Files
lmxopcua/tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Calculation.Tests/CalculationDriverScriptRunnerTests.cs
T
Joseph Doherty 69a6e0b4c8
v2-ci / unit-tests (push) Waiting to run
feat(scripting): out-of-process pre-emptible script runner behind Scripting:Runner (lmxopcua#780 P1)
Opt-in (Scripting:Runner=OutOfProcess; InProcess stays the default and its code path is unchanged). Implements
the P1 slice of docs/plans/2026-11-09-out-of-process-script-runner-design.md with the owner's §14 decisions:

- Options: Scripting:Runner (InProcess | Shadow | OutOfProcess), Scripting:Runner:Seams, Scripting:Worker:*
  (Shards 2, HardGrace max(1 s,T), HeapLimitBytes 512 MiB, QuarantineAfterKills 2, UnavailableGrace 5 s,
  IsolationProbationRuns 20, PeCacheDir validated absolute + outside the content root (fail closed),
  ExecutablePath). Shadow is not implemented yet: runs InProcess with a startup Warning.
- Core.Scripting: IScriptRunner seam + InProcessScriptRunner (today's guard, the parity baseline).
- Core.Scripting.Protocol: protobuf envelopes, 4-byte LE framing (zero/oversize/truncated/garbage refused),
  Variant carrying the exact CLR type; unsupported types are explicit failures.
- ScriptWorker app: compiles in the worker, P-thread scheduler, host-driven soft cancel, fail-fast
  watchdog, heartbeats, ctx.Logger forwarding, exits on pipe EOF / parent gone, forbidden-assembly
  self-check; Akka and Grpc.Core.Api excluded from its folder. Shipped in script-worker/ (Build + Publish).
- Core.Scripting.OutOfProcess: K shards + isolation worker, soft T / hard T+G kill, attribution
  (deadline kill = one key; crash = suspects -> isolation; isolation crash = strike), kill-strike
  quarantine, backoff 250 ms -> 30 s, fail closed, cleared allow-listed env, nonce + pid handshake on a
  current-user pipe, Windows Job Object.
- VirtualTag + Calculation seams use the runner when selected; a runner-side failure (worker restarted /
  runner unavailable) publishes BadResourceUnavailable (0x80040000) — ScadaBridge#112. Script faults keep
  BadInternalError. The scripted-alarm seam stays in process (alarms last).

Tests: new ZB.MOM.WW.OtOpcUa.ScriptWorker.Tests (Category=ScriptWorker, real processes; green on macOS and
on windev/Windows), seam tests in Host/Runtime/Calculation suites; mutation-checked.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
2026-11-09 23:33:08 -05:00

