packet-tracer-skill 0.2.2 → 0.3.0

package/examples/local-sample-evidence.json

@@ -0,0 +1,24 @@
+{
+  "schema_version": "examples.truth.v2",
+  "source": "examples/local-sample-evidence.json",
+  "available": true,
+  "policy": "Local user-supplied samples are evidence inputs only, not curated donor truth or npm package content.",
+  "audit_source": "output/local-sample-audit.json",
+  "total_files": 367,
+  "decode_success_count": 366,
+  "decode_fail_count": 1,
+  "top_capabilities": [
+    {"capability": "stp", "sample_count": 348, "examples": ["09. 2Switches_3Routers_Rime_New.pkt", "1-Securing Network Devices and Establish a SSH Session.pkt", "10-IPv4 Static and Default Routes.pkt"]},
+    {"capability": "static_route", "sample_count": 87, "examples": ["09. 2Switches_3Routers_Rime_New.pkt", "10-IPv4 Static and Default Routes.pkt", "13.3.2 lab.pkt"]},
+    {"capability": "ripv2", "sample_count": 61, "examples": ["10routerEGIRP.pkt", "10RouterRIP.pkt", "13.3.2 lab.pkt"]},
+    {"capability": "default_route", "sample_count": 56, "examples": ["10-IPv4 Static and Default Routes.pkt", "13.3.2 lab.pkt", "23i2110.pkt"]},
+    {"capability": "ospfv2", "sample_count": 50, "examples": ["11-Single-Area OSPFv2.pkt", "13routerOSPF.pkt", "2020-06-18 OSPF.pkt"]},
+    {"capability": "dhcp_pool", "sample_count": 48, "examples": ["10PORTDHCP.pkt", "20211220 VoIP, PortSec, DHCP - finished.pkt", "6-DHCPv4.pkt"]},
+    {"capability": "acl", "sample_count": 40, "examples": ["13.3.2 lab.pkt", "2020-06-18 OSPF.pkt", "23i2110.pkt"]},
+    {"capability": "ssh_ios", "sample_count": 27, "examples": ["1-Securing Network Devices and Establish a SSH Session.pkt", "16.4.7 lab.pkt", "2020-05-16 AAA NTP For Learnersv3.pkt"]},
+    {"capability": "dhcp_relay", "sample_count": 24, "examples": ["2020-04-19 HSRP OGIT PT Lab.pkt", "2020-05-16 AAA NTP For Learnersv3.pkt", "2020-05-20 Routing  NTP and more WTW.pkt"]},
+    {"capability": "eigrp_ipv4", "sample_count": 22, "examples": ["10routerEGIRP.pkt", "13routerEigrp.pkt", "13routerEigrpFINALIZED.pkt"]},
+    {"capability": "etherchannel", "sample_count": 7, "examples": ["20211124 L2 EtherChannel, HSRP, OSPF - empty.pkt", "20211124 L2 EtherChannel, HSRP, OSPF - finished.pkt", "5-Implement Inter-VLAN Routing and Etherchannel.pkt"]},
+    {"capability": "bgp", "sample_count": 2, "examples": ["Cisco-networking-projects-main\\BGP\\BGP_3_Router\\BGP_3_ROUTERS.pkt", "Cisco-networking-projects-main\\BGP\\BGP_Class_C\\BGP_Class_C.pkt"]}
+  ]
+}

package/examples/proof-cards.json

@@ -0,0 +1,117 @@
+{
+  "schema_version": "examples.truth.v2",
+  "proof_cards": [
+    {
+      "schema_version": "examples.truth.v2",
+      "artifact_type": "proof_card",
+      "name": "ipv4_routing_management_edit_proof",
+      "title": "IPv4 Routing / NAT / IOS Management",
+      "scenario_family": "ipv4_routing_management",
+      "support_level": "edit_proven",
+      "capabilities": ["ospfv2", "eigrp_ipv4", "ripv2", "static_route", "default_route", "dhcp_relay", "nat_static", "nat_dynamic", "pat", "ssh_ios", "ntp_ios", "syslog_ios"],
+      "explicit_command": "set R1 ospfv2 1 network 10.0.0.0 wildcard 0.0.0.255 area 0",
+      "try_command": "set R1 ospfv2 1 network 10.0.0.0 wildcard 0.0.0.255 area 0",
+      "proof_doc": "docs/ipv4-routing-management-proof.md",
+      "parity_excerpt": "explicit IPv4 routing/NAT/IOS-management commands are edit_proven; generate_ready=false",
+      "refusal_boundary": "No topology synthesis, route convergence proof, ACL object inference, or broad NAT design generation.",
+      "does_not_claim": "No topology synthesis, route convergence proof, ACL object inference, or broad NAT design generation.",
+      "maturity_summary": {"atlas_status": "edit_proven", "example_status": "proof_card", "donor_backed_ready": false, "generate_ready": false}
+    },
+    {
