ctx_checker 0.1.0

data/lib/ctx_checker/hillstone/parsers/show_ntp_status.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+require "date"
+require_relative "../../parsers/base"
+require "ctx_parser/values"
+
+module CtxChecker
+  module Hillstone
+    module Parsers
+      # 上次同步尝试与已配置对等体不能证明当前系统已同步。
+      class ShowNtpStatus < CtxChecker::Parsers::Base
+        private
+
+        # 逐对等体解析，同时保留系统同步证据缺失的状态。
+        def parse_output(text, complete:)
+          source = clean(text)
+          rows, clients, versions, settings = [], [], [], []
+          source.each_line.with_index(1) do |raw, number|
+            line = raw.strip
+            next if line.empty?
+
+            if (match = /\Antp client is (enabled|disabled), authentication is (enabled|disabled)\z/i.match(line))
+              clients << match[1].downcase
+            elsif (match = /\Antp version is ([1-4])\z/i.match(line))
+              versions << match[1]
+            elsif /\Antp query-interval is \d+(?: minute(?:s)?)?, max-adjustment time is \d+(?: seconds?)?\z/i.match?(line)
+              settings << line
+            elsif (match = /\Antp server (\S+?)(?:, (.+))?\z/i.match(line))
+              row = parse_peer(match[1], match[2], number)
+              rows << row if row
+            else
+              @issues << { code: :unrecognized_ntp_line, line: number }
+            end
+          end
+          @issues << { code: :duplicate_ntp_field, field: :version } if versions.size > 1
+          @issues << { code: :duplicate_ntp_field, field: :settings } if settings.size > 1
+          @issues << { code: :missing_ntp_status } if clients.empty?
+          @issues << { code: :duplicate_ntp_field, field: :client } if clients.size > 1
+          synchronized = false if clients == [ "disabled" ]
+          @issues << { code: :ntp_system_status_unavailable } unless synchronized == false
+          rows.unshift(component: "system", synchronized: synchronized) unless clients.empty?
+          build_result(rows, complete: complete, recognized: clients.any?, identity: [ :component ])
+        end
+
+        # 设备提供虚拟路由器时，将其纳入对等体身份。
+        def parse_peer(host, options, number)
+          unless valid_peer?(host)
+            @issues << { code: :invalid_ntp_peer, line: number }
+            return
+          end
+          fields = {}
+          Array(options&.split(/,\s*/)).each do |option|
+            key, value = peer_option(option, number)
+            next unless key
+            if fields.key?(key)
+              @issues << { code: :duplicate_ntp_field, field: key, line: number }
+              fields[key] = nil
+            else
+              fields[key] = value
+            end
+          end
+          peer = CtxParser::Values.valid_host?(host) ? CtxParser::Values.host(host) : host.downcase
+          { component: "peer/#{fields[:vrouter] || 'unspecified'}/#{peer}", peer: peer, synchronized: nil,
+            last_sync_status: fields[:last_sync_status] || :unknown, last_sync_at: nil }
+        end
+
+        # 未知选项作为诊断保留，不能误判为同步证据。
+        def peer_option(option, number)
+          if (match = /\Avrouter (\S+)\z/.match(option))
+            [ :vrouter, match[1] ]
+          elsif (match = /\Akey (\d+)\z/.match(option))
+            [ :key, match[1] ]
+          elsif option == "prefer"
+            [ :prefer, true ]
+          elsif (match = /\Alast sync: (\d{4}-\d{2}-\d{2}) (\d{2}:\d{2}:\d{2}) \(([^)]+)\)\z/.match(option))
+            [ :last_sync_status, sync_attempt(match, number) ]
+          else
+            @issues << { code: :unrecognized_ntp_field, line: number }
+            nil
+          end
+        end
+
+        # 本地时间戳在确定偏移前保留为不可用于偏差评估的证据。
+        def sync_attempt(match, number)
+          Date.iso8601(match[1])
+          unless match[2].split(":").map(&:to_i).zip([ 24, 60, 60 ]).all? { |value, limit| value < limit }
+            raise ArgumentError, "Invalid local clock"
+          end
+          @issues << { code: :ntp_last_sync_offset_unknown, line: number }
+          return :failed if match[3] == "Error"
+          return :succeeded if match[3] == "Success"
