Summary

  • The proposed YANG notification envelope makes generation time, hostname, a per-process 32-bit sequence and observation-time semantics portable, but each field remains a bounded claim made under a particular schema and operating context.
  • Before automation treats an envelope as evidence, it needs separate receipts for schema, authenticated identity, process continuity, clocks, subscription context, content custody, downstream transport and authoritative outcome.

A collector receives a neat object. The root is envelope. The time parses. The hostname belongs to the expected router. The sequence number follows the previous one. Inside contents, the YANG-Push update decodes without complaint. Every visible light is green.

What, exactly, has been proved?

Revision 05 of Extensible YANG Model for YANG-Push Notifications, dated 18 May 2026, offers a valuable answer to a practical problem. The RFC 5277 notification header has one mandatory metadata field, eventTime, and is not extensible. Once a receiver forwards a notification to a broker or time-series database, transport context can disappear. The draft places metadata and payload in a reusable YANG structure that can be encoded in XML, JSON or CBOR.

The Datatracker record lists an active NETCONF working-group Internet-Draft intended for Proposed Standard and waiting for WG Chair go-ahead. It is not an RFC. Its design is useful precisely because it makes more claims explicit. The discipline is to keep those claims no larger than their evidence.

A structure is a contract about shape

When enabled, the new header wraps the notification in a root envelope. event-time is mandatory. hostname and sequence-number are optional extensions, enabled by default when supported. contents is an anydata node carrying the notification payload. RFC 8791 supplies the YANG structure mechanism; RFC 7951 and RFC 9254 define JSON and CBOR encodings alongside XML.

A successful schema check can establish that an instance has the expected nodes, types, namespaces and serialization. It cannot establish that the schema inventory was the intended one, that the nested contents was fully validated, or that the values describe reality. This is not academic. The current Datatracker page displayed four YANG errors and two warnings on 10 September 2026, while a shepherd record in the history reports an earlier clean yanglint and pyang run and says example checking excluded the anydata payload. Those statements have different dates and scopes. Neither says a deployed publisher emits correct observations.

The first receipt is therefore exact: module revision, feature set, encoding, namespaces or SIDs, validator version, loaded schemas and whether validation descended into contents. “The envelope validated” is incomplete unless the operator can say what was actually validated.

A hostname is not its own authenticator

The draft describes hostname as the network node that published the message and says it uniquely identifies the node within a network. The YANG description is more operationally revealing: the value is usually configured by an administrator. That makes it a useful label within a governed naming domain. It does not make the label self-authenticating.

The security section keeps this boundary intact. NETCONF or RESTCONF must use secure transport and mutual authentication; access control should restrict sensitive configuration and notifications. Hostname exposure can help an attacker map the network or inject spoofed notifications. A receiver that accepts edge-17.example from an unauthenticated path has learned only that someone supplied those characters.

Identity needs a binding: authenticated transport peer or signing key, certificate and key epoch, device identity, publishing process, naming authority and subscription authorization. RFC 8341 also matters because authorization can filter or drop notification content. Authentication says who controls a credential. It does not, by itself, prove that the process was entitled to publish this subscription or that every expected field was visible to the receiver.

A clean sequence is local to a process epoch

The optional sequence-number is a counter32. The draft starts it at one, increments it for every notification published by the publisher process, wraps after 4294967295 and uses zero to expose the wrap. A gap or inversion is valuable evidence of discontinuity inside a stable, observed process epoch.

The difficult words are “publisher process”. The draft does not assign a durable epoch identifier or prescribe persistence across restart. A collector that begins at 914 cannot see messages omitted before 914. A replacement process can restart or restore state under the same hostname. A relay can reorder, duplicate or drop messages. A counter can wrap. A database consumer can deduplicate against the wrong scope. Continuity is defensible only when the receipt binds the counter to authenticated process identity, boot or process epoch, receiver start, initial value, wrap decision, relay path and downstream storage acknowledgement.

This is why “no sequence gaps” is not equivalent to “nothing was lost”. It is a narrower statement: no gap was observed under a declared identity and epoch across the range the observer actually retained.

The three important times answer different questions

Envelope event-time records when the event was generated; the draft explains it as when the YANG-Push message was crafted and sent. The separate observation extension adds timestamp for when a periodic metric was measured or an on-change state transition was observed. point-in-time distinguishes current-accounting, initial-state and state-changed.