+      "schema_version": "examples.truth.v2",
+      "artifact_type": "proof_card",
+      "name": "l2_resiliency_bgp_edit_proof",
+      "title": "L2 Resiliency + BGP",
+      "scenario_family": "l2_resiliency_routing",
+      "support_level": "edit_proven",
+      "capabilities": ["bgp", "stp", "rstp", "etherchannel", "lacp", "pagp", "vtp", "dtp"],
+      "explicit_command": "set SW1 etherchannel 1 mode active interfaces FastEthernet0/1 FastEthernet0/2",
+      "try_command": "set SW1 etherchannel 1 mode active interfaces FastEthernet0/1 FastEthernet0/2",
+      "proof_doc": "docs/l2-resiliency-bgp-proof.md",
+      "parity_excerpt": "explicit BGP/STP/EtherChannel/VTP/DTP IOS commands are edit_proven; generate_ready=false",
+      "refusal_boundary": "No redundant link creation, STP state validation, BGP convergence proof, or topology generation.",
+      "does_not_claim": "No redundant link creation, STP state validation, BGP convergence proof, or topology generation.",
+      "maturity_summary": {"atlas_status": "edit_proven", "example_status": "proof_card", "donor_backed_ready": false, "generate_ready": false}
+    },
+    {
+      "schema_version": "examples.truth.v2",
+      "artifact_type": "proof_card",
+      "name": "l2_security_qos_proof",
+      "title": "L2 Security + QoS",
+      "scenario_family": "l2_security_monitoring",
+      "support_level": "donor_backed_ready",
+      "capabilities": ["dot1x", "qos", "dhcp_snooping", "dai", "snmp", "netflow", "span"],
+      "explicit_command": "set SW1 dot1x interface FastEthernet0/1 mode auto radius 192.168.1.10 key radius123",
+      "try_command": "set SW1 dot1x interface FastEthernet0/1 mode auto radius 192.168.1.10 key radius123",
+      "proof_doc": "docs/l2-security-qos-proof.md",
+      "parity_excerpt": "dot1x is donor_backed_ready; QoS remains edit_proven; generate_ready=false",
+      "refusal_boundary": "No broad NAC design, RADIUS user synthesis, certificate workflow, or end-to-end QoS policy inference.",
+      "does_not_claim": "No broad NAC design, RADIUS user synthesis, certificate workflow, or end-to-end QoS policy inference.",
+      "maturity_summary": {"atlas_status": "donor_backed_ready", "example_status": "proof_card", "donor_backed_ready": true, "generate_ready": false}
+    },
+    {
+      "schema_version": "examples.truth.v2",
+      "artifact_type": "proof_card",
+      "name": "security_edge_deepening_proof",
+      "title": "Security Edge CBAC/ZFW",
+      "scenario_family": "wan_security_edge",
+      "support_level": "donor_backed_ready",
+      "capabilities": ["cbac", "zfw"],
+      "explicit_command": "set R1 zfw zone-pair INSIDE_OUT source inside destination outside policy POLICY1",
+      "try_command": "set R1 zfw zone-pair INSIDE_OUT source inside destination outside policy POLICY1",
+      "proof_doc": "docs/security-edge-deepening-proof.md",
+      "parity_excerpt": "ZFW is donor_backed_ready; CBAC remains edit_proven; generate_ready=false",
+      "refusal_boundary": "No ASA GUI/internal mutation, clientless VPN, service-policy synthesis, or broad security topology generation.",
+      "does_not_claim": "No ASA GUI/internal mutation, clientless VPN, service-policy synthesis, or broad security topology generation.",
+      "maturity_summary": {"atlas_status": "donor_backed_ready", "example_status": "proof_card", "donor_backed_ready": true, "generate_ready": false}
+    },
+    {
+      "schema_version": "examples.truth.v2",
+      "artifact_type": "proof_card",
+      "name": "voice_collaboration_proof",
+      "title": "Voice / Collaboration",
+      "scenario_family": "voice_collaboration",
+      "support_level": "donor_backed_ready",
+      "capabilities": ["voip", "ip_phone", "call_manager"],
+      "explicit_command": "set \"Router0\" telephony service source-address 192.168.10.1 port 2000 max-ephones 4 max-dn 4",
