Dev/rodpersky/p2 all changes

[Rod-Persky]

No description provided.

[Copilot]

Pull request overview

This PR extends the workspace’s TACACS+ YANG config pipeline to support RFC 9950 “central keystore/truststore” reference shapes end-to-end (parse/validate/enumerate/round-trip), and introduces a new provider-neutral crate (tacacsrs-credential-resolution) that plans and validates secret resolution without performing provider I/O.

Changes:

• Add central credential reference inspection in tacacsrs-config (inspect_central_references) and update validation/enumeration/tests to preserve central reference values as opaque strings.
• Introduce tacacsrs-credential-resolution with deterministic request planning, an async resolver trait, secret-safe material types, and a closed request/result matcher (plus example + tests).
• Pin and verify deterministic YANG generation inputs/outputs (manifest + verification scripts), and update docs/README to reflect the new layering.

Reviewed changes

Copilot reviewed 38 out of 39 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Documents the new crate and updated config/resolution layering.
libraries/tacacsrs_networking/src/transport/tls_psk/from_server.rs	Updates test server construction for new generated EPSK fields.
libraries/tacacsrs_networking/src/transport/tls_psk/context.rs	Updates EPSK test construction for new generated fields.
libraries/tacacsrs_networking/src/transport/tls_psk/config.rs	Updates EPSK test construction for new generated fields.
libraries/tacacsrs_credential_resolution/tests/resolution.rs	Adds end-to-end planning/resolution/result-set validation tests (including redaction expectations).
libraries/tacacsrs_credential_resolution/tests/material_safety.rs	Adds compile-time and runtime checks ensuring secret-bearing types don’t implement risky traits and redact debug output.
libraries/tacacsrs_credential_resolution/src/result_set.rs	Implements the closed result-set validator and redacted debug output.
libraries/tacacsrs_credential_resolution/src/resolver.rs	Defines the async resolver trait and plan execution helper.
libraries/tacacsrs_credential_resolution/src/request.rs	Implements deterministic planning and typed request/reference abstractions.
libraries/tacacsrs_credential_resolution/src/material.rs	Adds secret-safe material containers (SecretBytes, PublicBytes) and resolved credential variants.
libraries/tacacsrs_credential_resolution/src/lib.rs	Crate facade and re-exports.
libraries/tacacsrs_credential_resolution/src/fake.rs	Deterministic fake resolver for tests/examples.
libraries/tacacsrs_credential_resolution/src/error.rs	Typed, sanitized resolution errors.
libraries/tacacsrs_credential_resolution/README.md	Documents the provider-neutral contract and safety/redaction guarantees.
libraries/tacacsrs_credential_resolution/examples/central_resolution.rs	Runnable example showing planning + fake resolution for a central-reference config.
libraries/tacacsrs_credential_resolution/Cargo.toml	Adds the new crate and its dependencies.
libraries/tacacsrs_config/yang/verify_generated.py	Adds deterministic generation verification against a pinned manifest.
libraries/tacacsrs_config/yang/test_expand_yang_tree.py	Adds unit tests for cache revision pinning + manifest verification.
libraries/tacacsrs_config/yang/generation-manifest.json	Records pinned upstream commit + SHA-256s for inputs/outputs.
libraries/tacacsrs_config/yang/feature-flags.ini	Enables central-keystore/truststore-related model feature flags.
libraries/tacacsrs_config/yang/expanded-tree.txt	Updates the pinned expanded YANG tree output to include central reference paths.
libraries/tacacsrs_config/yang/expand_yang_tree.py	Pins upstream revision, enforces detached-HEAD cache, and improves cache cleaning.
libraries/tacacsrs_config/tests/parse_validation.rs	Updates expected validation messages for new choice cases and constraints.
libraries/tacacsrs_config/tests/generated_types.rs	Adds tests asserting generated shapes and choice metadata for central references.
libraries/tacacsrs_config/tests/enumeration_integration.rs	Adds integration tests ensuring enumeration preserves nested central references/metadata.
libraries/tacacsrs_config/tests/central_validation.rs	Adds validation tests covering central-only, dual-choice rejection, and mandatory choice enforcement.
libraries/tacacsrs_config/tests/central_roundtrip.rs	Adds round-trip tests ensuring central reference values serialize/parse exactly.
libraries/tacacsrs_config/tests/central_references.rs	Adds tests for deterministic inspection slots and redacted debug behavior.
libraries/tacacsrs_config/src/validation.rs	Extends choice validation for central keystore/truststore cases and validates server-credential bundles.
libraries/tacacsrs_config/src/lib.rs	Exposes the new central reference inspection API at top-level and under runtime.
libraries/tacacsrs_config/src/generated.rs	Updates generated types to include central-keystore/truststore reference fields and choice metadata.
libraries/tacacsrs_config/src/central_references.rs	Adds provider-neutral inspection of central references as deterministic typed slots.
libraries/tacacsrs_config/src/builders.rs	Updates builders to populate new generated fields with None.
libraries/tacacsrs_config/README.md	Updates crate docs to describe central inspection and the new resolution boundary.
docs/yang-config-guide.md	Updates guide to include central inspection and the credential-resolution workflow.
DEVELOPMENT.md	Documents pinned YANG generation inputs/outputs, determinism verification, and layering boundaries.
Cargo.toml	Adds tacacsrs-credential-resolution to the workspace members.
Cargo.lock	Adds lock entries for the new crate and new dev dependency (static_assertions).
.gitattributes	Ensures LF normalization for generated/config generation artifacts.

Comments suppressed due to low confidence (1)

libraries/tacacsrs_config/src/validation.rs:390

• validate_choice relies on case_presence having the same number of elements as choice_cases, but it never checks that invariant. Now that central-keystore/truststore adds extra choice cases, a future caller bug (wrong boolean slice length) could silently misvalidate config and produce misleading errors.

Consider adding an explicit length check and failing fast with an internal error message.

fn validate_choice(
    server_name: &str,
    field_path: &str,
    choice_cases: &[(&str, &[&str])],
    mandatory: bool,

[Copilot]

Pull request overview

Copilot reviewed 38 out of 39 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

libraries/tacacsrs_config/src/validation.rs:444

• Same issue as above for client-credentials bundles: gating reject_unsupported_epsk_derivation() on inline_definition.is_some() means context / target-* fields are accepted for central-keystore-reference EPSKs even though the runtime transport currently doesn't act on them.

Unless the central-resolution path already supports these derivation fields, keep rejecting them for all EPSK configs to avoid silently accepting unsupported settings.

) -> anyhow::Result<()> {
    if let Some(ref epsk) = creds.tls13_epsk {
        if epsk.inline_definition.is_some() {
            reject_unsupported_epsk_derivation(context, epsk)?;
        }
    }

libraries/tacacsrs_config/src/validation.rs:431

• reject_unsupported_epsk_derivation() is now only applied when epsk.inline_definition.is_some(). That allows configs using central-keystore-reference to set context, target-protocol, or target-kdf without being rejected, but the TLS-PSK transport currently doesn't consume those fields at all (only identity/hash/groups + key bytes), so they'd be silently ignored if/when central-key resolution is wired up.

If these fields are still unsupported end-to-end, reject them regardless of whether the key is inline or central to avoid accepting configuration that the runtime cannot honor.

This issue also appears on line 439 of the same file.

    if let Some(ref epsk) = ci.tls13_epsk {
        if epsk.inline_definition.is_some() {
            reject_unsupported_epsk_derivation(context, epsk)?;
        }
    }