ctx_checker 0.1.0

data/lib/ctx_checker/cisco_nxos/parsers/show_ip_traffic.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module CiscoNxos
+    module Parsers
+      # NX-OS 的 IPv4 软件协议栈标签不同于 IOS，需显式保留作用域。
+      class ShowIpTraffic < CtxChecker::Parsers::Base
+        METRICS = {
+          "bad checksum" => [ "checksum_errors", :error ], "packet too small" => [ "packet_too_small", :error ],
+          "bad version" => [ "bad_version", :error ], "bad header length" => [ "bad_header_length", :error ],
+          "bad packet length" => [ "bad_packet_length", :error ], "bad destination" => [ "bad_destination", :error ],
+          "bad ttl" => [ "bad_ttl", :error ], "could not forward" => [ "could_not_forward", :discard ],
+          "no buffer dropped" => [ "no_buffer", :discard ], "bad encapsulation" => [ "encapsulation_failed", :discard ],
+          "no route" => [ "no_route", :discard ], "non-existent protocol" => [ "unknown_protocol", :error ]
+        }.freeze
+        OPTIONAL_METRICS = {
+          "stateful restart recovery" => [ "stateful_restart_recovery", :informational ],
+          "mbuf pull up fail" => [ "mbuf_pullup_failed", :discard ],
+          "bad options" => [ "bad_options", :error ], "bad context id" => [ "bad_context_id", :error ],
+          "bad gw mac" => [ "bad_gateway_mac", :error ], "rpf drops" => [ "rpf_drops", :policy ],
+          "vinci migration packets" => [ "vinci_migration_packets", :informational ],
+          "total packet snooped" => [ "packets_snooped", :informational ],
+          "total packet on down svi" => [ "packets_on_down_svi", :informational ],
+          "ingress option processing failed" => [ "ingress_option_processing_failed", :discard ],
+          "nat inside drop" => [ "nat_inside_drops", :discard ], "nat outside drop" => [ "nat_outside_drops", :discard ],
+          "ingress mforward failed" => [ "ingress_mforward_failed", :discard ],
+          "ingress lisp drop" => [ "ingress_lisp_drops", :discard ],
+          "ingress lisp decap drop" => [ "ingress_lisp_decap_drops", :discard ],
+          "ingress lisp encap drop" => [ "ingress_lisp_encap_drops", :discard ],
+          "ingress lisp encap" => [ "ingress_lisp_encapsulated", :informational ],
+          "ingress mfwd copy drop" => [ "ingress_mfwd_copy_drops", :discard ],
+          "ingress ra/reass drop" => [ "ingress_ra_reass_drops", :discard ],
+          "ingress icmp redirect processing drop" => [ "ingress_icmp_redirect_processing_drops", :discard ],
+          "ingress drop (ifmgr init)" => [ "ingress_ifmgr_init_drops", :discard ],
+          "ingress drop (invalid filter)" => [ "ingress_invalid_filter_drops", :discard ],
+          "ingress drop (invalid l2 msg)" => [ "ingress_invalid_l2_message_drops", :discard ]
+        }.freeze
+        ERROR_METRICS = METRICS.merge(OPTIONAL_METRICS).freeze
+        ERROR_LABELS = Regexp.union((ERROR_METRICS.keys - [ "bad gw mac" ]).sort_by { |label| -label.size })
+        ERROR_CELL = /\G\s*(?:,\s*)?(?:(#{ERROR_LABELS.source})\s*:\s*|(bad gw mac)\s+)(\d+)(?=\s|,|\z)/i
+        ACL_METRICS = { "ingress" => "acl_ingress_drops", "egress" => "acl_egress_drops",
+          "directed broadcast" => "acl_directed_broadcast_drops" }.freeze
+        FRAGMENT_METRICS = {
+          "fragments dropped" => [ "fragments_dropped", :discard ],
+          "fragments timed out" => [ "fragments_timed_out", :discard ]
+        }.freeze
+        FRAGMENT_CONTEXT = [ "fragments received", "fragments sent", "fragments created", "packets with df", "packets reassembled" ].freeze
+
+        private
+
+        # 解析 show ip traffic，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          records, issues = [], []
+          recognized = false
+          section = nil
+          fragment_sections, acl_sections = 0, 0
+          ipv4 = false
+          clean(text).each_line.with_index(1) do |source, number|
+            line = source.strip
+            next if line.empty?
