{
  "version": 1,
  "target_platform": "central",
  "target_id": "role",
  "target_emits": [
    {
      "step":     1,
      "name":     "create_role_shared",
      "purpose":  "Create the user-role profile in the Library for the Gateway device-function. Body carries the role at the root plus three nested groups (session-parameters, miscellaneous-parameters, classification-parameters). All sub-fields below the root are Gateway-supported per the Central role schema; non-Gateway fields (mtu, auth-mode, poe-*, vlan-parameters, etc.) are intentionally NOT populated by this translation since AOS 8 -> Central is a Gateway path.",
      "endpoint": "/network-config/v1alpha1/roles/{name}",
      "method":   "POST",
      "query_params": {},
      "body": {
        "name":             "{name}",
        "access-vlan-id":   "{access_vlan_id}",
        "access-vlan-name": "{access_vlan_name}",
        "vlan-type":        "{vlan_type}",
        "session-parameters": {
          "captive-portal":                    "{captive_portal}",
          "check-for-accounting":              "{check_for_accounting}",
          "max-sessions":                      "{max_sessions}",
          "reauthentication-interval":         "{reauthentication_interval}",
          "reauthentication-interval-seconds": "{reauthentication_interval_seconds}"
        },
        "miscellaneous-parameters": {
          "enforce-dhcp":      "{enforce_dhcp}",
          "robust-age-out":    "{robust_age_out}",
          "registration-role": "{registration_role}",
          "openflow-enable":   "{openflow_enable}"
        },
        "classification-parameters": {
          "ip-classification":     "{ip_classification}",
          "dpi-classification":    "{dpi_classification}",
          "dpi-youtube-education": "{dpi_youtube_education}",
          "web-cc":                "{web_cc}"
        },
        "aaa-bw-contract": {
          "bw-contract": "{bw_contract_basic}"
        },
        "app-aaa-contract": {
          "app": "{bw_contract_app}"
        },
        "app-category-aaa-contract": {
          "app-category": "{bw_contract_appcategory}"
        },
        "web-category-aaa-contract": {
          "web-category": "{bw_contract_web_category}"
        },
        "web-reputation-aaa-contract": {
          "web-reputation": "{bw_contract_web_reputation}"
        },
        "exclude-app-contract": {
          "exclude-app": "{bw_contract_exclude_app}"
        },
        "exclude-app-cat-contract": {
          "exclude-app-category": "{bw_contract_exclude_appcategory}"
        }
      },
      "iteration": "once",
      "iteration_notes": "Optional fields drop out of the body when the source record lacks them. Empty nested groups (session-parameters / miscellaneous-parameters / classification-parameters) drop entirely if every member is missing.",
      "depends_on": []
    },
    {
      "step":     2,
      "name":     "assign_role",
      "purpose":  "Assign the role profile to the target scope. Multi-device-function array packed into a single POST.",
      "endpoint": "/network-config/v1alpha1/config-assignments",
      "method":   "POST",
      "query_params": {},
      "body_template": {
        "config-assignment": [
          "{one entry per device_function in target_meta.device_functions: { scope-id, device-function, profile-type='role', profile-instance='{name}' }}"
        ]
      },
      "iteration": "once",
      "iteration_notes": "One POST; all device-functions share the array.",
      "depends_on": [1]
    }
  ],
  "target_meta": {
    "device_functions": ["MOBILITY_GW"],
    "device_function_filtering_rule": "Per the Central role schema, every field in the body is Gateway-supported. AOS 8 user-roles map to Gateway roles in Central — that's the AOS 8 -> AOS 10/Central upgrade path. CAMPUS_AP role definition lives elsewhere (different schema fields). If an operator wants to assign the same name to AP scopes, they author a separate AP-targeted role translation (out of scope here)."
  },
  "target_scope_id_resolution": {
    "rule":   "Central scope_id is supplied by the consuming skill at runtime, derived from the AOS 8 role record's scope path.",
    "input":  "Source binding scope (string path / identifier); skill-specific",
    "output": "Central scope_id (string), supplied via runtime_values['central_scope_id']"
  },
  "required_runtime_values": ["central_scope_id"],
  "derived": {},
  "dependencies": [
    {
      "depends_on":  "central:policy (when authored — AOS 8 access-list session profiles map to Central policies, and policies reference roles via policy-rule[].condition.source.role; Central back-fills role.policies[] automatically from those references, so this translation does NOT send policies[] on the role body)",
      "depended_by": [
        {
          "target_id": "ssid_prof / virtual_ap",
          "field":     "aaa.role",
          "relation":  "role-by-name reference (string)",
          "notes":     "Wireless WLAN translations reference roles for default-role / aaa-server roles. Sequence: roles before WLANs."
