ctx_checker 0.1.0

data/lib/ctx_checker/palo_alto/parsers/show_transceiver_all.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module PaloAlto
+    module Parsers
+      # 汇总功率使用 mW；零和 N/A 不能转换为有限的 dBm 读数。
+      class ShowTransceiverAll < CtxChecker::Parsers::Base
+        NUMBER = /(?:\d+(?:\.\d+)?|n\/a)/i
+
+        private
+
+        # 解析 show transceiver all，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          text = clean(text)
+          rows, issues, header = [], [], false
+          text.each_line do |raw|
+            line = raw.strip
+            if /\APort\s+Temperature\s+Voltage\s+Current\s+Tx Power\s+Rx Power\z/i.match?(line)
+              header = true
+            elsif (match = /\A(ethernet\d+\/\d+)\s+#{NUMBER}(?:\s+C)?\s+#{NUMBER}(?:\s+V)?\s+#{NUMBER}(?:\s+mA)?\s+(#{NUMBER})(?:\s+mW)?\s+(#{NUMBER})(?:\s+mW)?\z/i.match(line))
+              [ [ :tx_power, match[2] ], [ :rx_power, match[3] ] ].each do |metric, raw_value|
+                milliwatts = raw_value.match?(/\A\d+(?:\.\d+)?\z/) ? Float(raw_value) : nil
+                if milliwatts && !milliwatts.finite?
+                  issues << { code: :invalid_optics_measurement, interface: match[1], metric: metric }
+                  milliwatts = nil
+                end
+                value = milliwatts && milliwatts.positive? ? 10 * Math.log10(milliwatts) : nil
+                issues << { code: :zero_optical_power_unresolved, interface: match[1], metric: metric } if milliwatts == 0
+                rows << { interface: match[1].downcase, lane: nil, metric: metric, value: value, unit: :dbm,
+                  low_alarm: nil, low_warning: nil, high_warning: nil, high_alarm: nil, alarm: :unknown,
+                  present: true, dom_supported: milliwatts.nil? ? nil : true }
+              end
+            elsif !line.empty? && !line.match?(/\A-+\z/)
+              issues << { code: :unrecognized_optics_line }
+            end
+          end
+          build_result(rows, complete: complete, recognized: header && rows.any?, issues: issues, identity: %i[interface lane metric])
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/palo_alto/profile.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require "ctx_parser/profile"
+require_relative "parsers/show_interface_all"
+require_relative "parsers/show_counter_interface_all"
+require_relative "parsers/show_lacp_aggregate_ethernet"
+require_relative "parsers/show_transceiver_all"
+require_relative "parsers/show_routing_protocol_bgp_peer"
+require_relative "parsers/show_routing_protocol_ospf_neighbor"
+require_relative "parsers/show_system_resources"
+require_relative "parsers/show_system_environmentals"
+require_relative "parsers/show_clock"
+require_relative "parsers/show_ntp"
+require_relative "parsers/show_system_state_alarms"
+require_relative "parsers/show_counter_global"
+
+module CtxChecker
+  module PaloAlto
+    # 声明传统路由引擎查询；高级路由格式需要独立平台策略。
+    class Profile < CtxParser::Profile
+      CATALOG = CtxParser::CommandCatalog.new([
+        { dimensions: [ :interfaces ], command: "show interface all", parser: Parsers::ShowInterfaceAll },
+        { dimensions: [ :counters ], command: "show counter interface all", parser: Parsers::ShowCounterInterfaceAll },
+        { dimensions: [ :aggregation ], command: "show lacp aggregate-ethernet all", parser: Parsers::ShowLacpAggregateEthernet },
+        { dimensions: [ :optics ], command: "show transceiver all", parser: Parsers::ShowTransceiverAll },
+        { dimensions: [ :bgp ], command: "show routing protocol bgp peer", parser: Parsers::ShowRoutingProtocolBgpPeer },
+        { dimensions: [ :ospf ], command: "show routing protocol ospf neighbor", parser: Parsers::ShowRoutingProtocolOspfNeighbor },
+        { dimensions: %i[cpu memory], command: "show system resources", parser: Parsers::ShowSystemResources },
+        { dimensions: %i[temperature environment power], command: "show system environmentals", parser: Parsers::ShowSystemEnvironmentals },
+        { dimensions: [ :clock ], command: "show clock", parser: Parsers::ShowClock },