+            if /\AIP Software Processed Traffic Statistics\z/i.match?(line)
+              ipv4 = recognized = true
+              section = nil
+            elsif /\A(?:ICMP|TCP|UDP|IPv6)\s/i.match?(line)
+              ipv4 = false
+              section = nil
+            elsif ipv4 && /\AErrors:\z/i.match?(line)
+              section = :errors
+            elsif ipv4 && /\AFragmentation\/reassembly:\z/i.match?(line)
+              section = :fragments
+              fragment_sections += 1
+            elsif ipv4 && /\AACL Filter Drops\s*:\z/i.match?(line)
+              section = :acl
+              acl_sections += 1
+            elsif ipv4 && /\AFragments created per protocol\z/i.match?(line)
+              section = :fragment_protocols
+            elsif /\A(?:Multicast|IP output|IP input|Rcvd|Sent|Input|Output|Statistics last reset)(?:\s|:)/i.match?(line)
+              section = nil
+            elsif section == :errors
+              parse_error_counters(line, number, records, issues)
+            elsif section == :acl
+              parse_acl_counter(line, number, records, issues)
+            elsif section == :fragment_protocols
+              issues << { code: :unparsed_counter, line: number } unless /\A\d+\s*:\s*\d+\z/.match?(line)
+            elsif section == :fragments
+              line.delete_suffix(",").split(/,\s*/).each do |cell|
+                match = /\A([^:]+):\s*(\d+)\z/.match(cell)
+                label = match && match[1].downcase
+                definition = FRAGMENT_METRICS[label]
+                if definition
+                  records << counter(definition, match[2])
+                elsif !FRAGMENT_CONTEXT.include?(label)
+                  issues << { code: :unparsed_counter, line: number }
+                end
+              end
+            end
+          end
+          missing = METRICS.values.map(&:first) - records.map { |record| record[:metric] }
+          issues << { code: :counter_fields_missing, count: missing.size } if recognized && missing.any?
+          if fragment_sections.positive?
+            missing = FRAGMENT_METRICS.values.map(&:first) - records.map { |record| record[:metric] }
+            issues << { code: :fragment_counter_fields_missing, count: missing.size } if missing.any?
+            issues << { code: :duplicate_counter_section, scope: "fragmentation" } if fragment_sections > 1
+          end
+          if acl_sections.positive?
+            missing = ACL_METRICS.values - records.map { |record| record[:metric] }
+            issues << { code: :acl_counter_fields_missing, count: missing.size } if missing.any?
+            issues << { code: :duplicate_counter_section, scope: "acl" } if acl_sections > 1
+          end
+          build_result(records, complete: complete, recognized: recognized, issues: issues, identity: %i[component metric])
+        end
+
+        # NX-OS 的部分相邻错误字段不以逗号分隔，且某个标签可能重复出现。
+        def parse_error_counters(line, number, records, issues)
+          position = 0
+          until /\A\s*,?\s*\z/.match?(line[position..])
