[jcombs-pointblue]

Why

On edir3 today, a deploy that changed two values in the AD driver's NOVLADDCFG-GCVs, through edir3's overrides, planned five steps for that object:

1. aux_class  cn=NOVLADDCFG-GCVs,…  objectClass += DirXML-PkgItemAux
2. modify     cn=NOVLADDCFG-GCVs,…  DirXML-ConfigValues (5.4 KB)
3. modify     cn=NOVLADDCFG-GCVs,…  DirXML-pkgGUID (130 B)
4. modify     cn=NOVLADDCFG-GCVs,…  DirXML-pkgAssociationId (27 B)
5. modify     cn=NOVLADDCFG-GCVs,…  DirXML-pkgChecksum (10 B)

The deploy's own snapshot shows the vault already had the aux class and the same three values (5DRKWAWH_…;com.netiqcorporation.novladdcfg;2.5.2…, IATDQ18S_201009040020200763, 4234957497). They read the same after the deploy. So nothing changed, but the plan suggested it would change package stamps on a production deploy.

The cause: for ARTIFACT_CHANGED, Plan added AUX_CLASS and a MODIFY for every stamp whenever the tree's artifact had stamps, without looking at the vault's. Identity Applications objects already compared them (parts.contains("stamps") and liveStamps).

What changes

• Which stamps are written: a changed driver resource writes only the stamps that differ from the vault object's (Plan.changedStamps). DirXML-pkgInitialState isn't in the vault's model, so it is still written when the tree has a baseline, as before.
• The aux class: added only when the vault object has no stamps (!VaultMapping.isStamped(was)).
• The customized-checksum fallback: now checks the tree's stamps, not the filtered attributes. A customized object with no recorded checksum still gets a content-derived one, and an unchanged checksum doesn't trigger it.
• Not affected: added objects, stamp-only changes (package-stamps), and stripping.

Tests

• PlanTest.changedPackagedObjectDoesNotRewriteTheVaultsStamps: same stamps on both sides and edited content give no AUX_CLASS and no DirXML-pkg* step, only the content.
• PlanTest.changedPackagedObjectWritesOnlyTheStampThatDiffers: a different checksum gives only DirXML-pkgChecksum and no AUX_CLASS.
• Both fail on the old Plan.java and pass with the fix. The existing customized-checksum tests pass unchanged.
• Full suite: 1045 tests, 0 failures.
• Live dry-run on edir3: a GCV value change to the AD driver now plans one step, DirXML-ConfigValues, plus the restart. Nothing was written.

🤖 Generated with Claude Code