+        { dimensions: [ :ntp ], command: "show ntp", parser: Parsers::ShowNtp },
+        { dimensions: [ :alarms ], command: "show system state | match alarm", parser: Parsers::ShowSystemStateAlarms },
+        { dimensions: [ :device_counters ], command: "show counter global", parser: Parsers::ShowCounterGlobal }
+      ])
+      COMMANDS = CATALOG.commands
+      PARSERS = CATALOG.parsers
+    end
+  end
+end

data/lib/ctx_checker/parser_registry.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require "ctx_parser"
+require_relative "h3c/profile"
+require_relative "cisco_ios/profile"
+require_relative "cisco_nxos/profile"
+require_relative "palo_alto/profile"
+require_relative "hillstone/profile"
+require_relative "radware_alteon/profile"
+
+module CtxChecker
+  # 注册明确的平台别名与命令策略，不猜测不支持的语法。
+  module ParserRegistry
+    PROFILES = { h3c: H3c::Profile, cisco_ios: CiscoIos::Profile,
+      cisco_nxos: CiscoNxos::Profile, palo_alto: PaloAlto::Profile, hillstone: Hillstone::Profile,
+      radware_alteon: RadwareAlteon::Profile }.freeze
+    ALIASES = { comware: :h3c, h3c_wireless: :h3c, ios: :cisco_ios, iosxe: :cisco_ios,
+      ios_xe: :cisco_ios, cisco_iosxe: :cisco_ios, nxos: :cisco_nxos,
+      paloalto: :palo_alto, panos: :palo_alto, stoneos: :hillstone, radware: :radware_alteon, alteon: :radware_alteon }.freeze
+    REGISTRY = CtxParser::Registry.new(profiles: PROFILES, aliases: ALIASES)
+
+    # 固件版本作为目标事实传入，仅由需要它的平台策略解释。
+    def self.fetch(platform, model: nil, software_version: nil)
+      unless software_version.nil? || software_version.is_a?(String) && !/[\x00-\x1f\x7f]/.match?(software_version)
+        raise ArgumentError, "Software version must be text"
+      end
+      profile = REGISTRY.fetch(platform, model: model)
+      profile.respond_to?(:with_software_version) ? profile.with_software_version(software_version) : profile
+    end
+
+    # 选择解析器与检查策略前，先归一化平台别名。
+    def self.canonical(platform)
+      unless platform.is_a?(String) || platform.is_a?(Symbol)
+        raise ArgumentError, "Platform must be text"
+      end
+      key = platform.to_s.strip.downcase.to_sym
+      key = ALIASES.fetch(key, key)
+      raise ArgumentError, "Unsupported checker platform" unless PROFILES.key?(key)
+
+      key.to_s
+    end
+  end
+end

data/lib/ctx_checker/parsers/base.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require "ctx_parser"
+require "ctx_parser/input"
+require_relative "interface_names"
+require_relative "scoped_result"
+
+module CtxChecker
+  module Parsers
+    # 共享文本边界与完整性规则，不在厂商解析器中嵌入健康策略。
+    class Base < CtxParser::Parser
+      MAX_BYTES = 16 * 1024 * 1024
+
+      private
+
+      # 从归一化观测记录中移除不支持的数据。
+      def clean(text)
+        @issues = []
+        @unsupported = false
+        source = CtxParser::Input.text(text, encoding: :transcode, newlines: :lf, max_bytes: MAX_BYTES)
+        source.each_line.with_index(1) do |line, number|
+          if /\A\s*(?:(?:%\s*)?(?:Error:\s*)?(?:Invalid (?:input|command|syntax)|Unrecognized command|Unknown command|command not (?:found|supported)|not supported on this|syntax error)|\^-+\s*unrecognized keyword\b)/i.match?(line)
+            @unsupported = true
+            @issues << { code: :unsupported_command, line: number }
+          elsif /\A\s*(?:%\s*(?:Error|Incomplete|Ambiguous)|Error:|Permission denied|Insufficient privilege|\^-+\s*(?:incomplete command|ambiguous command|error\b))/i.match?(line)
+            @issues << { code: :command_error, line: number }
+          elsif /--\s*More\s*--|----\s*More\s*----|Press (?:any key|ENTER|<SPACE>)/i.match?(line)
+            @issues << { code: :paginated_output, line: number }
+          end
+        end
+        source
+      end
+
+      # 隔离身份冲突，保留无歧义记录并降低覆盖完整性。
+      def build_result(records, complete:, recognized:, issues: [], identity: nil, covered_scopes: [])
+        problems = Array(@issues) + issues
+        if identity
+          grouped = CtxParser::Records.new(records, identity: identity)
+          if grouped.duplicates?
