testprotocols 0.6.0__tar.gz → 0.7.1__tar.gz

{testprotocols-0.6.0/src/testprotocols.egg-info → testprotocols-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: testprotocols
-Version: 0.6.0
+Version: 0.7.1
 Summary: Common Test Resource Layer — capability and device protocols for telco testing.
 Author-email: Alottabits <rjvisser@alottabits.com>
 Maintainer-email: Alottabits <rjvisser@alottabits.com>

{testprotocols-0.6.0 → testprotocols-0.7.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "testprotocols"
-version = "0.6.0"
+version = "0.7.1"
 description = "Common Test Resource Layer — capability and device protocols for telco testing."
 requires-python = ">=3.12"
 dependencies = []

{testprotocols-0.6.0 → testprotocols-0.7.1}/src/testprotocols/__init__.py

@@ -1,6 +1,6 @@
 """testprotocols — capability and device Protocols for telco resources under test."""
 
-__version__ = "0.6.0"
+__version__ = "0.7.1"
 
 from testprotocols.aftr_gateway import AftrGateway
 from testprotocols.appliance_nat import ApplianceNat

{testprotocols-0.6.0 → testprotocols-0.7.1}/src/testprotocols/first_hop_security.py

@@ -18,9 +18,7 @@ from testprotocols.models.switch import BindingSource, FhsBinding, FhsScope, Fhs
 class FirstHopSecurity(Protocol):
     """Abstract contract for DHCP snooping + Dynamic ARP Inspection."""
 
-    def set_dhcp_snooping(
-        self, scope: FhsScope, enabled: bool, vlan: int | None = None
-    ) -> None:
+    def set_dhcp_snooping(self, scope: FhsScope, enabled: bool, vlan: int | None = None) -> None:
         """Enable/disable DHCP snooping globally or per-VLAN. A switch-wide-only
         product maps ``PER_VLAN`` to ``GLOBAL`` or raises unsupported-capability."""
         ...

{testprotocols-0.6.0 → testprotocols-0.7.1}/src/testprotocols/iperf_client.py

@@ -19,7 +19,6 @@ class IperfClient(Protocol):
         traffic_port: int,
         bandwidth: int | None = None,
         bind_to_ip: str | None = None,
-        direction: str | None = None,
         ip_version: int | None = None,
         udp_protocol: bool = False,
         time: int = 10,
@@ -51,10 +50,6 @@ class IperfClient(Protocol):
           ``tcp_rmem``/``tcp_wmem``), so the host must be provisioned
           accordingly.
 
-        ``direction`` is DEPRECATED: a raw CLI fragment appended verbatim
-        after the typed flags. Kept as an escape hatch only; use the typed
-        parameters instead.
-
         Returns a tuple of (pid, log_file_path).
         """
         ...

{testprotocols-0.6.0 → testprotocols-0.7.1}/src/testprotocols/models/dhcp.py

@@ -41,7 +41,7 @@ class DhcpLeaseObservation:
     server: str = ""
     """The DHCP server identifier, option 54 (dotted quad; empty if absent)."""
 
-    options: Mapping[int, str] = field(default_factory=dict)
+    options: Mapping[int, str] = field(default_factory=dict[int, str])
     """Raw received value per option code, as reported by the client."""
 
 

{testprotocols-0.6.0 → testprotocols-0.7.1}/src/testprotocols/models/sdwan_appliance.py

@@ -227,7 +227,7 @@ class OneToOneNatRule:
     public_ip: str
     lan_ip: str
     uplink: str = "any"
-    allowed_inbound: list[NatInboundAllow] = field(default_factory=list)
+    allowed_inbound: list[NatInboundAllow] = field(default_factory=list[NatInboundAllow])
 
 
 @dataclass
@@ -236,7 +236,7 @@ class OneToManyNatRule:
 
     public_ip: str
     uplink: str = "any"
-    port_forwards: list[PortForwardRule] = field(default_factory=list)
+    port_forwards: list[PortForwardRule] = field(default_factory=list[PortForwardRule])
 
 
 # --- WAN uplinks ---
@@ -287,7 +287,7 @@ class SyslogServer:
 
     host: str
     port: int = 514
-    roles: list[SyslogRole] = field(default_factory=list)
+    roles: list[SyslogRole] = field(default_factory=list[SyslogRole])
 