+            match = ERROR_CELL.match(line, position)
+            unless match
+              issues << { code: :unparsed_counter, line: number }
+              break
+            end
+            definition = ERROR_METRICS.fetch((match[1] || match[2]).downcase)
+            record = counter(definition, match[3])
+            # 仅允许此类已知重复 NX-OS 展示字段合并相同值。
+            repeated = record[:metric] == "ingress_option_processing_failed" && records.include?(record)
+            records << record unless repeated
+            position = match.end(0)
+          end
+        end
+
+        # ACL 过滤属于主动策略，不能作为通用硬件错误总数。
+        def parse_acl_counter(line, number, records, issues)
+          match = /\A(Ingress|Egress|Directed Broadcast)\s+-\s+(\d+)\z/i.match(line)
+          if match
+            records << counter([ ACL_METRICS.fetch(match[1].downcase), :policy ], match[2])
+          else
+            issues << { code: :unparsed_counter, line: number }
+          end
+        end
+
+        # 提取支持的累计计数器，不强制转换未知值。
+        def counter(definition, value)
+          { component: "ipv4/control_plane", metric: definition[0], category: definition[1],
+            value: Integer(value, 10), discontinuity: nil }
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/cisco_nxos/parsers/show_ntp_peer_status.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+require "ipaddr"
+
+module CtxChecker
+  module CiscoNxos
+    module Parsers
+      # 所选 NTP 对等体用于证明同步，与报告 CFS 的 NX-OS show ntp status 区分。
+      class ShowNtpPeerStatus < CtxChecker::Parsers::Base
+        private
+
+        # 解析 show ntp peer status，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          peers, issues, totals = [], [], []
+          vrf_column = nil
+          each_ntp_line(clean(text), issues) do |line, number|
+            next if line.empty? || /\A-+\z/.match?(line)
+
+            if (match = /\ATotal peers\s*:\s*(\d+)\z/i.match(line))
+              totals << Integer(match[1], 10)
+            elsif /\A(?:\*\s*-\s*selected for sync|\-\s*-\s*peer mode)/i.match?(line)
+              next
+            elsif (match = /\Aremote\s+local\s+st\s+poll\s+reach\s+delay(?:\s+(vrf))?\z/i.match(line))
+              issues << { code: :duplicate_ntp_header, line: number } unless vrf_column.nil?
+              vrf_column = !match[1].nil?
+            else
+              peer = peer_row(line, number, vrf_column, issues)
+              peers << peer if peer
+            end
+          end
+          issues << { code: :ntp_peer_count_mismatch } unless totals.one? && totals.first == peers.size
+          issues << { code: :duplicate_identity } unless peers.map { |peer| peer.values_at(:peer, :vrf) }.uniq.size == peers.size
+          selected = peers.select { |peer| peer[:selected] }
+          issues << { code: :conflicting_ntp_selection } if selected.size > 1
+          peer = selected.one? ? selected.first : nil
+          issues << { code: :invalid_ntp_selection } if peer && (!peer[:reachable] || !peer[:stratum].between?(1, 14))
+          issues << { code: :local_ntp_reference } if peer && peer[:peer] == "127.127.1.0"
+          recognized = totals.any? || peers.any?
+          synchronized = issues.empty? && (complete || peer) ? !!peer : nil
+          records = recognized ? [ { component: "system", synchronized: synchronized,
+            stratum: peer && peer[:stratum] < 16 ? peer[:stratum] + 1 : nil, reference: peer&.fetch(:peer),
+            peer: peer&.fetch(:peer), offset_ms: nil, leap: nil } ] : []
+          build_result(records, complete: complete, recognized: recognized, issues: issues, identity: [ :component ])
+        end
+
+        # 旧版本省略 VRF，新版本可能紧接 delay 后输出 VRF。
+        def peer_row(line, number, vrf_column, issues)
+          match = /\A([*+\-=])?\s*(\S+)\s+(\S+)\s+(\d+)\s+(\d+)\s+([0-7]+)\s+(.+)\z/.match(line)
+          unless match
+            issues << { code: :unparsed_row, line: number }
+            return
+          end
+          if vrf_column.nil?
+            issues << { code: :missing_ntp_header, line: number }
+            return
+          end
+
+          remote, local = match.values_at(2, 3)
+          raise ArgumentError if [ remote, local ].any? { |address| address.include?("/") || address.include?("%") }
+          remote = IPAddr.new(remote).native.to_s
+          IPAddr.new(local)
+          stratum, reach = Integer(match[4], 10), Integer(match[6], 8)
+          raise ArgumentError unless stratum.between?(0, 16) && reach <= 255
+
+          delay = if vrf_column
+            /\A(\d+(?:\.\d+)?)(?:\s+(\S+)|([^\d.\s]\S*))?\z/.match(match[7])
+          else
+            /\A(\d+(?:\.\d+)?)\z/.match(match[7])
+          end
+          raise ArgumentError unless delay && Float(delay[1]).finite?
