| Internet-Draft | Disaggregated Pipeline Telemetry YANG | October 2026 |
| Li, et al. | Expires 3 May 2027 | [Page] |
This document specifies a Standards Track YANG 1.1 data model (ietf-dcn-pipeline-state-telemetry) for monitoring multi-stage execution phase timing and bulk state-mobility telemetry in disaggregated data-center service pipelines. The model defines nine causally ordered lifecycle timestamps, interval-union de-duplication for overlapping pipeline stages, and three-tier byte accounting that separates mandatory transport-visible encoded-bytes from optional application-visible logical-bytes and metadata-bytes, enabling consistent multi-vendor operational diagnostics under the Network Management Datastore Architecture (NMDA).¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 3 May 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
In disaggregated data-center service pipelines, context ingestion, state retrieval, bulk network transfer, representation transformation, and stream activation phases frequently overlap in time. One physical state transfer can serve more than one logical request, while one logical state can generate retries, replicas, and multiple rank-specific transfers. An observation that loses those relationships can misstate latency and traffic even when each source counter is individually accurate.¶
Operational management guidelines [RFC5706] and service assurance architectures [RFC9417] emphasize that disaggregated data-center services require explicit correlation between network state-transfer events and multi-stage pipeline execution intervals within a controlled administrative domain [RFC8799]. Complementing device-level packet discard reporting [DISCARD-MODEL], this document specifies a Standards Track YANG 1.1 data model together with normative interval-union timing and three-tier byte accounting obligations.¶
The intended use is a bounded, authorized diagnostic snapshot for network and service management in one reporting domain. It is not a raw trace transport, packet format, state discovery system, storage lease protocol, or device memory-ordering primitive. Exporters can derive the observations from existing runtime instrumentation; their instrumentation and fidelity remain explicit deployment dependencies. Operators needing continuous high-volume event export should use an appropriate existing telemetry mechanism rather than an unbounded instance of this model.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
The data model uses YANG 1.1 [RFC7950] and the Network Management Datastore Architecture (NMDA) [RFC8342]. Tree diagrams use [RFC8340]. JSON examples follow [RFC7951]; in particular, uint64, int64, and decimal64 values are JSON strings.¶
A producer is a management server exposing the operational data. A consumer is a management client interpreting it. An authorized reporting domain is a set of producers and consumers that share authenticated definitions of identifiers. Identifiers do not confer access rights.¶
A state-class definition MUST identify the model and relevant revision, representation, and state coverage, including required auxiliary state. A workload or population definition MUST identify the inclusion, sampling, and load conditions. A method or boundary definition MUST identify the measured events, estimator, units, and relevant version. These definitions MAY be provisioned outside this module over authenticated management channels. A consumer MUST NOT infer equivalence from an unrecognized identifier or compare data whose required definitions are unavailable. This version does not specify a cross-domain identifier registry.¶
A transport-layer acknowledgment, successful control request, directory lookup candidate, or recorded publication receipt is not by itself evidence of consumer-usable execution state. A telemetry observer MUST NOT derive accepted=true, completion=consumer-usable, or reclamation-state=reclaimable from network transport completion alone. Each exported lifecycle transition MUST be grounded in the runtime boundary and ownership evidence defined by this data model.¶
This YANG data model is strictly read-only operational telemetry. It neither grants a read lease nor acts as a hardware DMA fence, memory-access revocation primitive, or traffic-steering instruction. Local correlation with control-plane identifiers is permitted within an authorized diagnostic view, whereas unavailable application-layer byte counters (logical-bytes or metadata-bytes) MUST remain omitted rather than synthesized from wire-level encoded-bytes.¶
request-id identifies one logical request within a reporting boot. It MUST NOT be reused for a retry of another logical request. population-id identifies how requests are selected for this snapshot or analysis, including sampling and treatment of warmup, cancellation, and timeout. The producer MUST NOT silently omit unsuccessful requests from a population described as all admitted requests.¶
outcome is relative to initial-response emission. success means that an initial response unit was emitted; it does not assert that subsequent generation completed. failed, cancelled, and timeout mean the corresponding outcome occurred before initial response emission. pending means no terminal initial-response outcome has been observed. A successful request with unavailable instrumentation uses tirt-status unknown. A request that has not emitted an initial response unit MUST NOT carry a known TIRT.¶
For tirt-status known, tirt-us and tirt-boundary are mandatory. The boundary definition MUST identify arrival and unit-emission observation points, clock method, granularity, and any uncertainty that affects interpretation. The producer MUST obtain the duration from one monotonic clock or a method with explicit clock mapping and bounded error. When the method cannot support the claimed duration it MUST use unknown. A client arrival-to-receipt measure and a server admission-to-emission measure require different definitions.¶
Consumers MUST retain outcome and population qualifications when calculating or presenting TIRT statistics. Quantiles of successful requests MUST be identified as conditional on success, with known sampling and missing-data limitations. This bounded snapshot is not an admission counter: its eviction count cannot reconstruct a complete outcome distribution. Unknown values and requests with no initial response unit MUST NOT be inserted as zero-valued samples.¶
