get_ip_restrict.read: SSH parse remainder (rules row/prefix; timeout cleared)

[AdamRickards]

SSH remainder (split from #48)

Parent: #48 — call-timeout intention cleared under post-#215 budgets + #216 ladder (main 1609c36).

Live: mops/snmp/ssh all status=ok. SSH cli lists both declared shows.

Remain: SSH rules shape wrong vs mops/snmp (extra/phantom row; prefix_length disagree). Not a timeout leftover.

Route: Schema/SSH overlay parse (not #92 hang).

Do not paste device identity or rule addresses on public comments.

[AdamRickards]

Architect triage

Loop: schema / SSH overlay (live YAML) — not hang #92
Protocols: ssh
Orders:

• Schema clerk — confirm-only: for get_ip_restrict, is SSH overlay/YAML missing, wrong wire, or wrong join (CLI parse vs declared shows)? Prefer existing schema/wire tools; no implement unless ordered. MIB + CLI JSON. Trail on this issue.
• 1.17 clerk — confirm-only: labeled ssh differential vs napalm-hios v1.17 for get_ip_restrict (same-wire or diff). Own venv only; never 2.0 shim. No fix. Trail on this issue.
• Test bot — skip — live receipt already on body/parents

Leftover: SSH rules shape / prefix_length vs mops/snmp (phantom row); timeout cleared
Named proof (later): POST {"name":"get_ip_restrict.read","trace":true} — SSH status=ok with field leaving default or honest empty+raw; do not treat 2-of-3 as green.
Rails: no --gate; no device identity on public comments; one SSH ticket per leftover.

[AdamRickards]

Decision trail (1.17 clerk — SSH confirm)

Flow: source review only (no live SSH/SNMP/MOPS). Compare napalm-hios-1.17 get_ip_restrict vs crude-engine schema + SSH overlay.

Ruled out: hang/#92 (timeout already cleared on body). Not a missing getter. Not a protocol pick. Not extra/missing show commands.

Tool: 1.17 tree (napalm_hios/version.py = 1.17.0) + crude_engine/schemas/ip_restrict.yaml + crude_engine/wire/ssh/mgmtaccess.yaml. No live.

1.17 SSH (napalm_hios/ssh_hios.py:4752):

• CLI: show network management access global → parse_dot_keys; enabled prefers field Restricted management access then Operation; logging from field Logging.
• CLI: show network management access rules → _parse_rma_rules (4776): after --- header, one row per line; index = col 0; ip / prefix_length from col 1 IP/Mask / split; service flags from remaining columns; interface / per_rule_logging / log_counter hardcoded empty / false / 0.

YAML overlay (wire/ssh/mgmtaccess.yaml):

• Same two shows: hm2rmaoperation field Operation; rules via paired_rows (hm2rmaindex col 0, hm2rmaipaddr col 1, hm2rmaprefixlength line: 1, column: 0).
• Service attrs write-only (no SSH read).
• hm2rmaloggingglobal / hm2rmainterface / hm2rmalogging / hm2rmaipaddrtype have no SSH read (exempted).

Verdict: differential (parser + missing SSH reads). Same two CLIs, but overlay paired_rows takes prefix from record line 1 col 0 (no / split on IP/Mask) vs 1.17 single-line IP/Mask split — matches leftover phantom-row / prefix_length shape. Overlay also omits SSH reads 1.17 takes from the same global/rules shows (Logging + service columns).

Leftover: rules row/prefix parse (not timeout). Not green until overlay parse matches 1.17 _parse_rma_rules or named proof says otherwise.

[AdamRickards]

Schema clerk — confirm-only triage

Flow: confirm-only triage (no implement)

Symptom (ssh): status=ok; rules shape / phantom row; prefix_length disagree vs other protocols. Timeout cleared. Protocols: ssh only.

Declared SSH vs CLI.json:

• show network management access global — HIT
• show network management access rules — HIT
• Overlay present (wire/ssh/mgmtaccess.yaml: index / ip / prefix_length via paired_rows)

Classification: wrong join — shows HIT and overlay exists; paired_rows line/column for prefix vs index/ip misaligned → phantom row + wrong prefix_length. Not missing overlay; not wrong command spelling.

MIB (name only): hm2RmaPrefixLength / hm2RmaIpAddr / hm2RmaIndex (HM2-MGMTACCESS-MIB). Not picking mops/snmp winners.

Later hop (Schema soft): retune existing paired_rows (lines_per_record / line / column) on rules attrs — no new primitive. Park until ordered.

[AdamRickards]

Architect assign — raw-cli ↔ gold ↔ 1.17 trace (HITL review)

Goal: lock bucket before implement — parse/primitives vs wrong wire vs honest SSH gap.