+          vrf = vrf_column ? delay[2] || delay[3] : nil
+          raise ArgumentError if vrf_column && delay[3] && /\A[eE][+-]?\d+\z/.match?(delay[3])
+
+          { peer: remote, vrf: vrf, selected: match[1] == "*", stratum: stratum, reachable: reach.positive? }
+        rescue ArgumentError, IPAddr::InvalidAddressError
+          issues << { code: :invalid_ntp_peer, line: number }
+          nil
+        end
+
+        # 仅拼接文档明确的续行；未完成的记录不能吞并新的作用域。
+        def each_ntp_line(source, issues)
+          pending = nil
+          source.each_line.with_index(1) do |raw, number|
+            line = raw.strip
+            next if line.empty?
+
+            if pending
+              kind, prefix, first_line = pending
+              continuation = kind == :header ? /\Ast\s+poll\s+reach\s+delay(?:\s+vrf)?\z/i : /\A\d+\s+\d+\s+[0-7]+\s+.+\z/
+              pending = nil
+              if continuation.match?(line)
+                yield "#{prefix} #{line}", first_line
+                next
+              end
+              issues << { code: kind == :header ? :truncated_ntp_header : :truncated_ntp_peer, line: first_line }
+            end
+            kind = if /\Aremote\s+local\z/i.match?(line)
+              :header
+            elsif /\A(?:[*+\-=]\s*)?[0-9a-f:.]+\s+[0-9a-f:.]+\z/i.match?(line)
+              :peer
+            end
+            if kind
+              pending = [ kind, line, number ]
+            else
+              yield line, number
+            end
+          end
+          if pending
+            issues << { code: pending[0] == :header ? :truncated_ntp_header : :truncated_ntp_peer, line: pending[2] }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/cisco_nxos/parsers/show_port_channel_summary.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require_relative "../../cisco_ios/parsers/show_etherchannel_summary"
+
+module CtxChecker
+  module CiscoNxos
+    module Parsers
+      # NX-OS 使用相同的聚合组与成员标志，另增加接口类型列。
+      class ShowPortChannelSummary < CiscoIos::Parsers::ShowEtherchannelSummary
+        PLATFORM = :cisco_nxos
+
+        private
+
+        # 部分终端会将下一表格行附加在占满终端宽度的分隔线后。
+        def parse_output(text, complete:)
+          super(clean(text).gsub(/^([ \t]*-{3,})(?=Group\s+Port-|\d+\s+(?:Po|port-channel)\d+\()/i, "\\1\n"), complete: complete)
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/cisco_nxos/parsers/show_system_resources.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+require_relative "../../cisco_ios/parsers/system_values"
+require "ctx_parser/result_set"
+
+module CtxChecker
+  module CiscoNxos
+    module Parsers
+      # CPU 使用率为 100 减空闲率；Linux 已用内存可能包含可回收缓存。
+      class ShowSystemResources < CtxChecker::Parsers::Base
+        include CtxChecker::CiscoIos::Parsers::SystemValues
+
+        private
+
+        # 解析 show system resources，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          cpu, memory, cpu_issues, memory_issues = [], [], [], []
+          caches, statuses = [], []
+          kernel_cache = {}
+          clean(text).each_line.with_index(1) do |source, number|
+            line = source.strip
+            next if line.empty?