+            problems << { code: :duplicate_identity, count: grouped.duplicate_identity_count }
+            records = grouped.unambiguous
+          end
+        end
+        problems << { code: :unrecognized_output } unless recognized
+        problems << { code: :incomplete_output } unless complete
+        status = if @unsupported
+          records = []
+          :unsupported
+        elsif Array(@issues).any? { |issue| issue[:code] == :command_error }
+          records = []
+          :failed
+        elsif !recognized && records.empty?
+          :failed
+        elsif problems.any?
+          :partial
+        else
+          :complete
+        end
+        if covered_scopes.any?
+          ScopedResult.new(status: status, records: records, issues: problems.uniq,
+            covered_scopes: status == :complete ? covered_scopes.uniq : [])
+        else
+          CtxParser::Result.new(status: status, records: records, issues: problems.uniq)
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/parsers/interface_names.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module CtxChecker
+  module Parsers
+    # 仅展开已知厂商缩写，保留接口、子接口与成员的身份区别。
+    module InterfaceNames
+      H3C = {
+        "ge" => "GigabitEthernet", "gigabitethernet" => "GigabitEthernet",
+        "xge" => "Ten-GigabitEthernet", "ten-gigabitethernet" => "Ten-GigabitEthernet",
+        "ten-gige" => "Ten-GigabitEthernet", "fge" => "FortyGigE", "fortygige" => "FortyGigE",
+        "hge" => "HundredGigE", "hundredgige" => "HundredGigE",
+        "bagg" => "Bridge-Aggregation", "bridge-aggregation" => "Bridge-Aggregation",
+        "ragg" => "Route-Aggregation", "route-aggregation" => "Route-Aggregation",
+        "vlan" => "Vlan-interface", "vlan-interface" => "Vlan-interface"
+      }.freeze
+      CISCO = {
+        "eth" => "Ethernet", "et" => "Ethernet", "ethernet" => "Ethernet",
+        "gi" => "GigabitEthernet", "gig" => "GigabitEthernet", "gigabitethernet" => "GigabitEthernet",
+        "fa" => "FastEthernet", "fastethernet" => "FastEthernet",
+        "te" => "TenGigabitEthernet", "ten" => "TenGigabitEthernet", "tengigabitethernet" => "TenGigabitEthernet",
+        "twe" => "TwentyFiveGigE", "twentyfivegige" => "TwentyFiveGigE", "twentyfivegigabitethernet" => "TwentyFiveGigE",
+        "fo" => "FortyGigabitEthernet", "fortygigabitethernet" => "FortyGigabitEthernet",
+        "hu" => "HundredGigE", "hundredgige" => "HundredGigE",
+        "po" => "Port-channel", "port-channel" => "Port-channel", "vlan" => "Vlan"
+      }.freeze
+      COMMON = { "lo" => "Loopback", "loopback" => "Loopback", "tu" => "Tunnel", "tunnel" => "Tunnel", "nve" => "Nve" }.freeze
+
+      module_function
+
+      # 展开已知厂商接口缩写，同时保留端口后缀。
+      def normalize(name, platform:)
+        raise ArgumentError, "Interface name must be text" unless name.is_a?(String) && !name.strip.empty? && !/[\x00-\x1f\x7f]/.match?(name)
+
+        value = name.strip
