph Doherty	39729bfe21	feat(runtime): VirtualTagActor skeleton (engine wiring tracked as F8)	2026-05-26 05:09:01 -04:00
Joseph Doherty	64c627f8d6	feat(runtime): DriverInstanceActor state machine with Connecting/Connected/Reconnecting	2026-05-26 05:05:36 -04:00
Joseph Doherty	ed130135ca	feat(runtime): DriverHostActor state machine with PreStart recovery + DispatchDeployment + stale fallback	2026-05-26 05:02:42 -04:00