+
+            if (match = /\ACPU(?:\s*(\d+))? states\s*:\s*(#{NUMBER})% user,\s*(#{NUMBER})% kernel,\s*(#{NUMBER})% idle\z/i.match(line))
+              values = match.captures.drop(1).map { |value| percentage(value) }
+              valid = values.all? && (values.sum - 100).abs <= 0.2
+              cpu_issues << { code: :invalid_cpu_value, line: number } unless valid
+              cpu << { component: match[1] ? "cpu #{match[1]}" : "processor", scope: "system", window_seconds: 1,
+                utilization: valid ? (100 - values.last).round(3) : nil, interrupt_utilization: nil }
+            elsif (match = /\AMemory usage:\s*(\d+)K total,\s*(\d+)K used,\s*(\d+)K free\z/i.match(line))
+              total, used, free = match.captures.map { |value| Integer(value, 10) * 1024 }
+              valid = total.positive? && used + free == total
+              memory_issues << { code: :inconsistent_memory_totals, line: number } unless valid
+              memory << { component: "system", scope: "system", total_bytes: total, used_bytes: used, free_bytes: free,
+                available_bytes: nil, utilization: valid ? used.fdiv(total) * 100 : nil, basis: :used_including_cache, status: nil }
+            elsif (match = /\A(\d+)K buffers,\s*(\d+)K cache\z/i.match(line))
+              caches << match.captures.sum { |value| Integer(value, 10) * 1024 }
+            elsif (match = /\AKernel (buffers|cached)\s*:\s*(\d+)K Used\z/i.match(line))
+              key = match[1].downcase
+              memory_issues << { code: :duplicate_memory_cache, line: number } if kernel_cache.key?(key)
+              kernel_cache[key] = Integer(match[2], 10) * 1024
+            elsif (match = /\ACurrent memory status:\s*(.+)\z/i.match(line))
+              state = match[1].casecmp?("severe") ? :critical : component_status(match[1])
+              memory_issues << { code: :unknown_memory_status, line: number } if state == :unknown
+              statuses << state
+            elsif /\A(?:Load average:|Processes\s*:|Kernel vmalloc:\s*\d+K total,\s*\d+K free\z)/i.match?(line)
+              next
+            elsif /\ACPU/i.match?(line)
+              cpu_issues << unparsed(number)
+            elsif /\A(?:Memory|Kernel|Current memory|\d+K buffers)/i.match?(line)
+              memory_issues << unparsed(number)
+            else
+              cpu_issues << unparsed(number)
+              memory_issues << unparsed(number)
+            end
+          end
+          memory_issues << { code: :incomplete_memory_cache } if kernel_cache.size == 1
+          duplicate_cache = memory_issues.any? { |issue| issue[:code] == :duplicate_memory_cache }
+          caches << kernel_cache.values.sum if kernel_cache.size == 2 && !duplicate_cache
+          memory_issues << { code: :duplicate_memory_cache } if caches.size > 1
+          memory_issues << { code: :duplicate_memory_status } if statuses.size > 1
+          if memory.empty? && statuses.any?
+            memory_issues << { code: :memory_fields_missing }
+            memory << { component: "system", scope: "system", total_bytes: nil, used_bytes: nil, free_bytes: nil,
+              available_bytes: nil, utilization: nil, basis: :unknown, status: nil }
+          end
+          memory.each do |record|
+            record[:status] = most_severe_status(statuses) if statuses.any?
+            next unless caches.one? && record[:utilization] && !duplicate_cache
+
+            if caches.first <= record[:used_bytes]
+              record[:basis] = :used_minus_cache
+              record[:used_bytes] -= caches.first
+              record[:available_bytes] = record[:total_bytes] - record[:used_bytes]
+              record[:utilization] = record[:used_bytes].fdiv(record[:total_bytes]) * 100
+            else
+              memory_issues << { code: :inconsistent_memory_cache }
+            end
+          end
+          CtxParser::ResultSet.new(results: {
+            cpu: build_result(cpu, complete: complete, recognized: cpu.any?, issues: cpu_issues, identity: %i[component scope window_seconds]),
+            memory: build_result(memory, complete: complete, recognized: memory.any?, issues: memory_issues, identity: %i[component scope])
+          })
