Summary

  • draft-ietf-opsawg-collected-data-manifest-14 says a Platform Manifest must travel and be stored with collected telemetry; its Data Collection Manifest remains a non-normative example.
  • A datapoint can be joined to context through emission time, platform ID and subscription ID, including the actual collection period rather than only the requested cadence.
  • That join cannot by itself prove an omission-free stream, a trustworthy clock, intact custody, correct semantics, authorized judgment or an applied operational result.

A telemetry value rarely explains itself. The number 0 can mean an interface counter reached zero, a device reported an overload artifact, a collection interval was too short, a counter reset, or no usable sample survived the path to storage. Revision 14 of A Data Manifest for Contextualized Telemetry Data addresses the first institutional mistake in such a chain: keeping the value while discarding the conditions under which it was observed.

The proposal is specific. Its normative Platform Manifest can retain a network-defined platform identifier, vendor or PEN, software and operating-system details, and the YANG Library material that identifies module revisions, namespaces, features, deviations, schemas and datastores. A separate Data Collection Manifest reuses subscription state to describe the stream or datastore, filters, subscription ID, receiver, periodic or on-change trigger and collection period. That second model is an example, not a normative module, because design-time schema mount is not available.

The small but important current-period leaf shows why context matters. An operator may request a ten-second periodic collection while an overloaded platform quietly uses twenty seconds. The draft chooses to expose the period actually in force rather than pretending the configured cadence was honored. An analyst can then avoid reading a sparse series as if it had been sampled at the requested rate.

The storage rule is stronger than an ordinary inventory export. The manifest must be streamed and stored with the data, must follow it when it moves, and must change when the platform or subscription changes. The draft therefore treats context as a time series. Retrospective lookup uses three keys: the time the device sent the datapoint, the originating platform ID and the subscription ID. The analyst selects the latest matching platform and collection manifests before that timestamp.

That is a useful join. It is not a certificate of history.

Start with the source platform. The identifier is defined within a network and must be unique at each point in time, yet the same value may later identify a replacement device. A correct lookup therefore depends on the inventory mapping and its temporal boundary. If the controller assigns the wrong hostname, reuses an identifier too early or synthesizes the manifest from scattered vendor models, the fields can join cleanly to the wrong machine.

Schema identity is the next test. YANG Library can state which module revision, namespace, feature and deviation gives a leaf its intended meaning. The live Datatracker page now reports zero YANG validation errors and zero warnings for revision 14. But the draft itself supplies the decisive caution: YANG cannot express the requirement that at least one of the yang-catalog or ietf-system feature sets be present. A module with neither enabled can still validate while disclosing nothing about the platform beyond its ID. Green validation is evidence about a model and dependency set, not evidence that an implementation supplied the context needed by an analyst.

Collection scope is separate again. A subscription filter defines what could arrive. Periodic and on-change subscriptions create different meanings for silence. A current-period value can reveal cadence drift, but it cannot prove that every scheduled sample was emitted or received. The draft says manifest reliability is the same as the reliability of the data collection itself because the manifest is collected as data. An in-band companion cannot independently testify about everything the in-band system lost.

Time creates a further boundary. “Latest manifest before the datapoint” works only if emission timestamps, platform identity and the historical database are trustworthy enough to order. Clock error, delayed delivery, collector timestamp substitution or a late manifest update can select the wrong version without breaking the relational join. A timestamp is an input to the rule; it is not proof that the rule selected physical reality.

Custody is not solved by co-location. Secure NETCONF or RESTCONF transport, mutual authentication and access control can protect a session. The draft points to separate COSE-signature work for integrity and provenance. Those controls need their own receipts across buffering, normalization, replication and storage. Two rows present in the same database do not prove that neither was dropped, reordered or altered before arrival.

Interpretation begins after those checks. Exact schema improves the meaning of a leaf, but operators still need counter width, reset and wrap behavior, units, aggregation rules, vendor defects and the lineage of later transformations. The draft explicitly places data lineage for computed indicators outside scope. A correctly contextualized input can still feed a wrong rate calculation, an invalid baseline or a misleading incident narrative.

Decision and effect are the final two records. These YANG nodes are read-only and define no RPC or action. A manifest cannot authorize a controller change. An analysis can recommend rerouting, throttling or investigation; an accountable principal must decide, an execution system must respond, and an observed service boundary must show what happened. Context makes the argument auditable. It does not inherit the power to act.

The Datatracker status deserves the same discipline. On 10 September 2026, revision 14 was an Active Internet-Draft dated 19 August, submitted to the IESG for publication, in Expert Review, with Proposed Standard as its intended status. The checker result was clean. None of those facts says the work is an RFC or that a network has deployed it.

The best reading of the draft is therefore narrower and more valuable than a promise of “self-describing data.” It creates a context receipt. Preserve it, version it and join it carefully. Then require separate evidence for source, schema, scope, time, custody, interpretation, decision and effect. A manifest can tell an analyst which question to ask. It cannot answer every question that follows.

Sources