merge: resolve CLAUDE.md conflict, keep current branch version

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2 files changed, 150 insertions, 0 deletions

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
new file mode 100644
index 00000000..30fa5800
--- /dev/null
+++ b/.github/copilot-instructions.md
@@ -0,0 +1,80 @@
+## VyOS Documentation Project
+
+This is VyOS user documentation written in reStructuredText (RST) and built with Sphinx.
+
+### Review Scope
+
+When reviewing pull requests, only flag issues **introduced by the PR's changes**. Do not flag pre-existing issues in unchanged lines. Compare against the base branch to determine what was actually changed.
+
+### RST Heading Hierarchy
+
+All files must use this heading order:
+
+```
+##### (Title — one per file, with overline)
+***** (Chapters)
+===== (Sections)
+----- (Subsections)
+^^^^^ (Subsubsections)
+""""" (Paragraphs)
+```
+
+### Line Length
+
+Maximum 80 characters per line. Exception: content inside `.. code-block::` directives is **exempt** — they render with `<pre>` tags and preserve source formatting. Do not flag long lines inside code blocks.
+
+### Linter Suppression Markers
+
+`.. stop_vyoslinter` and `.. start_vyoslinter` are RST comments used to suppress CI linter checks. Key conventions:
+
+- When used **inside an indented directive** (`.. cfgcmd::`, `.. opcmd::`, list items), markers should match the surrounding indentation to stay within the block.
+- When used **at top level** (outside any directive), markers are placed at column 0.
+- Both patterns exist in this repo. Do not flag either placement as incorrect.
+- They must always appear in pairs (stop then start). A missing `start_vyoslinter` is a real issue.
+- A `stop_vyoslinter` that covers a large section is acceptable when the content requires it (e.g., files full of real debug output with production IPs).
+
+### IP Address Rules
+
+The CI linter checks IP addresses. These are **allowed without suppression** — do not flag them:
+
+- RFC 5737 documentation addresses: `192.0.2.0/24`, `198.51.100.0/24`, `203.0.113.0/24`
+- RFC 3849 documentation IPv6: `2001:db8::/32`
+- RFC 1918 private ranges: `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`
+- Loopback (`127.0.0.0/8`), link-local (`169.254.0.0/16`), `0.0.0.0/0`
+
+Real public IPs (e.g., `8.8.8.8`) require `stop/start_vyoslinter` suppression. Do not suggest replacing them with documentation addresses if the example intentionally uses real IPs.
+
+### TODO Markers
+
+`.. TODO::` directives serve two purposes in this repo:
+
+1. **Tracking markers** on pages that need `cfgcmd`/`opcmd` conversion (these are intentionally added).
+2. **Stale markers** on pages that already have full content (these should be removed).
+
+A PR that removes some TODOs and adds others is not contradictory — the intent matters.
+
+### VyOS Directives
+
+- `.. cfgcmd::` for configuration mode commands
+- `.. opcmd::` for operational mode commands
+- Do not convert these to plain `.. code-block::` — they are tracked for command coverage.
+
+### YAML in Code Blocks
+
+Ansible playbook examples in `.. code-block::` use RST indentation (typically 4 spaces from the directive). The YAML indentation within the block may differ from standalone YAML files. Verify carefully before flagging YAML as invalid — count spaces from the code-block's own indentation base, not from column 0.
+
+### Page Structure
+
+Configuration pages follow this order: Theory, Configuration (cfgcmd), Examples, Known Issues, Debugging.
+
+### Known False Positives
+
+Do **not** flag the following — they have been verified as correct or intentional:
+
+- **Markdown tables rendering with `||`**: Diff views may show table pipes as double-pipes. Check the raw source file before flagging.
+- **`stop/start_vyoslinter` at column 0 inside directives**: This is one of two accepted patterns. The other is indented markers matching the directive. Both are valid.
