netstack 0.1.1 → 0.2.0

data/lib/netstack/monitoring/state_comparison.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Monitoring
+    # Hashes are projections; arrays are unordered collections with multiplicity.
+    # Each expected entry needs its own actual entry, including overlapping projections.
+    module StateComparison
+      module_function
+
+      def matches?(actual, expected)
+        case expected
+        when Hash
+          actual.is_a?(Hash) && expected.all? { |key, value| actual.key?(key) && matches?(actual[key], value) }
+        when Array
+          return false unless actual.is_a?(Array) && actual.size == expected.size
+          assigned = {}
+          expected.each_index.all? { |index| match_entry?(index, actual, expected, assigned, {}) }
+        else
+          actual == expected || ((expected.is_a?(Integer) || expected.is_a?(Float)) && actual.is_a?(String) && actual == expected.to_s)
+        end
+      end
+
+      def match_entry?(index, actual, expected, assigned, visited)
+        actual.each_index do |candidate|
+          next if visited[candidate] || !matches?(actual[candidate], expected[index])
+          visited[candidate] = true
+          if !assigned.key?(candidate) || match_entry?(assigned[candidate], actual, expected, assigned, visited)
+            assigned[candidate] = index
+            return true
+          end
+        end
+        false
+      end
+      private_class_method :match_entry?
+    end
+  end
+end

