# Central v0.7 depth workflows (`v07-central-depth`)

Scope: Central-only. Adds schema-backed template/bulk/firmware-campaign/
config-health/troubleshooting-orchestration workflows on top of the existing
curated `central-config` / `central-monitoring` / `central-ops` tools, plus a
credential-gated live evaluator and a disposable-write lifecycle harness.
This page documents those additions only — it does not restate or revise
any global tool-count claims (see `README.md` / `docs/architecture/RAG-ARCHITECTURE.md`
for those, owned by the release process).

## Why these five workflows

Every endpoint below was verified against the committed OpenAPI source
(`ingestion/sources/openapi_specs/*.json`) and/or the generated Central
manifest (`src/hpe_networking_mcp/mcp_servers/openapi_gen/manifests/central.json`, 1,677 operations)
before any tool was written — no Classic-Central-shaped path was guessed.

| Workflow | New Central schema source | Gap this closes |
|---|---|---|
| VSF stacking-template lifecycle | `ingestion/sources/openapi_specs/vsf-template.json` (`GET/POST/PATCH/DELETE /network-config/v1alpha1/vsf-templates[/{name}]`) | The only schema-backed generic "template" resource in New Central; the existing `list_config_templates` only *probes* speculative Classic-shaped endpoints |
| Bulk site / site-collection delete | `scope-management-1fkx1wmq0s.json` (`DELETE /network-config/v1/sites/bulk`, `DELETE /network-config/v1/site-collections/bulk`) | Device-group bulk delete already existed; site/site-collection bulk delete did not |
| Firmware-compliance campaign | Orchestrates the existing manifest-confirmed `/network-config/v1alpha1/firmware-compliance` POST/PATCH flow across multiple targets | No bulk-firmware endpoint exists in the schema — this composes the single-target endpoint safely across scopes/personas instead of inventing one |
| Config-health remediation planning + execution | `configuration-health-b374ik1cmq.json` (`config-health/devices`, `config-health/active-issue`, `config-health/devices-resync`, `maxItems: 50`) | Planning was previously manual; resync had no schema-enforced chunk bound |
| Troubleshooting orchestration | Composes existing confirmed `/network-troubleshooting/*` LLDP/ARP/ping/show tools | No bounded, multi-step diagnostic bundle existed |

Endpoints considered and explicitly **not** implemented because no
authoritative schema exists in this manifest:

- Classic-style config templates with `%variable%` substitution or a
  separate template-group assignment step (`list_config_templates` now
  documents this precisely instead of guessing further).
- Bulk delete for `/network-config/v1alpha1/device-collections/bulk` —
  deprecated in the spec in favor of `device-groups/bulk` (already covered
  by the existing `delete_device_groups`).

## New tools

All writes below share one contract: `dry_run=True` by default (no network
call), an explicit `confirm=True` is required to execute, execution is
gated behind the existing Central write gate
(`HPE_MCP_CENTRAL_WRITES`, default enabled — `enforce_platform_write`
in `src/hpe_networking_mcp/mcp_servers/shared.py`), the executed response is validated
(`validate_write_result`, raises `WriteResultError` on a non-2xx/error
envelope), and a read-back call confirms what Central actually stored.

### `src/hpe_networking_mcp/mcp_servers/config.py` (75 → 80 tools)

| Tool | Annotation | Notes |
|---|---|---|
| `build_vsf_template` | `IDEMPOTENT_WRITE` | Create/update a LOCAL-scoped VSF template (`number_of_members` 1-10); read-back via GET after write |
| `delete_vsf_template` | `DESTRUCTIVE` | Delete + read-back; a 404 on read-back is surfaced as `read_back={"deleted_confirmed": True}` |
| `delete_sites_bulk` | `DESTRUCTIVE` | Up to 100 site IDs per call; irreversible (no read-back — verify with `list_sites` first) |
| `delete_site_collections_bulk` | `DESTRUCTIVE` | Same shape/bound as `delete_sites_bulk` |
| `run_firmware_compliance_campaign` | `IDEMPOTENT_WRITE` | Up to 25 `{scope_id, device_function}` targets; every target is attempted independently — one target's failure never aborts the rest (`targets_failed`, per-target `error`); each successful target is read back via `get_firmware_compliance` |

`get_network_profile` / `set_network_profile` / `delete_network_profile`
also work generically against `profile_type="vsf-template"` (added to
`_NETWORK_PROFILE_TYPES`), consistent with the existing BGP/OSPF/VRF/VSX/
telemetry profile family.

