Netdryrun v0.4.0

Verify a change against its intent. 0.4.0 adds netdryrun verify: declare what a change is meant to do, and every other difference in the network's behavior fails. It boots the lab before and after the change, snapshots both, and matches the difference against the intent. No checks to write. FRR only in 0.4; other nodes are refused or named as unobserved.

• netdryrun verify (CLI), the MCP tool verify_change, and the GitHub Action's mode: verify: one engine. The verdicts are INTENT MATCHED, NO BEHAVIOR CHANGE, UNDECLARED CHANGES: DO NOT APPLY and INCONCLUSIVE. verify never prints SAFE TO PROCEED, and every report echoes the intent: explained is not the same as safe. An approval takes four boots (each side twice), and a side that doesn't reproduce is INCONCLUSIVE. The standing guards in netdryrun.yml come from the base side, never from the change. Reference: verify.
• The snapshot covers BGP sessions, VRFs, routes of every protocol (selected, FIB-installed, next hops), every BGP path with its attributes, the Adj-RIB-Out of every session and each node's running config. A config change with no observable effect in the lab fails unless declared, and every approval lists the changed config lines the lab didn't exercise.
• The Action judges what lands: the PR merged into the base branch. A PR that edits the intent file, the workflow judging it, or the checks together with the configs fails before any lab boots, unless a code-owner review of that file is required and the workflow opts in.
• Fixes for false passes in 0.3.3 (live mixed-vendor interop labs: cJunosEvolved, cEOS, SR Linux, FRR):
  • Juniper: a path with no MED read as MED 0, so med: 0 passed on a route sent without a MED. And bgp_prefixes read Junos's accepted count, which also leaves out a received route hidden for an unusable next hop. It now subtracts only the routes rejected by import policy, as the other drivers count. A hidden route with a reason the driver doesn't know leaves the count a range, and a bound is judged only when the whole range agrees.
  • SR Linux: a route rejected by import policy counted as received, so active: false passed on it and present: false failed. It is now left out, as on every other driver.
  • Arista EOS: cEOS prints MED 0 for a path with no MED, so a med: 0 check on EOS is refused before the lab boots (exit 2). AS sets are read in the same form as every other driver.
  • A topology exec: command that fails is an error on every platform (containerlab only logs it). Startup config a NOS rejected is never a pass on Arista cEOS, SR Linux and SONiC too (FRR since 0.3.3). Advisory: advisories/0.3.3-exec-not-checked.
  • A repeated key in device JSON is never "the last one wins".
• Advertisement intervals stretch --settle and --hold, so a leak sent after the default windows can't let a negative check pass on a count still at 0. record covers every active VRF on FRR and SONiC.
• A machine-readable capability statement: capabilities.json, generated from the source (on netdryrun.com once the site deploys 0.4).
• The repository is now github.com/netdryrun/Netdryrun. Old links and uses: netdryrun/netdryrun@vX keep working through GitHub's redirect.
• Moved to 0.4.1: verify on an FRR lab with equal multipath paths to an advertised prefix gives no verdict (exit 2, never an approval); reading the graceful-restart stale flag on SR Linux, EOS and SONiC; counting only usable routes in SR Linux prefix counts; EOS out-delay.
• How this release was checked: releases/0.4.0/GATE.md records static checks, unit tests on Python 3.10–3.14, mutation testing of the verdict logic (the verify modules included), and the live lab matrix with both Verdict Corpora and chaos tests. review.md holds the reviews: a cold code review, an expert gauntlet, a multi-vendor audit, an adversarial review of every mutation acceptance, and two runs of a mixed-vendor interop test. Every finding has its decision.

Full list: CHANGELOG.