+        return value.downcase if %w[palo_alto paloalto panos hillstone stoneos].include?(platform.to_s)
+        if %w[radware_alteon radware alteon].include?(platform.to_s)
+          return "port#{Integer(value, 10)}" if /\A[1-9]\d*\z/.match?(value)
+
+          return value.downcase.sub(/\A(port|mgmt|trunk)\s+(\d+)/, '\1\2')
+        end
+
+        match = /\A([a-z-]+)\s*(\d.*)\z/i.match(value)
+        return value unless match
+
+        aliases = platform.to_s.start_with?("h3c") ? H3C : CISCO
+        "#{aliases.fetch(match[1].downcase) { COMMON.fetch(match[1].downcase, match[1]) }}#{match[2]}"
+      end
+
+      # 将已知接口名分类为物理口、聚合口、子接口或逻辑口。
+      def kind(name)
+        case name.to_s
+        when /\Aloopback\.?\d/i then :loopback
+        when /\A(?:tunnel|nve)\.?\d/i then :tunnel
+        when /\.\d+\z/ then :subinterface
+        when /\A(?:port-channel|bridge-aggregation|route-aggregation|ae|aggregate|trunk)\d/i then :aggregate
+        when /\A(?:vswitchif|bgroup)\d/i then :bridge
+        when /\Aredundant\d/i then :redundant
+        when /\Avlan(?:-interface)?\d/i then :svi
+        when /\A(?:[\w-]*ethernet|[\w-]*gige|mgmt|mgt|ha|cellular|port)\d/i then :physical
+        else :unknown
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/parsers/scoped_result.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require "ctx_parser/result"
+require "ctx_parser/immutable"
+
+module CtxChecker
+  module Parsers
+    # 运行表即使没有实体，也可证明已枚举的作用域。
+    class ScopedResult < CtxParser::Result
+      attr_reader :covered_scopes
+
+      # 冻结各作用域证据，不合并无关的观测结果。
+      def initialize(covered_scopes: [], **attributes)
+        @covered_scopes = CtxParser::Immutable.copy(covered_scopes)
+        super(**attributes)
+      end
+
+      # 值相等、序列化与替换操作均保留覆盖范围语义。
+      def to_h(&block)
+        attributes = { status: status, records: records, issues: issues, covered_scopes: covered_scopes }
+        block ? attributes.to_h(&block) : attributes
+      end
+      # 向 Ruby 模式匹配提供结果字段与已覆盖作用域。
+      def deconstruct_keys(keys) = keys ? to_h.slice(*keys) : to_h
+      # 创建新的不可变结果，同时保留未修改的作用域证据。
+      def with(**changes) = self.class.new(**to_h.merge(changes))
+      # 比较全部结果字段，包括明确的作用域覆盖范围。
+      def ==(other) = other.instance_of?(self.class) && to_h == other.to_h
+      # 比较结果值时同时比较已覆盖作用域。
+      def eql?(other) = other.instance_of?(self.class) && to_h.eql?(other.to_h)
+      # 按与相等判断一致的字段和作用域计算哈希。
+      def hash = [ self.class, to_h ].hash
+    end
+  end
+end

data/lib/ctx_checker/policy.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require_relative "observation"
+require_relative "system_policy"
+
+module CtxChecker
+  # 使用显式设备预期，不猜测未声明的拓扑或光学阈值。
+  class Policy
+    attr_reader :required_interfaces, :required_members, :minimum_active_members, :expected_bgp, :expected_ospf, :counter_limits, :optical_thresholds, :required_optics, :system
+
+    # 在设备评估前校验并冻结策略定义。
+    def initialize(required_interfaces: [], required_members: {}, minimum_active_members: {}, expected_bgp: [], expected_ospf: [], counter_limits: {}, optical_thresholds: [],
