packet-tracer-skill 0.2.0 → 0.2.2

package/scripts/coverage_matrix.py

@@ -37,6 +37,9 @@ DEVICE_FAMILY_MAP = {
     "Dsl Modem": "wan/cloud/dsl/cable devices",
     "Security Appliance": "security devices",
     "ASA": "security devices",
+    "NetworkController": "network controllers",
+    "CentralOfficeServer": "wan/cloud/dsl/cable devices",
+    "CellTower": "wan/cloud/dsl/cable devices",
     "IoT": "iot devices",
     "Board": "iot devices",
     "Sensor": "iot devices",
@@ -52,6 +55,94 @@ DEFAULT_FAMILY_LIMITATIONS = {
     "security devices": ["advanced security devices remain donor-limited"],
 }
 
+REPORT_ONLY_CAPABILITIES = {
+    "ipv6_slaac",
+    "dhcpv6_stateful",
+    "dhcpv6_stateless",
+    "ipv6_prefix_delegation",
+    "ipv6_dns_aaaa",
+    "ipv6_tunneling",
+    "isatap",
+    "ospfv3",
+    "eigrp_ipv6",
+    "ripng",
+    "hsrp",
+    "dhcp_snooping",
+    "dai",
+    "dot1x",
+    "lldp",
+    "rep",
+    "snmp",
+    "netflow",
+    "span",
+    "qos",
+    "port_security",
+    "asa_acl_nat",
+    "asa_service_policy",
+    "clientless_vpn",
+    "cbac",
+    "zfw",
+    "sniffer",
+    "wlc",
+    "wpa_enterprise",
+    "wep",
+    "guest_wifi",
+    "beamforming",
+    "meraki",
+    "cellular_5g",
+    "bluetooth",
+    "network_controller",
+    "python_programming",
+    "javascript_programming",
+    "blockly_programming",
+    "tcp_udp_app",
+    "vm_iox",
+    "voip",
+    "ip_phone",
+    "call_manager",
+    "linksys_voice",
+    "mqtt",
+    "real_http",
+    "real_websocket",
+    "visual_scripting",
+    "ptp",
+    "profinet",
+    "l2nat",
+    "cyberobserver",
+    "industrial_firewall",
+    "coaxial",
+    "cable_dsl",
+    "central_office",
+    "cell_tower",
+    "power_distribution",
+    "hot_swappable",
+    "ios_license",
+}
+
+IPV6_DONOR_BACKED_CAPABILITIES = {
+    "ipv6_slaac",
+    "dhcpv6_stateful",
+    "ospfv3",
+    "eigrp_ipv6",
+    "ripng",
+    "hsrp",
+}
+L2_SECURITY_MONITORING_EDIT_PROVEN_CAPABILITIES = {
+    "dhcp_snooping",
+    "dai",
+    "lldp",
+    "rep",
+    "snmp",
+    "netflow",
+    "span",
+    "port_security",
+}
+WIRELESS_ADVANCED_EDIT_PROVEN_CAPABILITIES = {
+    "wep",
+    "wpa_enterprise",
+}
+EDIT_PROVEN_REPORT_CAPABILITIES = IPV6_DONOR_BACKED_CAPABILITIES | L2_SECURITY_MONITORING_EDIT_PROVEN_CAPABILITIES
+
 CAPABILITY_PROVIDER_FAMILIES = {
     "access_port": {"switches", "multilayer switches"},
     "trunk": {"switches", "multilayer switches"},
@@ -99,6 +190,67 @@ CAPABILITY_PROVIDER_FAMILIES = {
     "tablet": {"end devices"},
     "printer": {"end devices"},
     "verification": {"routers", "switches", "multilayer switches", "servers", "end devices", "access points"},
+    "ipv6_slaac": {"routers", "switches", "end devices", "pt-specific edge/utility devices"},
+    "dhcpv6_stateful": {"routers", "servers", "end devices"},
+    "dhcpv6_stateless": {"routers", "servers", "end devices"},
+    "ipv6_prefix_delegation": {"routers", "wan/cloud/dsl/cable devices"},
+    "ipv6_dns_aaaa": {"servers", "routers"},
+    "ipv6_tunneling": {"routers"},
+    "isatap": {"routers", "end devices"},
+    "ospfv3": {"routers"},
+    "eigrp_ipv6": {"routers"},
+    "ripng": {"routers"},
+    "hsrp": {"routers", "switches", "multilayer switches"},
+    "dhcp_snooping": {"switches", "multilayer switches"},
+    "dai": {"switches", "multilayer switches"},
+    "dot1x": {"switches", "servers", "end devices"},
+    "lldp": {"routers", "switches", "multilayer switches"},
+    "rep": {"switches", "multilayer switches"},
+    "snmp": {"routers", "switches", "multilayer switches", "access points", "servers"},
+    "netflow": {"routers"},
+    "span": {"switches", "multilayer switches"},
+    "qos": {"routers", "switches", "multilayer switches"},
+    "port_security": {"switches", "multilayer switches"},
+    "asa_acl_nat": {"security devices"},
+    "asa_service_policy": {"security devices"},
+    "clientless_vpn": {"security devices"},
+    "cbac": {"routers", "security devices"},
+    "zfw": {"routers", "security devices"},
+    "sniffer": {"end devices", "pt-specific edge/utility devices"},
+    "wlc": {"access points"},
+    "wpa_enterprise": {"access points", "home/wireless routers", "servers"},