+      "try_command": "set \"Router0\" telephony service source-address 192.168.10.1 port 2000 max-ephones 4 max-dn 4",
+      "proof_doc": "docs/voice-collaboration-proof.md",
+      "parity_excerpt": "IOS telephony-service, ephone, and dial-peer paths are donor_backed_ready; generate_ready=false",
+      "refusal_boundary": "No Call Manager GUI synthesis, Linksys voice mutation, phone GUI internals, or broad VoIP topology generation.",
+      "does_not_claim": "No Call Manager GUI synthesis, Linksys voice mutation, phone GUI internals, or broad VoIP topology generation.",
+      "maturity_summary": {"atlas_status": "donor_backed_ready", "example_status": "proof_card", "donor_backed_ready": true, "generate_ready": false}
+    },
+    {
+      "schema_version": "examples.truth.v2",
+      "artifact_type": "proof_card",
+      "name": "automation_controller_proof",
+      "title": "Automation / Controller Scripts",
+      "scenario_family": "automation_controller",
+      "support_level": "donor_backed_ready",
+      "capabilities": ["python_programming", "javascript_programming", "tcp_udp_app"],
+      "explicit_command": "set \"Device\" script app \"App Name\" file \"main.py\" content \"print('hello')\"",
+      "try_command": "set \"Device\" script app \"App Name\" file \"main.py\" content \"print('hello')\"",
+      "proof_doc": "docs/automation-controller-proof.md",
+      "parity_excerpt": "existing Python, JavaScript, and TCP/UDP script files are donor_backed_ready; generate_ready=false",
+      "refusal_boundary": "No Network Controller GUI synthesis, Blockly graph mutation, VM/IOx workflow generation, or new app/file creation.",
+      "does_not_claim": "No Network Controller GUI synthesis, Blockly graph mutation, VM/IOx workflow generation, or new app/file creation.",
+      "maturity_summary": {"atlas_status": "donor_backed_ready", "example_status": "proof_card", "donor_backed_ready": true, "generate_ready": false}
+    },
+    {
+      "schema_version": "examples.truth.v2",
+      "artifact_type": "proof_card",
+      "name": "industrial_programming_proof",
+      "title": "Industrial Programming",
+      "scenario_family": "industrial_iot",
+      "support_level": "donor_backed_ready",
+      "capabilities": ["real_http", "real_websocket"],
+      "explicit_command": "set \"Py: real http server 2\" script app \"Real HTTP Server\" file \"main.py\" content \"print('updated')\"",
+      "try_command": "set \"Py: real http server 2\" script app \"Real HTTP Server\" file \"main.py\" content \"print('updated')\"",
+      "proof_doc": "docs/industrial-programming-proof.md",
+      "parity_excerpt": "Real HTTP and Real WebSocket script-file edits are donor_backed_ready; generate_ready=false",
+      "refusal_boundary": "No MQTT broker generation, Profinet/PTP/L2NAT mutation, CyberObserver workflow, or industrial topology generation.",
+      "does_not_claim": "No MQTT broker generation, Profinet/PTP/L2NAT mutation, CyberObserver workflow, or industrial topology generation.",
+      "maturity_summary": {"atlas_status": "donor_backed_ready", "example_status": "proof_card", "donor_backed_ready": true, "generate_ready": false}
+    }
+  ]
+}

package/examples/service_heavy_cli_edit_v1.inventory.json

@@ -1,11 +1,20 @@
 {
+  "schema_version": "examples.truth.v2",
   "example_name": "service_heavy_cli_edit_v1",
+  "artifact_type": "showcase_example",
   "source_mode": "donor-backed edit",
   "scenario_family": "service_heavy",
-  "public_repo_policy": {
+  "artifact_policy": {
     "commit_pkt_binary": false,
     "commit_inventory_json": true,
-    "commit_screenshot": false
+    "commit_screenshots": true,
+    "raw_source_public": false
+  },
+  "maturity_summary": {
+    "atlas_status": "known_working_example",
+    "example_status": "known_working_example",
+    "donor_backed_ready": true,
