vmware-debug 1.11.4__tar.gz → 1.12.1__tar.gz

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "vmware-debug",
   "displayName": "VMware Debug",
-  "version": "1.11.4",
+  "version": "1.12.1",
   "description": "VMware incident timeline, root-cause routing, local case ledger; no vSphere access. 14 MCP tools.",
   "author": {
     "name": "Wei Zhou",

vmware_debug-1.12.1/.clawhubignore

@@ -0,0 +1,19 @@
+# What `clawhub package publish` uploads from this folder.
+#
+# The CLI does not read .gitignore — only this file. Without it, publishing from
+# the repo root uploads everything on disk: .venv/, dist/, and any untracked
+# credential file (mcp-publisher leaves .mcpregistry_*_token here). So this is an
+# allowlist: ignore every top-level entry, then re-include only the plugin.
+/*
+!/openclaw.plugin.json
+!/package.json
+!/.claude-plugin/
+!/.mcp.json
+!/skills/
+!/README.md
+!/LICENSE
+
+# Never ship these even inside an allowed directory.
+.DS_Store
+__pycache__/
+*.pyc

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-debug==1.11.4",
+        "vmware-debug==1.12.1",
         "vmware-debug-mcp"
       ]
     }

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-debug
-Version: 1.11.4
+Version: 1.12.1
 Summary: VMware diagnostic brain — offline incident triage, log/event correlation, and root-cause routing across the VMware skill family
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-Debug
 Project-URL: Repository, https://github.com/vmware-skills/VMware-Debug
@@ -18,7 +18,7 @@ Requires-Dist: mcp[cli]<2.0,>=1.10
 Requires-Dist: pyyaml<7.0,>=6.0
 Requires-Dist: rich<15.0,>=13.0
 Requires-Dist: typer<1.0,>=0.12
-Requires-Dist: vmware-policy<2.0,>=1.13.1
+Requires-Dist: vmware-policy<2.0,>=1.15.0
 Description-Content-Type: text/markdown
 
 <!-- mcp-name: io.github.vmware-skills/vmware-debug -->

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/RELEASE_NOTES.md

@@ -1,3 +1,47 @@
+## v1.12.1 — every CLI command declares what it reaches
+
+Across the family, CLI reads never wrote `~/.vmware/audit.db`; they now do (`@audited`, under the
+MCP tool's name). To keep that from regressing, every CLI command must declare `@guarded` (a write),
+`@audited` (reaches a remote system) or `@cli_local` (reaches nothing remote), and a family gate fails
+any command that declares none.
+
+This skill's 4 CLI commands reach nothing remote; each is marked `@cli_local` with its reason.
+Their behaviour does not change.
+
+Requires `vmware-policy>=1.15.0`.
+
+## v1.12.0 — real alert titles get a category
+
+Eight alerts read off a lab vCenter 8.0.3 and Aria 8.18.7 were passed through `triage`, and six
+came back `uncategorized`; the top hypothesis was "uncategorized" itself. Five of them were not odd
+spellings of subsystems the taxonomy already had — they were subsystems it had no category for:
+
+* **`hardware`** (tpm, attestation, ipmi, sensor, bmc) — "Host TPM attestation alarm". The catalogue
+  already routed `hardware`, but the classifier could never emit it. Its plan now asks vmware-monitor
+  for the host sensors and the CIM Server state that supplies them (new `host_hardware` class).
+* **`licensing`** (license) — "License will soon expire", "Expired vCenter Server license". Routes to
+  vmware-monitor `license_status` (which asset holds which key). An Aria alert about a vCenter license
+  is built from vCenter's data, so it is not counted as a second source: licensing stays at Candidate.
+* **`data_collection`** (adapter instance, not receiving data, collector group, cloud proxy) — "Objects
+  are not receiving data from adapter instance". Routes to Aria's adapters, collector groups, node
+  health and resources, plus vmware-monitor for whether the source vCenter is reachable. Not a bare
+  "collector": vCenter's own services are named that way ("ESXi Dump Collector service") and stay
+  under `platform`.
+* **`auth`** now reads "password" — "Root user password expired".
+
+Seven of the eight now classify. "Group population health is degraded" stays uncategorized on purpose:
+it is a roll-up of member health and names no subsystem. Against all 427 vSphere event types the
+taxonomy now reads 140 (was 124): 14 licensing and 2 password events, and no type changed its first
+category. The keyword table is at 100, the cap its padding test allows — the next category will have
+to argue for moving it.
+
+**`case_readiness` recognises vmware-aiops.** It used to land in `unrecognised_skills` although routing
+sent power_lifecycle cases to it. A new `vm_operations` class lists `vm_list_snapshots` only. AIops's
+cluster summary and investigation bundles call vmware-monitor's code and would have counted monitor's
+data as a second source; `vm_task_status` needs a task id a plan does not have, and called with a VM
+name it answers "gone" with no error. With monitor and aiops, power_lifecycle now reaches Probable;
+data_collection reaches Probable with monitor and aria.
+
 ## v1.11.4 — concurrent writers stop losing case entries
 
