packet-tracer-skill 0.2.2 → 0.3.0

package/docs/voice-collaboration-proof.md

@@ -0,0 +1,38 @@
+# Voice Collaboration Proof
+
+This proof covers a narrow Packet Tracer voice/collaboration wave. It is explicit-edit proof, not broad VoIP topology generation.
+
+## What This Proves
+
+- The Cisco `voip_local_all_phone_devices.pkt` sample exposes IP Phone, Home VoIP, Analog Phone, and router telephony evidence.
+- Inventory can report voice devices and IOS telephony config without mutating phone GUI internals.
+- Explicit IOS voice commands can roundtrip through Packet Tracer XML:
+  - `telephony-service`
+  - `ephone-dn`
+  - `ephone`
+  - `dial-peer voice`
+- `voip`, `ip_phone`, and `call_manager` can be treated as `edit_proven` for explicit IOS voice edits.
+- `voip`, `ip_phone`, and `call_manager` are `donor_backed_ready` for explicit IOS voice edits because the proof gate has sample, decode, parser, and editor roundtrip evidence.
+
+## What This Does Not Prove
+
+- It does not claim full Call Manager or VoIP topology generation.
+- It does not mutate IP Phone GUI internals.
+- It does not claim Linksys voice mutation.
+- It does not make any voice/collaboration feature `generate_ready`.
+
+## Explicit Edit Command Shape
+
+```text
+set "Router0" telephony service source-address 192.168.10.1 port 2000 max-ephones 4 max-dn 4
+set "Router0" ephone-dn 1 number 1001
+set "Router0" ephone 1 mac 0001.42AA.BBCC button 1:1
+set "Router0" dial-peer voice 10 destination-pattern 2... session-target ipv4:10.0.0.2
+```
+
+## Public Contract
+
+- `voip`, `ip_phone`, and `call_manager` can report `edit_supported=true` and `donor_backed_ready=true` only for explicit IOS voice edit commands.
+- `generate_supported=false` remains the expected result.
+- `generate_mismatch_reason=supported_in_edit_only` is the intended parity wording.
+- `linksys_voice` remains report-only until separate decode and editor proof exists.

package/docs/wan-security-donor-proof.md

@@ -24,18 +24,35 @@ The prompt must explicitly request WAN/security intent, such as VPN, IPsec, GRE,
 - Packet Tracer sample inventory can identify WAN/security donor candidates.
 - Selected-donor readiness can be represented without changing the public JSON contract.
 - Refusal and remediation now point toward reusable ASA/cloud/serial/tunnel donor skeletons.
+- Explicit router edit commands can roundtrip a narrow WAN/security subset:
+  - GRE tunnel interface basics
+  - PPP serial encapsulation
+  - IPSec transform-set lines
+  - site-to-site VPN crypto-map skeleton binding
 
 ## What This Does Not Prove
 - It does not claim full synthetic VPN/IPSec/GRE/PPP configuration generation.
 - It does not claim that every ASA/firewall or multilayer switch feature is editable.
+- It does not claim ASA ACL/NAT, ASA service policy, CBAC, ZFW, or multilayer switching edit support.
 - It does not allow `reference_only` donors as final apply donors.
 - It does not change the `single-donor` final `.pkt` apply rule.
 
+## Edit-Proven Commands
+
+```text
+set R1 gre tunnel Tunnel0 source 10.0.0.1 destination 10.0.0.2 ip 172.16.0.1/30
+set R1 ppp interface Serial0/0/0 authentication chap
+set R1 ipsec transform-set TS esp-aes esp-sha-hmac
+set R1 crypto map VPNMAP 10 peer 203.0.113.2 transform-set TS match ACL_VPN interface Serial0/0/0
+```
+
+These commands are edit-proven only. They intentionally report
+`generate_supported=false` and `generate_mismatch_reason=supported_in_edit_only`
+until selected-donor acceptance evidence exists.
+
 ## Next Constrained Edit Candidates
-- GRE tunnel parameter mutation on an existing routed donor.
-- PPP/CHAP/PAP mutation on an existing serial or PPPoE donor.
-- IPSec profile/key mutation on an existing site-to-site donor.
 - ASA ACL/NAT mutation on an existing security-edge donor.
 - SVI/routed-port mutation on an existing multilayer switch donor.
+- CBAC/ZFW policy mutation on an existing routed security donor.
 
