floors provenance: loop_protection, arp_table, vlans, auto_disable, ip_restrict, signal_contact ssh=pass

[AdamRickards]

Summary

• Set ssh=pass for 6 methods after the Σ Resolve re-prove on main 6b71a1e. Each was all-green: mops/snmp/ssh ok, ssh n equal to the floor, parity_diffs == [].
  • get_loop_protection: schema(#299): SSH get_loop_protection enabled/mode/action/loop_detected maps #376 / get_loop_protection.read: SSH fail (no cli; invent-wrong scalars) #299
  • get_arp_table: schema(#295): get_arp_table interface value_map ifindex (ifName align) #377 / get_arp_table.read: SSH no-cli (empty cli+raw vs MOPS n=35) #295
  • get_vlans: schema(#290): get_vlans membership key_map bridge_port (ports ifName keys) #378 / get_vlans.read: SSH close-format (port membership vs MOPS) #290
  • get_auto_disable: schema(#292): SSH get_auto_disable brief column_overflow strict (ifName keys) #379 / get_auto_disable.read: SSH fail (raw empty; only show port) #292
  • get_ip_restrict: schema(#217): SSH get_ip_restrict rules paired_rows lines_per_record 2 #380 / get_ip_restrict.read: SSH parse remainder (rules row/prefix; timeout cleared) #217
  • get_signal_contact: schema(#293): get_signal_contact sense_ps_state per-PSU dict {psid: bool} #384 / get_signal_contact.read: SSH no-cli (protocol absent vs MOPS) #293
• Not touched: get_port_security (schema(#227): SSH get_port_security enabled paired_rows lpr 2 (port-name keys) #381 / get_port_security.read: SSH parse remainder (ports 56 vs 28; mode shape) #227) and get_router (schema(#228): SSH get_router ports pk bind + key_column 0 #382 / get_router.read: SSH parse remainder (ports/vri n=0; cli listed) #228). Both still have leftovers.
• Regenerated docs/FLOORS_BOARD.md: Σ 240→246 / 300 (80.0% → 82.0%); ssh pass 40→46. docs/status.html only had a date-line change, so it's not included (same as floors provenance: sflow poller/sampler + ipsource bindings ssh=pass #375).
• Only those 6 cells change; nothing invented. SSH cli hangs to timeout on invalid or missing command instead of failing #92 stays closed.

Evidence (sidecar <method>.read with trace:true, tip 6b71a1e, 2026-09-25)

method	mops	snmp	ssh	parity_diffs	ssh CLI
get_loop_protection	ok, interfaces n=28	ok, 28	ok, 28	[]	show loop-protection interface, show loop-protection global, show port
get_arp_table	ok, n=33	ok, 33	ok, 33	[]	show ip arp table, show port
get_vlans	ok, n=11	ok, 11	ok, 11	[]	show vlan brief, show vlan port, show port
get_auto_disable	ok, n=28	ok, 28	ok, 28	[]	show auto-disable brief, show port
get_ip_restrict	ok, rules n=1	ok, 1	ok, 1	[]	show network management access global, show network management access rules
get_signal_contact	ok, contacts n=1	ok, 1	ok, 1	[]	none recorded (see below)

Beyond the harness verdict, I also compared the full field-by-field output of ssh against mops and snmp: it is identical for 5 methods.

Caveats:

• get_vlans: on this lab every transport shows U-only membership (PVID). T/F is never exercised, so the T/F show vlan member remainder stays parked on hitl-engine-park.md. This pass covers the current floor only.
• get_signal_contact:
  • ssh matches snmp exactly, and sense_ps_state is {'1': True, '2': True} on all 3 transports.
  • sense_fan, sense_humidity and sense_stp_port_block are mops None vs ssh/snmp False. The harness doesn't count None vs False, and schema(#293): get_signal_contact sense_ps_state per-PSU dict {psid: bool} #384 leaves these out of scope.
  • The ssh cli is empty because the per-contact loop doesn't record commands (get_interfaces.read: SSH parse remainder (cli listed; n=1 vs mops 36) #226 class). Declared command: show signal-contact {entity} all for contacts 1–2.
  • The section: 1 PS-table index is not raw-verified. Live keys rule out the case "PS table at separator 0 followed by another table"; they don't rule out "PS table is the only separator" (fallback to separator 0).
• get_arp_table: n=33 on all three transports on this run. The ARP table is live, and n matches across transports.

Named proof

• python3 scripts/generate_floors_board.py
• python3 scripts/generate_status.py --check → PASS
• Receipt: /tmp/sigma/provenance20260925/receipt.txt

Issues

• Left open; Architect decides closure: get_loop_protection.read: SSH fail (no cli; invent-wrong scalars) #299, get_arp_table.read: SSH no-cli (empty cli+raw vs MOPS n=35) #295, get_vlans.read: SSH close-format (port membership vs MOPS) #290 (T/F parked), get_auto_disable.read: SSH fail (raw empty; only show port) #292, get_ip_restrict.read: SSH parse remainder (rules row/prefix; timeout cleared) #217, get_signal_contact.read: SSH no-cli (protocol absent vs MOPS) #293.

Test plan

• Diff is only those 6 ssh cells plus the board rollup
• Prove receipts under /tmp/sigma/provenance20260925/