 
 # --- Threat prevention (IDS / IPS + malware) ---
@@ -423,10 +423,10 @@ class VlanConfig:
     appliance_ip: str
     dhcp_mode: DhcpMode = DhcpMode.SERVER
     dhcp_lease_seconds: int = 86400
-    dns_servers: list[str] = field(default_factory=list)
-    dhcp_options: list[DhcpOption] = field(default_factory=list)
-    reservations: list[DhcpReservation] = field(default_factory=list)
-    reserved_ranges: list[tuple[str, str]] = field(default_factory=list)
+    dns_servers: list[str] = field(default_factory=list[str])
+    dhcp_options: list[DhcpOption] = field(default_factory=list[DhcpOption])
+    reservations: list[DhcpReservation] = field(default_factory=list[DhcpReservation])
+    reserved_ranges: list[tuple[str, str]] = field(default_factory=list[tuple[str, str]])
 
 
 @dataclass
@@ -489,8 +489,8 @@ class SiteToSiteVpnConfig:
     """
 
     role: VpnRole
-    hubs: list[VpnHub] = field(default_factory=list)
-    subnets: list[VpnSubnet] = field(default_factory=list)
+    hubs: list[VpnHub] = field(default_factory=list[VpnHub])
+    subnets: list[VpnSubnet] = field(default_factory=list[VpnSubnet])
 
 
 @dataclass
@@ -619,8 +619,8 @@ class BgpConfig:
 
     enabled: bool
     as_number: int
-    neighbors: list[BgpNeighbor] = field(default_factory=list)
-    advertised_networks: list[str] = field(default_factory=list)
+    neighbors: list[BgpNeighbor] = field(default_factory=list[BgpNeighbor])
+    advertised_networks: list[str] = field(default_factory=list[str])
 
 
 @dataclass

{testprotocols-0.6.0 → testprotocols-0.7.1}/src/testprotocols/models/switch.py

@@ -145,7 +145,7 @@ class SwitchPort:
     mode: PortMode
     enabled: bool = True
     native_vlan: int | None = None
-    allowed_vlans: list[int] = field(default_factory=list)
+    allowed_vlans: list[int] = field(default_factory=list[int])
     description: str = ""
     voice_vlan: int | None = None
     isolated: bool = False
@@ -195,7 +195,7 @@ class AccessPolicy:
 
     port: str
     policy_type: AccessPolicyType
-    allowed_macs: list[str] = field(default_factory=list)
+    allowed_macs: list[str] = field(default_factory=list[str])
     max_macs: int | None = None
     sticky: bool = False
 
@@ -209,7 +209,7 @@ class StormControlConfig:
     """
 
     port: str
-    thresholds: dict[StormControlType, float] = field(default_factory=dict)
+    thresholds: dict[StormControlType, float] = field(default_factory=dict[StormControlType, float])
 
 
 @dataclass

{testprotocols-0.6.0 → testprotocols-0.7.1}/src/testprotocols/models/switch_routing.py

@@ -81,11 +81,11 @@ class InterfaceDhcpConfig:
     interface: str
     mode: DhcpMode = DhcpMode.DISABLED
     lease_seconds: int = 86400
-    dns_servers: list[str] = field(default_factory=list)
-    options: list[DhcpOption] = field(default_factory=list)
-    reservations: list[DhcpReservation] = field(default_factory=list)
-    reserved_ranges: list[tuple[str, str]] = field(default_factory=list)
-    relay_targets: list[str] = field(default_factory=list)
+    dns_servers: list[str] = field(default_factory=list[str])
+    options: list[DhcpOption] = field(default_factory=list[DhcpOption])
+    reservations: list[DhcpReservation] = field(default_factory=list[DhcpReservation])
+    reserved_ranges: list[tuple[str, str]] = field(default_factory=list[tuple[str, str]])
+    relay_targets: list[str] = field(default_factory=list[str])
 
 
 @dataclass
@@ -105,8 +105,8 @@ class OspfConfig:
     enabled: bool
     router_id: str
     version: OspfVersion = OspfVersion.V2
-    areas: list[str] = field(default_factory=list)
-    interfaces: list[OspfInterfaceSettings] = field(default_factory=list)
+    areas: list[str] = field(default_factory=list[str])
+    interfaces: list[OspfInterfaceSettings] = field(default_factory=list[OspfInterfaceSettings])
 
 
 @dataclass

{testprotocols-0.6.0 → testprotocols-0.7.1}/src/testprotocols/sdwan_policy_manager.py

@@ -5,7 +5,9 @@ policy application, SLA policies, and application-flow visibility.
 
