Files
UA-.NETStandard/samples/Robotics
Marc Schier 2836da7ec8 Fix sessionless ResultTransfer ownership bypass and other issues. (#4834)
# Description

Correct ownership, endpoint validation, policy propagation, subscription
delivery, file handling and generated-model behavior across the stack,
tools and samples. Add focused regression tests and update the
corresponding guides and sample documentation.

### Previously included corrections

- Require an active, matching session to generate or access transient
ResultTransfer file handles. Cover both sessionless generation and reads
against a handle owned by an active session, using live session owners
in the Machinery tests.
- Keep physical filesystem operations within their configured mount and
apply the same confinement checks throughout file operations.
- Validate LDS semaphore paths consistently during server registration
and registration-store maintenance.

### Individual issues addressed

| # | Component | Issue and correction |
|---|---|---|
| 1 | AI jobs and transfers | Jobs and transfers did not consistently
retain their creator's identity and session. Apply ownership checks to
descendants, file handles, subscriptions and execution, and recheck
deployment permissions before dispatch. |
| 2 | Password-management client | Password-bearing calls could use
signing-only channels or follow a replacement connection. Capture an
encrypted transport generation and keep dispatch bound to it; preserve
ordinary non-password edits. |
| 3 | GDS and certificate-push clients | Connections omitted hostname
verification. Validate the original configured DNS name or IP address
before session activation. |
| 4 | Certificate push | Private-key uploads could use signing-only
calls. Require an encrypted, generation-bound dispatch while preserving
certificate-only updates and restoring the caller's identity afterward.
|
| 5 | MQTT client | The .NET Framework custom-trust callback could
discard TLS hostname, certificate-availability and usage errors. Retain
those checks while supporting configured issuer trust. |
| 6 | DTLS handshake | Certificate trust was not tied to the configured
peer address. Match the certificate's DNS or IP identity to the intended
endpoint. |
| 7 | Replicated address spaces | Serialized nodes lost per-node and
descendant permission metadata. Preserve role permissions, user-role
permissions and access restrictions, including updates to existing
replica nodes. |
| 8 | MCP PubSub imports | Imports without groups skipped checks on the
effective broker destination. Check the actual endpoint before resolving
credentials or activating the connection. |
| 9 | Reference-server accounts | A disabled username account could
authenticate again with its previous roles. Reject disabled accounts
during fresh authentication. |
| 10 | Console reference client | The sample disabled hostname checks
when connecting to an otherwise trusted peer. Retain the original
requested host and validate it before activation. |
| 11 | Capture replay and export | Replay and raw export could accept
non-capture files or include key material. Require complete PCAP/PCAPNG
containers and exclude key sidecars and decryption-secret blocks. |
| 12 | PubSub adapter fallback | The fallback client configuration
automatically accepted peer certificates. Apply normal trust and
hostname validation before activation or reads. |
| 13 | Kafka transport | Explicit TLS enablement was checked but did not
reach both final Confluent configurations. Use the same effective
protocol for validation, producers and consumers. |
| 14 | PubSub actions | Configuration rebuilds could widen a
connection-local action handler's scope. Preserve its original
connection association and reject mismatched dispatch. |
| 15 | PubSub readers | Reader-level message-protection settings were
accepted but ignored. Apply the effective group and reader settings
before accepting and publishing received values. |
| 16 | PubSub key groups | Different `SecurityGroupId` values could
share one connection-wide key context. Reject mixed groups on a
connection and require separate connections for distinct groups. |
| 17 | MCP session registrations | Session-name replacement or reuse
could retain another registration's credential bindings. Bind access to
the registration, caller and authenticated endpoint, and preserve that
identity when borrowing sessions. |
| 18 | Viewer HTTP host | Requests reached the viewer's OPC UA session
without consistent Host, Origin and port checks. Validate the request
destination and browser origin before using the session, while retaining
supported local MCP clients. |
| 19 | Vision file operations | File operations did not consistently
apply protected-file checks, and remote handles lacked caller and
connection context. Apply the shared checks and use host-side opaque
handles bound to caller, target and generation. |
| 20 | DTLS record integrity | The integrity-only MAC used a truncated
sequence number. Authenticate the full reconstructed sequence number and
epoch so records remain distinct across rollover. |
| 21 | AMB client sample | Connection setup omitted hostname validation.
Preserve the originally requested host and verify the peer identity
before activation. |
| 22 | Robot sample writes | The R2 `SpeedOverride` callback could
target R1 state. Bind each callback to its own robot and apply that
robot's write policy. |