Each activity is a half-open interval [start-us, end-us) on a clock scoped to its request. Both endpoints MUST refer to the same monotonically increasing local clock and per-record origin. end-us MUST be greater than or equal to start-us under exact integer comparison, including values beyond the exact range of an XPath floating-point number. A zero-length interval is permitted. A clock reset or wrap MUST NOT be hidden inside an interval.¶
Within one request, intervals on the same clock can be compared directly. Different clocks can be compared only when complete mappings to the same reference-clock are available. Reference time is local time plus offset-us; uncertainty-us is a bound on mapping error over the entire record, including drift and acquisition error. All three mapping leaves MUST be present together or absent together. A zero offset or uncertainty is a numeric value, not an absent node. Clock identifiers and origins from different requests MUST NOT be assumed equal.¶
Let mapped endpoints of two intervals be a1, b1 and a2, b2, with uncertainty bounds u1 and u2. A conservative bound on their overlap duration is:¶
lower = max(0, min(b1-u1, b2-u2) - max(a1+u1, a2+u2)) upper = max(0, min(b1+u1, b2+u2) - max(a1-u1, a2-u2))¶
These are conservative bounds; known correlations may permit tighter bounds only with a documented method. With unavailable mappings, a consumer MUST report cross-clock overlap as unknown, not zero. If a point estimate is presented, it MUST be accompanied by its uncertainty or explicitly identified as an estimate. Mapping a clock does not prove causality.¶
A consumer calculating time covered by comparable activity intervals MUST use the interval union, not the sum of all durations. Intervals [0,80) and [50,100) cover 100 time units, with overlap 30; their sum 130 is not an elapsed duration. The uncovered difference between a separately measured TIRT and that union is not automatically network delay. The observed intervals may omit activities, use different boundaries, or extend beyond the TIRT interval.¶
Activity kind labels do not establish a critical path, blocking cause, or attribution to the network. Consumers MUST NOT label the sum of per-stage quantiles as the corresponding TIRT quantile. Attribution requires additional causal evidence outside this model; absence of that evidence MUST remain distinguishable from a measured zero contribution.¶
A transfer entry represents one physical transfer attempt observed at a declared accounting boundary. transfer-id MUST uniquely identify that observation within the producer boot. It does not assert a globally unique wire transaction identifier. A request refers to that transfer using transfer-reference; multiple requests MAY refer to one entry. Repeated references MUST NOT multiply physical traffic.¶
logical-state-id and state-class identify the logical content and its representation definition. shard-id distinguishes disjoint logical coverage, copy-id distinguishes copies of the same coverage, and rank-scope states which rank or rank group is accounted for. attempt-id identifies retries. Producers MUST use separate transfer entries when these attributes, the accounting boundary, or the observation window differ. The same attempt observed in two windows therefore has distinct transfer-id values but retains its attempt-id. A rank aggregate MUST identify its member coverage and MUST NOT be added to overlapping individual-rank rows.¶
A referenced transfer MUST have the same state-class as its request in this version. Different classes require separate request observations or an explicitly specified future extension; a consumer MUST NOT assume implicit conversion. Logical bytes reused by many requests may legitimately be counted in each request's demand, but such a sum MUST NOT be labeled unique transferred state. Deduplicating unique logical state requires equivalent state-class, logical-state-id, and shard coverage; it excludes replicas and retries only for the explicitly identified logical metric.¶
logical-bytes describes logical state before transport encoding using the state-class definition. encoded-bytes describes the encoded payload. metadata-bytes describes representation metadata. When metadata-mode is included, metadata is already part of encoded-bytes and MUST NOT be added again; metadata-bytes MUST be no larger than encoded-bytes. When metadata-mode is separate, the representation footprint is their sum. None of these quantities alone asserts physical traffic.¶
observed-bytes records actual traffic at observation-boundary in the stated direction and observation window. The boundary definition MUST state the counter location, protocol layer, framing and header coverage, retry visibility, and whether traffic shared with other operations can be isolated. A producer MUST set observation-status unknown if it cannot obtain this quantity for the stated transfer and boundary. It MUST NOT populate observed-bytes by substituting logical-bytes or encoded-bytes. A measured zero remains distinct from unknown.¶
A counter interval that cannot distinguish concurrent transfers MUST NOT be copied to each transfer. Instrumentation must either isolate attribution or leave their observed values unknown. Capturing a common link counter for a whole group is a different scope and requires a definition that prevents later overlap with the group's members.¶
window-id and window-duration-us identify a common observation interval. Matching window identifiers MUST denote the same interval definition within the authenticated reporting domain and boot. The positive duration prevents division by zero. A consumer MAY calculate a byte rate by multiplying a known observed-byte total by 1000000 and dividing by window-duration-us. The unit is bytes per second; conversion to bits per second requires an additional factor of eight.¶