 These candidates need separate roundtrip proof before they become release claims.

package/examples/README.md

@@ -1,75 +1,104 @@
-## Known Working Scenario Set
-
-This repo keeps text-based example artifacts under `examples/` and treats them as a known working scenario set, not just a screenshot folder.
-
-For the `0.2.1` public preview surface, the canonical public set is:
-
-- `complex_campus_master_edit_v4`
-- `home_iot_cli_edit_v1`
-- `service_heavy_cli_edit_v1`
-
-Hero visual:
-
-- `screenshots/complex_campus_master_edit_v4.png`
-
-Policy:
-- generated `.pkt` and `.xml` files stay gitignored
-- public examples should be sanitized JSON or markdown summaries
-- if you want to publish a lab sample, prefer `--inventory --inventory-out` and commit the resulting JSON
-- real Packet Tracer screenshots can be committed under `examples/screenshots/`
-- examples may have one primary screenshot plus additional detail screenshots
-
-Example command:
-
-```powershell
-python .\scripts\generate_pkt.py --inventory .\output\complex_campus_master_edit_v4.pkt --inventory-capabilities --inventory-out .\examples\complex_campus_master_edit_v4.inventory.json
-```
-
-Current curated example:
-- `complex_campus_master_edit_v4.inventory.json`
-  Donor-backed complex campus edit showing management VLAN, Telnet, ACL, server services, and wireless updates without publishing the binary `.pkt` itself.
-- `screenshots/complex_campus_master_edit_v4.png`
-  Visual snapshot of the same lab opened inside Cisco Packet Tracer.
-
-Additional curated examples:
-- `home_iot_cli_edit_v1.inventory.json`
+## Examples Truth 2.0
+
+The `examples/` directory is the public proof surface for the published `0.2.3` capability release and the next `0.2.4` candidate hardening batch. It is not a raw Packet Tracer lab dump and it is not a claim that broad `.pkt` generation is solved.
+
+Global truth:
+
+- atlas `generate_ready=0` remains intentional
+- raw `.pkt` and `.pka` files stay out of git and npm
+- local `pkt_examples` audits are evidence inputs only
+- examples are either `showcase_example` artifacts or text-only `proof_card` artifacts
+
+## Artifact Types
+
+`showcase_example` means:
+
+- there is a screenshot and committed inventory manifest
+- the source workflow is donor-backed or acceptance-backed as an example artifact
+- the binary `.pkt` is not committed
+- the example can be used in README/npm/GitHub proof surfaces
+
+`proof_card` means:
+
+- there is no raw `.pkt` and no screenshot requirement
+- the card points to a proof doc
+- it records the explicit command shape, scenario family, support level, parity excerpt, and refusal boundary
+- it proves a narrow edit/readiness path, not broad topology generation
+
+## Current Showcase Examples
+
+- `complex_campus_master_edit_v4`
+  Donor-backed complex campus edit showing management VLAN, Telnet, ACL, server services, and wireless updates without publishing the binary `.pkt`.
+  Screenshot: `screenshots/complex_campus_master_edit_v4.png`.
+- `home_iot_cli_edit_v1`
   Home gateway and IoT registration example focused on donor-backed, constrained gateway device onboarding.
-- `screenshots/home_iot_cli_edit_v1.png`
-  Topology snapshot for the Home IoT example.
-- `service_heavy_cli_edit_v1.inventory.json`
-  Service-heavy server example focused on DNS, DHCP, FTP, email, syslog, AAA, and related service metadata.
-- `screenshots/service_heavy_cli_edit_v1.png`
-  Topology snapshot for the Service Heavy example.
-- `screenshots/service_heavy_cli_edit_v1_*.png`
-  Additional service detail screenshots for DHCP, DNS, and FTP views.
-- `index.json`
