Joseph Doherty
ac4edc6e0a
Add archreview/2026-10-21 (overall summary + tracker with R21-* rows). Re-triage the 68 cycle-1 Not-started rows in place: 21 Done, 13 Won't fix, 34 Open (promoted as R21-O1..O34). Correct the 2026-08-19 tracker header so CLI-47..50, IPC-36/37, TST-35 read Done like their rows.
2.7 KiB
MxAccessGateway — System Review (2026-10-21)
Summary of the fourth review cycle. Per-finding status is in remediation/00-tracking.md; the per-domain finding text is not kept in this directory, so the tracker rows carry the description.
Dimensions
Six reviewers each took one dimension of the system.
| Dimension | Reviewed | Outcome |
|---|---|---|
| Sessions | Session lifecycle, sweep, shutdown, lease, metrics accounting (GatewaySession, SessionManager) |
One High: a kill or shutdown during worker startup orphaned the worker. Nine findings, all fixed in stream A. Replay-ring byte cap remains open (low) |
| Worker | STA runtime, alarm polling, ReadBulk, caches, process exit paths (ZB.MOM.WW.MxGateway.Worker) |
Eight findings fixed on fix/review-2026-10-21-e, not yet merged; four deferred (one needs a parity probe, one is a security tradeoff) |
| gRPC | Interceptor coverage, audit, alarm feed, correlation ids, /metrics |
Eleven findings fixed. /metrics authentication is opt-in |
| Dashboard | Hub fan-out, browse, snapshot feed, health status, design doc | Ten findings fixed; three low races left open |
| Clients | Five language clients: ack retry, buffers, dispose, typed diagnostics | All fixed. The Go go vet copylocks error in a test predates the review and remains |
| Docs vs code | Proto comments, stillpending.md, tracker headers, untested helpers |
In progress in stream L |
Cross-cutting observations
- The two-process lifecycle is the most failure-prone area: most of the nine session findings are races between open, close, kill and shutdown. Each fix added a regression test; the pattern to keep is that every exit path accounts for the session exactly once.
- Silent failure was the recurring theme in the worker (STA death, alarm-poll failure, missing unhandled-exception hook). Each now ends in a typed fault or a distinct exit code.
- Bounded fan-out was the recurring theme in the dashboard: every hub send now has a bound, a timeout or a drop policy.
- Three external items are outside this repository: shared GLAuth TLS, the Gitea runner token, and an OtOpcUa session leak.
Cycle-1 backlog
The review also re-triaged 68 first-cycle findings that no later tracker had re-listed: 21 are done, 13 are closed as won't fix with a reason, and 34 remain open and are promoted as R21-O1 to R21-O34. The highest-weight open items are the missing reply to a command that races worker shutdown, the worker pipe without CurrentUserOnly, the no-op startup probe with retry options that cannot retry, the redactor gap for WriteSecuredBulk/WriteSecured2Bulk, the .NET retry budget that a DeadlineExceeded consumes, and the Go client's missing typed auth errors and strict-TLS flag.