+    "wep": {"access points", "home/wireless routers"},
+    "guest_wifi": {"home/wireless routers", "access points"},
+    "beamforming": {"home/wireless routers"},
+    "meraki": {"security devices", "home/wireless routers", "access points"},
+    "cellular_5g": {"wan/cloud/dsl/cable devices", "end devices"},
+    "bluetooth": {"iot devices", "end devices"},
+    "network_controller": {"pt-specific edge/utility devices", "routers", "switches"},
+    "python_programming": {"end devices", "pt-specific edge/utility devices"},
+    "javascript_programming": {"end devices", "pt-specific edge/utility devices"},
+    "blockly_programming": {"end devices", "pt-specific edge/utility devices"},
+    "tcp_udp_app": {"end devices", "servers"},
+    "vm_iox": {"routers", "pt-specific edge/utility devices"},
+    "voip": {"end devices", "switches", "routers"},
+    "ip_phone": {"end devices"},
+    "call_manager": {"routers", "servers", "end devices", "switches"},
+    "linksys_voice": {"home/wireless routers", "end devices"},
+    "mqtt": {"iot devices", "servers", "home/wireless routers", "pt-specific edge/utility devices"},
+    "real_http": {"iot devices", "servers", "pt-specific edge/utility devices"},
+    "real_websocket": {"iot devices", "servers", "pt-specific edge/utility devices"},
+    "visual_scripting": {"iot devices"},
+    "ptp": {"switches", "multilayer switches", "routers"},
+    "profinet": {"iot devices", "routers", "switches"},
+    "l2nat": {"switches", "multilayer switches"},
+    "cyberobserver": {"servers", "switches", "routers"},
+    "industrial_firewall": {"security devices", "routers"},
+    "coaxial": {"pt-specific edge/utility devices"},
+    "cable_dsl": {"wan/cloud/dsl/cable devices"},
+    "central_office": {"pt-specific edge/utility devices"},
+    "cell_tower": {"pt-specific edge/utility devices", "wan/cloud/dsl/cable devices"},
+    "power_distribution": {"pt-specific edge/utility devices"},
+    "hot_swappable": {"multilayer switches", "pt-specific edge/utility devices"},
+    "ios_license": {"routers", "switches", "multilayer switches"},
 }
 
 
@@ -277,26 +429,72 @@ def _requested_device_families(plan: IntentPlan) -> list[str]:
 def _scenario_family_for_plan(plan: IntentPlan, requested_families: list[str]) -> str | None:
     capabilities = set(plan.capabilities)
     requested_services = {str(service) for service in plan.service_requirements.get("services", []) if service}
-    if capabilities & {"iot", "iot_registration", "iot_control"} or {"iot devices", "home/wireless routers"} & set(requested_families):
-        return "home_iot"
-    if (
+    requested_family_set = set(requested_families)
+    prompt_lower = str(plan.prompt or "").lower()
+    campus_capabilities = {"vlan", "router_on_a_stick", "management_vlan", "telnet", "acl", "nat", "pat", "trunk", "access_port"}
+    service_capabilities = {"server_dns", "server_dhcp", "server_http", "server_https", "server_ftp", "server_tftp", "server_email", "server_syslog", "server_aaa"}
+    explicit_campus_style = plan.network_style in {"campus", "department_lan"}
+    explicit_service_style = plan.network_style == "service_heavy"
+    explicit_home_style = plan.network_style in {"home_iot", "smart_home"}
+    explicit_home_gateway_prompt = any(
+        token in prompt_lower
+        for token in ["home gateway", "homegateway", "smart home", "iot "]
+    )
+    campus_signal = (
+        explicit_campus_style
+        or bool(plan.department_groups)
+        or "campus" in prompt_lower
+        or "kampus" in prompt_lower
+        or (requested_family_set & {"switches", "multilayer switches"} and capabilities & campus_capabilities)
+        or len(capabilities & campus_capabilities) >= 3
+    )
+    home_iot_signal = (
+        explicit_home_style
+        or explicit_home_gateway_prompt
+        or plan.wireless_mode == "home_router_edge"
+        or capabilities & {"iot", "iot_registration", "iot_control"}
+        or {"iot devices", "home/wireless routers"} & requested_family_set
+    )
+    wan_signal = (
         plan.network_style == "wan_security"
         or capabilities & {"vpn", "ipsec", "gre", "ppp", "multilayer_switching", "security_edge"}
-        or {"wan/cloud/dsl/cable devices", "security devices"} & set(requested_families)
