packet-tracer-skill 0.2.1 → 0.2.3

package/scripts/coverage_matrix.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import re
 from dataclasses import asdict, dataclass, field
 from typing import Any
 
@@ -26,6 +27,9 @@ DEVICE_FAMILY_MAP = {
     "Tablet": "end devices",
     "Smartphone": "end devices",
     "Printer": "end devices",
+    "IpPhone": "end devices",
+    "HomeVoip": "end devices",
+    "AnalogPhone": "end devices",
     "LightWeightAccessPoint": "access points",
     "WirelessRouter": "home/wireless routers",
     "WirelessRouterNewGeneration": "home/wireless routers",
@@ -37,6 +41,9 @@ DEVICE_FAMILY_MAP = {
     "Dsl Modem": "wan/cloud/dsl/cable devices",
     "Security Appliance": "security devices",
     "ASA": "security devices",
+    "NetworkController": "network controllers",
+    "CentralOfficeServer": "wan/cloud/dsl/cable devices",
+    "CellTower": "wan/cloud/dsl/cable devices",
     "IoT": "iot devices",
     "Board": "iot devices",
     "Sensor": "iot devices",
@@ -52,6 +59,201 @@ DEFAULT_FAMILY_LIMITATIONS = {
     "security devices": ["advanced security devices remain donor-limited"],
 }
 
+REPORT_ONLY_CAPABILITIES = {
+    "ipv6_slaac",
+    "dhcpv6_stateful",
+    "dhcpv6_stateless",
+    "ipv6_prefix_delegation",
+    "ipv6_dns_aaaa",
+    "ipv6_tunneling",
+    "isatap",
+    "ospfv3",
+    "eigrp_ipv6",
+    "ripng",
+    "hsrp",
+    "dhcp_snooping",
+    "dai",
+    "dot1x",
+    "lldp",
+    "rep",
+    "snmp",
+    "netflow",
+    "span",
+    "qos",
+    "port_security",
+    "bgp",
+    "stp",
+    "rstp",
+    "etherchannel",
+    "lacp",
+    "pagp",
+    "vtp",
+    "dtp",
+    "ospfv2",
+    "eigrp_ipv4",
+    "ripv2",
+    "static_route",
+    "default_route",
+    "dhcp_relay",
+    "nat_static",
+    "nat_dynamic",
+    "pat",
+    "ssh_ios",
+    "ntp_ios",
+    "syslog_ios",
+    "asa_acl_nat",
+    "asa_service_policy",
+    "clientless_vpn",
+    "cbac",
+    "zfw",
+    "sniffer",
+    "wlc",
+    "wpa_enterprise",
+    "wep",
+    "guest_wifi",
+    "beamforming",
+    "meraki",
+    "cellular_5g",
+    "bluetooth",
+    "network_controller",
+    "python_programming",
+    "javascript_programming",
+    "blockly_programming",
+    "tcp_udp_app",
+    "vm_iox",
+    "voip",
+    "ip_phone",
+    "call_manager",
+    "linksys_voice",
+    "mqtt",
+    "real_http",
+    "real_websocket",
+    "visual_scripting",
+    "ptp",
+    "profinet",
+    "l2nat",
+    "cyberobserver",
+    "industrial_firewall",
+    "coaxial",
+    "cable_dsl",
+    "central_office",
+    "cell_tower",
+    "power_distribution",
+    "hot_swappable",
+    "ios_license",
+}
+
+IPV6_DONOR_BACKED_CAPABILITIES = {
+    "ipv6_slaac",
+    "dhcpv6_stateful",
+    "ospfv3",
+    "eigrp_ipv6",
+    "ripng",
+    "hsrp",
+}
+IPV6_DONOR_BACKED_READY_EDIT_CAPABILITIES = {
+    "ospfv3",
+    "eigrp_ipv6",
+    "ripng",
+    "hsrp",
+}
+L2_SECURITY_MONITORING_EDIT_PROVEN_CAPABILITIES = {
+    "dhcp_snooping",
+    "dai",
+    "dot1x",
+    "lldp",
+    "rep",
+    "snmp",
+    "netflow",
+    "span",
+    "qos",
+    "port_security",
+}
+WIRELESS_ADVANCED_EDIT_PROVEN_CAPABILITIES = {
+    "wep",
+    "wpa_enterprise",
+}
+PROGRAMMING_EDIT_PROVEN_CAPABILITIES = {
+    "real_http",
+    "real_websocket",
+    "python_programming",
+    "javascript_programming",
+    "tcp_udp_app",
+}
+AUTOMATION_CONTROLLER_EDIT_PROVEN_CAPABILITIES = {
+    "python_programming",
+    "javascript_programming",
+    "tcp_udp_app",
+}
+PROGRAMMING_DONOR_BACKED_READY_CAPABILITIES = {
+    "real_http",
+    "real_websocket",
+    "python_programming",
+    "javascript_programming",
+    "tcp_udp_app",
+}
+L2_SECURITY_MONITORING_DONOR_BACKED_READY_CAPABILITIES = {
+    "dot1x",
+}
+WAN_SECURITY_DONOR_BACKED_READY_EDIT_CAPABILITIES = {
+    "zfw",
+}
+VOICE_COLLABORATION_DONOR_BACKED_READY_CAPABILITIES = {
+    "voip",
+    "ip_phone",
+    "call_manager",
+}
+VOICE_COLLABORATION_EDIT_PROVEN_CAPABILITIES = {
+    "voip",
+    "ip_phone",
+    "call_manager",
+}
+WAN_SECURITY_EDIT_PROVEN_CAPABILITIES = {
+    "gre",
+    "ppp",
+    "ipsec",
+    "vpn",
+    "cbac",
+    "zfw",
+}
+L2_RESILIENCY_ROUTING_EDIT_PROVEN_CAPABILITIES = {
+    "bgp",
+    "stp",
+    "rstp",
+    "etherchannel",
+    "lacp",
+    "pagp",
+    "vtp",
+    "dtp",
+}
+IPV4_ROUTING_MANAGEMENT_EDIT_PROVEN_CAPABILITIES = {
+    "ospfv2",
+    "eigrp_ipv4",
+    "ripv2",
+    "static_route",
+    "default_route",
+    "dhcp_relay",
+    "nat_static",
+    "nat_dynamic",
+    "pat",
+    "ssh_ios",
+    "ntp_ios",
+    "syslog_ios",
+}
+
+WAN_SECURITY_DONOR_LIMITED_CAPABILITIES = {
+    "gre",
+    "ppp",
+    "ipsec",
+    "vpn",
+    "security_edge",
+    "multilayer_switching",
+}
+ALWAYS_EDIT_PROVEN_REPORT_CAPABILITIES = IPV6_DONOR_BACKED_CAPABILITIES | (
+    L2_SECURITY_MONITORING_EDIT_PROVEN_CAPABILITIES - {"dot1x", "qos"}
+)
+EDIT_PROVEN_REPORT_CAPABILITIES = ALWAYS_EDIT_PROVEN_REPORT_CAPABILITIES
+
 CAPABILITY_PROVIDER_FAMILIES = {
     "access_port": {"switches", "multilayer switches"},
     "trunk": {"switches", "multilayer switches"},
@@ -70,6 +272,25 @@ CAPABILITY_PROVIDER_FAMILIES = {
     "ipsec": {"routers", "security devices", "wan/cloud/dsl/cable devices"},
     "gre": {"routers", "wan/cloud/dsl/cable devices"},
     "ppp": {"routers", "wan/cloud/dsl/cable devices"},
+    "bgp": {"routers", "multilayer switches"},
+    "stp": {"switches", "multilayer switches"},
+    "rstp": {"switches", "multilayer switches"},
+    "etherchannel": {"switches", "multilayer switches"},
+    "lacp": {"switches", "multilayer switches"},
+    "pagp": {"switches", "multilayer switches"},
+    "vtp": {"switches", "multilayer switches"},
+    "dtp": {"switches", "multilayer switches"},
+    "ospfv2": {"routers", "multilayer switches"},
+    "eigrp_ipv4": {"routers", "multilayer switches"},
+    "ripv2": {"routers", "multilayer switches"},
+    "static_route": {"routers", "multilayer switches", "security devices"},
+    "default_route": {"routers", "multilayer switches", "security devices"},
+    "dhcp_relay": {"routers", "multilayer switches"},
+    "nat_static": {"routers", "security devices"},
+    "nat_dynamic": {"routers", "security devices"},
+    "ssh_ios": {"routers", "switches", "multilayer switches"},
+    "ntp_ios": {"routers", "switches", "multilayer switches"},
+    "syslog_ios": {"routers", "switches", "multilayer switches"},
     "multilayer_switching": {"multilayer switches"},
     "wan": {"wan/cloud/dsl/cable devices", "routers"},
     "security_edge": {"security devices", "routers"},
@@ -99,6 +320,67 @@ CAPABILITY_PROVIDER_FAMILIES = {
     "tablet": {"end devices"},
     "printer": {"end devices"},
     "verification": {"routers", "switches", "multilayer switches", "servers", "end devices", "access points"},
+    "ipv6_slaac": {"routers", "switches", "end devices", "pt-specific edge/utility devices"},
+    "dhcpv6_stateful": {"routers", "servers", "end devices"},
+    "dhcpv6_stateless": {"routers", "servers", "end devices"},
+    "ipv6_prefix_delegation": {"routers", "wan/cloud/dsl/cable devices"},
+    "ipv6_dns_aaaa": {"servers", "routers"},
+    "ipv6_tunneling": {"routers"},
+    "isatap": {"routers", "end devices"},
+    "ospfv3": {"routers"},
