Implem snmp managers

.claude/hooks/serena-first.sh

@@ -11,13 +11,13 @@ tool=$(echo "$input" | jq -r '.tool_name // ""')
 
 if [[ "$tool" == "Bash" ]]; then
   cmd=$(echo "$input" | jq -r '.tool_input.command // ""')
-  # Match rg/grep/ag/ack invocations referencing .go or .tf (as arg, glob, or --type)
-  if [[ "$cmd" =~ (^|[^[:alnum:]_])(rg|grep|ag|ack)([[:space:]]|$) ]]; then
+  # Match raw read/search invocations referencing .go or .tf (as arg, glob, or --type)
+  if [[ "$cmd" =~ (^|[^[:alnum:]_])(rg|grep|ag|ack|cat|sed|head|tail|awk|less|view)([[:space:]]|$) ]]; then
     if [[ "$cmd" =~ \.(go|tf)([[:space:]\"\'\)]|$) ]] \
        || [[ "$cmd" =~ --type[=[:space:]]+(go|terraform|tf|hcl) ]] \
        || [[ "$cmd" =~ -t[[:space:]]+(go|terraform|tf|hcl) ]]; then
       cat >&2 <<'EOF'
-[serena-first] WARNING: rg/grep on .go/.tf detected. Prefer Serena MCP:
+[serena-first] WARNING: raw read/search on .go/.tf detected. Prefer Serena MCP:
   - mcp__serena__find_symbol
   - mcp__serena__get_symbols_overview
   - mcp__serena__search_for_pattern (with relative_path)
@@ -60,7 +60,7 @@ Use Serena MCP instead:
   - File overview       → mcp__serena__get_symbols_overview
   - Pattern in symbol   → mcp__serena__search_for_pattern (with relative_path)
 Read remains allowed (required before Edit).
-If you truly need a raw text search, use `rg` via Bash.
+Raw text search is a last resort — prefer mcp__serena__search_for_pattern scoped to a relative_path.
 EOF
   exit 2
 fi

.planning/MILESTONES.md

@@ -1,5 +1,15 @@
 # Milestones: Terraform Provider FlashBlade
 
+## v2.23.1 flashblade_snmp_manager Resource & Data Source (Shipped: 2026-05-20)
+
+**Phases completed:** 1 phases, 1 plans, 13 tasks
+
+**Key accomplishments:**
+
+- flashblade_snmp_manager resource + data source (full CRUD on /api/2.23/snmp-managers) with atomic v2c/v3 nested blocks, sensitive write-once secrets (community + 2 passphrases), per-leaf drift detection across 6 leaves, and in-place v2c<->v3 switch support.
+
+---
+
 ## Completed Milestones
 
 ### v1.0 — Core Provider (completed 2026-03-28)
@@ -261,6 +271,7 @@
 **Last phase number:** 58
 
 **Known gaps (tech debt):**
+
 - `pulumi import` round-trip tests on composite-ID resources: validated statically but not tested live against array (deferred to post-alpha)
 - ProgramTest coverage limited to 6 examples; full 54-resource coverage deferred to post-alpha
 - TEST-02 examples delivered but live execution on array not run (deferred per VERIFICATION.md)
@@ -289,6 +300,7 @@
 **Last phase number:** 60
 
 **Known gaps (tech debt):**
+
 - HCL acceptance fixtures under `examples/acceptance/api-2-23/` not authored by GSD planner — acceptance was run from existing operator workflow
 - CI does not yet run acceptance against par5/pa7 — manual operator-driven sign-off
 - Pulumi SDK regen + private release for `pulumi-2.23.0` deferred to a dedicated milestone

.planning/PROJECT.md

@@ -2,44 +2,29 @@
 
 ## Current State
 
-**Latest shipped:** v2.23.0 (FlashBlade API 2.23 Upgrade) — 2026-05-20
-**Active milestone:** None — awaiting next milestone planning
+**Latest shipped:** v2.23.1 (`flashblade_snmp_manager` resource + data source) — 2026-05-20
+**Active milestone:** _(planning next — run `/gsd:new-milestone`)_
 
-**Shipped to date:** 16 milestones, 60 phases
-**TF Provider:** v2.23.0 (55 resources + 43 data sources, 807 tests, [GitHub Release](https://github.com/numberly/terraform-provider-mica/releases/tag/v2.23.0))
+**Shipped to date:** 17 milestones, 61 phases
+**TF Provider:** v2.23.1 (56 resources + 44 data sources, 816 tests on branch `implem-snmp-managers`, pending tag + merge to `main`)
 **Pulumi Bridge:** pulumi-2.22.3 alpha (private distribution via GitHub Releases, Python + Go SDKs) — bridge schema regen'd for API 2.23 but no new Pulumi release yet
 