+      resource_thresholds: {}, temperature_thresholds: {}, required_components: {}, required_dimensions: [], required_optics: [],
+      max_clock_skew_seconds: 300, max_ntp_offset_ms: 100, device_counter_limits: {})
+      @system = SystemPolicy.new(resource_thresholds: resource_thresholds, temperature_thresholds: temperature_thresholds,
+        required_components: required_components, required_dimensions: required_dimensions, max_clock_skew_seconds: max_clock_skew_seconds,
+        max_ntp_offset_ms: max_ntp_offset_ms, device_counter_limits: device_counter_limits)
+      names!(required_interfaces)
+      unless required_members.is_a?(Hash) && required_members.all? { |group, members| text?(group) && names!(members) }
+        raise ArgumentError, "Required members must map groups to interface names"
+      end
+      unless minimum_active_members.is_a?(Hash) && minimum_active_members.all? { |group, count| text?(group) && count.is_a?(Integer) && count.positive? }
+        raise ArgumentError, "Minimum active members must be positive integers"
+      end
+      peers!(expected_bgp, %i[vrf afi_safi peer])
+      peers!(expected_ospf, %i[vrf process_id interface router_id])
+      unless counter_limits.is_a?(Hash) && counter_limits.all? { |metric, count| Observation::METRICS.include?(metric) && count.is_a?(Integer) && count >= 0 }
+        raise ArgumentError, "Counter limits must be nonnegative integer deltas"
+      end
+      optics!(optical_thresholds)
+      required_optics!(required_optics)
+      @required_interfaces, @required_members, @minimum_active_members, @expected_bgp, @expected_ospf, @counter_limits =
+        [ required_interfaces, required_members, minimum_active_members, expected_bgp, expected_ospf, counter_limits ].map { |value| CtxParser::Immutable.copy(value) }
+      @optical_thresholds = CtxParser::Immutable.copy(optical_thresholds)
+      @optical_index = @optical_thresholds.to_h { |row| [ row.values_at(:interface, :lane, :metric).freeze, row ] }.freeze
+      @required_optics = CtxParser::Immutable.copy(required_optics)
+      @required_optical_index = @required_optics.to_h { |row| [ row.values_at(:interface, :lane, :metric).freeze, true ] }.freeze
+      freeze
+    end
+
+    # 策略仅替换精确光通道及指标的阈值，不改变设备告警证据。
+    def optical_thresholds_for(record) = @optical_index[record.values_at(:interface, :lane, :metric)]
+    # 检查策略是否要求此接口提供光学诊断。
+    def required_optics?(record) = @required_optical_index.key?(record.values_at(:interface, :lane, :metric))
+
+    # 检查策略是否明确要求此资源或功能。
+    def required?(name)
+      return true if system.required?(name)
+      case name
+      when :interfaces then required_interfaces.any?
+      when :aggregation then required_members.any? || minimum_active_members.any?
+      when :bgp then expected_bgp.any?
+      when :ospf then expected_ospf.any?
+      when :optics then required_optics.any?