+    "eigrp_ipv6": {"routers"},
+    "ripng": {"routers"},
+    "hsrp": {"routers", "switches", "multilayer switches"},
+    "dhcp_snooping": {"switches", "multilayer switches"},
+    "dai": {"switches", "multilayer switches"},
+    "dot1x": {"switches", "servers", "end devices"},
+    "lldp": {"routers", "switches", "multilayer switches"},
+    "rep": {"switches", "multilayer switches"},
+    "snmp": {"routers", "switches", "multilayer switches", "access points", "servers"},
+    "netflow": {"routers"},
+    "span": {"switches", "multilayer switches"},
+    "qos": {"routers", "switches", "multilayer switches"},
+    "port_security": {"switches", "multilayer switches"},
+    "asa_acl_nat": {"security devices"},
+    "asa_service_policy": {"security devices"},
+    "clientless_vpn": {"security devices"},
+    "cbac": {"routers", "security devices"},
+    "zfw": {"routers", "security devices"},
+    "sniffer": {"end devices", "pt-specific edge/utility devices"},
+    "wlc": {"access points"},
+    "wpa_enterprise": {"access points", "home/wireless routers", "servers"},
+    "wep": {"access points", "home/wireless routers"},
+    "guest_wifi": {"home/wireless routers", "access points"},
+    "beamforming": {"home/wireless routers"},
+    "meraki": {"security devices", "home/wireless routers", "access points"},
+    "cellular_5g": {"wan/cloud/dsl/cable devices", "end devices"},
+    "bluetooth": {"iot devices", "end devices"},
+    "network_controller": {"pt-specific edge/utility devices", "routers", "switches"},
+    "python_programming": {"end devices", "pt-specific edge/utility devices"},
+    "javascript_programming": {"end devices", "pt-specific edge/utility devices"},
+    "blockly_programming": {"end devices", "pt-specific edge/utility devices"},
+    "tcp_udp_app": {"end devices", "servers"},
+    "vm_iox": {"routers", "pt-specific edge/utility devices"},
+    "voip": {"end devices", "switches", "routers"},
+    "ip_phone": {"end devices"},
+    "call_manager": {"routers", "servers", "end devices", "switches"},
+    "linksys_voice": {"home/wireless routers", "end devices"},
+    "mqtt": {"iot devices", "servers", "home/wireless routers", "pt-specific edge/utility devices"},
+    "real_http": {"iot devices", "servers", "pt-specific edge/utility devices"},
+    "real_websocket": {"iot devices", "servers", "pt-specific edge/utility devices"},
+    "visual_scripting": {"iot devices"},
+    "ptp": {"switches", "multilayer switches", "routers"},
+    "profinet": {"iot devices", "routers", "switches"},
+    "l2nat": {"switches", "multilayer switches"},
+    "cyberobserver": {"servers", "switches", "routers"},
+    "industrial_firewall": {"security devices", "routers"},
+    "coaxial": {"pt-specific edge/utility devices"},
+    "cable_dsl": {"wan/cloud/dsl/cable devices"},
+    "central_office": {"pt-specific edge/utility devices"},
+    "cell_tower": {"pt-specific edge/utility devices", "wan/cloud/dsl/cable devices"},
+    "power_distribution": {"pt-specific edge/utility devices"},
+    "hot_swappable": {"multilayer switches", "pt-specific edge/utility devices"},
+    "ios_license": {"routers", "switches", "multilayer switches"},
 }
 
 
@@ -126,6 +408,33 @@ class CoverageGapReport:
     scenario_generate_readiness: dict[str, object] = field(default_factory=dict)
     recommended_next_actions: list[str] = field(default_factory=list)
 
+    @property
+    def critical_capability_parity(self) -> list[dict[str, object]]:
+        critical = set(self.scenario_generate_readiness.get("critical_capabilities") or [])
+        if not critical:
+            return []
+        return [entry for entry in self.capability_parity if entry.get("capability") in critical]
+
+    @property
+    def critical_parity_supported_count(self) -> int:
+        return sum(1 for entry in self.critical_capability_parity if entry.get("inventory_supported") or entry.get("edit_supported"))
+
+    @property
+    def critical_parity_generate_ready_count(self) -> int:
+        return sum(1 for entry in self.critical_capability_parity if entry.get("generate_supported"))
+
+    @property
+    def critical_parity_acceptance_verified_count(self) -> int:
+        return sum(1 for entry in self.critical_capability_parity if entry.get("acceptance_verified"))
+
+    @property
+    def critical_parity_donor_backed_ready_count(self) -> int:
+        return sum(1 for entry in self.critical_capability_parity if entry.get("donor_backed_ready"))
+
+    @property
+    def critical_parity_mismatch_count(self) -> int:
+        return sum(1 for entry in self.critical_capability_parity if entry.get("generate_mismatch_reason"))
+
 
 @dataclass
 class BlueprintPlan:
@@ -277,26 +586,78 @@ def _requested_device_families(plan: IntentPlan) -> list[str]:
 def _scenario_family_for_plan(plan: IntentPlan, requested_families: list[str]) -> str | None:
     capabilities = set(plan.capabilities)
     requested_services = {str(service) for service in plan.service_requirements.get("services", []) if service}
-    if capabilities & {"iot", "iot_registration", "iot_control"} or {"iot devices", "home/wireless routers"} & set(requested_families):
-        return "home_iot"
-    if (
+    requested_family_set = set(requested_families)
+    prompt_lower = str(plan.prompt or "").lower()
+    campus_capabilities = {"vlan", "router_on_a_stick", "management_vlan", "telnet", "acl", "nat", "pat", "trunk", "access_port"}
+    service_capabilities = {"server_dns", "server_dhcp", "server_http", "server_https", "server_ftp", "server_tftp", "server_email", "server_syslog", "server_aaa"}
+    explicit_campus_style = plan.network_style in {"campus", "department_lan"}
+    explicit_service_style = plan.network_style == "service_heavy"
+    explicit_home_style = plan.network_style in {"home_iot", "smart_home"}
+    explicit_home_gateway_prompt = any(
+        token in prompt_lower
+        for token in ["home gateway", "homegateway", "smart home", "iot "]
+    )
+    campus_signal = (
+        explicit_campus_style
+        or bool(plan.department_groups)
+        or "campus" in prompt_lower
+        or "kampus" in prompt_lower
+        or (requested_family_set & {"switches", "multilayer switches"} and capabilities & campus_capabilities)
+        or len(capabilities & campus_capabilities) >= 3
+    )
+    home_iot_signal = (
+        explicit_home_style
+        or explicit_home_gateway_prompt
+        or plan.wireless_mode == "home_router_edge"
+        or capabilities & {"iot", "iot_registration", "iot_control"}
+        or {"iot devices", "home/wireless routers"} & requested_family_set
+    )
+    wan_signal = (
         plan.network_style == "wan_security"
-        or capabilities & {"vpn", "ipsec", "gre", "ppp", "multilayer_switching", "security_edge"}
-        or {"wan/cloud/dsl/cable devices", "security devices"} & set(requested_families)
-    ):
+        or capabilities & {"vpn", "ipsec", "gre", "ppp", "multilayer_switching", "security_edge", "cbac", "zfw"}
+        or {"wan/cloud/dsl/cable devices", "security devices"} & requested_family_set
+    )
+    ipv6_routing_signal = plan.network_style == "ipv6_routing" or capabilities & {"ipv6_slaac", "dhcpv6_stateful", "dhcpv6_stateless", "ipv6_prefix_delegation", "ipv6_dns_aaaa", "ipv6_tunneling", "isatap", "ospfv3", "eigrp_ipv6", "ripng", "hsrp"}