        }
      ]
    }
  ],
  "tokenize_kind_per_field": {},
  "sources": {
    "aos8": {
      "kind":         "rest",
      "mapping_kind": "simple",
      "objects": [
        {
          "object":      "role",
          "object_path": "/v1/configuration/object/role",
          "role":        "user_role_profile",
          "docs": {
            "get":  "https://developer.arubanetworks.com/aos8/reference/get_object-role",
            "post": "https://developer.arubanetworks.com/aos8/reference/post_object-role"
          },
          "live_shape_example": "[{\"rname\": \"parent\", \"role__acl\": [{\"acl_type\": \"session\", \"pname\": \"parent\"}], \"role__vlan\": {\"vlanstr\": \"104\"}, \"role__cp_acc\": {\"_present\": true, \"_flags\": {\"default\": true}}, \"role__openflow\": {\"_present\": true, \"_flags\": {\"default\": true}}, \"role__reauth\": {\"seconds\": true, \"reauthperiod\": 3600}, \"role__max_sess\": {\"_flags\": {\"default\": true}, \"max_sess\": 65535}, \"role__enforce_dhcp\": {}, \"role__robust_age_out\": {}, \"role__reg_role\": {}, \"role__dpi_disable\": {}, \"role_enable_youtubeedu\": {}, \"role_disable_ipclassify\": {}, \"role__disable_webcc\": {}}, {\"rname\": \"blacklisted\", \"role__bwc\": [{\"dir_type\": \"downstream\", \"name\": \"...\"}, {\"dir_type\": \"upstream\", \"name\": \"...\"}]}, {\"rname\": \"camera_role_ubt\", \"role__vlan\": {\"vlanstr\": \"internal\"}}, {\"rname\": \"onguard-role\", \"role__cp\": {\"cp_profile_name\": \"onguard-captive-portal\"}}]",
          "notes": "Live-verified across 55 user-customized + system roles in the operator's tenant including a purpose-configured 'parent' role at /md/Campus/West with the full Tier 1 flag set + reauth-seconds. AOS 8 sub-objects use BOTH double-underscore (role__*) and single-underscore (role_*) prefixes — the classification flags 'role_disable_ipclassify' and 'role_enable_youtubeedu' use the single-underscore form (a quirk of the AOS 8 schema). Two distinct flag SHAPES surface: the older sub-objects like role__cp_acc / role__openflow use {_present: true, _flags: {...}} (Pattern A); the newer sub-objects like role__enforce_dhcp / role__reg_role / role__dpi_disable use empty {} when configured / absent when not (Pattern B). The aos8_field_present_to_true transform handles both by checking parent-path existence rather than a specific value. Inheritance: filter _flags.inherited=true entries from BOTH the role record itself and from its sub-objects before passing to emit_calls."
        }
      ],
      "key_mappings": {
        "name": {
          "from":      "rname",
          "to":        "role name (Central path param + body 'name', profile-instance on step 2)",
          "transform": "direct_str",
          "notes":     "Required. AOS 8 'rname' -> Central role 'name'."
        },
        "access_vlan_id": {
          "from":      "role__vlan.vlanstr",
          "to":        "Central role body 'access-vlan-id' (Gateway-only, integer; only when source is numeric)",
          "transform": "vlanstr_to_id_if_numeric",
          "optional":  true,
          "notes":     "AOS 8 stores both VLAN IDs and names as a single 'vlanstr' string. Three companion key_mappings (this one, access_vlan_name, vlan_type) all source from the same path with disambiguating transforms — only the matching access-vlan-* field survives. Per the Central role schema, access-vlan-id is at the ROOT of the role body (not inside vlan-parameters) for Gateway device-function."
        },
        "access_vlan_name": {
          "from":      "role__vlan.vlanstr",
          "to":        "Central role body 'access-vlan-name' (Gateway-only, string; only when source is non-numeric)",
          "transform": "vlanstr_to_name_if_nonnumeric",
          "optional":  true,
          "notes":     "Live example: vlanstr='internal' on camera_role_ubt -> access-vlan-name='internal'."
