20260526 增加持续soak监控与本地回放工具

scripts/local_repo_replay/templates/docs/input_tree_requirements.md

@@ -0,0 +1,39 @@
+# Input Tree Requirements
+
+The input tree is not part of this package. The caller must prepare it before
+running replay.
+
+## Mirror root
+
+The mirror root must map rsync URIs to local paths:
+
+```text
+rsync://rpki.example.net/repo/a/b/c.roa
+=> <mirror-root>/rpki.example.net/repo/a/b/c.roa
+```
+
+The tree must contain all objects needed by the selected TALs: TA certificates,
+manifests, CRLs, ROAs, ASPAs, router certs, and child CA certificates.
+
+Both Routinator and rpki-client scripts consume this same mirror root through a
+local rsync command wrapper.
+
+## rpki-client working cache
+
+For rpki-client replay, `--cache-dir` is only rpki-client's working cache
+directory for this local run. It is not the input dataset. The authoritative
+input is `--mirror-root`.
+
+## TALs
+
+Provide either `--tal-dir <dir>` or repeated `--tal <file>`.
+
+The scripts prepare a replay-local TAL copy that prefers `rsync://` TA
+certificate URIs. This prevents a TAL with an HTTPS URI listed first from
+escaping to the network during local replay. The TAL set should match the local
+tree. Mixing a tree from one run with different TALs may produce meaningless
+differences.
+
+## No generation
+
+This package does not generate the tree and does not repair missing objects.

scripts/local_repo_replay/templates/docs/offline_replay_limits.md

@@ -0,0 +1,38 @@
+# Offline Replay Limits
+
+## Routinator
+
+The Routinator script disables RRDP and uses an rsync command wrapper to map
+rsync URLs to local paths. It still runs Routinator's normal validation logic.
+
+If the local mirror does not contain required objects, validation can fail or
+produce fewer outputs.
+
+## rpki-client
+
+The rpki-client script uses `-R` to disable RRDP and `-e` to point rsync at the
+local mapper. rpki-client still builds its normal working cache, but every
+rsync source is rewritten to the local mirror.
+
+If the mirror was incomplete or produced by a different TAL set, replay results
+may differ from the original run.
+
+## Validation time
+
+rpki-client supports `-P <posix-seconds>`. Routinator does not expose the same
+simple command-line evaluation-time option in the tested version; if `FAKETIME_LIB`
+is configured, the script can run Routinator under faketime. Without
+`FAKETIME_LIB`, `--validation-time` is intentionally ignored for Routinator and
+current wall-clock validation can reject stale manifests or CRLs.
+
+Ubuntu example:
+
+```bash
+sudo apt-get install -y libfaketime
+export FAKETIME_LIB=/usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1
+```
+
+The script sets `TZ=UTC` and converts RFC3339 validation time to libfaketime
+absolute UTC format, for example `2026-05-14T06:48:00Z` becomes
+`@2026-05-14 06:48:00`. Setting `TZ=UTC` is required because libfaketime parses
+absolute timestamps in the process timezone.

scripts/local_repo_replay/templates/docs/output_files.md

@@ -0,0 +1,16 @@
+# Output Files
+
+Each replay output directory can contain:
+
+- `vrps.normalized.txt`: one normalized VRP per line.
+- `vaps.normalized.txt`: one normalized VAP/ASPA per line.
+- `summary.json`: counts and resource summary.
+- `process-time.txt`: `/usr/bin/time -v` output.
+- RP-specific raw output:
+  - Routinator: `routinator.json`, `vrps.csv`.
+  - rpki-client: `out/json`, `out/csv`, and other native files.
+- logs:
+  - `stdout.log` / `stderr.log` for rpki-client.
+  - `update.log`, `vrps.log`, `json.log` for Routinator.
+
+Dual replay additionally writes `compare-summary.json`.