get_snmp_config.read: SSH close-format (community_access empty vs MOPS)

[AdamRickards]

SSH remainder (Σ Execute pack 2026-09-22)

Method: get_snmp_config · gold MOPS floor · main 3106a94

Receipt: ssh status=ok; mops n=7 ssh n=7; cli=show snmp access, show snmp trap.

Bucket: close-format. community_access empty vs MOPS.

No invent. No #92.

[AdamRickards]

Architect trail (Resolve from Execute) — check 9 / check 10

Hole: SSH close-format community_access empty vs gold MOPS.

Owning hops: 1.17 differential → Schema Rank1 YAML. Prefer existing tools. Note #231/#12 Engine park if compound-index — soft only if YAML can help.

Named proof: sidecar get_snmp_config.read ssh vs mops.

No invent. No #92. Main tip 4546e60.

[AdamRickards]

Decision trail (1.17 clerk — check 9 SSH floor anchor)

• Flow: Resolve hop — differential only for get_snmp_config SSH community_access empty vs crude / MOPS gold. No YAML/code fix. No protocol winner.
• Ruled out: invent floors; blaming show snmp access alone (that show is versions/port/trap service).
• Tool: napalm-hios v1.17.0 ssh_hios.py:3862–3916 (+ get_snmp_information :1440–1471); MOPS mops_hios.py:5473–5541; crude schemas/snmp.yaml + wire/ssh/snmp-community.yaml + mgmtaccess SSH. Align with issue cli. No live switch.

What v1.17 SSH get_snmp_config asked

Need	Show
versions / port / trap_service	show snmp access (dot-keys)
v3_users	show snmp notification users
trap_destinations	show snmp trap + show snmp notification hosts
communities / access	none — return field communities is hardcoded []

Community name + mode (ro/rw) on SSH in 1.17 lives under a different getter: get_snmp_information → show snmp community (mode from read-only vs else → rw).

What v1.17 MOPS does (gold shape contrast)

get_snmp_config walks snmpCommunityEntry (name + securityName); access = 'rw' if 'rw' in sec_name.lower() else 'ro'. Not VACM writeView.

vs crude declared SSH

Field	Crude	vs 1.17
versions/port/trap_service	show snmp access fields	same show family as 1.17
trap dests	show snmp trap (overlay)	overlaps 1.17; 1.17 also notification hosts
communities name	show snmp community simple_table col0	exists on overlay but receipt cli did not list it
community_security_name	MIB only (no SSH in overlay)	no SSH
community_access	compute/lookup VACM vacmaccesswriteviewname ← group ← securityName	no SSH wires for VACM → stays {}
1.17 SSH communities	hardcoded empty on get_snmp_config	same empty outcome on this method; mode ask is other getter / other show

Empty community_access on SSH is expected: crude needs VACM chain with no SSH sources. Even name-only show snmp community is not in the receipt gather list. 1.17 does not fill communities inside get_snmp_config over SSH either.

• End: Yes, not captured (known-good = v1.17.0 source). Schema Rank1 options (hypothesis): bind community access from show snmp community mode text (1.17 get_snmp_information pattern / MOPS sec_name heuristic), not from VACM-over-SSH; or accept SSH empty communities as 1.17 get_snmp_config parity. Leftover → Schema.

[AdamRickards]

Schema clerk prep trail — soft #298 (waiting 1.17 Rank1)

1.17 differential: not present on this issue (Architect only: 1.17 → Schema Rank1). No YAML bind. Main tip 4546e60.

Inventory (schema + wire/ssh only)

Schema crude_engine/schemas/snmp.yaml — get_snmp_config defaults community_access: {}
VACM chain (MOPS/SNMP path):

attr	wire	source
communities	snmpcommunityname	snmp-community
community_security_name	snmpcommunitysecurityname	snmp-community
community_group_name	vacmgroupname	snmp-view-based-acm (+ lookup from security_name)
community_access	vacmaccesswriteviewname	snmp-view-based-acm (+ lookup from group_name, resolve rw/ro)

SSH wire today

• wire/ssh/snmp-community.yaml: only snmpcommunityname ← show snmp community simple_table col 0; snmpcommunitystatus create/delete only. No snmpcommunitysecurityname.
• No wire/ssh/snmp-view-based-acm.yaml — no SSH sources for vacmgroupname / vacmaccesswriteviewname.
• wire/ssh/mgmtaccess.yaml show snmp access: v1/v2/v3 + port only — not community_access map.

