baseline-rb 0.8.0 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c6f0dd98a7dd126671fc5c691a33852573b39a31e96dd45ca0b334db4c43c6f1
-  data.tar.gz: 3a3b85fbb2c40ca83af96cd6ca7dd26878f8190529f494e8398eb8fbe9f58b1b
+  metadata.gz: b5143fc59a995670ab9a7f35a7fb22353de3a471c1646c0790bfcdabe2405246
+  data.tar.gz: 1ce0e2e703d80a3cba8fff9cb84c441cfa41ef7dad5e47c87303dc4c7eba6849
 SHA512:
-  metadata.gz: 47ed7629d6207f6a9ecb58dae724b45431cda6bc2791bb55794fd0f751e2418e26dda9925b18c47f122953c43bb351169fc96651535f511b20cf09aaa3d965a4
-  data.tar.gz: ab562f184b06990e622dd0ce39dd8af2869980192124f90fcd7cbecbbdff47411e46674f6217848893ebb9e8ab22e87cbbb09511642a0ec97a439ab4dded17c6
+  metadata.gz: 56fc448769e9cdd00bd6ad3acfed63e5e00406165706a38c4c33049e041de68020b28994aa6f93afe872dae164d947d3999e5b9e62fce550f07b327719faae94
+  data.tar.gz: b7ba5f71cb034fec86a76d8081591ee753e503e6c992c5afb3fb818880cb98ed63918fabef5ca744ff8b52734510d0fda4cdf8238a21c802994a5b804decc14e

data/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Changes to the public contract are recorded here. Versions follow Semantic Versioning.
 
+## 0.9.0 (2026-10-20)
+
+- Generate explicitly approved NX-OS default-login, command/config-command authorization and accounting corrections with native ordered groups and separate local error fallback; preserve console, shared groups and existing materials.
+- Require resolved native role evidence, peer/consumer/recovery approval and existing endpoint keys before activating remote methods. Bind rendering to complete operation fingerprints and withhold coupled authorization changes if rendering fails.
+
+- Audit NX-OS management authentication with native global method lists, independent local error fallback and separate command/config-command authorization; retain sanitized typed evidence instead of applying IOS line-login syntax.
+- Respect native SSH defaults and explicit feature state, reject malformed replacements, and prevent disabled TACACS from certifying remote AAA usage. Telnet defaults remain unknown without product-specific or explicit evidence.
+
 ## 0.8.0 (2026-10-20)
 
 - Generate explicitly approved Huawei S-series VTY AAA-mode corrections with native UI/profile proofs while preserving shared schemes, templates, methods and ACLs.

data/README-zh.md

@@ -209,6 +209,8 @@ MIT，见 [LICENSE](LICENSE)。
 
 Comware/VRP TACACS 密钥按替换、撤销及方案重新进入后的最终状态归纳。`check.details[:key_slots]` 分别列出 H3C 认证/授权/计费及 Huawei 共享材料，关联已知端点并提示对端、AAA 引用和恢复前提。损坏状态需补证，检查仍受阻，不生成秘密命令。当前模型描述方案密钥，不代表已支持端点私有密钥继承。参见[TACACS 材料示例](examples/remediation_tacacs.rb)。
 
+NX-OS 管理 AAA 按原生全局登录方法、独立本地错误后备及命令/配置命令授权审计，非秘密 `aaa.nxos` 证据保留这些区别。禁用 TACACS 或损坏的最后声明不能证明远程使用；完整输入采用已确认的 SSH 默认，未明确的产品 Telnet 默认继续未知。明确的 `nxos` 批准可引用现有已核验组与密钥修正默认登录、两类授权及计费；登录本地错误后备需单独批准，控制台及共享对象保持原样。参见[离线示例](examples/remediation_nxos_aaa.rb)。参见[指标契约](docs/baseline-metrics.md)。
+
 Comware/VRP `aaa.bindings` 描述选中管理域的有序方法、TACACS 职责/组/端点引用、来源行及登录 VTY；本地后备与 `none` 分开记录，均不代表恢复访问已经可用。TACACS 使用检查复用这些证据，拒绝旧值和损坏引用。人工方案列出具体链路证据与批准前提，不自动挑选候选组；明确批准的 Comware 7 管理域 login 方法链可在完整核验后生成修正命令。`aaa.bindings` 保留选中域视角，`aaa.domain_bindings` 扩展覆盖已建模显式域的共享 TACACS 引用；实际用户路径、其他服务提供者及其他厂商绑定仍待分别补齐。参见[AAA 审核示例](examples/remediation_authentication.rb)。
 
 `tacacs.endpoints` 可声明 `bindings: [{kind: "aaa.domain", domain: "ADMIN", role: "authentication", position: "primary", selected: true}]`，在支持的 Comware/VRP 范围内核验完整域引用集合，包含未选中域的共享使用。position 是方法链优先级，与服务器主备不同。省略 bindings 只查定义；`[]` 需已知未绑定证据。局部/未建模引用保持未知，能力项区分对象与绑定支持。当前方案展示共享引用要求，不生成绑定切换命令。参见[绑定策略示例](examples/resource_bindings.rb)。

data/README.md

@@ -199,6 +199,8 @@ Credential review plans identify unsafe-storage and observable weak-password obj
 
 Comware/VRP TACACS key requirements retain the final key state across replacement, withdrawal, and reopened schemes. `check.details[:key_slots]` distinguishes missing H3C authentication/authorization/accounting material from Huawei shared material, associates known endpoints, and lists peer, AAA-reference, and recovery prerequisites. Malformed key state requires evidence; plans stay blocked and contain no secret commands. This models scheme-level keys, not endpoint-private-key inheritance. See the [TACACS material example](examples/remediation_tacacs.rb).
 