Consumers MUST NOT aggregate observed counts unless the direction, boundary layer, window, and scope definitions are compatible and the underlying traffic is disjoint. A transmit observation and a receive observation of the same bytes MUST NOT be summed as unique traffic. Failed attempts and retries contribute to physical traffic when visible at the selected boundary, even when accepted is false. Counters that already include retries MUST NOT have the same retry traffic added again from another row. Unknown observed counts make a complete total unknown; a sum over known entries MAY be reported only as a labeled partial total.¶
completion records an observed level, not a command. local-complete is a local transport event. remote-placement covers placement of the required bytes at the remote destination. consumer-usable additionally covers representation processing, required auxiliary state, and consumer visibility under a documented backend contract. failed and cancelled identify unsuccessful attempt outcomes. Cancellation MUST NOT be interpreted as proof that all hardware accesses have stopped.¶
completion-evidence MUST identify the contract and observation method supporting the reported level, or an explicit unknown definition when the level is unknown. A local API return, a future becoming ready, and a rank-level acknowledgement MUST NOT be promoted to consumer-usable unless the contract demonstrates the required coverage. The model neither adds a device fence nor grants permission to release or reuse a buffer.¶
accepted true means the representation was selected for consumption and requires completion consumer-usable. It does not mean all requests referring to the transfer completed or that earlier physical traffic disappeared. accepted false with consumer-usable is valid, for example when another usable copy was selected. Producers and consumers MUST preserve these distinctions.¶
Transfer phase identifies restore, inter-stage pipeline handoff, or writeback. It grants no packet priority. Expert dispatch and combine are activity kinds; their activation bytes MUST NOT be entered as materialized state bytes. resource-scope is an optional operator-defined physical sharing domain, such as a PCIe uplink or directional NIC resource. Equal labels do not prove contention, and unrelated labels do not prove isolation.¶
reclamation-state is independent of completion. A cancelled attempt can remain quiescing; a consumer-usable transfer can remain retained while a target compute accelerator still references its allocation. reclaimable means the documented backend has demonstrated that no outstanding writer or consumer can access the observed allocation generation. It is an observation, not a remote authorization to free it. Its evidence MUST bind the allocation generation and observation method. Epoch changes and elapsed cancellation timers alone MUST NOT establish reclaimable. An unknown state MUST NOT be interpreted as retained or reclaimable.¶
A dependency-wait activity MUST identify a transfer in the same coherent snapshot. Its start is the scheduler observation that the next eligible step is blocked on that transfer; its end is the observation that this block clears or is abandoned. The boundary definition MUST distinguish waiting solely on this transfer from waiting on it among multiple unsatisfied prerequisites. Such a wait is an observed dependency interval, not a counterfactual estimate of speedup. Its transfer state-class MUST match the request. A producer without scheduler evidence MUST NOT create a dependency-wait merely because a transfer overlaps idle time. Consumers use the union of comparable wait intervals and MUST NOT label it removable latency without further causal evidence.¶
A terminal cancelled or failed state does not erase prior physical bytes. Selection for consumption and memory reclamation are separate events. A complete snapshot MUST preserve the referenced transfer for every dependency-wait, using the same coherent eviction rule as explicit transfer-reference entries.¶
When an observation is exported by a transport-layer or fabric probe that cannot inspect application-layer serialization boundaries, the exporter MUST populate encoded-bytes and MUST omit logical-bytes and metadata-bytes rather than synthesizing zero or estimated values. When both logical-bytes and encoded-bytes are present, encoded-bytes MUST be greater than or equal to logical-bytes.¶
The ietf-dcn-pipeline-state-telemetry module contains only operational state (config false). Its presence container denotes supported exposure; absence is not a zero metric. A server implementing this module MUST advertise the implemented revision using YANG Library [RFC8525]. It MUST expose the model consistently with NMDA. No feature flags, RPCs, actions, or notifications are defined.¶
This specification defines data semantics independent of the selected YANG management protocol. NETCONF [RFC6241] and RESTCONF [RFC8040] are applicable existing transports. It does not assign a new URI scheme, HTTP resource outside the existing datastore mapping, port, or packet format. Protocol errors use the selected management protocol; no new error tags are defined.¶
A complete retrieval of pipeline-state-observations MUST describe one coherent snapshot. The producer MUST change snapshot-id when any exposed content changes and MUST change boot-id when continuity of identifiers or counters is lost. It MUST NOT reuse a snapshot-id within a boot. A consumer combining separate reads MUST verify both identifiers are equal; otherwise it MUST obtain a new complete snapshot or mark the combination unusable. Identical identifiers from different authenticated servers are not equal snapshots.¶
The producer MUST enforce the advertised retention limit and the schema maxima. A complete response MUST NOT contain dangling references. If authorization filtering or an incomplete response prevents reference resolution, the consumer MUST NOT treat the response as a complete conforming snapshot. The producer SHOULD expose only the authorized, internally consistent view to each principal. Omitted records MUST NOT be interpreted as successful operations or as zero-valued observations.¶
Counters are cumulative within a boot and follow yang:counter64 [RFC9911], including possible wrap. Consumers MUST NOT calculate deltas across a boot change; they MUST detect or explicitly bound counter wrap before calculating a delta. Limits bound retained records, not the full history or network load. Servers MAY choose a smaller limit, provided they report it accurately.¶
