ctx_checker 0.1.0

data/lib/ctx_checker/applicability.rb

@@ -0,0 +1,187 @@
+# frozen_string_literal: true
+
+require "digest"
+require "ctx_parser/document"
+require "ctx_parser/banner"
+require "ctx_parser/immutable"
+require_relative "parser_registry"
+
+module CtxChecker
+  # 配置证据可证明功能存在或缺失；运行回显为空不能证明任何一者。
+  class Applicability
+    DIMENSIONS = %i[aggregation bgp ospf].freeze
+    MAX_BYTES = 16 * 1024 * 1024
+    SUPPORTED_PLATFORMS = %w[h3c cisco_ios cisco_nxos].freeze
+    ROOT_PATTERNS = {
+      h3c: {
+        aggregation: /\A(?:interface\s+(?:Bridge-Aggregation|Route-Aggregation)\s*\d|link-aggregation\s+group\b)/i,
+        bgp: /\Abgp\b/i, ospf: /\Aospf(?:v3)?\b/i
+      },
+      cisco: {
+        aggregation: /\Ainterface\s+(?:Port-channel|Bundle-Ether)\s*\d/i,
+        bgp: /\Arouter\s+bgp\b/i, ospf: /\A(?:router\s+ospf(?:v3)?|ipv6\s+router\s+ospf)\b/i
+      }
+    }.transform_values { |patterns| patterns.transform_values(&:freeze).freeze }.freeze
+    INTERFACE_PATTERNS = {
+      h3c: { aggregation: /\A(?:port\s+link-aggregation\s+group|link-aggregation)\b/i,
+        ospf: /\A(?:ip\s+)?ospf(?:v3)?\b/i },
+      cisco: { aggregation: /\Achannel-group\b/i,
+        ospf: /\A(?:(?:ip|ipv6)\s+(?:router\s+)?ospf|ospfv3)\b/i }
+    }.transform_values { |patterns| patterns.transform_values(&:freeze).freeze }.freeze
+    VRF = /\A(?:vrf\s+(?:definition|context)\s+|ip\s+(?:vrf|vpn-instance)\s+)/i
+    ADDRESS_FAMILY = /\A(?:address-family|ipv[46]-family)\b/i
+    HINTS = { aggregation: /\b(?:link-aggregation|bridge-aggregation|route-aggregation|channel-group|port-channel|bundle-ether|lacp)\b/i,
+      bgp: /\bbgp\b/i, ospf: /\bospf(?:v3|6)?\b/i }.freeze
+
+    attr_reader :platform, :evidence
+
+    # 仅使用可追溯的配置证据推断可选功能是否适用。
+    def self.from_configuration(platform:, text:, complete: false, reference: nil)
+      new(platform: platform, text: text, complete: complete, reference: reference)
+    end
+
+    # 冻结配置推导的可选功能状态及其证据。
+    def initialize(platform:, text:, complete:, reference: nil)
+      raise ArgumentError, "Configuration must be text" unless text.is_a?(String)
+      raise ArgumentError, "Completeness must be boolean" unless [ true, false ].include?(complete)
+      unless (platform.is_a?(String) || platform.is_a?(Symbol)) && !platform.to_s.strip.empty? && !/[\x00-\x1f\x7f]/.match?(platform.to_s)
+        raise ArgumentError, "Platform must be text"
+      end
+      unless reference.nil? || reference.is_a?(String) && !reference.strip.empty? && !/[\x00-\x1f\x7f]/.match?(reference)
+        raise ArgumentError, "Configuration reference must be text"
+      end
+
+      @platform = canonical_platform(platform).freeze
+      source = { sha256: Digest::SHA256.hexdigest(text), bytes: text.bytesize }
+      source[:reference] = reference unless reference.nil?
