packet-tracer-skill 0.2.1 → 0.2.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (43) hide show
  1. package/CHANGELOG.md +53 -2
  2. package/README.md +443 -124
  3. package/docs/automation-controller-proof.md +35 -0
  4. package/docs/campus-donor-proof.md +103 -0
  5. package/docs/curated-donor-registry.md +37 -0
  6. package/docs/generate-ready-pilot-design.md +30 -0
  7. package/docs/github-launch-ops-0.2.1.md +45 -0
  8. package/docs/github-launch-ops-0.2.2.md +42 -0
  9. package/docs/github-metadata.md +23 -6
  10. package/docs/home-iot-donor-proof.md +64 -0
  11. package/docs/industrial-programming-proof.md +48 -0
  12. package/docs/ipv4-routing-management-proof.md +37 -0
  13. package/docs/l2-resiliency-bgp-proof.md +60 -0
  14. package/docs/l2-security-qos-proof.md +59 -0
  15. package/docs/launch-announcement-0.2.2.md +15 -0
  16. package/docs/packet-tracer-feature-gap-atlas.md +244 -0
  17. package/docs/post-launch-follow-up.md +39 -0
  18. package/docs/publish-preview-roadmap.md +20 -17
  19. package/docs/release-checklist.md +32 -17
  20. package/docs/release-notes-0.2.1.md +7 -6
  21. package/docs/release-notes-0.2.2.md +26 -0
  22. package/docs/release-notes-0.2.3.md +59 -0
  23. package/docs/runtime-truth.md +31 -0
  24. package/docs/security-edge-deepening-proof.md +65 -0
  25. package/docs/voice-collaboration-proof.md +38 -0
  26. package/docs/wan-security-donor-proof.md +58 -0
  27. package/docs/wireless-advanced-proof.md +60 -0
  28. package/examples/README.md +11 -8
  29. package/examples/gallery.md +9 -3
  30. package/examples/index.json +3 -3
  31. package/package.json +20 -1
  32. package/references/curated-donor-registry.json +5 -2
  33. package/references/packettracer-feature-atlas.json +183 -0
  34. package/references/scenario-fixture-corpus.json +1 -0
  35. package/scripts/build_examples_index.py +26 -15
  36. package/scripts/coverage_matrix.py +1054 -25
  37. package/scripts/feature_atlas.py +293 -0
  38. package/scripts/generate_pkt.py +491 -34
  39. package/scripts/intent_parser.py +798 -8
  40. package/scripts/pkt_editor.py +651 -0
  41. package/scripts/remote_search.py +197 -21
  42. package/scripts/runtime_doctor.py +83 -10
  43. package/scripts/sample_catalog.py +266 -6
@@ -0,0 +1,38 @@
1
+ # Voice Collaboration Proof
2
+
3
+ This proof covers a narrow Packet Tracer voice/collaboration wave. It is explicit-edit proof, not broad VoIP topology generation.
4
+
5
+ ## What This Proves
6
+
7
+ - The Cisco `voip_local_all_phone_devices.pkt` sample exposes IP Phone, Home VoIP, Analog Phone, and router telephony evidence.
8
+ - Inventory can report voice devices and IOS telephony config without mutating phone GUI internals.
9
+ - Explicit IOS voice commands can roundtrip through Packet Tracer XML:
10
+ - `telephony-service`
11
+ - `ephone-dn`
12
+ - `ephone`
13
+ - `dial-peer voice`
14
+ - `voip`, `ip_phone`, and `call_manager` can be treated as `edit_proven` for explicit IOS voice edits.
15
+ - `voip`, `ip_phone`, and `call_manager` are `donor_backed_ready` for explicit IOS voice edits because the proof gate has sample, decode, parser, and editor roundtrip evidence.
16
+
17
+ ## What This Does Not Prove
18
+
19
+ - It does not claim full Call Manager or VoIP topology generation.
20
+ - It does not mutate IP Phone GUI internals.
21
+ - It does not claim Linksys voice mutation.
22
+ - It does not make any voice/collaboration feature `generate_ready`.
23
+
24
+ ## Explicit Edit Command Shape
25
+
26
+ ```text
27
+ set "Router0" telephony service source-address 192.168.10.1 port 2000 max-ephones 4 max-dn 4
28
+ set "Router0" ephone-dn 1 number 1001
29
+ set "Router0" ephone 1 mac 0001.42AA.BBCC button 1:1
30
+ set "Router0" dial-peer voice 10 destination-pattern 2... session-target ipv4:10.0.0.2
31
+ ```
32
+
33
+ ## Public Contract
34
+
35
+ - `voip`, `ip_phone`, and `call_manager` can report `edit_supported=true` and `donor_backed_ready=true` only for explicit IOS voice edit commands.
36
+ - `generate_supported=false` remains the expected result.
37
+ - `generate_mismatch_reason=supported_in_edit_only` is the intended parity wording.
38
+ - `linksys_voice` remains report-only until separate decode and editor proof exists.
@@ -0,0 +1,58 @@
1
+ # WAN/Security Edge Donor Proof
2
+
3
+ ## Proof Goal
4
+ This proof records the current `wan_security_edge` truth after the Home IoT internal gate. It is a report/selection and donor-backed readiness proof, not a broad synthetic WAN/security generator claim.
5
+
6
+ ## Current Inventory And Report Proof
7
+ - The fixture prompt `wan security edge, multilayer switch, cloud, firewall/ASA, GRE, PPP, site-to-site VPN, IPsec, ACL, NAT` maps to `wan_security_edge`.
8
+ - The planner recognizes `vpn`, `ipsec`, `gre`, `ppp`, `multilayer_switching`, and `security_edge` as the expected capability family.