-    ):
+        or {"wan/cloud/dsl/cable devices", "security devices"} & requested_family_set
+    )
+    ipv6_routing_signal = plan.network_style == "ipv6_routing" or capabilities & {"ipv6_slaac", "dhcpv6_stateful", "dhcpv6_stateless", "ipv6_prefix_delegation", "ipv6_dns_aaaa", "ipv6_tunneling", "isatap", "ospfv3", "eigrp_ipv6", "ripng", "hsrp"}
+    l2_security_monitoring_signal = plan.network_style == "l2_security_monitoring" or capabilities & {"dhcp_snooping", "dai", "dot1x", "lldp", "rep", "snmp", "netflow", "span", "qos", "port_security"}
+    wireless_advanced_signal = plan.network_style == "wireless_advanced" or capabilities & {"wlc", "wpa_enterprise", "wep", "guest_wifi", "beamforming", "meraki", "cellular_5g", "bluetooth"}
+    automation_controller_signal = plan.network_style == "automation_controller" or capabilities & {"network_controller", "python_programming", "javascript_programming", "blockly_programming", "tcp_udp_app", "vm_iox"}
+    voice_collaboration_signal = plan.network_style == "voice_collaboration" or capabilities & {"voip", "ip_phone", "call_manager", "linksys_voice"}
+    industrial_iot_signal = plan.network_style == "industrial_iot" or capabilities & {"mqtt", "real_http", "real_websocket", "visual_scripting", "ptp", "profinet", "l2nat", "cyberobserver", "industrial_firewall"}
+    physical_media_device_signal = plan.network_style == "physical_media_device" or capabilities & {"coaxial", "cable_dsl", "central_office", "cell_tower", "power_distribution", "hot_swappable", "ios_license"}
+    service_signal = (
+        explicit_service_style
+        or requested_services & {"dns", "dhcp", "http", "https", "ftp", "tftp", "email", "syslog", "aaa", "ntp"}
+        or capabilities & service_capabilities
+        or "servers" in requested_family_set
+    )
+    if industrial_iot_signal:
+        return "industrial_iot"
+    if automation_controller_signal:
+        return "automation_controller"
+    if voice_collaboration_signal:
+        return "voice_collaboration"
+    if wireless_advanced_signal:
+        return "wireless_advanced"
+    if l2_security_monitoring_signal:
+        return "l2_security_monitoring"
+    if ipv6_routing_signal:
+        return "ipv6_routing"
+    if physical_media_device_signal:
+        return "physical_media_device"
+    if home_iot_signal:
+        return "home_iot"
+    if wan_signal:
         return "wan_security_edge"
-    if (
-        requested_services & {"dns", "dhcp", "http", "https", "ftp", "tftp", "email", "syslog", "aaa", "ntp"}
-        or capabilities & {"server_dns", "server_dhcp", "server_http", "server_https", "server_ftp", "server_tftp", "server_email", "server_syslog", "server_aaa"}
-        or "servers" in requested_families
-    ) and not (plan.department_groups or {"switches", "multilayer switches"} & set(requested_families) and capabilities & {"vlan", "router_on_a_stick", "management_vlan", "telnet"}):
-        return "service_heavy"
-    if (
-        plan.department_groups
-        or {"switches", "multilayer switches"} & set(requested_families)
-        or capabilities & {"vlan", "router_on_a_stick", "management_vlan", "telnet", "acl", "nat", "pat"}
-    ):
+    if campus_signal:
         return "campus"
+    if service_signal:
+        return "service_heavy"
     return None
 
 
@@ -305,6 +503,13 @@ SCENARIO_CAPABILITY_SETS = {
     "service_heavy": {"server_dns", "server_dhcp", "server_http", "server_https", "server_ftp", "server_tftp", "server_email", "server_syslog", "server_aaa", "ntp"},
     "home_iot": {"iot", "iot_registration", "iot_control", "wireless_ap", "wireless_mutation"},
     "wan_security_edge": {"vpn", "ipsec", "gre", "ppp", "acl", "nat"},
+    "ipv6_routing": {"ipv6_slaac", "dhcpv6_stateful", "dhcpv6_stateless", "ipv6_prefix_delegation", "ipv6_dns_aaaa", "ipv6_tunneling", "isatap", "ospfv3", "eigrp_ipv6", "ripng", "hsrp"},
+    "l2_security_monitoring": {"dhcp_snooping", "dai", "dot1x", "lldp", "rep", "snmp", "netflow", "span", "qos", "port_security"},
+    "wireless_advanced": {"wlc", "wpa_enterprise", "wep", "guest_wifi", "beamforming", "meraki", "cellular_5g", "bluetooth"},
