diff --git a/ZB.MOM.WW.Secrets/CHANGELOG.md b/ZB.MOM.WW.Secrets/CHANGELOG.md
index c531d4f..5d5d74b 100644
--- a/ZB.MOM.WW.Secrets/CHANGELOG.md
+++ b/ZB.MOM.WW.Secrets/CHANGELOG.md
@@ -10,6 +10,18 @@ one of them.
Fixes the scadaproj#15 code-review findings (`code-reviews/Secrets/findings.md`): six P2s (scadaproj#30–#35),
the P3 batch (scadaproj#45: Secrets-004–009, 011, 012, 014–016, 018, 019) and the scadaproj#49 follow-ups.
+### Deprecated
+
+- **`ZB.MOM.WW.Secrets.Replicator.Grpc` is deprecated** (scadaproj#8, owner decision 2026-11-09). The
+ pull-only `secrets_hub.v1` hub has had no consumer since ScadaBridge retired it (2026-09-28, site
+ secrets now ride its artifact deploy); OtOpcUa never used it (Akka pair-local). The project and its
+ test project are removed from `ZB.MOM.WW.Secrets.slnx`, so the family build, test run and pack
+ (`build/push.sh`) no longer include it, and the csproj is `IsPackable=false`. `SecretsGrpcHubServerExtensions`
+ (`AddZbSecretsGrpcHub`, `MapZbSecretsHub`) and `SecretsGrpcHubClientExtensions` (`AddZbSecretsGrpcHubClient`)
+ are `[Obsolete]`. **No `0.6.6` of this package will be published**; `0.4.1`–`0.6.3` stay on the feed
+ until the owner unlists them. Source and tests stay in the tree and still build standalone
+ (`dotnet test tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests`).
+
### scadaproj#52 follow-ups
- **The CLI reference audit reports malformed `${secret:}` tokens.** New `ReferenceStatus.Malformed`:
diff --git a/ZB.MOM.WW.Secrets/CLAUDE.md b/ZB.MOM.WW.Secrets/CLAUDE.md
index c129c2b..f005f06 100644
--- a/ZB.MOM.WW.Secrets/CLAUDE.md
+++ b/ZB.MOM.WW.Secrets/CLAUDE.md
@@ -1,8 +1,10 @@
# ZB.MOM.WW.Secrets
-Shared encrypted secret store + `${secret:}` resolution for the **ZB.MOM.WW SCADA family** (5 packages + the `secret` CLI; replicators for SqlServer / AkkaDotNet / Grpc). Build/test from this directory: `dotnet test`. Component spec + gaps: `../components/secrets/`. Operator runbooks under `docs/operations/`.
+Shared encrypted secret store + `${secret:}` resolution for the **ZB.MOM.WW SCADA family** (5 packages + the `secret` CLI; replicators for SqlServer / AkkaDotNet; the Grpc replicator is deprecated — scadaproj#8). Build/test from this directory: `dotnet test`. Component spec + gaps: `../components/secrets/`. Operator runbooks under `docs/operations/`.
-**Backlog / open work:** lives in Gitea issues on `dohertj2/scadaproj` (`tea issues list --repo dohertj2/scadaproj`) — currently #7 (ignitionoee router pins), #8 (Replicator.Grpc / `0.6.3` fate), #18 (migrator retry jitter). The history below is a record, not a status tracker; file new follow-ups as issues.
+**Backlog / open work:** lives in Gitea issues on `dohertj2/scadaproj` (`tea issues list --repo dohertj2/scadaproj`) — currently #7 (ignitionoee router pins), #18 (migrator retry jitter). The history below is a record, not a status tracker; file new follow-ups as issues.
+
+**`ZB.MOM.WW.Secrets.Replicator.Grpc` — DEPRECATED (2026-11-09, scadaproj#8, owner chose option (b)):** removed from `ZB.MOM.WW.Secrets.slnx` together with its test project (so build/test/`build/push.sh` skip it), csproj `IsPackable=false`, both hub DI extension classes `[Obsolete]`; README/CHANGELOG/`docs/operations/clustered-secrets.md` say so. Source + tests stay in the tree and build standalone (the test csproj suppresses CS0618). No consumer: ScadaBridge retired the hub 2026-09-28, OtOpcUa never used it. Feed versions `0.4.1`–`0.6.3` are left for the owner to unlist.