-  Lightweight gallery index for curated example artifacts.
-
-Rebuild the gallery index:
-
-```powershell
-python .\scripts\build_examples_index.py
-```
-
-Generated outputs:
-- `index.json`
-  Machine-readable curated example index.
-- `gallery.md`
-  Human-readable markdown gallery generated from the same source, positioned as the known working scenario set.
-- `previews/*.svg`
-  Generated fallback preview images for examples that do not yet have real Packet Tracer screenshots.
-
-Gallery families:
-- `campus`
-  VLAN, management, ACL, server services, and wireless edits.
-- `home_iot`
-  Home gateway, IoT things, registration, and constrained donor-backed wireless examples.
-- `service_heavy`
-  Server-centric service labs with richer metadata.
-
+  Screenshot: `screenshots/home_iot_cli_edit_v1.png`.
+- `service_heavy_cli_edit_v1`
+  Service-heavy server example focused on DNS, DHCP, FTP, email, syslog, AAA, and related service metadata.
+  Screenshot: `screenshots/service_heavy_cli_edit_v1.png`.
+
+## Current Proof Cards
+
+The proof cards make the `0.2.3` capability waves discoverable from the examples gallery and feed the `0.2.4` proof-readiness dashboard:
+
+- IPv4 routing / NAT / IOS management
+- L2 resiliency + BGP
+- L2 security + QoS
+- security-edge CBAC/ZFW
+- voice/collaboration
+- automation/controller
+- industrial programming
+
+The source file is `proof-cards.json`. It is text-only and diff-friendly.
+
+## Proof-Readiness Queue
+
+The `0.2.4` candidate adds a promotion queue for deciding which edit-proven features can safely move toward `donor_backed_ready`.
+
+- source artifact: `..\references\proof-readiness-candidates.json`
+- dashboard: `..\docs\proof-readiness-dashboard.md`
+- current primary queue: IPv4 routing, NAT, DHCP relay, SSH, NTP, and syslog IOS management
+- current secondary queue: STP/RSTP, EtherChannel/LACP/PAgP, VTP/DTP, and BGP
+
+The queue is intentionally conservative. Local sample counts are not enough by themselves; each promotion still needs explicit command shape, decode evidence, editor roundtrip, deterministic target resolution, and clean refusal behavior.
+
+## Local Sample Evidence
+
+The local audit command can summarize user-supplied Packet Tracer labs:
+
+```powershell
+python .\scripts\generate_pkt.py --local-sample-audit-root "C:\path\to\pkt_examples"
+```
+
+The default output is `output/local-sample-audit.json`. That file is ignored by git and npm packaging. It can show evidence such as STP, static routes, RIPv2, OSPFv2, DHCP, ACL, SSH, NAT, HSRP, EtherChannel, and BGP counts, but it does not promote those local files into curated public donors.
+
+## Rebuild
+
+Rebuild the generated index and gallery:
+
+```powershell
+python .\scripts\build_examples_index.py
+```
+
+Generated outputs:
+
+- `index.json`: machine-readable combined showcase/proof-card index
+- `gallery.md`: human-readable examples and evidence gallery
+- `previews/*.svg`: generated fallback preview images for showcase examples without screenshots
+
 Launch references:
+
 - `..\docs\hero-demo-plan.md`
-- `..\docs\release-notes-0.2.1.md`
+- `..\docs\release-notes-0.2.3.md`
+- `..\docs\release-notes-0.2.4.md`
+- `..\docs\proof-readiness-dashboard.md`
 - `..\docs\campus-donor-proof.md`
 - `..\docs\home-iot-donor-proof.md`
 - `..\docs\wan-security-donor-proof.md`
+- `..\docs\ipv4-routing-management-proof.md`
+- `..\docs\l2-resiliency-bgp-proof.md`
+- `..\docs\l2-security-qos-proof.md`
+- `..\docs\security-edge-deepening-proof.md`
+- `..\docs\voice-collaboration-proof.md`
+- `..\docs\automation-controller-proof.md`
+- `..\docs\industrial-programming-proof.md`