+
+          @issues << { code: :unknown_ntp_last_sync_status, line: number }
+          :unknown
+        rescue ArgumentError
+          @issues << { code: :invalid_ntp_last_sync_time, line: number }
+          :unknown
+        end
+
+        # 服务器名称仅接受主机名或主机地址，不接受任意 CLI 片段。
+        def valid_peer?(text)
+          return true if CtxParser::Values.valid_host?(text)
+          return false if text.match?(/\A[\d.]+\z/) || text.length > 253
+
+          text.delete_suffix(".").split(".", -1).all? { |label| /\A[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\z/.match?(label) }
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/hillstone/parsers/show_transceiver.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module Hillstone
+    module Parsers
+      # 光模块读数保留模块自身的正常、警告或告警范围。
+      class ShowTransceiver < CtxChecker::Parsers::Base
+        NUMBER = /[+-]?\d+(?:\.\d+)?/
+        HEADER = /\ATransceiver status information is shown as below:\z/i
+        BLOCK = /\A=+\s+((?:x?ethernet)\d+(?:\/\d+)+)\s+=+\z/i
+        METADATA = /\A(?:SFP(?:\+\/XFP)? information:|Part Number:|Serial Number:|Transmission media:|Module temperature(?: (?:normal|warning|alarm) range)?:|Tx supply voltage(?: (?:normal|warning|alarm) range)?:|Tx bias current(?: (?:normal|warning|alarm) range)?:|Module Wavelength:|single module max transmit distance:|OM[123] max transmit distance:|OM4 or copper max transmit distance:)/i
+
+        private
+
+        # 逐模块隔离，避免未知块将测量值错误关联到前一模块。
+        def parse_output(text, complete:)
+          rows, issues, blocks, current, header = [], [], [], nil, false
+          clean(text).each_line do |raw|
+            line = raw.strip
+            next if line.empty? || /\A=+\z/.match?(line)
+
+            if HEADER.match?(line)
+              issues << { code: :duplicate_optics_header } if header
+              header = true
+            elsif (match = BLOCK.match(line))
+              current = { name: CtxChecker::Parsers::InterfaceNames.normalize(match[1], platform: :hillstone), lines: [] }
+              blocks << current
+            elsif line.start_with?("=")
+              current = nil
+              issues << { code: :unrecognized_optics_block }
+            elsif current
+              current[:lines] << line
+            else
+              issues << { code: :unrecognized_optics_line }
+            end
+          end
+          blocks.each { |block| rows.concat(measurements(block, issues)) }
+          issues << { code: :optics_header_missing } unless header
+          issues << { code: :optics_measurements_missing } if blocks.empty?
+          build_result(rows, complete: complete, recognized: header || blocks.any?, issues: issues,
+            identity: %i[interface lane metric])
+        end
+
+        # 缺失或重复测量保持不可用，不替换为零。
+        def measurements(block, issues)
+          name = block[:name]
+          values, limits, seen = {}, {}, Hash.new(0)
+          block[:lines].each do |line|
+            if (match = /\A(Tx|Rx) optical power:\s*(#{NUMBER}|N\/A|--)\s*dBm\z/i.match(line))
+              metric = metric(match[1])
+              set_value(values, metric, number(match[2]), seen, issues, name)
+            elsif (match = /\A(Tx|Rx) optical power (normal|warning|alarm) range:\s*\[\s*(#{NUMBER})\s*[,，]\s*(#{NUMBER})\s*\]\z/i.match(line))
+              metric = metric(match[1])
+              level = match[2].casecmp?("alarm") ? :alarm : :warning
+              low, high = number(match[3]), number(match[4])
+              limits[metric] ||= {}
+              %i[low high].zip([ low, high ]).each do |bound, value|
+                key = "#{bound}_#{level}".to_sym
+                set_value(limits[metric], key, value, seen, issues, name, identity: [ metric, key ])
+              end
+            elsif !METADATA.match?(line)
+              issues << { code: :unrecognized_optics_field, interface: name }
+            end
+          end
+          %i[tx_power rx_power].map do |metric|
+            issues << { code: :optics_measurement_missing, interface: name, metric: metric } unless seen[metric].positive?