 Two agents on one case — a supported setup, since `OPS_HOME` can point at a shared folder — lost

vmware_debug-1.12.1/openclaw.plugin.json

@@ -0,0 +1,24 @@
+{
+  "id": "vmware-debug",
+  "name": "VMware Debug",
+  "description": "VMware incident timeline, root-cause routing, local case ledger; no vSphere access. 14 MCP tools.",
+  "skills": [
+    "./skills"
+  ],
+  "mcpServers": {
+    "vmware-debug": {
+      "transport": "stdio",
+      "command": "uvx",
+      "args": [
+        "--from",
+        "vmware-debug==1.12.1",
+        "vmware-debug-mcp"
+      ]
+    }
+  },
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {}
+  }
+}

vmware_debug-1.12.1/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@zw008/vmware-debug",
+  "version": "1.12.1",
+  "description": "VMware incident timeline, root-cause routing, local case ledger; no vSphere access. 14 MCP tools.",
+  "private": true,
+  "license": "MIT",
+  "homepage": "https://github.com/vmware-skills/VMware-Debug",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/vmware-skills/VMware-Debug.git"
+  },
+  "openclaw": {
+    "compat": {
+      "pluginApi": ">=2026.3.24-beta.2"
+    },
+    "build": {
+      "openclawVersion": "2026.3.24-beta.2"
+    }
+  }
+}

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-debug"
-version = "1.11.4"
+version = "1.12.1"
 description = "VMware diagnostic brain — offline incident triage, log/event correlation, and root-cause routing across the VMware skill family"
 readme = "README.md"
 license = "MIT"
@@ -21,7 +21,7 @@ dependencies = [
     "typer>=0.12,<1.0",
     "rich>=13.0,<15.0",
     "mcp[cli]>=1.10,<2.0",
-    "vmware-policy>=1.13.1,<2.0",
+    "vmware-policy>=1.15.0,<2.0",
     # Imported directly by ops/cases/grading.py for the rules file. It has
     # always arrived transitively via vmware-policy; a package should
     # declare what it imports rather than rely on a dependency's dependency.

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/vmware-skills/VMware-Debug",
     "source": "github"
   },
-  "version": "1.11.4",
+  "version": "1.12.1",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-debug",
-      "version": "1.11.4",
+      "version": "1.12.1",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/skills/vmware-debug/SKILL.md

@@ -51,7 +51,7 @@ write tools touch only the local case ledger.
 ## Quick Install
 
 ```bash
-uv tool install vmware-debug==1.11.4
+uv tool install vmware-debug==1.12.1
 vmware-debug categories          # see what it can diagnose
 ```
 

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/skills/vmware-debug/references/capabilities.md

@@ -31,9 +31,15 @@ fixed in-process constant, so `total` is a real count and `limit` is `null`.
 ## Symptom categories
 
 `storage`, `network`, `compute`, `ha_drs`, `host_lifecycle`, `power_lifecycle`,
-`auth`, `platform`.
+`auth`, `platform`, `hardware`, `licensing`, `data_collection`.
 See `references/routing.md` for keyword signatures and the skill each routes to.
 
