# Netops Change Guard

> Guard network writes behind dry-run, RFC 6241 confirmed-commit, and explicit rollback. Use when applying config to Cisco, Juniper, Arista, or Nokia and a human must own the blast radius.

- Skill: `gesh75/netops-change-guard` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gesh75/netops-change-guard`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gesh75/netops-change-guard/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: gesh75 (https://skillmd.com/u/gesh75)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gesh75/netops-change-guard

---


# Network change guard

Do not use for read-only show commands or lab toys with no production path. Not for firewall policy design.

## Procedure

1. Capture pre-state (`show run`, `show bgp summary`, interface counters) and store it next to the change ticket.
2. Render the candidate config from intent. Diff against running. Reject secrets, `shutdown` of uplinks, and default-route wipes.
3. Apply with confirmed-commit (NETCONF RFC 6241 or vendor equivalent) and a 5–10 minute confirm window.
4. Verify forwarding: ping, traceroute, BGP Established, EVPN MAC count, or synthetic probe — two agreeing signals.
5. Confirm the commit only after verification. Otherwise let it roll back and page the owner.

```xml
<commit>
  <confirmed/>
  <confirm-timeout>600</confirm-timeout>
</commit>
```

## Anti-patterns

- Never `commit` without a confirm window on a PE, spine, or edge firewall.
- Do not paste running-config with TACACS or SNMP strings into an LLM.

## Safety

Read-only until a named human approves the write. Fail closed if rollback is unavailable.