+            { interface: name, lane: nil, metric: metric, value: values[metric], unit: :dbm,
+              low_alarm: nil, high_alarm: nil, low_warning: nil, high_warning: nil,
+              alarm: :unknown, present: true, dom_supported: values.key?(metric) ? true : nil }.merge(limits.fetch(metric, {}))
+          end
+        end
+
+        # 即使数值相同，重复测量也使该指标失效。
+        def set_value(values, key, value, seen, issues, name, identity: key)
+          seen[identity] += 1
+          if seen[identity] > 1
+            values[key] = nil
+            issues << { code: :duplicate_optics_value, interface: name }
+          else
+            values[key] = value
+          end
+        end
+
+        # 标准测量名称独立于厂商标签。
+        def metric(direction)
+          direction.casecmp?("Tx") ? :tx_power : :rx_power
+        end
+
+        # 解析有限读数，明确保留 DOM 值不可用的状态。
+        def number(value)
+          return unless /\A#{NUMBER}\z/.match?(value)
+
+          parsed = Float(value)
+          parsed if parsed.finite?
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/hillstone/profile.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "ctx_parser/profile"
+require_relative "parsers/show_interface"
+require_relative "parsers/show_interface_counter"
+require_relative "parsers/show_transceiver"
+require_relative "parsers/show_ip_bgp_summary"
+require_relative "parsers/show_ip_ospf_neighbor"
+require_relative "parsers/show_cpu"
+require_relative "parsers/show_memory"
+require_relative "parsers/show_environment"
+require_relative "parsers/show_clock"
+require_relative "parsers/show_ntp_status"
+require_relative "parsers/show_cpu_cntr"
+
+module CtxChecker
+  module Hillstone
+    # StoneOS 命令已在 SG-6000-A3700 验证；未覆盖作用域明确保留不可用。
+    class Profile < CtxParser::Profile
+      CATALOG = CtxParser::CommandCatalog.new([
+        { dimensions: %i[interfaces aggregation], command: "show interface", parser: Parsers::ShowInterface },
+        { dimensions: [ :counters ], command: "show interface counter", parser: Parsers::ShowInterfaceCounter },
+        { dimensions: [ :optics ], command: "show transceiver", parser: Parsers::ShowTransceiver },
+        { dimensions: [ :bgp ], command: "show ip bgp summary", parser: Parsers::ShowIpBgpSummary },
+        { dimensions: [ :ospf ], command: "show ip ospf neighbor", parser: Parsers::ShowIpOspfNeighbor },
+        { dimensions: [ :cpu ], command: "show cpu", parser: Parsers::ShowCpu },
+        { dimensions: [ :memory ], command: "show memory", parser: Parsers::ShowMemory },
+        { dimensions: %i[temperature environment power], command: "show environment", parser: Parsers::ShowEnvironment },
+        { dimensions: [ :clock ], command: "show clock", parser: Parsers::ShowClock },
+        { dimensions: [ :ntp ], command: "show ntp status", parser: Parsers::ShowNtpStatus },
+        { dimensions: [ :device_counters ], command: "show cpu-cntr", parser: Parsers::ShowCpuCntr }
+      ])
+      COMMANDS = CATALOG.commands
+      PARSERS = CATALOG.parsers
+
+      # 在线接口丢弃表不提供错误包或 CRC 测量。
+      def counter_metrics = %i[in_errors out_errors crc_errors].freeze
+    end
+  end
+end

data/lib/ctx_checker/observation.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+require "ctx_parser/immutable"
+require "time"
+require_relative "system_record"
+
+module CtxChecker
+  # 提供经过校验的不可变运行事实，与后续健康评估相互独立。
+  class Observation
+    NAMES = (%i[interfaces counters aggregation optics bgp ospf] + SystemRecord::FIELDS.keys).freeze
+    STATUSES = %i[complete partial failed unsupported not_requested not_applicable].freeze
+    METRICS = %i[in_errors out_errors in_discards out_discards crc_errors stomped_crc_errors out_carrier_errors].freeze
+    COUNTER_UNITS = %i[packets bytes events unknown].freeze
+    COUNTER_SCOPES = %i[interface mac cpu logical queue unknown].freeze
+    OPTICAL_THRESHOLDS = %i[low_alarm low_warning high_warning high_alarm].freeze
+    FIELDS = CtxParser::Immutable.copy({