All arithmetic requirements in this document use exact integer quantities before division. Implementations MUST detect overflow and MUST NOT wrap, saturate silently, or turn an invalid result into zero. Schema validation does not replace semantic validation: XPath number conversion can lose precision for large 64-bit integers. Producers MUST satisfy, and consumers MUST verify before use, the additional constraints defined in this document. A consumer detecting a violation MUST exclude the affected record from the relevant calculation and SHOULD report the reason through its existing diagnostic interface; it need not discard unrelated valid records.¶
A snapshot identity is the tuple (authenticated producer, boot-id, view-id, snapshot-id). view-id identifies the authorized projection and MUST change when its authorization scope, filtering policy, or referenced definitions change. The same tuple MUST NOT identify different content. A producer MUST NOT leak the identity or activity of another authorization view through snapshot identifiers. A consumer MUST NOT join partial responses across views, even when their boot-id and snapshot-id match. This requirement applies to the complete defined subtree; it does not make unrelated datastore reads atomic. If coherent capture is unavailable, the server MUST fail the complete read using the management protocol rather than synthesize a mixed snapshot.¶
Capability discovery and datastores use the management protocol and YANG Library. NETCONF implementations claiming NMDA operational access MUST support an applicable operational-datastore retrieval mechanism; RESTCONF implementations MUST expose the operational datastore using its defined NMDA binding. A legacy running-configuration read is not a substitute for retrieval of these config false nodes. Authorization-filtered or partial responses cannot establish completeness by themselves.¶
The NMDA bindings are specified in [RFC8526] for NETCONF and [RFC8527] for RESTCONF. Consumers MUST NOT calculate counter deltas across different authorization views.¶
The number of request entries MUST NOT exceed record-limit. evicted-records counts request records omitted or removed by the retention policy since boot; it is not a transfer count or a service execution failure counter.¶
Retention of transfer entries MUST preserve all references in the same complete snapshot. When limits prevent this, the producer MUST evict dependent request records coherently and account for those evictions. It MUST NOT leave an apparently complete request pointing to an absent transfer.¶
Producer and consumer implementations MUST enforce exact interval ordering, state-class matching, metadata inclusion, and aggregation preconditions in addition to schema constraints. Invalid records MUST NOT contribute silently to valid-looking totals.¶
Implementations MUST document their scope definitions and missing-instrumentation behavior. Conformance to this data model is independent of model architecture, underlying transport protocol, and hardware accelerator implementation.¶
Conformance MUST be verified independently for each authorized diagnostic view. Verification suites MUST exercise: (1) a shared state transfer serving multiple logical requests, (2) overlapping pipeline execution intervals evaluated via interval-union accounting, (3) transport completion followed by consumer validation failure, and (4) configuration generation invalidation prior to final attachment. A filtered or incomplete snapshot MUST NOT be relabeled as a complete zero-cost or zero-loss observation.¶
The following tree shows the nodes defined by this module. The module text is normative. Read-only nodes are marked ro; a presence container is marked with an exclamation mark.¶
module: ietf-dcn-pipeline-state-telemetry
+--ro pipeline-state-observations!
+--ro boot-id local-id
+--ro view-id local-id
+--ro snapshot-id local-id
+--ro record-limit uint16
+--ro evicted-records yang:counter64
+--ro request* [request-id]
| +--ro request-id local-id
| +--ro population-id local-id
| +--ro state-class local-id
| +--ro outcome enumeration
| +--ro tirt-status enumeration
| +--ro tirt-us uint64
| +--ro tirt-boundary local-id
| +--ro clock* [clock-id]
| | +--ro clock-id local-id
| | +--ro reference-clock? local-id
| | +--ro offset-us? int64
| | +--ro uncertainty-us? uint64
| +--ro activity* [activity-id]
| | +--ro activity-id local-id
| | +--ro kind enumeration
| | +--ro clock-id -> ../../clock/clock-id
| | +--ro start-us uint64
| | +--ro end-us uint64
| | +--ro wait-transfer-id ->
../../../transfer/transfer-id
| | +--ro resource-scope? local-id
| | +--ro boundary local-id
| +--ro transfer-reference* [transfer-id]
| +--ro transfer-id -> ../../../transfer/transfer-id
+--ro transfer* [transfer-id]
+--ro transfer-id local-id
+--ro phase enumeration
+--ro reclamation-state enumeration
+--ro reclamation-evidence local-id
+--ro logical-state-id local-id
+--ro state-class local-id
+--ro attempt-id local-id
+--ro copy-id local-id
+--ro shard-id local-id
+--ro rank-scope local-id
+--ro observation-boundary local-id
+--ro window-id local-id
+--ro direction enumeration
+--ro logical-bytes uint64
+--ro encoded-bytes uint64
+--ro metadata-bytes uint64
+--ro metadata-mode enumeration
+--ro observation-status enumeration
+--ro completion enumeration
+--ro completion-evidence local-id
+--ro accepted boolean
+--ro observed-bytes uint64
+--ro window-duration-us uint64¶
This module imports common data types from [RFC9911]. RFC XXXX in the module and registration templates is to be replaced by the RFC number assigned to this document; it is not an allocated number.¶
module ietf-dcn-pipeline-state-telemetry {
yang-version 1.1;
namespace
"urn:ietf:params:xml:ns:yang:ietf-dcn-pipeline-state-telemetry";
prefix ino;
import ietf-yang-types {
prefix yang;
reference
"RFC 9911: Common YANG Data Types";
}
organization
"IETF Operations and Management Area Working Group (OPSAWG)";
contact
"Author contacts for this individual submission:
Zhiqiang Li <lizhiqiangyjy@chinamobile.com>
Zongpeng Du <duzongpeng@chinamobile.com>
Junjie Wang <wangjj@centec.com>
Wei Cheng <chengw@centec.com>
Ying Zhao <zhaoying@centec.com>
Chunhao Zhao <chunhao.zhao@sh-aia.com>
Xun Sun <sunxun@inesa.com>";
description
"A YANG Data Model for Disaggregated Pipeline Execution Timing
and State-Transfer Telemetry.
