feature-gates.txt

# Feature-gate manifest -- SINGLE SOURCE OF TRUTH for compile-out-able features.
#
# One line per gated package:  <build-tag>   <gated-package>
#
# A feature guarded by //go:build <build-tag> is reached ONLY through gated
# registration (the construction registry in cmd/ze/hub/service_registry.go, or
# an ssh_infra.go-style seam). Nothing always-on (untagged, non-test) imports
# <gated-package>; that is what lets the linker drop it when the tag is off.
#
# THIS FILE IS THE ONE PLACE A GATE IS DECLARED, and it has two readers.
# internal/le/repo/featuretags is the Go one, and every Go consumer derives from it:
#   - internal/le/go/toolchain derives the default daemon and test build tags
#   - internal/test/runner.TestBuildTags adds the functional-test personality
#   - internal/le/plugin/imports gates each package and its YANG package
#   - internal/le/arch/tier proves no always-on package imports a gated package
#   - internal/le/repo/changed and internal/le/go/staticcheck scope the gates
#   - internal/le/plugin/gatedtable writes the always-compiled table of gated
#     plugin names and the tags that carry them
# feature-tags is the shell one, for the bootstrap that has no le binary yet:
# the root ze and le launchers and the two Docker images source it.
#
# Four consumers cannot parse this manifest at runtime: .golangci.yml
# build-tags, gokrazy/ze/config.json GoBuildTags, the go install command in
# docs/guide/quickstart.md, and the shipped CodeQL build combinations.
# `./le repo feature-tags update` regenerates those lists, and `./le repo feature-tags
# check` rejects drift. Native stress, integration, and deployment actions read
# their daemon tags through the same Go parser.
#
# To add a feature gate, add each package that must disappear below, create its
# gated registration or seam, then run `./le repo update`, which rewrites the
# derived tag lists, the composition root and the gated-plugin table. The full
# procedure is in docs/architecture/plugin/feature-gates.md.
#
# Lines are "<tag> <pkg>"; '#' comments and blank lines are ignored. Reuse the
# same tag for feature-owned sidecar packages such as command schema. The
# generator gates both the direct package and its <pkg>/yang schema package when
# either is discovered.
#
# columns: <build-tag>   <gated-package>
ze_lg    internal/component/lg
ze_ssh   internal/component/ssh
ze_web   internal/component/web
ze_gnmi  internal/component/gnmi
ze_gnmi  internal/plugins/gnmi-cmd
ze_mcp   internal/component/mcp
ze_rest  internal/component/api/rest
ze_grpc  internal/component/api/grpc
ze_telemetry  internal/component/telemetry/exporter
ze_telemetry  internal/component/telemetry/collector
ze_isis    internal/plugins/isis
ze_isis    internal/plugins/isis/cli
ze_isis    internal/plugins/isis/transport
ze_ldp     internal/plugins/ldp
ze_ospf    internal/plugins/ospf
ze_ospf    internal/plugins/ospf/cli
ze_ospf    internal/plugins/ospf/transport
ze_ospf    internal/plugins/ospf/v3/transport
ze_rsvpte  internal/plugins/rsvpte
ze_vrrp    internal/plugins/vrrp
ze_vrrp    internal/plugins/vrrp/transport

# ze_ntp -- NTP client (system clock synchronization). Single self-registering
# plugin, all.go-only composition root (registry CLIHandler, no dispatch
# companion). The show-system NTP block reads it through the nil-safe
# registry.GetNTPSyncInfo seam, so always-on code never imports the package.
# ntp/events and ntp/yang are dropped transitively (spec-feature-gate-12).
ze_ntp     internal/plugins/ntp

# spec-feature-gate-12 Group A -- self-registering plugins whose ONLY
# composition root is the generated all.go (no cmd/ze dispatch import, no
# always-on functional importer). Gating is pure blank-import partitioning:
# one line per dir all.go blank-imports (each auto-gates its /yang sibling;
# X/cmd lines cover the X/cmd/yang command-schema imports).

# ze_flowexport -- NetFlow v9 / IPFIX / sFlow flow export + its command schema.
ze_flowexport  internal/plugins/flowexport
ze_flowexport  internal/plugins/flowexport/ipfix
ze_flowexport  internal/plugins/flowexport/netflow9
ze_flowexport  internal/plugins/flowexport/sflow
ze_flowexport  internal/plugins/flowexport-cmd

# ze_ddos -- DDoS detection and mitigation (detect + flowspec/flowtriq/local/
# observe responders; all augment the shared `ddos` config parent).
ze_ddos    internal/plugins/ddos/detect
ze_ddos    internal/plugins/ddos/flowspec
ze_ddos    internal/plugins/ddos/flowspec/cmd
ze_ddos    internal/plugins/ddos/flowtriq
ze_ddos    internal/plugins/ddos/local
ze_ddos    internal/plugins/ddos/local/cmd
ze_ddos    internal/plugins/ddos/observe
ze_ddos    internal/plugins/ddos/observe/cmd