+    "automation_controller": {"network_controller", "python_programming", "javascript_programming", "blockly_programming", "tcp_udp_app", "vm_iox"},
+    "voice_collaboration": {"voip", "ip_phone", "call_manager", "linksys_voice"},
+    "industrial_iot": {"mqtt", "real_http", "real_websocket", "visual_scripting", "ptp", "profinet", "l2nat", "cyberobserver", "industrial_firewall"},
+    "physical_media_device": {"coaxial", "cable_dsl", "central_office", "cell_tower", "power_distribution", "hot_swappable", "ios_license"},
 }
 
 CAPABILITY_REQUIRED_ARCHETYPES = {
@@ -330,6 +535,54 @@ CAPABILITY_REQUIRED_ARCHETYPES = {
     "ppp": ["WAN/security edge"],
     "multilayer_switching": ["WAN/security edge", "campus/core"],
     "security_edge": ["WAN/security edge"],
+    "ipv6_slaac": ["IPv6/routing"],
+    "dhcpv6_stateful": ["IPv6/routing"],
+    "dhcpv6_stateless": ["IPv6/routing"],
+    "ipv6_prefix_delegation": ["IPv6/routing"],
+    "ipv6_dns_aaaa": ["IPv6/routing"],
+    "ipv6_tunneling": ["IPv6/routing"],
+    "isatap": ["IPv6/routing"],
+    "ospfv3": ["IPv6/routing"],
+    "eigrp_ipv6": ["IPv6/routing"],
+    "ripng": ["IPv6/routing"],
+    "hsrp": ["IPv6/routing"],
+    "dhcp_snooping": ["L2 security/monitoring"],
+    "dai": ["L2 security/monitoring"],
+    "dot1x": ["L2 security/monitoring"],
+    "lldp": ["L2 security/monitoring"],
+    "rep": ["L2 security/monitoring"],
+    "snmp": ["L2 security/monitoring"],
+    "netflow": ["L2 security/monitoring"],
+    "span": ["L2 security/monitoring"],
+    "qos": ["L2 security/monitoring"],
+    "port_security": ["L2 security/monitoring"],
+    "wlc": ["advanced wireless"],
+    "wpa_enterprise": ["advanced wireless"],
+    "wep": ["advanced wireless"],
+    "guest_wifi": ["advanced wireless"],
+    "beamforming": ["advanced wireless"],
+    "meraki": ["advanced wireless"],
+    "cellular_5g": ["advanced wireless"],
+    "bluetooth": ["advanced wireless"],
+    "network_controller": ["automation/controller"],
+    "python_programming": ["automation/controller"],
+    "javascript_programming": ["automation/controller"],
+    "blockly_programming": ["automation/controller"],
+    "tcp_udp_app": ["automation/controller"],
+    "vm_iox": ["automation/controller"],
+    "voip": ["voice/collaboration"],
+    "ip_phone": ["voice/collaboration"],
+    "call_manager": ["voice/collaboration"],
+    "linksys_voice": ["voice/collaboration"],
+    "mqtt": ["industrial IoT"],
+    "real_http": ["industrial IoT"],
+    "real_websocket": ["industrial IoT"],
+    "visual_scripting": ["industrial IoT"],
+    "ptp": ["industrial IoT"],
+    "profinet": ["industrial IoT"],
+    "l2nat": ["industrial IoT"],
+    "cyberobserver": ["industrial IoT"],
+    "industrial_firewall": ["industrial IoT"],
 }
 
 CAPABILITY_REQUIRED_RUNTIME_FEATURES = {
@@ -346,10 +599,26 @@ CAPABILITY_REQUIRED_RUNTIME_FEATURES = {
     "wireless_client_association": ["workspace_validated", "wireless_runtime"],
     "iot_registration": ["workspace_validated", "iot_runtime"],
     "iot_control": ["workspace_validated", "iot_runtime"],
+    "vpn": ["workspace_validated", "tunnel_runtime"],
+    "ipsec": ["workspace_validated", "tunnel_runtime"],
+    "gre": ["workspace_validated", "tunnel_runtime"],
+    "ppp": ["workspace_validated", "wan_runtime"],
+    "security_edge": ["workspace_validated", "security_runtime"],
+    "multilayer_switching": ["workspace_validated", "multilayer_runtime"],
+    "ipv6_slaac": ["workspace_validated", "ipv6_runtime"],
+    "dhcpv6_stateful": ["workspace_validated", "ipv6_runtime"],
+    "ospfv3": ["workspace_validated", "ipv6_runtime"],
+    "eigrp_ipv6": ["workspace_validated", "ipv6_runtime"],
+    "ripng": ["workspace_validated", "ipv6_runtime"],
+    "hsrp": ["workspace_validated", "ipv6_runtime"],
+    "wep": ["workspace_validated", "wireless_runtime"],
+    "wpa_enterprise": ["workspace_validated", "wireless_runtime"],
 }
 
 
 def _generate_mismatch_reason(status: dict[str, object]) -> str | None:
+    if bool(status.get("report_only")):
+        return "report_only"
     if not bool(status.get("inventory_supported")):
         return "unsupported"
     if bool(status.get("edit_supported")) and not bool(status.get("safe_open_generate_supported")):
@@ -363,6 +632,154 @@ def _generate_mismatch_reason(status: dict[str, object]) -> str | None:
