dohertj2/scadaproj
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: truth sweep — index + component GAPS reconciled with shipped state (Health 0.3.0 merged both apps, OtOpcUa LocalDb Phase 2 executed, Auth 0.1.5, Secrets 0.2.3/0.3.0)

Browse Source 
Claude-Session: https://claude.ai/code/session_014WNM4vjoVksyyBraTXSZE1
This commit is contained in:
Joseph Doherty
2026-08-07 02:00:58 -04:00
parent 1a7bff6a19
commit 537a4f524d
23 changed files with 304 additions and 261 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/secrets/GAPS.md
+15 -8
View File
@@ -19,10 +19,12 @@ construction).
fix. Verified: the shipped `.nuspec` declares `SQLitePCLRaw.lib.e_sqlite3 >= 2.1.12` as a direct
dependency, so **consumers get the patched native lib without needing their own pin**, and a
fresh consumer restoring `0.1.3` scans clean.
- **All four apps are still pinned at `0.1.2`** — they get neither KEK rotation nor the security
fix until bumped.
- **All four apps are pinned to `0.1.2`** — OtOpcUa, MxAccessGateway, ScadaBridge take
`Secrets` + `.Abstractions` + `.Ui`; HistorianGateway takes `Secrets` + `.Ui`.
- **All four apps now pin `0.2.3`, pushed 2026-07-19** (superseding the "still pinned at `0.1.2`"
claim that stood here — corrected 2026-08-07; the 0.1.2→0.2.1 bump and the 0.2.2/0.2.3 rollout
are recorded below and in the scadaproj `CLAUDE.md` index). OtOpcUa, MxAccessGateway, ScadaBridge
take `Secrets` + `.Abstractions` + `.Ui`; HistorianGateway takes `Secrets` + `.Ui`.
- **`0.3.0` (2026-07-19) ships in the `secret` CLI tool only** (interactive operator console); the
four apps deliberately stay on the `0.2.3` libraries — the 0.3.0 delta has no app-side surface.
- **G-7 clustered replication is BUILT (2026-07-18, lib `0.2.0`) — both options, not just one.**
The plan scoped Option A (shared SQL store) and deferred Option B (Akka) to phase 2; the build
covers **both**, as two new packages:
@@ -50,8 +52,10 @@ construction).
### Open
- ✅ **All four apps bumped `0.1.2` → `0.2.1`** (2026-07-18), each on a local `feat/secrets-0.2.0`
branch, **not pushed**. HistorianGateway `bb9d923`, MxAccessGateway `b021e29`, OtOpcUa `1ccc237c`,
ScadaBridge `0083ce35`.
branch (HistorianGateway `bb9d923`, MxAccessGateway `b021e29`, OtOpcUa `1ccc237c`,
ScadaBridge `0083ce35`). *Superseded 2026-07-19:* the branches were carried forward through the
`0.2.2`/`0.2.3` fixes and **all four apps landed on `0.2.3`, merged and pushed** (the "not
pushed" note above described the interim 0.2.1 state only — corrected 2026-08-07).
- **Correction:** the bump was originally justified as closing GHSA-2m69-gcr7-jv3q in all four
apps. Measured against the `0.1.2` baseline in every repo, **all four already resolved the
patched `SQLitePCLRaw.lib.e_sqlite3 2.1.12`** — two via their own pins, two transitively via
@@ -270,8 +274,11 @@ evidence it is correct. When a reviewer names a mechanism, probe the mechanism.
operator runbook — full suite green (82+15, 0 regressions) + end-to-end CLI smoke, adversarial
crypto review PASS with a review-caught TOCTOU closed via compare-and-swap. G-7's SQL-store-vs-Akka
fork is resolved (build the shared SQL-Server `ISecretStore`; Akka replicator deferred phase-2)
with a design doc + executable plan + `.tasks.json`, **no code built**. See the G-7/G-8 backlog
entries below. Not yet committed/pushed (awaiting go-ahead).
with a design doc + executable plan + `.tasks.json`, **no code built at that point**. See the
G-7/G-8 backlog entries below. *(Corrected 2026-08-07: the trailing "Not yet committed/pushed
(awaiting go-ahead)" note was stale — G-8 + the G-7 plan ARE committed and pushed on `main` @
`d82d345`, as the Current-state section above already records; G-7 was subsequently BUILT
2026-07-18 at lib `0.2.0`, both replication options.)*
## Design + implementation plans (2026-07-16)