# ze_anomaly -- traffic anomaly detection (detect) + shaping responder (shape)
# + incident lifecycle store (observe); all three augment the shared `anomaly`
# config parent.
ze_anomaly internal/plugins/anomaly/detect
ze_anomaly internal/plugins/anomaly/detect/cmd
ze_anomaly internal/plugins/anomaly/observe
ze_anomaly internal/plugins/anomaly/observe/cmd
ze_anomaly internal/plugins/anomaly/shape
ze_anomaly internal/plugins/anomaly/shape/cmd

# ze_as112 -- AS112 reverse-DNS sink server (RFC 7534).
ze_as112   internal/plugins/as112

# ze_geodns -- geo-aware authoritative DNS server.
ze_geodns  internal/plugins/geodns

# ze_dhcpserver -- DHCP server.
ze_dhcpserver  internal/plugins/dhcpserver

# ze_pxe -- netboot/install pair: TFTP server + HTTP image server (the PXE
# provisioning services from the install spec family; shared tag by design).
ze_pxe     internal/plugins/tftpserver
ze_pxe     internal/plugins/imageserver

# ze_trafficusage -- per-host traffic accounting (augments traffic { usage }).
ze_trafficusage  internal/plugins/trafficusage

# ze_policyroute -- policy-routing engine (`policy` config root).
ze_policyroute   internal/plugins/policyroute

# ze_cos -- class-of-service profiles (static config + dynamic RADIUS CoS).
ze_cos     internal/plugins/cos

# ze_copp -- control-plane policing.
ze_copp    internal/plugins/copp

# ze_mpls -- the MPLS show-forwarding component + `show mpls` command schema.
# Closes the inconsistency where ldp/rsvpte are gated but the shared MPLS
# operational surface was not. Kernel MPLS forwarding (fib/kernel) stays on.
ze_mpls    internal/component/mpls
ze_mpls    internal/plugins/mpls-cmd

# spec-feature-gate-12 Group B -- gates with extra composition roots beyond the
# generated all.go.

# ze_tacacs -- TACACS+ (RFC 8907) AAA backend. THREE roots: plugin/all
# (generated, the yang schema), aaa/all (hand-gated all_ze_tacacs.go sibling),
# and the ze dispatch root (gated cmd/ze/dispatch_tacacs.go for tacacs/cli).
# A tacacs-less build rejects `system { authentication { tacacs {} } }` as
# unknown, so AAA can never silently fall through a configured-but-missing
# method.
ze_tacacs  internal/component/tacacs
ze_tacacs  internal/component/tacacs/cli

# ze_exabgp -- the ExaBGP compatibility bridge plugin and the `ze exabgp` root
# command. Gates internal/plugins/exabgp (dispatch root, via gated
# cmd/ze/dispatch_exabgp.go) and the in-process bridge plugin. ExaBGP config
# migration is `ze exabgp migrate`, so it is gated with them. `ze config
# migrate` converts Ze's own older config forms, stays always-on in
# component/config, and imports only the internal/exabgp/topics library leaf,
# never this plugin.
ze_exabgp  internal/plugins/exabgp
ze_exabgp  internal/plugins/exabgp/bridgeplugin

# ze_bfd -- the BFD engine (RFC 5880/5881/5883): root plugin, engine, session,
# transport, auth, cmd, schema. The CLIENT CONTRACT stays always-on by design:
# internal/component/bfd/api is the nil-able seam (SetService/GetService)
# BGP/OSPF/static consume, and it re-exports State/Diag from bfd/packet
# (~500-line pure-stdlib codec), so api and packet are deliberately NOT listed
# here. All consumers nil-check GetService and degrade gracefully (BGP and OSPF
# log a warn, OSPF also has a doctor check; static logs info), so a bfd-less
# build runs BGP/OSPF/static unchanged. The analysis-tree schema pin moved to
# config/yang/cli/tree_bfd.go (//go:build ze_bfd).
ze_bfd     internal/component/bfd
ze_bfd     internal/component/bfd/cmd

