SIENTIAPDE-1973

SIENTIAPDE-1973: Implement per-connector OPC client certificates and remove legacy read engine.
This update overhauls certificate management, transitioning from a single platform certificate to individual client certificates defined in the slot configuration. The CertProvider now downloads certificates from MinIO based on certificate_id, applying dynamic security policies (mode, policy) from the slot. The legacy READ_ENGINE=legacy option and OpcManager have been entirely removed, standardizing on the ServerReader with strict slot v2 enforcement. Write command resolution (ServerConfigResolver) now consistently uses connectors joined with opc_certificates. The CERT_BUCKET environment variable is no longer used.

tests/unit/engines/test_write.py

@@ -7,7 +7,12 @@ from asyncua import ua
 import ingestor.metrics as metrics
 from ingestor.engines.write import WriteEngine
 
-SERVER_CFG = {'url': 'opc.tcp://kepserver:49320', 'server_uri': 'urn:kep', 'use_security': True}
+SERVER_CFG = {
+    'server_id': 'srv1',
+    'url': 'opc.tcp://kepserver:49320',
+    'security': {'mode': 'SignAndEncrypt', 'policy': 'Basic256Sha256'},
+    'certificate': None,
+}
 
 
 def make_resolver(cfg=SERVER_CFG):
@@ -279,7 +284,7 @@ async def test_write_uses_the_resolved_server_connection():
 
     await eng.write(base_cmd())
 
-    eng.servers.resolve.assert_awaited_once_with('srv1', base_cmd())
+    eng.servers.resolve.assert_awaited_once_with('srv1')
     eng.pool.get.assert_awaited_once_with('srv1', SERVER_CFG)
 
 
@@ -310,22 +315,22 @@ async def test_write_server_lookup_failure_records_error():
 
 
 @pytest.mark.asyncio
-async def test_write_without_resolver_uses_the_command_connection():
-    eng = make_engine(servers=None)
+async def test_write_ignores_a_connection_carried_by_the_command():
+    """The server is always resolved by server_id (SIENTIAPDE-1974): connection fields
+    in the command are not an override"""
+    eng = make_engine()
     eng.pool.get.return_value = make_client()
 
-    await eng.write(base_cmd(url='opc.tcp://h:4840', server_uri='urn:h', use_security=True))
+    await eng.write(base_cmd(url='opc.tcp://h:4840'))
 
-    eng.pool.get.assert_awaited_once_with(
-        'srv1', {'url': 'opc.tcp://h:4840', 'use_security': True, 'server_uri': 'urn:h'}
-    )
+    eng.pool.get.assert_awaited_once_with('srv1', SERVER_CFG)
 
 
 @pytest.mark.asyncio
-async def test_write_without_resolver_or_url_is_server_not_found():
+async def test_write_without_resolver_is_server_not_found():
     eng = make_engine(servers=None)
 
-    result = await eng.write(base_cmd())
+    result = await eng.write(base_cmd(url='opc.tcp://h:4840'))
 
     assert result.opc_status_code == 'server_not_found'
     eng.pool.get.assert_not_awaited()