     return "unsupported"
 
 
+def _selected_sample_for_donor(
+    samples: list[SampleDescriptor],
+    selected_donor: str | None,
+) -> SampleDescriptor | None:
+    if not selected_donor:
+        return None
+    needle = str(selected_donor).replace("\\", "/").lower()
+    for sample in samples:
+        candidates = {
+            str(sample.path).replace("\\", "/").lower(),
+            str(sample.relative_path).replace("\\", "/").lower(),
+            str(sample.path).replace("\\", "/").split("/")[-1].lower(),
+            str(sample.relative_path).replace("\\", "/").split("/")[-1].lower(),
+        }
+        if needle in candidates:
+            return sample
+    return None
+
+
+def _has_explicit_iot_registration(plan: IntentPlan) -> bool:
+    return any(
+        op.get("op") == "set_iot_registration"
+        and str(op.get("device", "")).strip()
+        and str(op.get("target", "")).strip()
+        for op in plan.iot_ops
+    )
+
+
+def _has_explicit_iot_control(plan: IntentPlan) -> bool:
+    return any(
+        op.get("op") == "set_iot_rule_state"
+        and str(op.get("device", "")).strip()
+        and str(op.get("rule_name", "")).strip()
+        for op in plan.iot_ops
+    )
+
+
+def _has_explicit_wireless_association(plan: IntentPlan) -> bool:
+    return any(
+        op.get("op") == "associate_wireless_client"
+        and str(op.get("device", "")).strip()
+        and str(op.get("ap", "")).strip()
+        and str(op.get("ssid", "")).strip()
+        for op in plan.wireless_ops
+    )
+
+
+def _has_explicit_advanced_wireless_edit(plan: IntentPlan, capability: str) -> bool:
+    for op in plan.wireless_ops:
+        if op.get("op") != "set_wireless_ssid":
+            continue
+        security = str(op.get("security") or "").strip().lower()
+        if capability == "wep" and security == "wep" and str(op.get("device") or "").strip() and str(op.get("ssid") or "").strip():
+            return True
+        if capability == "wpa_enterprise" and security in {"wpa-enterprise", "wpa2-enterprise", "802.1x"} and str(op.get("device") or "").strip() and str(op.get("ssid") or "").strip():
+            return True
+    return False
+
+
+def _has_explicit_wan_security_intent(plan: IntentPlan) -> bool:
+    capabilities = set(plan.capabilities)
+    prompt_lower = str(plan.prompt or "").lower()
+    return (
+        plan.network_style == "wan_security"
+        or bool(capabilities & {"vpn", "ipsec", "gre", "ppp", "security_edge", "multilayer_switching"})
+        or any(token in prompt_lower for token in ["site-to-site", "firewall", "asa", "cloud", "multilayer"])
+    )
+
+
+def _has_explicit_ipv6_operation(plan: IntentPlan, capability: str) -> bool:
+    operation_map = {
+        "ipv6_slaac": {"enable_ipv6_unicast_routing", "set_ipv6_address", "set_ipv6_slaac"},
+        "dhcpv6_stateful": {"set_dhcpv6_pool"},
+        "ospfv3": {"set_ospfv3_interface"},
+        "eigrp_ipv6": {"set_eigrp_ipv6_interface"},
+        "ripng": {"set_ripng_interface"},
+        "hsrp": {"set_hsrp_ipv6"},
+    }
+    expected_ops = operation_map.get(capability, set())
+    return any(str(op.get("op")) in expected_ops for op in plan.router_ops)
+
+
+def _selected_donor_capability_override(
+    plan: IntentPlan,
+    capability: str,
+    selected_sample: SampleDescriptor | None,
+) -> bool:
+    if selected_sample is None:
+        return False
+    device_families = sorted({_device_family_for_type(device.get("type", "")) for device in selected_sample.devices if device.get("type")})
+    sample_capabilities = set(_expanded_sample_capabilities(selected_sample, device_families))
+    sample_capabilities.update(str(item) for item in selected_sample.validated_edit_capabilities if str(item).strip())
+    archetypes = {str(item) for item in selected_sample.archetype_tags if str(item).strip()}
+    runtime_features = {str(item) for item in selected_sample.runtime_features if str(item).strip()}
+
+    if capability == "iot":
+        return (
+            bool(archetypes & {"IoT/home gateway"})
+            and bool(sample_capabilities & {"iot", "iot_registration", "iot_control"})
+            and bool(runtime_features & {"iot_runtime"})