# ze_vpp -- the VPP dataplane: the shared GoVPP connector component and every
# per-plugin VPP backend (fib, firewall, iface, traffic, static) plus the IKE
# IPsec vpp backend (source-tagged files in ike/dataplane and plugins/static;
# registry fallbacks keep netlink/kernel/xfrm behavior identical). Dropping the
# tag unlinks vendored govpp (~46k LOC) for netlink-only deployments. Without
# it the `vpp {}` component root fails at parse, and `backend vpp` under
# `traffic control`, `interface` or `firewall` is refused at validate, commit
# and boot, naming ze_vpp: each of those owners declares a config need on its
# optional edge to the vpp component (registry.ConfigNeed).
ze_vpp     internal/component/vpp
ze_vpp     internal/plugins/fib/vpp
ze_vpp     internal/plugins/firewall/vpp
ze_vpp     internal/plugins/iface/vpp
ze_vpp     internal/plugins/traffic/vpp
ze_vpp     internal/plugins/static/vpp

# ze_ike -- the IKEv2/IPsec VPN control plane: engine, ipsec config plumbing,
# command surface, schema (eap/wire/transport drop transitively with the
# engine). Two packages under internal/component/ike deliberately stay UNGATED.
# dataplane is the shared kernel-XFRM programming seam OSPF also uses for RFC
# 4552 authentication (plugins/ospf/ipsec_install.go), independent of the IKE
# daemon; its GoVPP file is ze_vpp-gated separately. crypto declares the IKEv2
# transform registry, which `show mtu` reads to size every IPsec tunnel the
# kernel holds (component/mtu/cmd/overhead.go), so it is a wire vocabulary a
# box needs whether or not ze runs an IKE daemon. The hub blank imports
# moved to cmd/ze/hub/register_ike.go; the web SA page is source-tagged with a
# not-in-this-build stub counterpart.
ze_ike     internal/component/ike
ze_ike     internal/component/ike/ipsec
ze_ike     internal/component/ike/cmd
ze_ike     internal/component/ike/engine

# ze_l2tp -- the BNG: L2TP LNS, PPPoE server/client, subscriber management,
# and the BNG-side plugins (local auth, address pool, shaper). The largest
# remaining subtree. Hub construction moved behind the bngRegister seam
# (cmd/ze/hub/bng_infra.go + register_l2tp.go); the `ze l2tp` CLI moved to the
# gated dispatch companion; the web session pages, the diag l2tp captures, and
# the cos dynamic RADIUS-CoS handler are source-tagged with not-in-this-build
# or no-op counterparts (dynamic CoS is a BNG feature: no sessions, no
# dynamic CoS). l2tp/events is listed so no always-on code quietly re-couples
# to the session event contract.
ze_l2tp    internal/component/l2tp
ze_l2tp    internal/component/l2tp/cli
ze_l2tp    internal/component/l2tp/cmd
ze_l2tp    internal/component/l2tp/events
ze_l2tp    internal/component/l2tp/pppoe
ze_l2tp    internal/component/l2tp/pppoe/cmd
ze_l2tp    internal/component/l2tp/pppoeclient
ze_l2tp    internal/component/l2tp/subscriber
ze_l2tp    internal/component/l2tp/subscriber/cmd
ze_l2tp    internal/component/l2tp/plugins/authlocal
ze_l2tp    internal/component/l2tp/plugins/pool
ze_l2tp    internal/component/l2tp/plugins/shaper

# ze_radius -- the RADIUS (RFC 2865) client library and AAA backend. Usable
# without l2tp (system authentication via aaa/all's gated all_ze_radius.go
# sibling). The l2tp RADIUS auth plugin is the DEPENDENT piece: authradius
# lives under the ze_l2tp path, so the generator emits its group file with the
# compound constraint `ze_l2tp && ze_radius` (parentTagOf path nesting, the
# ze_bmp shape) -- an l2tp-with-local-auth build can drop RADIUS entirely.
ze_radius  internal/component/radius
ze_radius  internal/component/l2tp/plugins/authradius

# MRT routing-information export (RFC 6396) is a BGP plugin under ze_bgp, with
# no tag of its own: every MRT stream is BGP data, and its TABLE_DUMP_V2 RIB
# dump is filled only by bgp-rib (registry.SetRIBDumpCallback). A build without
# BGP carries no MRT, so `mrt {}` there is refused at parse (an unknown
# top-level keyword, as `bgp {}` is) rather than loading a recorder with nothing
# to record. Its reactor bridges stay
# self-registered into the plugin-registry seam (registry.SetMRTMessageCallback /
# SetMRTPeerCallback) and read by bgp/config. Its msgtype / internal/mrt
# dependencies are pure libraries dropped by dead-code elimination once the BGP
# engine is compiled out (feature-gate-11).
ze_bgp     internal/plugins/mrt

