Migration & testnet rollout

[ben-malbeclabs]

End-to-end rollout of flex-algo to testnet. Must be completed and signed off before any production deployment.

Milestone: RFC-18: Migration & Testnet Rollout
RFC: #3288

---

Size: Large

Pre-requisites:

• All PRs (1–5) merged and deployed: onchain program, activator (with --enable-flex-algo), CLI tools, controller
• Controller features.yaml staged with enabled: false
• Activator running with --enable-flex-algo flag before migration is run

Test plan:

1. Create UNICAST-DEFAULT topology — doublezero topology create unicast-default .... Verify TopologyInfo PDA created with bit 0, flex-algo 128, EOS color 1. Verify controller generates no device config (enabled: false). (Must happen before migration — the migration command requires UNICAST-DEFAULT to exist.)

2. Run migration — doublezero-admin migrate flex-algo --dry-run first to preview, then run for real. Verify every Vpnv4 loopback has flex_algo_node_segments populated (backfilled by BackfillTopology, which also upgrades any pre-RFC-18 binary layout as a side effect). Verify all existing links have link_topologies[0] set to UNICAST-DEFAULT. Verify no existing node_segment_idx values changed.

3. Create a test topology — e.g. test-dummy, constraint include-any. Verify bit 2 is allocated (bit 1 is pre-marked for UNICAST-DRAINED and skipped), flex-algo 130, EOS color 3. Verify backfill allocated FlexAlgoNodeSegment entries on all Vpnv4 loopbacks. Will be deleted at end of plan.

4. Tag a small set of links — Select 2–3 testnet links forming a connected path. Tag with UNICAST-DEFAULT. Verify link_topologies[0] set onchain. Verify no device config yet.

5. Enable topology config — Set enabled: true, community_stamping.all: false. Restart controller. Verify administrative-group alias UNICAST-DRAINED group 1 and administrative-group alias UNICAST-DEFAULT group 0 on all devices. Verify show isis flex-algo shows algo 128 with only tagged links. Verify show tunnel rib system-colored-tunnel-rib brief shows (endpoint, color 1) entries.

6. Verify multicast unaffected — Verify PIM RPF paths unchanged via algo 0 (all links).

7. Enable stamping on a single test tenant — Set community_stamping.tenants: [<test-tenant-pubkey>]. Restart. Verify RM-USER-<test-tenant>-IN contains set extcommunity color 1. Verify VPN-IPv4 routes carry Color:CO(00):1. Verify next-hop resolves via color 1 tunnel. Verify other tenants have no color community.

8. Enable stamping for all tenants — Set community_stamping.all: true. Restart. Verify all unicast tenant route-maps contain set extcommunity color 1. Verify multicast unaffected.

9. Test deletion and revert — Clear and delete test-dummy. Verify alias and flex-algo 130 removed from all devices. Verify admin-group bit 2 not reused on next create.

10. Full revert — Set enabled: false. Restart. Verify no router traffic-engineering on all devices. Verify no flex-algo IS-IS config. Verify no set extcommunity color in any route-map. Verify traffic continues normally.

Sign-off: All 10 steps pass with no traffic disruption before proceeding to production.

Blockers: All previous milestones complete and passing

[ben-malbeclabs]

Status update (2026-04-10): Not started. Unblocked once PRs #3497 → #3512 → #3513 → #3514 → #3515 merge in order. Migration plan documented — activator must deploy before controller to handle the UNICAST-DEFAULT topology lookup at link activation.