package/examples/complex_campus_master_edit_v4.inventory.json

@@ -1,10 +1,20 @@
 {
+  "schema_version": "examples.truth.v2",
   "example_name": "complex_campus_master_edit_v4",
+  "artifact_type": "showcase_example",
   "source_mode": "donor-backed edit",
   "scenario_family": "campus",
-  "public_repo_policy": {
+  "artifact_policy": {
     "commit_pkt_binary": false,
-    "commit_inventory_json": true
+    "commit_inventory_json": true,
+    "commit_screenshots": true,
+    "raw_source_public": false
+  },
+  "maturity_summary": {
+    "atlas_status": "known_working_example",
+    "example_status": "known_working_example",
+    "donor_backed_ready": true,
+    "generate_ready": false
   },
   "artifact_paths": {
     "screenshot": "examples/screenshots/complex_campus_master_edit_v4.png",

package/examples/gallery.md

@@ -1,8 +1,8 @@
-## Known Working Scenario Set
+## Showcase Examples
 
 These examples are public, text-first proof artifacts derived from donor-backed workflows and aligned with the scenario fixture corpus.
 
-`0.2.1` canonical public set:
+`0.2.4` candidate examples surface, built on the published `0.2.3` capability release:
 
 - `campus`
 - `home_iot`
@@ -18,28 +18,116 @@ Canonical donor proof:
 - [home IoT donor proof](../docs/home-iot-donor-proof.md)
 - [WAN/security donor proof](../docs/wan-security-donor-proof.md)
 
+Support truth:
+
+- showcase examples are screenshot + inventory artifacts for known working donor-backed workflows
+- proof cards are text-only evidence for explicit edit paths and donor-backed readiness
+- atlas `generate_ready=0` remains intentional; these examples do not claim broad generation support
+
 | Title | Family | Capabilities | Image | Inventory |
 | --- | --- | --- | --- | --- |
 | Complex Campus | `campus` | management_vlan, telnet, acl, server_dns, server_email, server_aaa, wireless_mutation | [screenshot](screenshots/complex_campus_master_edit_v4.png) | [manifest](complex_campus_master_edit_v4.inventory.json) |
 |  |  | Management VLAN, Telnet, ACL, DNS, email, AAA, and multi-SSID wireless campus edit. |  |  |
 |  |  | `known_working_example | donor=donor-backed | capabilities=management_vlan, telnet, acl` |  |  |
 |  |  | `campus_core_complex | known_working_example | family=campus` |  |  |
-|  |  | `management_vlan=generate-ready, telnet=generate-ready, acl=generate-ready` |  |  |
+|  |  | `management_vlan=known_working_example, telnet=known_working_example, acl=known_working_example` |  |  |
 |  |  | `decision=known_working_example | donor_origin=donor-backed` |  |  |
 |  |  | `runtime=donor-backed example artifact` |  |  |
 | Home IoT | `home_iot` | iot, iot_registration, wireless_ap | [screenshot](screenshots/home_iot_cli_edit_v1.png) | [manifest](home_iot_cli_edit_v1.inventory.json) |
 |  |  | Home gateway and IoT device onboarding with donor-backed registration state and constrained wireless readiness. |  |  |
-|  |  | `known_working_example | donor=donor-backed | capabilities=iot, iot_registration, wireless_ap | mode=donor-backed constrained-generate` |  |  |
+|  |  | `known_working_example | donor=donor-backed | capabilities=iot, iot_registration, wireless_ap | mode=donor-backed constrained edit` |  |  |
 |  |  | `home_iot_complex | known_working_example | family=home_iot` |  |  |
-|  |  | `iot=generate-ready, iot_registration=donor-backed constrained-generate, wireless_ap=generate-ready` |  |  |
+|  |  | `iot=known_working_example, iot_registration=donor_backed_ready, wireless_ap=known_working_example` |  |  |
 |  |  | `decision=known_working_example | donor_origin=donor-backed` |  |  |
 |  |  | `runtime=donor-backed example artifact` |  |  |
 | Service Heavy | `service_heavy` | server_dns, server_dhcp, server_ftp, server_email, server_syslog, server_aaa | [screenshot](screenshots/service_heavy_cli_edit_v1.png) | [manifest](service_heavy_cli_edit_v1.inventory.json) |
 |  |  | Service-rich server lab with DNS, DHCP, FTP, email, syslog, AAA, and detailed service metadata. |  |  |
 |  |  | `known_working_example | donor=donor-backed | capabilities=server_dns, server_dhcp, server_ftp` |  |  |
 |  |  | `service_heavy_complex | known_working_example | family=service_heavy` |  |  |
-|  |  | `server_dns=generate-ready, server_dhcp=generate-ready, server_ftp=generate-ready` |  |  |
+|  |  | `server_dns=known_working_example, server_dhcp=known_working_example, server_ftp=known_working_example` |  |  |
 |  |  | `decision=known_working_example | donor_origin=donor-backed` |  |  |
 |  |  | `runtime=donor-backed example artifact` |  |  |
 |  |  | extra visuals: [detail 1](screenshots/service_heavy_cli_edit_v1_dhcp.png); [detail 2](screenshots/service_heavy_cli_edit_v1_dns.png); [detail 3](screenshots/service_heavy_cli_edit_v1_ftp.png) |  |  |
 
