config_merge
Merge a configuration snippet under a device-side revert timer, enabling automatic rollback if management connectivity is lost. Use confirm_commit to make permanent.
Instructions
[WRITE] Merge a config snippet and commit under a device-side revert timer.
The device REVERTS the change by itself after revert_in seconds unless
confirm_commit follows — so a change that severs your own management access
heals without anyone having to reach the box. Verify reachability, THEN call
confirm_commit. Check commit.safetyNet in the result: drivers that
cannot arm a timer commit permanently and say so in commit.warning.
Returns diff and a backup digest (size + sha256). The full config is
deliberately NOT returned — it carries credential hashes and PSKs — but the
raw text is retained in undo.db for the recorded rollback. The diff is
credential-redacted with no opt-out (see the redaction block); use
config_diff(include_secrets=True) first if you must verify a literal key.
dry_run=True stages the candidate, returns the diff, discards it, and runs the SAME refusal the real commit would — so a green preview is never followed by a refusal.
Args: config_text: The configuration snippet to merge. revert_in: Device-side revert timer in seconds (default 300). 0 disables it, leaving the recorded undo as the only rollback path. dry_run: If True, preview the diff + safety assessment without committing. target: Device name from config.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | ||
| dry_run | No | ||
| revert_in | No | ||
| config_text | Yes |