Denozordec
9fa6269174
Implement reliable agent apply, telemetry v2, analytics retention, guarded rollouts, enrollment, labels and webhooks. Improve ReUI frontend data safety and bounded list loading, and add Docker smoke, recovery and resource checks. Document local verification and pending native acceptance.
5.2 KiB
Implementation checkpoint
Prerequisites unavailable here: Docker/Linux runtime, production-volume clone and RouterOS hardware. The user has no separate test stand; native checks are wired into CI and remain pending actual execution. Implementation and local verification cover F1/F2/F3, including a browser check of the 100k-entry paged list. Astra accepted the final feature/security package and benchmark CI wiring, with no open confirmed P1/P2 blockers. Local implementation is accepted; native release acceptance remains pending.
Root's final local suites passed: API 281 tests, shared 22, frontend 42, with 21 mounted UI checks recorded. The earlier 274-test checkpoint is superseded. The final fresh Windows in-memory run passed all 1611 requests, zero 429s, all raw/fleet/deduplication assertions and the bounded 100k import summary. Its separated steady profile observed new-ingestion p95 11.09ms and timeseries p95 8.07ms; the unconstrained host is not native target-host acceptance. Earlier mixed-profile results and full measurement limitations are documented in runtime-validation.md.
| Stage | Scope | Status | Acceptance still required |
|---|---|---|---|
| 0 | Baseline, preparation, ReUI | partial | ReUI skill updated to 68f0e6fa91; root confirmed premium CLI @reui/settings-2 --dry-run passed (10 hypothetical files; no installation). Run reproducible baseline on Linux; collect initial-route/browser measurements and registry evidence |
| 1 | Security and data preservation | implemented, local checks passed | Representative native DB upgrade, production recovery rehearsal and matching pre-upgrade backup procedure remain pending |
| 2 | Reliable policy application | implemented, local checks passed | Linux CI and RouterOS application/failure/recovery against real packets and agents remain pending |
| 3 | Sources and policy evaluation | implemented, local checks passed | Representative live-source and long-duration capacity checks remain pending |
| 4 | Trustworthy telemetry | implemented, local checks passed | Counter resets, timestamps and mixed-agent versions against native traffic remain pending |
| 5 | Analytics and storage | implemented, native acceptance pending | Local analytics/coverage/retry checks exist; long-duration retention, DB growth and Linux capacity measurements remain pending |
| 6 | Frontend speed and ReUI | implemented, local/browser checks recorded | Native network/navigation measurements remain pending; asset growth is disclosed below |
| 7 | Operations and Docker | implemented, CI wired | Actual built-image smoke, previous-image upgrade, recovery, digest provenance and constrained performance result remain pending CI/Linux |
| 8 | New F1/F2/F3 features | implemented, local checks passed | F1 diagnostics/source health/explain IP-port/analytics CSV; F2 TTL overrides/snapshots/canary/rollback/webhooks/one-time enrollment/token rotation; F3 labels/preview and guarded group assignment/IPv6. Native agents still require CI/hardware |
Operations now include identity-scoped rate limits, durable bounded audit and webhook outboxes, secret masking, fail-closed encrypted webhook storage, DNS-pinned HTTPS delivery, online SQLite backup/restore tooling, generated contract drift checks, per-run Docker builders with effective GC verification and a digest-pinned previous-image release upgrade gate. Review fixed queued-webhook cancellation after endpoint changes and signing-master exposure through settings/install context. The quality workflow now invokes the real benchmark harness after smoke against the exact same immutable image ID, with a disposable 2-vCPU/4GB container and a 500ms steady ingestion/timeseries p95 gate. Relevant PRs and every CD quality invocation run this job; a failed native benchmark blocks release.
Root's browser check loaded the 100000-entry global list as a 100-row page, then searched the final entry 11.1.134.159/32: exactly one result appeared and input focus remained intact. This confirms whole-list server filtering and bounded rendering for that scenario.
Final build artifacts: all JS/CSS assets 1908807 bytes raw / 590263 bytes gzip (+6.90% / +9.42% from the recorded baseline); bootstrap 871972 / 243973 bytes (+1.54% / +1.65%). Gzip figures are generated artifact sizes, not measured network transfer. Features increased total assets; no bundle-size reduction is claimed.
The Linux CI harness creates fresh network/mount/PID namespaces for nft and ipset independently, exercises IPv4/IPv6 traffic denial, drift repair, invalid-candidate preservation and unrelated rules. Its control-plane fixture now returns the exact report ID and sequence required by the durable telemetry sender; a pure acknowledgement-contract regression passes locally. Shell/Python validation is not native execution. Built-image startup/native SQLite, backup/upgrade, resource baselines, Docker-network traffic and RouterOS remain explicit pending gates.
Backend implementation/checks: backend-hardening.md. Frontend implementation/checks: frontend-validation.md. Runtime commands, actual constraints and pending gates: runtime-validation.md. Update this checkpoint only with observed integration evidence; a unit test alone does not complete a stage.