From d95328efb3f77320fa69ad3614a9a46136759e59 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Thu, 16 Jul 2026 13:49:43 -0400 Subject: [PATCH] docs(secrets): mxaccessgw G-4/G-5/G-6 adopted + merged (mxaccessgw @ e088dfa) --- CLAUDE.md | 2 +- components/secrets/GAPS.md | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/CLAUDE.md b/CLAUDE.md index 9951440..8d63425 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -143,7 +143,7 @@ each project's **code-verified current state**, and the **gaps** between. See | Config + validation (options / startup validation) | Adopted (lib `0.1.0`; all 3 apps, local) | Shared `ZB.MOM.WW.Configuration` lib | [`components/configuration/`](components/configuration/) | [`ZB.MOM.WW.Configuration/`](ZB.MOM.WW.Configuration/) | | Audit (event model + writer seam) | Adopted (lib `0.1.0`; all 3 apps, merged to **local default** main/master + **pushed to origin** (gitea)) | Shared `ZB.MOM.WW.Audit` lib | [`components/audit/`](components/audit/) | [`ZB.MOM.WW.Audit/`](ZB.MOM.WW.Audit/) | | Galaxy Repository (object-hierarchy SQL browse + gRPC service) | Built (lib `0.1.0`, **published to the Gitea feed**; consumed by HistorianGateway as a feed `PackageReference`) | Shared `ZB.MOM.WW.GalaxyRepository` lib | _(design in histsdk + design doc 2026-06-23)_ | [`ZB.MOM.WW.GalaxyRepository/`](ZB.MOM.WW.GalaxyRepository/) | -| Secrets (encrypted store + `${secret:}` resolution) | Built (libs `0.1.2`, **published to the Gitea feed**; **HistorianGateway adopted + live-proven** 2026-07-16; 3 apps not yet adopted) | Shared `ZB.MOM.WW.Secrets` lib (3 packages + CLI) | [`components/secrets/`](components/secrets/) | [`ZB.MOM.WW.Secrets/`](ZB.MOM.WW.Secrets/) | +| Secrets (encrypted store + `${secret:}` resolution) | Built (libs `0.1.2`, **published to the Gitea feed**; **HistorianGateway adopted + live-proven** 2026-07-16; **mxaccessgw adopted G-4/G-5/G-6 + merged to `origin/main` @ `e088dfa`** 2026-07-16, box-verified fail-closed + encrypt-at-rest; OtOpcUa + ScadaBridge planned, not yet adopted) | Shared `ZB.MOM.WW.Secrets` lib (3 packages + CLI) | [`components/secrets/`](components/secrets/) | [`ZB.MOM.WW.Secrets/`](ZB.MOM.WW.Secrets/) | The auth component is fully populated: a normalized [`spec`](components/auth/spec/SPEC.md), a proposed [`shared-contract`](components/auth/shared-contract/ZB.MOM.WW.Auth.md), three diff --git a/components/secrets/GAPS.md b/components/secrets/GAPS.md index c61c047..6457447 100644 --- a/components/secrets/GAPS.md +++ b/components/secrets/GAPS.md @@ -5,6 +5,22 @@ The delta between each project's [`current-state`](current-state/) and the reference-consumer-proven**; everything here is per-app adoption of an existing lib (not lib construction). +## Execution status (2026-07-16) + +- **mxaccessgw — G-4 + G-5 + G-6 DONE.** Executed via the plan below (8 tasks, subagent-driven, + classification-driven reviews), **merged + pushed to `origin/main` (mxaccessgw @ `e088dfa`)**. + Offline: 0-warning build, full suite 781 pass / 44 pre-existing worker-COM (0 non-worker), + behavioral claim-type authz test, no Data-Protection disturbance. Box-verified on windev + (real .NET 10.0.8): fail-closed on unseeded `${secret:}` (`SecretNotFoundException`, refuses + to start) + CLI seed/`get` decrypt round-trip + **zero plaintext in the SQLite store at rest**. + (`/admin/secrets` interactive reveal not re-proven on this box — same shared `.Ui` component + already live-proven via HistorianGateway; box gateway runs LDAP-disabled/anonymous so a real + LDAP-via-secret login wasn't exercised there.) Two review-caught fixes folded in: the LDAP + password change's test/doc blast radius (validator-helper + host-test-bootstrap + doc truth), + and the live-LDAP integration suite now honors the `MxGateway__Ldap__ServiceAccountPassword` + env override. **G-4/G-5/G-6 below are the remaining OtOpcUa + ScadaBridge scope.** +- **OtOpcUa, ScadaBridge — planned, NOT executed** (recommended order: OtOpcUa next, then ScadaBridge). + ## Design + implementation plans (2026-07-16) G-2 … G-6 are now planned. Shared design + three per-repo executable plans (task-metadata'd,