Fixture / CLI (offline) tests/fixtures/192.168.1.4

• mops tap3: community_access={private:rw, public:ro, trap:ro}
• ssh tap3: community_access={} (same empty as snmp tap3)
• ssh tap1 already runs show snmp community and gets Access mode:
  testcomm2 read-only / private read-write — name+mode present on CLI; schema egress still empty because nothing binds Access mode (or a VACM SSH chain) into community_access.

vs #231 / #12 (same symptom, different class?)

	#231 (SNMP)	#298 (SSH)
Symptom	community_access empty vs MOPS	same
Prior trail	NO_HOLE → #12 compound-index / key_format: ascii on SNMP VACM walks	—
This inventory	OID-suffix / typed index on SNMP gather	SSH overlay miss: VACM chain has no SSH wires; community CLI Access mode (col1) unbound

Not filing NO_HOLE yet. Prefer existing tools after concrete Rank1. If 1.17 Rank1 still requires Engine (new primitive / invent floor) → then park #12-class or new Engine park — do not invent.

Waiting on

1.17 clerk differential + concrete Schema Rank1 (exact YAML: which wire/attr/column/value_map — not OR). Then YAML-only PR Related:#298 or trail NO_HOLE if compound-index/Engine. No invent floors. No --gate. No lab identity. No Engine/interpreter.

[AdamRickards]

Schema clerk Rank1 — option 1 (YAML bind)

Flow: Soft #298 / 1.17 Rank1. Prefer existing tools. Main tip c5e4ec8.

Chose option 1 over 1.17 empty parity: bind honest Access mode from show snmp community into community_access shape without inventing VACM writeViews.

Ruled out: invent VACM views from Access mode; Engine/#12/#231 compound-index park (SNMP class, not this SSH overlay miss); accept-empty as default when YAML can bind.

YAML:

• wire/ssh/snmp-view-based-acm.yaml — vacmaccesswriteviewname ← show snmp community simple_table col1 + value_map: community_access_ssh
• wire/snmp-view-based-acm.yaml — community_access_ssh: read-only→ro, read-write→rw
• schema comment only on community_access (wire/lookup unchanged for MOPS/SNMP)

Why it works: SSH has no VACM sources → community_group_name empty → lookup continue leaves gathered CLI dict. Values already ro/rw (not writeView names).

Tool: validate_schemas.py --errors → 0 errors.

PR: #310 Related:#298 (not Fixes).

Tip Test: get_snmp_config SSH vs MOPS — community_access should leave {} when CLI has Access mode rows (fixture keys may differ from MOPS public/trap set; bind is CLI-honest).

End: green pending Test tip. Leftover → Test / Architect.

[AdamRickards]

Test — named prove PR #310 tip c043cab

Method: get_snmp_config.read · ssh vs MOPS floor · sidecar inspect+trace.

proto	status	n	cli
mops	ok	7	community_access keys=3 (modes ro/rw present)
snmp	ok	7	community_access keys=0
ssh	ok	7	show snmp access, show snmp trap, show snmp community

parity_diffs: community_access mops keys=3 vs ssh keys=0 (also vs snmp keys=0).

Bucket: close-format — not cleared. Call completes; show snmp community runs; ssh community_access still {} (honest VACM-less path did not populate Access-mode dict). Do not invent-green full VACM/writeView.

WHERE: not merge-ready for clearing #298 empty leftover. Schema: fix bind/lookup/community_access_ssh map so Access mode rows land, then re-kick Test. No #92. No invent floors.

[AdamRickards]

Architect (Test WHERE tip c043cab) — not merge-ready.

ssh completes; cli includes show snmp community; community_access still {} vs MOPS keys=3. Close-format not cleared.

Schema Rank1v2: fix YAML bind so Access mode actually populates community_access (or trail why bind is inert). Do not invent VACM / #12 path. Do not merge #310 until re-prove.

Prefer existing tools. Tip Test after amend.

[AdamRickards]

Schema clerk Rank1v2 — amend PR #310

Flow: Soft #298 / Test WHERE tip c043cab not merge-ready. Prefer existing tools. No invent VACM / #12.

Root cause (inert bind): Rank1 bound vacmaccesswriteviewname ← Access mode correctly — gather returned {community: ro/rw}. _apply_lookup then overwrote it: empty from: (community_group_name missing on SSH) is still a dict, so lookup_keys={} and gathered[community_access]={} — not the “empty → continue / keep gathered” path Rank1 assumed.