Copyright (c) 2026 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject
to the license terms contained in, the Revised BSD License
set forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX; see the
RFC itself for full legal notices.";
revision 2026-10-30 {
description
"Initial revision.";
reference
"RFC XXXX: A YANG Data Model for Disaggregated Pipeline
Execution Timing
and State-Transfer Telemetry";
}
typedef local-id {
type string {
length "1..128";
}
description
"Opaque identifier scoped to one authorized reporting domain.
It is not a global content hash or an authorization unit.";
}
container pipeline-state-observations {
presence "A bounded observation snapshot is available.";
config false;
description
"Read-only observations for service and network diagnostics.
This is not a packet export or storage control API.";
leaf boot-id {
type local-id;
mandatory true;
description
"Identifier changed after restart or loss of
identifier continuity.";
}
leaf view-id {
type local-id;
mandatory true;
description
"Authorized projection and definition generation.";
}
leaf snapshot-id {
type local-id;
mandatory true;
description
"Changes whenever any node in this snapshot
changes.";
}
leaf record-limit {
type uint16 {
range "1..1024";
}
mandatory true;
description
"Maximum retained request records.";
}
leaf evicted-records {
type yang:counter64;
mandatory true;
description
"Records removed or omitted due to retention
limits since boot.";
}
list request {
must "(outcome = 'success' and "
+ "tirt-status != 'not-applicable')"
+ " or (outcome != 'success' and tirt-status != 'known')" {
error-message "TIRT status conflicts with the outcome.";
description
"A non-success cannot claim a measured TIRT.";
}
key "request-id";
max-elements 1024;
description
"One logical request. Attempts and physical transfers have
separate identities. Records contain no payload content.";
leaf request-id {
type local-id;
mandatory true;
description
"Opaque logical request identifier within this
boot.";
}
leaf population-id {
type local-id;
mandatory true;
description
"Definition of workload and selection or sampling
procedure.";
}
leaf state-class {
type local-id;
mandatory true;
description
"Model, representation and state-coverage
definition.";
}
leaf outcome {
type enumeration {
enum success {
description
"An initial response unit was emitted.";
}
enum failed {
description
"Failed before initial response emission.";
}
enum cancelled {
description
"Cancelled before initial response emission.";
}
enum timeout {
description
"Timed out before initial response emission.";
}
enum pending {
description
"No terminal outcome has been observed.";
}
}
mandatory true;
description
"Outcome relative to initial-response emission.";
}
leaf tirt-status {
type enumeration {
enum known {
description
"A comparable TIRT duration is available.";
}
enum unknown {
description
"TIRT was not measured or cannot be compared.";
}
enum not-applicable {
description
"No initial response unit was emitted.";
}
}
mandatory true;
description
"Whether tirt-us has a meaning for this record.";
}
leaf tirt-us {
when "../tirt-status = 'known'";
type uint64;
units "microseconds";
mandatory true;
description
"Request arrival to first output unit emission
using one defined observation boundary.";
}
leaf tirt-boundary {
when "../tirt-status = 'known'";
type local-id;
mandatory true;
description
"Shared definition of the arrival and initial-response
observation points.";
}
list clock {
must '(not(reference-clock) and not(offset-us) and'
+ ' not(uncertainty-us)) or (reference-clock and'
+ ' offset-us and uncertainty-us)' {
error-message "A clock mapping is complete or absent.";
description
"Partial mappings must not appear usable.";
}
key "clock-id";
max-elements 16;
description
"Monotonic time domains. Optional mappings convert this
request's relative timestamps to reference-clock units.";
leaf clock-id {
type local-id;
mandatory true;
description
"Clock identifier scoped to this request.";
}
leaf reference-clock {
type local-id;
description
"Shared reference identifier; not an implicit UTC
claim.";
}
leaf offset-us {
type int64;
units "microseconds";
description
"Reference time equals local relative time plus
this offset.";
}
leaf uncertainty-us {
type uint64;
units "microseconds";
description
"Error bound for the mapping during this record.";
}
}
list activity {
must 'end-us >= start-us' {
error-message "An interval cannot end before it starts.";
description
"Both endpoints use the same clock.";
}
key "activity-id";
max-elements 256;
description
"An interval on a declared clock; overlap is allowed.";
leaf activity-id {
type local-id;
mandatory true;
description
"Identifier unique within this request.";
}
leaf kind {
type enumeration {
enum queueing {
description
"Queueing activity.";
}
enum context-ingestion {
description
"Initial context ingestion and state
materialization activity.";
}
enum transfer {
description
"Transfer activity.";
}
enum conversion {
description
"Conversion activity.";
}
enum stream-activation {
description
"Stream emission initialization activity.";
}
enum shard-dispatch {
description
"Dispatch of work to parallel workers.";
}
enum shard-compute {