data/lib/netstack/range_set.rb

@@ -0,0 +1,181 @@
+# frozen_string_literal: true
+
+module Netstack
+  # 不变量是区间有序、互不相交且已合并；遍历区间而不是逐个枚举主机。
+  class RangeSet
+    include Enumerable
+
+    attr_reader :ranges
+
+    # 校验、排序并合并区间，然后冻结集合以保证值语义。
+    def initialize(*ranges)
+      ordered = ranges.map do |range|
+        unless range.is_a?(Range) && range.begin.is_a?(Integer) && range.end.is_a?(Integer)
+          raise ArgumentError, "Intervals must have integer endpoints"
+        end
+        first, last = range.begin, range.end
+        last -= 1 if range.exclude_end?
+        raise ArgumentError, "Intervals must be nonnegative and ordered" if first.negative? || first > last
+        [ first, last ]
+      end.sort_by(&:first)
+      merged = []
+      ordered.each do |first, last|
+        if !merged.empty? && first <= merged.last[1] + 1
+          merged.last[1] = [ merged.last[1], last ].max
+        else
+          merged << [ first, last ]
+        end
+      end
+      @ranges = merged.map { |first, last| first..last }.freeze
+      @hash = @ranges.hash
+      freeze
+    end
+
+    # 遍历规范化后的区间；没有代码块时返回枚举器。
+    def each(&block)
+      return enum_for(__method__) unless block
+      ranges.each(&block)
+      self
+    end
+
+    # 判断集合是否没有区间。
+    def empty? = ranges.empty?
+
+    # 返回区间段数量，而不是地址或端口总数。
+    def size = ranges.size
+
+    # 返回最小端点；空集合返回 nil。
+    def min = ranges.first&.begin
+
+    # 返回最大端点；空集合返回 nil。
+    def max = ranges.last&.end
+
+    # 计算所有闭区间包含的元素总数。
+    def cardinality = sum { |range| range.end - range.begin + 1 }
+
+    attr_reader :hash
+    # 仅按规范化后的区间比较集合内容。
+    def ==(other) = other.is_a?(RangeSet) && ranges == other.ranges
+
+    alias_method :eql?, :==
+
+    # 计算并集；两个集合为空或相同对象时直接复用已有值。
+    def |(other)
+      validate_operand!(other)
+      return self if other.empty? || equal?(other)
+      return other if empty?
+      self.class.new(*ranges, *other.ranges)
+    end
+
+    # 用双指针扫描两个有序集合，计算交集。
+    def &(other)
+      validate_operand!(other)
+      return self if equal?(other) || empty?
+      return other if other.empty?
+
+      result = []
+      left = right = 0
+      while left < size && right < other.size
+        a, b = ranges[left], other.ranges[right]
+        first, last = [ a.begin, b.begin ].max, [ a.end, b.end ].min
+        result << (first..last) if first <= last
+        left += 1 if a.end <= b.end
+        right += 1 if b.end <= a.end
+      end
+      self.class.new(*result)
+    end
+
+    # 从当前集合中减去另一个集合，逐段截去重叠部分。
+    def -(other)
+      validate_operand!(other)
+      return self if empty? || other.empty?
+      return self.class.new if equal?(other)
+
+      result = []
+      right = 0
+      each do |range|
+        cursor = range.begin
+        right += 1 while right < other.size && other.ranges[right].end < cursor
+        scan = right
+        while scan < other.size && other.ranges[scan].begin <= range.end
+          removed = other.ranges[scan]
+          result << (cursor..(removed.begin - 1)) if removed.begin > cursor
+          cursor = [ cursor, removed.end + 1 ].max
+          break if cursor > range.end
+          scan += 1
+        end
+        result << (cursor..range.end) if cursor <= range.end
+      end
+      self.class.new(*result)
+    end
+
+    # 判断整数是否落在任一规范化区间内。
+    def include?(number)
+      raise ArgumentError, "Membership requires an integer" unless number.is_a?(Integer)
+      candidate = ranges.bsearch { |range| range.end >= number }
+      candidate ? candidate.begin <= number : false
+    end
+
+    # 判断集合是否被当前集合覆盖；空集合始终被覆盖。
+    def cover?(other)
+      return include?(other) if other.is_a?(Integer)
+      validate_operand!(other)
+      if other.size == 1
+        target = other.ranges.first
+        candidate = ranges.bsearch { |range| range.end >= target.end }
+        return candidate ? candidate.begin <= target.begin : false
+      end
+      index = 0
+      other.each do |range|
+        index += 1 while index < size && ranges[index].end < range.begin
+        return false if index == size || ranges[index].begin > range.begin || ranges[index].end < range.end
+      end
+      true
+    end
+
+    # 判断当前集合是否是另一个集合的子集。
+    def subset?(other)
+      validate_operand!(other)
+      other.cover?(self)
+    end
+
+    # 判断两个有序集合是否存在重叠区间。
+    def overlap?(other)
+      validate_operand!(other)
+      left = right = 0
+      while left < size && right < other.size
+        a, b = ranges[left], other.ranges[right]
+        return true if a.overlap?(b)
+        (a.end < b.end) ? left += 1 : right += 1
+      end
+      false
+    end
+
+    # 返回相等、包含、被包含或互不相同四种关系之一。
+    def relation(other)
+      validate_operand!(other)
+      return :equal if self == other
+      return :contains if cover?(other)
+      return :within if subset?(other)
+      :other
+    end
+
+    # 返回区间数组的浅副本，避免调用方修改内部数组。
+    def to_a = ranges.dup
+
+    # 哈希值只在当前进程有效；持久化区间，并在读取进程中重新建立冻结集合。
+    def marshal_dump = ranges
+
+    # 从持久化区间恢复集合的不变量和冻结状态。
+    def marshal_load(ranges)
+      initialize(*ranges)
+    end
+
+    private
+
+    # 统一校验集合运算的右值类型。
+    def validate_operand!(other)
+      raise ArgumentError, "Expected a RangeSet" unless other.is_a?(RangeSet)
+    end
+  end
+end

data/lib/netstack/routing/lookup.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+module Netstack
+  # 路由证据与本地查询；不安装路由，也不执行设备 I/O。
+  module Routing
+    # 先限定目标、VRF 和地址族，再按前缀长度与优先级筛选。
+    # 排序依据未知时保留歧义；并列的最优路由保留 ECMP 候选。
+    class Lookup
+      def call(routes:, destination:, target_key:, vrf: "default")
+        unless routes.is_a?(Array) && routes.all? { |route| route.is_a?(Route) }
+          raise InputError, "lookup routes must be Route values"
+        end
+        target_key = Values.text(target_key, name: "route target")
+        vrf = Values.text(vrf, name: "VRF")
+        address = ::IPAddr.new(Values.text(destination, name: "lookup destination"))
+        raise InputError, "lookup requires one unscoped host" if destination.match?(/[\/%]/)
+
+        candidates = routes.select do |route|
+          route.target_key == target_key && route.vrf == vrf && route.network.ipv4? == address.ipv4? && route.network.include?(address)
+        end
+        return LookupResult.new(routes: [], status: :not_found) if candidates.empty?
+
+        longest = candidates.map { |route| route.network.prefix }.max
+        candidates.select! { |route| route.network.prefix == longest }
+        if candidates.size > 1 && candidates.any? { |route| route.preference.nil? }
+          return LookupResult.new(routes: candidates, status: :ambiguous, reason: "route preference is unknown")
+        end
+        preference = candidates.filter_map(&:preference).min
+        candidates.select! { |route| route.preference == preference } if preference
+        if candidates.map(&:protocol).uniq.size > 1
+          return LookupResult.new(routes: candidates, status: :ambiguous, reason: "metrics from different protocols are not comparable")
+        end
+        if candidates.size > 1 && candidates.any? { |route| route.metric.nil? }
+          return LookupResult.new(routes: candidates, status: :ambiguous, reason: "route metric is unknown")
+        end
+        metric = candidates.filter_map(&:metric).min
+        candidates.select! { |route| route.metric == metric } if metric
+        LookupResult.new(routes: candidates, status: :matched)
+      rescue ::IPAddr::Error
+        raise InputError, "invalid lookup destination"
+      end
+    end
+  end
+end

