Files
UA-.NETStandard/samples/Vision/VisualInspectionCell
f6b27025a6 Classify sensitive log parameters with Microsoft.Extensions.Compliance data classification (#4864)
## Proposed changes

Fixes #4857. The stack's log messages wrote network addresses (endpoint,
discovery and reverse connect URLs, host names, IP addresses, ports),
application and user identities, file paths and exception texts as plain
parameters. Applications had no reliable way to keep them out of
general-purpose logs.

This PR replaces the stack's own redaction mechanism with the standard
.NET [data classification and
redaction](https://learn.microsoft.com/dotnet/core/extensions/data-redaction)
packages. Each sensitive `[LoggerMessage]` parameter is classified. The
application decides per classification what reaches its logs: erase it,
replace it with an HMAC token so entries stay correlatable, or pass it
through.

### Taxonomy
`Opc.Ua.Redaction.OpcUaDataClassifications` defines the `OpcUa` taxonomy
and one attribute per classification:

| Classification | Used for | Parameters |
|---|---|---|
| `[NetworkAddress]` | URLs, host and domain names, IP/MAC addresses,
end points, ports | 120 |
| `[ApplicationIdentity]` | certificates, subject, issuer, thumbprint,
ApplicationUri | 103 |
| `[FilePath]` | file, directory and certificate store paths | 67 |
| `[SensitiveText]` | exception or remote-supplied text passed as a
parameter | 55 |
| `[UserIdentity]` | user names, token subjects | 7 |

Correlation ids (`ChannelId`, `SessionId`, ...), status codes and
NodeIds stay unclassified.

### Pipeline and defaults
- Opc.Ua.Core now references
`Microsoft.Extensions.Telemetry(.Abstractions)` 10.11.0, so every
project above Core uses the `Microsoft.Gen.Logging` generator.
Opc.Ua.Client already did, through Http.Resilience. The packages ship
net462 and netstandard2.0 builds, so net48 is supported.
- **A plain `ILoggerFactory` logs `(null)` in place of classified
values.** Classified values are only written by the redaction-aware
logger.
- The new `ILoggingBuilder.EnableOpcUaRedaction()` turns that logger on.
It is `EnableRedaction()` with the discriminator off; otherwise every
unredacted value gets `:ParamName` appended.
`AddOpcUa().AddLogging(...)` and `DefaultTelemetry.Create(...)` call it,
as do the samples, so they log the same information as before until
redactors are registered.
- `services.AddOpcUa()` alone does not change the host's logging.
Generic-host apps call `builder.Logging.EnableOpcUaRedaction()`. This is
documented as a behavior-breaking change in
`docs/migrate/2.0.x/telemetry.md`.

### Obsolete API
`Redact`, `RedactionWrapper<T>`, `IRedactionStrategy`,
`RedactionStrategies` and `SimpleRedactionStrategy` are `[Obsolete]`.
They still work, but the stack no longer uses them.

### Not classified
- The `Exception` passed to a log call. Applications can drop exception
messages with `LoggerEnrichmentOptions.IncludeExceptionMessage`.
- Exception and `ServiceResult` message texts.
- `ServiceResult`/`StatusCode` parameters and logged data values.
- The few log calls whose level is decided at run time.
- `Opc.Ua.Vision.OpenUsd`, which references only Opc.Ua.Types and cannot
see the attributes.

### Generator behavior differences
These are visible to log consumers and to tests:
- `IFormattable` values such as `NodeId` are stored in the structured
state as invariant strings, not as objects.
- The generated log state is a thread-local object that is cleared after
the call.
- Classified values are pooled redactor objects, valid only during the
`Log` call.

Tests that inspected log state after the fact now capture it during the
call. The shared `RecordingLoggerProvider` snapshots classified values.

## Related Issues
- Fixes #4857

## Types of changes
- [ ] Bugfix (non-breaking change which fixes an issue)
- [x] Enhancement (non-breaking change which adds functionality)
- [ ] Test enhancement (non-breaking change to increase test coverage)
- [x] Breaking change (fix or feature that would cause existing
functionality to not work as expected; plain logger factories drop
classified values)
- [x] Documentation Update (if none of the other choices apply)

## Checklist
- [x] I have read the CONTRIBUTING doc.
- [x] I have signed the CLA.
- [x] I ran tests locally with my changes, all passed.
- [x] I fixed all failing tests in the CI pipelines.
- [x] I fixed all introduced issues with CodeQL and LGTM.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added necessary documentation (if appropriate).
- [ ] Any dependent changes have been merged and published in downstream
modules.

## Further comments
New tests:
- `LogClassificationCoverageTests` (Tools.Tests) scans all 104 stack
assemblies and fails if an address, identity or path parameter of a
`[LoggerMessage]` method is unclassified.
- `DataClassificationLoggingTests` (Core.Tests) pins erasing and HMAC
redaction, pass-through, the plain-factory drop, and both stack
defaults.

Local results on net10.0:

| Suite | Passed | Failed |
|---|---|---|
| Core.Tests | 6,489 | 0 |
| Client.Tests | 3,231 | 0 |
| Tools.Tests | 7,210 | 0 |
| PubSub.Tests | 1,536 | 0 |
| Core.Diagnostics.Tests | 571 | 0 |
| Configuration.Tests | 241 | 0 |

- **Server.Tests:** the full run predates the final test fixes and had
12 failures. All 12 were in the fixtures fixed afterwards, which now
pass: RoleStateBinding (45/45) and the FileDirectory and
compatibility-logging fixtures (74/74 in total). The full Core.Tests and
Server.Tests runs were not repeated after those fixes.
- **Builds:** `UA.slnx` builds with 0 errors for net10.0 and net48, and
the whitespace check passes.
- **NativeAOT:** not confirmed locally, because the machine has no C++
linker. A trimmed publish of `Opc.Ua.Aot.Tests` reported no trim or AOT
warnings from the stack, the new packages or the generated logging code;
its only errors come from the TUnit test framework (`FSharp.Core` not
found). The `aot-test` CI job has to confirm the native build.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
2026-10-21 09:47:07 +00:00
..