 Firewall-rule administration is **not** here — it moved to the dedicated
 ``l3_firewall`` / ``l7_firewall`` capabilities (coherent-domain split; see
-SPLITS.md). Typed path steering (``set_uplink_selection`` /
+SPLITS.md). Also not here: moving flows between the overlay and internet
+domains (overlay membership carve-outs) — see ``site_to_site_vpn``. Typed
+path steering (``set_uplink_selection`` /
 ``get_uplink_selection`` over ordered ``UplinkSelectionRule``s; performance
 classes reuse ``SLAPolicy`` by name) landed 2026-06-12; the default
 (primary) uplink pair (``get_default_uplink`` / ``set_default_uplink``)

{testprotocols-0.6.0 → testprotocols-0.7.1}/src/testprotocols/site_to_site_vpn.py

@@ -21,8 +21,12 @@ hub anywhere → ``HUB``; overlay enabled with hub list → ``SPOKE``) and on
 write registers/dereferences the device in the relevant site configs. The
 round-trip is intent-preserving even where the stored shape differs.
 
-In scope: overlay participation (role, hubs + default route, subnets) and
-peer status.
+In scope: overlay participation (role, hubs + default route, subnets),
+overlay exclusions (flow-level membership carve-outs — local breakout), and
+peer status. Overlay *membership* — which flows are in the overlay at all
+(role, hubs + default route, subnets, exclusions) — lives here; path
+selection *within* a domain (e.g. which overlay uplink, or which internet
+uplink) lives in ``sdwan_policy_manager``.
 
 Out of scope: VPN-scoped firewall rules (see ``l3_firewall``), IPsec crypto
 parameters (no driving test; highly vendor-divergent — add on evidence),
@@ -34,7 +38,11 @@ from __future__ import annotations
 
 from typing import Protocol, runtime_checkable
 
-from testprotocols.models.sdwan_appliance import SiteToSiteVpnConfig, VpnPeerStatus
+from testprotocols.models.sdwan_appliance import (
+    FlowMatch,
+    SiteToSiteVpnConfig,
+    VpnPeerStatus,
+)
 
 
 @runtime_checkable
@@ -59,3 +67,24 @@ class SiteToSiteVpn(Protocol):
         Empty list when the device participates in no overlay.
         """
         ...
+
+    def get_vpn_exclusions(self) -> list[FlowMatch]:
+        """Return the flow matches excluded from the overlay (local breakout).
+
+        Flows matching an entry bypass the site-to-site overlay and egress
+        the local uplink, even when an overlay route — including an overlay
+        default learned from a routing protocol — covers the destination.
+        Empty list when every flow is eligible for overlay routing.
+        """
+        ...
+
+    def set_vpn_exclusions(self, rules: list[FlowMatch]) -> None:
+        """Replace the overlay-exclusion rule set with *rules*.
+
+        Whole-replace; read-modify-write is the caller's responsibility.
+        Products that cannot express a constrained field (e.g. source-side
+        matches) raise rather than approximate. Vendor rule kinds outside
+        this contract (e.g. application-based exclusions) are preserved
+        unchanged by the driver.
+        """
+        ...

{testprotocols-0.6.0 → testprotocols-0.7.1}/src/testprotocols/switch_acl.py

@@ -17,9 +17,7 @@ from testprotocols.models.switch import AclDirection, SwitchAclRule
 class SwitchAcl(Protocol):
     """Abstract contract for the switch ACL."""
 
-    def set_acl(
-        self, binding: str, direction: AclDirection, rules: list[SwitchAclRule]
-    ) -> None:
+    def set_acl(self, binding: str, direction: AclDirection, rules: list[SwitchAclRule]) -> None:
         """Replace the ordered ACL bound to *binding* (a port or ``vlan:<id>``)
         in *direction*."""
         ...

{testprotocols-0.6.0 → testprotocols-0.7.1/src/testprotocols.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: testprotocols
-Version: 0.6.0
+Version: 0.7.1
 Summary: Common Test Resource Layer — capability and device protocols for telco testing.
 Author-email: Alottabits <rjvisser@alottabits.com>
 Maintainer-email: Alottabits <rjvisser@alottabits.com>