+## 0.2.4 Candidate Proof Cards
+
+| Title | Family | Support | Proof | Boundary |
+| --- | --- | --- | --- | --- |
+| IPv4 Routing / NAT / IOS Management | `ipv4_routing_management` | `edit_proven` | [proof](../docs/ipv4-routing-management-proof.md) | No topology synthesis, route convergence proof, ACL object inference, or broad NAT design generation. |
+|  |  | `explicit IPv4 routing/NAT/IOS-management commands are edit_proven; generate_ready=false` |  |  |
+|  |  | try this command: `set R1 ospfv2 1 network 10.0.0.0 wildcard 0.0.0.255 area 0` |  |  |
+|  |  | does not claim: No topology synthesis, route convergence proof, ACL object inference, or broad NAT design generation. |  |  |
+| L2 Resiliency + BGP | `l2_resiliency_routing` | `edit_proven` | [proof](../docs/l2-resiliency-bgp-proof.md) | No redundant link creation, STP state validation, BGP convergence proof, or topology generation. |
+|  |  | `explicit BGP/STP/EtherChannel/VTP/DTP IOS commands are edit_proven; generate_ready=false` |  |  |
+|  |  | try this command: `set SW1 etherchannel 1 mode active interfaces FastEthernet0/1 FastEthernet0/2` |  |  |
+|  |  | does not claim: No redundant link creation, STP state validation, BGP convergence proof, or topology generation. |  |  |
+| L2 Security + QoS | `l2_security_monitoring` | `donor_backed_ready` | [proof](../docs/l2-security-qos-proof.md) | No broad NAC design, RADIUS user synthesis, certificate workflow, or end-to-end QoS policy inference. |
+|  |  | `dot1x is donor_backed_ready; QoS remains edit_proven; generate_ready=false` |  |  |
+|  |  | try this command: `set SW1 dot1x interface FastEthernet0/1 mode auto radius 192.168.1.10 key radius123` |  |  |
+|  |  | does not claim: No broad NAC design, RADIUS user synthesis, certificate workflow, or end-to-end QoS policy inference. |  |  |
+| Security Edge CBAC/ZFW | `wan_security_edge` | `donor_backed_ready` | [proof](../docs/security-edge-deepening-proof.md) | No ASA GUI/internal mutation, clientless VPN, service-policy synthesis, or broad security topology generation. |
+|  |  | `ZFW is donor_backed_ready; CBAC remains edit_proven; generate_ready=false` |  |  |
+|  |  | try this command: `set R1 zfw zone-pair INSIDE_OUT source inside destination outside policy POLICY1` |  |  |
+|  |  | does not claim: No ASA GUI/internal mutation, clientless VPN, service-policy synthesis, or broad security topology generation. |  |  |
+| Voice / Collaboration | `voice_collaboration` | `donor_backed_ready` | [proof](../docs/voice-collaboration-proof.md) | No Call Manager GUI synthesis, Linksys voice mutation, phone GUI internals, or broad VoIP topology generation. |
+|  |  | `IOS telephony-service, ephone, and dial-peer paths are donor_backed_ready; generate_ready=false` |  |  |
+|  |  | try this command: `set "Router0" telephony service source-address 192.168.10.1 port 2000 max-ephones 4 max-dn 4` |  |  |
