Files
lmxopcua/docs/plans
Joseph Doherty c4f537a60c docs(security): record the stage 6 live gate — PASSED on docker-dev
site-a-1 (driver-only, no ConfigDb) with Security:Acl:Enabled=true; central-1
on the same artifact as the A/B control. 11 legs.

The two that only a live rig could settle, as a transcript:

  13:49:39  SiteAOnly = 53   (0x00000000)   streaming ~1/s
  13:49:40  SiteAOnly =      (0x801F0000)   revoking deploy lands; client TOLD
            … 25 seconds of silence, ~25 updates that never arrived …
  13:50:05  SiteAOnly = 157  (0x00000000)   restoring deploy; feed resumes

53 -> 157 across the gap: the device counter ran throughout, so delivery
stopped, not the source. The 0x801F0000 frame is exactly what the
MonitoringMode.Disabled implementation would have swallowed.

Also recorded: the leg that distinguishes working enforcement from a trie that
denies everything is resolvedScopes=1 in the install log, not any denial.

Stated plainly as NOT covered: a UNS-realm grant (the rig's SITE-A has no UNS
equipment) and alarm-command scoping (no alarms there). Both covered offline,
neither seen live.

Two rig facts worth keeping: :9200 round-robins central-1/central-2, and a
stale central-2 rejected the deploy outright because its image predated the
stage-3 scope kinds — image parity must be asserted per container, not assumed
from one build. And SITEA-modbus had an empty DriverConfig, so it ran as a stub
serving nothing; until that was fixed every read returned
BadWaitingForInitialData and no allow leg could be told from a denial.

Rig left as found.

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo
2026-08-01 09:52:42 -04:00
..