Agent: native nft named-set references instead of inlining members #10

New Issue

2026-07-26T17:01:26+10:00

benvin commented

2026-07-26 17:01:26 +10:00

Problem. The agent currently inlines named-set members as concrete
addresses when translating the rendered model (noted as a tracked follow-up in
e0f54ef). This inverts the design's critical property (DESIGN.md §7.3:
"membership is the only thing that churns; rules are stable"):

Every DNS TTL expiry or ASN refresh becomes a rule diff instead of a
set-element op — rule churn, generation churn, larger atomic applies.
ASN groups are large: inlining thousands of prefixes into every referencing
rule multiplies ruleset size and diff cost.

Proposal. Materialize each address group as a real nft named set
(flags interval for CIDRs; inet family or parallel v4/v6 sets per §8.3) and
compile rules as set lookups. Element deltas travel on the lighter set feed and
never bump the rule generation.

Acceptance. Changing a dns/asn group's membership produces zero rule
operations in the differential apply — only add/delete element. Rule count is
independent of group cardinality.

Suggest treating this as blocking for any multi-device rollout: the control
plane doesn't deliver its design until sets are native.

**Problem.** The agent currently inlines named-set members as concrete addresses when translating the rendered model (noted as a tracked follow-up in e0f54ef). This inverts the design's critical property (DESIGN.md §7.3: "membership is the only thing that churns; rules are stable"): - Every DNS TTL expiry or ASN refresh becomes a *rule* diff instead of a set-element op — rule churn, generation churn, larger atomic applies. - ASN groups are large: inlining thousands of prefixes into every referencing rule multiplies ruleset size and diff cost. **Proposal.** Materialize each address group as a real nft named set (`flags interval` for CIDRs; inet family or parallel v4/v6 sets per §8.3) and compile rules as set lookups. Element deltas travel on the lighter set feed and never bump the rule generation. **Acceptance.** Changing a dns/asn group's membership produces zero rule operations in the differential apply — only `add/delete element`. Rule count is independent of group cardinality. Suggest treating this as blocking for any multi-device rollout: the control plane doesn't deliver its design until sets are native.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/tomswall#10