{ "assessment": { "all_ok": true, "blockers": [], "decision": "PASS_STEP_044G2_ACTIVITY_COUNTER_NAME_SANITIZE_DESIGN_CLOSE", "expected_absence": { "activity_table_already_present_before_implementation": false, "candidate_nft_applied": false, "force_mode_enabled": false, "manual_agent_service_start_used": false, "private_material_published": false, "rebalance_paused": false, "unsafe_counter_name_seen": false, "vm100_changed": false, "vm101_changed": false, "vm121_changed": false }, "success_checks": { "active_leases_zero": true, "candidate_nft_created": true, "candidate_nft_has_out_and_in_rules": true, "cidr_preserved_in_rules": true, "counter_names_have_no_dot": true, "counter_names_have_no_slash": true, "counter_names_sanitized": true, "counter_plan_rows_five": true, "enabled_peer_count_five": true, "forced_leases_zero": true, "idle_leases_five": true, "lease_rows_five": true, "leases_query_ok": true, "pending_jobs_zero": true, "public_index_rebuilt": true, "public_report_created": true, "sampler_contract_created": true, "settings_query_ok": true, "transit_vpn_l3_device_detected": true, "vm100_allowed_ip_count_five": true, "vm100_confirm_collected": true, "vm100_peer_count_five": true, "vm121_read_model_collected": true, "wg_paid_l3_device_detected": true }, "warnings": [ "STEP_044G2 is read-only; corrected candidate nft is generated but not applied.", "Use sanitized candidate for STEP_044H implementation, not the original STEP_044G candidate with /32 in counter names." ] }, "changes": { "candidate_nft_applied": "NO", "manual_agent_service_start_used": "NO", "private_material_published": "NO", "vm100_changed": "NO", "vm101_changed": "NO", "vm121_changed": "NO_READONLY_DESIGN_CLOSE" }, "counter_plan": { "candidate_file": "candidate_router_egress_activity_sanitized.nft", "chain": "forward_activity", "counter_rows": [ { "egress_class": "cs1", "in_counter": "peer_10_253_1_10_in_vpn", "in_rule": "iifname \"eth2\" oifname \"wg_paid\" ip daddr 10.253.1.10/32 counter name \"peer_10_253_1_10_in_vpn\"", "out_counter": "peer_10_253_1_10_out_vpn", "out_rule": "iifname \"wg_paid\" oifname \"eth2\" ip saddr 10.253.1.10/32 counter name \"peer_10_253_1_10_out_vpn\"", "peer_id": "376dfa07-0ba4-4182-af39-389a2cb3badd", "target_id": "cs1_vpn3", "tunnel_cidr": "10.253.1.10/32", "tunnel_ip": "10.253.1.10" }, { "egress_class": "cs2", "in_counter": "peer_10_253_1_11_in_vpn", "in_rule": "iifname \"eth2\" oifname \"wg_paid\" ip daddr 10.253.1.11/32 counter name \"peer_10_253_1_11_in_vpn\"", "out_counter": "peer_10_253_1_11_out_vpn", "out_rule": "iifname \"wg_paid\" oifname \"eth2\" ip saddr 10.253.1.11/32 counter name \"peer_10_253_1_11_out_vpn\"", "peer_id": "cb533a1a-7070-416d-9272-846327545060", "target_id": "cs2_vpn4", "tunnel_cidr": "10.253.1.11/32", "tunnel_ip": "10.253.1.11" }, { "egress_class": "cs3", "in_counter": "peer_10_253_1_12_in_vpn", "in_rule": "iifname \"eth2\" oifname \"wg_paid\" ip daddr 10.253.1.12/32 counter name \"peer_10_253_1_12_in_vpn\"", "out_counter": "peer_10_253_1_12_out_vpn", "out_rule": "iifname \"wg_paid\" oifname \"eth2\" ip saddr 10.253.1.12/32 counter name \"peer_10_253_1_12_out_vpn\"", "peer_id": "a3cbe3b5-8416-4847-b5ee-21f42359b465", "target_id": "cs3_vpn5", "tunnel_cidr": "10.253.1.12/32", "tunnel_ip": "10.253.1.12" }, { "egress_class": "cs4", "in_counter": "peer_10_253_1_13_in_vpn", "in_rule": "iifname \"eth2\" oifname \"wg_paid\" ip daddr 10.253.1.13/32 counter name \"peer_10_253_1_13_in_vpn\"", "out_counter": "peer_10_253_1_13_out_vpn", "out_rule": "iifname \"wg_paid\" oifname \"eth2\" ip saddr 10.253.1.13/32 counter name \"peer_10_253_1_13_out_vpn\"", "peer_id": "219a1f63-ec47-4f72-9663-c1a17d82301e", "target_id": "cs4_vpn1", "tunnel_cidr": "10.253.1.13/32", "tunnel_ip": "10.253.1.13" }, { "egress_class": "cs5", "in_counter": "peer_10_253_1_14_in_vpn", "in_rule": "iifname \"eth2\" oifname \"wg_paid\" ip daddr 10.253.1.14/32 counter name \"peer_10_253_1_14_in_vpn\"", "out_counter": "peer_10_253_1_14_out_vpn", "out_rule": "iifname \"wg_paid\" oifname \"eth2\" ip saddr 10.253.1.14/32 counter name \"peer_10_253_1_14_out_vpn\"", "peer_id": "e4adcfa1-6fbc-4471-b66b-8d7837f35f9d", "target_id": "cs5_vpn2", "tunnel_cidr": "10.253.1.14/32", "tunnel_ip": "10.253.1.14" } ], "hook": "forward", "priority": 0, "table": "inet router_egress_activity" }, "db_summary": { "active_leases": 0, "enabled_peers": 5, "forced_leases": 0, "idle_leases": 5, "lease_rows": 5, "pending_jobs": 0 }, "mode": "READONLY_CLOSE_COUNTER_DESIGN_WITH_SAFE_NFT_COUNTER_NAMES", "publish": { "local_report": "http://127.0.0.1:8099/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260709-133718_step044g2_activity_counter_name_sanitize_design_close/", "public_index_rebuilt": true, "trycf_report": "https://helena-background-beam-harry.trycloudflare.com/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260709-133718_step044g2_activity_counter_name_sanitize_design_close/" }, "sampler_contract": { "active_delta_formula": "delta_packets = out_delta_packets + in_delta_packets; delta_bytes = out_delta_bytes + in_delta_bytes", "active_threshold": { "bytes_min": 16384, "packets_min": 10, "window_seconds": 120 }, "address_match_policy": "preserve CIDR from DB, e.g. 10.253.1.10/32", "counter_name_policy": "peer__, no slash and no dot", "directions": { "in_vpn": "iifname \"eth2\" oifname \"wg_paid\" ip daddr TUNNEL_CIDR", "out_vpn": "iifname \"wg_paid\" oifname \"eth2\" ip saddr TUNNEL_CIDR" }, "idle_threshold_seconds": 900, "important_not_metric": "WireGuard latest-handshake/keepalive is not enough to mark peer active", "source": "nft named counters in table inet router_egress_activity" }, "schema": "router-step-facts-v1", "step": "STEP_044G2_ACTIVITY_COUNTER_NAME_SANITIZE_DESIGN_CLOSE" }