+      else false
+      end
+    end
+
+    private
+
+    # 校验非空文本，拒绝将含控制字符的值作为标识。
+    def text?(value) = value.is_a?(String) && !value.strip.empty? && !/[\x00-\x1f\x7f]/.match?(value)
+
+    # 校验策略选择器使用的资源名称是否有效且不重复。
+    def names!(values)
+      raise ArgumentError, "Interface names must be unique text" unless values.is_a?(Array) && values.all? { |value| text?(value) } && values.uniq == values
+      true
+    end
+
+    # 校验协议对等体身份及对应策略要求。
+    def peers!(values, fields)
+      unless values.is_a?(Array) && values.uniq == values && values.all? do |row|
+          row.is_a?(Hash) && row.keys.sort == fields.sort && row.all? { |key, value| text?(value) || key == :process_id && value.is_a?(Integer) && value >= 0 }
+        end
+        raise ArgumentError, "Expected peers require complete scoped identities"
+      end
+    end
+
+    # 校验光功率阈值及必需接口选择。
+    def optics!(values)
+      fields = %i[interface lane metric] + Observation::OPTICAL_THRESHOLDS
+      unless values.is_a?(Array) && values.all? { |row| row.is_a?(Hash) && (row.keys - fields).empty? }
+        raise ArgumentError, "Optical policies require scoped threshold records"
+      end
+      observation = Observation.new(name: :optics, status: :complete, records: values)
+      observation.records.each do |row|
+        thresholds = row.values_at(*Observation::OPTICAL_THRESHOLDS)
+        paired = row[:low_alarm] && row[:high_alarm] || row[:low_warning] && row[:high_warning]
+        unless paired && thresholds.compact.each_cons(2).all? { |low, high| low <= high }
+          raise ArgumentError, "Optical policies require an ordered complete alarm or warning pair"
+        end
+      end
+    end
+
+    # 必需测量必须有明确身份；仅配置阈值不表示要求资源存在。
+    def required_optics!(values)
+      fields = %i[interface lane metric]
+      unless values.is_a?(Array) && values.all? { |row| row.is_a?(Hash) && row.keys.sort == fields }
+        raise ArgumentError, "Required optics need exact interface, lane and metric identities"
+      end
+      Observation.new(name: :optics, status: :complete, records: values)
+    end
+  end
+end

data/lib/ctx_checker/radware_alteon/parsers/info_l2_lacp_dump.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module RadwareAlteon
+    module Parsers
+      # 端口模式表可证明 LACP 已禁用，但不能虚构活跃成员状态。
+      class InfoL2LacpDump < CtxChecker::Parsers::Base
+        HEADER = /\APort\s+lacp\s+adminkey\s+operkey\s+selected\s+prio\s+attached\s+trunk\s+Blocked\z/i
+        ROW = /\A(\d+)\s+(\S+)\s+\d+\s+\d+\s+([yn])\s+\d+\s+(\d+|--)\s+(\d+|--)\s+([yn])\z/i
+
+        private
+
+        # 活跃模式需要额外运行证据，不能由重复的 trunk 记录替代。
+        def parse_output(text, complete:)
+          issues, ports, header = [], [], false
+          clean(text).each_line do |raw|
+            line = raw.strip
+            next if line.empty? || /\A-+\z/.match?(line)
+
+            if HEADER.match?(line)
+              issues << { code: :duplicate_aggregation_header } if header
+              header = true
+            elsif header && line == "aggr"
+              next
+            elsif header && (match = ROW.match(line)) && match[1].to_i.positive?
+              port = "port#{Integer(match[1], 10)}"
+              issues << { code: :duplicate_lacp_port, interface: port } if ports.include?(port)
+              ports << port
+              if match[2].casecmp?("off")
+                unless match.captures[2..] == %w[n -- -- n]
+                  issues << { code: :inconsistent_lacp_disabled_state, interface: port }
+                end
+              else
+                issues << { code: :lacp_operational_evidence_unavailable, interface: port }
+              end
+            else
+              issues << { code: :unrecognized_lacp_line }
+            end
+          end
+          issues << { code: :lacp_port_records_missing } if header && ports.empty?
+          build_result([], complete: complete, recognized: header, issues: issues)
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/radware_alteon/parsers/info_l2_trunk.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module RadwareAlteon
+    module Parsers
+      # trunk 成员关系与 STP 转发状态不能独立证明链路状态。
+      class InfoL2Trunk < CtxChecker::Parsers::Base
+        GROUP = /\ATrunk group (\d+), bw contract \d+, name:.*?, port state:\z/i
+        MEMBER = /\A(\d+):\s+STG\s+\d+\s+(\S+)\z/i
+
+        private
+
+        # 将成员限定在其所属 trunk 中，明确保留不完整聚合组。
+        def parse_output(text, complete:)
+          rows, issues, groups, current = [], [], [], nil
+          clean(text).each_line do |raw|
+            line = raw.strip
+            next if line.empty? || /\A-+\z/.match?(line)
+
+            if (match = GROUP.match(line)) && match[1].to_i.positive?