+      interfaces: %i[name kind admin_status oper_status protocol_status protocol_applicable parent],
+      counters: %i[interface metric value unit scope discontinuity sampled_at source_command],
+      aggregation: %i[group member member_status oper_status],
+      optics: %i[interface lane metric value unit low_alarm low_warning high_warning high_alarm alarm present dom_supported applicable],
+      bgp: %i[vrf afi_safi peer state received_prefixes remote_as],
+      ospf: %i[vrf process_id area interface router_id neighbor_address state network_type local_role neighbor_role], **SystemRecord::FIELDS
+    }.transform_values { |fields| fields + [ :source_complete ] })
+    IDENTITIES = CtxParser::Immutable.copy(interfaces: %i[name], counters: %i[interface metric],
+      aggregation: %i[group member], optics: %i[interface lane metric], bgp: %i[vrf afi_safi peer],
+      ospf: %i[vrf process_id interface router_id neighbor_address], **SystemRecord::IDENTITIES)
+    REQUIRED = CtxParser::Immutable.copy(interfaces: %i[name], counters: %i[interface metric],
+      aggregation: %i[group], optics: %i[interface metric], bgp: %i[peer], ospf: %i[router_id], **SystemRecord::REQUIRED)
+    ISSUE_FIELDS = %i[code line lines field count skipped interface metric metrics lane section expected observed group stage component scope window_seconds command error_type].freeze
+    ERROR_TYPE_PATTERN = /\A(?:[A-Z][A-Za-z0-9_]*::)*[A-Z][A-Za-z0-9_]*\z/
+    ENUMS = CtxParser::Immutable.copy(
+      kind: %i[physical aggregate bridge redundant svi loopback tunnel subinterface unknown],
+      admin_status: %i[up down unknown], oper_status: %i[up down unknown], protocol_status: %i[up down unknown],
+      member_status: %i[active standby down suspended unselected unknown], unit: %i[dbm],
+      alarm: %i[normal high_alarm high_warning low_warning low_alarm unknown],
+      network_type: %i[broadcast nbma point_to_point point_to_multipoint virtual_link unknown],
+      local_role: %i[dr bdr drother unknown], neighbor_role: %i[dr bdr drother unknown])
+    SCOPE_FIELDS = CtxParser::Immutable.copy(bgp: %i[vrf afi_safi], ospf: %i[vrf process_id interface])
+    attr_reader :name, :status, :records, :issues, :evidence, :covered_scopes
+
+    # 冻结单个维度的记录、状态及诊断元数据。
+    def initialize(name:, status:, records: [], issues: [], evidence: [], covered_scopes: [])
+      raise ArgumentError, "Unknown observation dimension" unless NAMES.include?(name)
+      raise ArgumentError, "Invalid observation status" unless STATUSES.include?(status)
+      raise ArgumentError, "Records must be an array" unless records.is_a?(Array)
+      if %i[failed unsupported not_requested not_applicable].include?(status) && records.any?
+        raise ArgumentError, "Unavailable observations cannot contain records"
+      end
+      @name, @status = name, status
+      validate_scopes!(covered_scopes)
+      normalized = records.map { |record| validate_record(record) }
+      identities = normalized.map { |record| identity(record) }
+      raise ArgumentError, "Duplicate observation identity" unless identities.uniq.size == identities.size
+      unless issues.is_a?(Array) && issues.all? { |issue| self.class.valid_issue?(issue) }
+        raise ArgumentError, "Observation issues require safe codes"
+      end
+      unless evidence.is_a?(Array) && evidence.all? { |entry| entry.is_a?(Hash) && (entry.keys - %i[command sha256 bytes reference observed_at status]).empty? }
+        raise ArgumentError, "Invalid observation evidence"
+      end
+      evidence.each do |entry|
+        raise ArgumentError, "Invalid command evidence status" if entry.key?(:status) && !%i[complete partial failed unsupported].include?(entry[:status])
+        raise ArgumentError, "Invalid evidence command" if entry.key?(:command) && !text?(entry[:command])
+        raise ArgumentError, "Invalid evidence digest" if entry.key?(:sha256) && !/\A[0-9a-f]{64}\z/.match?(entry[:sha256].to_s)
+        raise ArgumentError, "Invalid evidence byte count" if entry.key?(:bytes) && !(entry[:bytes].is_a?(Integer) && entry[:bytes] >= 0)
