Joseph Doherty
69a6e0b4c8
v2-ci / unit-tests (push) Waiting to run
Opt-in (Scripting:Runner=OutOfProcess; InProcess stays the default and its code path is unchanged). Implements the P1 slice of docs/plans/2026-11-09-out-of-process-script-runner-design.md with the owner's §14 decisions: - Options: Scripting:Runner (InProcess | Shadow | OutOfProcess), Scripting:Runner:Seams, Scripting:Worker:* (Shards 2, HardGrace max(1 s,T), HeapLimitBytes 512 MiB, QuarantineAfterKills 2, UnavailableGrace 5 s, IsolationProbationRuns 20, PeCacheDir validated absolute + outside the content root (fail closed), ExecutablePath). Shadow is not implemented yet: runs InProcess with a startup Warning. - Core.Scripting: IScriptRunner seam + InProcessScriptRunner (today's guard, the parity baseline). - Core.Scripting.Protocol: protobuf envelopes, 4-byte LE framing (zero/oversize/truncated/garbage refused), Variant carrying the exact CLR type; unsupported types are explicit failures. - ScriptWorker app: compiles in the worker, P-thread scheduler, host-driven soft cancel, fail-fast watchdog, heartbeats, ctx.Logger forwarding, exits on pipe EOF / parent gone, forbidden-assembly self-check; Akka and Grpc.Core.Api excluded from its folder. Shipped in script-worker/ (Build + Publish). - Core.Scripting.OutOfProcess: K shards + isolation worker, soft T / hard T+G kill, attribution (deadline kill = one key; crash = suspects -> isolation; isolation crash = strike), kill-strike quarantine, backoff 250 ms -> 30 s, fail closed, cleared allow-listed env, nonce + pid handshake on a current-user pipe, Windows Job Object. - VirtualTag + Calculation seams use the runner when selected; a runner-side failure (worker restarted / runner unavailable) publishes BadResourceUnavailable (0x80040000) — ScadaBridge#112. Script faults keep BadInternalError. The scripted-alarm seam stays in process (alarms last). Tests: new ZB.MOM.WW.OtOpcUa.ScriptWorker.Tests (Category=ScriptWorker, real processes; green on macOS and on windev/Windows), seam tests in Host/Runtime/Calculation suites; mutation-checked. Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
55 lines
2.2 KiB
C#
55 lines
2.2 KiB
C#
namespace ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol;
|
|
|
|
/// <summary>
|
|
/// The environment variables the host sets on a ScriptWorker (design §6). The nonce travels in the environment,
|
|
/// never on the command line (mxaccessgw <c>WorkerBootstrap.md</c>): a command line is world-readable on most
|
|
/// systems.
|
|
/// </summary>
|
|
public static class ScriptWorkerEnvironment
|
|
{
|
|
/// <summary>The pipe name the worker connects to.</summary>
|
|
public const string PipeName = "OTOPCUA_SCRIPTWORKER_PIPE";
|
|
|
|
/// <summary>The one-time launch nonce the worker must echo in <c>Ready</c>.</summary>
|
|
public const string Nonce = "OTOPCUA_SCRIPTWORKER_NONCE";
|
|
|
|
/// <summary>The host's process id; the worker exits when it disappears.</summary>
|
|
public const string ParentPid = "OTOPCUA_SCRIPTWORKER_PARENT_PID";
|
|
|
|
/// <summary>The worker's shard label, for its own diagnostics.</summary>
|
|
public const string Shard = "OTOPCUA_SCRIPTWORKER_SHARD";
|
|
|
|
/// <summary>
|
|
/// Exit code of a worker whose pipe reached end of stream (the host went away). Distinct from a crash so the
|
|
/// host's exit reason metric can tell them apart.
|
|
/// </summary>
|
|
public const int ExitPipeClosed = 3;
|
|
|
|
/// <summary>Exit code of a worker whose handshake or framing failed.</summary>
|
|
public const int ExitProtocolFault = 4;
|
|
|
|
/// <summary>Exit code of a worker whose parent process disappeared.</summary>
|
|
public const int ExitParentGone = 5;
|
|
|
|
/// <summary>Exit code of a worker that found a forbidden assembly loaded in itself.</summary>
|
|
public const int ExitForbiddenAssembly = 6;
|
|
|
|
/// <summary>
|
|
/// Assembly-name prefixes that must never be loaded in a worker (design §6): the host's cluster, database,
|
|
/// OPC UA and secrets stacks. The worker checks itself against this list and exits if it finds one.
|
|
/// </summary>
|
|
public static readonly IReadOnlyList<string> ForbiddenAssemblyPrefixes =
|
|
[
|
|
"Akka",
|
|
"Microsoft.Data.SqlClient",
|
|
"System.Data.SqlClient",
|
|
"Microsoft.EntityFrameworkCore",
|
|
"Opc.Ua",
|
|
"ZB.MOM.WW.Secrets",
|
|
"ZB.MOM.WW.OtOpcUa.Runtime",
|
|
"ZB.MOM.WW.OtOpcUa.Host",
|
|
"ZB.MOM.WW.OtOpcUa.Driver.",
|
|
"Grpc.",
|
|
];
|
|
}
|