WIP: Upgrade OPC UA SDK to 2.0.1 preserving application contracts #802

2026-11-10T13:30:50-05:00

dohertj2 commented

2026-11-10 13:30:50 -05:00

SDK 2 changes the value, identity, certificate and continuation APIs used by this application. This migrates the server, Shared client, driver and browser to exact SDK 2.0.1 while preserving existing application results and authorization. The 37 legacy aggregate factories are checked against 6,144 independent original-SDK vectors.

Draft — release HOLD; do not merge. Implements #782. Plan, complete execution evidence and rollout/rollback runbook are checked in under docs/plans/2026-11-10-opcua-sdk-2-*. Latest evidence: ed60970f.

Validation:

Integrated Release solution build: zero warnings/errors. Final CI4: 18,478 passed, 11 failed, 635 existing skips, 18,489 executed across 63 TRX. Test exit 1 and execution guard 0 retained. Exact remaining failures are the independently reproduced ten PercentGood cases (#796) and one ScriptWorker timing assertion (#798); no additional failure classes or new skips.
Server wire 187; server units 1,115 (+1 existing skip); Shared 324; final security 17/17. All 6,144 aggregate vectors pass directly and through the booted manager. Old/new separate-process Shared plus actual driver/CLI compatibility 62/62.
Production client/driver/live-reinitialize/browser lifecycle: 7,200.984 seconds, 5,420 cycles, 43,360 verified manager disposals. Zero weak product survivors or open PKI descriptors across 543 samples. This is client lifecycle evidence, not the server RSS gate.
SQL Server 195/195 and QuestDB 233 passed/1 existing opt-in skip on each SDK. Fresh HG 1.0 graph: all four self-contained Linux/Windows Host/CLI publishes; actual Linux Host twice-start/stop preserves PKI and passes six strict HMAC/peer cases plus both CLI reads.
Independent HG Client/Contracts 1.0.0 update landed on master 230cef4e and is merged here; historiangw#131 closed after published-package verification and three real TLS/h2c wire tests. Baseline test-ordering repair landed separately on master 52d1373e (#805 closed); both SDK1.5/SDK2 Runtime suites pass 1,002 tests.

Required holds:

#799 / G4 remains failed. Canonical cold RSS exceeds the unchanged cycle-3 +128 MiB cap on macOS and Linux. Fixed candidate saturation completed 384 cycles/96 restarts plus settling inside 1,800 seconds with zero factory JIT/load, new SDK assembly loads or lost events in both declared windows. It retained the cold failure and exit 1; allocation tracking adds overhead. This is no acceptance baseline or two-hour server pass. The original canonical adapter has partial diagnostic proof and unsupported ownership/process-memory parity; it supplies no approved RSS denominator. macOS native certificate-object retention remains unresolved.
#800: actual Windows runtime/service/reused-PKI evidence pending an approved operator channel.
#801 and ScadaBridge#121: live AVEVA/secure consumer/paired-cluster gates pending. Actual unchanged ScadaBridge passes 18 None/API-key cases; secure setup fails equally on both versions because its own certificate is unconfigured.
#797 and #806 retain preexisting opaque scripted-alarm narrow-grant and browser NAT limitations; neither is an SDK2 regression or an approved workaround.

Astra independently reviewed source, negative and positive security cases, artifact hashes, raw TRX, lifecycle and diagnostic receipts. No new must-fix migration source/security finding remains; no release approval was given. No resource/oracle/skip threshold was weakened. #782 stays open. SDK2 is not merged to master or deployed.