+`hardware`, `licensing` and `data_collection` were added after real alert titles
+("Host TPM attestation alarm", "License will soon expire", "Objects are not
+receiving data from adapter instance") matched no category at all. A roll-up
+such as "Group population health is degraded" is deliberately left
+uncategorized: it names no subsystem, and the cause is in one of its members.
+
 `host_lifecycle` is a host changing its own availability state — maintenance
 mode, shutdown, reboot, standby, connection loss, sync failure.
 `power_lifecycle` is the VM-level equivalent. They are separate because they are

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/skills/vmware-debug/references/routing.md

@@ -11,9 +11,12 @@ Keep this in sync with `_CATEGORY_SIGNATURES` in `vmware_debug/ops/timeline.py`
 | **compute** | cpu ready, memory, balloon, swap, contention, numa | vmware-aria (metrics + anomalies) | pilot (rightsizing) |
 | **ha_drs** | ha, high availability, drs, failover, admission control, isolation | vmware-monitor, vmware-aiops (cluster) | pilot |
 | **host_lifecycle** | maintenance mode, shut down of, host reboot, standby mode, lost connection to, cannot synchronize, not responding | vmware-monitor (host/cluster state), vmware-harden (drift — a host that left service on cue was told to), vmware-log-insight (vpxd/hostd) | pilot |
-| **power_lifecycle** | power on/off, failed to start, boot, vmx, ovf, clone, snapshot | vmware-aiops (task status, snapshot tree), vmware-monitor | aiops |
-| **auth** | login, authentication, denied, 401, 403, token, certificate, tls | config/.env, target cert + time sync | config fix |
+| **power_lifecycle** | power on/off, failed to start, boot, vmx, ovf, clone, snapshot | vmware-aiops (snapshot tree), vmware-monitor | aiops |
+| **auth** | login, authentication, denied, 401, 403, token, certificate, tls, password | config/.env, target cert + time sync | config fix |
 | **platform** | vpxd, hostd, service restart, crash, 503, not responding, disconnected | vmware-monitor (connection/service), vmware-log-insight (vpxd/hostd) | pilot |
+| **hardware** | tpm, attestation, ipmi, sensor, bmc | vmware-monitor (host sensors and the CIM Server that supplies them, host logs for ipmi/cim), the server's BMC | site / vendor |
+| **licensing** | license | vmware-monitor (license_status — which asset holds which key); an Aria alert on "Unlicensed Group" is Aria's own license | license portal |
+| **data_collection** | adapter instance, not receiving data, collector group, cloud proxy | vmware-aria (adapters, collector groups, node health, objects that stopped reporting), vmware-monitor (is the source vCenter reachable) | aria admin |
 
 ## Remediation handoff (advisor → executor)
 

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/skills/vmware-debug/references/setup-guide.md

@@ -6,7 +6,7 @@ is a pure, offline correlation engine. There is no `config.yaml` and no `.env`.
 ## Install
 
 ```bash
-uv tool install vmware-debug==1.11.4
+uv tool install vmware-debug==1.12.1
 vmware-debug categories      # verify it runs
 ```
 
@@ -15,7 +15,7 @@ vmware-debug categories      # verify it runs
 ```json
 {
   "command": "uvx",
-  "args": ["--from", "vmware-debug==1.11.4", "vmware-debug-mcp"]
+  "args": ["--from", "vmware-debug==1.12.1", "vmware-debug-mcp"]
 }
 ```
 

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/tests/eval/regression/test_classification_against_vsphere_vocabulary.py

@@ -50,6 +50,13 @@ So the change this file guards is not a bigger vocabulary. It is:
    know" and to go find that subsystem's read tools. For ``VmPoweredOnEvent``
    that is a wasted round trip after a false premise.
 