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/cisco_nxos/profile.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require "ctx_parser/profile"
+require_relative "parsers/show_interface"
+require_relative "parsers/show_port_channel_summary"
+require_relative "parsers/show_interface_transceiver_details"
+require_relative "parsers/show_bgp_ipv4_unicast_summary"
+require_relative "parsers/show_system_resources"
+require_relative "parsers/show_environment"
+require_relative "parsers/show_clock"
+require_relative "parsers/show_ntp_peer_status"
+require_relative "parsers/show_ip_traffic"
+require_relative "parsers/show_ip_ospf_neighbors"
+
+module CtxChecker
+  module CiscoNxos
+    # NX-OS 命令选择保留完整接口详情，并明确 IPv4 BGP 作用域。
+    class Profile < CtxParser::Profile
+      CATALOG = CtxParser::CommandCatalog.new([
+        { dimensions: %i[interfaces counters], command: "show interface", parser: Parsers::ShowInterface },
+        { dimensions: [ :aggregation ], command: "show port-channel summary", parser: Parsers::ShowPortChannelSummary },
+        { dimensions: [ :optics ], command: "show interface transceiver details", parser: Parsers::ShowInterfaceTransceiverDetails },
+        { dimensions: [ :bgp ], command: "show bgp ipv4 unicast summary", parser: Parsers::ShowBgpIpv4UnicastSummary },
+        { dimensions: [ :ospf ], command: "show ip ospf neighbors", parser: Parsers::ShowIpOspfNeighbors },
+        { dimensions: %i[cpu memory], command: "show system resources", parser: Parsers::ShowSystemResources },
+        { dimensions: %i[temperature environment power], command: "show environment", parser: Parsers::ShowEnvironment },
+        { dimensions: [ :clock ], command: "show clock", parser: Parsers::ShowClock },
+        { dimensions: [ :ntp ], command: "show ntp peer-status", parser: Parsers::ShowNtpPeerStatus },
+        { dimensions: [ :device_counters ], command: "show ip traffic", parser: Parsers::ShowIpTraffic }
+      ])
+      COMMANDS = CATALOG.commands
+      PARSERS = CATALOG.parsers
+    end
+  end
+end

data/lib/ctx_checker/collector.rb

@@ -0,0 +1,175 @@
+# frozen_string_literal: true
+
+require "time"
+require "ctx_driver"
+require_relative "runtime_parser"
+require_relative "snapshot"
+require_relative "failure"
+require_relative "applicability"
+
+module CtxChecker
+  # 按声明目录顺序查询设备，并明确连接资源的归属。
+  class Collector
+    DEFAULT_DIMENSIONS = RuntimeParser::DIMENSIONS
+
+    # 注入为顺序命令观测生成时间戳的时钟。
+    def initialize(clock: -> { Time.now.utc })
+      @clock = clock
+    end
+
+    # 连接的建立与清理由传入连接器的块生命周期管理。
+    def collect(target:, connector:, dimensions: DEFAULT_DIMENSIONS, applicability: nil)
+      parser, identity = prepare(target, dimensions)
+      if connector.respond_to?(:platform) && ParserRegistry.canonical(connector.platform) != parser.platform
+        raise ArgumentError, "Connector platform differs from the target"
+      end
+      observations = inapplicable_observations(parser, dimensions, applicability)
+      dimensions = dimensions - observations.keys
+      return Snapshot.new(target: identity, observed_at: @clock.call, observations: observations) if dimensions.empty?
+
+      issues = []
+      stage = :connect
+      begin
+        connector.open do |session|
+          stage = :collect
+          collect_into(session, parser, dimensions, observations)
+          stage = :close
+        end
+      rescue StandardError => error
+        raise unless CtxDriver::Failure.connection_error?(error, connector)
+
+        code = stage == :close ? :session_close_failed : CtxDriver::Failure.code(error, :connection_failed)
+        issues << { code: code, stage: stage }
+        mark_unavailable(parser, dimensions, observations, code: code, stage: stage, error: error)
+      end
+      reconcile_applicability(observations, applicability)
+      Snapshot.new(target: identity, observed_at: @clock.call, observations: observations, issues: issues)
+    end
+
+    # 借用已打开的 net-connector 会话，不负责建立或关闭连接。
+    def collect_session(target:, session:, dimensions: DEFAULT_DIMENSIONS, applicability: nil)
+      parser, identity = prepare(target, dimensions)
+      observations = inapplicable_observations(parser, dimensions, applicability)
+      dimensions = dimensions - observations.keys
+      collect_into(session, parser, dimensions, observations) if dimensions.any?