| 23 | AI result properties | Optional result children inherited
remotely writable defaults. Preserve their declaration restrictions and
keep server-produced results read-only. |
| 24 | WSS peer-trust updates | Existing channels did not consistently
respond to peer-trust changes. Revalidate complete chains for forward
and reverse WSS channels and close only those that no longer validate. |
| 25 | GDS revocation checks | Caller-provided certificates could cause
issuer retrieval from embedded URLs. Resolve validation from configured
local trust, issuers and CRLs without fetching caller-provided
locations. |
| 26 | GMS observations | Published correction observations retained
writable model defaults. Reject remote writes while preserving
publisher-side updates. |
| 27 | Production-dataset monitoring | Subscription admission and
delivery could use the reporter's context instead of each subscriber's
permissions. Evaluate the subscriber at admission and on every delivery,
including cancellation and disposal paths. |
| 28 | WoT MQTT destinations | Hostless MQTT forms could imply a
localhost destination before loopback checks. Reject them before
credential lookup or connection attempts and validate the effective
endpoint. |
| 29 | XRegistry opaque reads | Content-ID reads and notifications did
not consistently honor encrypted-read requirements or the currently
accepted transport. Recheck the bound endpoint and reject transport
downgrades before rebinding, including when protected values are already
queued. |
| 30 | PubSub capture dissection | Key loading did not consistently
check the configured capture-root boundary. Check each actual key path
immediately before opening it. |
| 31 | PubSub publication queues | Imported WriterGroup queues were not
fully checked against publish-topic grants. Check the destination
actually used by each group. |
| 32 | MCP PubSub mutations | A caller-supplied mode could select
subscribe grants for an operation that publishes. Derive the required
direction and parent context from the actual mutation. |
| 33 | Generated write masks | Model import and generation could widen
an explicit `UserWriteMask`. Preserve it through import, copy, merge,
inheritance and dependency metadata. |
| 34 | Generated method flags | An explicit `UserExecutable=false` could
be lost. Preserve its specified state and resulting method behavior
through the same model paths. |
| 35 | Generated role identifiers | Unresolved role identifiers could
cause permission entries to be omitted. Preserve namespace-qualified
role IDs and report a diagnostic when a policy cannot be represented. |
| 36 | Aggregation-server defaults | The `localhost` default did not
reliably constrain listener binding. Use numeric loopback for the
default endpoint and command-line fallback. |
| 37 | Certificate-validation cache | Cached results could skip current
leaf or issuer validity checks. Recheck validity windows on cache hits
and keep hostname validation independent of cached chain trust. |
| 38 | Software-update folders | Revision names and marker contents
containing dot segments could select paths outside the software root.
Normalize and check every derived path against that root. |
| 39 | USDA arrays | Array elements were not encoded for their string or
asset context. Escape them as data and preserve valid composition and
round-trip behavior. |
| 40 | Adapter hot reload | A changed dataset definition with the same
name could keep old fields, subscriptions or cached values active.
Compare complete immutable definitions and retire old state before
replacement. |
| 41 | Adapter index ranges | Subscription publication could ignore
`IndexRange` and return the complete value. Preserve the requested
projection and its status and timestamps; reject unsupported range
providers. |
| 42 | PubSub metadata and targets | Metadata from one connection could
change another connection's target mapping. Scope metadata to its
connection and provenance, and resolve targets using actual typed field
IDs rather than field names or unintended positional fallback. |
| 43 | Scales product locks | Product locks were not applied across
every remote mutation path. Apply them consistently to value writes,
filling calculations and related recipe/controller operations while
retaining permitted updates. |
| 44 | Event permission caching | Cached event decisions could outlive
identity, role or node-policy changes. Revalidate the current
subscriber, event type and source permissions instead of reusing a stale
decision. |
| 45 | WoT Modbus destinations | Hostless Modbus forms could imply
localhost before loopback checks. Reject them before connecting and
validate the effective endpoint. |
| 46 | MCP local PKI tools | Peer-trust mutations did not consistently
require the caller's `CertificateAdministration` grant. Check the
capability before trust and untrust operations. |
| 47 | Robot-control HTTP bridge | The bridge lacked consistent Host,
Origin and port validation and caller-specific session grants. Apply
those checks before borrowing the OPC UA session and retain supported
local clients. |
| 48 | Subscription transfers | Transferred subscriptions could retain
cached notifications after the destination's permissions changed.
Require authorization continuity between source and destination
identities and roles, invalidate stale retransmission data when
continuity fails, and preserve retransmission behavior for compatible
transfers. |

