feat(opcua): implement DataProvider + OperationProvider + FaultProvider; harden plugin

Address all critical and important findings from maintainer review:

Provider migration (#11 critical):
- Implement DataProvider (list_data, read_data, write_data) so standard
  SOVD GET/PUT /{type}/{id}/data endpoints work for PLC entities
- Implement OperationProvider (list_operations, execute_operation) for
  POST /{type}/{id}/operations/{name}
- Implement FaultProvider (list_faults, get_fault, clear_fault) for
  GET/DELETE /{type}/{id}/faults
- Export get_data_provider, get_operation_provider, get_fault_provider
  via extern "C" in opcua_plugin_exports.cpp
- Keep all vendor x-plc-* routes for backward compat + rich PLC data
- MCP tools (sovd_read_data etc.), Web UI, fleet gateway now work on
  PLC entities through standard SOVD paths

Shutdown guard (#13 important):
- Add std::atomic<bool> shutdown_requested_ with exchange(true) pattern
- Destructor calls shutdown() (was = default)
- Callbacks (publish_values, on_alarm_change) check flag before work
- All 4 route handlers + 8 provider methods return 503 when shutdown

Null checks (#14 important):
- All route handlers and provider methods check ctx_ and poller_ at
  entry, returning 503 ERR_SERVICE_UNAVAILABLE if uninitialized

Condition variable sleep (#15 important):
- Replace integer-division sleep loops in opcua_poller with
  std::condition_variable::wait_for so stop() wakes the thread
  immediately and sub-100ms intervals no longer cause CPU spin
- Replace assert(!running_) in set_poll_callback with std::logic_error
  throw that survives Release builds

Small fixes (#21, #22, #25, #26):
- SecurityPolicy=None warning now includes endpoint URL
- FetchContent GIT_TAG pinned to full SHA (122ea4c8) instead of
  mutable v0.16.0 tag
- package.xml: XML comment explaining open62541pp FetchContent + #366
- opcua-plugin.yml: add permissions: contents: read

Rename private fault helpers (avoid name collision with FaultProvider):
- report_fault -> send_report_fault
- clear_fault(fault_code) -> send_clear_fault(fault_code)

Author: mfaferek93

.github/workflows/opcua-plugin.yml

@@ -1,5 +1,8 @@
 name: OPC-UA Plugin Integration
 
+permissions:
+  contents: read
+
 # Runs the OpenPLC-based Docker integration suite for ros2_medkit_opcua.
 # Triggers only when the plugin itself, the gateway plugin/provider API, or
 # ros2_medkit_msgs change. A nightly cron provides a safety net against silent

src/ros2_medkit_plugins/ros2_medkit_opcua/CMakeLists.txt

@@ -48,7 +48,7 @@ include(FetchContent)
 fetchcontent_declare(
   open62541pp
   GIT_REPOSITORY https://github.com/open62541pp/open62541pp.git
-  GIT_TAG v0.16.0
+  GIT_TAG 122ea4c842193918b97fd2f2def4fbecabb33ffe  # v0.16.0 pinned by SHA
   GIT_SUBMODULES_RECURSE ON
 )
 # Build open62541 as part of open62541pp, with -fPIC for shared library

src/ros2_medkit_plugins/ros2_medkit_opcua/include/ros2_medkit_opcua/opcua_plugin.hpp

@@ -21,8 +21,12 @@
 #include <ros2_medkit_gateway/plugins/gateway_plugin.hpp>
 #include <ros2_medkit_gateway/plugins/plugin_context.hpp>
 #include <ros2_medkit_gateway/plugins/plugin_http_types.hpp>
+#include <ros2_medkit_gateway/providers/data_provider.hpp>
+#include <ros2_medkit_gateway/providers/fault_provider.hpp>
 #include <ros2_medkit_gateway/providers/introspection_provider.hpp>
+#include <ros2_medkit_gateway/providers/operation_provider.hpp>
 
+#include <atomic>
 #include <memory>
 #include <string>
 #include <unordered_map>
@@ -36,15 +40,32 @@ namespace ros2_medkit_gateway {
 