-Next steps: plan the next milestone via `/gsd:new-milestone` — typical candidates:
-- `pulumi-2.23.0` (publish the regen'd bridge schema, generate Python + Go SDKs for API 2.23)
-- API 2.24+ when swagger lands
-- Hardening: integrate par5/pa7 acceptance into CI, author HCL fixtures under `examples/acceptance/`
-- Other feature additions
-
-## Last Completed Milestone: v2.23.0 — FlashBlade API 2.23 Upgrade (shipped 2026-05-20)
-
-**Goal:** Aligner le provider sur l'API FlashBlade 2.23, ajouter le support des Workloads et Resiliency Groups, puis livrer la release (validation, docs, tag, merge).
-
-**Target features (déjà implémentés sur `test/api-upgrade-2.23`):**
-- API version bump 2.22 → 2.23 (provider, client, mock, examples, references)
-- `flashblade_workload` resource + data source
-- `flashblade_resiliency_group` data source (DS-only)
-- `flashblade_resiliency_group_member` data source (DS-only)
-- Schéma v1 (workload field) sur 6 ressources : file_system, file_system_export, nfs_export_policy, smb_client_policy, smb_share_policy, qos_policy
-- qos_policy : computed `context` field
-- Pulumi bridge regen (schema.json, bridge-metadata.json, schema-embed.json)
-- api-diff / api-upgrade skills enhancements (per-field variants, codebase scan, BLOCKING method detection)
-
-**Target features (à livrer dans la finalisation):**
-- Validation `make test` + `make lint` + `make docs` clean sur la branche
-- Acceptance tests live FlashBlade (par5, pa7) sur les nouvelles ressources et les schémas migrés
-- CHANGELOG + release notes v2.23.0
-- ROADMAP.md fix-up (coverage counters, version footer)
-- Tag `v2.23.0` + merge `test/api-upgrade-2.23` → `main`
-
-**Key context:**
-- Travail rétro : ~167 fichiers / ~7000 insertions déjà sur la branche, piloté par les skills `api-diff` et `api-upgrade`
-- 2 phases prévues : Phase 59 (consolidation rétro + validation), Phase 60 (release & merge)
-- TEST_BASELINE actuel (GNUmakefile) : 807 — à mettre à jour quand v2.23.0 ship
+## Last Completed Milestone: v2.23.1 — `flashblade_snmp_manager` (shipped 2026-05-20)
+
+**Delivered:**
+- `flashblade_snmp_manager` resource + data source with full CRUD on `/api/2.23/snmp-managers`
+- Atomic `v2c` and `v3` `SingleNestedAttribute` blocks with enum validators (`notification`, `version`, `auth_protocol`, `privacy_protocol`); in-place v2c↔v3 switch supported
+- Write-once sensitive secrets (`community`, `auth_passphrase`, `privacy_passphrase`): `Sensitive: true`, never logged, nulled on Import, mock handler strips them on response
+- Per-leaf drift detection on 6 non-sensitive leaves; 3 explicit skip markers on sensitive fields
+- 9 new `TestUnit_` tests (5 client + 3 resource + 1 DS); total 816 (baseline 807, unchanged)
+- All 13 SNMP-01..SNMP-13 requirements satisfied; verification `passed` (9/9 must-haves)
+
+**Phases:** 61 (1 phase, 1 monolithic plan, 13 tasks)
+**Last phase number:** 61
+**Branch:** `implem-snmp-managers` (pending squash-merge to `main` + tag `v2.23.1`)
+**Archives:** [milestones/v2.23.1-ROADMAP.md](milestones/v2.23.1-ROADMAP.md) · [milestones/v2.23.1-REQUIREMENTS.md](milestones/v2.23.1-REQUIREMENTS.md)
+
+**Previous milestones:** v2.23.0 (FlashBlade API 2.23 Upgrade, [archive](milestones/v2.23.0-ROADMAP.md)) · pulumi-2.22.3 (Pulumi Bridge Alpha, [archive](milestones/pulumi-2.22.3-ROADMAP.md))
 
 ## What This Is
 
@@ -49,22 +34,6 @@ A Terraform provider for Pure Storage FlashBlade that enables operational teams
 
 Operational teams can reliably create, update, delete, and reconcile drift on FlashBlade storage resources (buckets, file systems, policies) through Terraform with zero surprises — every plan reflects reality, every apply converges.
 