+**Re-measured 2026-09-15: reads 140, misses 287.** The 16 newly read types are
+the exception the paragraph above does not cover — 14 are licensing events
+(``LicenseExpiredEvent`` and its family) and 2 are password events, and licensing
+*was* a subsystem the taxonomy lacked. The category was added because real lab
+alert titles needed it (``test_real_alert_titles_classify``), not to move this
+number; the claim about the rest of the residue still holds.
+
 The numbers below are recorded, not required. If someone later raises coverage by
 padding ``_CATEGORY_SIGNATURES``, ``test_the_taxonomy_was_not_quietly_padded``
 fails and says so, because a coverage figure that goes up without an explanation

vmware_debug-1.12.1/tests/eval/regression/test_real_alert_titles_classify.py

@@ -0,0 +1,153 @@
+"""Alert titles from a real estate, and what the taxonomy made of them.
+
+On 2026-09-14 eight alerts were read off the lab vCenter 8.0.3 and Aria 8.18.7
+and passed through ``triage``. Six came back ``uncategorized`` and the top
+hypothesis was "uncategorized" itself. Unlike the residue measured in
+``test_classification_against_vsphere_vocabulary`` — events whose subsystem the
+taxonomy already had, spelled differently — these named subsystems it had no
+category for at all:
+
+    Root user password expired            credential lifecycle; auth read only
+                                          login/token/certificate words
+    License will soon expire              licensing — no category
+    Expired vCenter Server license         licensing — no category
+    Host TPM attestation alarm            hardware — routed in the catalogue,
+                                          but the classifier could never emit it
+    Objects are not receiving data        the monitoring pipeline itself — no
+      from adapter instance               category
+
+So the change is new categories with their own routing, not more synonyms for
+the old ones. One title stays unread on purpose, and is pinned below.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from vmware_debug.envelope import normalize_event
+from vmware_debug.ops.cases.readiness import readiness
+from vmware_debug.ops.cases.sources import load_catalogue
+from vmware_debug.ops.timeline import classification_coverage, classify_symptom
+
+#: (alert title, source, the category it has to land in first)
+LAB_ALERTS = (
+    ("Root user password expired", "monitor", "auth"),
+    ("License will soon expire", "aria", "licensing"),
+    ("Expired vCenter Server license", "monitor", "licensing"),
+    ("Host TPM attestation alarm", "monitor", "hardware"),
+    ("Objects are not receiving data from adapter instance", "aria", "data_collection"),
+    ("vCenter appliance health service is down", "aria", "platform"),
+    ("Host connection and power state", "monitor", "host_lifecycle"),
+)
+
+#: A roll-up of its members' health. It names no subsystem: whatever is wrong is
+#: wrong with one of the members, and any category given to the title would be
+#: a guess dressed as a routing decision.
+ROLLUP_ALERT = "Group population health is degraded"
+
+
+def _event(title: str, source: str) -> object:
+    return normalize_event(
+        {"ts": "2026-09-14T08:00:00Z", "source": source, "severity": "warning", "text": title}
+    )
+
+
+@pytest.mark.parametrize(("title", "source", "category"), LAB_ALERTS)
+def test_each_lab_alert_lands_in_its_category_first(title, source, category):
+    event = _event(title, source)
+    found = classify_symptom(event.text, event.entity, event.fields)
+    assert found and found[0] == category, f"{title!r} -> {found}"
+
+
+def test_the_population_rollup_stays_unread():
+    """Pinned so a later keyword does not quietly start routing it somewhere."""
+    assert classify_symptom(ROLLUP_ALERT) == []
+
+
+def test_the_lab_stream_is_now_mostly_readable():
+    events = [_event(t, s) for t, s, _c in LAB_ALERTS] + [_event(ROLLUP_ALERT, "aria")]
+    coverage = classification_coverage(events)
+    assert coverage["uncategorized"] == 1
