Joseph Doherty
b4c38d0f0c
Verified 2026-11-09 against each app's origin default branch pins (OtOpcUa origin/master c904472a, mxaccessgw origin/main de86f8b8, ScadaBridge origin/main 7153a197, HistorianGateway origin/main 4d6a9ad) and the Gitea NuGet feed: - Audit README: consumer matrix no longer says "adoption deferred" (all four apps pin 0.1.0, DEEP-adopted 2026-06-02; HistorianGateway row added); dead ~/Desktop/scadaproj-audit paths fixed. - Configuration CLAUDE.md: drop "not yet pushed to remotes"; all four pin 0.1.0. - Telemetry README/CLAUDE.md: all four apps call AddZbTelemetry and pin 0.1.0; HistorianGateway added to the consumer matrix. - Secrets CLAUDE.md: lead now says family 0.6.3 on the feed, all four apps pin 0.6.2, none pins 0.6.3 or Replicator.Grpc. Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
ZB.MOM.WW.Audit
Canonical audit event model, best-effort writer seam, and redactor seam for the ZB.MOM.WW SCADA family (OtOpcUa, MxAccessGateway, ScadaBridge). This is a library, not a service — it is linked directly into the consuming application at build time. Transport and storage remain per-project; only the shared record + seams live here.
Packages
| Package | Description | Key Dependencies |
|---|---|---|
ZB.MOM.WW.Audit |
Canonical AuditEvent record, AuditOutcome enum, IAuditWriter + IAuditRedactor seams, shipped helpers (NullAuditRedactor, TruncatingAuditRedactor, NoOpAuditWriter, CompositeAuditWriter, RedactingAuditWriter), and AddZbAudit DI extension. |
Microsoft.Extensions.DependencyInjection.Abstractions |
Consumer Matrix
| Consumer | ZB.MOM.WW.Audit |
|---|---|
| OtOpcUa | yes — DEEP-adopted 2026-06-02 (canonical record + AuditWriterActor : IAuditWriter), pins 0.1.0 |
| MxAccessGateway | yes — DEEP-adopted 2026-06-02 (canonical SQLite audit_event store + IAuditWriter), pins 0.1.0 |
| ScadaBridge | yes — DEEP-adopted 2026-06-02 (audit-subsystem re-architecture onto the canonical record), pins 0.1.0 |
| HistorianGateway | yes — AddZbAudit + IAuditWriter, pins 0.1.0 |
All four apps pin 0.1.0 (the only version on the Gitea feed), verified against each repo's origin default
branch 2026-11-09. The 2026-06-02 adoption was merged and pushed on 2026-06-03.
Adoption history is in components/audit/GAPS.md in the outer scadaproj workspace. Each app brings its own transport (Akka broadcast / SQLite append / SQL ingest) and domain vocabulary (channels / kinds / event-types) — those stay per-project. The shared library provides the canonical record and the two seams that decouple "what to audit" from "how to store it".
Auth alignment
AuditEvent.Actor is a string today. At adoption time it SHOULD be set to the ZB.MOM.WW.Auth principal identifier — this is the "audit closes the loop on Auth" hinge described in the spec. No compile-time dependency on ZB.MOM.WW.Auth is introduced here; the alignment is by convention.
Versioning
The single package is versioned from Directory.Build.props. The current release is 0.1.0. A single version bump in Directory.Build.props bumps the package.
Building and packing
# From ZB.MOM.WW.Audit/
dotnet build ZB.MOM.WW.Audit.slnx
dotnet test ZB.MOM.WW.Audit.slnx
# Produce the NuGet package into ./artifacts/
./build/pack.sh
Design documentation
Full design docs live in the components/audit folder of the SCADA project workspace:
~/Desktop/scadaproj/components/audit/spec/SPEC.md— overall audit specification~/Desktop/scadaproj/components/audit/spec/EVENT-MODEL.md— field-by-field event model + per-project mapping table~/Desktop/scadaproj/components/audit/shared-contract/ZB.MOM.WW.Audit.md— public API contract (on paper)~/Desktop/scadaproj/components/audit/GAPS.md— adoption backlog