+    "generate_ready": false
   },
   "artifact_paths": {
     "inventory_json": "examples/service_heavy_cli_edit_v1.inventory.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "packet-tracer-skill",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "private": false,
   "description": "Donor-backed Cisco Packet Tracer 9.x skill for natural-language planning, safe-open generation, editing, parity reporting, and runtime diagnostics across coding hosts.",
   "keywords": [
@@ -54,53 +54,69 @@
     "doctor": "node bin/packet-tracer-skill.js --doctor",
     "smoke:parity": "python scripts/generate_pkt.py --parity-report \"campus with VLAN DHCP ACL\""
   },
-  "files": [
-    "SKILL.md",
-    "LICENSE",
-    "LICENSES",
-    "README.md",
+  "files": [
+    "SKILL.md",
+    "LICENSE",
+    "LICENSES",
+    "README.md",
     "CONTRIBUTING.md",
     "CHANGELOG.md",
     "CITATION.cff",
     "SECURITY.md",
-    "CODE_OF_CONDUCT.md",
-    "requirements.txt",
-    "requirements-dev.txt",
-    "bin/packet-tracer-skill.js",
-    "scripts/*.py",
-    "scripts/*.ps1",
-    "scripts/vendor/README.md",
-    "scripts/vendor/twofish.py",
-    "templates",
-    "references/*.json",
-    "references/*.md",
-    "examples/README.md",
-    "examples/gallery.md",
-    "examples/index.json",
-    "examples/blueprint_minimal.json",
-    "examples/*.inventory.json",
-    "examples/screenshots/*.png",
-    "docs/curated-donor-registry.md",
-    "docs/campus-donor-proof.md",
-    "docs/home-iot-donor-proof.md",
-    "docs/wan-security-donor-proof.md",
-    "docs/wireless-advanced-proof.md",
-    "docs/packet-tracer-feature-gap-atlas.md",
-    "docs/discovery-keywords.md",
-    "docs/github-discussions-setup.md",
-    "docs/github-launch-ops-0.2.1.md",
-    "docs/github-launch-ops-0.2.2.md",
-    "docs/github-metadata.md",
-    "docs/hero-demo-plan.md",
-    "docs/launch-announcement-0.2.1.md",
-    "docs/launch-announcement-0.2.2.md",
-    "docs/post-launch-follow-up.md",
-    "docs/publish-preview-roadmap.md",
-    "docs/release-checklist.md",
-    "docs/release-notes-0.2.1.md",
-    "docs/release-notes-0.2.2.md",
-    "docs/runtime-truth.md"
-  ],
+    "CODE_OF_CONDUCT.md",
+    "requirements.txt",
+    "requirements-dev.txt",
+    "pytest.ini",
+    "bin/packet-tracer-skill.js",
+    "scripts/*.py",
+    "scripts/*.ps1",
+    "scripts/vendor/README.md",
+    "scripts/vendor/twofish.py",
+    "scripts/vendor/twofish_pure.py",
+    "templates",
+    "references/*.json",
+    "references/*.md",
+    "examples/README.md",
+    "examples/gallery.md",
+    "examples/index.json",
+    "examples/proof-cards.json",
+    "examples/local-sample-evidence.json",
+    "examples/blueprint_minimal.json",
+    "examples/*.inventory.json",
+    "examples/screenshots/*.png",
+    "docs/curated-donor-registry.md",
+    "docs/campus-donor-proof.md",
+    "docs/home-iot-donor-proof.md",
+    "docs/wan-security-donor-proof.md",
+    "docs/wireless-advanced-proof.md",
+    "docs/industrial-programming-proof.md",
+    "docs/automation-controller-proof.md",
+    "docs/voice-collaboration-proof.md",
+    "docs/l2-resiliency-bgp-proof.md",
+    "docs/ipv4-routing-management-proof.md",
+    "docs/l2-security-qos-proof.md",
+    "docs/security-edge-deepening-proof.md",
+    "docs/generate-ready-pilot-design.md",
+    "docs/proof-readiness-dashboard.md",
+    "docs/packet-tracer-feature-gap-atlas.md",
+    "docs/discovery-keywords.md",
+    "docs/github-discussions-setup.md",
+    "docs/github-launch-ops-0.2.1.md",
+    "docs/github-launch-ops-0.2.2.md",
+    "docs/github-launch-ops-0.2.3.md",
+    "docs/github-metadata.md",
+    "docs/hero-demo-plan.md",
+    "docs/launch-announcement-0.2.1.md",
+    "docs/launch-announcement-0.2.2.md",
+    "docs/post-launch-follow-up.md",
+    "docs/publish-preview-roadmap.md",
+    "docs/release-checklist.md",
