replace client telemetry and traffic with native agent

Author: yyyyyt123

.dockerignore

@@ -0,0 +1,21 @@
+.git
+.github
+.netopsbench*
+.mypy_cache
+.pytest_cache
+.ruff_cache
+.venv
+build
+dist
+*.egg-info
+**/__pycache__
+**/*.py[cod]
+
+docs
+examples
+lab-topology
+scenario_results
+scenarios
+scripts
+tests
+native/client-agent/target

.env.example

@@ -32,7 +32,6 @@ NETOPSBENCH_INFLUXDB_BUCKET=netopsbench
 # NETOPSBENCH_LOG_LEVEL=INFO                   # DEBUG | INFO | WARNING | ERROR
 # NETOPSBENCH_NO_SUDO=0                        # Set to 1 in CI/test environments without sudo
 # NETOPSBENCH_PYTHON=/path/to/python3          # Interpreter used by repository shell wrappers
-# NETOPSBENCH_TRAFFIC_PARALLELISM=32           # Parallel docker exec workers for benchmark traffic start/stop
 
 # --- Optional semantic fault-type judge ---
 # NETOPSBENCH_FAULT_TYPE_JUDGE_ENABLED=0

.github/workflows/client-agent-image.yml

@@ -0,0 +1,59 @@
+name: client-agent-image
+
+on:
+  push:
+    branches:
+      - "codex/**"
+    tags:
+      - "v*"
+    paths:
+      - ".github/workflows/client-agent-image.yml"
+      - "containers/client/**"
+      - "native/client-agent/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Set immutable image tags
+        id: tags
+        shell: bash
+        run: |
+          tags="ghcr.io/netx-lab/netopsbench-client:sha-${GITHUB_SHA}"
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            tags="${tags}"$'\n'"ghcr.io/netx-lab/netopsbench-client:${GITHUB_REF_NAME}"
+          fi
+          {
+            echo "value<<EOF"
+            echo "${tags}"
+            echo "EOF"
+          } >> "${GITHUB_OUTPUT}"
+
+      - name: Build and publish linux/amd64 image
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: containers/client/Dockerfile
+          platforms: linux/amd64
+          push: true
+          provenance: false
+          tags: ${{ steps.tags.outputs.value }}
+
+      - name: Publish manifest digest
+        run: echo "digest=${{ steps.build.outputs.digest }}" >> "${GITHUB_STEP_SUMMARY}"

.github/workflows/test.yml

@@ -9,6 +9,44 @@ on:
   pull_request:
 
 jobs:
+  rust:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: native/client-agent
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install pinned Rust
+        run: |
+          rustup toolchain install 1.97.1 --profile minimal --component clippy,rustfmt
+          rustup default 1.97.1
+
+      - name: Format
+        run: cargo fmt --check
+
+      - name: Clippy
+        run: cargo clippy --locked --all-targets -- -D warnings
+
+      - name: Test
+        run: cargo test --locked
+
+  client-image:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build client image
+        run: docker build -f containers/client/Dockerfile -t netopsbench-client:test .
+
+      - name: Verify native-only runtime
+        run: |
+          docker run --rm netopsbench-client:test netopsbench-client-agent --version
+          docker run --rm netopsbench-client:test sh -lc \
+            'command -v ping && command -v traceroute && ! command -v python3 && ! command -v iperf3'
+
   lint:
     runs-on: ubuntu-latest
     steps:

.gitignore

@@ -1,4 +1,5 @@
 __pycache__/
+native/client-agent/target/
 *.py[cod]
 *$py.class
 .venv/

containers/client/Dockerfile

@@ -0,0 +1,27 @@
+# syntax=docker/dockerfile:1
+FROM rust:1.97.1-alpine3.24@sha256:3c38f3f82c2f3d73da3b38e18d279393a04cb43ddded0e35088a8c3324d40900 AS builder
+
+RUN apk add --no-cache musl-dev
+WORKDIR /src/native/client-agent
+COPY native/client-agent/Cargo.toml native/client-agent/Cargo.lock native/client-agent/rust-toolchain.toml ./
+COPY native/client-agent/src ./src
+RUN cargo build --locked --release --target x86_64-unknown-linux-musl
+
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
+
+RUN apk add --no-cache \
+      bash \
+      ca-certificates \
+      curl \
+      ethtool \
+      iproute2 \
+      iputils \
+      procps \
+      tcpdump \
+      traceroute
+
+COPY --from=builder \
+  /src/native/client-agent/target/x86_64-unknown-linux-musl/release/netopsbench-client-agent \
+  /usr/local/bin/netopsbench-client-agent
+
+CMD ["sleep", "infinity"]