Ruled out: inventing VACM writeViews; Engine/#12 compound-index park (this is SSH overlay + lookup wipe, not SNMP index); accepting 1.17 empty-parity while YAML can keep the Access-mode dict.

YAML (amend #310):

• wire/ssh/snmp-community.yaml — snmpcommunitysecurityname ← show snmp community col0 (CLI join key; no separate securityName on SSH)
• wire/ssh/snmp-view-based-acm.yaml — vacmgroupname ← col0 (same join key); keep vacmaccesswriteviewname ← col1 + community_access_ssh
• schemas/snmp.yaml — resolve identity for already-mapped ro/rw, else writeView→rw/ro (MOPS-safe)

Why it works: lookup from is non-empty on SSH → Access-mode dict kept and rekeyed by community name. No writeView invent.

Tool: validate_schemas.py --errors → 0 errors. Offline egress sim: community_access={testcomm2:ro, private:rw, …}.

PR tip: de86e7b on #310 Related:#298 (not Fixes). Do not merge — Tip Test re-prove.

End: green pending Test tip. Leftover → Test / Architect.

[AdamRickards]

Test — re-prove PR #310 tip de86e7b (Rank1v2)

Method: get_snmp_config.read · ssh vs MOPS floor · sidecar inspect+trace.

proto	status	n	community_access	cli
mops	ok	7	keys=3 modes rw×1 ro×2	—
snmp	ok	7	keys=0	—
ssh	ok	7	keys=2 modes rw×1 ro×1	show snmp access, show snmp trap, show snmp community

Left {}: yes — ssh community_access populated (was empty on c043cab).

parity_diffs: mops keys=3 vs ssh keys=2 (also snmp still 0). No invent full VACM.

Bucket: Rank1v2 scoped close-format acceptable — Access-mode bind works; leftover = key count / one community vs MOPS (shape ≠ writeView-complete).

WHERE: merge-ready as scoped soft. Quote leftover: ssh n_keys=2 vs mops 3. No #92. No invent floors.

[AdamRickards]

Architect — PR #310 merged → ae5e3d9 (Rank1v2 soft).

Named proof: community_access left {} → keys=2 (ro/rw). Remainder: vs MOPS keys=3 (not invent-green VACM / full pass). Issue stays open. No provenance ssh=pass yet.

Next Σ Resolve: #292 fail-bucket.

[AdamRickards]

Schema — Rank1 classify pass (Σ Resolve 2026-09-25)

Classification: AMBIGUOUS (no PR). ssh community_access keys=2 (rw×1 ro×1) vs mops 3 (rw×1 ro×2). The CLI show snmp community / access receipt only carries 2 communities, while the MIB VACM set has a third. Adding it would invent a row. Needs a live inspect of the full CLI raw (is the third community on any show?) or HITL acceptance of the key-count delta. No invented floors. #92 closed.

[AdamRickards]

Test bot raw capture on c2fd150 for Schema; observe only, no fix

• Code tree: sidecar main 2f342a6. The only commit after c2fd150 is a docs change to the park file (docs(agents): park #62 Engine NO_HOLE; fix stale #47 cite #383); no code or YAML differs.
• Path: get_snmp_config.read with trace:true, where ssh cli carries the transcript. The sidecar has no raw verb.
• ssh commands issued: show snmp access, show snmp trap, show snmp community

show snmp community (community names redacted, layout kept):

SNMP V1/V2 community     Access mode
--------------------     -----------
<community-1>            read-only
<community-2>            read-write

Answer: 2 rows on CLI (1 read-only, 1 read-write), laid out as 2 columns with dash underlines. There is no third row.

From the same run, community_access per transport (all 3 status ok):

• mops: keys=3, which are <community-1>: ro, <community-2>: rw, <community-3>: ro
• snmp: keys=0 ({}); the get_snmp_config: community_access mops keys=3 vs snmp 0 (parity) #231 class
• ssh: keys=2, which are <community-1>: ro, <community-2>: rw. This matches the CLI rows above.

<community-3> (the extra MOPS key) has the same value as the SNMP trap community.... line of show snmp trap. It is not a row of show snmp community.

parity_diffs (verbatim):

• community_access: mops keys=3 vs snmp keys=0
• community_access: mops keys=3 vs ssh keys=2
• community_access: snmp keys=0 vs ssh keys=2

Test bot Σ Resolve 2026-09-25. Observe only; no fix authored.