data/lib/netstack/routing/lookup_result.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Routing
+    class LookupResult < Data.define(:routes, :status, :reason)
+      def initialize(routes:, status:, reason: nil)
+        super(routes: routes.dup.freeze, status: status, reason: Values.copy(reason))
+      end
+
+      def matched? = status == :matched
+      def ambiguous? = status == :ambiguous
+    end
+  end
+end

data/lib/netstack/routing/route.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+module Netstack
+  module Routing
+    class Route < Data.define(:target_key, :vrf, :destination, :protocol, :preference, :metric, :next_hop, :interface)
+      def initialize(target_key:, destination:, protocol:, vrf: "default", preference: nil, metric: nil, next_hop: nil, interface: nil)
+        text = Values.text(destination, name: "route destination")
+        raise InputError, "route destination cannot contain a scope identifier" if text.include?("%")
+        network = ::IPAddr.new(text)
+        if next_hop
+          hop = ::IPAddr.new(Values.text(next_hop, name: "next hop"))
+          raise InputError, "route next hop family mismatch" if hop.ipv4? != network.ipv4?
+          raise InputError, "next hop must be an unscoped host" if next_hop.match?(/[\/%]/)
+
+          next_hop = hop.to_s
+        end
+        super(target_key: Values.text(target_key, name: "route target"), vrf: Values.text(vrf, name: "VRF"),
+          destination: "#{network}/#{network.prefix}".freeze, protocol: Values.text(protocol, name: "route protocol").downcase.freeze,
+          preference: preference.nil? ? nil : Values.integer(preference, name: "route preference", min: 0),
+          metric: metric.nil? ? nil : Values.integer(metric, name: "route metric", min: 0),
+          next_hop: Values.copy(next_hop), interface: Values.text(interface, name: "route interface", optional: true))
+      rescue ::IPAddr::Error
+        raise InputError, "invalid route address"
+      end
+
+      def network = ::IPAddr.new(destination)
+      def key = [target_key, vrf, destination, protocol, preference, metric, next_hop, interface].freeze
+    end
+  end
+end

data/lib/netstack/routing/snapshot.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Routing
+    class Snapshot < Data.define(:target, :source, :vrf, :dimension)
+      def initialize(target:, source:, vrf:, dimension:)
+        unless target.is_a?(Target) && dimension.is_a?(Dimension) && dimension.name == :routes
+          raise InputError, "invalid route snapshot"
+        end
+        vrf = Values.text(vrf, name: "VRF")
+        unless dimension.records.all? { |route| route.is_a?(Route) && route.target_key == target.key && route.vrf == vrf }
+          raise InputError, "route snapshot contains foreign routes"
+        end
+        identities = dimension.records.map(&:key)
+        raise InputError, "duplicate route identity" unless identities.uniq.size == identities.size
+
+        super(target: target, source: Values.text(source, name: "route source"), vrf: vrf, dimension: dimension)
+      end
+
+      def complete? = dimension.complete?
+    end
+  end
+end