+    ipv4_routing_management_signal = plan.network_style == "ipv4_routing_management" or capabilities & {"ospfv2", "eigrp_ipv4", "ripv2", "static_route", "default_route", "dhcp_relay", "nat_static", "nat_dynamic", "pat", "ssh_ios", "ntp_ios", "syslog_ios"}
+    l2_resiliency_routing_signal = plan.network_style == "l2_resiliency_routing" or capabilities & {"bgp", "stp", "rstp", "etherchannel", "lacp", "pagp", "vtp", "dtp"}
+    l2_security_monitoring_signal = plan.network_style == "l2_security_monitoring" or capabilities & {"dhcp_snooping", "dai", "dot1x", "lldp", "rep", "snmp", "netflow", "span", "qos", "port_security"}
+    wireless_advanced_signal = plan.network_style == "wireless_advanced" or capabilities & {"wlc", "wpa_enterprise", "wep", "guest_wifi", "beamforming", "meraki", "cellular_5g", "bluetooth"}
+    automation_controller_signal = plan.network_style == "automation_controller" or capabilities & {"network_controller", "python_programming", "javascript_programming", "blockly_programming", "tcp_udp_app", "vm_iox"}
+    voice_collaboration_signal = plan.network_style == "voice_collaboration" or capabilities & {"voip", "ip_phone", "call_manager", "linksys_voice"}
+    industrial_iot_signal = plan.network_style == "industrial_iot" or capabilities & {"mqtt", "real_http", "real_websocket", "visual_scripting", "ptp", "profinet", "l2nat", "cyberobserver", "industrial_firewall"}
+    physical_media_device_signal = plan.network_style == "physical_media_device" or capabilities & {"coaxial", "cable_dsl", "central_office", "cell_tower", "power_distribution", "hot_swappable", "ios_license"}
+    service_signal = (
+        explicit_service_style
+        or requested_services & {"dns", "dhcp", "http", "https", "ftp", "tftp", "email", "syslog", "aaa", "ntp"}
+        or capabilities & service_capabilities
+        or "servers" in requested_family_set
+    )
+    if industrial_iot_signal:
+        return "industrial_iot"
+    if automation_controller_signal:
+        return "automation_controller"
+    if voice_collaboration_signal:
+        return "voice_collaboration"
+    if physical_media_device_signal:
+        return "physical_media_device"
+    if wireless_advanced_signal:
+        return "wireless_advanced"
+    if wan_signal:
         return "wan_security_edge"
-    if (
-        requested_services & {"dns", "dhcp", "http", "https", "ftp", "tftp", "email", "syslog", "aaa", "ntp"}
-        or capabilities & {"server_dns", "server_dhcp", "server_http", "server_https", "server_ftp", "server_tftp", "server_email", "server_syslog", "server_aaa"}
-        or "servers" in requested_families
-    ) and not (plan.department_groups or {"switches", "multilayer switches"} & set(requested_families) and capabilities & {"vlan", "router_on_a_stick", "management_vlan", "telnet"}):
-        return "service_heavy"
-    if (
-        plan.department_groups
-        or {"switches", "multilayer switches"} & set(requested_families)
-        or capabilities & {"vlan", "router_on_a_stick", "management_vlan", "telnet", "acl", "nat", "pat"}
-    ):
+    if l2_resiliency_routing_signal:
+        return "l2_resiliency_routing"
+    if ipv4_routing_management_signal:
+        return "ipv4_routing_management"
+    if l2_security_monitoring_signal:
+        return "l2_security_monitoring"
+    if ipv6_routing_signal:
+        return "ipv6_routing"
+    if home_iot_signal:
+        return "home_iot"
+    if campus_signal:
         return "campus"
+    if service_signal:
+        return "service_heavy"
     return None
 
 
@@ -304,7 +665,16 @@ SCENARIO_CAPABILITY_SETS = {
     "campus": {"router_on_a_stick", "trunk", "access_port", "management_vlan", "telnet", "verification", "acl", "nat"},
     "service_heavy": {"server_dns", "server_dhcp", "server_http", "server_https", "server_ftp", "server_tftp", "server_email", "server_syslog", "server_aaa", "ntp"},
     "home_iot": {"iot", "iot_registration", "iot_control", "wireless_ap", "wireless_mutation"},
-    "wan_security_edge": {"vpn", "ipsec", "gre", "ppp", "acl", "nat"},
+    "wan_security_edge": {"vpn", "ipsec", "gre", "ppp", "acl", "nat", "cbac", "zfw"},
+    "ipv6_routing": {"ipv6_slaac", "dhcpv6_stateful", "dhcpv6_stateless", "ipv6_prefix_delegation", "ipv6_dns_aaaa", "ipv6_tunneling", "isatap", "ospfv3", "eigrp_ipv6", "ripng", "hsrp"},
+    "l2_resiliency_routing": {"bgp", "stp", "rstp", "etherchannel", "lacp", "pagp", "vtp", "dtp"},
+    "ipv4_routing_management": {"ospfv2", "eigrp_ipv4", "ripv2", "static_route", "default_route", "dhcp_relay", "nat_static", "nat_dynamic", "pat", "ssh_ios", "ntp_ios", "syslog_ios"},
+    "l2_security_monitoring": {"dhcp_snooping", "dai", "dot1x", "lldp", "rep", "snmp", "netflow", "span", "qos", "port_security"},
+    "wireless_advanced": {"wlc", "wpa_enterprise", "wep", "guest_wifi", "beamforming", "meraki", "cellular_5g", "bluetooth"},
+    "automation_controller": {"network_controller", "python_programming", "javascript_programming", "blockly_programming", "tcp_udp_app", "vm_iox"},
+    "voice_collaboration": {"voip", "ip_phone", "call_manager", "linksys_voice"},
+    "industrial_iot": {"mqtt", "real_http", "real_websocket", "visual_scripting", "ptp", "profinet", "l2nat", "cyberobserver", "industrial_firewall"},
+    "physical_media_device": {"coaxial", "cable_dsl", "central_office", "cell_tower", "power_distribution", "hot_swappable", "ios_license"},
 }
 
 CAPABILITY_REQUIRED_ARCHETYPES = {
@@ -330,6 +700,76 @@ CAPABILITY_REQUIRED_ARCHETYPES = {
     "ppp": ["WAN/security edge"],
     "multilayer_switching": ["WAN/security edge", "campus/core"],
     "security_edge": ["WAN/security edge"],
+    "cbac": ["WAN/security edge"],
+    "zfw": ["WAN/security edge"],
+    "ipv6_slaac": ["IPv6/routing"],
+    "dhcpv6_stateful": ["IPv6/routing"],
+    "dhcpv6_stateless": ["IPv6/routing"],
+    "ipv6_prefix_delegation": ["IPv6/routing"],
+    "ipv6_dns_aaaa": ["IPv6/routing"],
+    "ipv6_tunneling": ["IPv6/routing"],
+    "isatap": ["IPv6/routing"],
+    "ospfv3": ["IPv6/routing"],
+    "eigrp_ipv6": ["IPv6/routing"],
+    "ripng": ["IPv6/routing"],
+    "hsrp": ["IPv6/routing"],
+    "dhcp_snooping": ["L2 security/monitoring"],
+    "dai": ["L2 security/monitoring"],
+    "dot1x": ["L2 security/monitoring"],
+    "lldp": ["L2 security/monitoring"],
+    "rep": ["L2 security/monitoring"],
+    "snmp": ["L2 security/monitoring"],
+    "netflow": ["L2 security/monitoring"],
+    "span": ["L2 security/monitoring"],
+    "qos": ["L2 security/monitoring"],
+    "port_security": ["L2 security/monitoring"],
+    "bgp": ["L2 resiliency/routing"],
+    "stp": ["L2 resiliency/routing"],
+    "rstp": ["L2 resiliency/routing"],
+    "etherchannel": ["L2 resiliency/routing"],
+    "lacp": ["L2 resiliency/routing"],
+    "pagp": ["L2 resiliency/routing"],
+    "vtp": ["L2 resiliency/routing"],
+    "dtp": ["L2 resiliency/routing"],
+    "ospfv2": ["IPv4 routing/management"],
+    "eigrp_ipv4": ["IPv4 routing/management"],
+    "ripv2": ["IPv4 routing/management"],
+    "static_route": ["IPv4 routing/management"],
+    "default_route": ["IPv4 routing/management"],