+    "docs/release-notes-0.2.1.md",
+    "docs/release-notes-0.2.2.md",
+    "docs/release-notes-0.2.3.md",
+    "docs/release-notes-0.2.4.md",
+    "docs/runtime-truth.md"
+  ],
   "engines": {
     "node": ">=18"
   }

package/pytest.ini

@@ -0,0 +1,9 @@
+[pytest]
+# Generated labs and their scratch installs live under `output/`, and a bare
+# `pytest` used to walk into them: a vendored `colorama` there ships its own
+# test files, so collection failed with 8 errors before a single test of this
+# repo ran. The suite lives in exactly one place, so say so.
+testpaths = tests
+norecursedirs = output .git .pydeps __pycache__ templates
+markers =
+    requires_twofish: test requires a local Packet Tracer Twofish bridge and real .pkt decode/edit runtime

package/references/packettracer-feature-atlas.json

@@ -17,10 +17,46 @@
         {"id": "ipv6_dns_aaaa", "capability": "ipv6_dns_aaaa", "label": "IPv6 DNS AAAA records", "sample_path_keywords": ["dns-a-and-aaaa", "aaaa"], "support_ceiling": "report_supported"},
         {"id": "ipv6_tunneling", "capability": "ipv6_tunneling", "label": "IPv6 tunneling", "sample_path_keywords": ["ipv6ip tunneling", "ipv6ip_"], "support_ceiling": "report_supported"},
         {"id": "isatap", "capability": "isatap", "label": "ISATAP", "sample_path_keywords": ["isatap"], "support_ceiling": "report_supported"},
-        {"id": "ospfv3", "capability": "ospfv3", "label": "OSPFv3", "sample_path_keywords": ["ospfv3", "ipv6_ospf"], "support_ceiling": "edit_proven"},
-        {"id": "eigrp_ipv6", "capability": "eigrp_ipv6", "label": "EIGRP IPv6", "sample_path_keywords": ["ipv6_eigrp"], "support_ceiling": "edit_proven"},
-        {"id": "ripng", "capability": "ripng", "label": "RIPng", "sample_path_keywords": ["ipv6", "rip"], "support_ceiling": "edit_proven"},
-        {"id": "hsrp", "capability": "hsrp", "label": "HSRP", "sample_path_keywords": ["hsrp"], "support_ceiling": "edit_proven"}
+        {"id": "ospfv3", "capability": "ospfv3", "label": "OSPFv3", "sample_path_keywords": ["ospfv3", "ipv6_ospf"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
+        {"id": "eigrp_ipv6", "capability": "eigrp_ipv6", "label": "EIGRP IPv6", "sample_path_keywords": ["ipv6_eigrp"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
+        {"id": "ripng", "capability": "ripng", "label": "RIPng", "sample_path_keywords": ["ipv6", "rip"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
+        {"id": "hsrp", "capability": "hsrp", "label": "HSRP", "sample_path_keywords": ["hsrp"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true}
+      ]
+    },
+    {
+      "id": "ipv4_routing_management",
+      "label": "IPv4 Routing And IOS Management",
+      "scenario_family": "ipv4_routing_management",
+      "wave": 7,
+      "features": [
+        {"id": "ospfv2", "capability": "ospfv2", "label": "OSPFv2", "sample_path_keywords": ["ospf", "ospfv2", "single-area ospf"], "support_ceiling": "edit_proven"},
+        {"id": "eigrp_ipv4", "capability": "eigrp_ipv4", "label": "EIGRP IPv4", "sample_path_keywords": ["eigrp", "ipv4 eigrp"], "support_ceiling": "edit_proven"},
+        {"id": "ripv2", "capability": "ripv2", "label": "RIPv2", "sample_path_keywords": ["ripv2", "rip"], "support_ceiling": "edit_proven"},
+        {"id": "static_route", "capability": "static_route", "label": "Static IPv4 route", "sample_path_keywords": ["static route", "ip route"], "support_ceiling": "edit_proven"},
+        {"id": "default_route", "capability": "default_route", "label": "Default IPv4 route", "sample_path_keywords": ["default route"], "support_ceiling": "edit_proven"},
+        {"id": "dhcp_relay", "capability": "dhcp_relay", "label": "DHCP relay / helper address", "sample_path_keywords": ["dhcp relay", "dhcprelay", "helper-address"], "support_ceiling": "edit_proven"},
