f1b976f5e2
Merge branch 'fix/r3-04-one-role-authority' — R3-04: EffectiveRoles is the one role authority (Cluster:Roles wins over OTOPCUA_ROLES, normalised, validated, fail-start on unknown/overlay-changed roles); Program.cs + all four validators consume it; case-insensitive gossip predicates; source-scan guard (archreview 01/S-12 = 03/C5, 01/C-9)
2026-08-20 11:05:09 -04:00
e6a36f4ba8
docs: ServiceHosting.md overlay-filename casing note; R3-04 review outcome (both FIX-FIRST items resolved)
2026-08-20 11:03:24 -04:00
d79d51dd4f
Merge branch 'fix/r3-01-mesh-grpc-allowanonymous' — R3-01: mesh gRPC + LocalDb sync endpoints opt out of the AdminUI cookie FallbackPolicy (PSK interceptors are the gate); real-auth-stack boundary tests + map-convention guard; rig DisableLogin parameterised (archreview 03/S14 Critical)
2026-08-20 10:43:49 -04:00
851e4cf5e0
Merge branch 'fix/r3-03-restart-resubscribe-watchdog' — R3-03: SpawnChild always sends the desired set (operator Restart + supervision restart re-provision, stale-alarm-set re-subscribe, incarnation check, 10 s backoff); watchdog grace = max(LastSuccessfulRead, connectedSince) (archreview 03/S16, S17, U6)
2026-08-20 10:40:11 -04:00
6d0002889a
docs(archreview): R3-03 review outcome — F1/F2/F3 fixed with red-before evidence
2026-08-20 10:39:47 -04:00
027c423502
docs(plans): R3-04 execution notes — T6-T12 deviations recorded, T13 marked pending (live gate deferred to orchestrator)
2026-08-20 10:33:07 -04:00
985de0b6ad
chore(docker-dev): site-b-2 is Cluster:Roles-only, site-a-2 pins a miscased Cluster:Roles entry (archreview 01/S-12, 01/C-9)
...
T11: site-b-2 drops OTOPCUA_ROLES entirely — Cluster:Roles is its sole role source, the rig's
only node that can exhibit the two-role-authority split (01/S-12). Expected to fail every
deploy on a pre-R3-04 build.
T12: site-a-2 pins Cluster__Roles__0="Driver" (capital D) as the standing 01/C-9 case-mismatch
pin, keeping cluster-SITE-A verbatim. Pre-fix this un-elects the SITE-A Primary.
Combined into one commit (deviation from the plan's two separate T11/T12 commits): the header
comment block documenting all six nodes' role sources interleaves both nodes on adjacent lines,
so a clean split was not practical. Recorded in the plan's Execution notes.
Compose edits only — the rig is NOT brought up as part of this change.
2026-08-20 10:32:18 -04:00
b8d2d50006
docs: one role authority — precedence, normalization, and the overlay invariant (R3-04)
2026-08-20 10:29:37 -04:00
b725788954
docs(plans): R3-01 execution notes (T1-T9) - filter gotcha, T4/T5 fixture scope, observed cookie-challenge signature
2026-08-20 10:28:55 -04:00
b8911eaa14
docs(plans): mark R3-01 T9 done; T10 remains pending (live gate, orchestrator-run)
2026-08-20 10:27:45 -04:00
659d5f51e4
test(integration): a Cluster:Roles-only node wires the driver stack
2026-08-20 10:26:34 -04:00
4dde5cb8bf
docs(plans): mark R3-01 T7 and T8 done
2026-08-20 10:25:12 -04:00
e2497c908d
test(cluster): guard that role reads live only in the authority (archreview theme 4)
2026-08-20 10:21:36 -04:00
9bd3366b28
docs(plans): mark R3-01 T6 done
2026-08-20 10:21:01 -04:00
e475f7b4ab
Merge branch 'fix/r3-05-acl-hot-path-expiry' — R3-05: bounded ConfigDb API-key lookup (deadline + TTL) and clock-driven key-expiry revalidation of live monitored items (archreview 03/S18, 03/S19)
2026-08-20 10:19:13 -04:00
62515f3279
fix(security): pin the cached-key expiry guard, meter cache_hit after it, and close two wiring gaps (review fixes)
2026-08-20 10:18:52 -04:00
353ed6bb58
docs(plans): mark R3-01 T5 done
2026-08-20 10:15:03 -04:00
4380e2e78a
fix(cluster): fail start when a late config layer changes Cluster:Roles (role overlays may not set it)
2026-08-20 10:11:25 -04:00
c1ad9e24d2
docs(archreview): R3-03 execution notes — final verification + deviation summary
2026-08-20 10:11:16 -04:00
3314a1f98d
feat(host): warn when Cluster:Roles and OTOPCUA_ROLES disagree; boot banner names the winning source
2026-08-20 10:08:03 -04:00
815423bd88
docs(plans): restore literal UTF-8 em-dashes in R3-01 tasks.json (cosmetic)
2026-08-20 10:07:20 -04:00
12c4028474
docs: restart re-provisioning + per-connection watchdog grace (R3-03)
2026-08-20 10:07:20 -04:00
af9d3a69ac
docs(plans): mark R3-01 T4 done
2026-08-20 10:06:55 -04:00
14094e3a18
docs(archreview): file R3-05 residuals R1/R2 (Gitea #562/#563); execution notes
2026-08-20 10:06:00 -04:00
5c7e5725a5
test(runtime): first supervision-restart test — child re-initialises + re-subscribes (archreview 03/U6)
...