+            and (_has_explicit_iot_registration(plan) or _has_explicit_iot_control(plan))
+        )
+    if capability == "iot_registration":
+        return (
+            "IoT/home gateway" in archetypes
+            and "iot_registration" in sample_capabilities
+            and "iot_runtime" in runtime_features
+            and _has_explicit_iot_registration(plan)
+        )
+    if capability == "iot_control":
+        return (
+            "IoT/home gateway" in archetypes
+            and "iot_control" in sample_capabilities
+            and "iot_runtime" in runtime_features
+            and _has_explicit_iot_control(plan)
+        )
+    if capability == "wireless_client_association":
+        return (
+            bool(archetypes & {"IoT/home gateway", "wireless-heavy"})
+            and "wireless_client_association" in sample_capabilities
+            and "wireless_runtime" in runtime_features
+            and _has_explicit_wireless_association(plan)
+        )
+    wan_runtime_by_capability = {
+        "vpn": {"tunnel_runtime", "security_runtime", "wan_runtime"},
+        "ipsec": {"tunnel_runtime", "security_runtime"},
+        "gre": {"tunnel_runtime", "wan_runtime"},
+        "ppp": {"wan_runtime"},
+        "security_edge": {"security_runtime"},
+        "multilayer_switching": {"multilayer_runtime"},
+    }
+    if capability in wan_runtime_by_capability:
+        return (
+            "WAN/security edge" in archetypes
+            and capability in sample_capabilities
+            and bool(runtime_features & wan_runtime_by_capability[capability])
+            and _has_explicit_wan_security_intent(plan)
+        )
+    if capability in IPV6_DONOR_BACKED_CAPABILITIES:
+        return (
+            "IPv6/routing" in archetypes
+            and capability in sample_capabilities
+            and "ipv6_runtime" in runtime_features
+            and _has_explicit_ipv6_operation(plan, capability)
+        )
+    return False
+
+
 def _best_maturity_level(status: dict[str, object]) -> str:
     level = str(status.get("best_maturity_level") or "").strip()
     if level in MATURITY_RANK:
@@ -381,6 +798,46 @@ def _best_maturity_level(status: dict[str, object]) -> str:
 
 
 def _recommended_next_action_for_capability(capability: str, mismatch_reason: str | None) -> str:
+    if mismatch_reason == "report_only":
+        return f"Keep {capability} in atlas/report mode until donor-backed edit or generate evidence exists."
+    if capability in {"vpn", "ipsec", "gre", "ppp", "security_edge", "multilayer_switching"}:
+        if mismatch_reason == "supported_but_donor_limited":
+            return f"Provide a WAN/security edge donor with reusable ASA/cloud/serial or tunnel skeleton for {capability}."
+        if mismatch_reason == "supported_but_acceptance_gated":
+            return f"Keep {capability} in report/selection flow until a WAN/security edge donor is acceptance-backed."
+        return f"Prefer a WAN/security edge donor with explicit {capability} evidence before strict generate."
+    if capability in IPV6_DONOR_BACKED_CAPABILITIES:
+        if mismatch_reason == "supported_in_edit_only":
+            return f"Use explicit edit commands for {capability}; strict prompt generate still needs a selected IPv6/routing donor."
+        if mismatch_reason == "supported_but_donor_limited":
+            return f"Provide an IPv6/routing donor with reusable IPv6 interface and routing skeleton for {capability}."
+        if mismatch_reason == "supported_but_acceptance_gated":
+            return f"Keep {capability} in report/edit flow until an IPv6/routing donor is acceptance-backed."
+        return f"Prefer an IPv6/routing donor and explicit router/interface targets before strict generate for {capability}."
+    if capability in L2_SECURITY_MONITORING_EDIT_PROVEN_CAPABILITIES:
+        if mismatch_reason == "supported_in_edit_only":
+            return f"Use explicit edit commands for {capability}; strict prompt generate still needs an acceptance-backed L2 security/monitoring donor."
+        if mismatch_reason == "supported_but_donor_limited":
+            return f"Provide an L2 security/monitoring donor with reusable switch/router monitoring skeleton for {capability}."
