Summary

  • RFC 9826 standardizes how PCEP speakers expose configuration, operational state, sessions, events, actions and statistics; it does not make every exposed value an independently verified fact about the remote peer or data plane.
  • NMDA origin, observation time, counter discontinuity and management authorization must travel with a value before it can support a control decision.
  • The defensible evidence chain continues beyond the datastore through the PCEP exchange, controller decision, PCC acceptance, device application, forwarding state and observed service result.

The dangerous screen is not the obviously broken one. It is the polished screen on which every branch is populated. A local PCEP entity is enabled, a peer address exists, a session says up, a database version is present and request counters are rising. Each value may be accurate within the instrumented implementation. Together they still do not answer who the remote party really is, whether this read is fresh, which authority changed the configuration, which decision the controller made, what the PCC accepted, what the device installed or what traffic experienced.

RFC 9826 supplies a common YANG 1.1 vocabulary for that screen. Its value is substantial. The ietf-pcep module organizes the local entity, peers, sessions, notifications and operations; ietf-pcep-stats adds response-time observations, message counters and telemetry. The RFC Editor record, Datatracker history, errata search and IANA YANG registry establish the documentary identity of the standard and modules. They do not establish that a product implements them, that its instrumentation is correct or that any named network is healthy.

Intent and state share a tree, not a truth value

The entity branch exposes both writable and read-only nodes. admin-status is the desired operating state set by an operator or implementation default; oper-status is the present status of an attempt to reach that desire. Confusing the two turns intent into outcome. An enabled flag can coexist with an inactive entity, a retry loop or a resource constraint.

The distinction becomes clearer under NMDA. <intended> represents configuration after transformations and validation. <operational> includes applied configuration, learned, system, default and dynamic values, plus system state. Origin metadata can label a value as intended, dynamic, learned, system, default or unknown. That is provenance about the value's source. It is not an authentication result for the PCEP peer, a timestamp for a message exchange or proof that forwarding follows the represented state.

YANG 1.1 defines how the model is expressed, while NACM can restrict which management users read nodes, receive notifications or invoke operations. Model validity and access control answer different questions. A client may be authenticated but over-privileged; an allowed write may be unsafe; a permitted read may see a filtered projection. RFC 9826 requires YANG management protocols such as NETCONF or RESTCONF to use secure transport and mutual authentication, but transport identity still does not confer the business authority to change path-control settings.

A peer row is a local claim; a session is a timed observation

The model keys a peer by IP address and can record role, capabilities, delegation preference and authentication configuration. An address is operationally useful indexing. It is not durable human or organizational identity. The base PCEP specification defines the actual protocol exchange and says a session becomes established only after both peers receive a Keepalive. During collision resolution, two candidate sessions can temporarily exist for the same entity pair. RFC 9826 therefore keys its read-only session list by initiator and allows the transient pair before one is discarded.

That design prevents the model from lying about establishment mechanics, but it does not make session-up timeless. A session record needs a read instant, state-last-change, transport context and peer-authentication evidence. Local and remote session IDs are troubleshooting fields; they do not become global identities. Negotiated keepalive and dead timers describe one live session's terms, not a permanent relationship.

Notifications add event evidence: session up, session down, local overload, peer overload and their clearing transitions. Yet NACM can drop a notification for a subscription that lacks read permission. A disconnected collector can also miss one. Event absence is therefore not evidence of non-occurrence. The useful record joins the notification to a sequence or subscription epoch and reconciles it with a subsequent state read.

Counters need a beginning before they can describe a rate

The statistics module exposes message totals for PCReq, PCRep, PCErr, PCNtf, Keepalive and stateful operations, as well as response-time averages and watermarks. It also exposes discontinuity-time. Session statistics apply to current sessions and disappear when a session goes down. Per-peer or per-session reset actions can clear a container; an optional RPC can reset all PCEP statistics.

A count of 10,000 without its epoch cannot be compared safely with yesterday's 9,000. A reset can make a healthy system look idle, or make an outage disappear from a naive trend. reset-at and reset-finished-at are different moments. Monitoring should retain both, along with collector time, device boot and session identity. A rising pcupd-sent counter proves that the implementation counted messages in that class. It does not prove a correct path calculation, remote acceptance or an installed route.

The model also defines trigger-resync, asking a PCE to resynchronize state with a particular PCC as a sanity check. Acceptance of the RPC is only an operation receipt. The security section warns that unauthorized use can force continuous synchronization; unauthorized global counter reset can damage monitoring. For high-consequence operations, keep the authenticated management principal, NACM decision, request body, server receipt, protocol response and resulting state as separate records.

The LSP database stops before the packet

For a stateful PCE, the operational datastore can contain an LSP database keyed by PLSP-ID, PCC address and LSP-ID, with PCEP-specific state linked to generic traffic-engineering state. RFC 8231 defines the underlying stateful PCEP synchronization, reports, updates and delegation. A populated LSP-DB is valuable controller evidence. It is not a direct read of line-card programming or an observation of packets.

That boundary preserves earlier BTW commissions. RFC 9504 owns GMPLS stateful capability and bounded delegation, not the general management projection. RFC 9830 owns BGP distribution of SR Policy candidate paths from controller to headend. RFC 9863 owns PCEP Color capability and color semantics. RFC 9916 owns PCEPS TLS-version selection and its early-data prohibition. RFC 9826 can expose configuration and state relating to all of them without turning its datastore into proof that their distinct mechanisms succeeded.

The older PCEP MIB is mapped explicitly to corresponding entity, peer, session, statistics and notification nodes. The mapping supports migration and comparison; it does not create an independent second witness when both views depend on the same implementation counters.

Heng Lu's Running-Code Primacy offers the editorial rule: a coordination artifact cannot outrank what running participants actually implement. Minimum Initial Specification keeps common structure separate from later local decisions. Reality, Not Advocacy requires the account to stop where observation stops. Applied here, these are this author's analytical discipline, not claims about IETF intent.

The resulting chain has ten receipts: module and feature identity; datastore name; origin; read time and epoch; management authentication and authorization; PCEP transport and peer identity; negotiated session; controller request and PCC response; device and forwarding application; packet and service outcome. RFC 9826 makes the first five easier to express and correlate. Its achievement is a better management projection, not the abolition of everything the projection cannot see.