Assemble a fabric from input objects, resolved per device like group_vars

[mbakalarski]

A Fabric gains four kinds of input object and an ordered list naming them.
Each input carries a fragment of the eos_designs document plus the devices that
see it; per device, the inputs that apply are layered in order with
dict.update() — Ansible's default hash_behaviour=replace.

Why nothing is merged

Two NodeSets carrying the same node-type key never meet, because no device
sees both: in a dual-DC fabric each leaf sees its own l3leaf.defaults. That is
what pyavd.get_avd_facts already expects to be handed —
engine.render_fabric_design flattens it today by giving every device the same
document, and xr.fabric_design_from_inputs exists to squeeze many hostvars
back into one. Neither is needed here, so a schema-aware merge, a duplicate-key
conflict rule and the defaults push-down are all avoided, and with them any
dependency on pyavd's private API.

The API

kind	carries
NodeSet	one node-type block's share — <role>.defaults, .nodes[], .node_groups[]
NetworkServices	the tenants (network_services_keys.name)
ConnectedEndpoints	connected_endpoints_keys.key lists, port_profiles, network_ports
Settings	everything else, narrowed to part of the fabric

The kinds separate ownership, not content: RBAC is granted per kind, and
eos_designs' top-level key names come from its own content, so no schema could
partition them anyway.

Only NodeSet declares devices. spec.declares is the fabric's device list
and there is no second one — a node named in a block the fabric does not declare
is not a device. Never a pattern either: visibility may be matched, existence
may not, since a typo would silently drop devices.

appliesTo takes all / nodeSets / hosts / matchHostnames. The
pattern form copies AVD's own hostname matching from default_node_types — and
from the code, not the description: shared_utils/node_type.py anchors the
pattern for you, while the schema's wording reads as though the author must.
Copying the wording would have made the same pattern mean two things. A pattern
matching nothing is an error rather than an empty set, because a pattern is
silent about matching nothing and the render is pushed as a full config
replacement.

Secret is in the requires enum from this first version. Not implemented
yet — but the mechanism it enables, a Secret layered like any other input, needs
no other schema footprint, and adding the enum value after release would be a
schema change to a published API. Credentials are not hypothetical: the bundled
examples carry sha512_password and type-7 BGP passwords, and type 7 is
reversible — pyavd ships bgp_decrypt.

All six XRDs gain categories: [crossplane, netclab]. function-avd had them
nowhere while netclab-xp carries them on all twelve, so kubectl get netclab
returned nothing in the avd namespace. Fabric and Device are fixed here too,
though it will only show on a fresh install — Crossplane's dependency manager
installs but does not upgrade.

Evidence

Measured against AVD's own corpus rather than argued.

check	result
hostvars identical to faithfully reproduced Ansible	25/25 inventories — 8 bundled examples + every molecule scenario with an inventory of its own, up to 501 devices
rendered configs match checked-in golden	7/8 examples; cv-pathfinder deferred

avd-verify-kinds and avd-verify-kinds --render run both from the CLI.

Three tests, doing different jobs

test_resolves_identically_to_ansible is the guard on the model, and it is
stricter than a render comparison on purpose: it fails on a hostvar difference
even where AVD would render the same config, so a divergence cannot hide until
it matters. Five seconds for the whole corpus, because nothing renders.

test_render_reproduces_golden adds nothing there — matching hostvars render
identically. It guards pyavd changing under us. That is what test_xr_fold
does today through the fold, and this is its successor: the fold reaches 6 of 8
examples, this reaches 7, campus-fabric being among the fold's deferrals.
Both nets run in parallel deliberately; removing the older one is a separate
change, so the swap shows up in a diff rather than being taken on trust.

test_apis_consistency guards what a build cannot and a cluster would find one
release later: that the XRDs and the kinds fn.py reconciles are the same set,
that every XRD carries categories, and that each defaultCompositionRef
resolves to a Composition for that kind.

Checked, not assumed

• Both new tests can fail — verified by perturbing a golden value, and by
  dropping a categories block, rather than by trusting they would.
• Offline suite: 61 tests in 10.7s → 84 in 15.0s.
• The Configuration package still builds from apis/, now carrying all six
  XRDs and Compositions.
• uv sync --locked clean; no version bump in this PR.

Not in scope

_reconcile_input does not fill status.devices: an input does not know the
fabric's device list, so appliesTo only resolves where inputs are collected —
the Fabric will fill it. Collection itself (requirements.resources), the gate
that stops a render before its inputs arrive, and the Secret implementation
are the next steps.

🤖 Generated with Claude Code