+- **RFC 1918 addresses without linter suppression**: Private IPs (`10.x`, `172.16.x`, `192.168.x`) are allowed. Do not suggest adding `stop/start_vyoslinter` around them.
+- **Long lines inside `.. code-block::`**: Code blocks are exempt from the 80-character line limit.
+- **Pre-existing typos or grammar issues in unchanged lines**: Only flag issues introduced by the current PR's diff. If a typo exists on an unchanged line, it is out of scope.
+- **Ansible YAML indentation in RST code blocks**: YAML inside `.. code-block::` is indented relative to the directive, not column 0. Verify from the code-block's indentation base before flagging as invalid.
+- **Adding `.. TODO::` while removing others**: Tracking TODOs on pages needing `cfgcmd` conversion is intentional. Removing stale TODOs on completed pages is also intentional. Both can happen in the same PR.
diff --git a/.github/instructions/rst-linter.instructions.md b/.github/instructions/rst-linter.instructions.md
new file mode 100644
index 00000000..419f094a
--- /dev/null
+++ b/.github/instructions/rst-linter.instructions.md
@@ -0,0 +1,70 @@
+---
+applyTo: "**/*.rst"
+---
+
+## RST Linter Rules
+
+Every pull request is automatically linted by `doc-linter.py` (from the `vyos/.github` repository). It checks **only changed files** for two things: IP address usage and line length.
+
+### IP Address Rules
+
+The linter rejects public IP addresses that are not reserved for documentation.
+
+**Use these documentation-reserved addresses (no suppression needed):**
+
+| Type | Range | RFC |
+|------|-------|-----|
+| IPv4 | `192.0.2.0/24` (TEST-NET-1) | RFC 5737 |
+| IPv4 | `198.51.100.0/24` (TEST-NET-2) | RFC 5737 |
+| IPv4 | `203.0.113.0/24` (TEST-NET-3) | RFC 5737 |
+| IPv6 | `2001:db8::/32` | RFC 3849 |
+
+**These are allowed without suppression (not flagged by linter):**
+
+| Type | Range | Why |
+|------|-------|-----|
+| RFC 1918 private | `10.0.0.0/8` | Private address space |
+| RFC 1918 private | `172.16.0.0/12` | Private address space |
+| RFC 1918 private | `192.168.0.0/16` | Private address space |
+| Loopback | `127.0.0.0/8` | Loopback range |
+| Link-local | `169.254.0.0/16` | Link-local |
+
+**These require `stop/start_vyoslinter` suppression:**
+
+| Example | Why suppression is needed |
+|---------|--------------------------|
+| `8.8.8.8` (Google DNS) | Real public IP, not documentation-reserved |
+| `64:ff9b::/96` (NAT64) | Well-known prefix, not in doc ranges |
+| Real provider IPs in examples | Authenticity matters for the example |
+
+### Line Length Rules
+
+Maximum 80 characters per line. Lines inside `.. code-block::` directives are **exempt** from the line length limit (they render with `<pre>` tags and preserve source formatting).
+
+### Suppression Syntax
+
+When real public IPs or long lines are unavoidable, wrap the block:
+
+```rst
+.. stop_vyoslinter
+
+.. code-block:: none
+
+   set system name-server '8.8.8.8'
+
+.. start_vyoslinter
+```
+
+**Rules for suppression markers:**
+
+- Place `.. stop_vyoslinter` on its own line, immediately before the content
+- Place `.. start_vyoslinter` on its own line, immediately after the content
+- Always re-enable the linter — never leave it stopped for the rest of the file
+- Suppress the smallest possible region
+- Do NOT use suppression for content that can use documentation-reserved addresses instead
+
+### Common Mistakes
+
+- Removing `stop/start_vyoslinter` markers without fixing the underlying issue (exposes the line to the linter and fails CI)
+- Using real public IPs when documentation addresses would work just as well
+- Adding suppression markers around content that only has private (RFC 1918) addresses or `0.0.0.0/0` — these are allowed and don't need suppression