+              current = "trunk#{Integer(match[1], 10)}"
+              issues << { code: :duplicate_aggregation_header, group: current } if groups.include?(current)
+              groups << current
+            elsif current && (match = MEMBER.match(line)) && match[1].to_i.positive?
+              member = "port#{Integer(match[1], 10)}"
+              state = match[2].downcase
+              issues << { code: :aggregation_forwarding_state_unknown, group: current, interface: member } unless state == "forwarding"
+              rows << { group: current, member: member,
+                member_status: state == "forwarding" ? :active : :unknown, oper_status: :unknown }
+            else
+              current = nil
+              issues << { code: :unrecognized_aggregation_line }
+            end
+          end
+          (groups.uniq - rows.map { |row| row[:group] }).each do |group|
+            rows << { group: group, member: nil, member_status: :unknown, oper_status: :unknown }
+            issues << { code: :aggregation_members_unavailable, group: group }
+          end
+          build_result(rows, complete: complete, recognized: groups.any?, issues: issues, identity: %i[group member])
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/radware_alteon/parsers/info_l3_bgp_summary.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module RadwareAlteon
+    module Parsers
+      # 传统 BGP 表与 FRR BGP 表分别使用已验证的语法。
+      class InfoL3BgpSummary < CtxChecker::Parsers::Base
+        private
+
+        # 协议明确禁用不代表策略要求的对等体健康。
+        def parse_output(text, complete:)
+          lines = clean(text).lines.map(&:strip).reject(&:empty?)
+          disabled = lines == [ "BGP is disabled." ]
+          issues = [ { code: disabled ? :protocol_disabled : :unrecognized_bgp_output } ]
+          build_result([], complete: complete, recognized: disabled, issues: issues)
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/radware_alteon/parsers/info_l3_ip.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module RadwareAlteon
+    module Parsers
+      # IP 接口索引独立于 VLAN ID 和物理数据端口号。
+      class InfoL3Ip < CtxChecker::Parsers::Base
+        ROW = /\A(\d+):\s+IP4\s+(\S+)\s+(\S+)\s+([^,\s]+)\s*,\s*vlan\s+(\d+),\s*(\S+),\s*BFD\s+\S+\z/i
+
+        private
+
+        # 将接口行限定在明确章节内，排除带编号的网关记录。
+        def parse_output(text, complete:)
+          rows, issues, section = [], [], :preamble
+          header, interfaces, ipv6, closed = false, false, false, false
+          clean(text).each_line do |raw|
+            line = raw.strip
+            next if line.empty? || /\A-+\z/.match?(line)
+
+            if line.casecmp?("IP information:")
+              issues << { code: :duplicate_interface_header } if header
+              header = true
+            elsif /\A,?Interface information:\z/i.match?(line)
+              issues << { code: :duplicate_interface_header } if interfaces
+              interfaces = true
+              section = :interfaces
+            elsif line.casecmp?("IPv6 Link Local Address Information:")
+              ipv6 = true
+              section = :ipv6
+            elsif /\ADefault gateway information:/i.match?(line)
+              closed = section == :ipv6
+              section = :other
+            elsif section == :preamble && /\ARouter ID:/.match?(line) || section == :other
+              next
+            elsif section == :interfaces && (match = ROW.match(line)) && match[1].to_i.positive?
+              row = interface_record(match, issues)
+              rows << row if row
+            elsif section == :ipv6
+              issues << { code: :ipv6_interface_evidence_unavailable }
+            else
+              issues << { code: :unrecognized_interface_line }
+            end
+          end
+          issues << { code: :interface_section_incomplete } unless header && interfaces && ipv6 && closed
+          issues << { code: :interface_records_missing } if interfaces && rows.empty?