+        {"id": "nat_static", "capability": "nat_static", "label": "Static NAT", "sample_path_keywords": ["static nat"], "support_ceiling": "edit_proven"},
+        {"id": "nat_dynamic", "capability": "nat_dynamic", "label": "Dynamic NAT", "sample_path_keywords": ["dynamic nat"], "support_ceiling": "edit_proven"},
+        {"id": "pat", "capability": "pat", "label": "PAT overload", "sample_path_keywords": ["pat", "overload"], "support_ceiling": "edit_proven"},
+        {"id": "ssh_ios", "capability": "ssh_ios", "label": "IOS SSH management", "sample_path_keywords": ["ssh"], "support_ceiling": "edit_proven"},
+        {"id": "ntp_ios", "capability": "ntp_ios", "label": "IOS NTP client", "sample_path_keywords": ["ntp"], "support_ceiling": "edit_proven"},
+        {"id": "syslog_ios", "capability": "syslog_ios", "label": "IOS syslog client", "sample_path_keywords": ["syslog"], "support_ceiling": "edit_proven"}
+      ]
+    },
+    {
+      "id": "l2_resiliency_routing",
+      "label": "L2 Resiliency And BGP",
+      "scenario_family": "l2_resiliency_routing",
+      "wave": 6,
+      "features": [
+        {"id": "bgp", "capability": "bgp", "label": "BGP", "sample_path_keywords": ["bgp"], "support_ceiling": "edit_proven"},
+        {"id": "stp", "capability": "stp", "label": "Spanning Tree Protocol", "sample_path_keywords": ["stp", "spanning tree", "spanning-tree"], "support_ceiling": "edit_proven"},
+        {"id": "rstp", "capability": "rstp", "label": "Rapid STP / Rapid PVST", "sample_path_keywords": ["rstp", "rapid-pvst"], "support_ceiling": "edit_proven"},
+        {"id": "etherchannel", "capability": "etherchannel", "label": "EtherChannel / Port-channel", "sample_path_keywords": ["etherchannel", "port-channel", "channel-group"], "support_ceiling": "edit_proven"},
+        {"id": "lacp", "capability": "lacp", "label": "LACP", "sample_path_keywords": ["lacp"], "support_ceiling": "edit_proven"},
+        {"id": "pagp", "capability": "pagp", "label": "PAgP", "sample_path_keywords": ["pagp"], "support_ceiling": "edit_proven"},
+        {"id": "vtp", "capability": "vtp", "label": "VTP", "sample_path_keywords": ["vtp"], "support_ceiling": "edit_proven"},
+        {"id": "dtp", "capability": "dtp", "label": "DTP", "sample_path_keywords": ["dtp"], "support_ceiling": "edit_proven"}
       ]
     },
     {
@@ -31,16 +67,30 @@
       "features": [
         {"id": "dhcp_snooping", "capability": "dhcp_snooping", "label": "DHCP snooping", "sample_path_keywords": ["dhcp_snooping"], "support_ceiling": "edit_proven"},
         {"id": "dai", "capability": "dai", "label": "Dynamic ARP Inspection", "sample_path_keywords": ["dai"], "support_ceiling": "edit_proven"},
-        {"id": "dot1x", "capability": "dot1x", "label": "802.1X / NAC", "sample_path_keywords": ["dot1x", "port-based nac"], "support_ceiling": "report_supported"},
+        {"id": "dot1x", "capability": "dot1x", "label": "802.1X / NAC", "sample_path_keywords": ["dot1x", "port-based nac"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
         {"id": "lldp", "capability": "lldp", "label": "LLDP", "sample_path_keywords": ["lldp"], "support_ceiling": "edit_proven"},
         {"id": "rep", "capability": "rep", "label": "REP", "sample_path_keywords": ["rep_"], "support_ceiling": "edit_proven"},
         {"id": "snmp", "capability": "snmp", "label": "SNMP", "sample_path_keywords": ["snmp"], "support_ceiling": "edit_proven"},
         {"id": "netflow", "capability": "netflow", "label": "NetFlow", "sample_path_keywords": ["netflow"], "support_ceiling": "edit_proven"},
-        {"id": "span", "capability": "span", "label": "SPAN/RSPAN", "sample_path_keywords": ["span"], "support_ceiling": "edit_proven"},
-        {"id": "qos", "capability": "qos", "label": "QoS", "sample_path_keywords": ["qos"], "support_ceiling": "report_supported"},