9
+ - Static Packet Tracer samples with VPN/IPSec/GRE/PPP, ASA/security, WAN/cloud, and multilayer switch evidence are treated as `WAN/security edge` donors.
10
+ - Capability parity remains conservative when no selected donor is available: the planner reports donor-limited readiness instead of guessing a final `.pkt`.
11
+
12
+ ## Donor-Backed Readiness Interpretation
13
+ WAN/security readiness can only rise when a selected donor is already aligned with `WAN/security edge` and contains the requested capability evidence plus the required runtime feature:
14
+
15
+ - `vpn`, `ipsec`, `gre`: tunnel-capable donor evidence
16
+ - `ppp`: WAN/PPP donor evidence
17
+ - `security_edge`: ASA/security donor evidence
18
+ - `multilayer_switching`: multilayer switch donor evidence
19
+
20
+ The prompt must explicitly request WAN/security intent, such as VPN, IPsec, GRE, PPP, ASA/firewall, cloud, multilayer, or site-to-site wording.
21
+
22
+ ## What This Proves
23
+ - WAN/security prompts are family-correct and do not drift into `service_heavy`.
24
+ - Packet Tracer sample inventory can identify WAN/security donor candidates.
25
+ - Selected-donor readiness can be represented without changing the public JSON contract.
26
+ - Refusal and remediation now point toward reusable ASA/cloud/serial/tunnel donor skeletons.
27
+ - Explicit router edit commands can roundtrip a narrow WAN/security subset:
28
+ - GRE tunnel interface basics
29
+ - PPP serial encapsulation
30
+ - IPSec transform-set lines
31
+ - site-to-site VPN crypto-map skeleton binding
32
+
33
+ ## What This Does Not Prove
34
+ - It does not claim full synthetic VPN/IPSec/GRE/PPP configuration generation.
35
+ - It does not claim that every ASA/firewall or multilayer switch feature is editable.
36
+ - It does not claim ASA ACL/NAT, ASA service policy, CBAC, ZFW, or multilayer switching edit support.
37
+ - It does not allow `reference_only` donors as final apply donors.
38
+ - It does not change the `single-donor` final `.pkt` apply rule.
39
+
40
+ ## Edit-Proven Commands
41
+
42
+ ```text
43
+ set R1 gre tunnel Tunnel0 source 10.0.0.1 destination 10.0.0.2 ip 172.16.0.1/30
44
+ set R1 ppp interface Serial0/0/0 authentication chap
45
+ set R1 ipsec transform-set TS esp-aes esp-sha-hmac
46
+ set R1 crypto map VPNMAP 10 peer 203.0.113.2 transform-set TS match ACL_VPN interface Serial0/0/0
47
+ ```
48
+
49
+ These commands are edit-proven only. They intentionally report
50
+ `generate_supported=false` and `generate_mismatch_reason=supported_in_edit_only`
51
+ until selected-donor acceptance evidence exists.
52
+
53
+ ## Next Constrained Edit Candidates
54
+ - ASA ACL/NAT mutation on an existing security-edge donor.
55
+ - SVI/routed-port mutation on an existing multilayer switch donor.
56
+ - CBAC/ZFW policy mutation on an existing routed security donor.
57
+
58
+ These candidates need separate roundtrip proof before they become release claims.
@@ -0,0 +1,60 @@
1
+ # Advanced Wireless Proof
2
+
3
+ This proof records the current Packet Tracer 9.0 advanced wireless boundary.
4
+ It is intentionally narrower than a generic WLC or enterprise Wi-Fi generation
5
+ claim.
6
+
7
+ ## Current Proof
8
+
9
+ The feature atlas recognizes advanced wireless sample families and prompt
10
+ signals for:
11
+
12
+ - `wlc`
13
+ - `wpa_enterprise`
14
+ - `wep`
15
+ - `guest_wifi`
16
+ - `beamforming`
17
+ - `meraki`
18
+ - `cellular_5g`
19
+ - `bluetooth`
20
+
21
+ The edit-proven subset is limited to explicit wireless SSID/security mutation
22
+ where the target device and SSID are deterministic:
23
+
24
+ ```powershell
25
+ python .\scripts\generate_pkt.py --parity-report "set AP1 ssid LEGACY security wep passphrase abc12345 channel 6"
26
+ python .\scripts\generate_pkt.py --parity-report "set WLC1 ssid CORP security wpa-enterprise radius 192.168.1.10 secret radius123 channel 11"
27
+ ```
28
+
29
+ Expected product interpretation:
30
+
31
+ - `wep` can report `edit_supported=true`.
32
+ - `wpa_enterprise` can report `edit_supported=true`.
33
+ - Both remain `generate_supported=false`.
34
+ - The deterministic mismatch reason is `supported_in_edit_only`.
35
+
36
+ ## What This Proves
37
+
38
+ - The parser can classify advanced wireless prompts without drifting into
39
+ `service_heavy`.
40
+ - WEP and WPA Enterprise/RADIUS can be represented as explicit edit intent.
41
+ - The atlas can promote a narrow advanced-wireless subset to `edit_proven`.
42
+ - WLC, Meraki, cellular, Bluetooth, beamforming, and guest Wi-Fi stay visible
43
+ as report-level Packet Tracer features.
44
+
45
+ ## What This Does Not Prove
46
+
47
+ - It does not prove broad WLC/controller configuration generation.
48
+ - It does not prove cellular, Bluetooth, Meraki, beamforming, or guest Wi-Fi edit
49
+ mutations.
50
+ - It does not prove full WPA Enterprise AAA/RADIUS topology construction.
51
+ - It does not make any advanced wireless feature `generate_ready`.