123 lines
5.7 KiB
C#

using System.Collections.Concurrent;
using Serilog;
using Shouldly;
using Xunit;
using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
using ZB.MOM.WW.OtOpcUa.Core.Scripting;
namespace ZB.MOM.WW.OtOpcUa.Driver.Calculation.Tests;
/// <summary>
/// lmxopcua#780 — with <c>Scripting:Runner=OutOfProcess</c> selecting the Calculation seam, the driver hands each
/// compiled run to the node's <see cref="IScriptRunner"/>: keyed by the calc tag's RawPath, with the driver's own
/// budget. A runner-side failure publishes <c>BadResourceUnavailable</c> (0x80040000); a script failure keeps
/// <c>BadInternalError</c>. The passthrough fast path never reaches the runner.
/// </summary>
public sealed class CalculationDriverScriptRunnerTests
{
private const uint StatusGood = 0u;
private const uint StatusBadInternalError = 0x80020000u;
private const uint StatusBadResourceUnavailable = 0x80040000u;
private const string Tag = "calc/e/x";
private sealed class FakeRunner : IScriptRunner
{
public ConcurrentQueue<ScriptRunOutcome> Outcomes { get; } = new();
public ConcurrentQueue<ScriptInvocation> Invocations { get; } = new();
public List<ScriptContextKind> Resets { get; } = [];
public Task<ScriptRunOutcome> RunAsync(ScriptInvocation invocation, CancellationToken ct = default)
{
Invocations.Enqueue(invocation);
return Task.FromResult(Outcomes.TryDequeue(out var next) ? next : ScriptRunOutcome.Ok(null));
}
public void Reset(ScriptContextKind kind) => Resets.Add(kind);
public IReadOnlyCollection<string> QuarantinedKeys(ScriptContextKind kind) => ["q-" + kind];
}
private static RawTagEntry CalcTag(string source)
{
var json = $"{{\"scriptId\":\"s\",\"changeTriggered\":true,\"scriptSource\":{System.Text.Json.JsonSerializer.Serialize(source)}}}";
return new RawTagEntry(Tag, json, WriteIdempotent: false);
}
private static async Task Settle(CalculationDriver driver)
{
var deadline = DateTime.UtcNow + TimeSpan.FromSeconds(30);
while (DateTime.UtcNow < deadline && !driver.IsEvaluationIdle) await Task.Delay(10);
driver.IsEvaluationIdle.ShouldBeTrue();
}
private static (CalculationDriver Driver, ConcurrentQueue<DataChangeEventArgs> Published) Build(FakeRunner runner, string source)
{
var driver = new CalculationDriver(
new CalculationDriverOptions { RawTags = [CalcTag(source)], RunTimeout = TimeSpan.FromMilliseconds(1234), ScriptRunner = runner },
"calc-drv", new ScriptRootLogger(new LoggerConfiguration().CreateLogger()));
var published = new ConcurrentQueue<DataChangeEventArgs>();
driver.OnDataChange += (_, e) => published.Enqueue(e);
return (driver, published);
}
[Fact]
public async Task A_runner_failure_publishes_BadResourceUnavailable_and_a_script_failure_BadInternalError()
{
var runner = new FakeRunner();
runner.Outcomes.Enqueue(ScriptRunOutcome.Ok(30.0));
runner.Outcomes.Enqueue(ScriptRunOutcome.Unavailable(ScriptRunOutcome.WorkerRestartedReason));
runner.Outcomes.Enqueue(ScriptRunOutcome.Failed("script threw: boom"));
var (driver, published) = Build(runner, "return (double)ctx.GetTag(\"src/a\").Value * 3;");
await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
driver.OnDependencyValue("src/a", 10.0, StatusGood, DateTime.UtcNow);
await Settle(driver);
published.TryDequeue(out var good).ShouldBeTrue();
good!.Snapshot.StatusCode.ShouldBe(StatusGood);
good.Snapshot.Value.ShouldBe(30.0);
var invocation = runner.Invocations.Single();
invocation.Key.ShouldBe(Tag);
invocation.Kind.ShouldBe(ScriptContextKind.Calculation);
invocation.Timeout.ShouldBe(TimeSpan.FromMilliseconds(1234));
invocation.Inputs["src/a"].Value.ShouldBe(10.0);
driver.OnDependencyValue("src/a", 11.0, StatusGood, DateTime.UtcNow);
await Settle(driver);
published.TryDequeue(out var unavailable).ShouldBeTrue();
unavailable!.Snapshot.StatusCode.ShouldBe(StatusBadResourceUnavailable);
unavailable.Snapshot.Value.ShouldBe(30.0, "the last known value rides out with the Bad status");
driver.OnDependencyValue("src/a", 12.0, StatusGood, DateTime.UtcNow);
await Settle(driver);
published.TryDequeue(out var scriptFault).ShouldBeTrue();
scriptFault!.Snapshot.StatusCode.ShouldBe(StatusBadInternalError);
}
[Fact]
public async Task The_passthrough_fast_path_never_reaches_the_runner()
{
var runner = new FakeRunner();
var (driver, published) = Build(runner, "return ctx.GetTag(\"src/a\").Value;");
await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
driver.OnDependencyValue("src/a", 4.0, StatusGood, DateTime.UtcNow);
await Settle(driver);
published.TryDequeue(out var mirrored).ShouldBeTrue();
mirrored!.Snapshot.Value.ShouldBe(4.0);
runner.Invocations.ShouldBeEmpty();
}
[Fact]
public void The_deploy_boundary_resets_the_runners_calculation_seam_and_quarantines_are_reported()
{
var runner = new FakeRunner();
using var evaluator = new CalculationEvaluator(Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance,
new ScriptRootLogger(new LoggerConfiguration().CreateLogger()), scriptRunner: runner);
evaluator.ClearCompiledScripts();
evaluator.ResetQuarantines();
runner.Resets.ShouldBe([ScriptContextKind.Calculation, ScriptContextKind.Calculation]);
evaluator.QuarantinedScripts.ShouldBe(["q-Calculation"]);
}
}