+        raise ArgumentError, "Invalid evidence reference" if entry.key?(:reference) && !text?(entry[:reference])
+        if entry.key?(:observed_at)
+          raise ArgumentError, "Invalid evidence time" unless entry[:observed_at].is_a?(String)
+          Time.iso8601(entry[:observed_at])
+        end
+      end
+      @records, @issues, @evidence = [ normalized, issues, evidence ].map { |value| CtxParser::Immutable.copy(value) }
+      @covered_scopes = CtxParser::Immutable.copy(covered_scopes)
+      @observed_at = evidence.filter_map { |entry| Time.iso8601(entry[:observed_at]).getutc if entry[:observed_at] }.max&.freeze
+      freeze
+    end
+
+    # 判断所有已选事实是否都有完整证据支持。
+    def complete? = status == :complete
+    # 返回当前观测关联的归一化时间戳。
+    def observed_at = @observed_at
+    # 返回用于关联同一资源多次采样的稳定字段。
+    def identity(record) = record.values_at(*IDENTITIES.fetch(name))
+    # 未增加作用域证明时，保持旧快照和计数器指纹稳定。
+    def to_h
+      value = { name: name, status: status, records: records, issues: issues, evidence: evidence }
+      covered_scopes.empty? ? value : value.merge(covered_scopes: covered_scopes)
+    end
+    # 展示对象身份与状态，避免泄露原始回显或凭据。
+    def inspect = "#<#{self.class} name=#{name} status=#{status} records=#{records.size}>"
+
+    # 命令失败与快照失败共用安全诊断结构。
+    def self.valid_issue?(issue)
+      return false unless issue.is_a?(Hash) && (issue.keys - ISSUE_FIELDS).empty?
+
+      code = issue[:code]
+      return false unless (code.is_a?(Symbol) || code.is_a?(String)) && /\A[a-z][a-z0-9_]*\z/.match?(code.to_s)
+
+      !issue.key?(:error_type) || issue[:error_type].is_a?(String) && ERROR_TYPE_PATTERN.match?(issue[:error_type])
+    end
+
+    private
+
+    # 完整协议表仅覆盖其明确的 VRF、地址族或 OSPF 进程。
+    def validate_scopes!(scopes)
+      unless scopes.is_a?(Array) && scopes.uniq == scopes
+        raise ArgumentError, "Covered scopes must be a unique array"
+      end
+      return if scopes.empty?
+
+      fields = SCOPE_FIELDS[name]
+      required = name == :ospf ? %i[vrf process_id] : fields
+      unless fields && %i[complete partial].include?(status) && scopes.all? do |scope|
+          scope.is_a?(Hash) && (scope.keys - fields).empty? && (required - scope.keys).empty? &&
+            scope.all? { |key, value| text?(value) || key == :process_id && value.is_a?(Integer) && value >= 0 }
+        end
+        raise ArgumentError, "Covered scopes require explicit protocol identities"
+      end
+    end
+
+    # 测量缺失保留 nil；身份字段不能静默消失。
+    def validate_record(record)
+      unless record.is_a?(Hash) && (record.keys - FIELDS.fetch(name)).empty?
+        raise ArgumentError, "Unsupported observation record fields"
+      end
+      row = FIELDS.fetch(name).to_h { |key| [ key, record[key] ] }
+      raise ArgumentError, "Missing observation identity" unless REQUIRED.fetch(name).all? { |key| !row[key].nil? }
+      row.each do |key, value|
+        next if value.nil?
+        valid = if key == :source_complete
+          value == true || value == false
+        elsif SystemRecord::FIELDS.key?(name)
+          SystemRecord.valid?(name, key, value)
+        elsif key == :sampled_at
+          SystemRecord.timestamp?(value)
+        elsif name == :counters && key == :unit
+          COUNTER_UNITS.include?(value)
+        elsif name == :counters && key == :scope
+          COUNTER_SCOPES.include?(value)
+        elsif ENUMS.key?(key)
+          ENUMS.fetch(key).include?(value)
+        elsif key == :metric
+          (name == :optics ? %i[tx_power rx_power] : METRICS).include?(value)
+        elsif key == :state
+          states = name == :bgp ? %i[established idle active connect opensent openconfirm shutdown unknown] : %i[full two_way down attempt init exstart exchange loading unknown]
+          states.include?(value)
+        elsif %i[value low_alarm low_warning high_warning high_alarm].include?(key)
+          name == :counters ? value.is_a?(Integer) && value >= 0 : value.is_a?(Numeric) && value.real? && value.finite?
