Landed: OtOpcUa master 230cef4e consumes the published Client/Contracts1.0.0; historiangw#131 is closed with verification. The change is merged into this SDK2 branch. The patch below is a historical/replay input; the validator recognizes an already migrated checkout. Master verification records the whole-solution zero-warning build,523 Gateway passes,1,002 Runtime passes and package hashes. SDK2 resource/release gates remain separate.

HistorianGateway consumer TLS migration — issue 131

consumer-1.0.0.patch is a reviewable consumer change, kept separate from the buildable application in this checkout. Real paired Client/Contracts 1.0.0 packages are now published and the isolated owning-project proof passed (RESULTS.md). The application in this checkout remains pinned to published 0.4.0 until the patch is applied by the coordinator.

The patch changes both central package pins to 1.0.0 and maps the new option as:

AllowUntrustedServerCertificate = options.UseTls && options.AllowUntrustedServerCertificate,

The old inverse-mapping and obsolete h2c-history comments are removed. The existing h2c construction test now includes a stale opt-out as well as a stale CA path. Three new bounded local wire tests verify behavior through the real adapter and published client API, without reflection or replacing the transport handler:

TLS with normal defaults rejects a self-signed server before the metadata RPC.
Explicit opt-out permits that self-signed server shape and executes one RPC.
Plaintext with stale opt-out and CA settings executes one RPC, proving TLS-only settings were not forwarded to the client's validating options.

The local server uses an ephemeral loopback port and a fresh short-lived self-signed certificate. RPC completion is bounded to 15 seconds; the consumer call timeout is two seconds. No gateway, deployment, or global trust store is used.

Before applying the patch, query the live Gitea NuGet version indexes for BOTH packages and require actual stable 1.0.0. Source main having the new API is not a package release. At initial inspection, both feed indexes listed exactly 0.4.0, 0.3.0, 0.2.0, 0.1.0, and the new API was only in Unreleased at HG commit e4321915ebc5e0704a68ecad21b85c1cc1c80d6b.

git apply --check scripts/validation/historiangw-131/consumer-1.0.0.patch
git apply scripts/validation/historiangw-131/consumer-1.0.0.patch
# From the consumer checkout, using a fresh run/results directory:
hg131_results=/absolute/fresh/results
test ! -e "$hg131_results" || exit 2
mkdir -p "$hg131_results" || exit
hg131_test_status=0
dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.Tests \
  -c Release --logger trx --results-directory "$hg131_results" || hg131_test_status=$?
hg131_guard_status=0
MIN_EXECUTED=1 bash scripts/ci/assert-not-all-skipped.sh "$hg131_results"/*.trx \
  || hg131_guard_status=$?
if [ "$hg131_test_status" -ne 0 ]; then exit "$hg131_test_status"; fi
exit "$hg131_guard_status"

Published-package verification must use the real 1.0.0 packages, preserve all test and guard exits, run the full owning project, and complete the consumer solution build/review before issue 131 is closed. The patch is transport-only and can be applied independently of the OPC UA SDK 2 rollout.

For isolated validation, use a fresh output directory OUTSIDE both repositories so the archived HG projects do not inherit the consumer's central package policy:

python3 scripts/validation/historiangw-131/validate.py \
  --consumer-root "$PWD" \
  --hg-root /Users/dohertj2/Desktop/HistorianGateway \
  --output /tmp/historiangw-131-fresh-validation

The script checks both live feed indexes. If both actual stable 1.0.0 packages are available, it validates them in an archived consumer copy. Otherwise it archives exact HG commit e432191 and temporarily replaces ONLY the archived Gateway csproj's two package references with source project references. This equivalent source validation does not create or publish any fake package/version. Restore uses an independent copy-on-write/copy cache, isolated HTTP cache and CLI home. Neither user checkout is built or edited. Full owning-suite TRX, required TLS failure classification, command exits and execution guard are retained under the task output. Published mode additionally checks package assets/provenance, absence of source overrides, and exact package-to-test-bin DLL hashes. Never treat source validation as stable published-package verification.