+        return f"Keep {capability} constrained to edit/inventory proof until an L2 security/monitoring donor is acceptance-backed."
+    if capability in WIRELESS_ADVANCED_EDIT_PROVEN_CAPABILITIES:
+        if mismatch_reason == "supported_in_edit_only":
+            return f"Use explicit wireless edit commands for {capability}; strict prompt generate still needs an acceptance-backed advanced wireless donor."
+        if mismatch_reason == "supported_but_donor_limited":
+            return f"Provide an advanced wireless donor with reusable AP/router/WLC skeleton for {capability}."
+        return f"Keep {capability} constrained to explicit wireless edit proof until an advanced wireless donor is acceptance-backed."
+    if capability == "iot_registration":
+        if mismatch_reason == "supported_but_acceptance_gated":
+            return "Use an IoT/home gateway donor and explicitly name the thing plus gateway/server target before strict generate."
+        return "Prefer an IoT/home gateway donor and explicitly name the thing plus gateway/server target."
+    if capability == "iot_control":
+        if mismatch_reason == "supported_but_acceptance_gated":
+            return "Use a donor that already contains IoT rules and explicitly name the rule-bearing device before strict generate."
+        return "Prefer an IoT/home gateway donor with existing rule/control structure before strict generate."
+    if capability == "wireless_client_association":
+        if mismatch_reason == "supported_but_acceptance_gated":
+            return "Use a donor-backed wireless prompt that explicitly names the client, AP/router, and SSID before strict generate."
+        return "Prefer a wireless-heavy or IoT/home gateway donor and explicitly name the client, AP/router, and SSID."
     if mismatch_reason == "supported_in_edit_only":
         return f"Use donor-backed edit flow for {capability} until safe-open generate coverage is raised."
     if mismatch_reason == "supported_but_donor_limited":
@@ -528,6 +985,7 @@ def build_coverage_gap_report(
     selected_donor: str | None = None,
 ) -> CoverageGapReport:
     iot_acceptance_gated = {"iot", "iot_registration", "iot_control"}
+    selected_sample = _selected_sample_for_donor(samples, selected_donor)
     matrix = build_capability_matrix(samples)
     by_capability: dict[str, list[CapabilityMatrixEntry]] = {}
     by_family: dict[str, list[CapabilityMatrixEntry]] = {}
@@ -544,6 +1002,14 @@ def build_coverage_gap_report(
     capability_statuses: list[dict[str, object]] = []
     for capability in requested_capabilities:
         provider_families = _provider_families_for_capability(capability, requested_families)
+        selected_donor_backed = _selected_donor_capability_override(plan, capability, selected_sample)
+        wireless_edit_proven_only = (
+            capability in WIRELESS_ADVANCED_EDIT_PROVEN_CAPABILITIES
+            and _has_explicit_advanced_wireless_edit(plan, capability)
+            and not selected_donor_backed
+        )
+        edit_proven_only = (capability in EDIT_PROVEN_REPORT_CAPABILITIES or wireless_edit_proven_only) and not selected_donor_backed
+        report_only = capability in REPORT_ONLY_CAPABILITIES and not selected_donor_backed and not edit_proven_only
         matching_entries = [
             entry
             for entry in by_capability.get(capability, [])
@@ -552,8 +1018,14 @@ def build_coverage_gap_report(
         if matching_entries:
             supported_capabilities.append(capability)
             best_entry = max(matching_entries, key=lambda entry: MATURITY_RANK[entry.maturity_level])
-            acceptance_verified = any(entry.maturity_level == "acceptance-verified" for entry in matching_entries) and capability not in iot_acceptance_gated
-            if best_entry.maturity_level == "safe-open-generate-supported":
+            acceptance_verified = (
+                (any(entry.maturity_level == "acceptance-verified" for entry in matching_entries) and capability not in iot_acceptance_gated)
+                or selected_donor_backed
+            )
+            if report_only or edit_proven_only:
+                acceptance_verified = False
+            requires_curated = best_entry.maturity_level == "safe-open-generate-supported" and not selected_donor_backed and not edit_proven_only
+            if requires_curated:
                 requires_curated_donor.append(capability)
             if not acceptance_verified:
                 requires_manual_acceptance.append(capability)
@@ -562,18 +1034,78 @@ def build_coverage_gap_report(
                     "capability": capability,
                     "provider_families": sorted(provider_families),
                     "matching_device_families": sorted({entry.device_family for entry in matching_entries}),
-                    "best_maturity_level": best_entry.maturity_level,
+                    "best_maturity_level": "inventory-supported" if report_only else "config-mutation-supported" if edit_proven_only else best_entry.maturity_level,
                     "inventory_supported": any(MATURITY_RANK[entry.maturity_level] >= MATURITY_RANK["inventory-supported"] for entry in matching_entries),
-                    "edit_supported": any(MATURITY_RANK[entry.maturity_level] >= MATURITY_RANK["config-mutation-supported"] for entry in matching_entries),
-                    "config_mutation_supported": any(MATURITY_RANK[entry.maturity_level] >= MATURITY_RANK["config-mutation-supported"] for entry in matching_entries),