+        elsif %i[received_prefixes remote_as].include?(key)
+          value.is_a?(Integer) && value >= 0
+        elsif %i[present dom_supported applicable protocol_applicable].include?(key)
+          value == true || value == false
+        elsif key == :lane || key == :discontinuity || key == :process_id
+          value.is_a?(Integer) && value >= 0 || text?(value)
+        else
+          text?(value)
+        end
+        raise ArgumentError, "Invalid #{name} field #{key}" unless valid
+      end
+      row
+    end
+
+    # 校验非空文本，拒绝将含控制字符的值作为标识。
+    def text?(value) = value.is_a?(String) && !value.strip.empty? && !/[\x00-\x1f\x7f]/.match?(value)
+  end
+end

data/lib/ctx_checker/observation_merger.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require_relative "observation"
+require "ctx_parser/records"
+
+module CtxChecker
+  # 组合独立命令证据，不拼接不相容的 CLI 语法正文。
+  class ObservationMerger
+    # 归并已声明的命令证据，不丢失来源失败或身份歧义。
+    def self.call(name, observations, commands:, required_metrics: [])
+      unless observations.is_a?(Array) && observations.all? { |observation| observation.is_a?(Observation) && observation.name == name }
+        raise ArgumentError, "Command observations must share a dimension"
+      end
+      sources = observations.map do |observation|
+        source = observation.evidence.map { |entry| entry[:command] }.compact.uniq
+        raise ArgumentError, "Observation must identify one declared source command" unless source.one? && commands.include?(source.first)
+        source.first
+      end
+      raise ArgumentError, "Duplicate source command" unless sources.uniq == sources
+
+      if observations.any? && observations.all? { |observation| observation.status == :not_applicable } && (commands - sources).empty?
+        return Observation.new(name: name, status: :not_applicable,
+          issues: observations.flat_map(&:issues).uniq, evidence: observations.flat_map(&:evidence))
+      end
+
+      issues = observations.zip(sources).flat_map do |observation, command|
+        observation.issues.reject { |issue| issue[:code] == :incomplete_command_set }.map { |issue| issue.merge(command: command) }
+      end
+      if observations.any? { |observation| observation.status == :partial && observation.issues.empty? }
+        issues << { code: :incomplete_command_output }
+      end
+      missing = commands - sources
+      issues << { code: :incomplete_command_set, count: missing.size } if missing.any?
+      records = observations.flat_map do |observation|
+        observation.records.map do |record|
+          if %i[counters device_counters].include?(name) && record[:sampled_at].nil? && observation.observed_at
+            record.merge(sampled_at: observation.observed_at.iso8601(6))
+          else
+            record
+          end
+        end
+      end
+      grouped = CtxParser::Records.new(records, identity: Observation::IDENTITIES.fetch(name))
+      covered_scopes = observations.flat_map(&:covered_scopes).uniq
+      if grouped.duplicates?
+        issues << { code: :duplicate_identity, count: grouped.duplicate_identity_count }
+        records = grouped.unambiguous.dup
+        # 隔离的对等体实际已被观察到，因此移除后不能再据其作用域证明缺失。
+        ambiguous = grouped.first_occurrences - grouped.unambiguous
+        covered_scopes = covered_scopes.reject do |scope|
+          ambiguous.any? { |row| scope.all? { |key, value| row[key].nil? || row[key] == value } }
+        end
+      end
+      if name == :counters && required_metrics.any?
+        # 补齐缺失指标的未知占位，不把独立方向查询失败解释为零错误。
+        records.group_by { |row| row[:interface] }.each do |interface, rows|
+          absent = required_metrics - rows.map { |row| row[:metric] }
+          next if absent.empty?
+          issues << { code: :counter_metrics_missing, interface: interface, metrics: absent }
+          records.concat(absent.map { |metric| { interface: interface, metric: metric, value: nil } })
+        end
+      end
+      unavailable = observations.all? { |observation| %i[failed unsupported].include?(observation.status) }
+      # 有成功事实时降为部分完整，而非让同级脚本失败抹除整份维度结果。
+      status = if unavailable && records.empty?
