# Pair-behaviour gate helper (lmxopcua#801)

`PairGate` is a small console tool for the **local docker-dev rig only**. Never point it at a wonder box.
It drives the redundancy and revocation half of the #801 SDK 2 live gate against the central pair
(central-1 `opc.tcp://localhost:4840`, central-2 `:4841`):

- **`mint` / `set-enabled`** call the same `IApiKeyAdminService` that the AdminUI `/apikeys` page uses
  (Create key, Revoke / Re-enable). The rig's committed dev pepper is the default. Override it with
  `PAIRGATE_PEPPER` and the ConfigDb with `PAIRGATE_CONFIGDB`. The credential goes to `<credDir>/<name>.key`
  (mode 0600) and is never printed. Output names the key id only.
- **`grant` / `ungrant`** add or remove a `NodeAcl` row in the rig ConfigDb.
- **`probe`** opens a fresh session (a new activation), then reads and writes the probe tag
  (`PAIRGATE_TAG`, default the writable `ns=2;s=pymodbus/plc/HR200`).
- **`watch`** holds **one** session open for N seconds. It subscribes to the given tags and reads and writes
  every 3 s. Output is JSON lines, so a revocation or expiry can be seen landing on an
  **already-open** session.
- **`server`** reads `Server.ServiceLevel` (`i=2267`) and `Server.ServerArray` (`i=2254`).

DB edits only reach the nodes' data-plane snapshot through a deployment (`docker-dev/deploy.sh </dev/null`).
That's the documented revocation contract in `docs/security.md`.

```sh
dotnet build scripts/validation/pair-gate -c Release -o /tmp/pairgate
g="dotnet /tmp/pairgate/PairGate.dll"
$g mint ./keys k-revoke p-revoke                 # plus a control key, and one with an expiry: ... p-exp 2026-11-12T15:00:00Z
$g grant p-revoke-main p-revoke MAIN Cluster - 159   # ReadOnly + WriteOperate
./docker-dev/deploy.sh </dev/null
$g watch opc.tcp://localhost:4840 @keys/k-revoke.key 600 ns=2\;s=pymodbus/plc/HR200 ns=2\;s=pymodbus/plc/HR100 > c1.log &
$g watch opc.tcp://localhost:4841 @keys/k-revoke.key 600 ns=2\;s=pymodbus/plc/HR200 ns=2\;s=pymodbus/plc/HR100 > c2.log &
$g set-enabled <keyId> false                     # new activations refused within StoreCacheSeconds
./docker-dev/deploy.sh </dev/null                # the open sessions on BOTH nodes lose write (ACL on: everything)
```

Always run a non-revoked control key next to the revoked one, so a denial can't be mistaken for an outage.
The 2026-11-12 run and its results are on #801.