Fork: 0
OpenStack / openstack-caracal-dc-dc
Transfer to URL with SHA Find file
Newer
Older
openstack-caracal-dc-dc / docs / netbox-write-path-findings.md
@JANeumatrix JANeumatrix 17 hours ago 2 KB NetBox write-path residue routed to docs/netbox-write-path-findings.md
Raw Blame History

NetBox write-path findings -- OPEN residue gating the deferred apex write-back

Status: OPEN obligations, routed here 2026-07-23 from the session-ledger retained block (which pointed only at the archived rotation). Gates: the DEFERRED end-of-deployment write-back to the production apex netbox.baldurkeep.com (DOCFIX-195: office1-netbox is the WORKING VR1 apex; the production apex is READ-ONLY reference until then). These findings gate THAT write campaign -- nothing current.

History: six write-path defects found 2026-07-14 by adversarial review. Defects 1-3 and 6 were FIXED the same day (docs/archive/changelogs/changelog-20260714-netbox-write-path-hardening.md: roles-importer preflight covers ARIN + ULA; prefixes-importer preflights every role; fidelity check both-bounds + delta-scope-aware; test fake raises on multi-match like real pynetbox). Full original text: docs/archive/session-ledger-rotated-20260719.md ("OPEN -- NetBox WRITE-PATH BUGS" section).

Open items (do ALL before the first production-apex write)

  1. Same-dumper blind spot (original #4) -- NOT fixed. sandbox-fidelity-check compares two dumps produced by the SAME field list, so any field the dumper omits is invisible on both sides by construction (prefix vrf, tenant, vlan, tags, custom_fields; site tenant/group/facility). Same structural shape as the region-scope bug that once dropped 17 prefixes. Fix direction: widen the dump field list, or add an independent field-coverage assertion.
  2. Duplicate-CIDR collapse (original #5) -- NOT fixed, latent. Prefix-keyed dicts in the seeder and fidelity check collapse duplicate prefixes (NetBox permits them; the importer's own docstring anticipates them vs vr0-dc0). A whole prefix object can vanish under a green check. Latent only because no duplicates exist upstream today. The hardened fake (#6 fix) makes this testable now.
  3. Re-run the fidelity check under the HARDENED version. The sandbox's "proven faithful" verdict (2026-07-14) was produced by the PRE-hardening check that could false-green. Re-run sandbox-fidelity-check.py against office1-netbox before trusting that verdict -- this re-run IS C2 sub-task (i) per DOCFIX-195.
  4. Re-verify the 1-3 fixes at campaign time. The fixes are two-plus stages old; before the production write, re-run their harnesses and re-read the preflight paths against the THEN-current NetBox/pynetbox versions (hard rule: a fix verified in July is not evidence in a later campaign).

Trigger

The next NetBox WRITE campaign of any kind -- above all the deferred netbox.baldurkeep.com merge-back at end-of-deployment. No write campaign starts while items 1-2 are unfixed or 3-4 unrun. (Read-only NetBox use is ungated.)