52
+
53
+ ## Next Safe Actions
54
+
55
+ - Add donor-backed inventory proof for WLC and Meraki samples before any edit
56
+ promotion.
57
+ - Keep cellular and Bluetooth in report mode until target resolution and device
58
+ runtime behavior are deterministic.
59
+ - Promote only one feature at a time from report-only to edit-proven, then to
60
+ donor-backed readiness after acceptance evidence exists.
@@ -32,10 +32,10 @@ Current curated example:
32
32
  Visual snapshot of the same lab opened inside Cisco Packet Tracer.
33
33
 
34
34
  Additional curated examples:
35
- - `home_iot_cli_edit_v1.inventory.json`
36
- Home gateway and IoT registration example focused on gateway-backed device onboarding.
37
- - `screenshots/home_iot_cli_edit_v1.png`
38
- Topology snapshot for the Home IoT example.
35
+ - `home_iot_cli_edit_v1.inventory.json`
36
+ Home gateway and IoT registration example focused on donor-backed, constrained gateway device onboarding.
37
+ - `screenshots/home_iot_cli_edit_v1.png`
38
+ Topology snapshot for the Home IoT example.
39
39
  - `service_heavy_cli_edit_v1.inventory.json`
40
40
  Service-heavy server example focused on DNS, DHCP, FTP, email, syslog, AAA, and related service metadata.
41
41
  - `screenshots/service_heavy_cli_edit_v1.png`
@@ -62,11 +62,14 @@ Generated outputs:
62
62
  Gallery families:
63
63
  - `campus`
64
64
  VLAN, management, ACL, server services, and wireless edits.
65
- - `home_iot`
66
- Home gateway, IoT things, and registration-focused examples.
65
+ - `home_iot`
66
+ Home gateway, IoT things, registration, and constrained donor-backed wireless examples.
67
67
  - `service_heavy`
68
68
  Server-centric service labs with richer metadata.
69
69
 
70
- Launch-prep references:
71
- - `..\docs\hero-demo-plan.md`
70
+ Launch references:
71
+ - `..\docs\hero-demo-plan.md`
72
72
  - `..\docs\release-notes-0.2.1.md`
73
+ - `..\docs\campus-donor-proof.md`
74
+ - `..\docs\home-iot-donor-proof.md`
75
+ - `..\docs\wan-security-donor-proof.md`
@@ -12,6 +12,12 @@ Hero visual:
12
12
 
13
13
  - [complex campus screenshot](screenshots/complex_campus_master_edit_v4.png)
14
14
 
15
+ Canonical donor proof:
16
+
17
+ - [campus donor proof](../docs/campus-donor-proof.md)
18
+ - [home IoT donor proof](../docs/home-iot-donor-proof.md)
19
+ - [WAN/security donor proof](../docs/wan-security-donor-proof.md)
20
+
15
21
  | Title | Family | Capabilities | Image | Inventory |
16
22
  | --- | --- | --- | --- | --- |
17
23
  | Complex Campus | `campus` | management_vlan, telnet, acl, server_dns, server_email, server_aaa, wireless_mutation | [screenshot](screenshots/complex_campus_master_edit_v4.png) | [manifest](complex_campus_master_edit_v4.inventory.json) |
@@ -22,10 +28,10 @@ Hero visual:
22
28
  | | | `decision=known_working_example | donor_origin=donor-backed` | | |
23
29
  | | | `runtime=donor-backed example artifact` | | |
24
30
  | Home IoT | `home_iot` | iot, iot_registration, wireless_ap | [screenshot](screenshots/home_iot_cli_edit_v1.png) | [manifest](home_iot_cli_edit_v1.inventory.json) |
25
- | | | Home gateway and IoT device onboarding with gateway-backed registration state. | | |
26
- | | | `known_working_example | donor=donor-backed | capabilities=iot, iot_registration, wireless_ap` | | |
31
+ | | | Home gateway and IoT device onboarding with donor-backed registration state and constrained wireless readiness. | | |
32
+ | | | `known_working_example | donor=donor-backed | capabilities=iot, iot_registration, wireless_ap | mode=donor-backed constrained-generate` | | |
27
33
  | | | `home_iot_complex | known_working_example | family=home_iot` | | |
28
- | | | `iot=generate-ready, iot_registration=generate-ready, wireless_ap=generate-ready` | | |
34
+ | | | `iot=generate-ready, iot_registration=donor-backed constrained-generate, wireless_ap=generate-ready` | | |
29
35
  | | | `decision=known_working_example | donor_origin=donor-backed` | | |
30
36
  | | | `runtime=donor-backed example artifact` | | |
31
37
  | Service Heavy | `service_heavy` | server_dns, server_dhcp, server_ftp, server_email, server_syslog, server_aaa | [screenshot](screenshots/service_heavy_cli_edit_v1.png) | [manifest](service_heavy_cli_edit_v1.inventory.json) |
@@ -46,7 +46,7 @@
46
46
  "name": "home_iot_cli_edit_v1",
47
47