+      @evidence = CtxParser::Immutable.copy([ source ])
+      @states = CtxParser::Immutable.copy(configuration_states(text, complete: complete))
+      freeze
+    end
+
+    # 返回功能已配置、未配置或未知的证据状态。
+    def state(name) = @states.fetch(name, :unknown)
+    # 检查证据是否明确证明可选功能未配置。
+    def not_applicable?(name) = state(name) == :not_configured
+    # 展示对象身份与状态，避免泄露原始回显或凭据。
+    def inspect = "#<#{self.class} platform=#{platform} states=#{@states}>"
+    alias to_s inspect
+
+    private
+
+    # 不支持的平台保留扩展入口，不继承其他厂商的语法判断。
+    def canonical_platform(value)
+      ParserRegistry.canonical(value)
+    rescue ArgumentError
+      value.to_s.strip.downcase
+    end
+
+    # 推导可选功能已配置、未配置或未知的状态。
+    def configuration_states(text, complete:)
+      unknown = DIMENSIONS.to_h { |name| [ name, :unknown ] }
+      return unknown unless SUPPORTED_PLATFORMS.include?(platform)
+
+      source = CtxParser::Input.text(text, encoding: :transcode, newlines: :lf, max_bytes: MAX_BYTES)
+      return unknown if /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.match?(source)
+
+      document = Document.new(source)
+      return unknown if document.issues.any?
+
+      roots = document.roots
+      identity = platform == "h3c" ? /\Asysname\s+\S+\z/i : /\Ahostname\s+\S+\z/i
+      recognized = roots.any? { |entry| identity.match?(entry.text) }
+      family = platform == "h3c" ? :h3c : :cisco
+      DIMENSIONS.to_h do |name|
+        present, unresolved = feature_state(roots, family, name)
+        value = if present
+          :configured
+        elsif complete && recognized && !unresolved
+          :not_configured
+        else
+          :unknown
+        end
+        [ name, value ]
+      end
+    rescue ArgumentError, EncodingError
+      unknown
+    end
+
+    # 仅在已声明的配置所属作用域中识别嵌套功能语句。
+    def feature_state(roots, family, name)
+      configured, unresolved = false, false
+      roots.each do |entry|
+        configured ||= ROOT_PATTERNS.fetch(family).fetch(name).match?(entry.text)
+        if /\Ainterface\s+/i.match?(entry.text)
+          pattern = INTERFACE_PATTERNS.fetch(family)[name]
+          configured ||= pattern && entry.children.any? { |child| pattern.match?(child.text) }
+          unresolved ||= feature_hint?(entry.text, name) || entry.children.any? { |child| feature_hint?(child.text, name) }
+        elsif VRF.match?(entry.text)
+          present, ambiguous = vrf_feature_state(entry.children, family, name)
+          configured ||= present
+          unresolved ||= ambiguous
+        elsif HINTS.fetch(name).match?(entry.text) && !unrelated_setting?(entry.text)
+          unresolved = true
+        end
+      end
+      [ configured, unresolved ]
+    end
+
+    # 结合全局与 VRF 配置作用域判断协议是否适用。
+    def vrf_feature_state(children, family, name)
+      pending = children.dup
+      unresolved = false
+      until pending.empty?
+        entry = pending.pop
+        return [ true, unresolved ] if ROOT_PATTERNS.fetch(family).fetch(name).match?(entry.text)
+        unresolved ||= feature_hint?(entry.text, name)
+        pending.concat(entry.children) if ADDRESS_FAMILY.match?(entry.text)
+      end
+      [ false, unresolved ]
+    end
+
+    # 识别不能安全推断为功能缺失的声明。
+    def feature_hint?(text, name) = HINTS.fetch(name).match?(text) && !unrelated_setting?(text)
+
+    # 功能开关或描述值本身不能证明已配置运行实例。
+    def unrelated_setting?(text)
+      text.match?(/\A(?:no |undo )?(?:feature\s+\S+|logging\s+level\s+\S+\s+\d+|description\s+.*|hostname\s+\S+|sysname\s+\S+)\z/i)
+    end
+
+    # 领域语法负责注释、终端错误和横幅处理；缩进结构继续复用公共实现。
+    class Document < CtxParser::Document
+      protected
+
+      # 区分配置结构行与引号、横幅中的文本内容。
+      def classify(line)
+        text = line.text
+        return :ignored if text.empty?