+|  |  | does not claim: No Call Manager GUI synthesis, Linksys voice mutation, phone GUI internals, or broad VoIP topology generation. |  |  |
+| Automation / Controller Scripts | `automation_controller` | `donor_backed_ready` | [proof](../docs/automation-controller-proof.md) | No Network Controller GUI synthesis, Blockly graph mutation, VM/IOx workflow generation, or new app/file creation. |
+|  |  | `existing Python, JavaScript, and TCP/UDP script files are donor_backed_ready; generate_ready=false` |  |  |
+|  |  | try this command: `set "Device" script app "App Name" file "main.py" content "print('hello')"` |  |  |
+|  |  | does not claim: No Network Controller GUI synthesis, Blockly graph mutation, VM/IOx workflow generation, or new app/file creation. |  |  |
+| Industrial Programming | `industrial_iot` | `donor_backed_ready` | [proof](../docs/industrial-programming-proof.md) | No MQTT broker generation, Profinet/PTP/L2NAT mutation, CyberObserver workflow, or industrial topology generation. |
+|  |  | `Real HTTP and Real WebSocket script-file edits are donor_backed_ready; generate_ready=false` |  |  |
+|  |  | try this command: `set "Py: real http server 2" script app "Real HTTP Server" file "main.py" content "print('updated')"` |  |  |
+|  |  | does not claim: No MQTT broker generation, Profinet/PTP/L2NAT mutation, CyberObserver workflow, or industrial topology generation. |  |  |
+
+## Local Sample Evidence Board
+
+Local audit source: `examples/local-sample-evidence.json`.
+
+Audit summary: `367` files, `366` decode successes, `1` decode failures.
+
+This is local evidence only. It does not make user-supplied `.pkt/.pka` files public curated donors, and it does not enter the npm package.
+
+| Capability | Sample Count | Example Paths |
+| --- | --- | --- |
+| `stp` | 348 | 09. 2Switches_3Routers_Rime_New.pkt; 1-Securing Network Devices and Establish a SSH Session.pkt; 10-IPv4 Static and Default Routes.pkt |
+| `static_route` | 87 | 09. 2Switches_3Routers_Rime_New.pkt; 10-IPv4 Static and Default Routes.pkt; 13.3.2 lab.pkt |
+| `ripv2` | 61 | 10routerEGIRP.pkt; 10RouterRIP.pkt; 13.3.2 lab.pkt |
+| `default_route` | 56 | 10-IPv4 Static and Default Routes.pkt; 13.3.2 lab.pkt; 23i2110.pkt |
+| `ospfv2` | 50 | 11-Single-Area OSPFv2.pkt; 13routerOSPF.pkt; 2020-06-18 OSPF.pkt |
+| `dhcp_pool` | 48 | 10PORTDHCP.pkt; 20211220 VoIP, PortSec, DHCP - finished.pkt; 6-DHCPv4.pkt |
+| `acl` | 40 | 13.3.2 lab.pkt; 2020-06-18 OSPF.pkt; 23i2110.pkt |
+| `ssh_ios` | 27 | 1-Securing Network Devices and Establish a SSH Session.pkt; 16.4.7 lab.pkt; 2020-05-16 AAA NTP For Learnersv3.pkt |
+| `dhcp_relay` | 24 | 2020-04-19 HSRP OGIT PT Lab.pkt; 2020-05-16 AAA NTP For Learnersv3.pkt; 2020-05-20 Routing  NTP and more WTW.pkt |
+| `eigrp_ipv4` | 22 | 10routerEGIRP.pkt; 13routerEigrp.pkt; 13routerEigrpFINALIZED.pkt |
+| `etherchannel` | 7 | 20211124 L2 EtherChannel, HSRP, OSPF - empty.pkt; 20211124 L2 EtherChannel, HSRP, OSPF - finished.pkt; 5-Implement Inter-VLAN Routing and Etherchannel.pkt |
