dohertj2/scadaproj
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Mark all baseline code-review findings resolved

Browse Source 
All 35 findings fixed in 544a6dd and marked Status: Resolved with resolution
notes. README regenerated: 0 pending / 35 total across 6 libraries.
This commit is contained in:
Joseph Doherty
2026-06-01 11:22:37 -04:00
parent 544a6ddb77
commit ae0ccc9a3a
7 changed files with 112 additions and 131 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code-reviews/Telemetry/findings.md
+36 -17
View File
@@ -10,7 +10,7 @@
| Last reviewed | 2026-06-01 |
| Reviewer | Claude (automated baseline) |
| Commit reviewed | `5f75cd4` |
| Open findings | 8 |
| Open findings | 0 |
## Summary
@@ -55,7 +55,7 @@ happy paths but have no coverage for redactor removal or structured-value redact
|--|--|
| Severity | High |
| Category | Security & secret handling |
| Status | Open |
| Status | Resolved |
| Location | `ZB.MOM.WW.Telemetry/src/ZB.MOM.WW.Telemetry.Serilog/RedactionEnricher.cs:49-67` |
**Description**
@@ -90,7 +90,9 @@ diff.) Add a test asserting a removing redactor scrubs the property (see Telemet
**Resolution**
_Unresolved._
Resolved in `544a6dd`, 2026-06-01 — `RedactionEnricher` now captures the original property
key set and calls `RemovePropertyIfPresent` for any key the redactor dropped from the snapshot,
so a removing redactor scrubs the property; covered by a new removing-redactor test.
### Telemetry-002 — Redactor cannot inspect or scrub destructured/structured property values
@@ -98,7 +100,7 @@ _Unresolved._
|--|--|
| Severity | Medium |
| Category | Security & secret handling |
| Status | Open |
| Status | Resolved |
| Location | `ZB.MOM.WW.Telemetry/src/ZB.MOM.WW.Telemetry.Serilog/RedactionEnricher.cs:49-55` |
**Description**
@@ -129,7 +131,10 @@ payloads are scrubbed when they are not.
**Resolution**
_Unresolved._
Resolved in `544a6dd`, 2026-06-01 — documented the seam's reach (scalar top-level properties
only; structured values exposed as their raw Serilog wrapper, redactable whole-property only) on
the `ILogRedactor` XML doc, the shared contract, and the README; pinned by a destructured-object
test. Nested-field redaction was deliberately not implemented (too invasive for v0.1.0).
### Telemetry-003 — No tests for redactor removal or structured-value redaction
@@ -137,7 +142,7 @@ _Unresolved._
|--|--|
| Severity | Medium |
| Category | Testing coverage |
| Status | Open |
| Status | Resolved |
| Location | `ZB.MOM.WW.Telemetry/tests/ZB.MOM.WW.Telemetry.Serilog.Tests/RedactionTests.cs:33-69` |
**Description**
@@ -158,7 +163,9 @@ takes). These should fail today and pin the fixes.
**Resolution**
_Unresolved._
Resolved in `544a6dd`, 2026-06-01 — added `Removing_redactor_scrubs_the_property_from_the_event`
(red→green for Telemetry-001) and `Redactor_cannot_reach_a_field_inside_a_destructured_object`
(pins the documented Telemetry-002 limitation), plus a Resource-attribute parity test.
### Telemetry-004 — `service.instance.id` Resource attribute is undocumented in spec and contract
@@ -166,7 +173,7 @@ _Unresolved._
|--|--|
| Severity | Low |
| Category | Spec & shared-contract adherence |
| Status | Open |
| Status | Resolved |
| Location | `ZB.MOM.WW.Telemetry/src/ZB.MOM.WW.Telemetry/ZbResource.cs:19-45` |
**Description**
@@ -190,7 +197,10 @@ member in the shared contract, so the normalized spec and the code agree.