data/lib/netstack/target.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Netstack
+  # 宿主提供的不可变目标身份；授权和凭据由宿主另外管理。
+  # 属性会进入计划，宿主必须确保其中不包含秘密。
+  class Target < Data.define(:key, :host, :platform, :attributes)
+    def initialize(key:, host:, platform:, attributes: {})
+      raise InputError, "attributes must be a Hash" unless attributes.is_a?(Hash)
+
+      super(key: Values.text(key, name: "target key"), host: Values.text(host, name: "host"),
+        platform: Values.text(platform.is_a?(Symbol) ? platform.to_s : platform, name: "platform"),
+        attributes: Values.copy(attributes))
+    end
+  end
+end

data/lib/netstack/unsupported_capability.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Netstack
+  class UnsupportedCapability < Error
+    def initialize(message = "unsupported capability", code: :unsupported_capability, stage: :validate, details: {})
+      super
+    end
+  end
+end

data/lib/netstack/values.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require "time"
+require "active_support/core_ext/object/deep_dup"
+require "active_support/core_ext/object/blank"
+
+module Netstack
+  # 防御性复制宿主交换值；只接受明确支持的类型，并建立深度不可变约束。
+  module Values
+    module_function
+
+    def copy(value)
+      freeze_value(value.deep_dup)
+    end
+
+    # ActiveSupport 负责深复制；此遍历只建立领域值的不可变契约。
+    def freeze_value(value)
+      case value
+      when Hash
+        value.to_h { |key, item| [freeze_value(key), freeze_value(item)] }.freeze
+      when Array
+        value.map! { |item| freeze_value(item) }.freeze
+      when String, Time
+        value.freeze
+      when NilClass, TrueClass, FalseClass, Integer, Symbol
+        value
+      when Float
+        raise InputError, "numeric values must be finite" unless value.finite?
+
+        value
+      when Data
+        value.class.new(**value.to_h.transform_values { |item| copy(item) })
+      else
+        raise ArgumentError, "unsupported value type: #{value.class}"
+      end
+    end
+    private_class_method :freeze_value
+
+    # 用于身份与标签的文本归一化，会去除首尾空白；不能用于不透明凭据。
+    def text(value, name:, optional: false)
+      return nil if optional && value.nil?
+      raise InputError, "#{name} must be nonempty text" unless value.is_a?(String) && value.present?
+
+      value.strip.freeze
+    end
+
+    def integer(value, name:, min: nil, max: nil)
+      parsed = if value.is_a?(Integer)
+        value
+      elsif value.is_a?(String) && /\A[0-9]+\z/.match?(value) && value.length <= 20
+        Integer(value, 10)
+      end
+      unless parsed && (!min || parsed >= min) && (!max || parsed <= max)
+        raise InputError, "#{name} must be an integer in range"
+      end
+
+      parsed
+    end
+
+    def time(value, name:, optional: false)
+      return nil if optional && value.nil?
+      return value.dup.freeze if value.is_a?(Time)
+      raise InputError, "#{name} must be an ISO 8601 timestamp" unless value.is_a?(String)
+
+      Time.iso8601(value).freeze
+    rescue ArgumentError
+      raise InputError, "#{name} must be an ISO 8601 timestamp"
+    end
+  end
+end

data/lib/netstack/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Netstack
-  VERSION = "0.1.1"
+  VERSION = "0.2.0"
 end