Orders (confirm / capture only — no YAML/engine fix this hop):

1. Test bot — sidecar trace:true named read; post: mops row/key summary (gold-shaped control), snmp one-liner if cheap, SSH cli raw (relevant shows), declared wire shows, current n/parity.
2. Schema — table: gold/MOPS field → present in raw cli? → declared SSH source → 1.17 ask (from 1.17 trail). Bucket: wrong join / wrong show / overlay missing / honest gap.
3. 1.17 — ssh-only: commands + shape vs crude declared; same-wire or differential (refresh if stale).

No 2-of-3 invent. No --gate. No device identity on GitHub. HITL will review the three trails together.

[AdamRickards]

Decision trail (1.17 clerk — HITL gold-pack SSH)

1. 1.17 shows used — show network management access global; show network management access rules (napalm_hios/ssh_hios.py:4752–4763).
2. 1.17 row shape — top dict {enabled, logging, rules} (parse_dot_keys on global). rules = list of dicts from _parse_rma_rules (4776): after --- header, one line = one rule; primary field index (col 0); ip/prefix_length from col 1 IP/Mask / split; service flags from remaining cols; interface/per_rule_logging/log_counter hardcoded.
3. Crude declared SSH — same two shows (wire/ssh/mgmtaccess.yaml): hm2rmaoperation field Operation; rules via paired_rows (hm2rmaindex col 0, hm2rmaipaddr col 1, hm2rmaprefixlength line:1 col:0). Service attrs write-only. No SSH read for Logging / per-rule services.
4. Crude row shape — schema get_ip_restrict dict defaults; rules sub_table primary_key: index (dict keyed by index, not list). Overlay paired_rows expects multi-line records; no / split on IP/Mask.
5. Verdict: differential — same two CLIs; rules parse (paired_rows line-1 prefix vs 1.17 single-line / split) + missing SSH reads for logging/services → phantom-row / prefix_length leftover.
6. Gold note: Test raw cli not yet on issue — align when Test raw cli lands. Expect command list only: show network management access global, show network management access rules.

[AdamRickards]

Raw-cli ↔ gold MOPS ↔ 1.17 capture (Test, main d6b7876)

Confirm/capture only — no implement.

1) MOPS control

• n keys: enabled, logging, rules (top-level 3)
• enabled=False, logging=False
• rules n=1 sample (ips redacted): {"2": {"ip": "<ip>", "prefix_length": 24, "http": true, "https": true, "snmp": true, "telnet": true, "ssh": true, "iec61850": true, "modbus": true, "ethernet_ip": true, "profinet": true, "per_rule_logging": false}}

2) SNMP

• status=ok phase=None open_ms=799 call_ms=5627 n=3 err=None

3) SSH cli raw

show network management access global

Restricted management access settings
-------------------------------------
Operation...................................disabled

show network management access rules

ID  IP address       HTTP   SNMP  SSH     IEC61850   EtherNet/IP  Active
    Prefix           HTTPS        Telnet  ModbusTCP  PROFINET           
--  ---------------  -----  ----  ------  ---------  -----------  ------
 2  <ip>      yes    yes   yes     yes        yes          [x]   

    24               yes          yes     yes        yes

(empty command entry)

4) Declared SSH shows vs ran

• Declared (read shows): ['show network management access global', 'show network management access rules']
• Ran: ['show network management access global', 'show network management access rules']
• Match on both shows; empty-string cli entry also present.

5) parity_diffs / n

• mops/snmp/ssh top-level n=3
• parity: ['rules.row count: mops=1 vs ssh=2', "rules.ssh-only rows: ['24']", 'rules.[2].prefix_length: mops=24 vs ssh=0', 'rules.row count: snmp=1 vs ssh=2', "rules.ssh-only rows: ['24']", 'rules.[2].prefix_length: snmp=24 vs ssh=0']

No device identity on this trail.

[AdamRickards]

Schema HITL review pack (confirm-only)

Sources: issue cli + 1.17 trail on-issue (Test raw not yet refreshed).