**Resolution**
_Unresolved._
Resolved in `544a6dd`, 2026-06-01 — kept the attribute (documented the
`MachineName:ProcessId` rationale) and added `service.instance.id` to the Resource tables in
`SPEC.md` §2 and `METRIC-CONVENTIONS.md` §4, plus the `ZbResource.InstanceId` member to the shared
contract; spec and code now agree.
### Telemetry-005 — Two hand-maintained Resource-attribute builders can silently drift
@@ -198,7 +208,7 @@ _Unresolved._
|--|--|
| Severity | Low |
| Category | Spec & shared-contract adherence |
| Status | Open |
| Status | Resolved |
| Location | `ZB.MOM.WW.Telemetry/src/ZB.MOM.WW.Telemetry/ZbResource.cs:38-64`, `ZB.MOM.WW.Telemetry/src/ZB.MOM.WW.Telemetry.Serilog/ZbSerilogConfig.cs:125-151` |
**Description**
@@ -221,7 +231,9 @@ key-for-key identical for a representative options object.
**Resolution**
_Unresolved._
Resolved in `544a6dd`, 2026-06-01 — introduced `ZbResource.BuildAttributes` as the single
source of truth; `ZbResource.Configure` (OTel SDK) and `ZbSerilogConfig.BuildResourceAttributes`
(OTLP log sink) now both derive from it, and a parity test asserts the two sets are identical.
### Telemetry-006 — Malformed `OtlpEndpoint` throws `UriFormatException` late, with no context
@@ -229,7 +241,7 @@ _Unresolved._
|--|--|
| Severity | Low |
| Category | Error handling & resilience |
| Status | Open |
| Status | Resolved |
| Location | `ZB.MOM.WW.Telemetry/src/ZB.MOM.WW.Telemetry/ZbTelemetryExtensions.cs:127-135` |
**Description**
@@ -252,7 +264,10 @@ option (consistent with the existing `ServiceName` guard) rather than letting a
**Resolution**
_Unresolved._
Resolved in `544a6dd`, 2026-06-01 — added `ZbTelemetryOptionsValidator.Validate`, called from
both `BuildOptions` and `AddZbSerilog`: when `Exporter == Otlp` it requires a non-empty,
well-formed absolute `OtlpEndpoint` and throws a named `ArgumentException` (no-op for Prometheus);
covered by three new tests.
### Telemetry-007 — Redaction snapshot allocates a dictionary on every log event
@@ -260,7 +275,7 @@ _Unresolved._
|--|--|
| Severity | Low |
| Category | Performance & resource management |
| Status | Open |
| Status | Resolved |
| Location | `ZB.MOM.WW.Telemetry/src/ZB.MOM.WW.Telemetry.Serilog/RedactionEnricher.cs:49-67` |
**Description**
@@ -282,7 +297,9 @@ redaction on very hot loggers. Acceptable as-is given redaction is opt-in and se
**Resolution**
_Unresolved._
Resolved in `544a6dd`, 2026-06-01 — `Enrich` now short-circuits before any snapshot allocation
when the event has no properties (and still early-returns when no redactor is registered), so the
per-event dictionary copy is only paid when there is actually something to redact.
### Telemetry-008 — `MapZbMetrics` XML doc claims it is "only valid when Exporter = Prometheus" — stale
@@ -290,7 +307,7 @@ _Unresolved._
|--|--|
| Severity | Low |
| Category | Documentation & XML docs |
| Status | Open |
| Status | Resolved |
| Location | `ZB.MOM.WW.Telemetry/src/ZB.MOM.WW.Telemetry/ZbMetricsEndpointExtensions.cs:11-14` |
**Description**
@@ -314,4 +331,6 @@ overlay). Align the shared-contract summary for `MapZbMetrics` to match.
**Resolution**
_Unresolved._
Resolved in `544a6dd`, 2026-06-01 — rewrote the `MapZbMetrics` XML doc to state it is valid
under any `Exporter` value (Prometheus always-on; OTLP additive overlay) and aligned the matching
shared-contract summary.