sonic: Enforce config table ownership statically

[ideaship]

Purpose

This PR establishes a single, enforced ownership model for the SONiC config
generator so that all forthcoming PRs touching the generator converge on one
consistent approach rather than each inventing its own. Several SONiC features
are in flight (ACL hardening, BFD, EVPN, static routes, …); without a
self-enforcing model they drift — adding tables the generator does not
classify, which silently reintroduces the stale-config bug the ownership model
exists to prevent. This change turns the model from documentation into a CI
gate: a new table that is not classified fails the build with a message
pointing at the right list.

This PR implements Decision C of the SONiC ownership tracking issue. Read it
for the full context, the surrounding decisions, and how this change fits in:

• SONiC config_db.json ownership model: open decisions + a hidden PR collision #2340

That issue records the agreed ownership model and the open decisions steering
the in-flight SONiC PRs; Decision C (the static ownership guard + four-category
taxonomy) is realized here. This PR stands on its own as the enforcement
mechanism.

What

The generator owns selected config_db.json tables (dropped and rebuilt every
regen), but the ownership registry was a hand-maintained allowlist with no
enforcement: a table the generator references but forgets to classify falls
into the unpoliced pass-through tier and silently accumulates stale config. The
existing tests only checked relationships between the registered constants, so
they could not catch an omission, and the model lived in a single docstring far
from the helpers that must honour it.

Changes

• Static guard test. Parses config_generator.py and collects every
  top-level config_db table referenced on config — config["X"]
  subscripts, the defensive config.get/setdefault/pop("X") accessors (a
  .get() read is a real dependency), and every literal-keyed merge form
  (update({...}), update(X=...), update(**{...}), |=, config | {...},
  {**config, ...}). The test fails when any referenced table is not
  classified as owned, inherited, or image-consumed, naming the table and the
  list to add it to. Static rather than runtime so it catches tables that emit
  only when NetBox carries their data, which a generate-and-inspect test would
  miss.

• Mutation backstop. A second guard rejects any config mutation the
  collector cannot statically read — an unrecognized method call or a
  reassignment that is not a dict display, a dict-merge, or a whitelisted base
  load — so coverage cannot erode silently. The one accepted blind spot is a
  dynamic key in a recognized form (config[var], config.update(name)),
  which the scaffold and drop loops rely on.

• Fourth ownership category, IMAGE_CONSUMED_TABLE_KEYS. For tables read
  from the image base config but never modified (read-only inputs that pass
  through to output). Empty for now; the first consumer is the gNMI listen port
  read from TELEMETRY. Disjointness invariants complete pairwise across
  owned / inherited / image-consumed.

• Docstring + comments rewritten around the four categories
  (owned / inherited / image-consumed / pass-through), with the inherited
  category corrected to "preserves base content, updates selected fields in
  place" rather than "emitted unchanged".

Notes

• Verified clean on the current tree: all referenced tables classify, the
  backstop passes, full suite green.
• Several open SONiC PRs add tables that are not yet registered (e.g. BFD,
  EVPN); once this lands they will get a red check pointing at the right list
  rather than shipping latent stale-config data loss.

🤖 Generated with Claude Code

[sourcery-ai]

Hey - I've left some high level feedback:

• Both _config_table_keys_referenced_in_source and _unanalyzable_config_mutations independently parse config_generator.py; consider parsing once and sharing the AST to avoid duplicated work and keep the analysis in sync.
• Instead of hard-coding _BASE_LOAD_CALLS as strings and comparing via ast.unparse(value.func), consider resolving allowed base-load functions via their module and name (e.g. matching on ast.Attribute/ast.Name) to make the guard more robust to formatting changes and imports.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Both `_config_table_keys_referenced_in_source` and `_unanalyzable_config_mutations` independently parse `config_generator.py`; consider parsing once and sharing the AST to avoid duplicated work and keep the analysis in sync.
- Instead of hard-coding `_BASE_LOAD_CALLS` as strings and comparing via `ast.unparse(value.func)`, consider resolving allowed base-load functions via their module and name (e.g. matching on `ast.Attribute`/`ast.Name`) to make the guard more robust to formatting changes and imports.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}