Summary

  • RFC 10035 adds a read-only augmented-by list to YANG Library so a management server can state which modules directly add schema nodes to another module in the same module-set.
  • The list closes a discovery gap, not the whole decision chain. It does not calculate transitive dependencies, locate every affected schema path, prove inventory freshness, establish semantic compatibility or authorize a live module change.

C is downstream of A, but not directly

The distinction in RFC 10035’s three-module example is small enough to fit in one sentence and important enough to change automation policy.

Module A supplies a base container. Module B augments that container with another container. Module C augments the container introduced by B with a leaf. The server reports that A is augmented-by B. It reports that B is augmented-by C. It does not report C as a direct augmenter of A, even though C’s XPath begins inside the tree rooted in A.

That is not missing data. It is the defined scope. The new leaf-list records the module that owns the direct parent of the target node. Ancestors further up the schema tree are indirect dependencies. An application that needs recursive closure or a particular path analysis must perform that search itself.

This matters because “depends on” is not one relationship. A module can import definitions, include a submodule, add nodes through an augment or alter supported properties through a deviation. A client preparing a schema, subscribing to data or planning an upgrade needs to know which relationship it is using and how far it has traversed.

RFC 10035 has made one reverse edge directly observable. It has not made every downstream decision server-owned.

Publication closes a gap in RFC 8525

The RFC Editor published RFC 10035 as an IETF Standards Track document in August 2026. The embedded ietf-yang-library-augmentedby module carries revision date 26 August 2026. IANA registered its module name, XML namespace and yanglib-aug prefix.

RFC 8525 already allows a management server to expose the datastores and module-sets it supports. A client can learn which modules are implemented, which are import-only, which features are enabled and which deviations apply. Deviations are reverse dependencies because another module changes the supported behavior of a base module.

Augments created the corresponding blind spot. Before RFC 10035, a connector wanting the reverse augmentation relationship could retrieve the modules and parse them together. That may be feasible for a configuration client with a complete schema cache. It is costly for a catalog, telemetry parser or distributed application trying to discover only the dependencies relevant to data it consumes.

RFC 10035 adds augmented-by beneath each module entry in the NMDA YANG Library. It also adds the list to the deprecated modules-state tree for RFC 7895 compatibility. The same new module therefore supports current and legacy library shapes without pretending those shapes are identical.

The gain is narrower, faster discovery. The server that assembled its supported schema now publishes a piece of information it is best placed to know.

The module-set is the evidence boundary

The list’s values are leaf references to module names in the same module-set. RFC 10035 requires the base and augmenting modules to be present in that set. An augmenting module must not be an import-only entry, and the reference must not point directly or indirectly back to the module it augments.

These are structural invariants. They prevent a server from advertising an edge whose endpoint is outside the schema set being described, or presenting a module that is merely available for imports as if it actively modifies the implemented schema.

They do not prove that a client has read the right module-set. RFC 8525 can describe several datastores and schema selections. A device replacement, software activation or module onboarding can change the content. RFC 10035 notes that reverse-dependency data increases the YANG Library instance size and that the library should be updated when new modules are onboarded.

The evidence packet therefore needs the device identity, datastore, schema or module-set selection, content identity, retrieval time and authenticated session. A cached direct edge without those coordinates can be internally valid and operationally stale.

Inventory is not compatibility

An augmented-by statement says that the server uses one module to add nodes to another module’s schema tree. It does not state that a particular client understands those nodes, that an application can ignore them or that a proposed revision keeps their meaning.

A catalog can use the edge to fetch the relevant models. A telemetry parser can use it to discover fields introduced outside the base module. A testing system can use it to expand the scope of validation. None of those uses turns the edge into a compatibility verdict.

The client must still inspect revisions, features, deviations, imports and target paths. It must decide whether the added node is mandatory in its workflow, guarded by a feature, populated in the relevant datastore or consumed by a policy. It must distinguish schema availability from data presence and data presence from business use.

This is especially important for removal. If A lists B, the entry is a warning that B modifies A. It is not permission to unload B after checking A’s source. Other modules may directly depend on B; clients may rely on B’s data; configuration instances may contain nodes introduced by it. The complete impact belongs to a graph rooted in a specific running schema and workload.

Read-only does not mean harmless disclosure

The new nodes are operational metadata, not configuration knobs. RFC 10035 defines no writable data. That reduces the risk that querying the list directly changes device behavior.

The metadata can still reveal how a server’s management surface is composed. A reader may learn which vendor or domain modules extend a standard base, which capabilities have been onboarded and where a client should look for additional schema. The RFC therefore places the data behind secure YANG management protocols, mutual authentication and access control such as NACM.

Authentication proves which management endpoint answered. Authorization decides which user may read which portion. Neither establishes that a returned inventory is complete for another user, another datastore or a later software state.

An automation system should preserve those visibility conditions. Comparing a privileged inventory with a restricted one can manufacture a disappearance that is only access control. Treating an absent edge as proof of absence is unsafe unless the query scope and entitlement are known.

Implementations show feasibility, not every deployment

The IESG writeup records four implementations and says the work was tested and validated at an IETF hackathon. That supports the claim that the mechanism can be implemented and queried. It does not identify the exact version running on every managed device or prove that every server updates the list atomically when its schema changes.

The right operational test begins with known modules. Install or activate a module that directly augments a base. Confirm that both appear in the same module-set, that the base reports the augmenting module and that the content identity changes as expected. Then create a two-hop case and confirm that the library reports each direct edge without incorrectly flattening the chain.

Negative tests matter. An import-only module must not appear as an active augmenter. A self-referential or cyclic construction must fail validation or be handled safely by a robust client. A user denied access must not gain sensitive composition data through another route. A stale collector must not approve a change from an old graph.

Only after those behaviors are observed can the implementation evidence be joined to a change-control decision.

Direct edges improve the handoff between institutions

The server has authority over the schema composition it exposes. The client has authority over the analysis it performs from that statement. The application or operator has authority over the change it executes and the service risk it accepts.

RFC 10035 improves the handoff because the server no longer forces every consumer to reconstruct a basic reverse edge from downloaded model text. It narrows duplication of work and gives inventory, catalog and telemetry systems a common fact.

The boundary should remain visible. The server does not know every business workflow that consumes a node. A generic graph engine does not know whether a module change is approved for a production window. A standards registry does not know whether a specific device refreshed its library after onboarding.

Preserve the chain: authenticated endpoint, datastore and schema selection; content identity; module revisions and roles; direct augmentation edges; client-computed closure; affected paths and consumers; candidate change; validation and rollback; observed configuration, telemetry and service result.

Sources