[ignore] Crescit backup pack A: validation and policy scenarios

playbooks/test_scenarios/01_vlan_invalid_range.yaml

@@ -0,0 +1,22 @@
+---
+# Crescit Test Scenario 1.1: VLAN ID Out of Range
+# Expected Detection: CRITICAL severity by Static Validator
+# Expected Auto-Fix: Suggest valid VLAN ID from available pool
+
+- hosts: ndfc
+  gather_facts: false
+  connection: ansible.netcommon.httpapi
+
+  vars:
+    fabric_name: cisco_test_fabric1
+
+  tasks:
+    - name: Add VLAN with invalid ID (out of range)
+      cisco.dcnm.dcnm_vlan:
+        fabric: "{{ fabric_name }}"
+        state: merged
+        config:
+          - vlan_id: 5000  # ❌ CRITICAL: Valid range is 1-4094
+            vlan_name: "PROD_Invalid_VLAN5000"
+            vlan_description: "Test scenario for VLAN range validation"
+        deploy: false

playbooks/test_scenarios/02_vrf_missing_rd.yaml

@@ -0,0 +1,26 @@
+---
+# Crescit Test Scenario 2.1: VRF Missing Explicit Route Distinguisher
+# Expected Detection: MEDIUM severity by Static + AI Semantic Validator
+# Expected Auto-Fix: Add explicit RD based on ASN
+
+- hosts: ndfc
+  gather_facts: false
+  connection: ansible.netcommon.httpapi
+
+  vars:
+    fabric_name: cisco_test_fabric1
+
+  tasks:
+    - name: Add VRF without explicit RD (anti-pattern)
+      cisco.dcnm.dcnm_vrf:
+        fabric: "{{ fabric_name }}"
+        state: merged
+        config:
+          - vrf_name: PROD_VRF_NewApp
+            vrf_id: 50100
+            vlan_id: 2100
+            # ❌ MEDIUM: Missing explicit RD
+            # Will auto-generate which can cause routing loops in multi-site
+            vrf_template: Default_VRF_Universal
+            vrf_extension_template: Default_VRF_Extension_Universal
+        deploy: false

playbooks/test_scenarios/04_network_missing_vrf.yaml

@@ -0,0 +1,26 @@
+---
+# Crescit Test Scenario 9.1: Network References Non-Existent VRF
+# Expected Detection: HIGH severity by NDFC Check Mode Validator
+# Expected Auto-Fix: Suggest creating VRF first or using existing VRF
+
+- hosts: ndfc
+  gather_facts: false
+  connection: ansible.netcommon.httpapi
+
+  vars:
+    fabric_name: cisco_test_fabric1
+
+  tasks:
+    - name: Add network referencing non-existent VRF
+      cisco.dcnm.dcnm_network:
+        fabric: "{{ fabric_name }}"
+        state: merged
+        config:
+          - net_name: PROD_NET_Orphan
+            vrf_name: PROD_VRF_DoesNotExist  # ❌ HIGH: This VRF doesn't exist
+            net_id: 30400
+            net_template: Default_Network_Universal
+            net_extension_template: Default_Network_Extension_Universal
+            vlan_id: 3040
+            gw_ip_subnet: "10.104.1.1/24"
+        deploy: false

playbooks/test_scenarios/05_default_values_anti_pattern.yaml

@@ -0,0 +1,42 @@
+---
+# Crescit Test Scenario 10.2: Using Default Values (Your Specific Requirement)
+# Expected Detection: MEDIUM severity by AI Semantic Validator
+# Expected Auto-Fix: Suggest explicit configuration values
+
+- hosts: ndfc
+  gather_facts: false
+  connection: ansible.netcommon.httpapi
+
+  vars:
+    fabric_name: cisco_test_fabric1
+
+  tasks:
+    - name: Add VRF relying on default values (anti-pattern)
+      cisco.dcnm.dcnm_vrf:
+        fabric: "{{ fabric_name }}"
+        state: merged
+        config:
+          - vrf_name: PROD_VRF_Defaults
+            vrf_id: 50600
+            vlan_id: 2600
+            # ⚠️ MEDIUM: Relies on defaults for critical fields:
+            # - No explicit RD (will auto-generate)
+            # - No explicit route targets (will auto-derive)
+            # - No L3VNI specified (uses default)
+            # - No BGP settings (uses fabric defaults)
+            vrf_template: Default_VRF_Universal
+            vrf_extension_template: Default_VRF_Extension_Universal
+        deploy: false
+
+    - name: Add VLAN with minimal config (also defaults)
+      cisco.dcnm.dcnm_vlan:
+        fabric: "{{ fabric_name }}"
+        state: merged
+        config:
+          - vlan_id: 2600
+            vlan_name: "PROD_Minimal_VLAN2600"
+            # ⚠️ INFO: Missing optional but recommended fields:
+            # - vlan_description (best practice)
+            # - dhcp_loopback_id (may need DHCP)
+            # - stp settings (uses fabric defaults)
+        deploy: false

playbooks/test_scenarios/07_vlan_naming_violation.yaml

@@ -0,0 +1,22 @@
+---
+# Crescit Test Scenario 1.2: VLAN Naming Convention Violation
+# Expected Detection: HIGH severity by Policy Validator
+# Expected Auto-Fix: Suggest compliant name (PROD_App_VLAN150)
+
+- hosts: ndfc
+  gather_facts: false
+  connection: ansible.netcommon.httpapi
+
+  vars:
+    fabric_name: cisco_test_fabric1
+
+  tasks:
+    - name: Add VLAN with non-compliant naming
+      cisco.dcnm.dcnm_vlan:
+        fabric: "{{ fabric_name }}"
+        state: merged
+        config:
+          - vlan_id: 150
+            vlan_name: "my_test_vlan"  # ❌ HIGH: Should be {ENV}_{PURPOSE}_VLAN{ID}
+            vlan_description: "Test VLAN for naming convention validation"
+        deploy: false

playbooks/test_scenarios/dcnm_hosts.yaml

@@ -0,0 +1,20 @@
+---
+# Inventory for Crescit demo playbooks
+# Target: NDFC controller at 10.78.210.227
+# Fabric: cisco_test_fabric1
+
+all:
+  vars:
+    ansible_python_interpreter: python
+    ansible_httpapi_validate_certs: false
+    ansible_httpapi_use_ssl: true
+  children:
+    ndfc:
+      vars:
+        ansible_connection: ansible.netcommon.httpapi
+        ansible_network_os: cisco.dcnm.dcnm
+        ansible_user: admin
+        ansible_password: "Admin1@#"
+      hosts:
+        ndfc1:
+          ansible_host: 10.78.210.227