+NX-OS management AAA auditing uses native global login methods, independent local error fallback and both command/config-command authorization. Sanitized `aaa.nxos` evidence preserves these distinctions; disabled TACACS and malformed final declarations cannot certify remote use. SSH defaults are modelled for complete input, while unknown product-specific Telnet defaults remain unknown. Explicit `nxos` approvals can correct default login, both authorization actions and accounting using existing verified groups/keys; native login fallback is approved separately. Console and shared objects stay unchanged. See the [offline example](examples/remediation_nxos_aaa.rb). See the [metric contract](docs/baseline-metrics.md).
+
 Comware/VRP `aaa.bindings` describes the selected management domain's ordered methods, TACACS role/group/endpoint references, source lines, and login VTY evidence. Local fallback and `none` are separate declarations; neither proves working recovery access. TACACS usage checks share this evidence and reject stale/malformed references. Plans list concrete chain evidence and approval requirements without selecting a candidate group. Explicitly approved Comware 7 login-chain corrections can bind an existing selected domain to a verified role group with local fallback, or to an approved local alternative; endpoint changes remain separate prerequisites. Comware 7 VTY account-mode corrections also accept explicit complete range approval, preserve the existing approved method chain and effective protocols, and project requested SSH-only and TACACS-login constraints together; inherited protocol rebinding needs separate temporary-transition approval. Huawei S-series VTY corrections use `authentication-mode aaa` with an explicit `vrp_s_series` profile and complete `user-interface vty` scope, preserving the selected domain, shared schemes/templates and exact current methods, including `local-case` username matching. Both mode planners require resolved authentication, authorization and accounting roles plus external recovery verification. `aaa.bindings` retains the selected-domain view; `aaa.domain_bindings` inventories explicitly modelled domains and their shared TACACS references. Actual per-user paths, other providers and vendor bindings remain separate evidence gaps. See the [AAA review example](examples/remediation_authentication.rb).
 
 `tacacs.endpoints` objects may declare typed `bindings: [{kind: "aaa.domain", domain: "ADMIN", role: "authentication", position: "primary", selected: true}]`. On supported Comware/VRP profiles this compares the exact domain-reference set, including unselected shared uses; `position` is method-chain preference, separate from server priority. Omitted bindings check definitions only; `[]` needs known unbound evidence. Partial/unmodelled references stay unknown, and capability entries separate binding support from object support. Current plans expose shared-reference requirements without binding-change commands. See the [binding-policy example](examples/resource_bindings.rb).

data/docs/baseline-metrics.md

@@ -330,3 +330,27 @@ Huawei 的 local 与 local-case 用户名匹配规则不同。`aaa.bindings` 和
 域、共享认证/授权/计费方案、HWTACACS 模板、密钥、用户、其他范围及 ACL 均保留；恢复仍需独立认证规划，Huawei 的保存/commit 流程仍须按目标版本确认。独立状态模型验证原生 UI 命令、最终指标、共享配置保留及二次零变更。现有真实备份不含 Huawei 样本，当前 Huawei 证据来自原厂语法、合成配置及安装包验证，不能称为真机或该备份集上的 Huawei 验收。
 
 依据：[Huawei VTY 认证模式命令](https://support.huawei.com/enterprise/en/doc/EDOC1100214493/677f04d0)、[Huawei local/local-case 语义](https://info.support.huawei.com/hedex/api/pages/EDOC1100210438/AEK0901G/09/resources/dc/local-user_ap-group_view.html)、[Huawei HWTACACS、本地认证与计费故障说明](https://support.huawei.com/enterprise/en/doc/EDOC1100411502/5561445f/example-for-configuring-hwtacacs-and-local-authentication-command-authorization-and-command-auditing-for-administrators)。
+
+
+## NX-OS 原生管理认证审计
+
+NX-OS 使用全局 default/console 登录方法，不套用 IOS 的逐线命名登录列表。`aaa.nxos` 保留非秘密方法顺序、来源行、独立的 `fallback_on_error` 状态、commands/config-commands 两类授权、默认计费和 TACACS 功能状态。关闭本地错误后备不会清空服务器组；撤销方法列表回到本地默认，损坏的最后声明不能复用先前证据。组无法解析、未知方法或未建模 AAA 控制会保留不完整状态。该图是配置证据，不证明认证服务器可达或本地恢复可用。
+
+`ssh.vty_aaa` 依据原生默认登录链判断账户认证，`none` 不会通过；无需虚构数字 VTY 范围。`tacacs.authorization` 同时检查默认命令与配置命令授权，缺失一类不会被另一类已配置的 TACACS 掩盖。禁用 TACACS 功能时，三项 TACACS 使用检查不能通过。授权链中的 `none` 保留为无数据库后备证据，不表示本地账户恢复。
+
+完整输入可采用已确认的 SSH 默认启用状态；Telnet 默认随 Nexus 产品不同，缺少明确声明时不推导 SSH-only。显式 feature/no feature 按最终声明归约，损坏声明保留未知。IOS 的 login/transport input 不能作为 NX-OS 原生登录证明。原生 AAA 修正使用下节独立批准，不复用 IOS 命名列表；NX-OS VTY 协议修正命令仍未实现。
+
+依据：[NX-OS 原生 AAA 与本地后备](https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/105x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-105x/m-configuring-aaa.html)、[原生授权方法与 none](https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5500/sw/command/reference/security/n5500-sec-cr/n5500-sec_cmds_a.html)、[SSH 默认状态](https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/104x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-104x/m-configuring-ssh-and-telnet.html)、[Nexus 3600 的 Telnet 默认差异](https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus3600/102x/configuration/security/cisco-nexus-3600-nx-os-security-configuration-guide-102x/m-configuring-ssh-and-telnet.pdf)。官方语法、合成测试与备份形态验证不等同于实机登录验收。
+
+
+## NX-OS 原生管理 AAA 修正
+
+`tacacs.login`、`tacacs.authorization`、`tacacs.accounting` 及 `ssh.vty_aaa` 可使用 `remediation.syntax_profile: nxos`。作用域固定为当前配置上下文的全局 default，不能混用 management_domain 或数字 vty_ranges；console 登录与其后备控制保持原样。所有操作都需 `management_consumers_verified: true` 和 `local_fallback_access_verified: true`；这些是外部批准，不由备份或可用组自动填充。标量已满足时不强制迁移到另一组或修改后备。
+
+`methods` 必须明确指定。默认登录接受 `[{kind: local}]` 或一个及以上有序 `[{kind: tacacs, group: OPS}]`。远程登录还需 `local_fallback_on_error: true`；原生 fallback error local 在激活新登录组之前设置，不能误拼为 group OPS local。SSH 账户认证为 true 时可将 none 改为批准的本地或远程方法；其他已启用 TACACS/SSH 规则同时约束最终方法，不能为同一登录链批准不同目标。
+
+授权的远程 methods 为有序 TACACS 组后接 `{kind: local}`，分别规划 commands 与 config-commands；两者只修改不匹配项，整项校验和渲染完成后才公开操作。计费接受有序 TACACS 组，不拼接未核验的 local 尾部。三项 TACACS 规则为 false 时只支持明确批准的单个 local 替代，不从 false 推导 none、删除服务器或开放无认证访问。本地方法切换保留独立 fallback 声明。
+
+远程目标必须已有启用的 TACACS 功能、可解析的组地址成员和同身份端点密钥存在性，并具备 `tacacs_peer_compatibility_verified: true`。特殊 group tacacs+ 验证当前全体服务器；命名组逐成员验证。共享组的 VRF/source、其他使用者和材料保持原样，外部对端核验须涵盖既有路径。端点新增、删除、材料配置及未解析的原生引用不能由此偷偷完成；同一策略要求的端点变更须先处理。操作携带完整指纹，其他厂商呈现器或不同操作不能借用批准。
+
+参见[可直接运行的合成示例](../examples/remediation_nxos_aaa.rb)及上节原厂语法依据。备份形态故障注入与独立命令状态模型验证的是离线配置闭环，不能替代目标固件接受、远程职责、本地恢复和共享消费者的人工实测；保存仍是独立人工提示。