-## Last Completed Milestone: pulumi-2.22.3 — Pulumi Bridge Alpha (shipped 2026-04-24)
-
-**Goal:** Expose the FlashBlade Terraform provider to Pulumi users (Python + Go) via the official `pulumi/pulumi-terraform-bridge` (`pkg/pf/*` for terraform-plugin-framework), in a new `./pulumi/` sub-directory with its own `go.mod`, distributed privately through GitHub releases.
-
-**Target features:**
-- Pulumi bridge scaffold in `./pulumi/` (tfgen + runtime binaries, ProviderInfo, embedded schema)
-- Mapping of all 28 resources + 21 data sources (auto-tokenization + targeted overrides for composite IDs, secrets, timeouts)
-- Python and Go SDK generation (embedded `schema.json` + `bridge-metadata.json`)
-- ProgramTest coverage on 3 representative resources (target, remote_credentials, bucket)
-- Private release pipeline: GitHub Actions build + goreleaser + cosign, tag `pulumi-2.22.3`
-- Auto-converted HCL examples (`PULUMI_CONVERT=1`) + 2 hand-written examples (bucket-py, bucket-go)
-
-**Key context:** Research already consolidated in `pulumi-bridge.md` (12 sections, 8 pitfalls, 6-step POC plan). Bridges the existing v2.22.3 provider (28 resources, 21 DS, 779 tests) without rewriting anything.
-
-**Last shipped:** v2.22.3 — Convention Compliance (2026-04-20, 779 tests, 0 lint issues, 12/12 requirements satisfied) — [archive](milestones/v2.22.3-ROADMAP.md)
-
 ## Requirements
 
 ### Validated
@@ -88,10 +57,12 @@ Operational teams can reliably create, update, delete, and reconcile drift on Fl
 - ✓ 814 unit tests, role_name/policy_name composite ID (role FIRST per policy-contains-colon constraint) — v2.22.2
 - ✓ Directory Service Role POST `?names=` bug fix + schema v1 (`name` Required + RequiresReplace) + upgrader — Phase 50.1
 - ✓ 818 unit tests, end-to-end validated against real FlashBlades (par5, pa7) — Phase 50.1
+- ✓ FlashBlade API 2.23 upgrade — workload + resiliency-group + 6 schema v1 migrations — v2.23.0
+- ✓ `flashblade_snmp_manager` resource + data source (v2c/v3 nested blocks, write-once secrets, per-leaf drift, 9 new tests) — v2.23.1 (SNMP-01..SNMP-13)
 
 ### Active
 
-_No active milestone — start the next one via `/gsd:new-milestone`._
+_(planning next milestone — run `/gsd:new-milestone`)_
 
 ### Known Follow-up Defects
 
@@ -153,4 +124,4 @@ This document evolves at phase transitions and milestone boundaries.
 4. Update Context with current state
 
 ---
-*Last updated: 2026-05-20 — milestone v2.23.0 shipped (tag `v2.23.0`, squash `3fd485d`, GitHub Release published). Archived to `.planning/milestones/v2.23.0-*`.*
+*Last updated: 2026-05-20 — after v2.23.1 milestone (`flashblade_snmp_manager` resource + data source archived; ready for next milestone).*

.planning/STATE.md

@@ -1,15 +1,15 @@
 ---
 gsd_state_version: 1.0
-milestone: v2.23.0
-milestone_name: FlashBlade API 2.23 Upgrade
-status: shipped
-last_updated: "2026-05-20T09:30:00.000Z"
+milestone: v2.23.1
+milestone_name: "**Goal:** Ship `flashblade_snmp_manager` resource + data source"
+status: verifying
+last_updated: "2026-05-20T13:24:59.298Z"
 last_activity: 2026-05-20
 progress:
-  total_phases: 2
-  completed_phases: 2
-  total_plans: 10
-  completed_plans: 10
+  total_phases: 1
+  completed_phases: 1
+  total_plans: 1
+  completed_plans: 1
   percent: 100
 ---
 
@@ -20,63 +20,74 @@ progress:
 See: .planning/PROJECT.md (updated 2026-05-20)
 