-                    "safe_open_generate_supported": any(MATURITY_RANK[entry.maturity_level] >= MATURITY_RANK["safe-open-generate-supported"] for entry in matching_entries),
+                    "edit_supported": True if edit_proven_only else False if report_only else any(MATURITY_RANK[entry.maturity_level] >= MATURITY_RANK["config-mutation-supported"] for entry in matching_entries),
+                    "config_mutation_supported": True if edit_proven_only else False if report_only else any(MATURITY_RANK[entry.maturity_level] >= MATURITY_RANK["config-mutation-supported"] for entry in matching_entries),
+                    "safe_open_generate_supported": False if report_only or edit_proven_only else any(MATURITY_RANK[entry.maturity_level] >= MATURITY_RANK["safe-open-generate-supported"] for entry in matching_entries),
                     "acceptance_verified": acceptance_verified,
-                    "requires_curated_donor": best_entry.maturity_level == "safe-open-generate-supported",
+                    "requires_curated_donor": requires_curated,
                     "requires_manual_acceptance": not acceptance_verified,
+                    "report_only": report_only,
                     "recommended_donors": list(dict.fromkeys(donor for entry in matching_entries for donor in entry.accepted_donors))[:10],
                     "known_limitations": list(dict.fromkeys(item for entry in matching_entries for item in entry.known_limitations)),
                 }
             )
+        elif edit_proven_only:
+            supported_capabilities.append(capability)
+            capability_statuses.append(
+                {
+                    "capability": capability,
+                    "provider_families": sorted(provider_families),
+                    "matching_device_families": sorted(provider_families),
+                    "best_maturity_level": "config-mutation-supported",
+                    "inventory_supported": True,
+                    "edit_supported": True,
+                    "config_mutation_supported": True,
+                    "safe_open_generate_supported": False,
+                    "acceptance_verified": False,
+                    "requires_curated_donor": False,
+                    "requires_manual_acceptance": True,
+                    "report_only": False,
+                    "recommended_donors": [],
+                    "known_limitations": ["editor-proven without sample-backed donor selection"],
+                }
+            )
+        elif report_only:
+            supported_capabilities.append(capability)
+            capability_statuses.append(
+                {
+                    "capability": capability,
+                    "provider_families": sorted(provider_families),
+                    "matching_device_families": sorted(provider_families),
+                    "best_maturity_level": "inventory-supported",
+                    "inventory_supported": True,
+                    "edit_supported": False,
+                    "config_mutation_supported": False,
+                    "safe_open_generate_supported": False,
+                    "acceptance_verified": False,
+                    "requires_curated_donor": False,
+                    "requires_manual_acceptance": True,
+                    "report_only": True,
+                    "recommended_donors": [],
+                    "known_limitations": ["report-supported without decode-backed donor selection"],
+                }
+            )
+        elif selected_donor_backed and selected_sample is not None:
+            supported_capabilities.append(capability)
+            capability_statuses.append(
+                {
+                    "capability": capability,
+                    "provider_families": sorted(provider_families),
+                    "matching_device_families": sorted({family for family in (selected_sample.device_families or []) if not provider_families or family in provider_families}),
+                    "best_maturity_level": selected_sample.apply_safety_level or "safe-open-generate-supported",
+                    "inventory_supported": True,
+                    "edit_supported": True,
+                    "config_mutation_supported": True,
+                    "safe_open_generate_supported": True,
+                    "acceptance_verified": True,
+                    "requires_curated_donor": False,
+                    "requires_manual_acceptance": False,
+                    "recommended_donors": [selected_sample.relative_path],
+                    "known_limitations": [],
+                }
+            )
         else:
             unsupported_capabilities.append(capability)
             capability_statuses.append(
@@ -694,6 +1226,10 @@ def build_inventory_capability_report(payload: dict[str, Any]) -> dict[str, obje
         capabilities.add("acl")
     if payload.get("topology_summary", {}).get("network_style") == "wan_security":
         capabilities.update({"vpn", "ipsec", "gre", "ppp"})
+    for routing_details in payload.get("routing", {}).values():
+        capabilities.update(str(capability) for capability in routing_details.get("capabilities", []) if str(capability).strip())
+    for l2_details in payload.get("l2_security_monitoring", {}).values():
+        capabilities.update(str(capability) for capability in l2_details.get("capabilities", []) if str(capability).strip())
     return {
         "device_families": families,
         "capabilities": sorted(capabilities),