+| `bgp` | 2 | Cisco-networking-projects-main\BGP\BGP_3_Router\BGP_3_ROUTERS.pkt; Cisco-networking-projects-main\BGP\BGP_Class_C\BGP_Class_C.pkt |
+
+## Proof-Readiness Promotion Queue
+
+This queue connects proof cards, feature atlas status, and local sample evidence. It is a planning artifact, not a `generate_ready` claim.
+
+Dashboard: [proof-readiness dashboard](../docs/proof-readiness-dashboard.md)
+
+| Priority | Capability | Family | Current Status | Explicit Command | Next Safe Action | Blocker |
+| --- | --- | --- | --- | --- | --- | --- |
+| `primary` | `ospfv2` | `ipv4_routing_management` | `edit_proven` | `set R1 ospfv2 1 network 10.0.0.0 wildcard 0.0.0.255 area 0` | Add proof-linked selected-donor readiness for explicit OSPFv2 IOS network commands. | `blocked_by_no_deterministic_target` |
+| `primary` | `eigrp_ipv4` | `ipv4_routing_management` | `edit_proven` | `set R1 eigrp ipv4 100 network 10.0.0.0 wildcard 0.0.0.255 no-auto-summary` | Add proof-linked readiness for explicit EIGRP IPv4 network commands with router target validation. | `blocked_by_no_deterministic_target` |
+| `primary` | `ripv2` | `ipv4_routing_management` | `edit_proven` | `set R1 rip version 2 network 10.0.0.0 no-auto-summary` | Promote explicit RIPv2 IOS commands after selected donor and interface scope are locked. | `blocked_by_no_deterministic_target` |
+| `primary` | `static_route` | `ipv4_routing_management` | `edit_proven` | `set R1 static-route 192.168.10.0/24 via 10.0.0.1` | Promote explicit static/default route commands where gateway and router target are deterministic. | `blocked_by_no_deterministic_target` |
+| `primary` | `default_route` | `ipv4_routing_management` | `edit_proven` | `set R1 static-route 0.0.0.0/0 via 10.0.0.1` | Use the same selected-donor proof path as static_route, but keep broad routing design blocked. | `blocked_by_no_deterministic_target` |
+| `primary` | `dhcp_relay` | `ipv4_routing_management` | `edit_proven` | `set R1 dhcp-relay interface GigabitEthernet0/0 helper 192.168.1.10` | Promote explicit helper-address edits only when interface and relay server are named or uniquely resolved. | `blocked_by_no_deterministic_target` |
+| `primary` | `ssh_ios` | `ipv4_routing_management` | `edit_proven` | `set R1 ssh domain lab.local username admin password cisco123 modulus 1024` | Promote explicit IOS SSH setup when router target, domain, username, and modulus are deterministic. | `blocked_by_no_deterministic_target` |
+| `primary` | `ntp_ios` | `ipv4_routing_management` | `edit_proven` | `set R1 ntp server 192.168.1.20` | Promote explicit NTP server edits after selected-donor proof confirms config persistence. | `blocked_by_no_deterministic_target` |
+| `primary` | `syslog_ios` | `ipv4_routing_management` | `edit_proven` | `set R1 syslog server 192.168.1.30` | Keep edit-proven until local decode-backed sample evidence exists for logging host lines. | `blocked_by_missing_decode_evidence` |