data/examples/remediation_nxos_aaa.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require "baseline"
+
+# 全部身份、材料及批准均为合成示例；只生成待人工审核命令，不访问设备。
+configuration = "hostname LAB\nfeature tacacs+\nno feature telnet\n" \
+  "tacacs-server host 192.0.2.30 key 7 SYNTHETIC-ONLY\n" \
+  "aaa group server tacacs+ OPS\n server 192.0.2.30\n use-vrf management\n!\n" \
+  "aaa authentication login default none\nno aaa authentication login default fallback error local\n" \
+  "aaa authentication login console local\naaa authorization commands default local\n" \
+  "aaa authorization config-commands default local\naaa accounting default local\nline vty\n!\n"
+checks = %w[tacacs.login tacacs.authorization tacacs.accounting ssh.vty_aaa].to_h do |id|
+  methods = [ { "kind" => "tacacs", "group" => "OPS" } ]
+  methods << { "kind" => "local" } if id == "tacacs.authorization"
+  options = { "syntax_profile" => "nxos", "methods" => methods,
+    "local_fallback_access_verified" => true, "management_consumers_verified" => true, "tacacs_peer_compatibility_verified" => true }
+  options["local_fallback_on_error"] = true if %w[tacacs.login ssh.vty_aaa].include?(id)
+  [ id, { "expected" => true, "remediation" => options } ]
+end
+policy = Baseline::Policy.new("version" => 1, "checks" => checks)
+plan = Baseline::Remediation.new(policy: policy).call(configuration: configuration, platform: :cisco_nxos, complete: true)
+raise "Expected native management-role corrections" unless plan.status == :ready && plan.operations.size == 4
+raise "Unexpected secret output" if plan.to_h.to_s.include?("SYNTHETIC-ONLY")
+puts plan.to_text

data/lib/baseline/cisco/parser.rb

@@ -54,13 +54,13 @@ module Baseline
         version = effective_configured_value(/\Aip ssh version\s+([12])\z/,
           family: /\A(?:no )?ip ssh version\b/, fact: "ssh.versions", reset: /\Ano ip ssh version(?: [12])?\z/)
         record_fact("ssh.versions", [ version ]) if version
-        ssh = nxos? ? configured_state(/\Afeature ssh\z/, /\Ano feature ssh\z/) : version ? true : nil
+        ssh = nxos? ? nxos_feature_state("ssh", default: true) : version ? true : nil
         record_fact("ssh.enabled", ssh, matching_blocks(/\A(?:ip ssh|(?:no )?feature ssh)/))
         default_aaa = nxos? || configured_state(/\Aaaa new-model\z/, /\Ano aaa new-model\z/) == true
         vtys = matching_blocks(/\Aline vty(?:\s|\z)/).map do |section|
           login = configured_vty_login(section, default_aaa: default_aaa)
           acl_entries = section.children.reject { |entry| /\A(?:no )?access-class\s+\S+\s+out(?:\s|\z)/.match?(entry.text) }
-          { name: section.text, protocols: effective_configured_value(/\Atransport input\s+((?:all|none|ssh|telnet)(?:\s+(?:ssh|telnet))*)\z/, entries: section.children,
+          { name: section.text, protocols: nxos? ? nxos_remote_protocols : effective_configured_value(/\Atransport input\s+((?:all|none|ssh|telnet)(?:\s+(?:ssh|telnet))*)\z/, entries: section.children,
               family: /\A(?:no )?transport input\b/, fact: "ssh.vty_ssh_only", reset: /\Ano transport input(?:\s+\S+)*\z/)&.split,
             authentication: login[:authentication], authentication_list: login[:authentication_list],
             acl_vrf_also: acl_entries.reverse.find { |entry| /\A(?:no )?access-class\b/.match?(entry.text) }&.text&.end_with?(" vrf-also") == true,
@@ -77,7 +77,7 @@ module Baseline
           ssh_port: rotary.empty? ? listener_port("ssh port", default: 22, scope: "management.acl", negate: "no") : nil,
           telnet_port: telnet_ports.empty? ? 23 : nil)
         telnet = if nxos?
-          configured_state(/\Afeature telnet\z/, /\Ano feature telnet\z/)
+          nxos_feature_state("telnet")
         elsif vtys.any? && vtys.all? { |entry| entry[:protocols] }
           vtys.any? { |entry| (entry[:protocols] & %w[all telnet]).any? }
         end