description
"Parallel worker computation.";
}
enum shard-combine {
description
"Gather and combine of parallel worker results.";
}
enum iterative-emission {
description
"An iterative output unit emission step.";
}
enum dependency-wait {
description
"Observed scheduler wait for a named dependency.";
}
enum other {
description
"Other activity.";
}
}
mandatory true;
description
"Activity label, not causal attribution.";
}
leaf clock-id {
type leafref {
path "../../clock/clock-id";
}
mandatory true;
description
"Clock for both endpoints.";
}
leaf start-us {
type uint64;
units "microseconds";
mandatory true;
description
"Inclusive start relative to a per-record local
origin.";
}
leaf end-us {
type uint64;
units "microseconds";
mandatory true;
description
"Exclusive end on the same local clock.";
}
leaf wait-transfer-id {
when "../kind = 'dependency-wait'";
type leafref {
path "../../../transfer/transfer-id";
}
mandatory true;
description
"Observed transfer dependency; not causal attribution.";
}
leaf resource-scope {
type local-id;
description
"Authenticated definition of a physical sharing
domain.";
}
leaf boundary {
type local-id;
mandatory true;
description
"Definition of the measured start and completion
events.";
}
}
list transfer-reference {
key "transfer-id";
max-elements 256;
description
"Physical transfers used by this logical request.";
leaf transfer-id {
type leafref {
path "../../../transfer/transfer-id";
}
mandatory true;
description
"Reference to a physical transfer counted once per
snapshot.";
}
}
}
list transfer {
must "not(accepted = 'true') or "
+ "completion = 'consumer-usable'" {
error-message "Accepted state must be consumer-usable.";
description
"Acceptance is not inferred from local completion.";
}
key "transfer-id";
max-elements 4096;
description
"One physical transfer attempt with a declared accounting
boundary. Retries and replicas are identified explicitly.";
leaf transfer-id {
type local-id;
mandatory true;
description
"Unique physical observation record identifier.";
}
leaf phase {
type enumeration {
enum restore {
description
"Restore of retained state.";
}
enum stage-handoff {
description
"Inter-stage pipeline state handoff.";
}
enum writeback {
description
"Writeback of generated state.";
}
enum other {
description
"Other explicitly defined phase.";
}
}
mandatory true;
description
"Application phase, not a network traffic class.";
}
leaf reclamation-state {
type enumeration {
enum unknown {
description
"No supported conclusion.";
}
enum retained {
description
"Allocation remains charged.";
}
enum quiescing {
description
"Access revocation is pending.";
}
enum reclaimable {
description
"Backend quiescence proven.";
}
}
mandatory true;
description
"Reclamation knowledge, independent of transfer outcome.";
}
leaf reclamation-evidence {
when "../reclamation-state != 'unknown'";
type local-id;
mandatory true;
description
"Scoped backend contract supporting this state.";
}
leaf logical-state-id {
type local-id;
mandatory true;
description
"State identity in its declared representation;
not a global hash.";
}
leaf state-class {
type local-id;
mandatory true;
description
"Model, representation, coverage and logical-size
definition.";
}
leaf attempt-id {
type local-id;
mandatory true;
description
"Attempt identifier for a logical retrieval.";
}
leaf copy-id {
type local-id;
mandatory true;
description
"Distinguishes replicas from logical shards.";
}
leaf shard-id {
type local-id;
mandatory true;
description
"Identifies a logical shard; equal IDs mean equal
coverage.";
}
leaf rank-scope {
type local-id;
mandatory true;
description
"Explicit rank or rank group accounted for by this
row.";
}
leaf observation-boundary {
type local-id;
mandatory true;
description
"Counter location, layer, framing coverage, and
retry inclusion.";
}
leaf window-id {
type local-id;
mandatory true;
description
"Common physical observation window; matching IDs
require the same definition.";
}
leaf direction {
type enumeration {
enum transmit {
description
"Bytes observed leaving the defined boundary.";
}
enum receive {
description
"Bytes observed entering the defined boundary.";
}
}
mandatory true;
description
"Observation direction.";
}
leaf logical-bytes {
type uint64;
units "bytes";
description
"Logical state bytes in this shard before
transport encoding.";
}
leaf encoded-bytes {
type uint64;
units "bytes";
mandatory true;
description
"Encoded payload bytes; metadata inclusion is
explicit.";
}
leaf metadata-bytes {
type uint64;
units "bytes";
description
"Representation metadata bytes for this attempt.";
}
leaf metadata-mode {
type enumeration {
enum included {
description
"Encoded byte count already includes metadata.";
}
enum separate {
description
"Metadata is not included in encoded-bytes.";
}
}
mandatory true;
description
"Relationship of metadata and encoded byte
counters.";
}
leaf observation-status {
type enumeration {
enum known {
description
"Observed byte count is available.";
}
enum unknown {
description
"Observed byte count is unavailable.";
}
}
mandatory true;
description
"Availability of observed-bytes.";
}
leaf completion {
type enumeration {
enum unknown {
description
"No supported completion conclusion.";