 **Core value:** Operational teams can reliably create, update, delete, and reconcile drift on FlashBlade storage resources through Terraform with zero surprises.
-**Current focus:** No active milestone — `/gsd:new-milestone` for next cycle
+**Current focus:** Phase 61 — flashblade-snmp-manager
 
 ## Current Position
 
-Milestone: v2.23.0 (FlashBlade API 2.23 Upgrade) — **SHIPPED 2026-05-20**
-Status: Archived — no active milestone
-Last activity: 2026-05-20 — milestone archived
+Milestone: v2.23.1 (`flashblade_snmp_manager`) — **EXECUTION COMPLETE, AWAITING VERIFICATION**
+Phase: 61
+Plan: Not started
+Status: Phase complete — ready for verification
+Last activity: 2026-05-20
 
-Progress: [██████████] 100% (2/2 phases, 10/10 plans)
+Progress: [██████████] 100% (1/1 phases, 1/1 plans)
 
 ## Recent Milestones
 
+- 🚧 **v2.23.1** — `flashblade_snmp_manager` (in planning, started 2026-05-20)
 - ✅ **v2.23.0** — FlashBlade API 2.23 Upgrade (shipped 2026-05-20, 807 tests, 33/33 requirements, [release](https://github.com/numberly/terraform-provider-mica/releases/tag/v2.23.0), [archive](milestones/v2.23.0-ROADMAP.md))
 - ✅ **pulumi-2.22.3** — Pulumi Bridge Alpha (shipped 2026-04-24, 836 TF tests + 23 bridge tests, [archive](milestones/pulumi-2.22.3-ROADMAP.md))
 - ✅ **v2.22.3** — Convention Compliance (shipped 2026-04-20, 779 tests, 12/12 requirements, [archive](milestones/v2.22.3-ROADMAP.md))
 - ✅ **v2.22.2** — Directory Service Roles & Role Mappings (shipped 2026-04-17, 818 tests, [archive](milestones/v2.22.2-ROADMAP.md))
-- ✅ **v2.22.1** — Directory Service – Array Management (shipped 2026-04-17, 798 tests, [archive](milestones/v2.22.1-ROADMAP.md))
 
 ## Performance Metrics
 
-- **Provider tests:** 836 (baseline at last shipped milestone pulumi-2.22.3)
-- **TEST_BASELINE (GNUmakefile):** 807 — to refresh once API 2.23 work lands on main (RELEASE-06)
-- **Lint:** 0 issues at last release
-- **Resources / Data sources:** 54 / 40 pre-API-2.23. Expected delta on merge: +1 resource (workload), +3 data sources (workload, resiliency_group, resiliency_group_member)
+- **Provider tests:** 816 (post-Phase-61, baseline 807 + 9 new for `flashblade_snmp_manager`)
+- **TEST_BASELINE (GNUmakefile):** 807 — NOT bumped (reserved for release milestones, will move to 816 at v2.23.1 ship)
+- **Lint:** 0 issues
+- **Resources / Data sources:** 56 / 44 (post-Phase-61, +1 resource +1 data source `flashblade_snmp_manager`)
+- **Phase 61 plan 01 execution:** 13 tasks, 11 atomic commits on `implem-snmp-managers`, ~15 min
 
 ## Accumulated Context
 
-### Key Decisions (v2.23.0)
+### Key Decisions (v2.23.1)
 
-- Retro milestone: 19/33 requirements already implemented on branch `test/api-upgrade-2.23`. They are mapped to Phase 59 for traceability only, not re-execution.
-- 14 requirements are active work: VALID-01..06 (Phase 59), RELEASE-01..07 (Phase 60).
-- Tight 2-phase split (coarse granularity): consolidation+validation, then release.
-- Acceptance validation on par5 + pa7 is mandatory before merge (VALID-04).
-- Pulumi SDK regen / publish (`pulumi-2.23.0`) is OUT of scope — separate milestone.
+- Resource scope = pure CRUD on `/snmp-managers`. The connectivity test endpoint `GET /snmp-managers/test` is OUT of scope (resource-action pattern, future milestone alongside `/dns/test`, `/smtp/test`, etc.).
+- Branch from clean `main`: `implem-snmp-managers`.
+- Domain placement: `internal/client/models_admin.go` (with `SmtpServer`, `SyslogServer`, `AlertWatcher`). Confirmed via `mcp__serena__get_symbols_overview`.
+- Pre-check (Serena `find_symbol` on `SnmpManager` / `Snmp*` / `snmp_manager`): no existing code, greenfield implementation.
+- Sensitive write-once fields: `v2c.community`, `v3.auth_passphrase`, `v3.privacy_passphrase` — never returned by API GET → keep state value, never overwrite in Read; null in ImportState.
+- Validators choose the **stricter POST-time constraints** from `_snmp_v3_post` (privacy_passphrase 8-63, auth_passphrase ≤ 32) for safer UX.
+- No cross-field validator on `version` vs. `v2c`/`v3` — let API validate (alignment with provider conventions).
+- `TEST_BASELINE` (GNUmakefile) must NOT be bumped in v2.23.1 — reserved for release milestones.
 