# ze_bgp -- the BGP engine, codec and every BGP plugin. The largest gate: the
# whole internal/component/bgp subtree plus flowspec-firewall, which translates
# BGP-delivered flowspec routes into firewall rules and is meaningless without
# it. Nothing under internal/component/bgp carries a source build tag: the
# packages are dropped transitively once the generated all_ze_bgp.go owns their
# blank imports and every always-on importer is cleared (spec-feature-gate-10-bgp).
# Lines below are the base packages all.go blank-imports (each auto-gates its
# /yang sibling), plus bgp/{config,reactor,types,message,grmarker} -- packages
# always-on code used to import, listed so dep_audit --check actively asserts
# no always-on importer creeps back rather than relying on the nm proof alone.
ze_bgp   internal/component/bgp
ze_bgp   internal/component/bgp/cli
ze_bgp   internal/component/bgp/config
ze_bgp   internal/component/bgp/grmarker
ze_bgp   internal/component/bgp/message
ze_bgp   internal/component/bgp/plugin
ze_bgp   internal/component/bgp/plugins/adj_rib_in
ze_bgp   internal/component/bgp/plugins/aigp
# ze_bmp -- BMP receiver/sender (RFC 7854, 8671, 9069). A DEPENDENT gate: BMP
# imports the BGP engine (bgp/message, bgp/types) and monitors the BGP RIB, so it
# only exists in a ze_bgp build. Its package nests under internal/component/bgp,
# so the generator emits all_ze_bmp.go guarded //go:build ze_bgp && ze_bmp
# (path-nesting dependency; feature-gate-11). Default-on via ZE_FEATURES.
ze_bmp   internal/component/bgp/plugins/bmp
ze_bgp   internal/component/bgp/plugins/capa
ze_bgp   internal/component/bgp/plugins/cmd/announce
ze_bgp   internal/component/bgp/plugins/cmd/cache
ze_bgp   internal/component/bgp/plugins/cmd/commit
ze_bgp   internal/component/bgp/plugins/cmd/monitor
ze_bgp   internal/component/bgp/plugins/cmd/peer
ze_bgp   internal/component/bgp/plugins/cmd/policy
ze_bgp   internal/component/bgp/plugins/cmd/raw
ze_bgp   internal/component/bgp/plugins/cmd/rib
ze_bgp   internal/component/bgp/plugins/cmd/update
ze_bgp   internal/component/bgp/plugins/epe
ze_bgp   internal/component/bgp/plugins/filter_aspath
ze_bgp   internal/component/bgp/plugins/filter_aspath_length
ze_bgp   internal/component/bgp/plugins/filter_community
ze_bgp   internal/component/bgp/plugins/filter_community_match
ze_bgp   internal/component/bgp/plugins/filter_family
ze_bgp   internal/component/bgp/plugins/filter_irr
ze_bgp   internal/component/bgp/plugins/filter_modify
ze_bgp   internal/component/bgp/plugins/filter_path_asn
ze_bgp   internal/component/bgp/plugins/filter_prefix
ze_bgp   internal/component/bgp/plugins/filter_remove_private_as
ze_bgp   internal/component/bgp/plugins/gr
ze_bgp   internal/component/bgp/plugins/healthcheck
ze_bgp   internal/component/bgp/plugins/hostname
ze_bgp   internal/component/bgp/plugins/llnh
ze_bgp   internal/component/bgp/plugins/ls_export
ze_bgp   internal/component/bgp/plugins/nlri/evpn
ze_bgp   internal/component/bgp/plugins/nlri/flowspec
ze_bgp   internal/component/bgp/plugins/nlri/labeled
ze_bgp   internal/component/bgp/plugins/nlri/ls
ze_bgp   internal/component/bgp/plugins/nlri/mup
ze_bgp   internal/component/bgp/plugins/nlri/mvpn
ze_bgp   internal/component/bgp/plugins/nlri/rtc
ze_bgp   internal/component/bgp/plugins/nlri/srpolicy
ze_bgp   internal/component/bgp/plugins/nlri/vpls
ze_bgp   internal/component/bgp/plugins/nlri/vpn
ze_bgp   internal/component/bgp/plugins/redistribute_egress
ze_bgp   internal/component/bgp/plugins/rib
ze_bgp   internal/component/bgp/plugins/rib/poolcmd
ze_bgp   internal/component/bgp/plugins/role
ze_bgp   internal/component/bgp/plugins/route_refresh
ze_bgp   internal/component/bgp/plugins/route_refresh/handler
ze_bgp   internal/component/bgp/plugins/rpki
ze_bgp   internal/component/bgp/plugins/rpki_decorator
ze_bgp   internal/component/bgp/plugins/rr
ze_bgp   internal/component/bgp/plugins/rs
ze_bgp   internal/component/bgp/plugins/softver
ze_bgp   internal/component/bgp/plugins/watchdog
ze_bgp   internal/component/bgp/reactor
ze_bgp   internal/component/bgp/reactor/filter
ze_bgp   internal/component/bgp/types
ze_bgp   internal/plugins/flowspec-firewall