io.github.netdryrun/netdryrun

**Verify a change against its intent.** 0.4.0 adds `netdryrun verify`: declare what a change is meant to do, and every other difference in the network's behavior fails. It boots the lab before and after the change, snapshots both, and matches the difference against the intent. No checks to write. FRR only in 0.4; other nodes are refused or named as unobserved.

- **`netdryrun verify`** (CLI), the MCP tool **`verify_change`**, and the GitHub Action's **`mode: verify`**: one engine. The verdicts are `INTENT MATCHED`, `NO BEHAVIOR CHANGE`, `UNDECLARED CHANGES: DO NOT APPLY` and `INCONCLUSIVE`. `verify` never prints `SAFE TO PROCEED`, and every report echoes the intent: explained is not the same as safe. An approval takes four boots (each side twice), and a side that doesn't reproduce is `INCONCLUSIVE`. The standing guards in `netdryrun.yml` come from the base side, never from the change. Reference: [verify](https://github.com/netdryrun/Netdryrun/blob/v0.4.0/website/docs/reference/verify.md).
- **The snapshot** covers BGP sessions, VRFs, routes of every protocol (selected, FIB-installed, next hops), every BGP path with its attributes, the Adj-RIB-Out of every session and each node's running config. A config change with no observable effect in the lab fails unless declared, and every approval lists the changed config lines the lab didn't exercise.
- **The Action judges what lands:** the PR merged into the base branch. A PR that edits the intent file, the workflow judging it, or the checks together with the configs fails before any lab boots, unless a code-owner review of that file is required and the workflow opts in.
- **Fixes for false passes in 0.3.3** (live mixed-vendor interop labs: cJunosEvolved, cEOS, SR Linux, FRR):
  - **Juniper:** a path with no MED read as MED 0, so `med: 0` passed on a route sent without a MED. And `bgp_prefixes` read Junos's accepted count, which also leaves out a received route hidden for an unusable next hop. It now subtracts only the routes rejected by import policy, as the other drivers count. A hidden route with a reason the driver doesn't know leaves the count a range, and a bound is judged only when the whole range agrees.
  - **SR Linux:** a route rejected by import policy counted as received, so `active: false` passed on it and `present: false` failed. It is now left out, as on every other driver.
  - **Arista EOS:** cEOS prints MED 0 for a path with no MED, so a `med: 0` check on EOS is refused before the lab boots (exit `2`). AS sets are read in the same form as every other driver.
  - **A topology `exec:` command that fails is an error** on every platform (containerlab only logs it). **Startup config a NOS rejected is never a pass** on Arista cEOS, SR Linux and SONiC too (FRR since 0.3.3). Advisory: [advisories/0.3.3-exec-not-checked](https://github.com/netdryrun/Netdryrun/blob/main/advisories/0.3.3-exec-not-checked/README.md).
  - A repeated key in device JSON is never "the last one wins".
- **Advertisement intervals stretch `--settle` and `--hold`**, so a leak sent after the default windows can't let a negative check pass on a count still at 0. **`record` covers every active VRF** on FRR and SONiC.
- **A machine-readable capability statement:** [capabilities.json](https://github.com/netdryrun/Netdryrun/blob/v0.4.0/website/docs/capabilities.json), generated from the source (on netdryrun.com once the site deploys 0.4).
- **The repository is now github.com/netdryrun/Netdryrun.** Old links and `uses: netdryrun/netdryrun@vX` keep working through GitHub's redirect.
- **Moved to 0.4.1:** `verify` on an FRR lab with equal multipath paths to an advertised prefix gives no verdict (exit `2`, never an approval); reading the graceful-restart stale flag on SR Linux, EOS and SONiC; counting only usable routes in SR Linux prefix counts; EOS `out-delay`.
- **How this release was checked:** [releases/0.4.0/GATE.md](https://github.com/netdryrun/Netdryrun/blob/v0.4.0/releases/0.4.0/GATE.md) re