+        {"id": "span", "capability": "span", "label": "SPAN/RSPAN", "sample_path_keywords": ["rspan", "monitor session", "span session"], "support_ceiling": "edit_proven"},
+        {"id": "qos", "capability": "qos", "label": "QoS", "sample_path_keywords": ["qos"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
         {"id": "port_security", "capability": "port_security", "label": "Port security", "sample_path_keywords": ["port security", "port-security"], "support_ceiling": "edit_proven"}
       ]
     },
+    {
+      "id": "wan_security_edge",
+      "label": "WAN Security Edge",
+      "scenario_family": "wan_security_edge",
+      "wave": 4,
+      "features": [
+        {"id": "vpn", "capability": "vpn", "label": "Site-to-site VPN crypto map", "sample_path_keywords": ["vpn", "ipsec"], "support_ceiling": "edit_proven"},
+        {"id": "ipsec", "capability": "ipsec", "label": "IPSec transform set / crypto map", "sample_path_keywords": ["ipsec", "ike"], "support_ceiling": "edit_proven"},
+        {"id": "gre", "capability": "gre", "label": "GRE tunnel basics", "sample_path_keywords": ["gre"], "support_ceiling": "edit_proven"},
+        {"id": "ppp", "capability": "ppp", "label": "PPP serial encapsulation", "sample_path_keywords": ["ppp", "chap", "pap"], "support_ceiling": "edit_proven"},
+        {"id": "security_edge", "capability": "security_edge", "label": "Security edge device evidence", "sample_path_keywords": ["asa", "firewall", "security appliance"], "support_ceiling": "report_supported"},
+        {"id": "multilayer_switching", "capability": "multilayer_switching", "label": "Multilayer switch / SVI evidence", "sample_path_keywords": ["multilayer", "3560", "svi"], "support_ceiling": "report_supported"}
+      ]
+    },
     {
       "id": "security_edge_deepening",
       "label": "Security Edge Deepening",
@@ -50,8 +100,8 @@
         {"id": "asa_acl_nat", "capability": "asa_acl_nat", "label": "ASA ACL/NAT", "sample_path_keywords": ["asa_acl_nat"], "support_ceiling": "report_supported"},
         {"id": "asa_service_policy", "capability": "asa_service_policy", "label": "ASA service policy", "sample_path_keywords": ["asa_service_policy"], "support_ceiling": "report_supported"},
         {"id": "clientless_vpn", "capability": "clientless_vpn", "label": "Clientless VPN", "sample_path_keywords": ["clientless_vpn"], "support_ceiling": "report_supported"},
-        {"id": "cbac", "capability": "cbac", "label": "CBAC", "sample_path_keywords": ["cbac"], "support_ceiling": "report_supported"},
-        {"id": "zfw", "capability": "zfw", "label": "Zone Based Firewall", "sample_path_keywords": ["zfw", "zone based firewall"], "support_ceiling": "report_supported"},
+        {"id": "cbac", "capability": "cbac", "label": "CBAC", "sample_path_keywords": ["cbac"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
+        {"id": "zfw", "capability": "zfw", "label": "Zone Based Firewall", "sample_path_keywords": ["zfw", "zone based firewall"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
         {"id": "sniffer", "capability": "sniffer", "label": "Sniffer", "sample_path_keywords": ["sniffer"], "support_ceiling": "report_supported"}
       ]
     },
@@ -78,10 +128,10 @@
       "wave": 5,
       "features": [
         {"id": "network_controller", "capability": "network_controller", "label": "Network Controller", "sample_path_keywords": ["network controller", "netcon"], "support_ceiling": "report_supported"},
-        {"id": "python_programming", "capability": "python_programming", "label": "Python programming", "sample_path_keywords": ["python", "programming_with_python"], "support_ceiling": "report_supported"},
-        {"id": "javascript_programming", "capability": "javascript_programming", "label": "JavaScript programming", "sample_path_keywords": ["javascript"], "support_ceiling": "report_supported"},
+        {"id": "python_programming", "capability": "python_programming", "label": "Python programming", "sample_path_keywords": ["python", "programming_with_python"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
+        {"id": "javascript_programming", "capability": "javascript_programming", "label": "JavaScript programming", "sample_path_keywords": ["javascript"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
         {"id": "blockly_programming", "capability": "blockly_programming", "label": "Blockly programming", "sample_path_keywords": ["blockly"], "support_ceiling": "report_supported"},
-        {"id": "tcp_udp_app", "capability": "tcp_udp_app", "label": "TCP/UDP test apps", "sample_path_keywords": ["tcp_test_app", "udp_test_app"], "support_ceiling": "report_supported"},
+        {"id": "tcp_udp_app", "capability": "tcp_udp_app", "label": "TCP/UDP test apps", "sample_path_keywords": ["tcp_test_app", "udp_test_app"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
         {"id": "vm_iox", "capability": "vm_iox", "label": "VM / IOx", "sample_path_keywords": ["iox", "uploading_and_running_vm"], "support_ceiling": "report_supported"}
       ]
     },
@@ -91,9 +141,9 @@
       "scenario_family": "voice_collaboration",
       "wave": 5,
       "features": [
-        {"id": "voip", "capability": "voip", "label": "VoIP", "sample_path_keywords": ["voip"], "support_ceiling": "report_supported"},
-        {"id": "ip_phone", "capability": "ip_phone", "label": "IP phones", "sample_path_keywords": ["phone"], "support_ceiling": "report_supported"},
-        {"id": "call_manager", "capability": "call_manager", "label": "Call Manager / telephony service", "sample_path_keywords": ["call", "voip"], "support_ceiling": "report_supported"},
+        {"id": "voip", "capability": "voip", "label": "VoIP", "sample_path_keywords": ["voip"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
+        {"id": "ip_phone", "capability": "ip_phone", "label": "IP phones", "sample_path_keywords": ["phone"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
+        {"id": "call_manager", "capability": "call_manager", "label": "Call Manager / telephony service", "sample_path_keywords": ["call", "voip"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
         {"id": "linksys_voice", "capability": "linksys_voice", "label": "Linksys voice", "sample_path_keywords": ["voip linksys"], "support_ceiling": "report_supported"}
       ]
     },
@@ -104,8 +154,8 @@
       "wave": 5,
       "features": [
         {"id": "mqtt", "capability": "mqtt", "label": "MQTT", "sample_path_keywords": ["mqtt"], "support_ceiling": "report_supported"},
-        {"id": "real_http", "capability": "real_http", "label": "Real HTTP", "sample_path_keywords": ["real http", "real-http"], "support_ceiling": "report_supported"},
-        {"id": "real_websocket", "capability": "real_websocket", "label": "Real WebSocket", "sample_path_keywords": ["real websocket", "real-websocket"], "support_ceiling": "report_supported"},
+        {"id": "real_http", "capability": "real_http", "label": "Real HTTP", "sample_path_keywords": ["real http", "real-http"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
+        {"id": "real_websocket", "capability": "real_websocket", "label": "Real WebSocket", "sample_path_keywords": ["real websocket", "real-websocket"], "support_ceiling": "donor_backed_ready", "donor_backed_proof": true},
         {"id": "visual_scripting", "capability": "visual_scripting", "label": "Visual scripting", "sample_path_keywords": ["visual-scripting", "visual scripting"], "support_ceiling": "report_supported"},
         {"id": "ptp", "capability": "ptp", "label": "PTP", "sample_path_keywords": ["ptp"], "support_ceiling": "report_supported"},
         {"id": "profinet", "capability": "profinet", "label": "Profinet", "sample_path_keywords": ["profinet"], "support_ceiling": "report_supported"},