Block a user
tomswallapi_device_config data source + rule fanout preview
Plan-time validation of selector grammar and cross-resource invariants
Structured source/dest schema + computed
set_name; fix the README example
Explicit
priority on rules and policies
Mark FRR-dependent invariants as unenforced until peering lands
Default
TOMSWALLAPI_DB_SSLMODE to require; document local-dev override
Convergence/staleness alerting endpoint
Guardrails on ASN group refresh deltas
Two-phase rollout for subnet↔zone moves
Wrap startup migrations in a Postgres advisory lock
Shared wire-types module across API, agent, and provider
Replace shared agent bearer token with per-device credentials
Parity test harness: golden-file diffs against shorewall + netns integration tests
Safe-apply: confirm-or-revert (
try / safe-restart equivalent)
Agent: native nft named-set references instead of inlining members
Agent: strict config unmarshal + schema version check — reject configs with unknown fields
Long-tail batch 5 (API): secmark/var + render blrules/conntrack