+    "dhcp_relay": ["IPv4 routing/management"],
+    "nat_static": ["IPv4 routing/management"],
+    "nat_dynamic": ["IPv4 routing/management"],
+    "pat": ["IPv4 routing/management"],
+    "ssh_ios": ["IPv4 routing/management"],
+    "ntp_ios": ["IPv4 routing/management"],
+    "syslog_ios": ["IPv4 routing/management"],
+    "wlc": ["advanced wireless"],
+    "wpa_enterprise": ["advanced wireless"],
+    "wep": ["advanced wireless"],
+    "guest_wifi": ["advanced wireless"],
+    "beamforming": ["advanced wireless"],
+    "meraki": ["advanced wireless"],
+    "cellular_5g": ["advanced wireless"],
+    "bluetooth": ["advanced wireless"],
+    "network_controller": ["automation/controller"],
+    "python_programming": ["automation/controller"],
+    "javascript_programming": ["automation/controller"],
+    "blockly_programming": ["automation/controller"],
+    "tcp_udp_app": ["automation/controller"],
+    "vm_iox": ["automation/controller"],
+    "voip": ["voice/collaboration"],
+    "ip_phone": ["voice/collaboration"],
+    "call_manager": ["voice/collaboration"],
+    "linksys_voice": ["voice/collaboration"],
+    "mqtt": ["industrial IoT"],
+    "real_http": ["industrial IoT"],
+    "real_websocket": ["industrial IoT"],
+    "visual_scripting": ["industrial IoT"],
+    "ptp": ["industrial IoT"],
+    "profinet": ["industrial IoT"],
+    "l2nat": ["industrial IoT"],
+    "cyberobserver": ["industrial IoT"],
+    "industrial_firewall": ["industrial IoT"],
 }
 
 CAPABILITY_REQUIRED_RUNTIME_FEATURES = {
@@ -346,12 +786,44 @@ CAPABILITY_REQUIRED_RUNTIME_FEATURES = {
     "wireless_client_association": ["workspace_validated", "wireless_runtime"],
     "iot_registration": ["workspace_validated", "iot_runtime"],
     "iot_control": ["workspace_validated", "iot_runtime"],
+    "vpn": ["workspace_validated", "tunnel_runtime"],
+    "ipsec": ["workspace_validated", "tunnel_runtime"],
+    "gre": ["workspace_validated", "tunnel_runtime"],
+    "ppp": ["workspace_validated", "wan_runtime"],
+    "security_edge": ["workspace_validated", "security_runtime"],
+    "cbac": ["workspace_validated", "security_runtime"],
+    "zfw": ["workspace_validated", "security_runtime"],
+    "multilayer_switching": ["workspace_validated", "multilayer_runtime"],
+    "ipv6_slaac": ["workspace_validated", "ipv6_runtime"],
+    "dhcpv6_stateful": ["workspace_validated", "ipv6_runtime"],
+    "ospfv3": ["workspace_validated", "ipv6_runtime"],
+    "eigrp_ipv6": ["workspace_validated", "ipv6_runtime"],
+    "ripng": ["workspace_validated", "ipv6_runtime"],
+    "hsrp": ["workspace_validated", "ipv6_runtime"],
+    "wep": ["workspace_validated", "wireless_runtime"],
+    "wpa_enterprise": ["workspace_validated", "wireless_runtime"],
+    "ospfv2": ["workspace_validated", "ipv4_routing_management_runtime"],
+    "eigrp_ipv4": ["workspace_validated", "ipv4_routing_management_runtime"],
+    "ripv2": ["workspace_validated", "ipv4_routing_management_runtime"],
+    "static_route": ["workspace_validated", "ipv4_routing_management_runtime"],
+    "default_route": ["workspace_validated", "ipv4_routing_management_runtime"],
+    "dhcp_relay": ["workspace_validated", "ipv4_routing_management_runtime"],
+    "nat_static": ["workspace_validated", "ipv4_routing_management_runtime"],
+    "nat_dynamic": ["workspace_validated", "ipv4_routing_management_runtime"],
+    "pat": ["workspace_validated", "ipv4_routing_management_runtime"],
+    "ssh_ios": ["workspace_validated", "ipv4_routing_management_runtime"],
+    "ntp_ios": ["workspace_validated", "ipv4_routing_management_runtime"],
+    "syslog_ios": ["workspace_validated", "ipv4_routing_management_runtime"],
 }
 
 
 def _generate_mismatch_reason(status: dict[str, object]) -> str | None:
+    if bool(status.get("report_only")):
+        return "report_only"
     if not bool(status.get("inventory_supported")):
         return "unsupported"
+    if bool(status.get("donor_limited_generate")):
+        return "supported_but_donor_limited"
     if bool(status.get("edit_supported")) and not bool(status.get("safe_open_generate_supported")):
         return "supported_in_edit_only"
     if bool(status.get("safe_open_generate_supported")) and bool(status.get("requires_curated_donor")):
@@ -363,6 +835,327 @@ def _generate_mismatch_reason(status: dict[str, object]) -> str | None:
     return "unsupported"
 
 
+def _donor_backed_ready(status: dict[str, object]) -> bool:
+    return bool(status.get("donor_backed_ready"))
+
+
+def _selected_sample_for_donor(
+    samples: list[SampleDescriptor],
+    selected_donor: str | None,
+) -> SampleDescriptor | None:
+    if not selected_donor:
+        return None
+    needle = str(selected_donor).replace("\\", "/").lower()
+    for sample in samples:
+        candidates = {
+            str(sample.path).replace("\\", "/").lower(),
+            str(sample.relative_path).replace("\\", "/").lower(),
+            str(sample.path).replace("\\", "/").split("/")[-1].lower(),
+            str(sample.relative_path).replace("\\", "/").split("/")[-1].lower(),
+        }
+        if needle in candidates:
+            return sample
+    return None
+
+
+def _has_explicit_iot_registration(plan: IntentPlan) -> bool:
+    return any(
+        op.get("op") == "set_iot_registration"
+        and str(op.get("device", "")).strip()
+        and str(op.get("target", "")).strip()
+        for op in plan.iot_ops
+    )
+
+
+def _has_explicit_iot_control(plan: IntentPlan) -> bool:
+    return any(
+        op.get("op") == "set_iot_rule_state"
+        and str(op.get("device", "")).strip()
+        and str(op.get("rule_name", "")).strip()
+        for op in plan.iot_ops
+    )
+
+
+def _has_explicit_wireless_association(plan: IntentPlan) -> bool:
+    return any(
+        op.get("op") == "associate_wireless_client"
+        and str(op.get("device", "")).strip()
+        and str(op.get("ap", "")).strip()
+        and str(op.get("ssid", "")).strip()
+        for op in plan.wireless_ops
+    )
+
+
+def _has_explicit_advanced_wireless_edit(plan: IntentPlan, capability: str) -> bool:
+    for op in plan.wireless_ops:
+        if op.get("op") != "set_wireless_ssid":
+            continue
+        security = str(op.get("security") or "").strip().lower()
+        if capability == "wep" and security == "wep" and str(op.get("device") or "").strip() and str(op.get("ssid") or "").strip():
+            return True
+        if capability == "wpa_enterprise" and security in {"wpa-enterprise", "wpa2-enterprise", "802.1x"} and str(op.get("device") or "").strip() and str(op.get("ssid") or "").strip():
+            return True
+    return False
+
+
+def _has_explicit_programming_edit(plan: IntentPlan, capability: str) -> bool:
+    for op in plan.programming_ops:
+        if op.get("op") != "set_script_file_content":
+            continue
+        if not (
+            str(op.get("device") or "").strip()
+            and str(op.get("app_name") or "").strip()
+            and str(op.get("file_name") or "").strip()
+        ):
+            continue
+        file_name = str(op.get("file_name") or "").lower()
+        app_name = str(op.get("app_name") or "").lower()
+        content = str(op.get("content") or "").lower()