+      reconcile_applicability(observations, applicability)
+      Snapshot.new(target: identity, observed_at: @clock.call, observations: observations)
+    end
+
+    private
+
+    # 配置证据可排除未启用的可选功能，但不改变未知运行证据的状态。
+    def inapplicable_observations(parser, dimensions, applicability)
+      return {} unless applicability
+      unless applicability.is_a?(Applicability) && applicability.platform == parser.platform
+        raise ArgumentError, "Applicability must belong to the target platform"
+      end
+
+      dimensions.select { |name| applicability.not_applicable?(name) }.to_h do |name|
+        [ name, Observation.new(name: name, status: :not_applicable,
+          issues: [ { code: :feature_not_configured } ], evidence: applicability.evidence) ]
+      end
+    end
+
+    # 已配置功能与运行回显禁用相互矛盾，两者不能静默覆盖。
+    def reconcile_applicability(observations, applicability)
+      return unless applicability
+
+      observations.each do |name, observation|
+        next unless observation.status == :not_applicable && applicability.state(name) == :configured
+
+        observations[name] = Observation.new(name: name, status: :partial,
+          issues: [ *observation.issues, { code: :configuration_runtime_conflict } ],
+          evidence: observation.evidence + applicability.evidence)
+      end
+    end
+
+    # 发送任何设备命令前，先校验维度选择与目标身份。
+    def prepare(target, dimensions)
+      RuntimeParser.validate_dimensions!(dimensions)
+      raise ArgumentError, "Target must be a hash" unless target.is_a?(Hash)
+
+      parser = RuntimeParser.new(platform: target.fetch(:platform), model: target[:model], software_version: target[:software_version])
+      parser.discovery_dimensions(dimensions)
+      # 打开连接器前校验身份，避免将输入错误误报为连接故障。
+      snapshot = Snapshot.new(target: target.merge(platform: parser.platform), observed_at: @clock.call, observations: {})
+      [ parser, snapshot.target ]
+    end
+
+    # 采集发现命令及其依赖命令，保留各自独立的失败结果。
+    def collect_into(session, parser, dimensions, observations)
+      reader = CtxDriver::Reader.new(session: session, clock: @clock)
+      fragments = Hash.new { |hash, key| hash[key] = [] }
+      dependencies = parser.discovery_dimensions(dimensions)
+      dependency_commands = dependencies.empty? ? [] : parser.queries(dependencies).keys
+      discovery_queries = parser.queries((dimensions + dependencies).uniq).select { |command, _names| dependency_commands.include?(command) }
+      collect_queries(reader, parser, discovery_queries, fragments)
+      discoveries = dependencies.to_h { |name| [ name, parser.combine(name, fragments.fetch(name)) ] }
+      begin
+        parser = parser.expand(discoveries, dimensions: dimensions)
+      rescue StandardError => error
+        expansion_error = error
+      end
+      queries = parser.queries(dimensions).reject { |command, _names| discovery_queries.key?(command) }
+      collect_queries(reader, parser, queries, fragments)
+      dimensions.each do |name|
+        observations[name] = if parser.profile.commands.key?(name)
+          parser.combine(name, fragments.fetch(name))
+        else
+          parser.unavailable_observation(name, discoveries: discoveries, error: expansion_error)
+        end
+      end
+    end
+
+    # 发现阶段与扩展采集阶段共用单条顺序命令边界。
+    def collect_queries(reader, parser, queries, fragments)
+      queries.each do |command, names|
+        read(reader, parser, command, names).each { |name, observation| fragments[name] << observation }
+      end
+    end
+
+    # 每条命令独立承担失败；单个脚本失败不能丢弃此前事实。
+    def read(reader, parser, command, names)
+      capture = reader.read(command)
+      evidence = capture.evidence
+      unless capture.success?
