cluster-migrate
Cluster many sources by measured similarity and emit a per-host variance report. It groups N sources by the Jaccard similarity of their operator-attributed workload features — services, carried config, firewall, tuning, audit, MAC, never base-OS packages — and writes, per cluster, the majority role and each host's two-directional delta to it. The variance report is the product: it flags the one host of a group that differs from its peers. By default the run is fully local — no API call, no credentials, no charge.
With --emit-roles it also emits a parameterised, runnable Ansible role per cluster. That path resolves packages against the Index (so it needs credentials and a --target), and each emittable host's role emission is a billable per-VM migration. It refuses per-host for any coupled or undetermined-coupling datastore node — those belong to coupled-migrate.
vrtmv cluster-migrate --manifest fleet.txt -o report/
vrtmv cluster-migrate --root /mnt/app01 --root /mnt/app02 --similarity-threshold 0.6 -o report/
vrtmv cluster-migrate --manifest fleet.txt --emit-roles --target rocky9 -o out/
| Flag | Purpose |
|---|---|
--manifest <path> | Sources, one per line (same format as readiness). |
--image / --root / --ssh | Ad-hoc sources instead of a manifest (repeatable). |
--similarity-threshold <0.0-1.0> | Similarity at/above which two sources join one cluster (default 0.5). Lower merges more aggressively into fewer, broader roles; higher splits into more, tighter ones. Stated in the report because it directly controls the pattern count. |
-o, --out <path> | Output directory (default vrtmv-cluster). |
--format json,md | Report formats to write (default both). |
--continue-on-error | Continue past a source that fails to scan instead of aborting the run. |
--emit-roles | Also emit a runnable role per cluster (billable per-VM; needs credentials + --target). |
--target <os> | Target OS for the emitted roles (e.g. rocky9). Required with --emit-roles. |
Hosts that report one identity
A host is billed by its identity (see identity). Two or more sources of one run that report one identity are clones of one image, or one host listed under several names. With --emit-roles each of them is refused before anything is emitted for it: no role, no attestation, no usage report. The refusal names the hosts and the file the identity came from. The other hosts emit, and the run exits non-zero. Without --emit-roles the run bills nothing, so it prints the same finding as a warning and writes the report as before. Run vrtmv identity on each clone, or remove the second name from the manifest, and run again.