+
+        @banner ||= CtxParser::Banner.new
+        # Comware 的可选关键字本身不能作为横幅分隔符。
+        if !@banner.open? && /\Aheader\s+\S+\s+information\s*\z/i.match?(text)
+          issues << { code: :invalid_banner, line: line.number }
+          return :ignored
+        end
+        return :ignored if @banner.consume(text)
+        if /\A(?:banner|header)\b/i.match?(text)
+          issues << { code: :invalid_banner, line: line.number }
+          return :ignored
+        end
+        if /--\s*More\s*--|Press (?:any key|ENTER|<SPACE>)|\A%\s*(?:Invalid|Incomplete|Ambiguous|Error)\b|\A(?:%\s*)?(?:Error:|Invalid (?:command|input|syntax)|Incomplete command|Ambiguous command|Permission denied|Insufficient privilege|Unrecognized command|Unknown command|command not (?:found|supported)|syntax error|\^-+\s*(?:unrecognized keyword|incomplete command|ambiguous command|error\b))/i.match?(text)
+          issues << { code: :incomplete_configuration, line: line.number }
+          return :ignored
+        end
+        return :boundary if text.start_with?("!", "#") || %w[end return].include?(text)
+        return :ignored if /\A(?:Building configuration|Current configuration)/i.match?(text)
+
+        :entry
+      end
+
+      # 汇总已解析记录，并报告未解决或不完整的来源状态。
+      def finish
+        issues << { code: :incomplete_banner } if @banner&.open?
+      end
+    end
+    private_constant :Document
+  end
+end

data/lib/ctx_checker/checks/aggregation.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module CtxChecker
+  module Checks
+    # 逐个评估成员；即使聚合接口仍为 up，也保留成员故障。
+    class Aggregation < Base
+      private
+
+      # 按策略评估资源，同时保留测量值缺失的状态。
+      def assess(record)
+        record = resolved_state(record)
+        if record[:member].nil?
+          return finding(record[:oper_status] == :down ? :fail : :unknown, :aggregation_members_unavailable,
+            entity: record[:group], actual: record, severity: :warning)
+        end
+        status, reason = if record[:oper_status] == :down || member_down?(record) || %i[down suspended unselected].include?(record[:member_status])
+          [ :fail, :aggregation_member_down ]
+        elsif %i[active standby].include?(record[:member_status]) && record[:oper_status] == :up
+          [ :pass, record[:member_status] == :standby ? :aggregation_standby : :aggregation_active ]
+        else
+          [ :unknown, :aggregation_state_unavailable ]
+        end
+        finding(status, reason, entity: record.slice(:group, :member), actual: record, severity: :warning)
+      end
+
+      # 为策略要求但未观察到的资源生成证据缺失结果。
+      def missing
+        rows = @observation.records.map { |record| resolved_state(record) }.group_by { |record| record[:group] }
+        results = @policy.required_members.flat_map do |group, members|
+          group_rows = rows.fetch(group, [])
+          status = group_rows.any? { |row| row[:member].nil? } ? :unknown : missing_status
+          (members - group_rows.map { |row| row[:member] }).map do |member|
+            finding(status, :required_member_missing, entity: { group: group, member: member }, severity: :critical)
+          end
+        end
+        @policy.minimum_active_members.each do |group, minimum|
+          group_rows = rows.fetch(group, [])
+          members = group_rows.reject { |row| row[:member].nil? }
+          active = members.count { |row| row[:member_status] == :active && row[:oper_status] == :up && !member_down?(row) }