+        observations.any? && observations.all? { |observation| observation.status == :unsupported } && missing.empty? ? :unsupported : :failed
+      elsif issues.any? || observations.any? { |observation| %i[failed unsupported].include?(observation.status) }
+        :partial
+      else
+        :complete
+      end
+      if name == :aggregation && status == :complete && records.empty?
+        status = :not_applicable
+        issues << { code: :aggregation_not_configured }
+      end
+      Observation.new(name: name, status: status, records: records, issues: issues.uniq,
+        covered_scopes: covered_scopes, evidence: observations.flat_map(&:evidence))
+    end
+  end
+end

data/lib/ctx_checker/palo_alto/parsers/show_clock.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require "date"
+require "time"
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module PaloAlto
+    module Parsers
+      # 命名本地时区缺少明确偏移，不能用于安全判断 UTC 时钟偏差。
+      class ShowClock < CtxChecker::Parsers::Base
+        private
+
+        # 解析 show clock，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          source = clean(text)
+          rows, issues = [], []
+          source.each_line.with_index(1) do |raw, number|
+            next if raw.strip.empty?
+            match = /\A(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)\s+([A-Z][a-z]{2})\s+(\d{1,2})\s+(\d{2}:\d{2}:\d{2})\s+(\S+)\s+(\d{4})\z/.match(raw.strip)
+            unless match
+              issues << { code: :invalid_clock_output, line: number }
+              next
+            end
+            zone = %w[UTC GMT Z].include?(match[4]) ? "+0000" : match[4]
+            timestamp = clock_time(match, zone)
+            issues << { code: :clock_offset_unknown, line: number } unless timestamp
+            rows << { component: "system", time: timestamp, source: "system_clock", synchronized: nil }
+          end
+          build_result(rows, complete: complete, recognized: rows.any?, issues: issues, identity: [ :component ])
+        end
+
+        # 解析设备时钟，不虚构未知时区。
+        def clock_time(match, zone)
+          return unless /\A[+-]\d{2}:?\d{2}\z/.match?(zone)
+          month = Date::ABBR_MONTHNAMES.index(match[1])
+          year, day = Integer(match[5], 10), Integer(match[2], 10)
+          return unless month && Date.valid_date?(year, month, day)
+          hours, minutes, seconds = match[3].split(":").map { |part| Integer(part, 10) }
+          return unless hours < 24 && minutes < 60 && seconds < 60
+          offset = zone.delete(":")
+          return unless offset[1, 2].to_i < 24 && offset[3, 2].to_i < 60
+          Time.strptime("#{match[1]} #{day} #{match[3]} #{offset} #{year}", "%b %d %H:%M:%S %z %Y").iso8601
+        rescue ArgumentError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/palo_alto/parsers/show_counter_global.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module PaloAlto
+    module Parsers
+      # 数值自数据平面重启后累计；CLI 速率采样由外部调用方管理。
+      class ShowCounterGlobal < CtxChecker::Parsers::Base
+        CATEGORIES = { "info" => :informational, "warn" => :error, "error" => :error, "drop" => :discard }.freeze
+        # 安全策略执行与设备转发故障区分处理。
+        METRIC_CATEGORIES = { "flow_policy_deny" => :policy }.freeze
+
+        private
+
+        # 解析 show counter global，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          source = clean(text)
+          rows, totals, issues = [], [], []
+          title, header = false, false
+          source.each_line.with_index(1) do |raw, number|
+            line = raw.strip
+            if line == "Global counters:"
+              title = true
+            elsif line.match?(/\Aname\s+value\s+rate\s+severity\s+category\s+aspect\s+description\z/)
+              header = true
+            elsif (match = /\ATotal counters shown:\s*(\d+)\z/.match(line))
+              totals << Integer(match[1], 10)
+            elsif line.empty? || line.match?(/\A-+\z/) || line.match?(/\AElapsed time since last sampling:\s*\d+(?:\.\d+)? seconds\z/)
+              next
+            elsif header && (match = /\A([a-zA-Z][a-zA-Z0-9_]*)\s+(\d+)\s+\d+\s+(info|warn|error|drop)\s+(\S+)\s+(\S+)\s+.+\z/.match(line))
+              rows << { component: "dataplane/#{match[4]}/#{match[5]}", metric: match[1], category: METRIC_CATEGORIES.fetch(match[1], CATEGORIES.fetch(match[3])),
+                value: Integer(match[2], 10), discontinuity: nil }
