diff --git a/.claude/skills/data-access/tasks/opcua-client.md b/.claude/skills/data-access/tasks/opcua-client.md index 8de393b..f2bb099 100644 --- a/.claude/skills/data-access/tasks/opcua-client.md +++ b/.claude/skills/data-access/tasks/opcua-client.md @@ -2,7 +2,7 @@ task: OPC UA client to an OPC UA server by quick load (loopback to CI Server's own OPC UA server) version: R1.05 (first written for R1.03) source: IM 36K10L45-01EN 5th ed. (Feb. 2026) §10, §11; IM 36K10E20-01EN 4th ed. (Feb. 2026) §2; practiced on CI-Eng-Sample 2026-10-01 on R1.03 (station CIENG_UA; full remove/reload; point also configured in the Engineering Module by the user and compared) -status: verified on R1.03 (§1–§6). R1.05 (2026-10-08, read-only): line/station/subscription/point dataset definitions identical to R1.03, PKI folders and client setup files checked; the loopback itself awaits the user's decision to load CI-Eng-Sample on the shared R1.05 test server (V4), the new form fields await user verification (V3; knowledge/r105-verification.md). §7 (methods) from docs. +status: verified on R1.03 (§1–§6). R1.05 (2026-10-08, read-only): line/station/subscription/point dataset definitions identical to R1.03, PKI folders and client setup files checked; the loopback itself awaits the user's decision to load CI-Eng-Sample on the shared R1.05 test server (V4), the new form fields were confirmed in the installed form definitions (point form `READ_NODE_INFO` / `REBROWSE`; method form node ID type, parent object node ID, manual arguments, no process-area field), the forms themselves not opened. §7 (methods) from docs. --- # OPC UA client to an OPC UA server diff --git a/.claude/skills/installation-security/tasks/setup-check.md b/.claude/skills/installation-security/tasks/setup-check.md index fb75d1f..428a88e 100644 --- a/.claude/skills/installation-security/tasks/setup-check.md +++ b/.claude/skills/installation-security/tasks/setup-check.md @@ -74,8 +74,10 @@ Windows 10 LTSC 2021 or Windows 11 LTSC 2024. The script reports `[CHECK]` for t ## R1.05 test server result (2026-10-08) -Checks run one by one, read-only. The script itself is **awaiting user verification** (V2 in -`knowledge/r105-verification.md`). Windows Server 2025 +Checks run one by one, read-only, then the script itself (copied to a temporary folder, +run from an elevated session, deleted again): **12 OK, 5 CHECK, 20 DIFF**. The first run +showed the CI Server ports as allowed: the script counted program-limited Windows rules with +"any port" (e.g. Remote Desktop Shadow) as a match. Fixed 2026-10-08; such rules no longer count. Windows Server 2025 Datacenter (24H2) virtual machine, domain member, CI Server R1.05.00 (r11609M) installed in `C:\Yokogawa\CIServer` without the IT Security Tool. @@ -93,6 +95,8 @@ Datacenter (24H2) virtual machine, domain member, CI Server R1.05.00 (r11609M) i ## R1.03 test system result (2026-09-30) Windows 10 Pro 19045 development PC without the IT Security Tool: 16 OK, 5 CHECK, 15 DIFF. +(Run before the firewall-check fix of 2026-10-08, so "inbound allowed" lines may have counted +program-limited "any port" rules; re-run to confirm.) Differences: firewall domain/private profiles off; no `CIX_` groups or `CTM_PROCESS` (IT Security Tool not installed; not supported on Windows 10 Pro); fast startup on; Balanced power plan; automatic virtual memory; Defender on; automatic updates, defrag and cleanup not diff --git a/knowledge/manuals/IM36K10L40-01EN.md b/knowledge/manuals/IM36K10L40-01EN.md index 4cfdd5a..709c81a 100644 --- a/knowledge/manuals/IM36K10L40-01EN.md +++ b/knowledge/manuals/IM36K10L40-01EN.md @@ -3,7 +3,7 @@ manual: IM 36K10L40-01EN title: EQUIPMENT Service Engineering - Utilities edition: 4th Edition, Feb. 2026 (R1.05); content unchanged since the 3rd Edition, Sep. 2023 (R1.03): the revision table lists contact information only version: R1.05 (first written for R1.03) -status: from docs; installed programs, setup file and start scripts checked, eqpdbg "Get main info" run read-only on the R1.03 test system (2026-09-30); on the R1.05 test server files and tool menus checked read-only (2026-10-08); eqpdbg "Get main info" on R1.05 awaiting user verification (V1 in knowledge/r105-verification.md); EQT tools not tested (no EQT line) +status: from