+          known = group_rows.none? { |row| row[:member].nil? } && members.all? { |row| row[:member_status] && row[:member_status] != :unknown && %i[up down].include?(row[:oper_status]) }
+          status = if active >= minimum
+            :pass
+          elsif @observation.complete? && known
+            :fail
+          else
+            :unknown
+          end
+          results << finding(status, :aggregation_capacity, entity: group, actual: active, expected: minimum, severity: :critical)
+        end
+        results
+      end
+
+      # Comware 成员表不提供链路状态；仅关联完整的父级接口证据。
+      def resolved_state(record)
+        return record if %i[up down].include?(record[:oper_status])
+
+        parent = interface(record[:group])
+        return record unless parent && parent[:kind] == :aggregate &&
+          record_complete?(parent, @snapshot.observation(:interfaces))
+
+        record.merge(oper_status: parent[:oper_status])
+      end
+
+      # 成员处于选中状态，不能覆盖已确认的物理链路故障。
+      def member_down?(record)
+        physical = interface(record[:member])
+        physical && record_complete?(physical, @snapshot.observation(:interfaces)) && physical[:oper_status] == :down
+      end
+    end
+  end
+end

data/lib/ctx_checker/checks/alarms.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module CtxChecker
+  module Checks
+    # 当前告警独立于历史事件日志进行评估。
+    class Alarms < Base
+      private
+
+      # 按策略评估资源，同时保留测量值缺失的状态。
+      def assess(record)
+        entity = record.slice(:component, :alarm_id)
+        active = record[:active]
+        if active.nil? || active == false && record[:count]&.positive? || active == true && record[:count] == 0
+          return finding(:unknown, :alarm_state_unavailable, entity: entity, actual: record)
+        end
+        return finding(:pass, :alarm_clear, entity: entity, actual: record) unless active
+        return finding(:not_applicable, :informational_alarm, entity: entity, actual: record) if record[:severity] == :info
+
+        finding(:fail, :active_alarm, entity: entity, actual: record, severity: record[:severity] == :critical ? :critical : :warning)
+      end
+    end
+  end
+end

data/lib/ctx_checker/checks/base.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require_relative "../finding"
+
+module CtxChecker
+  module Checks
+    # 共用证据边界；厂商特定文本不进入评估规则。
+    class Base
+      # 绑定当前维度评估使用的快照与策略。
+      def initialize(snapshot:, policy:, previous: nil)
+        @snapshot, @policy, @previous = snapshot, policy, previous
+      end
+
+      # 评估已知记录，分别表达必需、缺失与不完整证据。
+      def call(observation)
+        @observation = observation
+        if observation.status == :not_applicable
+          return [ finding(:fail, :required_feature_not_configured, severity: :critical) ] if @policy.required?(observation.name)
+
+          return [ finding(:not_applicable, :feature_not_configured) ]
+        end
+        if observation.status == :not_requested && !@policy.required?(observation.name)
+          return [ finding(:not_applicable, :not_requested) ]
+        end
+        results = observation.records.flat_map do |record|
+          @current_record = record
+          assess(record)
+        ensure
+          @current_record = nil
+        end
+        results.concat(missing)
+        results << finding(:unknown, observation.complete? ? :empty_evidence : observation.status) if results.empty?