docs/content/docs/debug-operate/observability.mdx

@@ -91,7 +91,11 @@ bash scripts/runtime/deploy.sh xs lab-topology
 export NETOPSBENCH_TOPOLOGY_DIR="$PWD/lab-topology/generated_topology_xs"
 ```
 
-`deploy.sh` generates topology metadata, renders Telegraf config, starts InfluxDB / Telegraf / Grafana, and deploys Pingmesh agents.
+`deploy.sh` generates topology metadata, renders Telegraf config, starts InfluxDB / Telegraf / Grafana, and starts the native Pingmesh and background-traffic processes in each client.
+
+The default client image is pinned by digest. A custom client image must provide
+`/usr/local/bin/netopsbench-client-agent`; runtime preparation fails explicitly
+when the binary is absent.
 
 Common overrides:
 

docs/content/docs/run-benchmarks/interactive-simulator.mdx

@@ -57,7 +57,8 @@ tool and diagnosis actions. Install `netopsbench[simulator]` and run
 from accepting additional tool or submit actions after its deadline; it does
 not attempt to terminate arbitrary user threads while an action is running.
 
-When using a large topology, keep only that topology's Pingmesh, BGP collector,
-and Telegraf processes active on the host. Other labs may remain deployed and
-warm. See the observation-validity guidance in
+Large warm topologies may keep their native Pingmesh, BGP collector, and
+Telegraf processes active together. The simulator still rejects an incident
+when the active topology does not meet readiness or complete-coverage gates.
+See the observation-validity guidance in
 [Benchmark Methodology](/docs/run-benchmarks/methodology).

docs/content/docs/run-benchmarks/methodology.mdx

@@ -59,20 +59,28 @@ Scenarios are generated from the packaged canonical campaign spec. Running `neto
 
 ## Observation validity
 
-Pingmesh compares an explicit healthy baseline with the fault observation window. A path is reported as a latency spike only when the median `rtt_avg` for that source/destination path increases by at least 20 ms; an isolated RTT peak does not qualify. This rule is shared by built-in and custom topologies and intentionally does not detect smaller latency changes.
+Pingmesh compares an explicit healthy baseline with the fault observation
+window. A path is reported as a latency spike when its median `rtt_avg`
+increases by at least 20 ms, or when the median increases by at least 20 ms in
+two independent ECMP port batches. A peak or a single elevated port batch does
+not qualify. Packet-loss evidence likewise combines a strong per-path count
+with source/destination leaf concentration, so uniformly distributed
+background loss is not presented as a localized fault. These rules are shared
+by built-in and custom topologies.
 
 Background traffic must start its complete topology-derived flow matrix before the baseline is captured. A partial matrix is an infrastructure-invalid case, rather than a degraded observation presented to the agent.
 
-On one host, run observability for only one large topology at a time. Other
-Containerlab topologies may remain deployed and warm, but pause their Pingmesh,
-BGP collector, and Telegraf processes while measuring the active large
-topology. Co-running multiple large telemetry pipelines causes host scheduling
-pressure that can appear as network latency. This is an operational constraint,
-not part of scenario or detector semantics.
-
-The 0.2 collector retains complete BGP snapshots. On xlarge topologies this
-file-to-Telegraf path may fall behind its 10-second polling interval, so use
-the tool's reported data freshness when interpreting BGP event evidence.
+Each topology sends native Pingmesh batches through its topology-local
+Telegraf listener. Multiple warm topologies may therefore keep observability
+active together; readiness and complete coverage remain mandatory for every
+case. Host capacity is not hidden by a longer timeout or a topology-specific
+detector threshold.
+
+The 0.2 collector polls BGP every 10 seconds. On topologies with more than 128
+routing devices, every poll writes the collection index, state transitions,
+and all non-Established neighbors; stable complete-neighbor snapshots are
+written every 60 seconds. Use the tool's reported data freshness when
+interpreting BGP evidence.
 
 ## Scoring dimensions
 

docs/content/docs/run-benchmarks/run-scenario-vs-suite.mdx

@@ -103,7 +103,6 @@ Useful environment overrides:
 | `BENCH_SCALES` | Space-separated scale list such as `xs small`. |
 | `BENCH_WORKERS_<SCALE>` | Worker count override for one scale, for example `BENCH_WORKERS_LARGE=2`. |
 | `BENCH_CLEAN_RUNS=1` | Explicitly remove previous `.netopsbench/runs/` artifacts before the batch. By default, previous reports and traces are preserved. |
-| `NETOPSBENCH_TRAFFIC_PARALLELISM` | Bounded client traffic start/stop concurrency; defaults to 32. |
 
 The script writes logs under `scenario_results/benchmark_logs_<timestamp>/`, records the run ids for the batch in `benchmark_runs_<timestamp>.jsonl`, and writes a CSV summary under `scenario_results/benchmark_summary_<timestamp>.csv`. Run artifacts use timestamp ids such as `run-20260605T124040Z`; use `netopsbench trace view` to sync trace-enabled runs into the local Harbor viewer cache and inspect saved traces.