  "title": "Home IoT",
48
48
  "scenario_family": "home_iot",
49
- "summary": "Home gateway and IoT device onboarding with gateway-backed registration state.",
49
+ "summary": "Home gateway and IoT device onboarding with donor-backed registration state and constrained wireless readiness.",
50
50
  "capabilities": [
51
51
  "iot",
52
52
  "iot_registration",
@@ -59,11 +59,11 @@
59
59
  ],
60
60
  "acceptance_rank": 3,
61
61
  "acceptance_label": "known_working_example",
62
- "acceptance_excerpt": "known_working_example | donor=donor-backed | capabilities=iot, iot_registration, wireless_ap",
62
+ "acceptance_excerpt": "known_working_example | donor=donor-backed | capabilities=iot, iot_registration, wireless_ap | mode=donor-backed constrained-generate",
63
63
  "donor_origin": "donor-backed",
64
64
  "fixture_name": "home_iot_complex",
65
65
  "matrix_excerpt": "home_iot_complex | known_working_example | family=home_iot",
66
- "parity_excerpt": "iot=generate-ready, iot_registration=generate-ready, wireless_ap=generate-ready",
66
+ "parity_excerpt": "iot=generate-ready, iot_registration=donor-backed constrained-generate, wireless_ap=generate-ready",
67
67
  "decision_excerpt": "decision=known_working_example | donor_origin=donor-backed",
68
68
  "runtime_excerpt": "runtime=donor-backed example artifact",
69
69
  "inventory_json": "examples/home_iot_cli_edit_v1.inventory.json",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "packet-tracer-skill",
3
- "version": "0.2.1",
3
+ "version": "0.2.3",
4
4
  "private": false,
5
5
  "description": "Donor-backed Cisco Packet Tracer 9.x skill for natural-language planning, safe-open generation, editing, parity reporting, and runtime diagnostics across coding hosts.",
6
6
  "keywords": [
@@ -81,14 +81,33 @@
81
81
  "examples/*.inventory.json",
82
82
  "examples/screenshots/*.png",
83
83
  "docs/curated-donor-registry.md",
84
+ "docs/campus-donor-proof.md",
85
+ "docs/home-iot-donor-proof.md",
86
+ "docs/wan-security-donor-proof.md",
87
+ "docs/wireless-advanced-proof.md",
88
+ "docs/industrial-programming-proof.md",
89
+ "docs/automation-controller-proof.md",
90
+ "docs/voice-collaboration-proof.md",
91
+ "docs/l2-resiliency-bgp-proof.md",
92
+ "docs/ipv4-routing-management-proof.md",
93
+ "docs/l2-security-qos-proof.md",
94
+ "docs/security-edge-deepening-proof.md",
95
+ "docs/generate-ready-pilot-design.md",
96
+ "docs/packet-tracer-feature-gap-atlas.md",
84
97
  "docs/discovery-keywords.md",
85
98
  "docs/github-discussions-setup.md",
99
+ "docs/github-launch-ops-0.2.1.md",
100
+ "docs/github-launch-ops-0.2.2.md",
86
101
  "docs/github-metadata.md",
87
102
  "docs/hero-demo-plan.md",
88
103
  "docs/launch-announcement-0.2.1.md",
104
+ "docs/launch-announcement-0.2.2.md",
105
+ "docs/post-launch-follow-up.md",
89
106
  "docs/publish-preview-roadmap.md",
90
107
  "docs/release-checklist.md",
91
108
  "docs/release-notes-0.2.1.md",
109
+ "docs/release-notes-0.2.2.md",
110
+ "docs/release-notes-0.2.3.md",
92
111
  "docs/runtime-truth.md"
93
112
  ],
94
113
  "engines": {
@@ -20,7 +20,9 @@
20
20
  "acceptance_fixtures": ["campus_core_complex"],
21
21
  "acceptance_notes": [
22
22
  "Known working campus example with public screenshot and inventory artifact.",
23
- "Use when donor root contains the exported complex campus .pkt example."
23
+ "Use when donor root contains the exported complex campus .pkt example.",
24
+ "Local inventory smoke revalidated the matching campus donor artifact before the public donor proof note was added.",
25
+ "See docs/campus-donor-proof.md for the public proof note: inventory succeeds, but generalized campus prompt selection still fails on layout_reuse_too_weak."
24
26
  ],
25
27
  "provenance": "known-working-example:complex_campus_master_edit_v4"
26
28
  },
@@ -40,7 +42,8 @@
40
42
  "acceptance_fixtures": ["home_iot_complex"],
41
43
  "acceptance_notes": [
42
44
  "Known working home IoT example with gateway-backed registration state.",
43
- "Use when donor root contains the exported Home IoT showcase lab."
45
+ "Use when donor root contains the exported Home IoT showcase lab.",
46
+ "See docs/home-iot-donor-proof.md for the public proof note: constrained donor-backed generate is valid, but broad smart-home synthesis is still intentionally out of scope."