        },
        "vlan_type": {
          "from":      "role__vlan.vlanstr",
          "to":        "Central role body 'vlan-type' (root, enum: 'VLAN_ID' or 'VLAN_NAME')",
          "transform": "vlanstr_to_vlan_type",
          "optional":  true,
          "notes":     "Discriminator for whichever access-vlan-* field was emitted."
        },
        "captive_portal": {
          "from":      "role__cp.cp_profile_name",
          "to":        "Central role body 'session-parameters.captive-portal' (Gateway + AP + Switch CX/PVOS, string)",
          "transform": "direct_str",
          "optional":  true,
          "notes":     "Live-verified: 'onguard-role' has role__cp.cp_profile_name='onguard-captive-portal'. References a captive-portal profile that must exist in Central before this role is created."
        },
        "check_for_accounting": {
          "from":      "role__cp_acc",
          "to":        "Central role body 'session-parameters.check-for-accounting' (Gateway-only, bool)",
          "transform": "aos8_field_present_to_true",
          "optional":  true,
          "notes":     "Pattern-A flag: source carries {_present: true, _flags: {default: true}}. The transform returns True for any non-None input. Consumer should filter _flags.default=true entries before passing to emit_calls."
        },
        "max_sessions": {
          "from":      "role__max_sess.max_sess",
          "to":        "Central role body 'session-parameters.max-sessions' (Gateway-only, int)",
          "transform": "direct_int",
          "optional":  true,
          "notes":     "Live-verified: every role surfaces with max_sess=65535 _flags.default=true. Consumer should filter."
        },
        "reauthentication_interval": {
          "from":      "role__reauth",
          "to":        "Central role body 'session-parameters.reauthentication-interval' (Gateway-only, int minutes; mutually exclusive with -seconds form)",
          "transform": "aos8_reauth_minutes_value",
          "optional":  true,
          "notes":     "Source dict: {reauthperiod: N} for minutes form; {seconds: true, reauthperiod: N} for seconds form. This transform returns N only when 'seconds' is falsy/absent; otherwise None so the seconds companion claims it. Live-verified: most roles have {reauthperiod: 0, _flags: {default: true}}. Consumer should filter _flags.default=true before passing to emit_calls."
        },
        "reauthentication_interval_seconds": {
          "from":      "role__reauth",
          "to":        "Central role body 'session-parameters.reauthentication-interval-seconds' (Gateway-only, int seconds)",
          "transform": "aos8_reauth_seconds_value",
          "optional":  true,
          "notes":     "Companion to reauthentication_interval. Live-verified on the test 'parent' role configured with 'reauthentication-interval 3600 seconds' -> source {seconds: true, reauthperiod: 3600}."
        },
        "openflow_enable": {
          "from":      "role__openflow",
          "to":        "Central role body 'miscellaneous-parameters.openflow-enable' (Gateway-only, bool)",
          "transform": "aos8_field_present_to_true",
          "optional":  true,
          "notes":     "Pattern-A flag (source has _present + _flags). Live-verified: every role surfaces with _flags.default=true; consumer should filter."
        },
        "enforce_dhcp": {
          "from":      "role__enforce_dhcp",
          "to":        "Central role body 'miscellaneous-parameters.enforce-dhcp' (Gateway-only, bool)",
          "transform": "aos8_field_present_to_true",
          "optional":  true,
          "notes":     "Pattern-B flag (live-verified on test 'parent' role): source carries empty {} when configured. Transform returns True for any value; if absent, optional path drops the body key."
        },
        "robust_age_out": {
          "from":      "role__robust_age_out",
          "to":        "Central role body 'miscellaneous-parameters.robust-age-out' (Gateway-only, bool)",
          "transform": "aos8_field_present_to_true",
          "optional":  true,
          "notes":     "Pattern-B flag (live-verified)."
        },
        "registration_role": {
          "from":      "role__reg_role",
          "to":        "Central role body 'miscellaneous-parameters.registration-role' (Gateway-only, bool)",
          "transform": "aos8_field_present_to_true",
          "optional":  true,
          "notes":     "Pattern-B flag (live-verified). AOS 8 source name is abbreviated to 'reg_role' (not 'registration_role')."
        },
        "ip_classification": {
          "from":      "role_disable_ipclassify",
          "to":        "Central role body 'classification-parameters.ip-classification' (Gateway-only, bool; true means DISABLED per Central convention for the disable-flag pattern)",
          "transform": "aos8_field_present_to_true",
          "optional":  true,
          "notes":     "Pattern-B flag (live-verified). NOTE the AOS 8 source uses a SINGLE underscore prefix (role_, not role__) for this field — verified live. Inverted semantic: AOS 8 CLI 'ip-classification disable' surfaces as field presence; the resulting True value maps to Central's flag where true also means disabled (per the AOS 8 -> CNX LLD reference)."