data/lib/netstack/vxlan/auditor.rb

@@ -0,0 +1,187 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Vxlan
+    class Auditor
+      def inspect(snapshot)
+        findings = []
+        fabric = snapshot.fabric
+        (fabric.expected_node_keys - fabric.nodes.map(&:key)).each do |key|
+          add(findings, :configuration_incomplete, :warning, [key], "Configuration evidence is unavailable")
+          inspect_runtime(Node.new(key: key), snapshot.runtime.fetch(key, {}), findings)
+        end
+        fabric.nodes.each do |node|
+          add(findings, :configuration_incomplete, :warning, [node.key], "Configuration evidence is incomplete") unless node.complete?
+          inspect_node(node, findings)
+          inspect_runtime(node, snapshot.runtime.fetch(node.key, {}), findings)
+        end
+        inspect_consistency(fabric, findings)
+        inspect_vpc(fabric, findings)
+        findings.freeze
+      end
+
+      private
+
+      def add(findings, code, severity, keys, message, **details)
+        findings << Finding.new(code: code, severity: severity, node_keys: keys, message: message, details: details)
+      end
+
+      def inspect_node(node, findings)
+        inspect_bgp(node, findings) if node.complete?
+        return unless node.vtep?
+
+        add(findings, :nve_shutdown, :critical, [node.key], "NVE interface is administratively down") if node.nve[:shutdown]
+        return unless node.complete?
+
+        add(findings, :nve_source_missing, :critical, [node.key], "NVE source interface is missing") unless node.nve[:source_interface]
+        node.segments.each do |segment|
+          details = { vlan_id: segment.vlan_id, vni: segment.vni, vrf: segment.vrf, prefix: segment.prefix }
+          add(findings, :anycast_gateway_disabled, :warning, [node.key], "SVI does not enable anycast gateway", **details) unless segment.anycast
+          add(findings, :anycast_mac_missing, :critical, [node.key], "Global anycast gateway MAC is missing", **details) if segment.anycast && !node.anycast_mac
+          member = node.nve.fetch(:members, {})[segment.vni]
+          add(findings, :nve_member_missing, :critical, [node.key], "Segment VNI is missing from NVE", **details) unless member
+          if member && (member[:associate_vrf] || (!member[:replication] && !member[:multicast_group]))
+            add(findings, :nve_member_invalid, :critical, [node.key], "L2 NVE member has invalid replication or L3 association", **details)
+          end
+          evpn = node.evpn[segment.vni]
+          add(findings, :evpn_vni_missing, :critical, [node.key], "L2 VNI is missing from EVPN", **details) unless evpn
+          if evpn && !bidirectional?(evpn[:route_targets])
+            add(findings, :evpn_route_target_missing, :critical, [node.key], "EVPN import/export route-target is incomplete", **details)
+          end
+          vrf = node.vrfs[segment.vrf]
+          unless vrf && vrf[:vni] && node.nve.fetch(:members, {}).dig(vrf[:vni], :associate_vrf)
+            add(findings, :vrf_l3_vni_missing, :critical, [node.key], "VRF L3 VNI or NVE association is missing", **details)
+          end
+          if vrf && !bidirectional?(vrf[:route_targets].select { |target| target[:evpn] })
+            add(findings, :vrf_route_target_missing, :critical, [node.key], "VRF EVPN import/export route-target is incomplete", **details)
+          end
+          advertisement = RoutePolicy.new.advertisement(node, segment)
+          unless advertisement == :permitted
+            add(findings, :route_advertisement, advertisement == :unknown ? :warning : :critical, [node.key],
+                "Segment route advertisement is #{advertisement}", **details, decision: advertisement)
+          end
+          segment.acl_bindings.each do |direction, name|
+            unless node.acls.key?(name)
+              add(findings, :acl_missing, :critical, [node.key], "SVI references an absent ACL", **details, acl: name,
+                                                                                                            direction: direction)
+            end
+          end
+        end
+        node.vlan_vnis.each do |vlan_id, vni|
+          next unless vni && !node.segment(vlan_id)
+          next if node.vrfs.values.any? { |vrf| vrf[:vni] == vni }
+
+          add(findings, :unrouted_vlan, :warning, [node.key], "Mapped VLAN has no parsed routed SVI", vlan_id: vlan_id, vni: vni)
+        end
+      end
+
+      def bidirectional?(targets)
+        directions = targets.flat_map { |target| target[:direction] == :both ? %i[import export] : [target[:direction]] }
+        (%i[import export] - directions).empty?
+      end
+
+      def inspect_bgp(node, findings)
+        node.bgp.fetch(:neighbors, {}).each do |peer, settings|
+          template = node.bgp.fetch(:templates, {})[settings[:inherit_peer]] || {}
+          families = (template[:address_families] || {}).merge(settings[:address_families]) do |_key, parent, child|
+            parent.merge(child.compact)
+          end
+          family = families["l2vpn evpn"]
+          next unless family
+
+          unless family[:extended_community]
+            add(findings, :bgp_extended_community_missing, :critical, [node.key], "EVPN neighbor lacks extended community advertisement",