**`0.6.6` — built, NOT published (2026-11-09, scadaproj#30–#35, #45, #49):** every scadaproj#15 review finding resolved (Secrets-001–019; 0 open) plus the #49 follow-ups (CLI default `SqlitePath`, plain-root reload gap documented) — see `CHANGELOG.md` and `../code-reviews/Secrets/findings.md`. Behaviour changes worth knowing before adopting: store paths through symlinks into the content root now fail validation, malformed `${secret:}` tokens fail startup, UI Reveal fails closed on audit failure.
diff --git a/ZB.MOM.WW.Secrets/Directory.Packages.props b/ZB.MOM.WW.Secrets/Directory.Packages.props
index 522ae47..57830d6 100644
--- a/ZB.MOM.WW.Secrets/Directory.Packages.props
+++ b/ZB.MOM.WW.Secrets/Directory.Packages.props
@@ -30,7 +30,8 @@
-
- true
+ false
ZB.MOM.WW.Secrets.Replicator.Grpc
ZB.MOM.WW
- Central-hosted gRPC secrets hub (pull-only) for the ZB.MOM.WW SCADA family — site nodes follow central, ciphertext-only.
+ DEPRECATED (scadaproj#8) — central-hosted gRPC secrets hub (pull-only) for the ZB.MOM.WW SCADA family — site nodes follow central, ciphertext-only.
https://gitea.dohertylan.com/dohertj2/scadaproj/src/branch/main/ZB.MOM.WW.Secrets
https://gitea.dohertylan.com/dohertj2/scadaproj
diff --git a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests.csproj b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests.csproj
index beb86e7..f32400b 100644
--- a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests.csproj
+++ b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests.csproj
@@ -1,7 +1,12 @@
+
false
+ $(NoWarn);CS0618
diff --git a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/BundleFlowTests.cs b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/BundleFlowTests.cs
index 2b50a3d..8a1c369 100644
--- a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/BundleFlowTests.cs
+++ b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/BundleFlowTests.cs
@@ -233,6 +233,8 @@ public sealed class BundleFlowTests : IDisposable
}
[SkippableFact]
+ // Skip.IfNot is invisible to CA1416; this states the platform guard the analyzer can see.
+ [System.Runtime.Versioning.UnsupportedOSPlatform("windows")]
public async Task Import_source_key_file_permission_denied_renders_friendly_error_without_importing()
{
Skip.IfNot(!OperatingSystem.IsWindows(), "Unix permission bits are exercised via UnixFileMode.");
diff --git a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/KekDoctorFlowTests.cs b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/KekDoctorFlowTests.cs
index 00e419d..ccb048b 100644
--- a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/KekDoctorFlowTests.cs
+++ b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/KekDoctorFlowTests.cs
@@ -227,6 +227,8 @@ public sealed class KekDoctorFlowTests : IAsyncLifetime, IDisposable
}
[SkippableFact]
+ // Skip.IfNot is invisible to CA1416; this states the platform guard the analyzer can see.
+ [System.Runtime.Versioning.UnsupportedOSPlatform("windows")]
public async Task File_old_key_source_permission_denied_renders_friendly_error_and_still_re_diagnoses()
{
Skip.IfNot(!OperatingSystem.IsWindows(), "Unix permission bits are exercised via UnixFileMode.");
diff --git a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Configuration/SecretsStorePathRulesTests.cs b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Configuration/SecretsStorePathRulesTests.cs
index 6ad7433..ba9e885 100644
--- a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Configuration/SecretsStorePathRulesTests.cs
+++ b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Configuration/SecretsStorePathRulesTests.cs
@@ -214,8 +214,8 @@ public sealed class SecretsStorePathRulesTests
services.AddZbSecrets(config, "Secrets");
services.AddZbSecrets(config, "Secrets");
- Assert.Single(services.Where(d => d.ServiceType == typeof(SecretsOptionsValidator)));
- Assert.Single(services.Where(d => d.ServiceType == typeof(IValidateOptions)));
+ Assert.Single(services, d => d.ServiceType == typeof(SecretsOptionsValidator));
+ Assert.Single(services, d => d.ServiceType == typeof(IValidateOptions));
}
[Fact]