ci-server-engineer/knowledge/r105-verification.md
cliu 9f300bd07b R1.05 V4: test certificates removed, server back to original state
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-08 19:12:13 +11:00

102 lines
6.1 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# R1.05 verification checklist
Two kinds of R1.05 checks are open after the read-only re-check of 2026-10-08:
- **Not tested:** the function is not available on the R1.05 test server, so it cannot be
tested there at all. The content stays "from docs" and is marked **not tested** with the
reason. Nothing to do until a suitable system exists.
- **Awaiting user verification:** Claude could not run the step itself (refused as a remote
command, needs an administrator, needs the GUI). Claude prepared the steps and expected
results below; the user runs them on the server or in the GUI and sends the output or a
screenshot, and Claude records the result in the task file and in `progress.md`.
All steps below are read-only: they open forms or print information and save nothing.
Close every form with *Cancel*.
## Not tested on the R1.05 test server
| Area | Reason | Where marked |
|---|---|---|
| IT Security Tool (version 2.0 / 3.0), `CIX_` groups, `CTM_PROCESS`, LAPS, GPO import | Tool not installed; Windows Server 2025 is not supported by the tool | skill `installation-security`, C10/C30 summaries |
| Vnet/IP drivers, VAGW Bossd | No Vnet/IP card; not supported on Server 2025 | skill `installation-security`, C10 summary |
| Upgrade from R1.03/R1.04 with the automatic configuration merge (`jupgutl`, `-c` argument) | Fresh R1.05 install, no upgrade to observe; an upgrade test needs a separate machine | C10 summary, ISS-086 |
| CI Server with PRM | No PRM | C10 summary, ISS-090 |
| IEC 60870-5-104 and IEC 61850 (EQT managers, report control blocks, `eqtdbg`, `eqtfrcscn`) | No device and no EQT line on the server | skill `equipment`, L40/L41 summaries, ISS-076–079 |
| OPC A&E `OPXAES_DIR_ALM`, OPC UA PubSub, imported information model | Needs another client/server or extra server instances | skill `data-access`, ISS-085 |
## Awaiting user verification
### V1. `eqpdbg` main info (skill `equipment`, L40 summary §3): **done 2026-10-08**
Run by Claude over ssh at the user's request; output as expected (recorded in the L40 summary).
On the R1.05 test server, in a normal command prompt:
```
eqpdbg 0 EQPMDC
```
Type `1` (Get main info), Enter, read the output, then `-1` (Exit). Expected: line type 107,
the Modbus line(s) attached, scan interval (tick) in ms, number of slaves, line load %.
Do not choose any other action number. Send a screenshot of the output.
### V2. Setup check script (skill `installation-security`, task `setup-check.md`): **done 2026-10-08**
Run by Claude (temporary copy, deleted afterwards): 12 OK, 5 CHECK, 20 DIFF after fixing the
firewall check (see `setup-check.md`).
Copy `tools/setup_check.ps1` from this repo to a scratch folder on the server, run it in an
**elevated** Windows PowerShell, then delete the copy:
```
powershell -NoProfile -ExecutionPolicy Bypass -File setup_check.ps1
```
Expected (from the one-by-one checks of 2026-10-08): CI Server 1.05.00 OK; Windows Server 2025
Datacenter shown as not in the list; DIFF for firewall domain profile, Defender, automatic
updates, defrag / component cleanup, page file, .NET 3.5, missing `CIX_` groups; CHECK lines
for IT security. Send the result table (screenshot or text).
### V3. Engineering Module forms (skill `data-access`): **form definitions checked 2026-10-08**
Claude has no GUI access to the server. Checked instead in the installed form definitions
(`tls\wap\cfg`): the main menu has the *OPC UA Information Model Mapper* action (dataset
`UASERVER_MAPPER_DF`); each user in the project tree has *Add API key* (dataset `API_KEYS_DF`);
the OPC UA client point form has `READ_NODE_INFO` and `REBROWSE`; the method form has node ID
type, parent object node ID, manual argument fields and no process-area field. Screenshots of
the open forms are optional.
In the Engineering Module on the server (log on as a user with engineering rights), open each
form below, take a screenshot, and close it with *Cancel*:
1. *Tools › OPC UA Information Model Mapper*: the mapper window opens (shows *New Mapping*).
2. *Authorisation › Users*, any user: the *Add API Key* function exists (do not create a key).
3. An OPC UA client point form (*New* on an OPC UA station is enough to see it, then
*Cancel*): the checkbox *Read additional node information* exists.
4. An OPC UA client method form: fields for node ID type, *Options* tab (parent object node ID)
and *Arguments* tab; no process-area field.
If no OPC UA client line exists on the server, steps 3–4 need one: skip them and say so.
### V4. CI-Eng-Sample on the R1.05 test server: **reduced load tested 2026-10-08**
The user approved a reduced load (no history group, no user `CIENG`, no layouts/displays) that
is removed again afterwards. Scripts: `examples/CI-Eng-Sample/shared/`.
- Load: 0 errors in every step; R1.05 accepts the sample's `@VERSION 1.03.00` files.
- Classes: `DEMO.COUNTER` counts (65 → 68 in 3 s); `TANK1.CALC.VOLUME` = 100 for level 50
(traditional class); `TANK1.JFLOW.sPerMin` = 2 for inflow 120 (Java class); sub-item
`TANK1.LEVEL.MAX` follows the level.
- Modbus loopback (mirror started for the test only): setpoint 1234 → readback 1234,
`PLC1.COMM_OK` = 1; `eqpdbg 0 EQPCIENG` slave info: `CIENG_PLC` ON_SCAN, line GOOD.
- OPC UA loopback: after the two certificate moves done by the user, `UA.COMM_OK` = 1 (status
5), `UA.SRV_STATE` = 0, `UA.LEVEL_COPY` followed `TANK1.LEVEL` (62.5). While the server still
rejected the client, the Boolean status item showed 0 with status 4 (ISS-080).
- Remove: 0 errors. Before/after snapshot: all datasets identical (count and name hash), no
`CIENG*` record left. Left over and cleaned: 34 `dss_*.tmp` files in `tls\lst` (ISS-091),
`OPXCIENG.log`, the temporary sample copy.
- Certificates: the test's files (client own certificate `<host>_OPXCIENG.der/.pem`, the
server certificate trusted in the client store, the client certificate trusted in the
server store) and the `pkiserver\rejected` folder created by the test were deleted with the
user's approval. `OPCUAC_PKI_CERTIFICATES_DF` went back from 3 to 1 record by itself: the
dataset follows the certificate files. The server is back in its original state.