data/lib/baseline/cisco_nxos/authentication.rb

@@ -0,0 +1,155 @@
+# frozen_string_literal: true
+
+require_relative "../nxos_aaa_methods"
+
+module Baseline
+  module CiscoNxos
+    # 原生默认方法、独立后备与命令/配置命令授权分别归约，不套用 IOS 的逐线登录列表。
+    module Authentication
+      private
+
+      def prepare_configuration
+        super
+        @nxos_aaa_graph = nil
+        @nxos_features = {}
+      end
+
+      def nxos_feature_state(name, default: nil)
+        key = [ name, default ]
+        return @nxos_features[key] if @nxos_features.key?(key)
+        entry = matching_blocks(/\A(?:no )?feature #{Regexp.escape(name)}(?:\s|\z)/).last
+        value = if entry
+          case entry.text
+          when "feature #{name}" then analyze(entry) { true }
+          when "no feature #{name}" then analyze(entry) { false }
+          else
+            fact = { "ssh" => "ssh.enabled", "telnet" => "services.telnet", "tacacs+" => "tacacs" }.fetch(name)
+            record_unknown_fact(fact, [ entry ], code: :unsupported_authentication_method)
+            nil
+          end
+        elsif @fact_builder.complete?
+          default
+        end
+        @nxos_features[key] = value
+      end
+
+      # SSH 缺省稳定；Telnet 缺省跨 Nexus 产品不同，缺显式声明时继续未知。
+      def nxos_remote_protocols
+        ssh, telnet = nxos_feature_state("ssh", default: true), nxos_feature_state("telnet")
+        return if ssh.nil? || telnet.nil?
+        values = []
+        values << "ssh" if ssh
+        values << "telnet" if telnet
+        values.empty? ? [ "none" ] : values
+      end
+
+      def configured_vty_login(section, default_aaa:)
+        foreign = matching_blocks(/\A(?:no )?(?:login|transport input)(?:\s|\z)/, section.children)
+        if foreign.any?
+          record_unknown_fact("ssh.vty_aaa", foreign, code: :unsupported_authentication_method)
+          record_unknown_fact("tacacs.login", foreign, code: :unsupported_authentication_method)
+        end
+        state = nxos_method_state("aaa authentication login default", "authentication")
+        account = state["complete"] && state["methods"].none? { |method| method["kind"] == "none" }
+        { authentication: foreign.any? || !state["complete"] ? nil : account ? "aaa" : "none", authentication_list: "default" }
+      end
+
+      # 后备行不参与主列表覆盖；撤销独立控制也不能清除现有服务器组。
+      def nxos_method_state(prefix, role)
+        state = { "methods" => [ { "kind" => "local" } ], "declared" => false, "complete" => @fact_builder.complete?, "lines" => [] }
+        matching_blocks(/\A(?:no )?#{Regexp.escape(prefix)}(?:\s|\z)/).each do |entry|
+          text = entry.text.delete_prefix("no ")
+          tail = text.delete_prefix(prefix).strip
+          next if role == "authentication" && (tail == "fallback" || tail.start_with?("fallback "))
+          methods = NxosAaaMethods.parse(tail, role: role)
+          negative = entry.text.start_with?("no ")
+          if methods || negative && tail.empty?
+            analyze(entry) { true }
+            state = { "methods" => negative ? [ { "kind" => "local" } ] : methods, "declared" => !negative, "complete" => true, "lines" => [ entry.line ] }
+          else
+            state = { "methods" => [], "declared" => true, "complete" => false, "lines" => [ entry.line ] }
+          end
+        end
+        state
+      end
+
+      def nxos_login_state(selector)
+        node = nxos_method_state("aaa authentication login #{selector}", "authentication")
+        fallback, lines = @fact_builder.complete? ? true : nil, []
+        matching_blocks(/\A(?:no )?aaa authentication login #{selector} fallback(?:\s|\z)/).each do |entry|
+          fallback = case entry.text
+          when "aaa authentication login #{selector} fallback error local" then analyze(entry) { true }
+          when "no aaa authentication login #{selector} fallback error local" then analyze(entry) { false }
+          end
+          lines = [ entry.line ]
+        end
+        node.merge("fallback_on_error" => fallback, "fallback_lines" => lines, "complete" => node["complete"] && !fallback.nil?)
+      end
+
+      def nxos_resolve_methods(node, servers, inventory)
+        complete = node["complete"]
+        methods = node["methods"].map do |method|
+          next method unless method["kind"] == "server_group"
+          name = method["group"]
+          known = name == "tacacs+" ? servers.any? && !@fact_builder.unresolved?("tacacs.servers") :
+            inventory.closed && inventory.groups.fetch(name, []).any? && inventory.references.fetch(name, []).all? { |reference| reference[:complete] }
+          if known
+            { "kind" => "tacacs", "group" => name }
+          elsif name == "radius"
+            { "kind" => "radius" }
+          else
+            complete = false
+            { "kind" => "unresolved" }
+          end
+        end
+        node.merge("methods" => methods, "complete" => complete)
+      end
+
+      def record_tacacs_login_usage(servers, inventory)
+        authentication = %w[default console].to_h { |selector| [ selector, nxos_resolve_methods(nxos_login_state(selector), servers, inventory) ] }
+        authorization = %w[commands config-commands].to_h do |action|
+          [ action, nxos_resolve_methods(nxos_method_state("aaa authorization #{action} default", "authorization"), servers, inventory) ]
+        end
+        accounting = nxos_resolve_methods(nxos_method_state("aaa accounting default", "accounting"), servers, inventory)
+        unsupported = matching_blocks(/\A(?:no )?aaa (?:authentication login|authorization|accounting)(?:\s|\z)/).reject do |entry|
+          /\A(?:no )?aaa (?:authentication login (?:default|console|ascii-authentication|error-enable|invalid-username-log|(?:mschap|mschapv2|chap) enable)(?:\s|\z)|authorization (?:commands|config-commands) default(?:\s|\z)|accounting (?:default|dot1x)(?:\s|\z))/.match?(entry.text)
+        end
+        foreign = matching_blocks(/\Aline vty(?:\s|\z)/).flat_map do |section|
+          matching_blocks(/\A(?:no )?(?:login|transport input)(?:\s|\z)/, section.children)
+        end
+        scope_complete = unsupported.empty? && foreign.empty?
+        @nxos_aaa_graph = CtxParser::Immutable.copy({ "authentication" => authentication, "authorization" => authorization,
+          "accounting" => { "default" => accounting }, "scope_complete" => scope_complete, "tacacs_enabled" => nxos_feature_state("tacacs+", default: false) })
+        record_fact("aaa.nxos", @nxos_aaa_graph)
+        record_unknown_fact("aaa.nxos", unsupported + foreign, code: :unsupported_authentication_method) unless scope_complete
+        node = authentication.fetch("default")
+        nxos_record_usage("tacacs.login", [ node ], scope_complete: scope_complete)
+        if node["complete"]
+          record_fact("ssh.vty_aaa", node["methods"].none? { |method| method["kind"] == "none" })
+        else
+          record_unknown_fact("ssh.vty_aaa", code: :authentication_list_unresolved)
+        end
+        if (protocols = nxos_remote_protocols)
+          record_fact("ssh.vty_ssh_only", protocols == [ "ssh" ])
+        end
+      end
+
+      def record_tacacs_action_usage(kind, _servers, _inventory)
+        nodes = @nxos_aaa_graph.fetch(kind).values
+        nxos_record_usage("tacacs.#{kind}", nodes, scope_complete: @nxos_aaa_graph["scope_complete"])
+      end
+
+      def nxos_record_usage(fact, nodes, scope_complete:)
+        feature = @nxos_aaa_graph["tacacs_enabled"]
+        if !scope_complete || nodes.empty? || nodes.any? { |node| !node["complete"] } || feature.nil?
+          record_unknown_fact(fact, code: :tacacs_group_unresolved)
+        else
+          used = feature && nodes.all? { |node| node["methods"].first&.fetch("kind") == "tacacs" }
+          lines = nodes.flat_map { |node| node["lines"] }
+          entries = roots.select { |entry| lines.include?(entry.line) }
+          record_fact(fact, used, entries)
+        end
+      end
+    end
+  end
+end

