[privateip]

Summary

The Looking Glass backend needs executed evidence on real fabric routers, against thresholds fixed in advance, before any cell turns the service on, and unit tests against fake nodes cannot supply it.

This adds an independent client, built only from the published service API, and a qualification suite that drives the service through it on the containerlab lab with faults, covering every row of the contract's acceptance matrix, including routing impact and cleanup.

A full run on the lab passed all 21 scenarios, with loaded BGP convergence at 1.00 times the control, and the qualification guide and an archived record describe how to repeat it and what it measured.

A lab pass does not qualify a staging or production cell, so the issue stays open until the suite runs there.

Stack

Second of two stacked PRs, on top of #1141, which fixes the four defects earlier runs of this suite found. Nothing here changes a shipped binary or manifest. The lab image build now records its commit, and rolling back means reverting this.

Test plan

• The client builds and tests in its own module and imports nothing beyond the published service API
• A full lab run passes every scenario with none skipped, and the lab's existing fabric checks pass after the rollback

Related to #1048

[privateip]

Two independent reviews ran on this PR, then a second pass on the fixed head. The first pass held on an overstated title, a commit subject over 72 characters, a stale script comment and an output path the lab run never used. All four are fixed, and a dry run resolves the path to the repository's ignored bin directory. The second pass split, holding on the archive record's list of differences from the tested commit, which now names the script comment too.

The lab run recorded in the archive used commit 980cc91c. The published commits differ from it only in documentation, one gateway unit test, the lab task's output directory and a script comment, so the suite was not rerun on this head. A trial merge with current main, after #1140, has no conflicts.

CI is green on the current head. Merge the stack from this PR with the merge-async endpoint once both layers are approved, since GitHub does not allow auto-merge on stacked pull requests. This is related to #1048, which stays open until the suite runs on a staging cell.

[ecv]

Approve.

Lab-only change: the client, suite, containerlab config and docs ship nothing to production, and the pass criteria are fixed thresholds that fail the run rather than pass vacuously. It is stacked on #1141 and must merge after it.

• Stacked: the base is #1141's head (fix/lg-qualify-findings), so this diff is only the qualification work. It needs #1141's refusal policy, since the lab probe sink moved to global 2c0f:40::/64 and 11.1.42.0/24 because documentation space is now refused, and its client-auth certs for direct operator probes. Only docs/fabric-api/operations.md overlaps (one added paragraph, no conflict). Merge #1141 first and let GitHub retarget this PR.
• Nothing ships: no .github/, config/ or containers/ file changes. Lab overlays live under deploy/containerlab/resources/looking-glass/ and only reference existing config/fabric-api components. The client is its own module under examples/, and test:looking-glass-client fails if it imports Galactic packages beyond the published service API.
• Thresholds are consts in thresholds_test.go, fixed from the design doc. The scenarios fail on a miss, and the routing-impact scenario treats a control p95 whose bootstrap half-width is over 10% as a failure, not a pass. destinations asserts refusal with the exact reason for private, documentation, operator-allowed loopbacks, multicast and hostnames, and TestQualify calls t.Fatal if the client or binaries are missing.
• Without LG_QUALIFY_KUBECONFIG the suite skips, so a bare go test ./... in CI passes without running it. That fits a 45-minute lab run, but a green check proves nothing about the Looking Glass. The archive benchmark file is the evidence of an actual run.
• destinations checks the refusals but not that they cost no tokens, slots or packets, which is the pre-charge property #1141 adds.

Follow-ups:

• Assert in destinations that the project and cell budgets are unchanged after a refused probe.
• Add --deny-prefixes to the dfw gateway overlay so the lab exercises the gateway-side platform refusal and not only the special-use ranges.