-### Key Decisions (pulumi-2.22.3, kept for context)
+### Key Decisions (carried from v2.23.0, for context)
 
-- Module path: `github.com/numberly/opentofu-provider-flashblade`. Bridge modules under `./pulumi/provider/` and `./pulumi/sdk/go/` with `replace ../../`.
-- Bridge: `pulumi-terraform-bridge/v3 v3.127.0`, `pulumi/sdk/v3 v3.231.0`, `pulumi/pkg/v3 v3.231.0`.
-- Schema commit policy: `schema.json` + `bridge-metadata.json` committed; CI gate via `git diff --exit-code` after `make tfgen` — directly relevant to VALID-05.
-- Composite IDs use `/` separator with string keys.
-- Tokens via SingleModule (`flashblade:index/*`).
+- Pulumi SDK regen / publish is owned by a separate `pulumi-2.23.x` milestone (out of scope here too).
+
+### Key Decisions (Phase 61 execution)
+
+- **Mock handler wiring follows codebase pattern** (per-test registration via `ms.Mux`), not plan literal text (`server.go`). The existing codebase never wires resource handlers in `NewMockServer`. Deviation documented in SUMMARY.md.
+- **Drift logs inlined to satisfy "exactly 6" contract** (not routed through a helper) for grep-ability and explicit per-leaf branching.
+- **Strict POST-time validators applied at provider schema level for both Create AND Update** (auth_passphrase ≤ 32, privacy_passphrase 8..63) — predictable validation before PATCH.
 
 ### Open Todos
 
-- Plan Phase 59 via `/gsd:plan-phase 59`.
-- At Phase 60 release time: bump `TEST_BASELINE` in `GNUmakefile` (RELEASE-06).
+- Run `/gsd:verify-phase 61` to validate the execution.
+- After verification: tag `v2.23.1`, push branch `implem-snmp-managers`, open PR to `main`.
+- At v2.23.1 release: bump `TEST_BASELINE` in `GNUmakefile` from 807 to 816.
 
 ### Open Blockers
 
 _(none)_
 
 ## Next Steps
 
-Run `/gsd:plan-phase 59` to decompose Phase 59 into executable plans (consolidation + validation work covering VALID-01..06, plus retro traceability for the 19 already-shipped API/WORKLOAD/RESILIENCY/SCHEMA/BRIDGE requirements).
+Run `/gsd:verify-phase 61` to validate the execution. On pass: tag v2.23.1, open PR `implem-snmp-managers` → `main`.
 
 ## Session Log
 
-- 2026-05-20 — Milestone v2.23.0 created (retro + finalisation for API 2.23 upgrade on branch `test/api-upgrade-2.23`).
-- 2026-05-20 — Roadmap created: Phase 59 (API 2.23 Consolidation & Validation), Phase 60 (v2.23.0 Release). 33/33 requirements mapped.
+- 2026-05-20 — Milestone v2.23.1 created (`flashblade_snmp_manager` CRUD, branch `implem-snmp-managers`). Pre-check Serena: no collision. API schemas validated via `swagger-to-reference` + raw `swagger-2.23.json`.
+- 2026-05-20 — Roadmap created: Phase 61 (Implement `flashblade_snmp_manager` Resource & Data Source). 13/13 requirements mapped.
+- 2026-05-20 — Phase 61 context gathered. 20 decisions locked (D-01..D-20) in `phases/61-flashblade-snmp-manager/61-CONTEXT.md`. Next: `/gsd:plan-phase 61`.
+- 2026-05-20 — **Phase 61 plan 01 executed.** 13 tasks, 11 atomic commits on `implem-snmp-managers` (a241ec1 → 24098d1). 816 tests (807 + 9), lint clean, docs idempotent, ROADMAP row moved to Implemented. SUMMARY at `.planning/phases/61-flashblade-snmp-manager/61-01-implement-snmp-manager-SUMMARY.md`.