### Compatibility notes

- Replication uses the versioned NSRP v1 policy envelope. Upgrade peers
together and re-encode or reseed legacy topology from the authoritative
model; missing permission metadata is not inferred from old records.
- Integrity-only DTLS peers must be upgraded together for the full
sequence/epoch MAC. AEAD behavior is unchanged.
- Distinct PubSub key groups require separate connections.
- Custom sessions that cannot capture the actual encrypted transport,
and subscription providers that cannot honor a requested range, are
rejected rather than silently changing the requested behavior.
- Subscription transfers retain retransmission data only when the
destination authorization remains compatible with the source snapshot;
otherwise the old sequence numbers and cached data are invalidated.

## Related Issues

No separate tracking issue is linked. The individual corrections are
listed above.

## Checklist

_Put an `x` in the boxes that apply. You can complete these step by step
after opening the PR._

- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [ ] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.
2026-10-21 05:37:29 +02:00
..

Robotics samples

Three runnable samples covering the two robotics companion models this stack implements: OPC 40010 Robotics, which describes a robot, and the draft OPC UA — Robot Intent, which commands one.

Sample What it is What it shows
MinimalRobotServer A server for a two-robot cell OPC 40010 topology, RSL/GPOS positioning, and an OpenUSD representation of the whole cell
IntentEnabledRobot A server for one collaborative arm The Robot Intent command surface end to end, plus an OpenUSD representation you can drive
IntentViewerClient A client with a 3-D viewport Clicking a target in the OpenUSD viewport and watching the arm execute the intent

All three are non-production demonstration code. --insecure in the command lines below means an unsecured endpoint with blanket certificate acceptance; it exists so the samples start without a PKI dance and must never be used anywhere real.

MinimalRobotServer

A self-contained server exposing a robot cell: two KUKA-style six-axis arms on mobile platforms, their axes, power trains and safety states modelled per OPC 40010, their positions modelled per OPC 10000-210 RSL and OPC 10000-211 GPOS, and the whole thing published as an OpenUSD representation whose assets the server serves over the Part 5 FileType.

dotnet run --project samples/Robotics/MinimalRobotServer -- --host localhost --port 62830

Then render it live with the connector tool:

dotnet run --project tools/Opc.Ua.OpenUsd.Connector -- `
    --server opc.tcp://localhost:62830/MinimalRobotServer `
    --fetch-assets ./stage --insecure --view

See MinimalRobotServer/README.md for the full walkthrough, the address-space layout and the USD binding contract.

IntentEnabledRobot

One stationary UR5e-style collaborative arm with an offset wrist — deliberately a different kinematic family from the cell sample's arms — on a workbench with four target locations.

Where MinimalRobotServer shows you what a robot is, this shows you how to ask it to do something: the server declares an IntentControllerType with its capabilities, frames, tool centre point, locations, axes, outputs, kinematic description and safety state, and executes submitted intents against a simulated motion kernel with real kinematics. Every intent is tracked on a Part 10 program instance, so a motion that takes a minute outlives the Call that started it.

dotnet run --project samples/Robotics/IntentEnabledRobot -- --host localhost --port 62840

IntentViewerClient

The reason the intent surface exists, made visible. The client connects, discovers Server/RobotIntent/Controllers, reads the controller's capabilities, opens the OpenUSD viewport on the served stage, and streams live joint and tool-centre-point values into the picture. Click one of the four target pucks on the bench and the client submits a linear-move intent to that location, then tracks the resulting IntentOperation to a terminal state while the arm animates on screen.