+          build_result(rows, complete: complete, recognized: header && interfaces, issues: issues, identity: [ :name ])
+        end
+
+        # 明确的 IP4 状态仅证明运行状态，不能推断未报告的线路协议状态。
+        def interface_record(match, issues)
+          name = "ipif#{Integer(match[1], 10)}"
+          unless match.captures[1, 3].all? { |value| IPAddr.new(value).ipv4? } && IPAddr.new("#{match[2]}/#{match[3]}")
+            issues << { code: :invalid_interface_address, interface: name }
+            return
+          end
+          state = match[6].downcase
+          issues << { code: :unknown_interface_state, interface: name } unless %w[up down].include?(state)
+          { name: name, kind: :svi, admin_status: :unknown,
+            oper_status: { "up" => :up, "down" => :down }.fetch(state, :unknown),
+            protocol_status: :unknown, protocol_applicable: true, parent: nil }
+        rescue IPAddr::InvalidAddressError, IPAddr::InvalidPrefixError
+          issues << { code: :invalid_interface_address, interface: name }
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/radware_alteon/parsers/info_l3_ospf_nbr.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module RadwareAlteon
+    module Parsers
+      # OSPF 正文为空不能推断邻居或进程覆盖完整。
+      class InfoL3OspfNbr < CtxChecker::Parsers::Base
+        private
+
+        # 在验证活跃 Alteon 邻居表前，保留明确禁用状态。
+        def parse_output(text, complete:)
+          lines = clean(text).lines.map(&:strip).reject(&:empty?)
+          disabled = lines == [ "OSPF is disabled." ]
+          issues = [ { code: disabled ? :protocol_disabled : :unrecognized_ospf_output } ]
+          build_result([], complete: complete, recognized: disabled, issues: issues)
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/radware_alteon/parsers/info_link.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module RadwareAlteon
+    module Parsers
+      # 运维修改端口别名时，物理端口号仍保持稳定。
+      class InfoLink < CtxChecker::Parsers::Base
+        HEADER = /\AAlias\s+Port\s+Speed\s+Duplex\s+Flow Ctrl\s+Link\z/i
+        ROW = /\A(\S+)\s+(\d+)\s+\S+\s+\S+\s+(?:yes|no)\*?\s+(?:yes|no)\*?\s+(\S+)\z/i
+
+        private
+
+        # 链路行缺失不能证明端口已禁用或健康。
+        def parse_output(text, complete:)
+          rows, issues, header = [], [], false
+          clean(text).each_line do |raw|
+            line = raw.strip
+            next if line.empty? || /\A[-\s]+\z/.match?(line)
+            next if /\A-+\s+-+\s+-+\s+-+\s+--TX---RX--\s+-+\z/.match?(line)
+            next if line == "* = value set by configuration; not autonegotiated."
+
+            if HEADER.match?(line)
+              issues << { code: :duplicate_interface_header } if header
+              header = true
+            elsif header && (match = ROW.match(line)) && match[2].to_i.positive?
+              name = "#{match[1].casecmp?("mgmt") ? "mgmt" : "port"}#{Integer(match[2], 10)}"
+              state = match[3].downcase
+              issues << { code: :unknown_interface_state, interface: name } unless %w[up down disabled].include?(state)
+              rows << { name: name, kind: :physical, admin_status: state == "disabled" ? :down : :unknown,
+                oper_status: { "up" => :up, "down" => :down, "disabled" => :down }.fetch(state, :unknown),
+                protocol_status: :unknown, protocol_applicable: nil }
+            else
+              issues << { code: :unrecognized_interface_line }
+            end
+          end
+          issues << { code: :interface_records_missing } if header && rows.empty?
+          build_result(rows, complete: complete, recognized: header, issues: issues, identity: [ :name ])
+        end
+      end
+    end
+  end
+end