+| `secondary` | `stp` | `l2_resiliency_routing` | `edit_proven` | `set SW1 stp mode rapid-pvst vlan 10 root primary` | Promote explicit STP mode/root commands after switch target and VLAN scope are deterministic. | `blocked_by_no_deterministic_target` |
+| `secondary` | `rstp` | `l2_resiliency_routing` | `edit_proven` | `set SW1 stp mode rapid-pvst vlan 10 root primary` | Use STP selected-donor proof path for rapid-pvst command shape. | `blocked_by_no_deterministic_target` |
+| `secondary` | `etherchannel` | `l2_resiliency_routing` | `edit_proven` | `set SW1 etherchannel 1 mode active interfaces FastEthernet0/1 FastEthernet0/2` | Promote explicit channel-group edits only when every interface target is named and unique. | `blocked_by_no_deterministic_target` |
+| `secondary` | `lacp` | `l2_resiliency_routing` | `edit_proven` | `set SW1 etherchannel 1 mode active interfaces FastEthernet0/1 FastEthernet0/2` | Promote active/passive LACP modes through the EtherChannel proof gate. | `blocked_by_no_deterministic_target` |
+| `secondary` | `pagp` | `l2_resiliency_routing` | `edit_proven` | `set SW1 etherchannel 1 mode desirable interfaces FastEthernet0/1 FastEthernet0/2` | Promote desirable/auto PAgP modes only after selected-donor interface validation. | `blocked_by_no_deterministic_target` |
+| `secondary` | `vtp` | `l2_resiliency_routing` | `edit_proven` | `set SW1 vtp domain CAMPUS mode server version 2` | Promote explicit VTP domain/mode/version edits when switch target is deterministic. | `blocked_by_no_deterministic_target` |
+| `secondary` | `dtp` | `l2_resiliency_routing` | `edit_proven` | `set SW1 dtp interface FastEthernet0/1 mode dynamic desirable` | Keep edit-proven until local decode-backed DTP sample evidence is found. | `blocked_by_missing_decode_evidence` |
+| `secondary` | `bgp` | `l2_resiliency_routing` | `edit_proven` | `set R1 bgp 65001 neighbor 10.0.0.2 remote-as 65002 network 192.168.1.0 mask 255.255.255.0` | Promote explicit BGP neighbor/network edits only after ASN, neighbor, and network target validation are proof-linked. | `blocked_by_no_deterministic_target` |
+

package/examples/home_iot_cli_edit_v1.inventory.json

@@ -1,11 +1,20 @@
 {
+  "schema_version": "examples.truth.v2",
   "example_name": "home_iot_cli_edit_v1",
+  "artifact_type": "showcase_example",
   "source_mode": "donor-backed edit",
   "scenario_family": "home_iot",
-  "public_repo_policy": {
+  "artifact_policy": {
     "commit_pkt_binary": false,
     "commit_inventory_json": true,
-    "commit_screenshot": false
+    "commit_screenshots": true,
+    "raw_source_public": false
+  },
+  "maturity_summary": {
+    "atlas_status": "donor_backed_ready",
+    "example_status": "known_working_example",
+    "donor_backed_ready": true,
+    "generate_ready": false
   },
   "artifact_paths": {
     "inventory_json": "examples/home_iot_cli_edit_v1.inventory.json",