data/lib/baseline/cisco_nxos/command_renderer.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../cisco/command_renderer"
+require_relative "../nxos_aaa_schema"
 
 module Baseline
   module CiscoNxos
@@ -14,6 +15,30 @@ module Baseline
       NTP_STYLE = :nxos
       SSH_DISABLE_COMMAND = "no feature ssh"
 
+      def supports?(id) = NxosAaaSchema::IDS.key?(id) || super
+
+      def render(operation, verified_aaa_operation_ids: [], **options)
+        return super unless operation.kind == NxosAaaSchema::KIND
+        unless verified_aaa_operation_ids.is_a?(Array) && verified_aaa_operation_ids.all? { |id| id.is_a?(String) && /\A[0-9a-f]{64}\z/.match?(id) } && verified_aaa_operation_ids.include?(operation.id)
+          raise UnsupportedOperation, "management_method_preconditions_unverified"
+        end
+        NxosAaaSchema.validate!(identity: operation.identity, scope: operation.scope, before: operation.before, after: operation.after, action: operation.action, phase: operation.phase)
+        role = operation.identity.fetch("role")
+        methods = operation.after.fetch("methods")
+        native = methods == [ { "kind" => "local" } ] ? "local" : "group #{methods.select { |method| method['kind'] == 'tacacs' }.map { |method| method.fetch('group') }.join(' ')}#{role == 'authorization' ? ' local' : ''}"
+        prefix = case role
+        when "authentication" then "aaa authentication login default"
+        when "authorization" then "aaa authorization #{operation.identity.fetch('function')} default"
+        when "accounting" then "aaa accounting default"
+        end
+        commands = []
+        if role == "authentication" && operation.before["fallback_on_error"] != operation.after["fallback_on_error"]
+          commands << "aaa authentication login default fallback error local"
+        end
+        commands << "#{prefix} #{native}" unless operation.before["methods"] == methods
+        commands.map { |command| CommandStep.new(view: [], command: command, phase: operation.phase, operation_id: operation.id) }
+      end
+
       private
 
       # NX-OS 地址族由地址本身决定，路由域使用 use-vrf。

data/lib/baseline/cisco_nxos/parser.rb

@@ -1,11 +1,13 @@
 # frozen_string_literal: true
 
 require_relative "../cisco/parser"
+require_relative "authentication"
 
 module Baseline
   module CiscoNxos
     # 解析 NX-OS 功能开关、角色权限及命名扩展 ACL。
     class Parser < Cisco::Parser
+      include Authentication
       private
 
       # 选择共享 Cisco 解析逻辑中的 NX-OS 分支。

data/lib/baseline/configuration_operation.rb

@@ -32,6 +32,8 @@ module Baseline
         TacacsOperationSchema.validate!(kind: kind, identity: identity, scope: scope, before: before, after: after, action: action, phase: phase)
       elsif kind == VtyAuthenticationSchema::KIND
         VtyAuthenticationSchema.validate!(identity: identity, scope: scope, before: before, after: after, action: action, phase: phase)
+      elsif kind == NxosAaaSchema::KIND
+        NxosAaaSchema.validate!(identity: identity, scope: scope, before: before, after: after, action: action, phase: phase)
       elsif kind == AaaChainSchema::KIND
         AaaChainSchema.validate!(identity: identity, scope: scope, before: before, after: after, action: action, phase: phase)
       elsif kind == "syslog.reference"

data/lib/baseline/nxos_aaa_methods.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require_relative "resource_schema"
+
+module Baseline
+  # NX-OS 的 group-list 是单个有序组列表，本地错误后备不是认证列表尾部方法。
+  module NxosAaaMethods
+    def self.group?(name) = name == "tacacs+" || ResourceSchema.token?(name) && !%w[group local none fallback error default console].include?(name)
+
+    def self.parse(text, role:)
+      return [ { "kind" => "local" } ] if text == "local"
+      return [ { "kind" => "none" } ] if text == "none" && %w[authentication authorization].include?(role)
+      tokens = text.split
+      return unless tokens.shift == "group"
+      terminal = tokens.pop if role == "authorization" && %w[local none].include?(tokens.last) || role == "authentication" && tokens.last == "none"
+      return unless !tokens.empty? && tokens.join(" ").bytesize <= 127 && tokens.uniq == tokens && tokens.all? { |name| group?(name) }
+      methods = tokens.map { |name| { "kind" => "server_group", "group" => name } }
+      methods << { "kind" => terminal } if terminal
+      methods
+    end
+  end
+end