+        return names.to_h do |name|
+          [ name, Failure.observation(name, **capture.failure, command: command, evidence: evidence, skipped: capture.skipped?) ]
+        end
+      end
+
+      begin
+        parser.parse_many(names, capture.body, complete: true, command: command).transform_values do |observation|
+          records = if %i[counters device_counters].include?(observation.name)
+            observation.records.map { |record| record.merge(sampled_at: evidence.first[:observed_at]) }
+          else
+            observation.records
+          end
+          source_status = observation.evidence.first&.fetch(:status, nil) || observation.status
+          Observation.new(name: observation.name, status: observation.status, records: records,
+            covered_scopes: observation.covered_scopes,
+            issues: observation.issues, evidence: evidence.map { |entry| entry.merge(status: source_status) })
+        end
+      rescue StandardError => error
+        failure = CtxDriver::Failure.details(error, fallback: :command_processing_failed, stage: :parse)
+        names.to_h { |name| [ name, Failure.observation(name, **failure, command: command, evidence: evidence) ] }
+      end
+    end
+
+    # 连接建立失败时仍标明各条计划查询，不覆盖已完成事实。
+    def mark_unavailable(parser, dimensions, observations, **failure)
+      dimensions.each do |name|
+        next if observations.key?(name)
+
+        observations[name] = if parser.profile.commands.key?(name)
+          sources = parser.profile.commands_for(name).map do |command|
+            Failure.observation(name, **failure, command: command, skipped: true)
+          end
+          parser.combine(name, sources)
+        else
+          parser.unavailable_observation(name, error: failure[:error], code: failure[:code], stage: failure[:stage])
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/evaluator.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require_relative "policy"
+require_relative "report"
+require_relative "checks/interfaces"
+require_relative "checks/counters"
+require_relative "checks/aggregation"
+require_relative "checks/optics"
+require_relative "checks/routing"
+require_relative "checks/resources"
+require_relative "checks/temperature"
+require_relative "checks/hardware"
+require_relative "checks/clock"
+require_relative "checks/ntp"
+require_relative "checks/alarms"
+require_relative "checks/device_counters"
+
+module CtxChecker
+  # 基于不可变当前采样及可选的前次采样，组合厂商无关的检查。
+  class Evaluator
+    CHECKS = { interfaces: Checks::Interfaces, counters: Checks::Counters, aggregation: Checks::Aggregation,
+      optics: Checks::Optics, bgp: Checks::Routing, ospf: Checks::Routing,
+      cpu: Checks::Resources, memory: Checks::Resources, temperature: Checks::Temperature,
+      environment: Checks::Hardware, power: Checks::Hardware, clock: Checks::Clock,
+      ntp: Checks::Ntp, alarms: Checks::Alarms, device_counters: Checks::DeviceCounters }.freeze
+
+    # 绑定归一化证据评估使用的策略。
+    def initialize(policy: Policy.new)
+      raise ArgumentError, "Evaluator requires a Policy" unless policy.is_a?(Policy)
+      @policy = policy
+      freeze
+    end
+
+    # 评估所有适用检查，分别返回健康结果与证据覆盖率。
+    def call(snapshot, previous: nil)
+      raise ArgumentError, "Evaluator requires a Snapshot" unless snapshot.is_a?(Snapshot)
+      if previous && (!snapshot.same_target?(previous) || previous.observed_at >= snapshot.observed_at)
+        raise ArgumentError, "Previous sample must belong to the same target and precede the current sample"
+      end
+      findings = CHECKS.flat_map do |name, checker|
+        checker.new(snapshot: snapshot, policy: @policy, previous: previous).call(snapshot.observation(name))
+      end
+      snapshot.issues.each do |issue|
+        findings << Finding.new(id: "collection.#{issue[:code]}", dimension: :collection, status: :unknown, reason: issue[:code].to_sym)
+      end
+      Report.new(snapshot: snapshot, findings: findings)
+    end
+  end
+end

data/lib/ctx_checker/failure.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require_relative "observation"
+
+module CtxChecker
+  # 运行失败仅展示阶段与安全异常类型，不包含异常消息或原始回显。
+  module Failure
+    # 构建单个失败维度，保留安全错误元数据及可追溯的命令证据。
+    def self.observation(name, code:, stage:, command:, error: nil, error_type: nil, evidence: [], skipped: false)
+      issue = { code: code, stage: stage, command: command, skipped: skipped }
+      issue[:error_type] = error ? self.error_type(error) : error_type if error || error_type
+      entries = evidence.empty? ? [ {} ] : evidence
+      Observation.new(name: name, status: :failed, issues: [ issue ],
+        evidence: entries.map { |entry| entry.merge(command: command, status: :failed) })
+    end
+
+    # 匿名异常仍使用安全类别，不输出对象检查内容。
+    def self.error_type(error)
+      name = error.class.name
+      name.is_a?(String) && Observation::ERROR_TYPE_PATTERN.match?(name) ? name : "StandardError"
+    end
+    private_class_method :error_type
+  end
+end