44
47
  ],
45
48
  "provenance": "known-working-example:home_iot_cli_edit_v1"
46
49
  },
@@ -0,0 +1,183 @@
1
+ {
2
+ "atlas_version": "1.0",
3
+ "target_packet_tracer_version": "9.0.0.0810",
4
+ "support_policy": "Truth-first: features start as inventory/report truth and only move to edit or generate when donor-backed acceptance evidence exists.",
5
+ "status_contract": ["not_mapped", "inventory_known", "report_supported", "edit_proven", "donor_backed_ready", "generate_ready"],
6
+ "feature_groups": [
7
+ {
8
+ "id": "ipv6_routing",
9
+ "label": "IPv6 And Routing",
10
+ "scenario_family": "ipv6_routing",
11
+ "wave": 2,
12
+ "features": [
13
+ {"id": "ipv6_slaac", "capability": "ipv6_slaac", "label": "IPv6 SLAAC", "sample_path_keywords": ["ipv6_slaac", "slaac"], "support_ceiling": "edit_proven"},
14
+ {"id": "dhcpv6_stateful", "capability": "dhcpv6_stateful", "label": "DHCPv6 stateful", "sample_path_keywords": ["stateful_dhcpv6"], "support_ceiling": "edit_proven"},
15
+ {"id": "dhcpv6_stateless", "capability": "dhcpv6_stateless", "label": "DHCPv6 stateless", "sample_path_keywords": ["stateless_dhcpv6"], "support_ceiling": "report_supported"},
16
+ {"id": "ipv6_prefix_delegation", "capability": "ipv6_prefix_delegation", "label": "IPv6 prefix delegation", "sample_path_keywords": ["prefix_delegation"], "support_ceiling": "report_supported"},
17
+ {"id": "ipv6_dns_aaaa", "capability": "ipv6_dns_aaaa", "label": "IPv6 DNS AAAA records", "sample_path_keywords": ["dns-a-and-aaaa", "aaaa"], "support_ceiling": "report_supported"},
18
+ {"id": "ipv6_tunneling", "capability": "ipv6_tunneling", "label": "IPv6 tunneling", "sample_path_keywords": ["ipv6ip tunneling", "ipv6ip_"], "support_ceiling": "report_supported"},
19
+ {"id": "isatap", "capability": "isatap", "label": "ISATAP", "sample_path_keywords": ["isatap"], "support_ceiling": "report_supported"},
20
+ {"id": "ospfv3", "capability": "ospfv3", "label": "OSPFv3", "sample_path_keywords": ["ospfv3", "ipv6_ospf"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
21
+ {"id": "eigrp_ipv6", "capability": "eigrp_ipv6", "label": "EIGRP IPv6", "sample_path_keywords": ["ipv6_eigrp"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
22
+ {"id": "ripng", "capability": "ripng", "label": "RIPng", "sample_path_keywords": ["ipv6", "rip"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
23
+ {"id": "hsrp", "capability": "hsrp", "label": "HSRP", "sample_path_keywords": ["hsrp"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true}
24
+ ]
25
+ },
26
+ {
27
+ "id": "ipv4_routing_management",
28
+ "label": "IPv4 Routing And IOS Management",
29
+ "scenario_family": "ipv4_routing_management",
30
+ "wave": 7,
31
+ "features": [
32
+ {"id": "ospfv2", "capability": "ospfv2", "label": "OSPFv2", "sample_path_keywords": ["ospf", "ospfv2", "single-area ospf"], "support_ceiling": "edit_proven"},
33
+ {"id": "eigrp_ipv4", "capability": "eigrp_ipv4", "label": "EIGRP IPv4", "sample_path_keywords": ["eigrp", "ipv4 eigrp"], "support_ceiling": "edit_proven"},
34
+ {"id": "ripv2", "capability": "ripv2", "label": "RIPv2", "sample_path_keywords": ["ripv2", "rip"], "support_ceiling": "edit_proven"},
35
+ {"id": "static_route", "capability": "static_route", "label": "Static IPv4 route", "sample_path_keywords": ["static route", "ip route"], "support_ceiling": "edit_proven"},
36
+ {"id": "default_route", "capability": "default_route", "label": "Default IPv4 route", "sample_path_keywords": ["default route"], "support_ceiling": "edit_proven"},
37
+ {"id": "dhcp_relay", "capability": "dhcp_relay", "label": "DHCP relay / helper address", "sample_path_keywords": ["dhcp relay", "dhcprelay", "helper-address"], "support_ceiling": "edit_proven"},
38
+ {"id": "nat_static", "capability": "nat_static", "label": "Static NAT", "sample_path_keywords": ["static nat"], "support_ceiling": "edit_proven"},
39
+ {"id": "nat_dynamic", "capability": "nat_dynamic", "label": "Dynamic NAT", "sample_path_keywords": ["dynamic nat"], "support_ceiling": "edit_proven"},
40
+ {"id": "pat", "capability": "pat", "label": "PAT overload", "sample_path_keywords": ["pat", "overload"], "support_ceiling": "edit_proven"},
41
+ {"id": "ssh_ios", "capability": "ssh_ios", "label": "IOS SSH management", "sample_path_keywords": ["ssh"], "support_ceiling": "edit_proven"},
42
+ {"id": "ntp_ios", "capability": "ntp_ios", "label": "IOS NTP client", "sample_path_keywords": ["ntp"], "support_ceiling": "edit_proven"},
43
+ {"id": "syslog_ios", "capability": "syslog_ios", "label": "IOS syslog client", "sample_path_keywords": ["syslog"], "support_ceiling": "edit_proven"}
44
+ ]
45
+ },
46
+ {
47
+ "id": "l2_resiliency_routing",
48
+ "label": "L2 Resiliency And BGP",
49
+ "scenario_family": "l2_resiliency_routing",
50
+ "wave": 6,
51
+ "features": [
52
+ {"id": "bgp", "capability": "bgp", "label": "BGP", "sample_path_keywords": ["bgp"], "support_ceiling": "edit_proven"},
53
+ {"id": "stp", "capability": "stp", "label": "Spanning Tree Protocol", "sample_path_keywords": ["stp", "spanning tree", "spanning-tree"], "support_ceiling": "edit_proven"},
54
+ {"id": "rstp", "capability": "rstp", "label": "Rapid STP / Rapid PVST", "sample_path_keywords": ["rstp", "rapid-pvst"], "support_ceiling": "edit_proven"},
55