SDK 2 changes the value, identity, certificate and continuation APIs used by this application. This migrates the server, Shared client, driver and browser to exact SDK 2.0.1 while preserving existing application results and authorization. The 37 legacy aggregate factories are checked against 6,144 independent original-SDK vectors. **Draft — release HOLD; do not merge.** Implements #782. Plan, complete execution evidence and rollout/rollback runbook are checked in under `docs/plans/2026-11-10-opcua-sdk-2-*`. Latest evidence: ed60970f. Validation: - Integrated Release solution build: zero warnings/errors. Final CI4: **18,478 passed, 11 failed, 635 existing skips**, 18,489 executed across 63 TRX. Test exit 1 and execution guard 0 retained. Exact remaining failures are the independently reproduced ten PercentGood cases (#796) and one ScriptWorker timing assertion (#798); no additional failure classes or new skips. - Server wire 187; server units 1,115 (+1 existing skip); Shared 324; final security 17/17. All 6,144 aggregate vectors pass directly and through the booted manager. Old/new separate-process Shared plus actual driver/CLI compatibility 62/62. - Production client/driver/live-reinitialize/browser lifecycle: **7,200.984 seconds, 5,420 cycles, 43,360 verified manager disposals**. Zero weak product survivors or open PKI descriptors across 543 samples. This is client lifecycle evidence, not the server RSS gate. - SQL Server 195/195 and QuestDB 233 passed/1 existing opt-in skip on each SDK. Fresh HG 1.0 graph: all four self-contained Linux/Windows Host/CLI publishes; actual Linux Host twice-start/stop preserves PKI and passes six strict HMAC/peer cases plus both CLI reads. - Independent HG Client/Contracts 1.0.0 update landed on master 230cef4e and is merged here; historiangw#131 closed after published-package verification and three real TLS/h2c wire tests. Baseline test-ordering repair landed separately on master 52d1373e (#805 closed); both SDK1.5/SDK2 Runtime suites pass 1,002 tests. Required holds: - **#799 / G4 remains failed.** Canonical cold RSS exceeds the unchanged cycle-3 +128 MiB cap on macOS and Linux. Fixed candidate saturation completed 384 cycles/96 restarts plus settling inside 1,800 seconds with zero factory JIT/load, new SDK assembly loads or lost events in both declared windows. It retained the cold failure and exit 1; allocation tracking adds overhead. This is no acceptance baseline or two-hour server pass. The original canonical adapter has partial diagnostic proof and unsupported ownership/process-memory parity; it supplies no approved RSS denominator. macOS native certificate-object retention remains unresolved. - #800: actual Windows runtime/service/reused-PKI evidence pending an approved operator channel. - #801 and ScadaBridge#121: live AVEVA/secure consumer/paired-cluster gates pending. Actual unchanged ScadaBridge passes 18 None/API-key cases; secure setup fails equally on both versions because its own certificate is unconfigured. - #797 and #806 retain preexisting opaque scripted-alarm narrow-grant and browser NAT limitations; neither is an SDK2 regression or an approved workaround. Astra independently reviewed source, negative and positive security cases, artifact hashes, raw TRX, lifecycle and diagnostic receipts. **No new must-fix migration source/security finding remains; no release approval was given.** No resource/oracle/skip threshold was weakened. #782 stays open. SDK2 is not merged to master or deployed.

dohertj2 added 52 commits 2026-11-10 13:30:51 -05:00

docs: record OPC UA 2.0 migration baseline and decisions 56250a88a4

build: raise Extensions baseline for OPC UA SDK 2.0 d9984028b7

build: pin OPC UA SDK 2.0.1 and migration tooling d2076e75c6

refactor: migrate OPC UA server SDK 2.0 compilation and boundaries 9af1a824b3

refactor: migrate client applications to OPC UA SDK 2.0 586ce9422d

refactor: migrate OPC UA driver and browser to SDK 2.0 52a4476b21

fix: initialize SDK telemetry and preserve ByteString boundaries f9a006dab4

fix: preserve SDK 2 driver value and credential lifetimes 4400127810

fix: preserve SDK 2.0 client value and lifetime contracts 33c7dc4292

fix: preserve history sentinels and alarm SDK metadata 3dcb035f89

fix: reject unsupported upstream matrix payloads per item 7314f159a0