+        results << finding(:unknown, :incomplete_evidence) unless observation.complete? || results.any? { |row| row.status == :unknown }
+        results
+      end
+
+      private
+
+      # 局部采集仍保留已知故障；判定成功则要求完整的支持证据。
+      def finding(status, reason, entity: nil, actual: nil, expected: nil, severity: :info, suffix: nil)
+        if status == :pass && !record_complete?(@current_record, @observation)
+          status, reason = :unknown, :incomplete_evidence
+        end
+        Finding.new(id: [ @observation.name, suffix || reason ].join("."), dimension: @observation.name,
+          entity: entity, status: status, reason: reason, actual: actual, expected: expected, severity: severity)
+      end
+
+      # 为策略要求但未观察到的资源生成证据缺失结果。
+      def missing = []
+      # 为不可用证据选择结果状态，不据此声明健康。
+      def missing_status = @observation.complete? ? :fail : :unknown
+      # 仅在需要关联接口状态的检查中建立接口索引。
+      def interface(name)
+        @interfaces ||= @snapshot.observation(:interfaces).records.to_h { |row| [ row[:name], row ] }
+        @interfaces[name]
+      end
+
+      # 同级查询失败不能使其他来源的完整测量失效。
+      def record_complete?(record, observation)
+        return false if record && record[:source_complete] == false
+
+        observation.complete? || observation.status == :partial && record && record[:source_complete] == true
+      end
+    end
+  end
+end

data/lib/ctx_checker/checks/clock.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module CtxChecker
+  module Checks
+    # 依据明确的 UTC 偏移，以命令采集时间计算设备时钟偏差。
+    class Clock < Base
+      private
+
+      # 按策略评估资源，同时保留测量值缺失的状态。
+      def assess(record)
+        entity = { component: record[:component] }
+        results = []
+        if record[:synchronized] == false
+          results << finding(:fail, :clock_unsynchronized, entity: entity, severity: :warning)
+        end
+        unless record[:time]
+          return results + [ finding(:unknown, :clock_time_unavailable, entity: entity) ]
+        end
+        observed_at = @observation.observed_at || @snapshot.observed_at
+        skew = (Time.iso8601(record[:time]) - observed_at).abs
+        limit = @policy.system.max_clock_skew_seconds
+        results << finding(skew > limit ? :fail : :pass, :clock_skew, entity: entity,
+          actual: { time: record[:time], skew_seconds: skew }, expected: { maximum_seconds: limit }, severity: skew > limit ? :warning : :info)
+        results
+      end
+    end
+  end
+end

data/lib/ctx_checker/checks/counters.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module CtxChecker
+  module Checks
+    # 区分可能重叠的累计指标；仅在采样连续性得到证明时计算增量。
+    class Counters < Base
+      # 按稳定计数器身份索引前次采样，使比较保持线性复杂度。
+      def initialize(**options)
+        super
+        @previous_counters = @previous&.observation(dimension)
+        @previous_records = @previous_counters&.records&.to_h { |row| [ row.values_at(*identity_fields), row ] } || {}
+      end
+
+      private
+
+      # 按策略评估资源，同时保留测量值缺失的状态。
+      def assess(record)
+        entity = record.slice(*identity_fields)
+        value = record[:value]
+        return finding(:unknown, :counter_unavailable, entity: entity) if value.nil?
+        previous = @previous_counters
+        prior = @previous_records[record.values_at(*identity_fields)]
+        if (reason = packet_semantics_reason(record, prior))
+          return finding(:unknown, reason, entity: entity, actual: record.slice(:value, :unit, :scope))
+        end
+        unless prior
+          # 单次非零累计值无法证明当前窗口新增错误，等待可比较的前次采样。
+          return finding(value.zero? ? :pass : :unknown, value.zero? ? :zero_cumulative_counter : :cumulative_errors,
+            entity: entity, actual: value, severity: value.zero? ? :info : :warning)
+        end
+        interval = sample_time(record, @observation, @snapshot) - sample_time(prior, previous, @previous)
+        # 先验证时间与重置标记；数值下降可能是清零或重启，不能按负增量计算。
+        reason = if interval <= 0
+          :counter_sample_time_invalid
+        elsif record[:discontinuity].nil? || prior[:discontinuity].nil?