}
enum local-complete {
description
"Local transport completion only.";
}
enum remote-placement {
description
"All required transfer bytes placed remotely.";
}
enum consumer-usable {
description
"Required state and visibility verified for
consumer.";
}
enum failed {
description
"Attempt failed.";
}
enum cancelled {
description
"Attempt cancelled; not proof of memory
quiescence.";
}
}
mandatory true;
description
"Completion level supported by evidence.";
}
leaf completion-evidence {
type local-id;
mandatory true;
description
"Versioned backend contract and observation
method, or explicit unknown definition.";
}
leaf accepted {
type boolean;
mandatory true;
description
"True only when this representation was selected
for consumption.";
}
leaf observed-bytes {
when "../observation-status = 'known'";
type uint64;
units "bytes";
mandatory true;
description
"Actual bytes at the stated boundary, including
retries if visible there.";
}
leaf window-duration-us {
type uint64 {
range "1..max";
}
units "microseconds";
mandatory true;
description
"Duration of the common observation window.";
}
}
}
}¶
The target deployment is a managed disaggregated data-center service cluster utilizing inter-stage state-transfer connectors or a shared external state tier within a limited administrative domain [RFC8799]. Bulk state payloads traverse existing transport planes. NETCONF or RESTCONF retrieves bounded diagnostic snapshots from an instrumented management agent; the management plane is never invoked on the per-packet or per-chunk data path.¶
Instrumentation adapters on service nodes and network interface controllers map native runtime and transport events to the nine causally ordered lifecycle timestamps defined in this module. Transport queue submission, RDMA/transport completion, state directory publication, target-device memory visibility, scheduler admission, and buffer reclamation remain distinct observable milestones. Where local instrumentation cannot distinguish two milestones, the unobservable timestamp MUST remain omitted rather than synthesized.¶
No modification to RDMA work requests, RoCEv2 headers, QUIC frames, or hardware memory allocators is required by this YANG data model. The model provides deterministic operational observability across multi-vendor management consumers rather than fast-path congestion control.¶
The security analysis for the ietf-dcn-pipeline-state-telemetry module follows the approach in [RFC9907]. YANG management access requires a secure transport and mutual authentication. Deployments using NETCONF over SSH follow [RFC6242]; RESTCONF uses HTTPS with authentication appropriate to the deployment and current TLS guidance [RFC9846]. Peer authentication alone does not authorize a metric or its scope.¶
Access control MUST be enforced using the Network Configuration Access Control Model (NACM) [RFC8341] when this module is accessed by NETCONF or RESTCONF. Deployments MUST restrict readable observations to authorized principals in the reporting domain and SHOULD deny them to other principals by default. The module introduces no writable data nodes, RPCs, actions, or notifications. It does not weaken access controls on nodes in imported or augmented modules.¶
The request and transfer subtrees disclose timing, workload populations, model classes, relationships among requests sharing state, placement ranks, and traffic volumes. Their combination can reveal tenant behavior even without payload content. Servers SHOULD minimize retention and sampling detail, use domain-scoped pseudonyms, and avoid user payloads, raw units, content hashes, credentials, and customer names in identifiers. Operators SHOULD separate authorization views by tenant when tenants do not share a trust domain.¶
Forged clock mappings, completion evidence, or byte counts can conceal failures or distort capacity decisions. Consumers MUST authenticate the reporting peer and MUST NOT treat an asserted completion level as a hardware fence or authorization to reuse memory. A malicious producer can provide internally consistent but false measurements; cross-checking independent counters and backend contracts is an operational defense, not a property proven by this model.¶
Long retention, frequent polling, and large authorized responses can consume server resources. Producers SHOULD rate-limit collection and reads using existing management facilities, and MUST enforce the stated cardinality bounds. A consumer MUST distinguish filtering, eviction, missing instrumentation, and failures from actual zero measurements. Confidentiality and integrity protect transport but do not eliminate information exposed to an authorized reader.¶
This document requests registration of the following URI in the IETF XML Registry [RFC3688]. These registrations follow the IANA review procedures specified in RFC 3688 and RFC 9890.¶
| Field | Value |
|---|---|
| URI | urn:ietf:params:xml:ns:yang:ietf-dcn-pipeline-state-telemetry |
| Registrant Contact | The IESG |
| XML | N/A; the requested URI is an XML namespace. |
This document requests the following registration in the YANG Module Names registry following [RFC7950] and the registration rules in [RFC9890]. The namespace and module name below are requests, not existing assignments.¶