        },
        "dpi_classification": {
          "from":      "role__dpi_disable",
          "to":        "Central role body 'classification-parameters.dpi-classification' (Gateway-only, bool; true means DISABLED)",
          "transform": "aos8_field_present_to_true",
          "optional":  true,
          "notes":     "Pattern-B flag (live-verified). AOS 8 source name reflects the CLI verb 'dpi disable'."
        },
        "dpi_youtube_education": {
          "from":      "role_enable_youtubeedu",
          "to":        "Central role body 'classification-parameters.dpi-youtube-education' (Gateway-only, bool)",
          "transform": "aos8_field_present_to_true",
          "optional":  true,
          "notes":     "Pattern-B flag (live-verified). NOTE single underscore prefix (role_, not role__). Standard (non-inverted) flag — AOS 8 CLI 'dpi youtubeedu' enables the feature."
        },
        "web_cc": {
          "from":      "role__disable_webcc",
          "to":        "Central role body 'classification-parameters.web-cc' (Gateway-only, bool; true means DISABLED)",
          "transform": "aos8_field_present_to_true",
          "optional":  true,
          "notes":     "Pattern-B flag (live-verified). AOS 8 source name reflects the CLI verb 'web-cc disable'."
        },
        "bw_contract_basic": {
          "from":      "role__bwc",
          "to":        "Central role body 'aaa-bw-contract.bw-contract[]' (Gateway + AP)",
          "transform": "aos8_role_bwc_basic_to_central",
          "optional":  true,
          "notes":     "Per-role bandwidth contract. Source shape live-verified on 'blacklisted' role at /md/Campus/West: [{dir_type, name}]. Transform renames dir_type -> direction (uppercase) and name -> bwc-name. AOS 8 doesn't carry the association field (per-user vs per-apgroup); Central applies its default."
        },
        "bw_contract_app": {
          "from":      "role__bwc_app",
          "to":        "Central role body 'app-aaa-contract.app[]' (Gateway-only)",
          "transform": "aos8_role_bwc_app_filter_app",
          "optional":  true,
          "notes":     "Per-app bandwidth contract. AOS 8 stores per-app AND per-appcategory entries in the same role__bwc_app array, discriminated by 'app_type'. This mapping filters to app_type=='app' and outputs Central's app-aaa-contract.app[] shape. Live-verified on 'parent' role at /md/Campus/West with app_type='app', appname='youtube'. Note: Central's appname is an enum of ~3953 DPI app names; AOS 8 source values pass through as-is and may need manual remapping if the catalogs drift."
        },
        "bw_contract_appcategory": {
          "from":      "role__bwc_app",
          "to":        "Central role body 'app-category-aaa-contract.app-category[]' (Gateway-only)",
          "transform": "aos8_role_bwc_app_filter_appcategory",
          "optional":  true,
          "notes":     "Per-app-category bandwidth contract. Companion to bw_contract_app — sources from the same role__bwc_app array but filters to app_type=='appcategory'. Transform uppercases the AOS 8 'appname' value (the category name) to match Central's 24-value enum (e.g. 'streaming' -> 'STREAMING'). Live-verified on 'parent' role with appname='streaming'."
        },
        "bw_contract_web_category": {
          "from":      "role__bwc_web",
          "to":        "Central role body 'web-category-aaa-contract.web-category[]' (Gateway-only)",
          "transform": "aos8_role_bwc_web_filter_category",
          "optional":  true,
          "notes":     "Per-WebCC-category bandwidth contract. AOS 8 stores per-category AND per-reputation entries in the same role__bwc_web array, discriminated by 'web_opt'. Filters to web_opt=='web-cc-category' and uppercases + slash-replaces the category name (AOS 8 'streaming/media' -> Central 'STREAMING-MEDIA'). Live-verified on 'parent' role. Caveat: only the simple slash-and-uppercase mapping is performed; some Central categories carry connective words AOS 8 omits (e.g. AOS 8 'entertainment/arts' would become 'ENTERTAINMENT-ARTS' from this transform but Central's enum is 'ENTERTAINMENT-AND-ARTS'). Operators should spot-check categories with multi-word Central forms after migration."