+    assert coverage["unmatched_samples"] == [ROLLUP_ALERT]
+
+
+@pytest.mark.parametrize(
+    ("text", "category"),
+    [
+        # Each contains a word the new categories added, and was already about
+        # something else. A bare "collector" took the first two from platform.
+        ("The ESXi Dump Collector service is not running on vcsa01", "platform"),
+        ("vCenter Server Syslog Collector service stopped", "platform"),
+        ("vSAN license expired for datastore vsan-01", "storage"),
+        ("Password for user root@192.168.60.10 denied: authentication failed", "auth"),
+    ],
+)
+def test_a_new_category_does_not_steal_an_existing_match(text, category):
+    assert classify_symptom(text)[0] == category, classify_symptom(text)
+
+
+class TestReadiness:
+    def test_aiops_is_a_recognised_skill(self):
+        """It used to land in unrecognised_skills while routing pointed
+        power_lifecycle cases at it."""
+        out = readiness(["vmware-monitor", "vmware-aiops"])
+        assert out["unrecognised_skills"] == []
+
+    def test_aiops_lifts_power_lifecycle_to_probable(self):
+        without = readiness(["vmware-monitor"])["categories"]["power_lifecycle"]
+        with_aiops = readiness(["vmware-monitor", "vmware-aiops"])["categories"]["power_lifecycle"]
+        assert without["ceiling"] == "candidate"
+        assert with_aiops["ceiling"] == "probable"
+        assert with_aiops["independent_sources"] == ["vmware-aiops", "vmware-monitor"]
+
+    def test_aiops_classes_name_only_reads_aiops_does_itself(self):
+        """AIops's cluster summary and investigation bundles call vmware-monitor's
+        code. Listed under aiops they would be monitor's data counted as a second
+        source — a Probable bought with one source under two names."""
+        delegated = {
+            "cluster_health_summary",
+            "cross_vcenter_attention",
+            "vm_investigation_bundle",
+            "host_investigation_bundle",
+            "datastore_investigation_bundle",
+        }
+        for name, spec in load_catalogue()["classes"].items():
+            if spec.get("skill") == "vmware-aiops":
+                tools = {e["tool"] for e in spec["tools"]}
+                assert not tools & delegated, f"{name} lists delegated tools {tools & delegated}"
+
+    def test_task_status_is_not_offered_as_evidence(self):
+        """It takes a task id; a plan has VM names. Called with a name it answers
+        "gone" and no error, which the grader would count as a second source."""
+        tools = {
+            e["tool"]
+            for spec in load_catalogue()["classes"].values()
+            if spec.get("skill") == "vmware-aiops"
+            for e in spec["tools"]
+        }
+        assert "vm_task_status" not in tools
+
+    def test_collection_reaches_probable_with_monitor_and_aria(self):
+        """Aria's collector state and vCenter's own reachability are two observations."""
+        out = readiness(["vmware-monitor", "vmware-aria"])["categories"]["data_collection"]
+        assert out["ceiling"] == "probable"
+
+    def test_licensing_does_not_count_an_aria_alert_as_a_second_source(self):
+        """An Aria alert about a vCenter license is built from vCenter's data, so
+        monitor plus aria would be one source counted twice."""
+        out = readiness(["vmware-monitor", "vmware-aria"])["categories"]["licensing"]
+        assert out["ceiling"] == "candidate"
+
+    def test_one_skill_alone_is_still_one_source(self):
+        out = readiness(["vmware-aria"])["categories"]["data_collection"]
+        assert out["ceiling"] == "candidate"
+
+    def test_a_hardware_plan_can_ask_for_the_sensors(self):
+        routed = load_catalogue()["routing"]["hardware"]["supporting"]
+        tools = {e["tool"] for c in routed for e in load_catalogue()["classes"][c]["tools"]}
+        assert {"get_host_sensors", "get_host_services"} <= tools
+
+
+@pytest.fixture(autouse=True)
+def _isolated_home(tmp_path, monkeypatch):
+    monkeypatch.setenv("OPS_HOME", str(tmp_path / "vmware"))