+                peer_ip: peer)
+          end
+          if node.role == :spine && !family[:route_reflector_client]
+            add(findings, :bgp_reflector_client_missing, :warning, [node.key], "Spine EVPN neighbor is not a route-reflector client", peer_ip: peer)
+          end
+        end
+      end
+
+      def inspect_consistency(fabric, findings)
+        fabric.vteps.flat_map { |node| node.segments.map { |segment| [node, segment] } }.group_by { |_node, segment| segment.identity }.each do |identity, rows|
+          signatures = rows.map { |_node, segment| segment.to_h }.uniq
+          if signatures.size > 1
+            add(findings, :segment_inconsistent, :critical, rows.map do |node, _segment|
+              node.key
+            end, "Segment configuration differs between nodes", identity: identity, values: signatures)
+          end
+          acl_contents = rows.map do |node, segment|
+            segment.acl_bindings.transform_values { |name| node.acls[name] }
+          end
+          next unless acl_contents.uniq.size > 1
+
+          add(findings, :acl_inconsistent, :critical, rows.map do |node, _segment|
+            node.key
+          end, "Segment ACL contents differ between nodes", identity: identity)
+        end
+        fabric.vteps.flat_map { |node| node.segments.map { |segment| [node, segment] } }.group_by { |_node, segment| segment.vni }.each do |vni, rows|
+          identities = rows.map { |_node, segment| segment.identity }.uniq
+          next unless identities.size > 1
+
+          add(findings, :vni_conflict, :critical, rows.map do |node, _segment|
+            node.key
+          end.uniq, "VNI represents different routed segments", vni: vni, identities: identities)
+        end
+        macs = fabric.vteps.filter_map(&:anycast_mac).uniq
+        add(findings, :anycast_mac_inconsistent, :critical, fabric.vteps.map(&:key), "Anycast gateway MAC differs between VTEPs", values: macs) if macs.size > 1
+      end
+
+      def inspect_vpc(fabric, findings)
+        fabric.nodes.select(&:vpc_domain).group_by { |node| node.vpc_domain.id }.each do |id, nodes|
+          if nodes.size != 2
+            add(findings, :vpc_member_count, :warning, nodes.map(&:key), "vPC domain does not have exactly two observed nodes", domain_id: id,
+                                                                                                                                count: nodes.size)
+          end
+          nodes.each do |node|
+            domain = node.vpc_domain
+            if node.complete? && (domain.peer_links.empty? || domain.peer_keepalive[:destination].nil?)
+              add(findings, :vpc_peer_configuration_missing, :critical, [node.key], "vPC peer-link or keepalive destination is missing", domain_id: id)
+            end
+          end
+          next unless nodes.size == 2
+
+          left, right = nodes.map(&:vpc_domain)
+          if left.peer_keepalive[:destination] != right.peer_keepalive[:source] || right.peer_keepalive[:destination] != left.peer_keepalive[:source]
+            add(findings, :vpc_keepalive_inconsistent, :critical, nodes.map(&:key), "vPC keepalive endpoints are not reciprocal", domain_id: id)
+          end
+          if left.member_ports.keys.sort != right.member_ports.keys.sort
+            add(findings, :vpc_members_inconsistent, :critical, nodes.map(&:key), "vPC member IDs differ between peers", domain_id: id)
+          end
+        end
+      end
+
+      def inspect_runtime(node, dimensions, findings)
+        dimensions.each do |name, result|
+          unless result.complete?
+            add(findings, :runtime_incomplete, :warning, [node.key], "Runtime dimension is #{result.status}", dimension: name, status: result.status)
+          end
+          result.records.each do |row|
+            abnormal = case name
+                       when :nve_peers, :nve_vnis then row[:state] != :up
+                       when :bgp_neighbors then row[:state] != :established
+                       when :ospf_neighbors then !row[:state].start_with?("full")
+                       when :port_channels then !row[:flags].include?("U")
+                       when :vpc then row[:consistency_status] != "success" || !row.fetch(:peer_status, "").include?("formed ok")
+                       else false
+                       end
+            add(findings, :runtime_abnormal, :critical, [node.key], "Runtime #{name} is abnormal", dimension: name, record: row) if abnormal
+          end
+          next unless result.complete? && node.complete?
+
+          expected = if name == :nve_vnis
+                       node.nve.fetch(:members, {}).keys
+                     else
+                       name == :bgp_neighbors ? node.bgp.fetch(:neighbors, {}).keys : []
+                     end
+          observed = result.records.map { |row| name == :nve_vnis ? row[:vni] : row[:peer_ip] }
+          (expected - observed).each do |identity|
+            add(findings, :runtime_object_missing, :critical, [node.key], "Configured object is absent from complete runtime evidence", dimension: name,
+                                                                                                                                        identity: identity)
+          end
+        end
+      end
+    end
+  end
+end