        },
        "bw_contract_web_reputation": {
          "from":      "role__bwc_web",
          "to":        "Central role body 'web-reputation-aaa-contract.web-reputation[]' (Gateway-only)",
          "transform": "aos8_role_bwc_web_filter_reputation",
          "optional":  true,
          "notes":     "Per-WebCC-reputation bandwidth contract. Companion to bw_contract_web_category — sources from the same role__bwc_web array but filters to web_opt=='web-cc-reputation'. Transform uppercases (and dash->underscore) the AOS 8 'web_rep' value to match Central's 5-value enum (TRUSTWORTHY / LOW_RISK / MODERATE_RISK / SUSPICIOUS / HIGH_RISK). Live-verified on 'parent' role with web_rep='trustworthy'."
        },
        "bw_contract_exclude_app": {
          "from":      "role__bwc_ex",
          "to":        "Central role body 'exclude-app-contract.exclude-app[]' (Gateway-only)",
          "transform": "aos8_role_bwc_excl_filter_app",
          "optional":  true,
          "notes":     "Per-app bw-contract exclusion. AOS 8 stores per-app + per-appcategory exclude entries in a single role__bwc_ex array discriminated by 'app_type'; filters to app_type=='app'. The exclude variant carries no traffic direction and no contract reference — listed apps simply bypass bandwidth-contract enforcement. Live-verified on 'parent' role with appname='netflix'. Source AOS 8 app names pass through verbatim; if Central's DPI catalog rejects an unknown app, operators must remap manually."
        },
        "bw_contract_exclude_appcategory": {
          "from":      "role__bwc_ex",
          "to":        "Central role body 'exclude-app-cat-contract.exclude-app-category[]' (Gateway-only)",
          "transform": "aos8_role_bwc_excl_filter_appcategory",
          "optional":  true,
          "notes":     "Per-app-category bw-contract exclusion. Companion to bw_contract_exclude_app — sources from the same role__bwc_ex array but filters to app_type=='appcategory'. Transform uppercases the AOS 8 'appname' value (which carries the category name in this variant) to match Central's 24-value enum. Live-verified on 'parent' role with appname='collaboration' (-> 'COLLABORATION')."
        }
      },
      "unmapped_fields": [
        {
          "from":            "role__via, role__pool_pptp, role__pool_via_dhcp",
          "reason":          "VIA connection profile + PPTP / DHCP-proxy IP pools. Operator ruled VIA + the VIA-only pool variants out of scope for v1 (VIA workflows are increasingly handled by alternative products). role__pool_l2tp is captured below as a confirmed-live unused mapping kept for future enablement.",
          "severity_rule":   "non_empty_regression"
        },
        {
          "from":            "role__pool_l2tp.poolname",
          "reason":          "L2TP IP pool reference. Live-verified shape on faculty-* roles in the source tenant. Maps to Central session-parameters.pool.l2tp (Gateway-only). Not included in v1 because the user explicitly excluded the pool-family fields with the VIA / pool tier of features. If/when re-enabled, the source field is confirmed and the Central target is confirmed in the role schema.",
          "severity_rule":   "non_empty_regression",
          "todo":            "Re-enable in v2 if pool migration becomes in-scope."
        },
        {
          "from":            "role__acl",
          "reason":          "AOS 8 access-list session bindings on the role. Central does NOT carry policies/ACLs as a field on the role profile body — instead, Central policies (separate /policies endpoint) reference roles via policy-rule[].condition.source.role, and Central back-fills role.policies[] automatically from those references. The ACL -> role binding is owned by the future central:policy translation (policy POST body carries the role reference). The role translation deliberately drops role__acl from the body to avoid sending a field Central will reject.",
          "severity_rule":   "always_operator_map",
          "todo":            "Author central:policy. Migrate AOS 8 ip access-list session profiles into Central policy POSTs, with the policy's policy-rule.condition.source.role pointed at the role(s) that originally listed the ACL in their role__acl array."
        }
      ],
      "ignored_variants": [
        {
          "form":   "role with _flags.default=true at the top level",
          "reason": "AOS 8 system / built-in roles (logon, guest, ap-role, etc.) appear with _flags.default=true. Migrating them would create duplicate user-role profiles in Central that shadow Central's own built-ins. Consumer must filter top-level _flags.default=true roles before passing to emit_calls."