+          :counter_continuity_unconfirmed
+        elsif record[:discontinuity] != prior[:discontinuity] || prior[:value].nil? || value < prior[:value]
+          :counter_discontinuity
+        end
+        return finding(:unknown, reason, entity: entity, actual: value, severity: :warning) if reason
+
+        delta = value - prior[:value]
+        limit = limit_for(record)
+        # 超限是已观察故障；未超限仍需前后来源完整才能证明通过。
+        if delta <= limit && (!record_complete?(prior, previous) || !record_complete?(record, @observation))
+          return finding(:unknown, :counter_evidence_incomplete, entity: entity, actual: { delta: delta, seconds: interval })
+        end
+        finding(delta > limit ? :fail : :pass, :counter_delta, entity: entity,
+          actual: delta_measurement(value, delta, interval), expected: { maximum_delta: limit }, severity: :warning)
+      end
+
+      # 选择当前评估负责的观测维度。
+      def dimension = :counters
+      # 返回用于跨采样匹配记录的稳定身份字段。
+      def identity_fields = Observation::IDENTITIES.fetch(dimension)
+      # 优先使用资源专用阈值，再回退到策略默认值。
+      def limit_for(record) = @policy.counter_limits.fetch(record[:metric], 0)
+      # 将已计算增量与采样间隔组织为报告测量值。
+      def delta_measurement(_value, delta, interval) = { delta: delta, seconds: interval }
+      # 解析速率或增量分析所需的采样时间。
+      def sample_time(record, observation, snapshot) = record[:sampled_at] ? Time.iso8601(record[:sampled_at]) : observation.observed_at || snapshot.observed_at
+
+      # 包数阈值不能比较字节、事件计数，也不能比较测量语义已变化的采样。
+      def packet_semantics_reason(record, prior)
+        return unless dimension == :counters
+        return :counter_unit_unknown if record[:unit] == :unknown
+        return :counter_unit_not_packets unless record[:unit].nil? || record[:unit] == :packets
+        return :counter_scope_unknown if record[:scope] == :unknown
+        return unless prior
+        return :counter_unit_changed if record[:unit] != prior[:unit]
+        :counter_scope_changed if record[:scope] != prior[:scope]
+      end
+    end
+  end
+end

data/lib/ctx_checker/checks/device_counters.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require_relative "counters"
+
+module CtxChecker
+  module Checks
+    # 区分设备级指标；策略主动丢弃仅在运维明确配置阈值时评估。
+    class DeviceCounters < Counters
+      private
+
+      # 按策略评估资源，同时保留测量值缺失的状态。
+      def assess(record)
+        unless @policy.system.device_counter_limits.key?(record[:metric])
+          case record[:category]
+          when :policy, :informational
+            return finding(:not_applicable, :device_counter_context, entity: record.slice(*identity_fields), actual: record)
+          when nil, :unknown
+            return finding(:unknown, :counter_category_unavailable, entity: record.slice(*identity_fields), actual: record)
+          end
+        end
+        super
+      end
+
+      # 选择当前评估负责的观测维度。
+      def dimension = :device_counters
+      # 优先使用资源专用阈值，再回退到策略默认值。
+      def limit_for(record) = @policy.system.device_counter_limits.fetch(record[:metric], 0)
+      # 组织累计量、已验证增量及采样间隔，并计算每秒速率。
+      def delta_measurement(value, delta, interval) = { cumulative: value, delta: delta, seconds: interval, per_second: delta / interval }
+    end
+  end
+end

data/lib/ctx_checker/checks/hardware.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module CtxChecker
+  module Checks
+    # 区分可选空槽位、组件故障与策略明确要求的组件。
+    class Hardware < Base
+      private
+
+      # 按策略评估资源，同时保留测量值缺失的状态。
+      def assess(record)
+        entity = record.slice(:component, :kind)
+        state = record[:status]
+        if record[:watts] && record[:capacity_watts] && record[:watts] > record[:capacity_watts]
+          return [ finding(:fail, :power_capacity_exceeded, entity: entity,
+            actual: record[:watts], expected: { maximum_watts: record[:capacity_watts] }, severity: :critical),
+            finding(:unknown, :power_measurements_inconsistent, entity: entity, actual: record) ]
+        end
+        if %i[warning critical failed].include?(state)
+          return finding(:fail, :hardware_fault, entity: entity, actual: record, severity: state == :warning ? :warning : :critical)
+        end
+        if record[:present] == false || state == :absent
+          if state == :ok || record[:present] == true || record[:watts]&.positive?