That separation fixes a real analytical mistake. A periodic poll may occur before a time-bucket boundary while message construction occurs after it. Indexing by generation time can put two observations in one bucket and none in another. Observation time gives the collector a better alignment point.

It is still a timestamp supplied by a clock. RFC 6991 defines the date-and-time representation and even allows -00:00 to express an unknown time zone. Parseability does not prove NTP or PTP lock, UTC traceability, bounded offset, leap handling or monotonicity. Event time, observation time, subscription anchor time, arrival time and persistence time should be retained separately with clock source and uncertainty. Otherwise a precise fractional second can lend false authority to an unsynchronized clock.

Capability is a declaration, not an instance receipt

RFC 9196 gives publishers a way to expose capabilities at implementation time or runtime. Revision 05 augments it with support indicators for the envelope, hostname and sequence metadata, and observation time. These indicators let a client negotiate intelligently.

They do not show that the global envelope switch is currently enabled, that optional metadata appeared in a particular message, that its value was correct, or that every receiver and intermediary can preserve it. Support, configuration, emission and downstream custody are four separate states.

The operational difference is sharp because the envelope switch is server-wide. Enabling or disabling it terminates all existing configured and dynamic subscriptions; termination notifications use the old header before the subscriptions end. Old and new formats can coexist across a network. A migration receipt must therefore record the switch transaction, terminated subscription set, receiver compatibility and the new subscription epochs. Capability discovery alone cannot prove a cutover completed without a blind interval.

contents inherits the subscription's limits

RFC 8639 ties event delivery to filters, receivers, permissions and subscription lifecycle. RFC 8641 distinguishes periodic and on-change YANG-Push, datastore selection, filters, anchor times, dampening and synchronization. A push-update is complete only under the terms of its subscription; a push-change-update can collapse intermediate changes during a dampening period.

The envelope does not repeat that whole contract. A valid subscription ID is a lookup key, not proof that the looked-up configuration was the intended version at generation time. A changed filter, datastore, permission, trigger or receiver binding can alter meaning while hostname and sequence remain smooth. Record a cryptographic fingerprint of the effective subscription and authorization context with each process epoch, then retain the lifecycle events that changed it.

RFC 8342 adds the final semantic boundary: intended, running and operational state are not interchangeable. A publisher can accurately serialize one datastore view without proving forwarding behavior, service impact or customer outcome. Syntax does not elevate a notification into authoritative truth.

Downstream custody needs content identity

The base draft says contents carries the notification values unchanged, but it does not include a content signature. Secure NETCONF or RESTCONF protects one association. Once a receiver decodes, re-encodes, forwards, aggregates or stores the message, that channel's assurance no longer travels automatically with the payload.

A separate work in progress, the YANG provenance draft, demonstrates why an extensible envelope is useful: it proposes a COSE signature whose input is exactly contents, plus capability discovery for that signature. It also states the limits plainly. A signature protects integrity and origin at signing time. It does not guarantee freshness, correct data from a legitimate signer, an uncompromised key, complete signatures at every intermediary, or a trustworthy mapping from key ID to data authority.

So even provenance is a scoped receipt. Preserve the content digest, canonicalization and serialization method, signer and key policy, signature result, freshness material, every transformation and each countersignature. Then independently ask whether the signed observation was true.

Eight receipts, no borrowed certainty

A defensible claim needs eight receipts: schema and validation scope; authenticated identity; process continuity; clock source and uncertainty; subscription and authorization context; exact content identity and signature scope; transport and downstream custody; and correlation to authoritative datastore plus observed outcome.

The envelope makes those receipts easier to name and carry. That is substantial progress. The mistake would be allowing one field to borrow the authority of another: a hostname borrowing authentication, a counter borrowing durable history, a timestamp borrowing synchronized time, a capability borrowing runtime presence, or valid bytes borrowing operational truth.

Supporting specification record

The version boundary is preserved in the Datatracker history. Timestamp syntax follows RFC 3339; the replaced notification header comes from RFC 5277; secure management context includes RFC 6241 and RFC 8040; the data-model language is RFC 7950; and the broader telemetry-plane context is RFC 9232. These references define mechanics and context, not a deployed result.