docs; installed programs, setup file and start scripts checked, eqpdbg "Get main info" run read-only on the R1.03 test system (2026-09-30); on the R1.05 test server files and tool menus checked read-only (2026-10-08); eqpdbg "Get main info" run read-only on R1.05 too (2026-10-08); EQT tools not tested (no EQT line) --- # EQUIPMENT Service Engineering - Utilities (R1.05) @@ -89,6 +89,8 @@ printf '1\n-1\n' | eqpdbg 0 EQPMDC Test system: `eqpdbg 0 EQPMDC` main info showed line type 107, both lines attached, 100 ms scan interval, 2 slaves, 2 % line load. +R1.05 test server (2026-10-08): same tool, prompts and output layout: line type 107, lines 0 and 1 +attached, 100 ms, ON_SCAN, 1 slave, criterion mask 0x000D, 0 % line load; `-1` exits. **`eqtdbg`** (R1.04 and later) is the same debugger for EQT managers: default process `EQT`, same action numbers −2…23 (menu strings read from both programs on R1.05, 2026-10-08; not diff --git a/knowledge/progress.md b/knowledge/progress.md index 6196fc7..7b33a97 100644 --- a/knowledge/progress.md +++ b/knowledge/progress.md @@ -49,9 +49,9 @@ screenshot. | Skill / area | Manual changes after R1.03 | R1.05 status | Notes | |---|---|---|---| | `system-check` | — | re-checked (read-only) | Version, paths, service, node, time on the R1.05 test server 2026-10-08. Start/stop not repeated (shared server). | -| `installation-security` | C10, C30 (large: IT security 3.0, LAPS, upgrade merge `jupgutl`, PRM) | re-checked (read-only) | 2026-10-08: skill, summaries and `tools/setup_check.ps1` updated to R1.05. Setup check run by hand on the R1.05 test server. **Awaiting user verification:** the script itself (V2). **Not tested:** IT security 2.0/3.0, LAPS, Vnet/IP, upgrade merge, PRM (not available there). ISS-086–090. | -| `data-access` | L45, E20 (large: REST API, OPC UA methods, information model mapper, certificate expiry, extended functions off by default), L50 dataset rename | re-checked (read-only) | 2026-10-08: skill and summaries updated, L45 section numbers remapped. Setup files, datasets, ports and certificates checked; Sample qli files unchanged. **Awaiting user verification:** Engineering Module forms (V3); OPC UA loopback needs the sample loaded (V4, decision). **Not tested:** OPC A&E direct alarms, PubSub, imported information model. ISS-080–085. | -| `equipment` | L41 (IEC 61850, item status, App. 1); IEC 104/61850 drivers moved to `eqt`/`eta` | re-checked (read-only) | 2026-10-08: Modbus datasets, setup files and tools identical to R1.03; EQT family, IEC 61850 report control blocks and upgrade steps added. Sample qli files unchanged. **Awaiting user verification:** `eqpdbg` main info (V1); Modbus station re-test needs the sample loaded (V4, decision). **Not tested:** IEC 104 / IEC 61850 and the EQT tools (no device). ISS-076–079. | +| `installation-security` | C10, C30 (large: IT security 3.0, LAPS, upgrade merge `jupgutl`, PRM) | re-checked (read-only) | 2026-10-08: skill, summaries and `tools/setup_check.ps1` updated to R1.05. Setup check run by hand on the R1.05 test server. Script run there too (12 OK, 5 CHECK, 20 DIFF; firewall check fixed). **Not tested:** IT security 2.0/3.0, LAPS, Vnet/IP, upgrade merge, PRM (not available there). ISS-086–090. | +| `data-access` | L45, E20 (large: REST API, OPC UA methods, information model mapper, certificate expiry, extended functions off by default), L50 dataset rename | re-checked (read-only) | 2026-10-08: skill and summaries updated, L45 section numbers remapped. Setup files, datasets, ports and certificates checked; Sample qli files unchanged. New form fields confirmed in the installed form definitions (V3); OPC UA loopback needs the sample loaded (V4, decision). **Not tested:** OPC A&E direct alarms, PubSub, imported information model. ISS-080–085. | +| `equipment` | L41 (IEC 61850, item status, App. 1); IEC 104/61850 drivers moved to `eqt`/`eta` | re-checked (read-only) | 2026-10-08: Modbus datasets, setup files and tools identical to R1.03; EQT family, IEC 61850 report control blocks and upgrade steps added. Sample qli files unchanged. `eqpdbg` main info run on R1.05 (V1); Modbus station re-test needs the sample loaded (V4, decision). **Not tested:** IEC 104 / IEC 61850 and the EQT tools (no device). ISS-076–079. | | pyTOOLS (new) | P40 new | not started | No skill yet. | | `graphics` | C50, C60, R30 (small) | manual diff read | | | `history-management` | C40 §4.2 (REST API, pyTOOLS) | manual diff read | The REST API itself is described in skill `data-access` (L45 ch. 4); link to it from here. | diff --git a/knowledge/r105-verification.md b/knowledge/r105-verification.md index 28e2bc0..a603f7a 100644 --- a/knowledge/r105-verification.md +++ b/knowledge/r105-verification.md @@ -26,7 +26,9 @@ Close every form with *Cancel*. ## Awaiting user verification -### V1. `eqpdbg` main info (skill `equipment`, L40 summary §3) +### V1. `eqpdbg` main info (skill `equipment`, L40 summary §3): **done 2026-10-08** + +Run by Claude over ssh at the user's request; output as expected (recorded in the L40 summary). On the R1.05 test server, in a normal command prompt: @@ -38,7 +40,10 @@ Type `1` (Get main info), Enter, read the output, then `-1` (Exit). Expected: li the Modbus line(s) attached, scan interval (tick) in ms, number of slaves, line load %. Do not choose any other action number. Send a screenshot of the output. -### V2. Setup check script (skill `installation-security`, task `setup-check.md`) +### V2. Setup check script (skill `installation-security`, task `setup-check.md`): **done 2026-10-08** + +Run by Claude (temporary copy, deleted afterwards): 12 OK, 5 CHECK, 20 DIFF after fixing the +firewall check (see `setup-check.md`). Copy `tools/setup_check.ps1` from this repo to a scratch folder on the server, run it in an **elevated** Windows PowerShell, then delete the copy: @@ -52,7 +57,14 @@ Datacenter shown as not in the list; DIFF for firewall domain profile, Defender, updates, defrag / component cleanup, page file, .NET 3.5, missing `CIX_` groups; CHECK lines for IT security. Send the result table (screenshot or text). -### V3. Engineering Module forms (skill `data-access`) +### V3. Engineering Module forms (skill `data-access`): **form definitions checked 2026-10-08** + +Claude has no GUI access to the server. Checked instead in the installed form definitions +(`tls\wap\cfg`): the main menu has the *OPC UA Information Model Mapper* action (dataset +`UASERVER_MAPPER_DF`); each user in the project tree has *Add API key* (dataset `API_KEYS_DF`); +the OPC UA client point form has `READ_NODE_INFO` and `REBROWSE`; the method form has node ID +type, parent object node ID, manual argument fields and no process-area field. Screenshots of +the open forms are optional. In the Engineering Module on the server (log on as a user with engineering rights), open each form below, take a screenshot, and close it with *Cancel*: diff --git a/tools/setup_check.ps1 b/tools/setup_check.ps1 index b4d10d6..ac45082 100644 --- a/tools/setup_check.ps1 +++ b/tools/setup_check.ps1 @@ -153,10 +153,16 @@ foreach ($p in (Get-NetFirewallProfile -ErrorAction SilentlyContinue)) { $ports = @{ 'TCP 8080' = 8080; 'TCP 8443' = 8443; 'UDP 17001' = 17001; 'UDP 17101' = 17101; 'UDP 18002' = 18002 } # R1.05: RESTful API web server (jrstsrv.sup JRST_NETWORK_PORT), IM 36K01C30-01EN 5th ed. Table 3.2-1 if (-not $isR103) { $ports['TCP 34597'] = 34597 } -$allow = Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue +# A rule counts when it names the port, or allows any port without being limited to one program +# (Windows' own "any port" rules such as Remote Desktop Shadow are program-limited and do not count). +$allow = foreach ($r in (Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue)) { + $pf = $r | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue + $af = $r | Get-NetFirewallApplicationFilter -ErrorAction SilentlyContinue + [pscustomobject]@{ Protocol = $pf.Protocol; LocalPort = @($pf.LocalPort); AnyProgram = ($af.Program -eq 'Any' -and $af.Package -in @($null, '', 'Any')) } +} foreach ($name in $ports.Keys) { $proto, $num = $name.Split(' ') - $hit = $allow | Where-Object { $_.Protocol -eq $proto -and ($_.LocalPort -contains "$num" -or $_.LocalPort -contains 'Any') } + $hit = $allow | Where-Object { $_.Protocol -eq $proto -and ($_.LocalPort -contains "$num" -or ($_.LocalPort -contains 'Any' -and $_.AnyProgram)) } Add-Result 'Firewall' "Inbound $name allowed" 'yes (web / secure web / DURM / SMDMON / RESTful API)' $(if ($hit) { 'yes' } else { 'no rule found' }) ([bool]$hit) }