2 Commits

Author	SHA1	Message	Date
Joseph Doherty	92997b40dc	feat(overview): self-observability, config and the container image ... Closes Phase 3 of the overview-dashboard plan (tasks 3.7-3.9). Self-observability - OverviewMetrics: an observable gauge read from the published snapshot at scrape time, so the metric and the page cannot disagree about what the dashboard believes, plus a sweep-duration histogram. Instrument names follow the family METRIC-CONVENTIONS spec (overview.instance.status / overview.poll.duration, unit s) rather than the plan's literal zb_ names; Prometheus renders them as overview_instance_status and overview_poll_duration_seconds. Labels are application/node/group - "node", not "instance", because Prometheus stamps its own instance label on every scraped series and a colliding metric label is silently renamed exported_instance. Instances never probed emit nothing: the enum's zero ordinal is Up, so a placeholder would publish the single most reassuring answer about a node nobody has heard from. - Two readiness checks make the dashboard's own /health/ready mean something: registry-loaded (reports the counts it bound) and last-poll-cycle-completed, which catches the failure where Kestrel is fine, the page still renders, and every card on it is quietly frozen. The heartbeat is stamped by the sweep, not derived from the snapshot's timestamp - the poller publishes the registry before it probes anything, so a stuck poller would otherwise look healthy. No cycle yet is Degraded inside the grace window and Unhealthy past it, so a restart does not fail readiness for its first seconds and a poller that never started cannot hide behind "still starting". Configuration - appsettings.json ships tuning defaults with an EMPTY Applications list, so a deployment that supplies no registry fails at ConfigPreflight naming the key instead of booting into a dashboard of nothing. - Three registries, because reachability genuinely differs: Development is the host-reachable subset (4 instances), Docker is the full 16-instance fleet by container DNS name. The rigs publish almost no per-node HTTP port to the host - OtOpcUa publishes none (only Traefik :9200, load-balanced across the central pair, so it cannot identify a node) and ScadaBridge keeps site :8084 container-internal. Ports were established by probing the running rigs, not read off the compose files, because the two disagree: OtOpcUa site nodes serve health on :8080, not the :9000 their compose anchor implies. - Real Serilog sinks, not the family's empty "Serilog": {}. AddZbSerilog drives sinks entirely from configuration and adds none of its own, so the empty section produces an app that logs NOWHERE - verified against the running HistorianGateway container, whose log stream is completely empty for exactly this reason. The HttpClient level override matters too: 16 instances on a 10s cadence emit several Information lines a second of pure probe noise. Container - HistorianGateway-pattern runtime-only image; the compose stack joins the three rig networks as external, so bringing the dashboard up or down cannot disturb a rig. The Dockerfile clears ASPNETCORE_HTTP_PORTS as well as ASPNETCORE_URLS: on .NET 8+ the base image declares its binding via the former, and clearing only the latter leaves Kestrel logging "Overriding address(es)" every boot. No healthcheck - aspnet:10.0 has neither curl nor wget, and adding a --healthcheck entry point to production code to satisfy Compose is not a trade worth making. Tests - BootTests boot the real Program.cs: every endpoint anonymous, the page rendering from cache while nothing it watches is reachable, the Meters allowlist proven by an end-to-end /metrics scrape, and both refuse-to-boot paths (missing registry, stale window inside the poll interval). The registry is supplied via environment variables, not ConfigureAppConfiguration, because ConfigPreflight runs before Build() - when the factory's callbacks are applied - and would not see them. 170 tests, 0 warnings. Verified live against the running rigs: 16 cards, 16 gauge series, page and gauge agreeing exactly.	2026-07-24 07:35:32 -04:00
Joseph Doherty	5fe7135e2c	feat(overview): poller, leader aggregation and the dashboard UI ... Tasks 3.4-3.6 of the overview-dashboard plan. Polling (3.4/3.5): - OverviewPollerService: one timer at the fastest configured cadence, each target polled when its own interval is due, fan-out per sweep, no retries (the next tick is the retry, so damping stays the only place that decides whether a failure is worth showing). - OverviewSnapshotStore: atomic swap of a complete immutable graph plus a change event. Pages read it and never probe — the cache-first requirement. - LeaderResolver: per-group leader from akka-cluster data, with the split-brain flag scoped to members that are actually answering, so an ordinary failover is not misread as a disagreement. UI (3.6): ThemeShell + StatusPill/TechCard composition against the mockup; instance cards carry the status stripe (dashed for Unreachable), the check detail list and the raw ready/active signal line. Two defects found by verification rather than by review: - The active tier answers with a status code and an EMPTY body, but the client demanded parseable JSON on every probe — so a healthy pair rendered as "role unknown" instead of Active/Standby. Split into ProbeAsync (ready tier, body is the payload) and ProbeStatusAsync (active tier, code is the answer). Caught by a live smoke run against two fake health endpoints; the poller tests now serve an empty body so they hold the fix. - SweepAsync published even when cancellation was already requested, leaving a half-probed registry as the store's final state on shutdown. It now checks the token itself rather than relying on the transport to throw. Also: app.UseAntiforgery() is required despite the anonymous-by-design pipeline — AddRazorComponents stamps antiforgery metadata unconditionally and the endpoint middleware hard-fails without it (every page was 500). Chosen over DisableAntiforgery() so a future form is protected by default. 147 tests, 0 warnings. Live-verified end to end against fake endpoints: Up/Unreachable/Active/Standby, leader chip, cluster-data line, KPI counts.	2026-07-24 07:05:16 -04:00