+ {"id": "etherchannel", "capability": "etherchannel", "label": "EtherChannel / Port-channel", "sample_path_keywords": ["etherchannel", "port-channel", "channel-group"], "support_ceiling": "edit_proven"},
56
+ {"id": "lacp", "capability": "lacp", "label": "LACP", "sample_path_keywords": ["lacp"], "support_ceiling": "edit_proven"},
57
+ {"id": "pagp", "capability": "pagp", "label": "PAgP", "sample_path_keywords": ["pagp"], "support_ceiling": "edit_proven"},
58
+ {"id": "vtp", "capability": "vtp", "label": "VTP", "sample_path_keywords": ["vtp"], "support_ceiling": "edit_proven"},
59
+ {"id": "dtp", "capability": "dtp", "label": "DTP", "sample_path_keywords": ["dtp"], "support_ceiling": "edit_proven"}
60
+ ]
61
+ },
62
+ {
63
+ "id": "l2_security_monitoring",
64
+ "label": "L2 Security And Monitoring",
65
+ "scenario_family": "l2_security_monitoring",
66
+ "wave": 3,
67
+ "features": [
68
+ {"id": "dhcp_snooping", "capability": "dhcp_snooping", "label": "DHCP snooping", "sample_path_keywords": ["dhcp_snooping"], "support_ceiling": "edit_proven"},
69
+ {"id": "dai", "capability": "dai", "label": "Dynamic ARP Inspection", "sample_path_keywords": ["dai"], "support_ceiling": "edit_proven"},
70
+ {"id": "dot1x", "capability": "dot1x", "label": "802.1X / NAC", "sample_path_keywords": ["dot1x", "port-based nac"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
71
+ {"id": "lldp", "capability": "lldp", "label": "LLDP", "sample_path_keywords": ["lldp"], "support_ceiling": "edit_proven"},
72
+ {"id": "rep", "capability": "rep", "label": "REP", "sample_path_keywords": ["rep_"], "support_ceiling": "edit_proven"},
73
+ {"id": "snmp", "capability": "snmp", "label": "SNMP", "sample_path_keywords": ["snmp"], "support_ceiling": "edit_proven"},
74
+ {"id": "netflow", "capability": "netflow", "label": "NetFlow", "sample_path_keywords": ["netflow"], "support_ceiling": "edit_proven"},
75
+ {"id": "span", "capability": "span", "label": "SPAN/RSPAN", "sample_path_keywords": ["rspan", "monitor session", "span session"], "support_ceiling": "edit_proven"},
76
+ {"id": "qos", "capability": "qos", "label": "QoS", "sample_path_keywords": ["qos"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
77
+ {"id": "port_security", "capability": "port_security", "label": "Port security", "sample_path_keywords": ["port security", "port-security"], "support_ceiling": "edit_proven"}
78
+ ]
79
+ },
80
+ {
81
+ "id": "wan_security_edge",
82
+ "label": "WAN Security Edge",
83
+ "scenario_family": "wan_security_edge",
84
+ "wave": 4,
85
+ "features": [
86
+ {"id": "vpn", "capability": "vpn", "label": "Site-to-site VPN crypto map", "sample_path_keywords": ["vpn", "ipsec"], "support_ceiling": "edit_proven"},
87
+ {"id": "ipsec", "capability": "ipsec", "label": "IPSec transform set / crypto map", "sample_path_keywords": ["ipsec", "ike"], "support_ceiling": "edit_proven"},
88
+ {"id": "gre", "capability": "gre", "label": "GRE tunnel basics", "sample_path_keywords": ["gre"], "support_ceiling": "edit_proven"},
89
+ {"id": "ppp", "capability": "ppp", "label": "PPP serial encapsulation", "sample_path_keywords": ["ppp", "chap", "pap"], "support_ceiling": "edit_proven"},
90
+ {"id": "security_edge", "capability": "security_edge", "label": "Security edge device evidence", "sample_path_keywords": ["asa", "firewall", "security appliance"], "support_ceiling": "report_supported"},
91
+ {"id": "multilayer_switching", "capability": "multilayer_switching", "label": "Multilayer switch / SVI evidence", "sample_path_keywords": ["multilayer", "3560", "svi"], "support_ceiling": "report_supported"}
92
+ ]
93
+ },
94
+ {
95
+ "id": "security_edge_deepening",
96
+ "label": "Security Edge Deepening",
97
+ "scenario_family": "wan_security_edge",
98
+ "wave": 3,
99
+ "features": [
100
+ {"id": "asa_acl_nat", "capability": "asa_acl_nat", "label": "ASA ACL/NAT", "sample_path_keywords": ["asa_acl_nat"], "support_ceiling": "report_supported"},
101
+ {"id": "asa_service_policy", "capability": "asa_service_policy", "label": "ASA service policy", "sample_path_keywords": ["asa_service_policy"], "support_ceiling": "report_supported"},
102
+ {"id": "clientless_vpn", "capability": "clientless_vpn", "label": "Clientless VPN", "sample_path_keywords": ["clientless_vpn"], "support_ceiling": "report_supported"},
103
+ {"id": "cbac", "capability": "cbac", "label": "CBAC", "sample_path_keywords": ["cbac"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
104
+ {"id": "zfw", "capability": "zfw", "label": "Zone Based Firewall", "sample_path_keywords": ["zfw", "zone based firewall"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
105
+ {"id": "sniffer", "capability": "sniffer", "label": "Sniffer", "sample_path_keywords": ["sniffer"], "support_ceiling": "report_supported"}
106
+ ]
107
+ },
108
+ {
109
+ "id": "wireless_advanced",
110
+ "label": "Advanced Wireless",
111
+ "scenario_family": "wireless_advanced",
112
+ "wave": 4,
113
+ "features": [
114
+ {"id": "wlc", "capability": "wlc", "label": "Wireless LAN Controller", "sample_path_keywords": ["wlc"], "support_ceiling": "report_supported"},
115
+ {"id": "wpa_enterprise", "capability": "wpa_enterprise", "label": "WPA Enterprise / RADIUS", "sample_path_keywords": ["wpa_radius", "wpa2_enterprise"], "support_ceiling": "edit_proven"},
