Joseph Doherty
86 lines
2.6 KiB
JSON
86 lines
2.6 KiB
JSON
{
|
|
"planPath": "archreview/plans/R3-01-mesh-grpc-allowanonymous-plan.md",
|
|
"lastUpdated": "2026-08-20",
|
|
"tasks": [
|
|
{
|
|
"id": "T1",
|
|
"subject": "Extract MapOtOpcUaMeshGrpcServices from Program.cs:743-784 (behaviour-preserving) + endpoint census scaffold (03/S14)",
|
|
"status": "done",
|
|
"blockedBy": []
|
|
},
|
|
{
|
|
"id": "T2",
|
|
"subject": "Census asserts IAllowAnonymous + scope/count guard-of-the-guard; .AllowAnonymous() on the four MapGrpcService maps",
|
|
"status": "done",
|
|
"blockedBy": [
|
|
"T1"
|
|
]
|
|
},
|
|
{
|
|
"id": "T3",
|
|
"subject": "LocalDb sync endpoint anonymised via an empty-prefix MapGroup (MapZbLocalDbSync returns IEndpointRouteBuilder, not chainable)",
|
|
"status": "done",
|
|
"blockedBy": [
|
|
"T2"
|
|
]
|
|
},
|
|
{
|
|
"id": "T4",
|
|
"subject": "MeshGrpcAuthStackTests: PSK-bearing calls succeed through the REAL AddOtOpcUaAuth + UseAuthentication/UseAuthorization stack, with an un-anonymised negative control",
|
|
"status": "done",
|
|
"blockedBy": [
|
|
"T3"
|
|
]
|
|
},
|
|
{
|
|
"id": "T5",
|
|
"subject": "Status fidelity: a no-PSK call reports the interceptor's DETAIL string, not a cookie 401/302 (ConfigServe Unauthenticated collision makes status-only assertions vacuous)",
|
|
"status": "done",
|
|
"blockedBy": [
|
|
"T4"
|
|
]
|
|
},
|
|
{
|
|
"id": "T6",
|
|
"subject": "MeshGrpcDriverOnlyPipelineTests: driver-only nodes carry no authorization middleware — pins the 03/S14 exemption",
|
|
"status": "done",
|
|
"blockedBy": [
|
|
"T3"
|
|
]
|
|
},
|
|
{
|
|
"id": "T7",
|
|
"subject": "MeshGrpcMapConventionTests: Program.cs source scan — zero direct MapGrpcService/MapZbLocalDbSync sites, exactly one mapper call",
|
|
"status": "done",
|
|
"blockedBy": [
|
|
"T1"
|
|
]
|
|
},
|
|
{
|
|
"id": "T8",
|
|
"subject": "docker-dev: Security__Auth__DisableLogin parameterised as ${OTOPCUA_DISABLE_LOGIN:-true} on central-1/central-2 + header docs",
|
|
"status": "done",
|
|
"blockedBy": []
|
|
},
|
|
{
|
|
"id": "T9",
|
|
"subject": "docs/security.md \"Mesh gRPC ingress is AllowAnonymous by design\" + cross-refs in docs/Configuration.md and docs/Telemetry.md",
|
|
"status": "done",
|
|
"blockedBy": []
|
|
},
|
|
{
|
|
"id": "T10",
|
|
"subject": "LIVE GATE: docker-dev with DisableLogin=false — step-0 falsification control MUST fail on the pre-fix build (Deployment.Status=4), then the fixed build seals Applied on all six nodes; restore DisableLogin=true",
|
|
"status": "pending",
|
|
"blockedBy": [
|
|
"T3",
|
|
"T4",
|
|
"T5",
|
|
"T6",
|
|
"T7",
|
|
"T8"
|
|
]
|
|
}
|
|
]
|
|
}
|