 /// OPC-UA Gateway Plugin - bridges OPC-UA PLCs into the SOVD entity tree
 ///
-/// Implements GatewayPlugin (lifecycle, routes) and IntrospectionProvider
-/// (entity discovery from OPC-UA address space).
+/// Implements GatewayPlugin (lifecycle, routes), IntrospectionProvider
+/// (entity discovery from OPC-UA address space), and the typed provider
+/// interfaces (DataProvider, OperationProvider, FaultProvider) so that
+/// standard SOVD endpoints (/data, /operations, /faults) work for PLC
+/// entities alongside the vendor x-plc-* extensions.
 ///
-/// Vendor REST endpoints:
+/// Standard SOVD endpoints (via provider interfaces):
+///   GET  /{type}/{id}/data                    - DataProvider::list_data
+///   GET  /{type}/{id}/data/{name}             - DataProvider::read_data
+///   PUT  /{type}/{id}/data/{name}             - DataProvider::write_data
+///   GET  /{type}/{id}/operations              - OperationProvider::list_operations
+///   POST /{type}/{id}/operations/{name}       - OperationProvider::execute_operation
+///   GET  /{type}/{id}/faults                  - FaultProvider::list_faults
+///   GET  /{type}/{id}/faults/{code}           - FaultProvider::get_fault
+///   DELETE /{type}/{id}/faults/{code}         - FaultProvider::clear_fault
+///
+/// Vendor REST extensions (via get_routes):
 ///   GET  /apps/{id}/x-plc-data          - All OPC-UA values for entity
 ///   GET  /apps/{id}/x-plc-data/{node}   - Single node value
 ///   POST /apps/{id}/x-plc-operations/{op} - Write value to PLC
 ///   GET  /components/{id}/x-plc-status  - Connection state and stats
-class OpcuaPlugin : public ros2_medkit_gateway::GatewayPlugin, public ros2_medkit_gateway::IntrospectionProvider {
+class OpcuaPlugin : public ros2_medkit_gateway::GatewayPlugin,
+                    public ros2_medkit_gateway::IntrospectionProvider,
+                    public ros2_medkit_gateway::DataProvider,
+                    public ros2_medkit_gateway::OperationProvider,
+                    public ros2_medkit_gateway::FaultProvider {
  public:
   OpcuaPlugin();
   ~OpcuaPlugin() override;
@@ -61,6 +82,26 @@ class OpcuaPlugin : public ros2_medkit_gateway::GatewayPlugin, public ros2_medki
   // -- IntrospectionProvider interface --
   ros2_medkit_gateway::IntrospectionResult introspect(const ros2_medkit_gateway::IntrospectionInput & input) override;
 
+  // -- DataProvider interface --
+  tl::expected<nlohmann::json, DataProviderErrorInfo> list_data(const std::string & entity_id) override;
+  tl::expected<nlohmann::json, DataProviderErrorInfo> read_data(const std::string & entity_id,
+                                                                const std::string & resource_name) override;
+  tl::expected<nlohmann::json, DataProviderErrorInfo>
+  write_data(const std::string & entity_id, const std::string & resource_name, const nlohmann::json & value) override;
+
+  // -- OperationProvider interface --
+  tl::expected<nlohmann::json, OperationProviderErrorInfo> list_operations(const std::string & entity_id) override;
+  tl::expected<nlohmann::json, OperationProviderErrorInfo>
+  execute_operation(const std::string & entity_id, const std::string & operation_name,
+                    const nlohmann::json & parameters) override;
+
+  // -- FaultProvider interface --
+  tl::expected<nlohmann::json, FaultProviderErrorInfo> list_faults(const std::string & entity_id) override;
+  tl::expected<nlohmann::json, FaultProviderErrorInfo> get_fault(const std::string & entity_id,
+                                                                 const std::string & fault_code) override;
+  tl::expected<nlohmann::json, FaultProviderErrorInfo> clear_fault(const std::string & entity_id,
+                                                                   const std::string & fault_code) override;
+
  private:
   // Route handlers
   void handle_plc_data(const ros2_medkit_gateway::PluginRequest & req, ros2_medkit_gateway::PluginResponse & res);
@@ -72,17 +113,18 @@ class OpcuaPlugin : public ros2_medkit_gateway::GatewayPlugin, public ros2_medki
   // Alarm -> Fault bridge
   void on_alarm_change(const std::string & fault_code, const AlarmConfig & config, bool active);
 
-  // Report/clear fault via ROS 2 service
-  void report_fault(const std::string & entity_id, const std::string & fault_code, const std::string & severity_str,
-                    const std::string & message);
-  void clear_fault(const std::string & fault_code);
+  // Report/clear fault via ROS 2 service (private helpers, not the FaultProvider overrides)
+  void send_report_fault(const std::string & entity_id, const std::string & fault_code,
+                         const std::string & severity_str, const std::string & message);
+  void send_clear_fault(const std::string & fault_code);
 
   // Publish PLC values to ROS 2 topics (called after each poll)
   void publish_values(const PollSnapshot & snap);
 
   // Build JSON response for data endpoint
   nlohmann::json build_data_response(const std::string & entity_id) const;
 
+  std::atomic<bool> shutdown_requested_{false};
   ros2_medkit_gateway::PluginContext * ctx_{nullptr};
   OpcuaClientConfig client_config_;
   PollerConfig poller_config_;

src/ros2_medkit_plugins/ros2_medkit_opcua/include/ros2_medkit_opcua/opcua_poller.hpp

@@ -19,6 +19,7 @@
 
 #include <atomic>
 #include <chrono>
+#include <condition_variable>
 #include <functional>
 #include <memory>
 #include <mutex>
@@ -100,6 +101,9 @@ class OpcuaPoller {
   std::atomic<bool> running_{false};
   std::atomic<bool> using_subscriptions_{false};
 
+  std::mutex stop_mutex_;
+  std::condition_variable stop_cv_;
+
   mutable std::mutex snapshot_mutex_;
   PollSnapshot snapshot_;
 

src/ros2_medkit_plugins/ros2_medkit_opcua/package.xml

@@ -22,6 +22,11 @@
   <depend>yaml_cpp_vendor</depend>
   <depend>libssl-dev</depend>
 
+  <!-- open62541pp (OPC-UA C++ wrapper, MPLv2) is pulled via FetchContent at
+       build time. Not declared as a rosdep dependency because it has no apt
+       package. See https://github.com/selfpatch/ros2_medkit/issues/366 for
+       vendoring follow-up before rosdistro release. -->
+
   <test_depend>ament_lint_auto</test_depend>
   <test_depend>ament_lint_common</test_depend>
   <test_depend>ament_cmake_clang_format</test_depend>