data/lib/baseline/nxos_aaa_remediation.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require_relative "configuration_operation"
+require_relative "nxos_aaa_schema"
+require_relative "tacacs_remediation"
+
+module Baseline
+  # 只激活现有已核验的原生方法引用，不改变共享服务器对象、控制台或既有材料。
+  class NxosAaaRemediation
+    def self.applicable?(finding, evidence)
+      evidence.platform == "cisco_nxos" && evidence.complete? && NxosAaaSchema::IDS.key?(finding.id) &&
+        !finding.expected.nil? && %i[fail unknown].include?(finding.status)
+    end
+
+    def initialize(policy:) = @policy = policy
+
+    def call(finding, audit)
+      options = @policy.rules.find { |rule| rule.id == finding.id }.remediation
+      require!(options["syntax_profile"] == "nxos", "native_management_method_syntax_profile")
+      %w[methods local_fallback_access_verified management_consumers_verified].each do |key|
+        require!(options[key] && (!key.end_with?("verified") || options[key] == true), key)
+      end
+      evidence = audit.configuration
+      require!(evidence.complete? && evidence.platform == "cisco_nxos", "complete_native_configuration")
+      graph = evidence.fact("aaa.nxos")
+      require!(evidence.fact_known?("aaa.nxos") && graph["scope_complete"], "resolved_native_management_method_scope")
+      nodes = [ graph["authentication"]["default"], *graph["authorization"].values, graph["accounting"]["default"] ]
+      require!(nodes.all? { |node| node["complete"] }, "resolved_management_login_roles")
+      role = NxosAaaSchema::IDS.fetch(finding.id)
+      methods = options.fetch("methods")
+      remote = methods.first["kind"] == "tacacs"
+      conflict! if finding.id == "ssh.vty_aaa" ? finding.expected != true : remote != finding.expected
+      verify_authentication_policy!(audit, methods) if role == "authentication"
+      stable = audit.findings.select { |item| TacacsRemediation::IDS.include?(item.id) && item.status != :not_applicable && !item.expected.nil? }
+      require!(stable.all? { |item| item.status == :pass }, "stable_approved_tacacs_endpoints")
+      if remote
+        require!(graph["tacacs_enabled"] == true, "existing_enabled_tacacs_feature")
+        require!(options["tacacs_peer_compatibility_verified"] == true, "tacacs_peer_compatibility_verified")
+        require!(options["local_fallback_on_error"] == true, "local_fallback_on_error") if role == "authentication"
+        verify_targets!(evidence, methods)
+      end
+      functions = role == "authorization" ? %w[commands config-commands] : [ "default" ]
+      functions.filter_map do |function|
+        node = graph.fetch(role).fetch(function)
+        before = { "methods" => node.fetch("methods") }
+        after = { "methods" => methods }
+        if role == "authentication"
+          before["fallback_on_error"] = node.fetch("fallback_on_error")
+          after["fallback_on_error"] = remote ? true : before["fallback_on_error"]
+        end
+        next if before == after
+        identity = { "role" => role }
+        identity["function"] = function if role == "authorization"
+        ConfigurationOperation.new(kind: NxosAaaSchema::KIND, identity: identity, scope: { "selector" => "default", "syntax_profile" => "nxos" },
+          before: before, after: after, action: :replace, phase: :activate, risk: finding.severity == "critical" ? "critical" : "high")
+      end
+    end
+
+    private
+
+    def require!(condition, requirement)
+      raise TargetRemediation::Blocked.new(:authentication_chain_evidence_required, requirements: [ requirement ]) unless condition
+    end
+
+    def conflict! = raise(TargetRemediation::Blocked, :policy_conflict)
+
+    # 同一 default 登录链不得接受两个不同目标，已有通过的标量规则仍约束投影结果。
+    def verify_authentication_policy!(audit, methods)
+      related = audit.findings.select { |item| %w[tacacs.login ssh.vty_aaa].include?(item.id) && item.status != :not_applicable && !item.expected.nil? }
+      related.each do |item|
+        conflict! if item.id == "ssh.vty_aaa" ? item.expected != true : item.expected != (methods.first["kind"] == "tacacs")
+        rule = @policy.rules.find { |candidate| candidate.id == item.id }
+        if rule.remediation["syntax_profile"] == "nxos"
+          flags = %w[management_consumers_verified local_fallback_access_verified]
+          flags += %w[tacacs_peer_compatibility_verified local_fallback_on_error] if methods.first["kind"] == "tacacs"
+          conflict! if flags.any? { |key| rule.remediation[key] == false }
+        end
+        if item.status != :pass && rule.remediation["syntax_profile"] == "nxos" && rule.remediation.key?("methods")
+          conflict! unless rule.remediation["methods"] == methods
+        end
+      end
+    end
+
+    # 现有地址成员逐个关联相同身份的材料；原生组的 VRF/source 等保持原样，由外部对端核验覆盖运行路径。
+    def verify_targets!(evidence, methods)
+      require!(%w[tacacs.servers tacacs.groups tacacs.group_references tacacs.endpoints].all? { |fact| evidence.fact_known?(fact) }, "resolved_tacacs_reference_inventory")
+      methods.select { |method| method["kind"] == "tacacs" }.each do |method|
+        group = method.fetch("group")
+        refs = evidence.fact("tacacs.group_references")[group]
+        addresses = if group == "tacacs+"
+          evidence.fact("tacacs.servers")
+        else
+          require!(refs && refs.any? && refs.all? { |ref| ref[:kind] == "address" && ref[:complete] }, "resolved_native_tacacs_group_members")
+          refs.flat_map { |ref| ref[:servers] }.uniq
+        end
+        require!(addresses.any?, "resolved_tacacs_role_endpoints")
+        addresses.each do |address|
+          targets = evidence.fact("tacacs.endpoints").select { |target| target["identity"] == { "address" => address } }
+          require!(targets.any? && targets.all? { |target| target["attributes"]["key_present"] == true }, "existing_tacacs_endpoint_key")
+        end
+      end
+    end
+  end
+end