116
+ {"id": "wep", "capability": "wep", "label": "WEP wireless mode", "sample_path_keywords": ["wep"], "support_ceiling": "edit_proven"},
117
+ {"id": "guest_wifi", "capability": "guest_wifi", "label": "Guest Wi-Fi", "sample_path_keywords": ["guest"], "support_ceiling": "report_supported"},
118
+ {"id": "beamforming", "capability": "beamforming", "label": "Beamforming", "sample_path_keywords": ["beamforming"], "support_ceiling": "report_supported"},
119
+ {"id": "meraki", "capability": "meraki", "label": "Meraki security appliance/wireless", "sample_path_keywords": ["meraki"], "support_ceiling": "report_supported"},
120
+ {"id": "cellular_5g", "capability": "cellular_5g", "label": "5G / cellular", "sample_path_keywords": ["5g", "cellular", "cell tower"], "support_ceiling": "report_supported"},
121
+ {"id": "bluetooth", "capability": "bluetooth", "label": "Bluetooth", "sample_path_keywords": ["bluetooth"], "support_ceiling": "report_supported"}
122
+ ]
123
+ },
124
+ {
125
+ "id": "automation_controller",
126
+ "label": "Automation And Programming",
127
+ "scenario_family": "automation_controller",
128
+ "wave": 5,
129
+ "features": [
130
+ {"id": "network_controller", "capability": "network_controller", "label": "Network Controller", "sample_path_keywords": ["network controller", "netcon"], "support_ceiling": "report_supported"},
131
+ {"id": "python_programming", "capability": "python_programming", "label": "Python programming", "sample_path_keywords": ["python", "programming_with_python"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
132
+ {"id": "javascript_programming", "capability": "javascript_programming", "label": "JavaScript programming", "sample_path_keywords": ["javascript"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
133
+ {"id": "blockly_programming", "capability": "blockly_programming", "label": "Blockly programming", "sample_path_keywords": ["blockly"], "support_ceiling": "report_supported"},
134
+ {"id": "tcp_udp_app", "capability": "tcp_udp_app", "label": "TCP/UDP test apps", "sample_path_keywords": ["tcp_test_app", "udp_test_app"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
135
+ {"id": "vm_iox", "capability": "vm_iox", "label": "VM / IOx", "sample_path_keywords": ["iox", "uploading_and_running_vm"], "support_ceiling": "report_supported"}
136
+ ]
137
+ },
138
+ {
139
+ "id": "voice_collaboration",
140
+ "label": "Voice And Collaboration",
141
+ "scenario_family": "voice_collaboration",
142
+ "wave": 5,
143
+ "features": [
144
+ {"id": "voip", "capability": "voip", "label": "VoIP", "sample_path_keywords": ["voip"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
145
+ {"id": "ip_phone", "capability": "ip_phone", "label": "IP phones", "sample_path_keywords": ["phone"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
146
+ {"id": "call_manager", "capability": "call_manager", "label": "Call Manager / telephony service", "sample_path_keywords": ["call", "voip"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
147
+ {"id": "linksys_voice", "capability": "linksys_voice", "label": "Linksys voice", "sample_path_keywords": ["voip linksys"], "support_ceiling": "report_supported"}
148
+ ]
149
+ },
150
+ {
151
+ "id": "industrial_iot",
152
+ "label": "Industrial IoT And Real Apps",
153
+ "scenario_family": "industrial_iot",
154
+ "wave": 5,
155
+ "features": [
156
+ {"id": "mqtt", "capability": "mqtt", "label": "MQTT", "sample_path_keywords": ["mqtt"], "support_ceiling": "report_supported"},
157
+ {"id": "real_http", "capability": "real_http", "label": "Real HTTP", "sample_path_keywords": ["real http", "real-http"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
158
+ {"id": "real_websocket", "capability": "real_websocket", "label": "Real WebSocket", "sample_path_keywords": ["real websocket", "real-websocket"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
159
+ {"id": "visual_scripting", "capability": "visual_scripting", "label": "Visual scripting", "sample_path_keywords": ["visual-scripting", "visual scripting"], "support_ceiling": "report_supported"},
160
+ {"id": "ptp", "capability": "ptp", "label": "PTP", "sample_path_keywords": ["ptp"], "support_ceiling": "report_supported"},
161
+ {"id": "profinet", "capability": "profinet", "label": "Profinet", "sample_path_keywords": ["profinet"], "support_ceiling": "report_supported"},
162
+ {"id": "l2nat", "capability": "l2nat", "label": "L2NAT", "sample_path_keywords": ["l2nat"], "support_ceiling": "report_supported"},
163
+ {"id": "cyberobserver", "capability": "cyberobserver", "label": "CyberObserver", "sample_path_keywords": ["cyberobserver"], "support_ceiling": "report_supported"},
164
+ {"id": "industrial_firewall", "capability": "industrial_firewall", "label": "Industrial firewall", "sample_path_keywords": ["isa3000", "industrial cybersecurity"], "support_ceiling": "report_supported"}
165
+ ]
166
+ },
167
+ {
168
+ "id": "physical_media_device_gaps",
169
+ "label": "Physical Media And Device Gaps",
170
+ "scenario_family": "physical_media_device",
171
+ "wave": 5,
172
+ "features": [
173
+ {"id": "coaxial", "capability": "coaxial", "label": "Coaxial splitter/media", "sample_path_keywords": ["coaxial"], "support_ceiling": "report_supported"},