Crash seam: the planned null-Snapshot OnDataChange (no SupervisorStrategy fallback needed).
Seen RED with T6 reverted: InitializeCount 1, not 2 — with a preceding ShutdownCount>=1
assertion proving the restart really happened, so the red is not ambiguous with 'never crashed'.
2026-08-20 10:05:45 -04:00
e46c1db5e5
fix(cluster): gossiped-role predicates compare case-insensitively — a miscased peer no longer un-elects the Primary
2026-08-20 10:04:16 -04:00
a9b592aeb8
docs(security): correct revocation latency (activation vs open session) + S18/S19 knobs
2026-08-20 10:04:03 -04:00
dfab7f614d
test(integration): key expiry stops a live subscription over the wire, with no deploy
2026-08-20 10:00:52 -04:00
2b9a397b2d
fix(runtime): re-provision a driver child after a supervision restart (archreview 03/S6, S16)
2026-08-20 09:56:05 -04:00
a4f12bccef
fix(host): run monitored-item revalidation on a low-frequency timer (archreview 03/S19)
2026-08-20 09:55:01 -04:00
d97e441979
test(runtime): operator restart re-subscribes the respawned child (archreview 03/S16, U6)
...
Seen RED against a T3-reverted build: all 4 failed, Created[1].SubscribeCount == 0
on the headline case. 20x isolation run green after the fix was restored.
2026-08-20 09:53:38 -04:00
1759f60476
docs(plans): mark R3-01 T3 done
2026-08-20 09:51:43 -04:00
bcec88ef70
fix(cluster): all four role-scoped validators read the authority — 'Driver' no longer skips every driver rule (archreview 01/C-9)
2026-08-20 09:51:23 -04:00
b09f78396f
test(opcua): pin clock-driven expiry in the revalidation pass; correct the only-trigger remark
2026-08-20 09:50:39 -04:00
bd80ff96ca
feat(security): AclRevalidationTimer — clock-driven monitored-item revalidation (archreview 03/S19)
2026-08-20 09:46:56 -04:00
2f90156408
docs(plans): mark R3-01 T2 done
2026-08-20 09:46:40 -04:00
792e8f422a
fix(host): Program.cs derives roles from the one authority, not OTOPCUA_ROLES alone (archreview 01/S-12 = 03/C5)
2026-08-20 09:46:27 -04:00
39a10a277a
fix(security): wrap the ConfigDb key store on admin nodes + registration guard
2026-08-20 09:45:08 -04:00
7dfd6dcc9f
fix(cluster): AkkaClusterOptions.Roles is the EffectiveRoles instance, not a second derivation
2026-08-20 09:43:54 -04:00
6048257dfe
feat(observability): meter bounded API-key store lookups
2026-08-20 09:43:07 -04:00
ac9a71bcbd
docs(plans): mark R3-01 T1 done
2026-08-20 09:43:06 -04:00
b3a71f6655
test(runtime): recording subscribable driver factory + enabled-driver v3 seed
2026-08-20 09:42:33 -04:00
7702616716
feat(cluster): EffectiveRoles — one role authority with one precedence + two-layer normalization (archreview 01/S-12, 01/C-9)
2026-08-20 09:41:54 -04:00
37288d4df5
feat(security): short TTL read-through cache in front of the ConfigDb key store
2026-08-20 09:40:56 -04:00
3b56e5bd01
fix(security): bound the API-key store call under the SessionManager lock (archreview 03/S18)
2026-08-20 09:38:41 -04:00
daaeb854d6
fix(runtime): every spawn hands the child its desired subscriptions (archreview 03/S16)
2026-08-20 09:36:52 -04:00
894444376e
feat(security): register TimeProvider + S18/S19 option knobs (archreview 03/S18,S19)
2026-08-20 09:36:14 -04:00
bdc81a1372
refactor(runtime): one desired-subscription payload authority (_desiredByDriver)
2026-08-20 09:34:49 -04:00
72329eabdd
docs(archreview): round-3 plan R3-02 (stale-Good family — one quality contract, four seams); index task count
2026-08-20 09:33:36 -04:00
a801e2aefb
fix(runtime): comms-loss grace is per connection — max(LastSuccessfulRead, connectedSince) (archreview 03/S17)
2026-08-20 09:32:30 -04:00
Joseph Doherty