data/lib/baseline/nxos_aaa_schema.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require_relative "aaa_chain_schema"
+require_relative "nxos_aaa_methods"
+
+module Baseline
+  # 原生全局 default 范围与职责语法独立于 Comware 域和 IOS 命名登录列表。
+  module NxosAaaSchema
+    KIND = "aaa.nxos_chain"
+    IDS = AaaChainSchema::IDS.merge("ssh.vty_aaa" => "authentication").freeze
+    APPROVALS = %w[syntax_profile methods local_fallback_on_error local_fallback_access_verified management_consumers_verified tacacs_peer_compatibility_verified].freeze
+
+    def self.methods?(methods, role:, approved:)
+      return false unless methods.is_a?(Array) && methods.any? && methods.all? { |method| method.is_a?(Hash) }
+      return true if methods == [ { "kind" => "local" } ]
+      return !approved && role != "accounting" if methods == [ { "kind" => "none" } ]
+      terminal = methods.last if %w[local none].include?(methods.last&.fetch("kind", nil))
+      groups = terminal ? methods[0...-1] : methods
+      valid = groups.any? && groups.all? do |method|
+        method.is_a?(Hash) && (method.keys.sort == %w[group kind] && method["kind"] == "tacacs" && NxosAaaMethods.group?(method["group"]) ||
+          !approved && method == { "kind" => "radius" })
+      end
+      return false unless valid && groups.uniq == groups && groups.map { |method| method["group"] || "radius" }.join(" ").bytesize <= 127
+      return terminal.nil? if role == "accounting"
+      return !terminal || !approved && terminal == { "kind" => "none" } if role == "authentication"
+
+      approved ? terminal == { "kind" => "local" } : !terminal || [ { "kind" => "local" }, { "kind" => "none" } ].include?(terminal)
+    end
+
+    def self.validate_approval!(value, id:)
+      role = IDS.fetch(id)
+      valid = (value.keys - APPROVALS).empty? && (!value.key?("methods") || methods?(value["methods"], role: role, approved: true)) &&
+        (!value.key?("local_fallback_on_error") || role == "authentication" && value["methods"] != [ { "kind" => "local" } ] && [ true, false ].include?(value["local_fallback_on_error"]))
+      raise ArgumentError, "Invalid native NX-OS method approval" unless valid
+    end
+
+    def self.validate!(identity:, scope:, before:, after:, action:, phase:)
+      role = identity.is_a?(Hash) && identity["role"]
+      fields = role == "authentication" ? %w[fallback_on_error methods] : [ "methods" ]
+      identity_valid = role == "authorization" ? identity.keys.sort == %w[function role] && %w[commands config-commands].include?(identity["function"]) :
+        %w[authentication accounting].include?(role) && identity.keys == [ "role" ]
+      valid = identity_valid && scope == { "selector" => "default", "syntax_profile" => "nxos" } && action == :replace && phase == :activate &&
+        before.is_a?(Hash) && before.keys.sort == fields && methods?(before["methods"], role: role, approved: false) &&
+        after.is_a?(Hash) && after.keys.sort == fields && methods?(after["methods"], role: role, approved: true)
+      if valid && role == "authentication"
+        valid = [ true, false ].include?(before["fallback_on_error"]) &&
+          (after["methods"] == [ { "kind" => "local" } ] ? after["fallback_on_error"] == before["fallback_on_error"] : after["fallback_on_error"] == true)
+      end
+      raise ArgumentError, "Invalid native NX-OS method operation" unless valid
+    end
+  end
+end

data/lib/baseline/remediation.rb

@@ -24,7 +24,12 @@ module Baseline
       CtxParser::Immutable.copy(Audit.capabilities(platform: name).to_h do |id, capability|
         supported = capability[:status] != :unsupported && renderer.supports?(id)
         requirements = RemediationPlanner::REQUIREMENTS.fetch(id, [ "supported_rule_handler" ])
-        if supported && id == "ssh.vty_aaa"
+        if supported && name == "cisco_nxos" && NxosAaaSchema::IDS.key?(id)
+          requirements = %w[native_management_method_syntax_profile approved_ordered_native_methods resolved_native_management_method_scope
+            resolved_management_login_roles local_fallback_access_verified management_consumers_verified stable_approved_tacacs_endpoints
+            existing_enabled_tacacs_feature_for_remote_methods existing_tacacs_endpoint_keys_for_remote_methods tacacs_peer_compatibility_verified_for_remote_methods]
+          requirements << "local_fallback_on_error_for_remote_authentication" if NxosAaaSchema::IDS[id] == "authentication"
+        elsif supported && id == "ssh.vty_aaa"
           requirements = AaaChainSchema::APPROVALS + %w[vty_ranges complete_matching_vty_scope existing_approved_management_method_chain
             exact_existing_methods_including_local_case resolved_management_login_roles known_vty_authentication_and_protocols]
           requirements += name == "h3c" ? [ "temporary_vty_protocol_rebind_approved_for_inherited_protocol_changes" ] : [ "existing_shared_tacacs_key_for_remote_roles" ]

data/lib/baseline/remediation_planner.rb

@@ -14,6 +14,7 @@ require_relative "credential_remediation"
 require_relative "tacacs_key_remediation"
 require_relative "authentication_remediation"
 require_relative "aaa_chain_remediation"
+require_relative "nxos_aaa_remediation"
 require_relative "vty_authentication_remediation"
 require_relative "resource_binding_remediation"
 require_relative "tacacs_remediation"
@@ -90,6 +91,8 @@ module Baseline
         elsif TacacsKeyRemediation.applicable?(finding, audit.configuration)
           result = TacacsKeyRemediation.new.call(finding, audit.configuration)
           check(finding, :blocked, result.fetch(:reason), requirements: result.fetch(:requirements), details: result.fetch(:details))
+        elsif NxosAaaRemediation.applicable?(finding, audit.configuration)
+          compile_aaa_chain(finding, audit, operations, steps)
         elsif AuthenticationRemediation.applicable?(finding, audit.configuration)
           if AaaChainSchema::IDS.key?(finding.id) && @policy.rules.find { |rule| rule.id == finding.id }.remediation.any?
             next compile_aaa_chain(finding, audit, operations, steps)
@@ -148,11 +151,13 @@ module Baseline
 