Method: get_ip_restrict · ssh-labeled · gold = schema defaults (ip_restrict.yaml) · wire mgmtaccess · MIB+CLI.json HIT on both shows.

gold/MOPS field	in raw SSH cli?	declared crude SSH source	1.17 ask (from 1.17 trail)
enabled	unknown (snippet) — issue lists show network management access global	hm2rmaoperation ← show network management access global field Operation	enabled→show network management access global / Restricted management access (fallback Operation)
logging	unknown (snippet)	no SSH read (hm2rmaloggingglobal exempted)	logging→same/Logging
rules (sub_table)	unknown (snippet) — issue lists show … rules	overlay via paired_rows on rules show	rules table via _parse_rma_rules
rules[].index	unknown (snippet)	hm2rmaindex ← rules paired_rows col 0	rules[].index→show … rules col0
rules[].ip	unknown (snippet)	hm2rmaipaddr ← rules paired_rows col 1	rules[].ip+prefix_length→col1 IP/Mask split /
rules[].prefix_length	unknown (snippet) — leftover: disagree / phantom row	hm2rmaprefixlength ← rules paired_rows line:1 col:0	rules[].ip+prefix_length→col1 IP/Mask split /
rules[].http / https / snmp / telnet / ssh / iec61850 / modbus / ethernet_ip / profinet	unknown (snippet)	write-only (no SSH read)	rules[].services.*→cols 2+
rules[].per_rule_logging	unknown (snippet)	no SSH read	1.17 hardcodes false

Bucket: wrong join

[AdamRickards]

Schema HITL review pack (confirm-only) — refreshed

Sources: Test raw receipt (main d6b7876) + 1.17 ask (on-issue / steering).

Method: get_ip_restrict · ssh-labeled · gold = schema defaults · wire mgmtaccess · MIB+CLI.json. Test parity: ssh rules n=2 (phantom 24) / prefix_length 0 vs mops n=1 / 24.

gold/MOPS field	in raw SSH cli?	declared crude SSH source	1.17 ask (from 1.17 trail)
enabled	yes — global Operation...................................disabled (header: Restricted management access settings)	hm2rmaoperation ← show network management access global field Operation	enabled→show network management access global / Restricted management access (fallback Operation)
logging	no — no Logging field in Test global raw	no SSH read (hm2rmaloggingglobal)	logging→same/Logging
rules[].index	yes — rules col0 2	hm2rmaindex ← rules paired_rows col 0	rules[].index→show … rules col0
rules[].ip	yes — rules IP address col (redacted in Test)	hm2rmaipaddr ← rules paired_rows col 1	rules[].ip+prefix_length→col1 IP/Mask split /
rules[].prefix_length	yes — token 24 on second line under Prefix (not same-line IP/Mask)	hm2rmaprefixlength ← paired_rows line:1 col:0	rules[].ip+prefix_length→col1 IP/Mask split /
rules[].http / https / snmp / telnet / ssh / iec61850 / modbus / ethernet_ip / profinet	yes — service cols yes on line0/line1	write-only (no SSH read)	rules[].services.*→cols 2+
rules[].per_rule_logging	no	no SSH read	1.17 hardcodes false

Bucket: wrong join

[AdamRickards]

Test — Σ Execute pack WHERE (main 3106a94)

Named proof: sidecar get_ip_restrict.read trace:true vs MOPS floor.

proto	status	n	cli
mops	ok	3	—
ssh	ok	3	show network management access global, show network management access rules

Bucket: close-format. phantom rule row; prefix_length shape miss. Timeout cleared. No invent. No #92.

[AdamRickards]

Schema — Rank1 classify pass (Σ Resolve 2026-09-25)

• Flow: Rank1 classify → SOFT (retune the existing paired_rows lines_per_record, as the confirm-only triage predicted).
• Ruled out: Engine / new parser (the IP/Mask split isn't needed, because Prefix sits on line1 on this firmware); invented floors; extra shows.
• Tool: wire/ssh/mgmtaccess.yaml 3× rules reads + lines_per_record: 2. Offline _parse_paired_rows on the captured layout: index {'2'} only; prefix {'2': '24'}. validate_schemas.py --errors → 0 errors (baseline).
• Receipt (before): ssh rules n=2 (phantom '24'), prefix_length 0, vs mops n=1 / 24.
• PR: schema(#217): SSH get_ip_restrict rules paired_rows lines_per_record 2 #380 · tip 22b597d
• Green / leftover: row count and prefix_length should match (Test proves). Leftover: per-rule service flags and logging still have no SSH read. The service columns are in raw and could be a later soft; logging isn't in the global raw.

Proof: python3 tests/release_matrix.py --inspect --method get_ip_restrict --protocol ssh --trace --device

[AdamRickards]

Architect: #380 merged (phantom row gone). Test re-inspect is GREEN with parity [] on 1/1/1. This stays open because the per-rule service flags and logging still have no SSH read.

[AdamRickards]

Architect: provenance #386 merged (9ee450d), so get_ip_restrict ssh is now pass on the floor. This stays open only for the per-rule service flags and logging, which still have no SSH read.