| Field | Value |
|---|---|
| Name | ietf-dcn-pipeline-state-telemetry |
| Maintained by IANA? | N |
| Namespace | urn:ietf:params:xml:ns:yang:ietf-dcn-pipeline-state-telemetry |
| Prefix | ino |
| Reference | RFC XXXX |
This section follows [RFC7942] and is to be removed before RFC publication. The accompanying review package reports schema, example, and semantic checks for this document. Earlier validation counts are not transferred to this revision. No production framework integration, independent management endpoint interoperability, or hardware performance result is claimed.¶
Two logical requests reference one physical transfer. Its observed traffic is 660 bytes, counted once, while its encoded payload including metadata is 600 bytes and its logical state is 1000 bytes. The common observation window is 100 microseconds; the difference between 600 and 660 is meaningful only under the provisioned boundary definition. Each request has overlapping activities and a separately measured TIRT.¶
{
"ietf-dcn-pipeline-state-telemetry:pipeline-state-observations": {
"boot-id": "b1",
"snapshot-id": "s1",
"record-limit": 32,
"evicted-records": "0",
"request": [
{
"request-id": "r1",
"population-id": "all-admitted-v1",
"state-class": "dense-fp16-v1",
"outcome": "success",
"tirt-status": "known",
"tirt-us": "100",
"tirt-boundary": "client-arrival-to-initial-response-v1",
"clock": [
{
"clock-id": "mono1"
}
],
"activity": [
{
"activity-id": "p1",
"kind": "context-ingestion",
"clock-id": "mono1",
"start-us": "0",
"end-us": "80",
"boundary": "ingestion-submit-to-complete-v1"
},
{
"activity-id": "x1",
"kind": "transfer",
"clock-id": "mono1",
"start-us": "50",
"end-us": "100",
"boundary": "transfer-submit-to-usable-v1"
},
{
"activity-id": "w1",
"kind": "dependency-wait",
"clock-id": "mono1",
"start-us": "80",
"end-us": "100",
"wait-transfer-id": "t1",
"boundary": "eligible-step-waiting-solely-on-t1-v1",
"resource-scope": "pcie-root-1"
}
],
"transfer-reference": [
{
"transfer-id": "t1"
}
]
},
{
"request-id": "r2",
"population-id": "all-admitted-v1",
"state-class": "dense-fp16-v1",
"outcome": "success",
"tirt-status": "known",
"tirt-us": "100",
"tirt-boundary": "client-arrival-to-initial-response-v1",
"clock": [
{
"clock-id": "mono1"
}
],
"activity": [
{
"activity-id": "p1",
"kind": "context-ingestion",
"clock-id": "mono1",
"start-us": "0",
"end-us": "80",
"boundary": "ingestion-submit-to-complete-v1"
},
{
"activity-id": "x1",
"kind": "transfer",
"clock-id": "mono1",
"start-us": "50",
"end-us": "100",
"boundary": "transfer-submit-to-usable-v1"
}
],
"transfer-reference": [
{
"transfer-id": "t1"
}
]
}
],
"transfer": [
{
"transfer-id": "t1",
"logical-state-id": "state1",
"state-class": "dense-fp16-v1",
"attempt-id": "a1",
"copy-id": "replica1",
"shard-id": "shard0",
"rank-scope": "rank0",
"observation-boundary": "host-tx-including-retries-v1",
"window-id": "w1",
"direction": "transmit",
"logical-bytes": "1000",
"encoded-bytes": "600",
"metadata-bytes": "40",
"metadata-mode": "included",
"observation-status": "known",
"observed-bytes": "660",
"window-duration-us": "100",
"completion": "consumer-usable",
"completion-evidence": "backend-visibility-and-coverage-v1",
"accepted": true,
"phase": "restore",
"reclamation-state": "retained",
"reclamation-evidence": "generation-pinned-v1"
}
],
"view-id": "authorized-view-1"
}
}¶
| Case | Input or mutation | Expected behavior |
|---|---|---|
| O01/S09 | Two requests refer to t1, observed 660 | Count 660 physical bytes, not 1320. |
| O03/O04 | Partial clock mapping; complete zero mapping | Reject partial; accept complete zeros. |
| O07 | accepted=true; local-complete | Reject inconsistent transfer. |
| O08 | Referenced transfer absent | Snapshot is not complete. |
| O09 | failed before initial response with known TIRT | Reject inconsistent request. |
| O14 | included metadata 601; encoded 600 | Reject inconsistent byte values. |
| O17 | start=18446744073709551615; end one less | Reject using exact integer comparison. |
| S01 | [0,80) and [50,100) | Union 100; sum 130 is not elapsed time. |
| S10/S11 | Mixed directions or duplicate physical row | Reject total as unique traffic. |
| S12 | Disjoint retry observation adds 100 to 660 | Physical total 760 with declared window. |
| S13/S14 | Encoded 600, metadata 40 | Included: 600; separate: 640. |
| S15 | [0,80), [50,100), each error +/-5 | Overlap bounded by 20 and 40. |
These test vectors verify arithmetic and representation invariants. Verifying a backend's consumer-usability contract additionally requires platform-level completion and memory-visibility instrumentation.¶
In a 1 ms window, 20 MB transmitted and 15 MB received across the same full-duplex interface mean 160 Gbit/s transmit and 120 Gbit/s receive. Their sum is bidirectional work, not 280 Gbit/s of utilization against one 200 Gbit/s directional capacity. Two request records referencing the same physical attempt do not double its bytes. A cancelled 4 MB attempt still contributes 4 MB to physical traffic when the selected counter observes those bytes. These examples use decimal MB and hypothetical values.¶