docs(wiki): sync wiki with 44673dfea..15f9b98ae (211 commits)
Updated 29 existing pages. No new pages.
Breaking CLI change: a bare `ze <config-file>` no longer starts the daemon.
Position 1 accepted a command OR a free-form path, so a config named like a
command was dispatched as that command and never loaded. Launch is now
`ze start <config-file>`, with `-` kept as the stdin sentinel. Corrected in
quick-start, starting-and-stopping (including its systemd unit),
command-reference, debugging, scenarios, chaos-tested-peering and
exabgp-migration-walkthrough. command-reference also gains a `ze start`
section with its own flags.
Also flipped: `ze config set`, `activate` and `deactivate` no longer notify a
running daemon by default. `--reload` opts in and `--no-reload` is gone.
Feature gates grew from 12 to 36 and now include the BGP engine itself, the
BNG, IPsec, VPP and every routing protocol. building.md gets the full grouped
list, the generated `go install` line, and the dependency rules that make it
usable: ze_bmp needs ze_bgp, and bfd/api stays always-on so a BFD-less build
still runs BGP and OSPF unchanged. status, feature-inventory, comparison and
glossary all carried the stale twelve-tag list.
RFC gate: 138 enrolled RFCs over 1466 gated requirements became 166 documents
over 2720, none outstanding. Documented the four regression ratchets and the
extraction-completeness pass, including why deleting a requirement is blocked:
it would otherwise be the cheapest route from red to green, cheaper than
declaring a gap, which would pressure contributors to hide obligations.
Protocol correctness, documented where an operator would look for it:
- route-injection: an operator-supplied as-path gets the local AS prepended
for a plain eBGP peer (RFC 4271 5.1.2). Verbatim transparency is scoped to
RS clients, so the two never share a built UPDATE.
- peers: RFC 6286 identifier validation on both receive rails, AS-wide
uniqueness, and the allow-shared-router-id opt-out for anycast speakers.
- graceful-restart: RFC 9494 4.6 depreference on stale readvertisement is
driven by stale level rather than restart state, so mark-stale routes are
covered too.
- bgp-nlri-ls: an unknown NLRI type is skipped, not fatal to every NLRI after
it, per RFC 9552 5.1.
- bgp-nlri-evpn: Ze is a control-plane relay and not a PE; malformed IP
Address Length is rejected.
- bgp-rib: multipath ECMP group installation and the ecmp-paths field.
Security and robustness: authorization fails closed on an unresolved profile,
with the reserved-namespace break-glass path and the AAA ingress filtering that
stops an untrusted RADIUS or TACACS+ server naming it. EAP-TLS refuses a
responder that has no trust anchor to validate against. static isolates one
unprogrammable route instead of failing the whole section, withdraws the
orphaned old route on a skipped replacement, and surfaces both through
skip-reason and a doctor check.
Operator traps now named: the pinned appliance kernel ships no L2TP and Ze's
fail-closed probe crash-loops the daemon on it with nothing useful on serial;
policy routing needs a filter chain because nftables rejects a route chain on
prerouting, which took the plugin down at startup; nft set-element timeouts
silently never expired until the set-level flag was set.
ci.md claimed the CI configuration was not in the repository. It is: validation
moved off Codeberg's shared Woodpecker runners onto GitHub Actions, six
workflows, with the stage list single-sourced in stagesForMode so a gate absent
from that function runs nowhere.
testing.md gains the test-health dashboard (is our testing correct, not is it
large), the two sensitivity ratchets, the accept-only .ci lint and its
shrink-only baseline, and the needs-linux and netns-link directives.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>