version: "11.0"
description: "Release order, router checks, and recovery behavior."
directives:
  - id: E-1110.9
    dos:
      - Run local preflight before Git checks or SSH setup.
      - Show the derived target and release options before router changes.
      - Require --yes before the release command can start.
      - Connect only after local checks pass.
      - Check for sudo and systemctl on the router.
      - Require a writable /config folder on the router.
      - Check available router disk capacity before upload.
      - Require more than 10240 kilobytes of available disk capacity in /config.
      - Require haproxy when a local script name contains haproxy.
      - Require file and uname when the bundle has an .exe script.
      - Upload the config to a unique path under the router user's home folder.
      - Stage the config and scripts before the interactive release sequence.
      - >-
        Open an interactive VyOS shell after VyOps uploads all files to temporary
        paths.
      - Start configure mode and load the staged config.
      - Disable terminal paging before the compare output.
      - Mark the compare output and include it in command output.
      - Run commit-confirm with a five-minute timer.
      - Answer yes when VyOS asks to confirm the commit.
      - Confirm the candidate before VyOps saves it.
      - Save the confirmed config before VyOps reports the end of release.
      - Download the active config after the router accepts the release.
      - Download router script state when the release synchronizes scripts.
      - >-
        Download the config and deployment manifest before local replacement when the release
        synchronizes scripts.
      - >-
        Replace the config and deployment manifest as one local update when the release
        synchronizes scripts.
      - Restore both local files if one replacement fails during script sync.
      - Keep the local deployment manifest when the release does not sync scripts.
      - Keep router script state separate from config.boot.manifest.tsv.
      - Write a nine-column tab-separated header to config.boot.deployment.tsv.
      - Write one deployment manifest record for each script path after script sync.
      - >-
        Use these columns in order: `kind`, `path`, `preexisting`, `old_mode`, `old_sha256`,
        `old_type`, `new_mode`, `new_sha256`, `new_type`.
      - Run optional system checks when --verify is set.
      - Run configured hooks after the config and scripts pass their checks.
      - Remove remote temporary files after success or failure.
      - Close all SSH clients before the command exits.
      - Reconnect after a release error and restore scripts when needed.
    donts:
      - Do not connect before preflight passes.
      - Do not continue when config load or commit-confirm reports an error.
      - Do not save the candidate before confirmation.
      - Do not claim success when the interactive sequence did not confirm.
  - id: E-1110.10
    dos:
      - >-
        Run show vrrp, show interfaces wireguard, show bgp summary, show ip route, and show
        haproxy when --verify is set.
      - Report an unconfigured VRRP, BGP, or HAProxy item as optional.
      - Report an empty WireGuard interface list as optional.
      - Write verification output after secret redaction.
      - Report a required verification failure and stop the release.
      - Reconnect before the interactive release sequence.
      - Reconnect before VyOps downloads the confirmed config.
      - Restore script files when the release does not confirm.
      - Keep confirmed script files when post-commit script finalization completes.
    donts:
      - Do not report a failed route check as optional.
      - Do not suppress a required verification failure.
  - id: E-1110.11
    dos:
      - Skip an unchanged release when the latest commit is a VyOps Pushback commit.
      - Skip this check when --force or --no-pushback is set.
      - Create a repository snapshot before release when pushback is enabled.
      - Push confirmed router state to Git unless --no-pushback is set.
      - Tell users that --no-pushback can keep router state and Git out of sync.
      - Tell users that --no-hooks skips all synced scripts.
      - Allow --verify-binaries to compare binary hashes after upload.
    donts:
      - Do not offer a release dry-run mode.
      - Do not run a release against two routers at the same time.