get_config.read: SSH no-cli (empty cli vs MOPS)

[AdamRickards]

SSH remainder (Σ Execute 2026-09-23)

Method: get_config · main 2c65702.

Receipt: ssh ok n=2; cli=[].

Bucket: no-cli. running/startup empty both — no CLI provenance. No invent. No #92.

[AdamRickards]

Architect trail (2026-09-23)

• Hole: Schema / SSH — no-cli (empty or protocol-absent). Rank1 = find declared show(s) / Media CLI that populate cli without inventing values.
• Order: CLI.json + sibling overlays → Schema PR → Test re-inspect. Fanout lessons from get_vlans.read: SSH close-format (port membership vs MOPS) #290/fix(wire): SSH get_vlans Rank1v2 PVID membership via show vlan port (#290) #303 apply (timeout = HARD stop that path).
• Named proof: python3 tests/release_matrix.py --inspect --method <this> --protocol ssh --trace on tip 6a9ac64+.
• Provenance: cell stays untested until green. No invent; SSH cli hangs to timeout on invalid or missing command instead of failing #92 closed.
• Owner: Schema clerk. NO_HOLE → Architect parks Engine (do not widget-wait).

[AdamRickards]

Decision trail (Schema clerk)

• Flow: soft assign get_config.read SSH no-cli on tip 8040457+ (rebased check on current main). Receipt: ssh ok n=2; cli=[]; running/startup empty both — no CLI provenance. Architect: Schema Rank1 = find declared show(s) / Media CLI that populate cli without inventing values. No invent. No SSH cli hangs to timeout on invalid or missing command instead of failing #92. Fanout call-timeout HARD (get_vlans.read: SSH close-format (port membership vs MOPS) #290/fix(wire): SSH get_vlans Rank1v2 PVID membership via show vlan port (#290) #303).
• Method / Rank1: get_config. Rank1 = CLI.json + sibling overlays → Schema PR → Test re-inspect. 1.17 differential if wire/attr map unclear.
• 1.17 / catalogue: API_REFERENCE: Protocols: None (Composed). SCHEMA_MODEL: empty {} is only for honest no-wire (SSH execute blobs like get_config running/startup); floor class check_catalogue.py --composed. Schema comment already: 1.17 get_config is SSH execute (show running-config). No overlay in this ticket. running: {} / startup: {} — intentional, not a missing bind.
• CLI.json hit (shows exist, not hangable): show running-config script → running; show running-config xml → startup (CLI_REFERENCE §12.5 + cli_ref_hios_merged). Sibling wire/ssh/filemgmt.yaml already covers status/watchdog/profiles only — 0 overlays for config-blob attrs. No Media/MIB wire carries running/startup text (base wires with ssh-only sources: 0).
• Ruled out: (1) Bind running/startup to invent non-MIB wires + parser: none blob — invents wire identity; VALID_ATTR_KEYS has no wireless ssh: on schema attrs; would exit Composed → fake SSH protocol. (2) Reuse hm2fmnvmstate / status shows — wrong object; would poison get_config_status. (3) Hang shows without wire+source — engine gather skips no-wire attrs → cli stays []. (4) Fanout / extra shows beyond CLI.json pair — none needed; hang is the gap, not spelling. (5) Populate non-empty blobs vs MOPS/SNMP empty composed floor — invents SSH-only content vs gold empty both.
• Tool: tip main. Prefer existing YAML tools exhausted. validate_schemas.py not run (no YAML change). No live sidecar this hop. No --gate. No lab identity.
• Change: none. No PR.
• End: NO_HOLE (accepted-limit / protocol absence). Leftover class: Engine — SSH execute-blob gather for Composed get_config (honest wireless command attrs, or execute_methods path) without inventing MIB wires. Soft Σ SSH no-cli continue elsewhere. Do not start get_config_remote.read: SSH no-cli (empty cli; url/status vs MOPS) #325.

[AdamRickards]

Architect — NO_HOLE park

Schema Rank1: composed Protocols:None; running/startup honest {}; no MIB wire for show running-config. Prefer existing tools exhausted.

Parked Engine: SSH execute-blob gather for running/startup config (or equivalent primitive).

Park PR: #348
Soft path: #325+ continue. No invent. #92 closed. Do not widget-wait.

[AdamRickards]

Review of draft PR #388 (review/324-config-running, head a18962c). Draft; do not merge. This mirrors the PR comment (#388 (comment)) here on the issue.

Sidecar live proof: get_config.read trace:true, main 9ee450d then this head (2 runs, same result), then restored to main.

protocol	main 9ee450d	PR #388 a18962c
mops	ok, running/startup empty	ok, running/startup empty
snmp	ok, running/startup empty	ok, running/startup empty
ssh	ok, running/startup empty, no command sent	timeout, phase=call at the 6 s call budget; last command show running-config script, output still streaming, no prompt returned
parity_diffs	0	0 (ssh had no result to compare)

Claims from the patch note

1. parser: none returns the raw response as-is: CONFIRMED offline (a fake SSH gets the command, and the text comes back unchanged).
2. SSH's protocol default parser is dot_keys, so parser: none must be explicit: CONFIRMED (drivers/SSH.yaml default parser: dot_keys).
3. Wiring running to show running-config script returns the config over SSH: DENIED live. The SSH call timed out at phase=call inside the 6 s budget on both runs, so content is untested.
4. MOPS/SNMP are unchanged (empty): CONFIRMED live.
5. startup has no safe read-only command and stays unwired: UNTESTED (not probed; no write commands sent).
6. show running-config xml / script all alternatives: UNTESTED (not probed).
7. Schema + wire YAML only, no Engine changes: CONFIRMED.
8. pytest green (22 passed, 2 skipped): CONFIRMED; ci_offline.sh and the floors board check also pass.
9. Risk low-medium, and "still open: none for running": DENIED. On timeout, the receipt's session_log_tail carried about 8 KB of running-config text. On success, the full text would also land in raw, in cli (trace) and in the parity_diffs prefix. Receipt redaction is needed before this can be proven or merged.

Verdict: fail.

Next step: receipt redaction for config text (sidecar/receipt side), then a decision on how an SSH call that streams long output should finish inside the existing budget. Budgets are not the fix. Parity/gold handling for an SSH-only field stays open. The owner decides whether to keep the draft.