     # 认证链在完整核验后才公开单个原生修改，原操作指纹不能为不同目标背书。
     def compile_aaa_chain(finding, audit, operations, steps)
-      operation = AaaChainRemediation.new(policy: @policy).call(finding, audit)
-      rendered = @renderer.render(operation, verified_aaa_operation_ids: [ operation.id ])
-      operations << operation
+      handler = audit.configuration.platform == "cisco_nxos" ? NxosAaaRemediation : AaaChainRemediation
+      proposed = Array(handler.new(policy: @policy).call(finding, audit))
+      ids = proposed.map(&:id)
+      rendered = proposed.flat_map { |operation| @renderer.render(operation, verified_aaa_operation_ids: ids) }
+      operations.concat(proposed)
       steps.concat(rendered)
-      check(finding, :planned, nil, operation_ids: [ operation.id ], details: { verification_scope: :configured_inventory_and_external_management_approval })
+      check(finding, :planned, nil, operation_ids: ids, details: { verification_scope: :configured_inventory_and_external_management_approval })
     rescue TargetRemediation::Blocked => error
       check(finding, :blocked, error.reason, requirements: error.requirements)
     rescue CommandRenderer::UnsupportedOperation

data/lib/baseline/rule.rb

@@ -6,6 +6,7 @@ require_relative "resource_schema"
 require_relative "syslog_reference_schema"
 require_relative "snmp_group_migration_schema"
 require_relative "aaa_chain_schema"
+require_relative "nxos_aaa_schema"
 require_relative "vty_authentication_schema"
 
 require "ctx_parser/immutable"
@@ -85,6 +86,7 @@ module Baseline
       end
       @managed_scopes = CtxParser::Immutable.copy(options["managed_scopes"])
       @remediation = CtxParser::Immutable.copy(options.fetch("remediation", {}))
+      native_aaa_keys = remediation.is_a?(Hash) && [ nil, "nxos" ].include?(remediation["syntax_profile"]) ? NxosAaaSchema::APPROVALS : []
       remediation_keys = if id == "snmp.versions"
         %w[existing_v3_access_verified]
       elsif id == "snmp.write_enabled"
@@ -102,9 +104,9 @@ module Baseline
       elsif %w[syslog.minimum_servers syslog.servers syslog.destinations ntp.minimum_servers ntp.servers].include?(id)
         %w[maximum_targets order]
       elsif id == "ssh.vty_aaa"
-        AaaChainSchema::APPROVALS + %w[vty_ranges temporary_vty_protocol_rebind_approved]
+        (AaaChainSchema::APPROVALS + native_aaa_keys + %w[vty_ranges temporary_vty_protocol_rebind_approved]).uniq
       elsif AaaChainSchema::IDS.key?(id)
-        AaaChainSchema::APPROVALS
+        (AaaChainSchema::APPROVALS + native_aaa_keys).uniq
       elsif id == "tacacs.endpoints"
         %w[maximum_targets order syntax_profile local_fallback_access_verified tacacs_key_compatibility_verified]
       else []
@@ -120,7 +122,8 @@ module Baseline
       syntax_profiles = case id
       when "ntp.authentication" then %w[comware_legacy comware7 vrp_s_series]
       when "snmp.write_enabled" then SnmpGroupMigrationSchema::PROFILES
-      when "ssh.vty_aaa" then VtyAuthenticationSchema::PROFILES.keys
+      when "ssh.vty_aaa" then VtyAuthenticationSchema::PROFILES.keys + [ "nxos" ]
+      when *AaaChainSchema::IDS.keys then %w[comware7 nxos]
       else [ "comware7" ]
       end
       unless (!remediation.key?("ntp_peer_key_compatibility_verified") || [ true, false ].include?(remediation["ntp_peer_key_compatibility_verified"])) &&
@@ -131,7 +134,11 @@ module Baseline
       AccessApproval.validate!(remediation["access_targets"], domain: id.start_with?("snmp.") ? :snmp : :management) if remediation.key?("access_targets")
       SyslogReferenceSchema.validate_migrations!(remediation["binding_migrations"]) if remediation.key?("binding_migrations")
       SnmpGroupMigrationSchema.validate_approvals!(remediation["group_migrations"]) if remediation.key?("group_migrations")
-      AaaChainSchema.validate_approval!(remediation) if AaaChainSchema::IDS.key?(id) || id == "ssh.vty_aaa"
+      if remediation["syntax_profile"] == "nxos" && NxosAaaSchema::IDS.key?(id)
+        NxosAaaSchema.validate_approval!(remediation, id: id)
+      elsif AaaChainSchema::IDS.key?(id) || id == "ssh.vty_aaa"
+        AaaChainSchema.validate_approval!(remediation)
+      end
       if remediation.key?("vty_ranges") && !VtyAuthenticationSchema.ranges?(remediation["vty_ranges"], syntax_profile: remediation["syntax_profile"])
         raise ArgumentError, "Invalid approved VTY scope"
       end

data/lib/baseline/version.rb

@@ -2,5 +2,5 @@
 
 module Baseline
   # 公开包版本，供 RubyGems 元数据和运行时调用方共用。
-  VERSION = "0.8.0"
+  VERSION = "0.9.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: baseline-rb
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.9.0
 platform: ruby
 authors:
 - Gatework contributors
@@ -120,6 +120,7 @@ files:
 - examples/remediation_huawei_vty_authentication.rb
 - examples/remediation_ntp_authentication.rb
 - examples/remediation_ntp_authentication_switch.rb
+- examples/remediation_nxos_aaa.rb
 - examples/remediation_palo_alto_ntp.rb
 - examples/remediation_palo_alto_syslog.rb
 - examples/remediation_palo_alto_syslog_migration.rb
@@ -147,6 +148,7 @@ files:
 - lib/baseline/cisco/tacacs_groups.rb
 - lib/baseline/cisco_ios/command_renderer.rb
 - lib/baseline/cisco_ios/parser.rb
+- lib/baseline/cisco_nxos/authentication.rb
 - lib/baseline/cisco_nxos/command_renderer.rb
 - lib/baseline/cisco_nxos/parser.rb
 - lib/baseline/command_renderer.rb
@@ -181,6 +183,9 @@ files:
 - lib/baseline/ntp_commands.rb
 - lib/baseline/ntp_remediation.rb
 - lib/baseline/ntp_server_operation_schema.rb
+- lib/baseline/nxos_aaa_methods.rb
+- lib/baseline/nxos_aaa_remediation.rb
+- lib/baseline/nxos_aaa_schema.rb
 - lib/baseline/palo_alto/command_index.rb
 - lib/baseline/palo_alto/command_renderer.rb
 - lib/baseline/palo_alto/document.rb