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/uv.lock

@@ -1293,7 +1293,7 @@ wheels = [
 
 [[package]]
 name = "vmware-debug"
-version = "1.11.4"
+version = "1.12.1"
 source = { editable = "." }
 dependencies = [
     { name = "mcp", extra = ["cli"] },
@@ -1316,7 +1316,7 @@ requires-dist = [
     { name = "pyyaml", specifier = ">=6.0,<7.0" },
     { name = "rich", specifier = ">=13.0,<15.0" },
     { name = "typer", specifier = ">=0.12,<1.0" },
-    { name = "vmware-policy", specifier = ">=1.13.1,<2.0" },
+    { name = "vmware-policy", specifier = ">=1.15.0,<2.0" },
 ]
 
 [package.metadata.requires-dev]
@@ -1328,14 +1328,14 @@ dev = [
 
 [[package]]
 name = "vmware-policy"
-version = "1.13.1"
+version = "1.15.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "pyyaml" },
     { name = "rich" },
     { name = "typer" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/df/76/1c97d2243ee2190627fce431cfebe548db42fb6d541753a7bf5275d5d2db/vmware_policy-1.13.1.tar.gz", hash = "sha256:d1d22ae3ee954ccefbe42d43525834d45fac83217ee9bceb356a275c8683932c", size = 175470, upload-time = "2026-09-12T00:04:32.99Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ac/0c/c7b6c9e2e82b5c8d40b0721bfc9a6428bdd9fd41d8c1c6ec492b94f183f8/vmware_policy-1.15.0.tar.gz", hash = "sha256:48e1850c434dd3f34401b1e3785c073d72b451af904cc2f8c7d3bde772309e8a", size = 181525, upload-time = "2026-09-15T05:43:38.307Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/6f/63/8ea229871a27d4a187ed546d007776a4209d2bff066d41a7207ca519a9af/vmware_policy-1.13.1-py3-none-any.whl", hash = "sha256:7946a4acb54d16754d5d447a4a56a06787d34b6aa33dda9434ff5753522c3959", size = 67768, upload-time = "2026-09-12T00:04:31.448Z" },
+    { url = "https://files.pythonhosted.org/packages/37/26/088f02325e51109cfe8e433d861c28f75f22ce26bb375944d365c46f85c4/vmware_policy-1.15.0-py3-none-any.whl", hash = "sha256:2f5a7b0e57fc084ea9083e67fb6e3c27059e6bd9c75b3eabfed58d6ee4366db4", size = 69524, upload-time = "2026-09-15T05:43:36.606Z" },
 ]

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/vmware_debug/__init__.py

@@ -6,4 +6,4 @@ remediation to vmware-aiops / vmware-pilot. Never writes to any VMware system
 and never executes fixes; its only writes go to the local case ledger.
 """
 
-__version__ = "1.11.4"
+__version__ = "1.12.1"

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/vmware_debug/cli.py

@@ -20,6 +20,7 @@ from rich.table import Table
 
 from vmware_debug import __version__
 from vmware_debug.mcp.tools import incident_timeline, list_symptom_categories
+from vmware_policy import cli_local
 
 
 def _harden_console_encoding() -> None:
@@ -53,12 +54,14 @@ console = Console()
 
 
 @app.command()
+@cli_local("prints the installed version")
 def version() -> None:
     """Print the installed version."""
     console.print(f"vmware-debug {__version__}")
 
 
 @app.command()
+@cli_local("prints the built-in symptom catalogue; contacts nothing")
 def categories() -> None:
     """List the symptom categories debug recognises and what to check for each."""
     table = Table(title="vmware-debug symptom categories")
@@ -71,6 +74,7 @@ def categories() -> None:
 
 
 @app.command()
+@cli_local("correlates events read from a file or stdin; contacts nothing")
 def triage(
     events_file: Optional[Path] = typer.Option(
         None, "--events", "-e", help="JSON file of event envelopes; reads stdin if omitted."
@@ -99,6 +103,7 @@ def triage(
 
