{ "assessment": { "all_ok": true, "blockers": [], "decision": "PASS_STEP_044G_RUNTIME_EGRESS_ACTIVITY_COUNTERS_DESIGN", "expected_absence": { "activity_table_already_present_before_implementation": false, "candidate_nft_applied": false, "force_mode_enabled": false, "lease_rows_updated": false, "manual_agent_service_start_used": false, "private_material_published": false, "rebalance_paused": false, "vm100_changed": false, "vm101_changed": false, "vm121_changed": false }, "success_checks": { "active_leases_zero": true, "candidate_nft_created": true, "candidate_nft_has_forward_hook": true, "candidate_nft_has_out_and_in_rules": true, "counter_plan_rows_five": true, "counter_plan_two_counters_per_peer": true, "enabled_peer_count_five": true, "forced_leases_zero": true, "idle_leases_five": true, "lease_rows_five": true, "leases_query_ok": true, "pending_jobs_zero": true, "postgres_container_found": true, "public_index_rebuilt": true, "public_report_created": true, "sampler_contract_created": true, "settings_query_ok": true, "targets_query_ok": true, "vm100_allowed_ip_count_five": true, "vm100_inventory_collected": true, "vm100_selector_rows_five": true, "vm100_transit_vpn_l3_device_detected": true, "vm100_transit_vpn_present": true, "vm100_wg_paid_l3_device_detected": true, "vm100_wg_paid_peer_count_five": true, "vm100_wg_paid_up_or_present": true, "vm101_cs1_to_vpn3_seen": true, "vm101_cs2_to_vpn4_seen": true, "vm101_cs3_to_vpn5_seen": true, "vm101_cs4_to_vpn1_seen": true, "vm101_cs5_to_vpn2_seen": true, "vm101_slot_map_collected": true, "vm121_read_model_collected": true }, "warnings": [ "STEP_044G is read-only design/inventory; candidate nft is generated but not applied.", "Next implementation step should install a persistent VM100 init script/service for router_egress_activity counters and a read/parser tool.", "Activity should be based on useful inner traffic both directions, not WireGuard handshake/keepalive." ] }, "changes": { "candidate_nft_applied": "NO", "lease_rows_updated": "NO", "manual_agent_service_start_used": "NO", "private_material_published": "NO", "vm100_changed": "NO", "vm101_changed": "NO", "vm121_changed": "NO_READONLY_DESIGN" }, "counter_plan": { "chain": "forward_activity", "counter_rows": [ { "egress_class": "cs1", "in_counter": "peer_10_253_1_10/32_in_vpn", "in_rule": "iifname \"eth2\" oifname \"wg_paid\" ip daddr 10.253.1.10/32 counter name \"peer_10_253_1_10/32_in_vpn\"", "out_counter": "peer_10_253_1_10/32_out_vpn", "out_rule": "iifname \"wg_paid\" oifname \"eth2\" ip saddr 10.253.1.10/32 counter name \"peer_10_253_1_10/32_out_vpn\"", "peer_id": "376dfa07-0ba4-4182-af39-389a2cb3badd", "target_id": "cs1_vpn3", "tunnel_ip": "10.253.1.10/32" }, { "egress_class": "cs2", "in_counter": "peer_10_253_1_11/32_in_vpn", "in_rule": "iifname \"eth2\" oifname \"wg_paid\" ip daddr 10.253.1.11/32 counter name \"peer_10_253_1_11/32_in_vpn\"", "out_counter": "peer_10_253_1_11/32_out_vpn", "out_rule": "iifname \"wg_paid\" oifname \"eth2\" ip saddr 10.253.1.11/32 counter name \"peer_10_253_1_11/32_out_vpn\"", "peer_id": "cb533a1a-7070-416d-9272-846327545060", "target_id": "cs2_vpn4", "tunnel_ip": "10.253.1.11/32" }, { "egress_class": "cs3", "in_counter": "peer_10_253_1_12/32_in_vpn", "in_rule": "iifname \"eth2\" oifname \"wg_paid\" ip daddr 10.253.1.12/32 counter name \"peer_10_253_1_12/32_in_vpn\"", "out_counter": "peer_10_253_1_12/32_out_vpn", "out_rule": "iifname \"wg_paid\" oifname \"eth2\" ip saddr 10.253.1.12/32 counter name \"peer_10_253_1_12/32_out_vpn\"", "peer_id": "a3cbe3b5-8416-4847-b5ee-21f42359b465", "target_id": "cs3_vpn5", "tunnel_ip": "10.253.1.12/32" }, { "egress_class": "cs4", "in_counter": "peer_10_253_1_13/32_in_vpn", "in_rule": "iifname \"eth2\" oifname \"wg_paid\" ip daddr 10.253.1.13/32 counter name \"peer_10_253_1_13/32_in_vpn\"", "out_counter": "peer_10_253_1_13/32_out_vpn", "out_rule": "iifname \"wg_paid\" oifname \"eth2\" ip saddr 10.253.1.13/32 counter name \"peer_10_253_1_13/32_out_vpn\"", "peer_id": "219a1f63-ec47-4f72-9663-c1a17d82301e", "target_id": "cs4_vpn1", "tunnel_ip": "10.253.1.13/32" }, { "egress_class": "cs5", "in_counter": "peer_10_253_1_14/32_in_vpn", "in_rule": "iifname \"eth2\" oifname \"wg_paid\" ip daddr 10.253.1.14/32 counter name \"peer_10_253_1_14/32_in_vpn\"", "out_counter": "peer_10_253_1_14/32_out_vpn", "out_rule": "iifname \"wg_paid\" oifname \"eth2\" ip saddr 10.253.1.14/32 counter name \"peer_10_253_1_14/32_out_vpn\"", "peer_id": "e4adcfa1-6fbc-4471-b66b-8d7837f35f9d", "target_id": "cs5_vpn2", "tunnel_ip": "10.253.1.14/32" } ], "hook": "forward", "nft_candidate_file": "candidate_router_egress_activity.nft", "priority": 0, "table": "inet router_egress_activity" }, "db_summary": { "active_leases": 0, "enabled_peers": 5, "forced_leases": 0, "idle_leases": 5, "lease_rows": 5, "pending_jobs": 0 }, "mode": "READONLY_DESIGN_VM100_INNER_TRAFFIC_ACTIVITY_COUNTERS_FOR_RUNTIME_EGRESS_ALLOCATOR", "publish": { "local_report": "http://127.0.0.1:8099/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260709-133108_step044g_runtime_egress_activity_counters_design/", "public_index_rebuilt": true, "trycf_report": "https://helena-background-beam-harry.trycloudflare.com/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260709-133108_step044g_runtime_egress_activity_counters_design/" }, "sampler_contract": { "active_delta_formula": "delta_packets = out_delta_packets + in_delta_packets; delta_bytes = out_delta_bytes + in_delta_bytes", "active_threshold": { "bytes_min": 16384, "packets_min": 10, "window_seconds": 120 }, "counter_pairs_per_peer": 2, "directions": { "in_vpn": "iifname \"eth2\" oifname \"wg_paid\" ip daddr TUNNEL_IP", "out_vpn": "iifname \"wg_paid\" oifname \"eth2\" ip saddr TUNNEL_IP" }, "idle_threshold_seconds": 900, "important_not_metric": "WireGuard latest-handshake/keepalive is not enough to mark peer active", "source": "nft named counters in table inet router_egress_activity", "why_both_directions": "Download-heavy clients may have small client->VPN request traffic but large VPN->client response traffic; both are useful inner traffic and load the egress slot." }, "schema": "router-step-facts-v1", "step": "STEP_044G_RUNTIME_EGRESS_ACTIVITY_COUNTERS_DESIGN", "vm100_detected_interfaces": { "activity_iif_device": "wg_paid", "activity_oif_device": "eth2", "transit_direct": { "device": "eth0", "interface": "transit_direct", "l3_device": "eth0", "proto": "static", "raw_present": true, "up": true }, "transit_vpn": { "device": "eth2", "interface": "transit_vpn", "l3_device": "eth2", "proto": "static", "raw_present": true, "up": true }, "wg_paid": { "device": null, "interface": "wg_paid", "l3_device": "wg_paid", "proto": "wireguard", "raw_present": true, "up": true } } }