### `src/hpe_networking_mcp/mcp_servers/monitoring.py` (85 → 87 tools)

| Tool | Annotation | Notes |
|---|---|---|
| `plan_config_health_remediation` | `READ_ONLY` | Bounded scan (`max_devices_scanned` ≤ 200) of `list_devices_config_health` + `get_device_config_issues`; makes no config changes |
| `execute_config_health_remediation` | `IDEMPOTENT_WRITE` | Chunks ≤200 serials into groups of ≤50 (the `resyncCfgDevices` schema max) and resyncs each chunk independently — one chunk's failure never aborts the rest; reads back `get_device_config_issues` per serial in each successful chunk |

`resync_device_config` now enforces the same 50-serial schema bound
directly (`ValueError` above the limit) instead of silently forwarding an
oversized request.

### `src/hpe_networking_mcp/mcp_servers/ops.py` (40 → 41 tools)

| Tool | Annotation | Notes |
|---|---|---|
| `run_troubleshooting_bundle` | `DIAGNOSTIC` | CX or AOS-S only. Always runs an ARP-table step (CX also runs LLDP); optional ping (`destination`) and show (`commands`, ≤5, each must start with `show `) steps. Composes existing tools only — no new endpoint. Each step's failure is captured independently; the bundle never aborts early |

## Live evaluation: `scripts/evaluate_central_070_readonly.py`

Credential-gated per `src/hpe_networking_mcp/pipeline/live_test_config.py`; every artifact is
written through `src/hpe_networking_mcp/pipeline/artifact_contracts.write_artifact`
(`live_lifecycle_evidence` kind), which redacts secrets and hashes any
identifier before the file touches disk.

- **Default (offline, fixture-backed):** exercises a bounded 3-step
  sequence against an in-memory fake client — no network I/O.
- **`--live-read`:** swaps in the real `hpe_networking_mcp.mcp_servers.shared.get_client()`
  and runs the same bounded steps as GET-only calls. Requires
  `HPE_MCP_LIVE_TEST_CENTRAL_READ=1`; a GET-only guard is installed on
  the client so any non-GET verb raises before transmission. Blocked
  (exit code 1, no artifact written) when the env gate is unset.
- **`--live-write` / `run_disposable_write_lifecycle`:** a disposable
  create → read-back → delete VSF-template round trip
  (`build_vsf_template` / `delete_vsf_template`) against an operator-supplied
  lab scope. Gated by `HPE_MCP_LIVE_TEST_CENTRAL_WRITE=1` **and** the
  read gate (`live_test_config.live_test_write_enabled`). `main()` never
  calls this function in this repo revision — it only reports gate status
  when `--live-write` is passed — by design, so this task never executes a
  live write.

### Live status for this evaluation run

`HPE_MCP_LIVE_TEST_CENTRAL_READ` was **not set** in this environment, so
per the task's read-only-gating rule, no live call was attempted here —
only the default offline/fixture-backed evaluation was run
(`.venv/bin/python scripts/evaluate_central_070_readonly.py`). Central
credentials happen to be present in `config/credentials.yaml`, but
credential presence never implies authorization (see
`src/hpe_networking_mcp/pipeline/live_test_config.py`) — set
`HPE_MCP_LIVE_TEST_CENTRAL_READ=1` explicitly to run the bounded
GET-only path.

## Tests

| File | Covers |
|---|---|
| `tests/unit/test_config_v07_workflows.py` | VSF template dry_run/confirm/gate/read-back/validated-result; bulk-delete bounds + payload shape; firmware campaign bounds + partial failure |
| `tests/unit/test_monitoring_config_health_remediation.py` | Remediation planning (healthy-device skip, scan bound, per-device error capture); execution chunk bound, dry_run/confirm/gate, partial-chunk-failure |
| `tests/unit/test_ops_troubleshooting_bundle.py` | Device-type/command validation, CX vs AOS-S step composition, per-step partial-failure isolation |
| `tests/unit/test_evaluate_central_070_readonly.py` | Offline artifact validity + redaction (no raw fixture identifiers), live-read gating, disposable-write harness never auto-executed and hashes its identifier |

Run: `.venv/bin/python -m pytest tests/unit/test_config_v07_workflows.py tests/unit/test_monitoring_config_health_remediation.py tests/unit/test_ops_troubleshooting_bundle.py tests/unit/test_evaluate_central_070_readonly.py -q`