read-tsf 1.3.0

Added

• SKILL.md: a "DP CPU — onset and attribution" section. Date the onset
  against HA state changes; check VM-Series sizing against the licence's
  core cap and the packet-IO mode (DPDK or PacketMMAP); decide
  compute-bound or buffer-bound from PBP and ingress-backlog state in
  sdb.txt; split DP time by function with debug dataplane pow performance; name the costly inspection from the config. Two reading
  traps: per-process 94–100 % for pktproc in dp-monitor is busy-polling
  on the PA-3200, not load, and in HA an error is a cause only if the peer
  lacks it.
• SKILL.md: --- panio blocks in dp-monitor.log also carry show session info and the global counters with a per-second rate, a
  pre-incident time series for any counter.
• TSF-GUIDE.md §3: debug dataplane pow performance.
• TSF-GUIDE.md §4, new rows:
  • an active HA member black-holing traffic with links up — the passive
    peer's pkt_recv against the active's ha_msg_sent, and the noise
    both peers share;
  • SFP model, optical levels, PAUSE frames and MAC errors in sdb.txt
    (sys.s1.p<N>.phy|detail|cfg|stats), with the insertion history in
    brdagent.log;
  • where frames are lost — CPU vs MAC counters of show counter interface all on both ends of HA2;
  • why a VM-Series runs PacketMMAP instead of DPDK, per boot, from
    pan_vm_plugin.log, pairing NIC twins by MAC.

Changed

• The PA-3250 on 11.1 behaves like the PA-1400 in dp-monitor:
  bcm_g_cntr_stats fails with a Python SyntaxError and
  dpc_nica_stats prints NICA FPGA not available.

Fixed

• tools/validate.sh checks links only in files git would commit, so a
  note under an ignored directory no longer blocks tools/intake.sh.

read-tsf 1.2.0

Added

• read-tsf-sync installs and updates the skill on machines with or
  without GitHub. It is a bash script in the plugin's bin/, with a
  PowerShell twin (read-tsf-sync.ps1 and a .cmd launcher) for Windows
  PowerShell 5.1 and later. Each run picks its source: an archive given on
  the command line, else GitHub when it answers, else the newest release
  archive in the current directory or in Downloads. Archives are checked
  against their .sha256. Local edits are kept across updates, and an edit
  that collides with the new release is kept under pending/.

• read-tsf-sync contribute writes a Markdown document that the user reads
  and e-mails themselves. It holds a summary, an evidence table (platform,
  PAN-OS version, what was checked, what it showed), the changed files, the
  checks that ran, a diff and the full text. A change to the skill's
  documents needs evidence. Before anything is written, the new lines and
  the text around them are checked:

  • against the customer-data patterns;
  • for domain names;
  • for the hostname, serial, domain and addresses of the analyzed TSF
    (--tsf);
  • against a local denylist.txt.

  A pull request is opened instead only from a git clone with a logged-in
  gh, and only with --yes; its description is the same summary and
  evidence. Neither path ever carries a binary or a file from outside the
  skill.

• tools/check-no-customer-data.sh also catches PAN-OS serials, MAC
  addresses outside the documentation block, values of config elements that
  hold names and secrets, and PAN-OS encrypted values.

• tools/intake.sh turns a received contribution into a pull request under
  the contributor's name. --dry-run only checks it. tools/pack.sh builds
  the offline archive, and a release workflow attaches it to every v* tag.

• A read-tsf-sync skill, a few lines long, so that Claude can run an
  update or a contribution when asked.

• tools/test-sync.sh runs either script end to end in a sandbox. CI runs
  it with bash and PowerShell 7 on Linux, and with Windows PowerShell 5.1
  and Git Bash on Windows.

Fixed

• README.md described the symptom map as covering "sessions" and
  "management plane", which are not rows of it, and omitted seven that are.
  It now names the sixteen domains the table actually holds.

read-tsf 1.1.1

Two table cells were split by unescaped pipes inside inline code, so the crash row rendered as nine columns and scattered its interpretation across cells belonging to no header.

The README also documented claude plugin update read-tsf, which the CLI rejects — the qualified name read-tsf@tbortolossi is what it accepts.

Full notes in CHANGELOG.md.

read-tsf 1.1.0

First public release.

The log map re-verified against an extracted PA-440 and ten anonymized tech support files — the PA-3200 family, a PA-5200, two PA-7000 chassis and several single-dataplane platforms, PAN-OS 10.2 through 12.1. Roughly half the file families in var/log/pan had no mention anywhere before this pass.

Added: an inventory pass before any reading; clock trust from var/log/ntpstats; cloud log forwarding (icd.log names the region, icd_dp.log carries the failures); interface flaps dated to the millisecond in qtrace_routed; device health monitors, SNMP, keystore, MP-to-DP plumbing, daemon supervision, SD-WAN, IoT, directory sync; Panorama sync state; the GlobalProtect portal's nginx front end; and the published log names that exist on no archive at all.

Full notes in CHANGELOG.md.