[almaslennikov]

Add native Go l8k discover --target dpf for a DPU estate independent of Host Network Operator deployment. Explicit site YAML selects host/DPU Redfish or host/ARM SSH access, credential references and TLS/SSH trust. Inventory can run before management Kubernetes exists; a supplied management kubeconfig must work.

Completion requires explicit DPU BMC endpoints and read-only verification of each session's Administrator privileges, matching enabled/unlocked account, password-change state and role. SSH identity cannot substitute. Account lookup supports bounded pagination and a single terminal slash on advertised member links, while rejecting unsafe paths and duplicate aliases. Requests use the validated advertised URI. Discovery never changes passwords or roles.

Physical association uses host/card serial identity, rejects contradictory PCI vendor information, and requires final identity rereads. BF4 B4240 readers follow explicit System/chassis relationships and retain identity-bound PSID observations where available. Optional OS/network, per-card firmware/PSID, MFT, NVConfig and restriction queries use existing read tools. Every unavailable or failed observation retains an actionable reason. After an optional SSH command timeout, the next read can reconnect with the original endpoint, credentials and host-key trust; the failed command is not replayed. Reconnection failures, cancellation and changed identity still block completion.

Inventory v1alpha3 publishes named host/DPU facts and field-specific issues. Generic observation maps, raw vendor firmware dumps and successful-state bookkeeping are omitted. Persisted YAML omits all provenance maps and references, including nested management, SSH, address-lookup and probe records, while preserving arbitrary user data-map keys. JSON diagnostic reports retain their source contracts. Host BMC output excludes firmware/time data; DPU firmware retains known activation and distinct ERoT components. Equivalent whitespace spellings cannot abort publication, but measured versions remain unchanged and padded versions cannot prove a software minimum. Version-aware decoding preserves conservative legacy input semantics and rejects contradictory facts.

dpf.release selects an independent embedded software BOM, defaulting to 26.4.0. Public output contains artifact coordinates, exact hardware applicability and named documented minima; omitted minima remain unknown. Catalog source lists and generic requirement lists stay internal. Compatibility never accepts partial, conflicting or inactive firmware as a running minimum. The catalog does not qualify hardware or enable provisioning.

Refresh preserves user intent, credential references, comments, explicit values and prior successful output on partial failure. Address comparison retains locator facts and source outcomes while ignoring candidate references and source-byte digests. Copy-only normalization keeps wire-equivalent empty management-node and host/ARM runtime facts stable across YAML/JSON save and reload. Whole absent network/hardware observations remain distinguishable; nonempty values, failed-source reasons and actual address, route and interface changes remain material. scopeDigest protects endpoint/trust selection without duplicating requested endpoints in inventory. Optional address lookup uses explicit MAC selectors and bounded local lease/observed-neighbor sources; candidates never establish identity or receive credentials. No subnet scanning, tool installation, Python discovery runtime or custom discovery image is introduced.

The CLI streams named operations and status on stderr, then reports host/DPU mappings and administrator verification. Required inventory failures remain distinct from deferred provisioning checks. --quiet suppresses progress; --output json keeps stdout to one final document. Debug/trace logs provide bounded stage, timing and request metadata without credentials or raw remote output.

User documentation covers initial inventory, address lookup and refresh, explaining which operations run on the CLI, host OS, DPU ARM OS, BMC and management API. Each workflow has a diagram generated from repository-owned OpenSpec workflow definitions. Engineering plans and lab/test history are kept out of user guides. Discovery reference, workflow source, design and OpenSpec contracts describe reason persistence and timeout recovery.

Local validation:

• Repository make build and make test passed; all DPF packages and the target adapter passed race tests.
• Pinned repository lint reported zero issues. Strict MkDocs, workflow generation/drift, and CLI documentation contracts passed.
• Regression coverage verifies current/legacy YAML save and reload, unchanged fingerprints and refresh backups, unchanged JSON/model values, and arbitrary data-map keys that match provenance field names.
• Independent review of the exact typed YAML filtering, material comparison and actual publish/reload flow found no blocking defect. Publication/reload regressions cover all three supported inventory versions; candidate fact/status changes and real node address/route/interface changes remain detectable. The preceding baseline also passed full repository race tests and hosted CI.