 
 @app.command()
+@cli_local("starts the MCP server; its tools audit themselves")
 def mcp() -> None:
     """Start the stdio MCP server (no network access; proxy-safe)."""
     from vmware_debug.mcp_server.server import main as _main

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/vmware_debug/mcp_server/server.py

@@ -588,7 +588,8 @@ def build_server() -> FastMCP:
         whether it is
         available, through which tools, and if not, `how_to_supply`. Per
         symptom category (storage, network, compute, ha_drs, configuration,
-        accelerator, kubernetes, hardware): a `ceiling` and the
+        accelerator, kubernetes, hardware, host_lifecycle, power_lifecycle,
+        auth, platform, licensing, data_collection): a `ceiling` and the
         `independent_sources` behind it. There is deliberately no single score —
         "readiness 78%" cannot be acted on, "storage reaches Probable, hardware
         reaches Candidate" can.
@@ -648,7 +649,8 @@ def build_server() -> FastMCP:
             category: Force the symptom class instead of inferring it. Exactly
                 one of: storage, network, compute, ha_drs, configuration,
                 accelerator, kubernetes, hardware, host_lifecycle,
-                power_lifecycle, auth, platform. Omit to infer, then read
+                power_lifecycle, auth, platform, licensing,
+                data_collection. Omit to infer, then read
                 `category_signals` for the word that decided it.
             available_skills: Narrow to the skills actually installed, in either
                 spelling ("monitor" or "vmware-monitor"). Omit to assume all of

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/vmware_debug/ops/timeline.py

@@ -79,7 +79,7 @@ _CATEGORY_SIGNATURES: tuple[tuple[str, tuple[str, ...], str], ...] = (
     (
         "auth",
         ("login", "authentication", "permission", "denied", "unauthorized",
-         "401", "403", "token", "certificate", "tls"),
+         "401", "403", "token", "certificate", "tls", "password"),
         "check the service account + credentials in config/.env; verify the "
         "target's certificate/time sync",
     ),
@@ -90,6 +90,36 @@ _CATEGORY_SIGNATURES: tuple[tuple[str, tuple[str, ...], str], ...] = (
         "vmware-monitor (host connection state + service health) + "
         "vmware-log-insight (vpxd/hostd logs around the first error)",
     ),
+    # The three below are subsystems, not synonyms. Real alert titles from a lab
+    # estate ("Host TPM attestation alarm", "License will soon expire", "Objects
+    # are not receiving data from adapter instance") matched nothing because no
+    # category covered them at all — see test_real_alert_titles_classify.
+    (
+        "hardware",
+        ("tpm", "attestation", "ipmi", "sensor", "bmc"),
+        "vmware-monitor (get_host_sensors; host_log_scan for ipmi/cim errors — "
+        "no sensor data usually means no IPMI device or a stopped CIM service) + "
+        "the server's own BMC (iDRAC/iLO/XCC). A TPM attestation alarm is most "
+        "often a firmware setting (TPM 2.0 / TIS mode) rather than a failing part",
+    ),
+    (
+        "licensing",
+        ("license",),
+        "vmware-monitor (license_status: per-asset assignments show whether the "
+        "alarmed asset still holds the expiring key, or the alarm is stale) + "
+        "vmware-aria (an alert on 'Unlicensed Group' is Aria's own license, not "
+        "vCenter's)",
+    ),
+    (
+        "data_collection",
+        # Not a bare "collector": vCenter's own services are named that way
+        # ("ESXi Dump Collector service is not running") and belong to platform.
+        ("adapter instance", "not receiving data", "collector group", "cloud proxy"),
+        "vmware-aria (list_adapters for when each adapter last collected, "
+        "list_collector_groups, get_aria_health; list_resources to find the "
+        "objects that stopped reporting) + vmware-monitor (whether the source "
+        "vCenter itself is reachable)",
+    ),
 )
 
 

{vmware_debug-1.11.4 → vmware_debug-1.12.1}/vmware_debug/rules/evidence_sources.yaml