+            return finding(:unknown, :hardware_presence_inconsistent, entity: entity, actual: record)
+          end
+          required = required_components.include?(record[:component])
+          return finding(required ? :fail : :not_applicable, :hardware_absent, entity: entity,
+            actual: record, severity: required ? :critical : :info)
+        end
+        finding(state == :ok ? :pass : :unknown, :hardware_state, entity: entity, actual: record)
+      end
+
+      # 解析策略明确要求的环境组件。
+      def required_components = @policy.system.required_components.fetch(@observation.name, [])
+
+      # 为策略要求但未观察到的资源生成证据缺失结果。
+      def missing
+        (required_components - @observation.records.map { |row| row[:component] }).map do |component|
+          finding(missing_status, :required_component_missing, entity: { component: component }, severity: :critical)
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/checks/interfaces.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module CtxChecker
+  module Checks
+    # 评估物理与逻辑链路，同时尊重明确的管理关闭意图。
+    class Interfaces < Base
+      private
+
+      # 按策略评估资源，同时保留测量值缺失的状态。
+      def assess(record)
+        name = record[:name]
+        required = @policy.required_interfaces.include?(name)
+        status, reason = if record[:admin_status] == :down && !required
+          [ :not_applicable, :administratively_down ]
+        elsif record[:oper_status] == :down || record[:protocol_status] == :down && record[:protocol_applicable] != false || required && record[:admin_status] == :down
+          [ :fail, :interface_down ]
+        elsif record[:oper_status] == :up && (record[:protocol_applicable] == false || record[:protocol_status] == :up || %i[physical aggregate].include?(record[:kind]))
+          [ :pass, :interface_up ]
+        else
+          [ :unknown, :interface_state_unavailable ]
+        end
+        finding(status, reason, entity: name, actual: record, severity: required ? :critical : :warning)
+      end
+
+      # 为策略要求但未观察到的资源生成证据缺失结果。
+      def missing
+        (@policy.required_interfaces - @observation.records.map { |row| row[:name] }).map do |name|
+          finding(missing_status, :required_interface_missing, entity: name, severity: :critical)
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/checks/ntp.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module CtxChecker
+  module Checks
+    # 设备可达或已配置对等体不能代替系统同步证据。
+    class Ntp < Base
+      private
+
+      # 按策略评估资源，同时保留测量值缺失的状态。
+      def assess(record)
+        entity = { component: record[:component] }
+        return peer_attempt(record, entity) unless record[:component] == "system"
+
+        unsynchronized = record[:synchronized] == false || record[:stratum] == 16 || record[:leap] == 3
+        status = unsynchronized ? :fail : record[:synchronized] == true && record[:stratum] != 0 ? :pass : :unknown
+        results = [ finding(status,
+          :ntp_synchronization, entity: entity, actual: record, severity: unsynchronized ? :warning : :info) ]
+        if record[:synchronized] == true && (unsynchronized || record[:stratum] == 0)
+          results << finding(:unknown, :ntp_state_inconsistent, entity: entity)
+        end
+        if record[:offset_ms]
+          exceeded = record[:offset_ms].abs > @policy.system.max_ntp_offset_ms
+          results << finding(exceeded ? :fail : :pass, :ntp_offset, entity: entity, actual: record[:offset_ms],
+            expected: { maximum_absolute_ms: @policy.system.max_ntp_offset_ms }, severity: exceeded ? :warning : :info)
+        end
+        results
+      end
+
+      # 可独立报告对等体尝试失败，但不能据此断言系统已失去同步。
+      def peer_attempt(record, entity)
+        if record[:last_sync_status] == :failed
+          finding(:fail, :ntp_last_sync_failed, entity: entity, actual: record, severity: :warning)
+        else
+          finding(:not_applicable, :ntp_peer_context, entity: entity, actual: record)
+        end
+      end
+
+      # 为策略要求但未观察到的资源生成证据缺失结果。
+      def missing
+        return [] if @observation.records.any? { |row| row[:component] == "system" }
+        [ finding(:unknown, :ntp_system_state_unavailable) ]
+      end
+    end
+  end
+end