+        if capability == "python_programming" and (file_name.endswith(".py") or "python" in app_name):
+            return True
+        if capability == "javascript_programming" and (file_name.endswith(".js") or "javascript" in app_name):
+            return True
+        script_text = " ".join([file_name, app_name, content])
+        if capability == "tcp_udp_app" and ("tcp" in script_text or "udp" in script_text):
+            return True
+        if capability == "real_http" and ("realhttp" in content or "real http" in app_name):
+            return True
+        if capability == "real_websocket" and ("realws" in content or "websocket" in content or "websocket" in app_name):
+            return True
+    return False
+
+
+def _has_explicit_l2_security_edit(plan: IntentPlan, capability: str) -> bool:
+    expected_ops = {
+        "dot1x": {"set_dot1x"},
+        "qos": {"set_qos_policy"},
+    }.get(capability, set())
+    if not expected_ops:
+        return False
+    for op in plan.switch_ops:
+        if str(op.get("op")) not in expected_ops:
+            continue
+        if not str(op.get("device") or "").strip():
+            continue
+        if capability == "dot1x":
+            return bool(str(op.get("interface") or "").strip() and str(op.get("mode") or "").strip())
+        if capability == "qos":
+            return bool(
+                str(op.get("interface") or "").strip()
+                and str(op.get("class_map") or "").strip()
+                and str(op.get("policy_map") or "").strip()
+                and str(op.get("direction") or "").strip()
+            )
+    return False
+
+
+def _has_explicit_l2_resiliency_edit(plan: IntentPlan, capability: str) -> bool:
+    if capability == "bgp":
+        return any(
+            op.get("op") == "set_bgp_neighbor"
+            and str(op.get("device") or "").strip()
+            and str(op.get("neighbor") or "").strip()
+            and str(op.get("remote_as") or "").strip()
+            for op in plan.router_ops
+        )
+    for op in plan.switch_ops:
+        if not str(op.get("device") or "").strip():
+            continue
+        op_name = str(op.get("op"))
+        if capability == "stp" and op_name == "set_stp":
+            return bool(str(op.get("mode") or "").strip())
+        if capability == "rstp" and op_name == "set_stp":
+            return bool(re.search(r"(?:rapid|rstp)", str(op.get("mode") or ""), flags=re.IGNORECASE))
+        if capability == "etherchannel" and op_name == "set_etherchannel":
+            return bool(op.get("interfaces"))
+        if capability == "lacp" and op_name == "set_etherchannel":
+            if str(op.get("mode") or "").lower() in {"active", "passive"} and bool(op.get("interfaces")):
+                return True
+            continue
+        if capability == "pagp" and op_name == "set_etherchannel":
+            if str(op.get("mode") or "").lower() in {"desirable", "auto"} and bool(op.get("interfaces")):
+                return True
+            continue
+        if capability == "vtp" and op_name == "set_vtp":
+            return bool(str(op.get("domain") or "").strip() and str(op.get("mode") or "").strip())
+        if capability == "dtp" and op_name == "set_dtp":
+            return bool(str(op.get("interface") or "").strip() and str(op.get("mode") or "").strip())
+    return False
+
+
+def _has_explicit_ipv4_routing_management_edit(plan: IntentPlan, capability: str) -> bool:
+    operation_map = {
+        "ospfv2": {"set_ospfv2_network"},
+        "eigrp_ipv4": {"set_eigrp_ipv4_network"},
+        "ripv2": {"set_ripv2_network"},
+        "static_route": {"set_static_route"},
+        "default_route": {"set_static_route"},
+        "dhcp_relay": {"set_dhcp_relay"},
+        "nat_static": {"set_nat_static"},
+        "nat_dynamic": {"set_nat_interface"},
+        "pat": {"set_pat_overload"},
+        "ssh_ios": {"set_ssh_ios"},
+        "ntp_ios": {"set_ntp_server"},
+        "syslog_ios": {"set_syslog_server"},
+    }
+    expected_ops = operation_map.get(capability, set())
+    if not expected_ops:
+        return False
+    for op in plan.router_ops:
+        if str(op.get("op")) not in expected_ops:
+            continue
+        if not str(op.get("device") or "").strip():
+            continue
+        if capability == "default_route":
+            return op.get("network") == "0.0.0.0" and op.get("prefix") == 0
+        if capability == "nat_dynamic":
+            return str(op.get("role") or "").lower() in {"inside", "outside"} and str(op.get("interface") or "").strip()
+        return True
+    return False
+
+
+def _has_explicit_wan_security_edit(plan: IntentPlan, capability: str) -> bool:
+    expected_ops = {
+        "gre": {"set_gre_tunnel"},
+        "ppp": {"set_ppp_interface"},
+        "ipsec": {"set_ipsec_transform_set", "set_crypto_map"},
+        "vpn": {"set_crypto_map"},
+        "cbac": {"set_cbac_inspect"},
+        "zfw": {"set_zfw_zone_interface", "set_zfw_zone_pair", "set_zfw_policy"},
+    }.get(capability, set())
+    if not expected_ops:
+        return False
+    for op in plan.router_ops:
+        if str(op.get("op")) not in expected_ops:
+            continue
+        if not str(op.get("device") or "").strip():
+            continue
+        if capability == "gre":
+            return bool(str(op.get("interface") or "").strip() and str(op.get("source") or "").strip() and str(op.get("destination") or "").strip())
+        if capability == "ppp":
+            return bool(str(op.get("interface") or "").strip())
+        if capability == "ipsec":
+            if op.get("op") == "set_ipsec_transform_set":
+                return bool(str(op.get("name") or "").strip() and str(op.get("encryption") or "").strip() and str(op.get("integrity") or "").strip())
+            return bool(str(op.get("map_name") or "").strip() and str(op.get("transform_set") or "").strip())
+        if capability == "vpn":
+            return bool(str(op.get("map_name") or "").strip() and str(op.get("peer") or "").strip())
+        if capability == "cbac":
+            return bool(str(op.get("name") or "").strip() and str(op.get("protocol") or "").strip() and str(op.get("interface") or "").strip())
+        if capability == "zfw":
+            if op.get("op") == "set_zfw_zone_interface":
+                return bool(str(op.get("zone") or "").strip() and str(op.get("interface") or "").strip())
+            if op.get("op") == "set_zfw_zone_pair":
+                return bool(str(op.get("pair_name") or "").strip() and str(op.get("source") or "").strip() and str(op.get("destination") or "").strip())
+            return bool(str(op.get("class_map") or "").strip() and str(op.get("policy_map") or "").strip())
+    return False
+
+
+def _has_explicit_wan_security_intent(plan: IntentPlan) -> bool:
+    capabilities = set(plan.capabilities)
+    prompt_lower = str(plan.prompt or "").lower()
+    return (
+        plan.network_style == "wan_security"
+        or bool(capabilities & {"vpn", "ipsec", "gre", "ppp", "security_edge", "multilayer_switching"})
+        or any(token in prompt_lower for token in ["site-to-site", "firewall", "asa", "cloud", "multilayer"])
+    )
+
+
+def _has_explicit_voice_edit(plan: IntentPlan, capability: str) -> bool:
+    op_names = {str(op.get("op")) for op in plan.router_ops}
+    if capability == "voip":
+        return bool(op_names & {"set_telephony_service", "set_ephone_dn", "set_ephone", "set_dial_peer_voice"})
+    if capability == "call_manager":
+        return bool(op_names & {"set_telephony_service", "set_ephone_dn", "set_ephone"})
+    if capability == "ip_phone":
+        return bool(op_names & {"set_ephone_dn", "set_ephone"})
+    return False
+
+
+def _has_explicit_ipv6_operation(plan: IntentPlan, capability: str) -> bool:
+    operation_map = {
+        "ipv6_slaac": {"enable_ipv6_unicast_routing", "set_ipv6_address", "set_ipv6_slaac"},
+        "dhcpv6_stateful": {"set_dhcpv6_pool"},
+        "ospfv3": {"set_ospfv3_interface"},
+        "eigrp_ipv6": {"set_eigrp_ipv6_interface"},
+        "ripng": {"set_ripng_interface"},
+        "hsrp": {"set_hsrp_ipv6"},
+    }
+    expected_ops = operation_map.get(capability, set())
+    return any(str(op.get("op")) in expected_ops for op in plan.router_ops)
+
+
+def _selected_donor_capability_override(
+    plan: IntentPlan,
+    capability: str,
+    selected_sample: SampleDescriptor | None,
+) -> bool:
+    if selected_sample is None:
+        return False
+    device_families = sorted({_device_family_for_type(device.get("type", "")) for device in selected_sample.devices if device.get("type")})
+    sample_capabilities = set(_expanded_sample_capabilities(selected_sample, device_families))
+    sample_capabilities.update(str(item) for item in selected_sample.validated_edit_capabilities if str(item).strip())
+    archetypes = {str(item) for item in selected_sample.archetype_tags if str(item).strip()}
+    runtime_features = {str(item) for item in selected_sample.runtime_features if str(item).strip()}
+
+    if capability == "iot":
+        return (
+            bool(archetypes & {"IoT/home gateway"})
+            and bool(sample_capabilities & {"iot", "iot_registration", "iot_control"})
+            and bool(runtime_features & {"iot_runtime"})
+            and (_has_explicit_iot_registration(plan) or _has_explicit_iot_control(plan))
+        )
+    if capability == "iot_registration":
+        return (
+            "IoT/home gateway" in archetypes
+            and "iot_registration" in sample_capabilities
+            and "iot_runtime" in runtime_features
+            and _has_explicit_iot_registration(plan)
+        )
+    if capability == "iot_control":
+        return (
+            "IoT/home gateway" in archetypes
+            and "iot_control" in sample_capabilities
+            and "iot_runtime" in runtime_features
+            and _has_explicit_iot_control(plan)
+        )
+    if capability == "wireless_client_association":
+        return (
+            bool(archetypes & {"IoT/home gateway", "wireless-heavy"})
+            and "wireless_client_association" in sample_capabilities
+            and "wireless_runtime" in runtime_features
+            and _has_explicit_wireless_association(plan)
+        )
+    wan_runtime_by_capability = {
+        "vpn": {"tunnel_runtime", "security_runtime", "wan_runtime"},
+        "ipsec": {"tunnel_runtime", "security_runtime"},
+        "gre": {"tunnel_runtime", "wan_runtime"},
+        "ppp": {"wan_runtime"},
+        "security_edge": {"security_runtime"},
+        "multilayer_switching": {"multilayer_runtime"},
+    }
+    if capability in wan_runtime_by_capability:
+        has_acceptance_backed_wan_generate = (
+            bool(selected_sample.acceptance_fixtures)
+            and selected_sample.apply_safety_level in {"acceptance-verified", "safe-open-generate-supported"}
+        )
+        return (
+            "WAN/security edge" in archetypes
+            and capability in sample_capabilities
+            and bool(runtime_features & wan_runtime_by_capability[capability])
+            and has_acceptance_backed_wan_generate
+            and _has_explicit_wan_security_intent(plan)
+        )
+    if capability in IPV6_DONOR_BACKED_CAPABILITIES:
+        return (
+            "IPv6/routing" in archetypes
+            and capability in sample_capabilities
+            and "ipv6_runtime" in runtime_features
+            and _has_explicit_ipv6_operation(plan, capability)
+        )
+    return False
+
+
 def _best_maturity_level(status: dict[str, object]) -> str:
     level = str(status.get("best_maturity_level") or "").strip()
     if level in MATURITY_RANK:
@@ -381,6 +1174,60 @@ def _best_maturity_level(status: dict[str, object]) -> str:
 
 
 def _recommended_next_action_for_capability(capability: str, mismatch_reason: str | None) -> str:
+    if mismatch_reason == "report_only":
+        return f"Keep {capability} in atlas/report mode until donor-backed edit or generate evidence exists."
+    if capability in {"vpn", "ipsec", "gre", "ppp", "security_edge", "multilayer_switching", "cbac", "zfw"}:
+        if mismatch_reason == "supported_in_edit_only":
+            return f"Use explicit WAN/security edit commands for {capability}; strict prompt generate still needs an acceptance-backed WAN/security donor."
+        if mismatch_reason == "supported_but_donor_limited":
+            return f"Provide a WAN/security edge donor with reusable ASA/cloud/serial or tunnel skeleton for {capability}."
+        if mismatch_reason == "supported_but_acceptance_gated":
+            return f"Keep {capability} in report/selection flow until a WAN/security edge donor is acceptance-backed."
+        return f"Prefer a WAN/security edge donor with explicit {capability} evidence before strict generate."
+    if capability in IPV6_DONOR_BACKED_CAPABILITIES:
+        if mismatch_reason == "supported_in_edit_only":
+            return f"Use explicit edit commands for {capability}; strict prompt generate still needs a selected IPv6/routing donor."
+        if mismatch_reason == "supported_but_donor_limited":
+            return f"Provide an IPv6/routing donor with reusable IPv6 interface and routing skeleton for {capability}."
+        if mismatch_reason == "supported_but_acceptance_gated":
+            return f"Keep {capability} in report/edit flow until an IPv6/routing donor is acceptance-backed."
+        return f"Prefer an IPv6/routing donor and explicit router/interface targets before strict generate for {capability}."
+    if capability in L2_SECURITY_MONITORING_EDIT_PROVEN_CAPABILITIES:
+        if mismatch_reason == "supported_in_edit_only":
+            return f"Use explicit edit commands for {capability}; strict prompt generate still needs an acceptance-backed L2 security/monitoring donor."
+        if mismatch_reason == "supported_but_donor_limited":
+            return f"Provide an L2 security/monitoring donor with reusable switch/router monitoring skeleton for {capability}."
+        return f"Keep {capability} constrained to edit/inventory proof until an L2 security/monitoring donor is acceptance-backed."
+    if capability in WIRELESS_ADVANCED_EDIT_PROVEN_CAPABILITIES:
+        if mismatch_reason == "supported_in_edit_only":
+            return f"Use explicit wireless edit commands for {capability}; strict prompt generate still needs an acceptance-backed advanced wireless donor."
+        if mismatch_reason == "supported_but_donor_limited":
+            return f"Provide an advanced wireless donor with reusable AP/router/WLC skeleton for {capability}."
+        return f"Keep {capability} constrained to explicit wireless edit proof until an advanced wireless donor is acceptance-backed."
+    if capability in VOICE_COLLABORATION_EDIT_PROVEN_CAPABILITIES:
+        if mismatch_reason == "supported_in_edit_only":
+            return f"Use explicit voice IOS edit commands for {capability}; strict prompt generate still needs an acceptance-backed voice/collaboration donor."
+        if mismatch_reason == "supported_but_donor_limited":
+            return f"Provide a voice/collaboration donor with reusable telephony-service, ephone, or dial-peer skeleton for {capability}."
+        return f"Keep {capability} constrained to voice inventory/edit proof until a voice/collaboration donor is acceptance-backed."
+    if capability in AUTOMATION_CONTROLLER_EDIT_PROVEN_CAPABILITIES:
+        if mismatch_reason == "supported_in_edit_only":
+            return f"Use explicit script-file edit commands for {capability}; strict prompt generate still needs an acceptance-backed automation/controller donor."
+        if mismatch_reason == "supported_but_donor_limited":
+            return f"Provide an automation/controller donor with reusable existing app/file script surfaces for {capability}."
+        return f"Keep {capability} constrained to automation inventory/edit proof until an automation/controller donor is acceptance-backed."
+    if capability == "iot_registration":
+        if mismatch_reason == "supported_but_acceptance_gated":
+            return "Use an IoT/home gateway donor and explicitly name the thing plus gateway/server target before strict generate."
+        return "Prefer an IoT/home gateway donor and explicitly name the thing plus gateway/server target."
+    if capability == "iot_control":
+        if mismatch_reason == "supported_but_acceptance_gated":
+            return "Use a donor that already contains IoT rules and explicitly name the rule-bearing device before strict generate."
+        return "Prefer an IoT/home gateway donor with existing rule/control structure before strict generate."
+    if capability == "wireless_client_association":
+        if mismatch_reason == "supported_but_acceptance_gated":
+            return "Use a donor-backed wireless prompt that explicitly names the client, AP/router, and SSID before strict generate."
+        return "Prefer a wireless-heavy or IoT/home gateway donor and explicitly name the client, AP/router, and SSID."
     if mismatch_reason == "supported_in_edit_only":
         return f"Use donor-backed edit flow for {capability} until safe-open generate coverage is raised."
     if mismatch_reason == "supported_but_donor_limited":
@@ -528,6 +1375,7 @@ def build_coverage_gap_report(
     selected_donor: str | None = None,
 ) -> CoverageGapReport:
     iot_acceptance_gated = {"iot", "iot_registration", "iot_control"}
+    selected_sample = _selected_sample_for_donor(samples, selected_donor)
     matrix = build_capability_matrix(samples)
     by_capability: dict[str, list[CapabilityMatrixEntry]] = {}
     by_family: dict[str, list[CapabilityMatrixEntry]] = {}
@@ -544,6 +1392,79 @@ def build_coverage_gap_report(
     capability_statuses: list[dict[str, object]] = []
     for capability in requested_capabilities:
         provider_families = _provider_families_for_capability(capability, requested_families)
+        selected_donor_backed = _selected_donor_capability_override(plan, capability, selected_sample)
+        wireless_edit_proven_only = (
+            capability in WIRELESS_ADVANCED_EDIT_PROVEN_CAPABILITIES
+            and _has_explicit_advanced_wireless_edit(plan, capability)
+            and not selected_donor_backed
+        )
+        programming_edit_proven_only = (
+            capability in PROGRAMMING_EDIT_PROVEN_CAPABILITIES
+            and _has_explicit_programming_edit(plan, capability)
+            and not selected_donor_backed
+        )
+        programming_donor_backed_ready = (
+            capability in PROGRAMMING_DONOR_BACKED_READY_CAPABILITIES
+            and programming_edit_proven_only
+        )
+        voice_edit_proven_only = (
+            capability in VOICE_COLLABORATION_EDIT_PROVEN_CAPABILITIES
+            and _has_explicit_voice_edit(plan, capability)
+            and not selected_donor_backed
+        )
+        voice_donor_backed_ready = (
+            capability in VOICE_COLLABORATION_DONOR_BACKED_READY_CAPABILITIES
+            and voice_edit_proven_only
+        )
+        l2_security_edit_proven_only = (
+            capability in {"dot1x", "qos"}
+            and _has_explicit_l2_security_edit(plan, capability)
+            and not selected_donor_backed
+        )
+        l2_security_donor_backed_ready = (
+            capability in L2_SECURITY_MONITORING_DONOR_BACKED_READY_CAPABILITIES
+            and l2_security_edit_proven_only
+        )
+        wan_security_edit_proven_only = (
+            capability in WAN_SECURITY_EDIT_PROVEN_CAPABILITIES
+            and _has_explicit_wan_security_edit(plan, capability)
+            and not selected_donor_backed
+        )
+        l2_resiliency_edit_proven_only = (
+            capability in L2_RESILIENCY_ROUTING_EDIT_PROVEN_CAPABILITIES
+            and _has_explicit_l2_resiliency_edit(plan, capability)
+            and not selected_donor_backed
+        )
+        ipv4_routing_management_edit_proven_only = (
+            capability in IPV4_ROUTING_MANAGEMENT_EDIT_PROVEN_CAPABILITIES
+            and _has_explicit_ipv4_routing_management_edit(plan, capability)
+            and not selected_donor_backed
+        )
+        wan_security_donor_backed_ready = (
+            capability in WAN_SECURITY_DONOR_BACKED_READY_EDIT_CAPABILITIES
+            and wan_security_edit_proven_only
+        )
+        wan_security_donor_limited = (
+            capability in WAN_SECURITY_DONOR_LIMITED_CAPABILITIES
+            and _has_explicit_wan_security_intent(plan)
+            and not selected_donor_backed
+            and not wan_security_edit_proven_only
+        )
+        edit_proven_only = (
+            capability in EDIT_PROVEN_REPORT_CAPABILITIES
+            or wireless_edit_proven_only
+            or programming_edit_proven_only
+            or voice_edit_proven_only
+            or l2_security_edit_proven_only
+            or wan_security_edit_proven_only
+            or l2_resiliency_edit_proven_only
+            or ipv4_routing_management_edit_proven_only
+        ) and not selected_donor_backed
+        ipv6_donor_backed_ready = (
+            capability in IPV6_DONOR_BACKED_READY_EDIT_CAPABILITIES
+            and edit_proven_only
+        )
+        report_only = capability in REPORT_ONLY_CAPABILITIES and not selected_donor_backed and not edit_proven_only
         matching_entries = [
             entry
             for entry in by_capability.get(capability, [])
@@ -552,8 +1473,18 @@ def build_coverage_gap_report(
         if matching_entries:
             supported_capabilities.append(capability)
             best_entry = max(matching_entries, key=lambda entry: MATURITY_RANK[entry.maturity_level])
-            acceptance_verified = any(entry.maturity_level == "acceptance-verified" for entry in matching_entries) and capability not in iot_acceptance_gated
-            if best_entry.maturity_level == "safe-open-generate-supported":
+            acceptance_verified = (
+                (any(entry.maturity_level == "acceptance-verified" for entry in matching_entries) and capability not in iot_acceptance_gated)
+                or selected_donor_backed
+            )
+            if report_only or edit_proven_only or wan_security_donor_limited:
+                acceptance_verified = False
+            requires_curated = (
+                best_entry.maturity_level == "safe-open-generate-supported"
+                and not selected_donor_backed
+                and not edit_proven_only
+            ) or wan_security_donor_limited
+            if requires_curated:
                 requires_curated_donor.append(capability)
             if not acceptance_verified:
                 requires_manual_acceptance.append(capability)
@@ -562,18 +1493,101 @@ def build_coverage_gap_report(
                     "capability": capability,
                     "provider_families": sorted(provider_families),
                     "matching_device_families": sorted({entry.device_family for entry in matching_entries}),
-                    "best_maturity_level": best_entry.maturity_level,
+                    "best_maturity_level": "inventory-supported" if report_only else "config-mutation-supported" if edit_proven_only else best_entry.maturity_level,
                     "inventory_supported": any(MATURITY_RANK[entry.maturity_level] >= MATURITY_RANK["inventory-supported"] for entry in matching_entries),
-                    "edit_supported": any(MATURITY_RANK[entry.maturity_level] >= MATURITY_RANK["config-mutation-supported"] for entry in matching_entries),
-                    "config_mutation_supported": any(MATURITY_RANK[entry.maturity_level] >= MATURITY_RANK["config-mutation-supported"] for entry in matching_entries),
-                    "safe_open_generate_supported": any(MATURITY_RANK[entry.maturity_level] >= MATURITY_RANK["safe-open-generate-supported"] for entry in matching_entries),
+                    "edit_supported": True if edit_proven_only else False if report_only else any(MATURITY_RANK[entry.maturity_level] >= MATURITY_RANK["config-mutation-supported"] for entry in matching_entries),
+                    "config_mutation_supported": True if edit_proven_only else False if report_only else any(MATURITY_RANK[entry.maturity_level] >= MATURITY_RANK["config-mutation-supported"] for entry in matching_entries),
+                    "safe_open_generate_supported": False if report_only or edit_proven_only or wan_security_donor_limited else any(MATURITY_RANK[entry.maturity_level] >= MATURITY_RANK["safe-open-generate-supported"] for entry in matching_entries),
                     "acceptance_verified": acceptance_verified,
-                    "requires_curated_donor": best_entry.maturity_level == "safe-open-generate-supported",
+                    "donor_backed_ready": bool(
+                        selected_donor_backed
+                        or ipv6_donor_backed_ready
+                        or programming_donor_backed_ready
+                        or voice_donor_backed_ready
+                        or l2_security_donor_backed_ready
+                        or wan_security_donor_backed_ready
+                    ),
+                    "requires_curated_donor": requires_curated,
                     "requires_manual_acceptance": not acceptance_verified,
+                    "report_only": report_only,
+                    "donor_limited_generate": wan_security_donor_limited,
                     "recommended_donors": list(dict.fromkeys(donor for entry in matching_entries for donor in entry.accepted_donors))[:10],
                     "known_limitations": list(dict.fromkeys(item for entry in matching_entries for item in entry.known_limitations)),
                 }
             )
+        elif edit_proven_only:
+            supported_capabilities.append(capability)
+            requires_manual_acceptance.append(capability)
+            capability_statuses.append(
+                {
+                    "capability": capability,
+                    "provider_families": sorted(provider_families),
+                    "matching_device_families": sorted(provider_families),
+                    "best_maturity_level": "config-mutation-supported",
+                    "inventory_supported": True,
+                    "edit_supported": True,
+                    "config_mutation_supported": True,
+                    "safe_open_generate_supported": False,
+                    "acceptance_verified": False,
+                    "donor_backed_ready": bool(
+                        programming_donor_backed_ready
+                        or ipv6_donor_backed_ready
+                        or voice_donor_backed_ready
+                        or l2_security_donor_backed_ready
+                        or wan_security_donor_backed_ready
+                    ),
+                    "requires_curated_donor": False,
+                    "requires_manual_acceptance": True,
+                    "report_only": False,
+                    "donor_limited_generate": False,
+                    "recommended_donors": [],
+                    "known_limitations": ["editor-proven without sample-backed donor selection"],
+                }
+            )
+        elif report_only:
+            supported_capabilities.append(capability)
+            requires_manual_acceptance.append(capability)
+            capability_statuses.append(
+                {
+                    "capability": capability,
+                    "provider_families": sorted(provider_families),
+                    "matching_device_families": sorted(provider_families),
+                    "best_maturity_level": "inventory-supported",
+                    "inventory_supported": True,
+                    "edit_supported": False,
+                    "config_mutation_supported": False,
+                    "safe_open_generate_supported": False,
+                    "acceptance_verified": False,
+                    "donor_backed_ready": False,
+                    "requires_curated_donor": False,
+                    "requires_manual_acceptance": True,
+                    "report_only": True,
+                    "donor_limited_generate": False,
+                    "recommended_donors": [],
+                    "known_limitations": ["report-supported without decode-backed donor selection"],
+                }
+            )
+        elif selected_donor_backed and selected_sample is not None:
+            supported_capabilities.append(capability)
+            capability_statuses.append(
+                {
+                    "capability": capability,
+                    "provider_families": sorted(provider_families),
+                    "matching_device_families": sorted({family for family in (selected_sample.device_families or []) if not provider_families or family in provider_families}),
+                    "best_maturity_level": selected_sample.apply_safety_level or "safe-open-generate-supported",
+                    "inventory_supported": True,
+                    "edit_supported": True,
+                    "config_mutation_supported": True,
+                    "safe_open_generate_supported": True,
+                    "acceptance_verified": True,
+                    "donor_backed_ready": True,
+                    "requires_curated_donor": False,
+                    "requires_manual_acceptance": False,
+                    "donor_limited_generate": False,
+                    "recommended_donors": [selected_sample.relative_path],
+                    "known_limitations": [],
+                }
+            )
         else:
             unsupported_capabilities.append(capability)
             capability_statuses.append(
@@ -587,8 +1601,10 @@ def build_coverage_gap_report(
                     "config_mutation_supported": False,
                     "safe_open_generate_supported": False,
                     "acceptance_verified": False,
+                    "donor_backed_ready": False,
                     "requires_curated_donor": False,
                     "requires_manual_acceptance": True,
+                    "donor_limited_generate": False,
                     "recommended_donors": [],
                     "known_limitations": ["no matching donor coverage found"],
                 }
@@ -603,6 +1619,7 @@ def build_coverage_gap_report(
             "capability": str(status.get("capability")),
             "inventory_supported": bool(status.get("inventory_supported")),
             "edit_supported": bool(status.get("edit_supported")),
+            "donor_backed_ready": _donor_backed_ready(status),
             "generate_supported": bool(status.get("safe_open_generate_supported")),
             "acceptance_verified": bool(status.get("acceptance_verified")),
             "best_maturity_level": _best_maturity_level(status),
@@ -694,6 +1711,18 @@ def build_inventory_capability_report(payload: dict[str, Any]) -> dict[str, obje
         capabilities.add("acl")
     if payload.get("topology_summary", {}).get("network_style") == "wan_security":
         capabilities.update({"vpn", "ipsec", "gre", "ppp"})
+    for routing_details in payload.get("routing", {}).values():
+        capabilities.update(str(capability) for capability in routing_details.get("capabilities", []) if str(capability).strip())
+    for l2_details in payload.get("l2_security_monitoring", {}).values():
+        capabilities.update(str(capability) for capability in l2_details.get("capabilities", []) if str(capability).strip())
+    for l2_resiliency_details in payload.get("l2_resiliency_routing", {}).values():
+        capabilities.update(str(capability) for capability in l2_resiliency_details.get("capabilities", []) if str(capability).strip())
+    for ipv4_details in payload.get("ipv4_routing_management", {}).values():
+        capabilities.update(str(capability) for capability in ipv4_details.get("capabilities", []) if str(capability).strip())
+    for voice_details in payload.get("voice", {}).values():
+        capabilities.update(str(capability) for capability in voice_details.get("capabilities", []) if str(capability).strip())
+    for programming_details in payload.get("programming", {}).values():
+        capabilities.update(str(capability) for capability in programming_details.get("feature_tags", []) if str(capability).strip())
     return {
         "device_families": families,
         "capabilities": sorted(capabilities),