        },
        {
          "form":   "Switch CX / Switch PVOS / Access Point role-profile fields (mtu, auth-mode, poe-*, vlan-parameters.*, named-vlan, etc.)",
          "reason": "Per the Central role schema, many session-parameters / vlan-parameters fields are device-function-specific (Switch CX, Switch PVOS, AP). AOS 8 -> Central is a Gateway path, so this translation populates only Gateway-supported fields. A separate translation would be needed for AP-targeted roles (different schema fields, and AOS 8 has no equivalent for most of them)."
        }
      ]
    }
  },
  "draft_notes": [
    "v1 translation, Gateway-targeted. Two-step Central CNX flow (role SHARED create + multi-DF config-assignments). Every body field is Gateway-supported per the Central role schema (verified via api-endpoints/central/role.json's x-supportedDeviceType annotations).",
    "Live-verified source field names across 55 roles in the operator's tenant including a purpose-configured 'parent' role with all Tier 1 flag features + reauthentication-interval-seconds + per-app / per-appcategory / per-web-cc-category / per-web-cc-reputation bandwidth contracts + bw-contract exclude (app + appcategory), and the 'blacklisted' role with the basic per-role bandwidth contract. All seven bw-contract sub-shapes are mapped (basic per-role + per-app + per-appcategory + per-web-cc-category + per-web-cc-reputation + exclude-app + exclude-appcategory).",
    "Bandwidth-contract source shape: AOS 8 stores three discriminated source arrays: 'role__bwc_app' carries per-app + per-appcategory entries (discriminator 'app_type'), 'role__bwc_web' carries per-web-cc-category + per-web-cc-reputation entries (discriminator 'web_opt'), and 'role__bwc_ex' carries exclude-app + exclude-appcategory entries (also using 'app_type'). Plus the basic per-role 'role__bwc'. Central has SEVEN distinct body schemas; each AOS 8 array fans out to two Central body fields via paired filter-and-transform key_mappings.",
    "INVERSION CALL-OUT: AOS 8 carries the role->ACL binding inside the role record (role__acl array). Central inverts the relationship — policies reference roles via policy-rule[].condition.source.role, and Central back-fills role.policies[] from those references. This translation does NOT send policies[] in the role body. ACL->role binding is owned by the future central:policy translation.",
    "Idempotency: if a role profile with the same name already exists, the SHARED POST returns HTTP 409. Consumer must handle 409 idempotently.",
    "Two AOS 8 flag SHAPES coexist in the source: Pattern A (role__cp_acc / role__openflow have {_present: true, _flags: {default: true}}) and Pattern B (role__enforce_dhcp / role__reg_role / role__dpi_disable / role__disable_webcc / role_disable_ipclassify / role_enable_youtubeedu surface as empty {} when configured, absent when not). Both are handled by the same aos8_field_present_to_true transform — it returns True for any non-None value, relying on the engine's optional-field path to drop the body key when the source path is missing entirely.",
    "Single-underscore prefix gotcha: most role sub-objects use 'role__' (double underscore), but two classification flags use 'role_' (single underscore): 'role_disable_ipclassify' and 'role_enable_youtubeedu'. Verified live; not a typo.",
    "Consumer responsibility documented: pre-filter source records to drop _flags.default=true sub-objects (and top-level default=true roles) before passing to emit_calls. Otherwise every role POST will explicitly carry AOS 8 system defaults (max-sessions=65535, check-for-accounting=true, etc.) which may overwrite Central's own role-profile defaults.",
    "Central-side fields with no AOS 8 source equivalent (kept visible here for future translation paths, not migration targets in this AOS 8 -> Central GW path): (1) 'airslice-application-list' (root, GW) and 'monitoring-application-list' (root, GW) — Central-native AppRF / AirSlice features without an AOS 8 counterpart; (2) 'dap-application-uuid' (root, GW) — feeds Central's Dynamic App Prioritization service, configured via that service's UI not via role profile in AOS 8; (3) 'vlan-parameters.trunk-allowed-vlan-names' (GW per schema) and the 'ipfix-flow-monitor' separate sub-schema — both anticipated to surface on a future Classic-Central / switching-role translation path (Classic Central switch -> Central CNX), not on this Gateway translation; (4) 'session-parameters.disable-cp-gw-translation' (GW-only) — labelled an 'Internal flag' in the schema for captive-portal translation behavior on the GW agent, not operator-settable from AOS 8. None of these block AOS 8 -> Central GW migration; they're fields that will need a source mapping when the corresponding non-AOS-8 source platform / use case lands."
  ]
}