@@ -109,6 +109,52 @@ classes:
       - {tool: list_tkc_clusters, gives: "workload clusters and their phase"}
       - {tool: list_namespace_storage_usage, gives: "namespace storage pressure"}
 
+  # Same skill as virtualization_state, so never a second source for a monitor
+  # case. Separate only so a licensing plan asks for license_status and not
+  # for seven unrelated tools.
+  license_state:
+    label: License inventory and which asset holds which license
+    skill: vmware-monitor
+    decisive: false
+    tools:
+      - {tool: license_status, gives: "license expiry, and the license assigned to each vCenter and host"}
+      - {tool: get_alarms, gives: "whether the license alarm is active, and whether its condition still holds"}
+
+  collection_pipeline:
+    label: Aria's own collection pipeline (adapters, collectors, node health)
+    skill: vmware-aria
+    decisive: false
+    tools:
+      - {tool: list_adapters, gives: "each adapter instance and when it last collected"}
+      - {tool: list_collector_groups, gives: "collector groups and their members"}
+      - {tool: get_aria_health, gives: "Aria node and service health"}
+      - {tool: list_resources, gives: "objects under the adapter, to find the ones that stopped reporting"}
+
+  # Same skill as virtualization_state, so never a second source. Separate so
+  # a hardware plan asks for the sensors and the CIM Server state that supplies
+  # them, which is what its suggested_check tells the reader to look at.
+  host_hardware:
+    label: Host hardware sensors and the CIM Server that supplies them
+    skill: vmware-monitor
+    decisive: false
+    tools:
+      - {tool: get_host_sensors, gives: "sensor readings per host, and hosts reporting none with their CIM Server state"}
+      - {tool: get_host_services, gives: "whether sfcbd-watchdog (CIM Server) is running on the host"}
+
+  # Only reads vmware-aiops performs itself. Its cluster_health_summary,
+  # cross_vcenter_attention and *_investigation_bundle tools call
+  # vmware-monitor's code; listed here they would be monitor's data counted as
+  # a second, independent source.
+  # vm_task_status is left out on purpose: it takes a task id, a plan only has
+  # VM names, and called with a name it answers "gone" with no error — a reply
+  # that would count as a second source while saying nothing.
+  vm_operations:
+    label: VM snapshot tree
+    skill: vmware-aiops
+    decisive: false
+    tools:
+      - {tool: vm_list_snapshots, gives: "the VM's snapshot tree"}
+
   # ── The two that do not exist ──────────────────────────────────────────
   # Both are decisive: either one can take a conclusion to Confirmed. Neither
   # has a tool. Listing them empty is what lets case_readiness report an honest
@@ -169,7 +215,7 @@ routing:
     supporting: [kubernetes, virtualization_state, logs]
     decisive: [knowledge]
   hardware:
-    supporting: [virtualization_state, logs]
+    supporting: [host_hardware, virtualization_state, logs]
     decisive: [hardware]
 
   # The three below complete the set that ops/timeline.py's keyword classifier
@@ -188,7 +234,7 @@ routing:
     decisive: [knowledge]
 
   power_lifecycle:
-    supporting: [virtualization_state, logs]
+    supporting: [virtualization_state, logs, vm_operations]
     decisive: [knowledge]
 
   auth:
@@ -198,3 +244,17 @@ routing:
   platform:
     supporting: [virtualization_state, logs, metrics_and_anomalies]
     decisive: [knowledge]
+
+  # Licensing has one source here. An Aria alert about a vCenter license is
+  # built from vCenter's own data, so counting it would be one source twice —
+  # the same double-count vm_operations refuses for AIops's bundles.
+  licensing:
+    supporting: [license_state]
+    decisive: [knowledge]
+
+  # Two observations: Aria's own collector state, and whether the vCenter it
+  # collects from is reachable.
+
+  data_collection:
+    supporting: [collection_pipeline, virtualization_state]
+    decisive: [knowledge]