Joseph Doherty
5198d3dc7f
Task 9 (closeout) of the Secrets gRPC-hub program. Bookkeeping only; no code. - clustered-secrets.md, Production enablement: the gRPC hub is no longer pending. It is BUILT, SHIPPED (0.4.1) and LIVE-GATED PASS 4/4 (ScadaBridge main @ f6c3f7c5, docs/plans/2026-08-07-secrets-grpc-hub-live-gate.md), so the "until that ships, ScadaBridge replication stays off" line is replaced with the truth: the code path is merged and gated, and production enablement is a separate operator action behind a still-default-off flag. OtOpcUa's pair-local topology is recorded as live-gated (lmxopcua master @ 1bd79c8e) rather than pending re-gate. Rotation fan-out corrected: on ScadaBridge it is BOTH central nodes plus both nodes of every site pair, because each central node has its own independent store. - components/secrets/GAPS.md: new "gRPC hub delivered" section recording the 0.4.0/0.4.1 publish, both gates with SHAs and gate-doc paths, and the residual. Existing narrative left intact and amended, not rewritten. - CLAUDE.md Secrets row: lib version 0.3.0 -> 0.4.1 and the app-pin claim corrected (ScadaBridge pins 0.4.1 for the Grpc replicator; the other three still pin 0.2.3); the "production topologies DECIDED" region now records delivery, both gates, default-off, and the residual. - Plan ledger: task 9 completed. Residual carried forward as scadaproj#4 — ScadaBridge's central pair does not converge with itself (central-b served an authenticated but EMPTY manifest all gate while central-a held every secret) and the site client dials a single endpoint; these are one design question, since failover to an empty hub would succeed and silently stop convergence. scadaproj#3 is closed. Claude-Session: https://claude.ai/code/session_014WNM4vjoVksyyBraTXSZE1
16 lines
4.1 KiB
JSON
16 lines
4.1 KiB
JSON
{
|
||
"planPath": "docs/plans/2026-08-07-secrets-grpc-hub-implementation.md",
|
||
"tasks": [
|
||
{"id": 1, "subject": "Task 1: Package scaffold + secrets_hub.v1 proto", "status": "completed", "classification": "standard", "parallelizableWith": [8], "note": "5fd7bf5 + cf6d19d (evolution-policy header) + cc95590 (test project scaffold); spec ✅, code review Approved"},
|
||
{"id": 2, "subject": "Task 2: Server half — hub service + bearer auth + DI", "status": "completed", "classification": "high-risk", "blockedBy": [1], "parallelizableWith": [3], "note": "7fc77f2 + 353af72 (review fixes: GetSecrets batch cap, DI single-registration guard) merged ff into feat/secrets-grpc-hub; spec ✅ 16/16, code review Approved; 73 server tests"},
|
||
{"id": 3, "subject": "Task 3: Client half — pull-only sweep service + DI", "status": "completed", "classification": "high-risk", "blockedBy": [1], "parallelizableWith": [2], "note": "c5ea3a7 + 1c31e6b (review Critical fix: per-row parse isolation, WireToDomain batch methods deleted, real-client CallInvoker tests) merged 55e0178; spec ✅ 8/8, code review Approved on re-review; merged suite 140/140"},
|
||
{"id": 4, "subject": "Task 4: Integration tests + no-write-surface pin", "status": "completed", "classification": "standard", "blockedBy": [2, 3], "note": "3e3748b + 5f81e65 (harness drift-fix via internal validateEagerly seam); spec ✅ 6/6, code review Approved; Grpc suite 158, solution 436/0/15"},
|
||
{"id": 5, "subject": "Task 5: Version bump + pack + publish 0.4.0", "status": "completed", "classification": "small", "blockedBy": [4], "note": "321ab22 = main, pushed; 6 packages @ 0.4.0 on dohertj2-gitea feed incl. new Replicator.Grpc, restore-verified from fresh cache; CHANGELOG.md created (backfilled 0.2.0–0.3.0)"},
|
||
{"id": 6, "subject": "Task 6: ScadaBridge wiring — central hub + site sweep client", "status": "completed", "classification": "high-risk", "blockedBy": [5], "note": "ScadaBridge feat/secrets-grpc-hub 57f08c21+127ec254+c8e90daa+fc784b41 (predicate-sharing review fix); role is a method parameter (not config); mode key Secrets:Replication:Mode default SqlServer; 31/31 wiring pins; spec ✅ 8/8, code review Approved; residual: sweep dials single endpoint (no central-pair failover) — carry to closeout"},
|
||
{"id": 7, "subject": "Task 7: ScadaBridge live gate (docker cluster)", "status": "completed", "classification": "high-risk", "blockedBy": [6], "parallelizableWith": [8], "note": "PASS 4/4 (check 4 on 2nd pass after 0.4.1 denial-warning fix, scadaproj c86cead); ScadaBridge main @ f6c3f7c5 merged+pushed; gate doc docs/plans/2026-08-07-secrets-grpc-hub-live-gate.md; residuals: central pair doesn't converge with itself + single-endpoint client = one design issue to file; delete-while-follower-offline untested"},
|
||
{"id": 8, "subject": "Task 8: OtOpcUa Akka pair-local re-gate (three-mesh rig)", "status": "completed", "classification": "high-risk", "parallelizableWith": [1, 2, 3, 4, 5, 6, 7], "note": "PASS 4/4, OtOpcUa master @ 1bd79c8e pushed; gate doc docs/plans/2026-08-07-secrets-pair-local-live-gate.md; rig fix: Secrets__SqlitePath onto per-node volume; follow-up for Task 9: stale KNOWN-NON-FUNCTIONAL comment in OtOpcUa appsettings.json Secrets block"},
|
||
{"id": 9, "subject": "Task 9: Closeout — issue #3, runbook, GAPS, index", "status": "completed", "classification": "small", "blockedBy": [7, 8], "note": "Runbook clustered-secrets.md Production-enablement + rotation fan-out updated (ScadaBridge = both central nodes + both nodes of every site pair); components/secrets/GAPS.md gained a 'gRPC hub delivered' section (0.4.0/0.4.1, both gates with SHAs, residual); CLAUDE.md Secrets row updated (lib 0.4.1, ScadaBridge pins 0.4.1, both gates PASS 4/4, default-off, residual). OtOpcUa stale appsettings _comment corrected: lmxopcua master @ 01256344, pushed. scadaproj#3 all 6 boxes checked with SHA annotations, closing comment posted, CLOSED. Residual filed as scadaproj#4 (central-pair convergence + client endpoint failover are one design question; plus delete-while-follower-offline untested and denial-warning alerting must sum per-window deltas)."}
|
||
],
|
||
"lastUpdated": "2026-08-07"
|
||
}
|