Joseph Doherty
3dd7aa40ff
Publishes the three ZB.MOM.WW.LocalDb packages to the Gitea feed (restore-verified from a scratch consumer) and adds the build/push.sh the other shared libs already have. The status prose across CLAUDE.md, README.md and components/*/GAPS.md had drifted from reality, so it was re-derived from the feed listing and the actual PackageReferences + registration calls on each consumer's default branch rather than from prior claims. Five claims were false: Health "not yet adopted" (all four apps wire MapZbHealth), GalaxyRepository's mxaccessgw adoption "a follow-on" (its Server wires AddZbGalaxyRepository), Configuration "not yet pushed", Secrets G-8 "not yet committed", and Theme pinned at 0.2.0 (all four are on 0.3.1). Every doc also said "three apps" while HistorianGateway is a fourth consumer of seven libs, and all eight libraries' test counts were stale (re-ran each suite; all green). Surfaces one previously unrecorded gap: Secrets source is at 0.1.3 with KEK rotation committed, but the feed tops out at 0.1.2, so no app can consume rotation until it is published. Health and observability divergence tables are labelled historical, not re-verified — the libraries are proven wired, but per-app probe coverage vs spec was not re-walked. Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts
Secrets (encrypted secret store + ${secret:} resolution)
Normalizes how the family stores and consumes secrets — SQL/login passwords, API-key HMAC
peppers, LDAP bind passwords, connection strings, TLS material — which are handled ad-hoc
and inconsistently across the three apps today (Data-Protection-encrypted connection
strings in ScadaBridge; peppers/passwords in environment variables; LDAP passwords in
appsettings).
The goal is the shared ZB.MOM.WW.Secrets library: AES-256-GCM envelope encryption at
rest, a pluggable master-key provider and store, an audited ISecretResolver +
${secret:name} config expander for app runtime, and a Blazor /admin/secrets management
UI. The library is built, published (0.1.2), and live-proven via its reference consumer;
per-app adoption is the tracked follow-on.
- Target:
spec/SPEC.md - Realized API:
shared-contract/ZB.MOM.WW.Secrets.md - Implementation:
../../ZB.MOM.WW.Secrets/· designdocs/plans/2026-07-15-secrets-manager-design.md - Adoption backlog:
GAPS.md
Status
| State | |
|---|---|
| Library | Built + published — ZB.MOM.WW.Secrets{,.Abstractions,.Ui} 0.1.2 on the dohertj2-gitea feed; .Cli in-repo (not packed); .Akka replicator deferred (design only) |
| Reference consumer | HistorianGateway — adopted + live-proven (2026-07-16): historian password sourced via ${secret:}, authenticated read against the real wonder historian |
| Three sister apps | Not yet adopted — see per-app current-state + GAPS |
Per-project current state
| Project | Today (baseline) | Doc |
|---|---|---|
| OtOpcUa | (code-verified baseline) | current-state/otopcua/CURRENT-STATE.md |
| MxAccessGateway | (code-verified baseline) | current-state/mxaccessgw/CURRENT-STATE.md |
| ScadaBridge | (code-verified baseline) | current-state/scadabridge/CURRENT-STATE.md |
Not applicable as a fourth adopter row but the exemplar: HistorianGateway already consumes the lib — its wiring is the template the three apps follow (see the shared-contract "Consumer wiring" section).