174
+ {"id": "cable_dsl", "capability": "cable_dsl", "label": "Cable/DSL modem", "sample_path_keywords": ["cable", "dsl"], "support_ceiling": "report_supported"},
175
+ {"id": "central_office", "capability": "central_office", "label": "Central office", "sample_path_keywords": ["centraloffice", "central office"], "support_ceiling": "report_supported"},
176
+ {"id": "cell_tower", "capability": "cell_tower", "label": "Cell tower", "sample_path_keywords": ["cell tower"], "support_ceiling": "report_supported"},
177
+ {"id": "power_distribution", "capability": "power_distribution", "label": "Power distribution", "sample_path_keywords": ["power distribution"], "support_ceiling": "report_supported"},
178
+ {"id": "hot_swappable", "capability": "hot_swappable", "label": "Hot-swappable modules", "sample_path_keywords": ["hotswappable", "hot swappable"], "support_ceiling": "report_supported"},
179
+ {"id": "ios_license", "capability": "ios_license", "label": "IOS/license workflows", "sample_path_keywords": ["ios_15", "license"], "support_ceiling": "report_supported"}
180
+ ]
181
+ }
182
+ ]
183
+ }
@@ -6,6 +6,7 @@
6
6
  "scenario_family": "campus",
7
7
  "preferred_donor_archetypes": ["campus/core"],
8
8
  "critical_capabilities": ["router_on_a_stick", "trunk", "management_vlan", "telnet", "acl", "nat"],
9
+ "prompt_aliases": ["campus with VLAN DHCP ACL"],
9
10
  "minimum_expectations": {
10
11
  "requires_family_match": true,
11
12
  "requires_nonempty_summary": true,
@@ -19,12 +19,12 @@ TITLE_BY_FAMILY = {
19
19
  "wan_security_edge": "WAN Security Edge",
20
20
  }
21
21
 
22
- SUMMARY_BY_FAMILY = {
23
- "campus": "Management VLAN, Telnet, ACL, DNS, email, AAA, and multi-SSID wireless campus edit.",
24
- "home_iot": "Home gateway and IoT device onboarding with gateway-backed registration state.",
25
- "service_heavy": "Service-rich server lab with DNS, DHCP, FTP, email, syslog, AAA, and detailed service metadata.",
26
- "wan_security_edge": "WAN/security-edge lab with multilayer, tunnel, VPN, and edge-policy coverage metadata.",
27
- }
22
+ SUMMARY_BY_FAMILY = {
23
+ "campus": "Management VLAN, Telnet, ACL, DNS, email, AAA, and multi-SSID wireless campus edit.",
24
+ "home_iot": "Home gateway and IoT device onboarding with donor-backed registration state and constrained wireless readiness.",
25
+ "service_heavy": "Service-rich server lab with DNS, DHCP, FTP, email, syslog, AAA, and detailed service metadata.",
26
+ "wan_security_edge": "WAN/security-edge lab with multilayer, tunnel, VPN, and edge-policy coverage metadata.",
27
+ }
28
28
 
29
29
  CAPABILITIES_BY_FAMILY = {
30
30
  "campus": [
@@ -202,12 +202,17 @@ def _build_entry(manifest_path: Path) -> dict[str, object]:
202
202
  preview = _write_preview(manifest_path)
203
203
  screenshot = screenshots[0] if screenshots else None
204
204
  detail_images = screenshots[1:] if len(screenshots) > 1 else []
205
- primary_capabilities = CAPABILITIES_BY_FAMILY.get(family, [])
206
- acceptance_excerpt = f"{acceptance_label} | donor={donor_origin} | capabilities={', '.join(primary_capabilities[:3])}"
207
- fixture_name = FIXTURE_BY_FAMILY.get(family)
208
- matrix_excerpt = f"{fixture_name or 'ad-hoc'} | {acceptance_label} | family={family}"
209
- parity_excerpt = ", ".join(f"{cap}=generate-ready" for cap in primary_capabilities[:3]) if primary_capabilities else "no parity excerpt"
210
- decision_excerpt = f"decision={acceptance_label} | donor_origin={donor_origin}"
205
+ primary_capabilities = CAPABILITIES_BY_FAMILY.get(family, [])
206
+ acceptance_excerpt = f"{acceptance_label} | donor={donor_origin} | capabilities={', '.join(primary_capabilities[:3])}"
207
+ if family == "home_iot":
208
+ acceptance_excerpt += " | mode=donor-backed constrained-generate"
209
+ fixture_name = FIXTURE_BY_FAMILY.get(family)
210
+ matrix_excerpt = f"{fixture_name or 'ad-hoc'} | {acceptance_label} | family={family}"
211
+ if family == "home_iot":
212
+ parity_excerpt = "iot=generate-ready, iot_registration=donor-backed constrained-generate, wireless_ap=generate-ready"
213
+ else:
214
+ parity_excerpt = ", ".join(f"{cap}=generate-ready" for cap in primary_capabilities[:3]) if primary_capabilities else "no parity excerpt"
215
+ decision_excerpt = f"decision={acceptance_label} | donor_origin={donor_origin}"
211
216
  runtime_excerpt = "runtime=donor-backed example artifact"
212
217
  return {
213
218
  "name": name,
@@ -258,9 +263,15 @@ def build_examples_gallery_markdown(payload: dict[str, object]) -> str:
258
263
  "",
259
264
  "Hero visual:",
260
265
  "",
261
- "- [complex campus screenshot](screenshots/complex_campus_master_edit_v4.png)",
262
- "",
263
- "| Title | Family | Capabilities | Image | Inventory |",
266
+ "- [complex campus screenshot](screenshots/complex_campus_master_edit_v4.png)",
267
+ "",
268
+ "Canonical donor proof:",
269
+ "",
270
+ "- [campus donor proof](../docs/campus-donor-proof.md)",
271
+ "- [home IoT donor proof](../docs/home-iot-donor-proof.md)",
272
+ "- [WAN/security donor proof](../docs/wan-security-donor-proof.md)",
273
+ "",
274
+ "| Title | Family | Capabilities | Image | Inventory |",
264
275
  "| --- | --- | --- | --- | --- |",
265
276
  ]
266
277
  for entry in payload["curated_examples"]: