packet-tracer-skill 0.2.2 → 0.2.3

package/docs/l2-resiliency-bgp-proof.md

@@ -0,0 +1,60 @@
+# L2 Resiliency + BGP Proof Wave
+
+This proof wave uses the local user-supplied `pkt_examples` corpus as evidence input only. Raw `.pkt` files, imported caches, and `output/pkt_examples_audit.json` are not package or repository artifacts.
+
+## What Is Covered
+
+The wave adds parser, inventory, catalog, atlas, and parity truth for:
+
+- `bgp`
+- `stp`
+- `rstp`
+- `etherchannel`
+- `lacp`
+- `pagp`
+- `vtp`
+- `dtp`
+
+These capabilities are constrained to IOS text configuration surfaces. They are not broad topology generation features.
+
+## Explicit Edit Commands
+
+Supported edit-proof command shapes:
+
+```powershell
+python scripts/generate_pkt.py --parity-report "set R1 bgp 65001 neighbor 10.0.0.2 remote-as 65002 network 192.168.1.0 mask 255.255.255.0"
+python scripts/generate_pkt.py --parity-report "set SW1 stp mode rapid-pvst vlan 10 root primary"
+python scripts/generate_pkt.py --parity-report "set SW1 etherchannel 1 mode active interfaces FastEthernet0/1 FastEthernet0/2"
+python scripts/generate_pkt.py --parity-report "set SW1 etherchannel 2 mode desirable interfaces FastEthernet0/3 FastEthernet0/4"
+python scripts/generate_pkt.py --parity-report "set SW1 vtp domain CAMPUS mode server version 2"
+python scripts/generate_pkt.py --parity-report "set SW1 dtp interface FastEthernet0/1 mode dynamic desirable"
+```
+
+## Target Rules
+
+- The target device name must be explicit.
+- Interface names must be explicit where an interface command is used.
+- Only existing device configuration text is mutated.
+- No GUI/internal Packet Tracer state is guessed.
+- No links, modules, devices, or topology shape are synthesized in this wave.
+
+## What This Proves
+
+- BGP neighbor/network IOS text can be parsed and written deterministically.
+- The editor writes a `router bgp` block with explicit `neighbor ... remote-as` and optional `network ... mask` lines.
+- STP/RSTP can be detected separately from SPAN/RSPAN through explicit `spanning-tree` lines.
+- EtherChannel can be represented through explicit `channel-group` and `Port-channel` text.
+- LACP/PAgP are derived from explicit EtherChannel modes.
+- VTP and DTP line shapes can be parsed, inventoried, and roundtripped as IOS text.
+
+## What This Does Not Prove
+
+- It does not prove full BGP peering convergence.
+- It does not prove STP state simulation correctness.
+- It does not create or validate physical redundant links.
+- It does not make these capabilities `donor_backed_ready`.
+- It does not make any of these capabilities `generate_ready`.
+
+## Current Product Status
+
+The atlas status for this wave is `edit_proven` when roundtrip tests exist. `generate_ready=0` remains intentional until a single-donor acceptance fixture proves a strict safe-open generate path.

package/docs/l2-security-qos-proof.md

@@ -0,0 +1,59 @@
+# L2 Security and QoS Proof
+
+This proof records the `0.2.3` candidate L2 security/QoS edit-proven subset. It is intentionally narrow: the skill can append deterministic IOS-style switch configuration lines for explicitly named targets, but it does not synthesize a full NAC or QoS design from a broad prompt.
+
+## Explicit Commands
+
+Supported explicit edit shapes:
+
+```text
+set SW1 dot1x interface FastEthernet0/1 mode auto radius 192.168.1.10 key radius123
+set SW1 qos class-map VOICE match dscp ef policy-map QOS_POLICY class VOICE priority service-policy output FastEthernet0/1
+```
+
+The dot1x command writes:
+
+```text
+aaa new-model
+dot1x system-auth-control
+radius-server host 192.168.1.10 key radius123
+interface FastEthernet0/1
+ authentication port-control auto
+ dot1x pae authenticator
+```
+
+The QoS command writes:
+
+```text
+mls qos
+class-map match-any VOICE
+ match dscp ef
+policy-map QOS_POLICY
+ class VOICE
+  priority
+interface FastEthernet0/1
+ service-policy output QOS_POLICY
+```
+
+## Donor-Backed Readiness
+
+- `dot1x` is `donor_backed_ready` because it has parser, catalog, decode-verified sample, and editor roundtrip evidence.
+- `qos` remains `edit_proven` rather than `donor_backed_ready` because the current QoS sample evidence is path-backed but not decode-verified in the atlas gate.
+
+## What This Proves
+
+- `dot1x` and `qos` are parser-recognized as `l2_security_monitoring`.
+- Explicit dot1x and QoS commands roundtrip through Packet Tracer XML config text.
+- Parity reports mark these capabilities as `edit_supported=true`, `generate_supported=false`, and `generate_mismatch_reason=supported_in_edit_only`.
+- The feature atlas can classify dot1x as `donor_backed_ready` and QoS as `edit_proven` when the proof gate is evaluated.
+
+## What This Does Not Prove
+
+- This does not make dot1x or QoS `generate_ready`.
+- This does not create RADIUS server users, certificates, supplicant profiles, policy discovery, or end-to-end NAC validation.
+- This does not generate QoS classes from traffic intent; class-map, policy-map, direction, and interface must be explicit.
+- This does not prove every Packet Tracer switch model accepts every IOS line.
+
+## Safe Next Step
+
+The next promotion would require selected-donor proof with a reusable L2 security/monitoring skeleton and acceptance fixtures. Until then, broad prompts such as `dot1x qos policy class-map policy-map` remain report/plan evidence, while explicit commands use the edit-only path.

package/docs/packet-tracer-feature-gap-atlas.md

@@ -7,21 +7,33 @@ It is intentionally conservative:
 - `inventory_known` means a Packet Tracer sample or path proves the feature exists.
 - `report_supported` means the skill can recognize and report the feature without claiming mutation support.
 - `edit_proven` requires a roundtrip editor test.
-- `donor_backed_ready` requires selected-donor evidence.
+- `donor_backed_ready` requires selected-donor evidence or a validated proof-linked explicit edit gate with sample, decode, and roundtrip evidence.
 - `generate_ready` requires acceptance-backed generate behavior.
 
 The atlas does not claim that every Packet Tracer feature is generate-ready. It turns missing or under-modelled Packet Tracer features into an auditable backlog before any broad config mutation is opened.
 
-## First Generate Enablement Wave
+## Remote Sample Evidence
 
-The first promotion wave is `ipv6_routing`. The following subset can move beyond report-only only when explicit router/interface targets and an IPv6/routing donor are selected:
+GitHub `.pkt` repositories can add discovery evidence, but they do not automatically change feature maturity.
 
-- IPv6 interface/SLAAC config
-- DHCPv6 stateful pool binding
-- OSPFv3 interface routing
-- EIGRP IPv6 interface routing
-- RIPng interface routing
-- IPv6 HSRP virtual address
+Remote sample evidence is treated in three layers:
+
+- sample-path evidence: a public repo path suggests a Packet Tracer feature exists, but the file may still fail decode or validation
+- decode/inventory evidence: a locally cached sample opens through the decoder and produces feature tags
+- proof evidence: an explicit editor roundtrip or acceptance fixture proves a safe operation shape
+
+`output/remote-import-cache/remote-sample-audit.json` records repo URL, license metadata, imported file counts, decode success/failure counts, detected feature tags, license-based candidate promotion status, and decode-gated validation status. Unknown-license repositories remain `reference_only`. Permissive-license repositories only become curated candidates after local decode and inventory validation. Raw remote `.pkt` files are never a checked-in truth source.
+
+## First Donor-Backed Edit Readiness Wave
+
+The first promotion wave is `ipv6_routing`. The following subset can move beyond report-only when explicit router/interface targets or proof-linked IPv6/routing edit evidence exists:
+
+- IPv6 interface/SLAAC config remains edit-proven.
+- DHCPv6 stateful pool binding remains edit-proven until decode-verified sample evidence is available.
+- OSPFv3 interface routing is donor-backed ready for explicit edit paths.
+- EIGRP IPv6 interface routing is donor-backed ready for explicit edit paths.
+- RIPng interface routing is donor-backed ready for explicit edit paths.
+- IPv6 HSRP virtual address is donor-backed ready for explicit edit paths.
 
 IPv6 tunneling, ISATAP, prefix delegation, and AAAA DNS remain report-first until separate donor-backed editor proof exists.
 
@@ -56,23 +68,168 @@ SSID. They still report `generate_supported=false` and
 WLC/controller workflows, Meraki, cellular/5G, Bluetooth, beamforming, and
 guest Wi-Fi remain report-only until separate donor-backed editor proof exists.
 
+## Fourth Edit-Proven Wave
+
+The fourth promotion wave is `wan_security_edge`. This wave promotes only
+explicit, deterministic router edit commands:
+
+- GRE tunnel basics
+- PPP serial encapsulation
+- IPSec transform-set lines
+- site-to-site VPN crypto-map skeleton binding
+
+These capabilities can report `edit_supported=true` only when the prompt names
+the router, interface or tunnel, peer/source/destination, and required crypto
+objects. They still report `generate_supported=false` and
+`generate_mismatch_reason=supported_in_edit_only`.
+
+ASA ACL/NAT, service policies, clientless VPN, CBAC, ZFW, security-edge device
+mutation, and multilayer switching remain report-only in this wave until separate
+donor-backed editor proof exists.
+
+## Fifth Donor-Backed Edit Readiness Wave
+
+The fifth promotion wave is `industrial_iot` programming. This wave promotes
+only existing script-file replacement for Real HTTP and Real WebSocket samples:
+
+- Real HTTP Python script file replacement
+- Real WebSocket Python/JavaScript script file replacement
+- programming inventory with hashes and lengths instead of source dumps
+
+These capabilities can report `edit_supported=true` and
+`donor_backed_ready=true` only when the prompt quotes the device name, app name,
+and existing file name. They still report `generate_supported=false` and
+`generate_mismatch_reason=supported_in_edit_only`.
+
+MQTT protocol mutation, visual scripting generation, PTP, Profinet, L2NAT,
+CyberObserver, and industrial firewall workflows remain report-only until
+separate donor-backed editor proof exists.
+
+## Sixth Donor-Backed Edit Readiness Wave
+
+The sixth promotion wave is `voice_collaboration`. This wave promotes only
+explicit IOS voice configuration lines on an existing router config surface:
+
+- `telephony-service` source address, SCCP port, max ephones, and max DNs
+- `ephone-dn` extension number lines
+- `ephone` MAC and button assignment lines
+- `dial-peer voice` destination-pattern and session-target lines
+
+These capabilities can report `edit_supported=true` and
+`donor_backed_ready=true` only when the prompt names the router and the voice
+object identifiers or values. They still report `generate_supported=false` and
+`generate_mismatch_reason=supported_in_edit_only`.
+
+IP phone GUI internals, Linksys voice GUI mutation, Call Manager synthesis, and
+broad VoIP topology generation remain report-only until separate donor-backed
+editor proof exists.
+
+## Seventh Donor-Backed Edit Readiness Wave
+
+The seventh promotion wave is `automation_controller`. This wave promotes only
+existing script-file replacement on Packet Tracer programming samples:
+
+- Python app file replacement
+- JavaScript app file replacement
+- TCP/UDP test app JavaScript file replacement
+- programming inventory with hashes and lengths instead of source dumps
+
+These capabilities can report `edit_supported=true` and
+`donor_backed_ready=true` only when the prompt quotes the device name, app name,
+and existing file name. They still report `generate_supported=false` and
+`generate_mismatch_reason=supported_in_edit_only`.
+
+Network Controller GUI workflows, Blockly visual graph mutation, VM/IOx runtime
+creation, and broad controller/application generation remain report-only until
+separate donor-backed editor proof exists.
+
+## Eighth Donor-Backed Edit Readiness Wave
+
+The eighth promotion wave is the `0.2.3` candidate L2/security proof hardening.
+This wave promotes only deterministic IOS line edits:
+
+- 802.1X/NAC switch config using `aaa new-model`, `dot1x system-auth-control`,
+  `authentication port-control`, and optional `radius-server host`
+- QoS switch config using explicit `class-map`, `policy-map`, and
+  `service-policy input/output`
+- router CBAC using `ip inspect name` plus interface-level `ip inspect`
+- router ZFW using `zone security`, `zone-pair security`, and
+  `policy-map type inspect`
+
+These capabilities can report `edit_supported=true` only for explicit commands
+with deterministic device/interface/object names. Dot1x and ZFW can also report
+`donor_backed_ready=true` because they have decode-verified sample evidence.
+QoS and CBAC remain `edit_proven` until decode-verified sample evidence is added.
+All four still report `generate_supported=false` and
+`generate_mismatch_reason=supported_in_edit_only`.
+
+ASA ACL/NAT, ASA service-policy, clientless VPN, sniffer workflows, broad NAC,
+and broad QoS design remain report-only until separate donor-backed editor proof
+exists.
+
+## Ninth Edit-Proven Wave
+
+The ninth promotion wave is `l2_resiliency_routing`. This wave uses the local
+user-supplied `pkt_examples` corpus as evidence input and promotes only explicit
+IOS line edits:
+
+- BGP `router bgp`, `neighbor remote-as`, and optional `network mask` lines
+- STP/RSTP `spanning-tree mode` and VLAN root lines
+- EtherChannel `channel-group` and `Port-channel` lines
+- LACP/PAgP mode derivation from explicit EtherChannel modes
+- VTP domain/mode/version lines
+- DTP dynamic switchport mode lines
+
+These capabilities can report `edit_supported=true` only for explicit commands
+with deterministic router/switch/interface names. They do not report
+`donor_backed_ready=true` yet, because this wave does not add selected-donor
+acceptance proof. They still report `generate_supported=false` and
+`generate_mismatch_reason=supported_in_edit_only`.
+
+`spanning-tree` evidence is intentionally separated from SPAN/RSPAN. STP/RSTP
+must not create the `span` capability; SPAN remains tied to monitor-session style
+config or explicit SPAN/RSPAN prompts.
+
+## Tenth Edit-Proven Wave
+
+The tenth promotion wave is `ipv4_routing_management`. This wave also uses the
+local user-supplied `pkt_examples` corpus as evidence input and promotes only
+explicit IOS line edits:
+
+- OSPFv2, EIGRP IPv4, and RIPv2 router process/network lines
+- static and default IPv4 routes
+- DHCP relay `ip helper-address`
+- NAT inside/outside markers, static NAT, and PAT overload skeletons
+- IOS SSH, NTP client, and syslog client lines
+
+These capabilities can report `edit_supported=true` only for explicit commands
+with deterministic router and interface names. They remain
+`donor_backed_ready=false` and `generate_supported=false`; the local sample corpus
+is evidence input, not a public curated donor registry.
+
 ## Current Feature Families
 
-- `ipv6_routing`: SLAAC, DHCPv6, prefix delegation, AAAA DNS, IPv6 tunneling, ISATAP, OSPFv3, EIGRP IPv6, RIPng, HSRP.
-- `l2_security_monitoring`: DHCP snooping, DAI, 802.1X/NAC, LLDP, REP, SNMP, NetFlow, SPAN/RSPAN, QoS, port security.
-- `wan_security_edge`: ASA ACL/NAT, ASA service policy, clientless VPN, CBAC, ZFW, sniffer, IPSec variants.
+- `ipv6_routing`: SLAAC, DHCPv6, prefix delegation, AAAA DNS, IPv6 tunneling, ISATAP, OSPFv3, EIGRP IPv6, RIPng, HSRP; OSPFv3, EIGRP IPv6, RIPng, and HSRP are donor-backed ready for explicit edit paths.
+- `ipv4_routing_management`: OSPFv2, EIGRP IPv4, RIPv2, static/default routes, DHCP relay, static/dynamic NAT, PAT, SSH, NTP, and syslog; explicit IOS text edits are edit-proven, but not donor-backed-ready or generate-ready.
+- `l2_resiliency_routing`: BGP, STP/RSTP, EtherChannel, LACP/PAgP, VTP, and DTP; explicit IOS text edits are edit-proven, but not donor-backed-ready or generate-ready.
+- `l2_security_monitoring`: DHCP snooping, DAI, 802.1X/NAC, LLDP, REP, SNMP, NetFlow, SPAN/RSPAN, QoS, port security; dot1x is donor-backed ready for explicit IOS line edits, while QoS is edit-proven.
+- `wan_security_edge`: VPN crypto-map skeleton, IPSec transform-set, GRE tunnel basics, PPP serial encapsulation, CBAC/ZFW router IOS edits, security-edge evidence, multilayer evidence.
+- `security_edge_deepening`: ASA ACL/NAT, ASA service policy, clientless VPN, CBAC, ZFW, sniffer, IPSec variants; router ZFW is donor-backed ready, while CBAC is edit-proven.
 - `wireless_advanced`: WLC, WPA Enterprise/RADIUS, WEP/WPA modes, guest Wi-Fi, beamforming, Meraki, 5G/cellular, Bluetooth.
-- `automation_controller`: Network Controller, Python, JavaScript, Blockly, TCP/UDP test apps, VM/IOx samples.
-- `voice_collaboration`: VoIP, IP phones, Call Manager-style telephony, Linksys voice.
-- `industrial_iot`: MQTT, Real HTTP, Real WebSocket, visual scripting, PTP, Profinet, L2NAT, CyberObserver, industrial firewall.
+- `automation_controller`: Network Controller, Python, JavaScript, Blockly, TCP/UDP test apps, VM/IOx samples; existing Python, JavaScript, and TCP/UDP script-file edits are donor-backed ready.
+- `voice_collaboration`: VoIP, IP phones, Call Manager-style IOS telephony, Linksys voice; explicit IOS voice edits are donor-backed ready.
+- `industrial_iot`: MQTT, Real HTTP, Real WebSocket, visual scripting, PTP, Profinet, L2NAT, CyberObserver, industrial firewall; only Real HTTP/WebSocket existing script-file edits are donor-backed ready.
 - `physical_media_device`: coaxial, cable/DSL, central office, cell tower, power distribution, hot-swappable modules, IOS/license workflows.
 
 ## CLI
 
 ```powershell
 python .\scripts\generate_pkt.py --feature-gap-report
+python .\scripts\generate_pkt.py --local-sample-audit-root "C:\path\to\pkt_examples"
 ```
 
+The default local audit artifact is `output/local-sample-audit.json`. It is ignored by git and excluded from npm packaging. Local `pkt_examples` evidence does not promote a sample into curated public truth by itself.
+
 The report includes:
 
 - total Packet Tracer feature groups tracked

package/docs/release-checklist.md

@@ -1,6 +1,6 @@
 # Release Checklist
 
-Target release surface: `0.2.2` conservative public preview.
+Target release surface: `0.2.3` capability proof/readiness release.
 
 ## Product Contract
 
@@ -27,13 +27,17 @@ python .\scripts\runtime_doctor.py
 - `files` includes docs and runtime assets needed by consumers
 - version bump matches semver intent
 
-## Public Artifacts
-
-- raw `.pkt` binaries are not committed
-- examples index and gallery were rebuilt
-- screenshots are intentional and non-sensitive
-- changelog entry is updated for `0.2.2`
-- release notes source exists: `docs/release-notes-0.2.2.md`
+## Public Artifacts
+
+- raw `.pkt` binaries are not committed
+- remote GitHub imports, if used, stay under `output/remote-import-cache`
+- `output/remote-import-cache/remote-sample-audit.json` is reviewed for license, decode, and promotion status before any claim changes
+- user-supplied local audits, if used, stay under `output/local-sample-audit.json` or another ignored `output/` path
+- local `pkt_examples` files remain local evidence only; no raw `.pkt`, `.pka`, local audit cache, or user-supplied corpus files are packaged
+- examples index and gallery were rebuilt
+- screenshots are intentional and non-sensitive
+- changelog entry is updated for `0.2.3`
+- release notes source exists: `docs/release-notes-0.2.3.md`
 - hero demo plan exists: `docs/hero-demo-plan.md`
 - GitHub launch ops runbook exists: `docs/github-launch-ops-0.2.2.md`
 - canonical donor proof exists: `docs/campus-donor-proof.md`
@@ -60,6 +64,7 @@ Only publish when:
 - `package.json` version is final for the publish-preview batch
 - doctor wording matches current runtime reality
 - no accidental local paths leaked into tracked files
+- no raw `.pkt`, `.pka`, or remote cache files appear in `npm pack --dry-run --json`
 - GitHub metadata doc is final and matches README wording
 - hero visual and release notes are ready for direct reuse
 

package/docs/release-notes-0.2.2.md

@@ -6,7 +6,7 @@
 
 ## Highlights
 
-- README runtime instructions now use generic Twofish bridge examples instead of a user-specific `.codex` path as the default
+- README runtime instructions now use generic Twofish bridge examples instead of a user-specific local path as the default
 - `PKT_TWOFISH_LIBRARY` and `PKT_TWOFISH_SEARCH_ROOTS` setup paths are documented separately
 - advanced wireless prompts classify into the `wireless_advanced` family
 - WEP and WPA Enterprise/RADIUS are represented as edit-proven only for explicit deterministic edit targets

package/docs/release-notes-0.2.3.md

@@ -0,0 +1,59 @@
+# packet-tracer-skill v0.2.3
+
+`0.2.3` is a capability proof and readiness release. It expands the set of Packet Tracer features that the skill can recognize, inventory, edit with explicit deterministic commands, and report through the feature atlas without claiming broad synthetic generation.
+
+## Highlights
+
+- Added voice/collaboration edit proof for IOS `telephony-service`, `ephone-dn`, `ephone`, and `dial-peer voice` command shapes.
+- Added automation/controller script-file edit proof for existing Python, JavaScript, and TCP/UDP app files.
+- Added L2 security/QoS proof for explicit dot1x and QoS IOS switch commands.
+- Added router security-edge proof for explicit CBAC and ZFW IOS command shapes.
+- Added BGP + L2 resiliency proof for BGP, STP/RSTP, EtherChannel/LACP/PAgP, VTP, and DTP IOS commands.
+- Added IPv4 routing/NAT/IOS-management proof for OSPFv2, EIGRP IPv4, RIPv2, static/default routes, DHCP relay, NAT/PAT, SSH, NTP, and syslog.
+- Added local user-supplied Packet Tracer corpus audit with `--local-sample-audit-root`, storing audit output under ignored `output/` paths.
+- Hardened donor-backed readiness gates so proof-linked decode, sample, parser, and editor evidence are required before readiness promotion.
+
+## Runtime Truth
+
+Windows-first runtime remains the supported validation posture. This release was validated with an external Twofish bridge override, but it does not claim repo-local self-contained runtime readiness.
+
+Use:
+
+```powershell
+npx packet-tracer-skill --doctor
+python .\scripts\runtime_doctor.py
+```
+
+The doctor output remains the authority for Packet Tracer install state, donor path, bridge resolution, ready operations, blocked operations, and the recommended next fix.
+
+## Feature Atlas Truth
+
+`generate_ready=0` remains intentional. The release improves report, edit, and donor-backed edit readiness coverage, but broad generation stays blocked until a future single-donor acceptance-backed pilot proves deterministic target inventory and acceptance JSON.
+
+Support levels should be read in this order:
+
+- `report_supported`: the feature is recognized and can be explained in reports.
+- `edit_proven`: explicit command shapes have editor roundtrip evidence.
+- `donor_backed_ready`: a proof-linked donor or selected-donor path can safely carry a narrow explicit workflow.
+- `generate_ready`: strict scenario generation is acceptance-backed. This remains closed in `0.2.3`.
+
+## Safety Boundaries
+
+- No raw `.pkt` or `.pka` labs are added to the repo or npm tarball.
+- Local `pkt_examples` evidence and remote GitHub sample imports remain evidence-only workflows.
+- Unknown-license remote samples stay `reference_only`.
+- ASA GUI/internal mutation, WLC/controller synthesis, broad physical/media workflows, and broad topology generation remain blocked.
+
+## Verification
+
+Release verification includes:
+
+```powershell
+python .\scripts\build_examples_index.py
+python -m pytest tests -q
+node --check .\bin\packet-tracer-skill.js
+python .\scripts\generate_pkt.py --feature-gap-report
+python .\scripts\generate_pkt.py --parity-report "campus with VLAN DHCP ACL"
+python .\scripts\generate_pkt.py --parity-report "ospf eigrp rip static default route dhcp relay nat pat ssh ntp syslog"
+npm pack --dry-run --json
+```

package/docs/security-edge-deepening-proof.md

@@ -0,0 +1,65 @@
+# Security Edge Deepening Proof
+
+This proof records the `0.2.3` candidate router-based security edge edit-proven subset. The supported surface is IOS line-based CBAC/ZFW configuration on an explicitly named router. ASA GUI/internal mutation, clientless VPN, and broad security topology generation remain blocked.
+
+## Explicit Commands
+
+Supported CBAC shape:
+
+```text
+set R1 cbac inspect FIREWALL protocol tcp interface FastEthernet0/0 direction in
+```
+
+This writes:
+
+```text
+ip inspect name FIREWALL tcp
+interface FastEthernet0/0
+ ip inspect FIREWALL in
+```
+
+Supported ZFW shapes:
+
+```text
+set R1 zfw zone inside interface FastEthernet0/0
+set R1 zfw zone-pair INSIDE_OUT source inside destination outside policy POLICY1
+set R1 zfw class-map CM_WEB match protocol http policy-map POLICY1 action inspect
+```
+
+These write:
+
+```text
+zone security inside
+interface FastEthernet0/0
+ zone-member security inside
+zone-pair security INSIDE_OUT source inside destination outside
+ service-policy type inspect POLICY1
+class-map type inspect match-any CM_WEB
+ match protocol http
+policy-map type inspect POLICY1
+ class type inspect CM_WEB
+  inspect
+```
+
+## Donor-Backed Readiness
+
+- `zfw` is `donor_backed_ready` because it has parser, catalog, decode-verified sample, and editor roundtrip evidence.
+- `cbac` remains `edit_proven` rather than `donor_backed_ready` because the current CBAC sample evidence is path-backed but not decode-verified in the atlas gate.
+
+## What This Proves
+
+- `cbac` and `zfw` are parser-recognized under the WAN/security edge family.
+- Explicit router IOS commands roundtrip through Packet Tracer XML config text.
+- Parity reports mark CBAC/ZFW as `edit_supported=true`, `generate_supported=false`, and `generate_mismatch_reason=supported_in_edit_only` for explicit commands.
+- The feature atlas can classify ZFW as `donor_backed_ready` and CBAC as `edit_proven` when the proof gate is evaluated.
+
+## What This Does Not Prove
+
+- This does not make CBAC, ZFW, ASA ACL/NAT, ASA service policy, or clientless VPN `generate_ready`.
+- This does not mutate ASA GUI/internal security appliance state.
+- This does not synthesize zones, trust boundaries, NAT, VPN peers, or firewall policy from a broad prompt.
+- ASA service-policy and clientless VPN remain report-only until exact donor-backed XML surfaces are proven.
+
+## Safe Next Step
+
+The next promotion should prefer router IOS CBAC/ZFW donor-backed fixtures before touching ASA internals. ASA ACL/NAT, service policy, and clientless VPN should stay report-only until a decode-backed sample and deterministic roundtrip mutation exist.

package/docs/voice-collaboration-proof.md

@@ -0,0 +1,38 @@
+# Voice Collaboration Proof
+
+This proof covers a narrow Packet Tracer voice/collaboration wave. It is explicit-edit proof, not broad VoIP topology generation.
+
+## What This Proves
+
+- The Cisco `voip_local_all_phone_devices.pkt` sample exposes IP Phone, Home VoIP, Analog Phone, and router telephony evidence.
+- Inventory can report voice devices and IOS telephony config without mutating phone GUI internals.
+- Explicit IOS voice commands can roundtrip through Packet Tracer XML:
+  - `telephony-service`
+  - `ephone-dn`
+  - `ephone`
+  - `dial-peer voice`
+- `voip`, `ip_phone`, and `call_manager` can be treated as `edit_proven` for explicit IOS voice edits.
+- `voip`, `ip_phone`, and `call_manager` are `donor_backed_ready` for explicit IOS voice edits because the proof gate has sample, decode, parser, and editor roundtrip evidence.
+
+## What This Does Not Prove
+
+- It does not claim full Call Manager or VoIP topology generation.
+- It does not mutate IP Phone GUI internals.
+- It does not claim Linksys voice mutation.
+- It does not make any voice/collaboration feature `generate_ready`.
+
+## Explicit Edit Command Shape
+
+```text
+set "Router0" telephony service source-address 192.168.10.1 port 2000 max-ephones 4 max-dn 4
+set "Router0" ephone-dn 1 number 1001
+set "Router0" ephone 1 mac 0001.42AA.BBCC button 1:1
+set "Router0" dial-peer voice 10 destination-pattern 2... session-target ipv4:10.0.0.2
+```
+
+## Public Contract
+
+- `voip`, `ip_phone`, and `call_manager` can report `edit_supported=true` and `donor_backed_ready=true` only for explicit IOS voice edit commands.
+- `generate_supported=false` remains the expected result.
+- `generate_mismatch_reason=supported_in_edit_only` is the intended parity wording.
+- `linksys_voice` remains report-only until separate decode and editor proof exists.

package/docs/wan-security-donor-proof.md

@@ -24,18 +24,35 @@ The prompt must explicitly request WAN/security intent, such as VPN, IPsec, GRE,
 - Packet Tracer sample inventory can identify WAN/security donor candidates.
 - Selected-donor readiness can be represented without changing the public JSON contract.
 - Refusal and remediation now point toward reusable ASA/cloud/serial/tunnel donor skeletons.
+- Explicit router edit commands can roundtrip a narrow WAN/security subset:
+  - GRE tunnel interface basics
+  - PPP serial encapsulation
+  - IPSec transform-set lines
+  - site-to-site VPN crypto-map skeleton binding
 
 ## What This Does Not Prove
 - It does not claim full synthetic VPN/IPSec/GRE/PPP configuration generation.
 - It does not claim that every ASA/firewall or multilayer switch feature is editable.
+- It does not claim ASA ACL/NAT, ASA service policy, CBAC, ZFW, or multilayer switching edit support.
 - It does not allow `reference_only` donors as final apply donors.
 - It does not change the `single-donor` final `.pkt` apply rule.
 
+## Edit-Proven Commands
+
+```text
+set R1 gre tunnel Tunnel0 source 10.0.0.1 destination 10.0.0.2 ip 172.16.0.1/30
+set R1 ppp interface Serial0/0/0 authentication chap
+set R1 ipsec transform-set TS esp-aes esp-sha-hmac
+set R1 crypto map VPNMAP 10 peer 203.0.113.2 transform-set TS match ACL_VPN interface Serial0/0/0
+```
+
+These commands are edit-proven only. They intentionally report
+`generate_supported=false` and `generate_mismatch_reason=supported_in_edit_only`
+until selected-donor acceptance evidence exists.
+
 ## Next Constrained Edit Candidates
-- GRE tunnel parameter mutation on an existing routed donor.
-- PPP/CHAP/PAP mutation on an existing serial or PPPoE donor.
-- IPSec profile/key mutation on an existing site-to-site donor.
 - ASA ACL/NAT mutation on an existing security-edge donor.
 - SVI/routed-port mutation on an existing multilayer switch donor.
+- CBAC/ZFW policy mutation on an existing routed security donor.
 
 These candidates need separate roundtrip proof before they become release claims.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "packet-tracer-skill",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "private": false,
   "description": "Donor-backed Cisco Packet Tracer 9.x skill for natural-language planning, safe-open generation, editing, parity reporting, and runtime diagnostics across coding hosts.",
   "keywords": [
@@ -85,6 +85,14 @@
     "docs/home-iot-donor-proof.md",
     "docs/wan-security-donor-proof.md",
     "docs/wireless-advanced-proof.md",
+    "docs/industrial-programming-proof.md",
+    "docs/automation-controller-proof.md",
+    "docs/voice-collaboration-proof.md",
+    "docs/l2-resiliency-bgp-proof.md",
+    "docs/ipv4-routing-management-proof.md",
+    "docs/l2-security-qos-proof.md",
+    "docs/security-edge-deepening-proof.md",
+    "docs/generate-ready-pilot-design.md",
     "docs/packet-tracer-feature-gap-atlas.md",
     "docs/discovery-keywords.md",
     "docs/github-discussions-setup.md",
@@ -99,6 +107,7 @@
     "docs/release-checklist.md",
     "docs/release-notes-0.2.1.md",
     "docs/release-notes-0.2.2.md",
+    "docs/release-notes-0.2.3.md",
     "docs/runtime-truth.md"
   ],
   "engines": {