Hardware qualification remains unqualified and deployment acceptance remains not evaluated. Management-network probes stay gated. DPF generate/deploy/validate, hypervisor discovery and post-operator service validation are outside this preview. HBN-BGP discovery and lifecycle support will be delivered separately.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The latest changes appear safe to merge.

Summary

Adds Go-based DPF inventory discovery, a separate release software BOM, typed inventory output and operator workflows.

• The DPF discovery command reads selected host and DPU sources and builds a mapped inventory.
• Complete DPF runs publish a named inventory while partial runs keep their own results.
• The DPF inventory includes a release-specific software BOM and documented hardware minima.
• Optional MAC lookup adds address candidates without connecting to them.
• The guides and workflow references explain how DPF inventory discovery fits into an operator's work.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Explicit site inputs] --> B[Read selected Redfish or SSH sources]
  B --> C[Recheck identity and match cards to hosts]
  C --> D[Check required results and compare saved facts]
  D --> E{Required checks pass?}
  E -->|Yes| F[Publish inventory]
  E -->|No| G[Save partial results and preserve prior handoff]

Loading

_{Reviews (20) · Last reviewed commit: "fix(dpf): compare persisted empty runtim..." · Reviewed by Greptile}

[almaslennikov]

Updated the implementation in amended commit cb15c24709b1eda3e2b833f389a51bc2f48bb301.

Discovery now reuses digest-pinned nicolaka/netshoot:v0.16; removed the custom image Dockerfile, Go helper executable and netlink-only dependencies. Registry coordinates were verified, and actual-image tests passed on Linux amd64 and arm64. The inspected NVIDIA toolbox is a September2023 Ubuntu23.04 image; the tested DOCA3.3 runtime variants lack curl/ip. Kubernetes runtime qualification remains gated.

Addressed the review findings:

1. Absolute Redfish links: normalize collection members and adapter links through the same-origin guard before identity/deduplication comparisons; normalize card-to-System associations. Real TLS collector fixtures cover relative/absolute links, explicit selection, replacement and foreign-origin rejection.
2. Read failures versus replacement: management recheck errors have a separate failure code; scope digests are compared only when both are known. Added initial/recheck outage regressions preserving partial status and the baseline. This distinction is specifically for management checks; existing Redfish final-read diagnostics remain a documented fail-closed limitation.
3. Management probe path: construct /version from an absolute path, preserving API base paths. The runner's generated request now passes the shared request preparation exercised by admission fixtures.
4. Quiet output: honor programmatic invocation Output.Quiet for informational progress. This does not add a discover-level --quiet flag.

The independent follow-up review also found that jq accepted multiple JSON documents. The adapter now requires exactly one object; actual-image regressions cover both object/object and scalar/object bodies.

Local validation passed: full race suite, pinned lint, five-platform builds, actual-image tests for both architectures, CLI/docs contracts and strict MkDocs. Hosted CI must rerun for this amended head; no live management cluster or BMC was used.

[almaslennikov]

Added explicit BMC TLS opt-out in 6b4fd58 and corrected public Redfish session-link handling in f8b1c93.

• Verification remains the default. The insecure policy is captured in each affected requested-scope entry and changes the scope digest; cached access cannot leak the setting between endpoints. Management API and probe TLS remain strict.
• Login uses the public root's advertised standard session link, including same-origin absolute/trailing-slash forms, without requiring a protected SessionService GET. Cleanup remains limited to the exact returned session child.
• Local full race tests passed after the TLS change; focused DPF/target race tests passed after the session change. Final Redfish race tests, lint, native/Linux-amd64 builds, docs contracts and strict MkDocs passed. Hosted checks are tracked separately.

Authorized lab retries confirmed that TLS bypass and session login work. Management and candidate HPE inventory were collected, but DPU reads returned403 and DPU session cleanup was incomplete. Host adapter coverage also needs qualification. These results do not qualify the hardware or management probe image; the existing gates remain closed. No firmware, power, account-policy or Kubernetes changes were made.