+            else
+              issues << { code: :unrecognized_counter_row, line: number }
+            end
+          end
+          if !totals.one? || totals.first != rows.size
+            issues << { code: :counter_total_mismatch, observed: rows.size, expected: totals.one? ? totals.first : nil }
+          end
+          recognized = title && header && (rows.any? || totals == [ 0 ])
+          build_result(rows, complete: complete, recognized: recognized, issues: issues, identity: %i[component metric])
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/palo_alto/parsers/show_counter_interface_all.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module PaloAlto
+    module Parsers
+      # CPU 接收错误属于 L2 至 L4 错误，不能替代 MAC CRC 错误。
+      class ShowCounterInterfaceAll < CtxChecker::Parsers::Base
+        METRICS = {
+          "receive errors" => :in_errors, "transmit errors" => :out_errors,
+          "receive discarded" => :in_discards, "receive packets dropped" => :in_discards,
+          "transmit packets dropped" => :out_discards
+        }.freeze
+        DETAIL = /\A(?:bytes (?:received|transmitted)|packets (?:received|transmitted|dropped(?: by flow state check)?|routed to different zone)|receive incoming errors|forwarding errors|no route|arp not found|neighbor (?:not found|info pending)|mac not found|land attacks|ping-of-death attacks|teardrop attacks|[im]ac spoof attacks|ip spoof attacks|ICMP fragment|layer2 (?:encapsulated|decapsulated) packets|multicast packets received|(?:tcp|udp|sctp|other) cps)\s+\d+\z/i
+
+        private
+
+        # 解析 show counter interface all，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          text = clean(text)
+          rows, issues, interfaces = [], [], {}
+          text.split(/(?=^\s*Interface:)/i).each do |block|
+            next if block.strip.empty?
+            match = /\A\s*Interface:\s*([^\n]+)\n/i.match(block)
+            unless match
+              lines = block.lines.map(&:strip).reject { |line| line.empty? || line.match?(/\A-+\z/) }
+              issues << { code: :unrecognized_counter_block } unless lines == [ "Hardware interface counters:" ]
+              next
+            end
+            name = match[1].strip.casecmp?("Management Interface") ? "management" : match[1].strip.downcase
+            interfaces[name] = true
+            kind = CtxChecker::Parsers::InterfaceNames.kind(name)
+            wanted = kind == :physical ? :hardware : :logical
+            section, values = nil, []
+            block.lines.drop(1).each do |raw|
+              line = raw.strip
+              if (heading = /\A(Hardware|Logical) interface counters(?: read from CPU)?:\z/i.match(line))
+                section = heading[1].downcase.to_sym
+              elsif line.match?(/\A(?:Detailed )?Physical port counters read from MAC:\z/i)
+                section = :mac
+              elsif line.empty? || line.match?(/\A-+\z/)
+                next
+              elsif section == wanted && (metric = /\A(.+?)\s+(\d+)\z/.match(line)) && METRICS.key?(metric[1].downcase)
+                values << { interface: name, metric: METRICS.fetch(metric[1].downcase), value: Integer(metric[2], 10), discontinuity: nil,
+                  unit: :packets, scope: section == :hardware ? :cpu : :logical }
+              elsif section == wanted && !DETAIL.match?(line)
+                issues << { code: :unrecognized_counter_field, interface: name }
+              elsif section.nil?
+                issues << { code: :counter_section_missing, interface: name }
+              end
+            end
+            rows.concat(values)
+          end
+          # 同一接口可能同时出现在硬件与逻辑清单中，须先确定其标准层级，
+          # 再补齐缺失指标，不能按每个展示块重复生成。
+          by_interface = rows.group_by { |row| row[:interface] }
+          interfaces.each_key do |name|
+            missing = %i[in_errors out_errors in_discards out_discards crc_errors] - by_interface.fetch(name, []).map { |row| row[:metric] }
+            missing.each { |metric| rows << { interface: name, metric: metric, value: nil, discontinuity: nil } }
+            issues << { code: :missing_counter_metrics, interface: name, metrics: missing } if missing.any?
+          end
+          build_result(rows, complete: complete, recognized: interfaces.any?, issues: issues, identity: %i[interface metric])
+        end
+      end
+    end
+  end
+end