Visual Inspection Cell

VisualInspectionCell is the server half of the visual-inspection sample. It hosts one address space containing four companion areas:

  • Vision — BracketFixtureCamera, the FixtureImages inline PNG clip endpoint, and BracketInspectionPipeline.
  • AI Model Management — the visual-inspection-primary deployment, a learning job, and the Invoke path used for model provenance.
  • ISA-95 Job Control V2 — an allowlisted inspection order and a rework/reject order.
  • Alarms & Conditions — OperatorDispositionDialog, a DialogConditionType used when a result is not decidable.

The server is intentionally a host for companion composition, not the owner of the production decision loop. The paired VisualInspectionAgent connects as an external orchestrator and drives the cycle with typed clients.

graph TD
    Server["VisualInspectionCell server"]
    Vision["Vision root"]
    Sensor["BracketFixtureCamera<br/>ImageSensorType"]
    Clip["FixtureImages<br/>inline PNG clips"]
    Pipeline["BracketInspectionPipeline<br/>InferencePipelineType"]
    AI["AI Model Management<br/>deployment + learning job"]
    Jobs["ISA-95 Job Control V2<br/>fixed order catalogue"]
    Dialog["OperatorDispositionDialog<br/>DialogConditionType"]

    Server --> Vision
    Vision --> Sensor
    Sensor --> Clip
    Vision --> Pipeline
    Pipeline -->|"Deployment"| AI
    Pipeline -->|"LearningJob"| AI
    Server --> Jobs
    Server --> Dialog

Running

Prerequisites: .NET 10 SDK.

dotnet run --project samples\Vision\VisualInspectionCell\VisualInspectionCell.csproj -- --insecure

The default endpoint is opc.tcp://localhost:62865/VisualInspectionCell. --host <name> and --port <number> configure the endpoint host and port. The anonymous operator role is mapped for the local sample.

--insecure is a demo convenience. It accepts untrusted certificates and must not be used for production systems.

It is also, in practice, required to run the pair on a fresh machine. The flag sets AutoAcceptUntrustedCertificates on the server, and without it the cell rejects the agent's self-signed certificate with BadCertificateUntrusted and the agent fails with BadNotConnected - which reads like a connectivity problem rather than a trust one. Start both halves with --insecure, or trust the agent's certificate in the server's PKI store first.

Startup options

Option Meaning
--host <name> Endpoint host name. Default localhost.
--port <number> Endpoint port. Default 62865.
--inferenceLocation OnServer|EdgeOffServer Selects the advertised Vision inference location. Default OnServer.
--insecure Demo-only certificate convenience.
--pki-root <absolute-path> Use a private certificate-store root instead of the hosting default. Does not enable automatic peer trust.
--run-seconds <1-3600> Stop the hosted server after a bounded run. Omit for the normal interactive lifetime.

For an owned, non-rendering qualification run, select a private PKI root and an unused loopback port, without --insecure:

dotnet run --project samples\Vision\VisualInspectionCell\VisualInspectionCell.csproj -- `
  --host 127.0.0.1 --port 62865 --pki-root D:\owned-vision-run\pki --run-seconds 120

Establish trust explicitly in the client's and server's private peer stores before connecting with SignAndEncrypt. The cell uses checked-in PNG fixtures and an in-process backend; it does not need a camera, media download, renderer or GPU.

Fixtures and measurement

The cell serves three 800 x 600 PNG fixtures from Fixtures/ through the Vision media provider. The camera scale is 10 px/mm, so one pixel is 0.10 mm. That one-pixel pitch is carried as VisionCharacteristicDataType.Uncertainty; it is not invented to force a result.

Fixture Why it exists
bracket-ok.png Bore diameter is 12.00 mm, so the interval [11.90, 12.10] is wholly inside [11.80, 12.20].
bracket-not-ok.png Bore diameter is 12.60 mm, so the interval [12.50, 12.70] is wholly outside the bore tolerance.
bracket-ambiguous.png The intended slot is 8.15 mm, but at 10 px/mm it draws as 81.5 px and can only be represented as 8.10 mm. The interval [8.00, 8.20] straddles the 8.15 mm upper limit.

What the cell publishes

  • BracketFixtureCamera (ImageSensorType) with simulated reality, RGB8, 800 x 600 resolution, 10 px/mm intrinsics, and fixture_table as the frame id.
  • FixtureImages, an inline PNG clip endpoint with endpoint URI opcua-inline://visual-inspection-cell/fixtures.
  • BracketInspectionPipeline, bound to the camera, an AI deployment, a learning job, VisualInspectionInferenceProvider, and VisualInspectionFeedbackSink.
  • A fixed ISA-95 V2 catalogue with VIS-INSP-BRACKET-001 and VIS-REWORK-REJECT-001. InspectionJobControlProvider rejects any other job order id instead of accepting invented payloads.
  • OperatorDispositionDialog, the human-disposition condition the agent uses when the deterministic rule returns NotDecidable.

The fixture clip endpoint and pipeline advertise Ready after their in-process providers are attached. GetClip selects a fixture by its file name or a known published ResultId; RunInference requires an explicit acquisition timestamp for stable result correlation. The sample does not implement continuous inference.

Deliberately not implemented

The sample publishes and counts learning samples, but it does not pretend to retrain a model or promote a candidate. That is the same line taken by the AI Model Management sample: a simulated MLOps loop would mislead readers about the part of the specification a sample cannot honestly demonstrate.