Start the server first, then:

dotnet run --project samples/Robotics/IntentViewerClient -- `
    --server opc.tcp://localhost:62840/IntentEnabledRobot `
    --insecure --view

It also runs headless, which is how it is exercised in CI and how it works on a machine without the native OpenUSD payload:

dotnet run --project samples/Robotics/IntentViewerClient -- `
    --server opc.tcp://localhost:62840/IntentEnabledRobot --insecure

In headless mode the four targets are offered as a console menu instead of as prims to click, and everything downstream of the pick — submission, tracking, cancellation, command authority — is identical.

Agent-driven pallet stacking

IntentViewerClient --mcp is the agent entry point for the intent sample. Start IntentEnabledRobot, then run the viewer with MCP over stdio for a headless agent or over HTTP when the OpenUSD viewport is open. The agent and the human viewer share the same OPC UA SampleSession, so MCP calls, operation monitoring, payload outputs and OpenUSD live bindings all describe the same robot.

A well-behaved agent starts with discovery, not motion:

  1. robotics_list_controllers
  2. robotics_read_controller to inspect SupportedIntents, SupportedFacets, frames, tools, locations and outputs
  3. robotics_read_state to verify Ready, mode, safety and current command owner
  4. robotics_request_control before any command

The pallet demonstration deliberately proves refusal handling before the successful plan. Another session holds command authority, the agent submits a move, receives Accepted=false with Failure=ControlNotOwned, reads the enum and message, releases or waits for the owner, requests authority itself, and only then replans. It must not retry the refused submission blindly.

The stacking plan uses the published model seam. Parts begin under /World/Payloads/BinParts, the held part is driven by HeldPartPosition and HeldPartVisible, and completed slots are driven by PayloadSlotNNFilled. The viewer and connector do not contain pallet logic; they just render the server-published bindings. The agent can pick from Bin, move the held part to row/layer coordinates near Fixture, place it, then submit a mission that repeats the sequence for the next slot.

Agents must not assume:

  • command authority is implicit;
  • a supported tool means the controller supports every intent kind;
  • SupportedIntents, SupportedFacets, safety state or queue depth can be skipped;
  • a refusal should be retried without changing the plan;
  • a submitted operation is done until robotics_wait_operation or controller state says so.

How a click becomes an intent

The viewport is rendered by the optional Opc.Ua.OpenUsd.Connector.Viewer assembly. A pick becomes an intent the same way whichever path resolves it: the viewer raises UsdViewOptions.PrimPicked, and the client maps that prim path to the LocationType node the server published under the controller's Locations folder, builds an intent naming that location, and submits it.

UsdViewOptions.PickMode selects how the pick is resolved:

Mode Behaviour
Auto (default) Renderer-backed pointer picking first, falling back to the command prim only when renderer picking is unavailable
Renderer Renderer-backed pointer picking only
CommandPrim Watch UsdViewOptions.CommandPrimPath (default /World/IntentCommand) and raise the callback when its targetPrim changes

Renderer-backed picking works: the OpenUSD viewer owns input handling, DPI scaling, physical-pixel conversion and stale-revision retry, and reports hits through the host callback. Misses do not submit intents. The gaps this used to work around were filed as marcschier/openusd-dotnet issues #1, #5, #8, #9, #10 and #11, and all are fixed in the package version this sample ships against. The command-prim path remains supported, and is what makes picking work headlessly — which is also how an MCP agent drives the same robot.

Prerequisites

  • .NET SDK 10.0.
  • The --view option needs the optional viewer assembly and its native OpenUSD payload, which is supported on win-x64, linux-x64, and osx-arm64. A RID-less build or publish on a supported host uses that host's payload; publish with an explicit RID for another platform. Everything else, including both servers and the headless client, runs on every platform the stack supports.

See also