testprotocols-0.7.1/tests/test_appliance_vlans.py

@@ -0,0 +1,52 @@
+"""Protocol-conformance tests for ApplianceVlans (runtime_checkable structural check)."""
+
+from __future__ import annotations
+
+from testprotocols.appliance_vlans import ApplianceVlans
+from testprotocols.models.sdwan_appliance import DhcpLease, VlanConfig
+
+
+class _Complete:
+    """Has every ApplianceVlans member, including delete_vlan.
+
+    Signatures mirror the protocol for documentation only — ``runtime_checkable``
+    ``isinstance`` checks member presence, not shape, so these bodies are never
+    reached.
+    """
+
+    def list_vlans(self) -> list[VlanConfig]:
+        raise NotImplementedError
+
+    def get_vlan(self, vlan_id: int) -> VlanConfig:
+        raise NotImplementedError
+
+    def set_vlan(self, config: VlanConfig) -> None: ...
+
+    def delete_vlan(self, vlan_id: int) -> None: ...
+
+    def get_dhcp_leases(self, vlan_id: int | None = None) -> list[DhcpLease]:
+        raise NotImplementedError
+
+
+class _NoDelete:
+    """Missing delete_vlan — must NOT satisfy the protocol once delete_vlan is declared."""
+
+    def list_vlans(self) -> list[VlanConfig]:
+        raise NotImplementedError
+
+    def get_vlan(self, vlan_id: int) -> VlanConfig:
+        raise NotImplementedError
+
+    def set_vlan(self, config: VlanConfig) -> None: ...
+
+    def get_dhcp_leases(self, vlan_id: int | None = None) -> list[DhcpLease]:
+        raise NotImplementedError
+
+
+def test_complete_impl_satisfies_protocol() -> None:
+    assert isinstance(_Complete(), ApplianceVlans)
+
+
+def test_delete_vlan_is_required_by_protocol() -> None:
+    # runtime_checkable isinstance requires every declared member be present.
+    assert not isinstance(_NoDelete(), ApplianceVlans)

{testprotocols-0.6.0 → testprotocols-0.7.1}/tests/test_cpe_templates.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 import importlib
 
 import pytest
+from _helpers import protocol_attrs
 
 PROTOCOLS = [
     (
@@ -93,5 +94,5 @@ def test_is_runtime_checkable(class_name: str, module: str, expected_methods: se
 def test_protocol_shape(class_name: str, module: str, expected_methods: set[str]) -> None:
     """Each Protocol declares at least the expected method set."""
     cls = getattr(importlib.import_module(module), class_name)
-    actual = set(cls.__protocol_attrs__)
+    actual = protocol_attrs(cls)
     assert expected_methods <= actual, f"{class_name} missing: {expected_methods - actual}"

{testprotocols-0.6.0 → testprotocols-0.7.1}/tests/test_device_types.py

@@ -10,6 +10,7 @@ inventory-string -> Protocol binding and the per-archetype capability set
 from __future__ import annotations
 
 import pytest
+from _helpers import protocol_attrs
 from testprotocols.devices import DeviceTypeSpec, all_device_types, get_device_type
 from testprotocols.devices.base import BaseDeviceProtocol
 from testprotocols.devices.client import (
@@ -195,7 +196,7 @@ def test_sdwan_router_aggregates_expected_capabilities() -> None:
         "nat",
         "conntrack",
     }
-    actual = set(SdwanRouterDevice.__protocol_attrs__)
+    actual = protocol_attrs(SdwanRouterDevice)
     assert expected <= actual, f"missing: {expected - actual}"
     assert "netem" not in actual, "netem should not be on SdwanRouterDevice"
 
@@ -220,7 +221,7 @@ def test_sdwan_appliance_aggregates_expected_capabilities() -> None:
         "syslog",
         "vpn",
     }
-    actual = set(SdwanApplianceDevice.__protocol_attrs__)
+    actual = protocol_attrs(SdwanApplianceDevice)
     assert expected <= actual, f"missing: {expected - actual}"
     # device_management is Linux-host-shaped (ps/memory/board-logs/file-content)
     # and intentionally NOT on the managed-appliance archetype — see GAPS.md.
@@ -257,7 +258,7 @@ def test_cpe_aggregates_expected_capabilities() -> None:
         "firewall_zones",
         "ntp_client",
     }
-    actual = set(CpeDevice.__protocol_attrs__)
+    actual = protocol_attrs(CpeDevice)
     assert expected <= actual, f"missing: {expected - actual}"
 
 
@@ -281,7 +282,7 @@ def test_lan_client_aggregates_expected_capabilities() -> None:
         "arp_client",
         "vlan_client",
     }
-    actual = set(LanClientDevice.__protocol_attrs__)
+    actual = protocol_attrs(LanClientDevice)
     assert expected <= actual, f"missing: {expected - actual}"
 
 
@@ -301,13 +302,13 @@ def test_wlan_client_aggregates_expected_capabilities() -> None:
         "nmap_scanner",
         "file_transfer",
     }
-    actual = set(WlanClientDevice.__protocol_attrs__)
+    actual = protocol_attrs(WlanClientDevice)
     assert expected <= actual, f"missing: {expected - actual}"
 
 
 def test_qoe_client_aggregates_expected_capabilities() -> None:
     expected = {"qoe_browser", "ip_interface", "dhcp_client", "syslog"}
-    actual = set(QoeClientDevice.__protocol_attrs__)
+    actual = protocol_attrs(QoeClientDevice)
     assert expected <= actual, f"missing: {expected - actual}"
 
 
@@ -323,15 +324,13 @@ def test_qoe_measurement_client_aggregates_expected_capabilities() -> None:
         "pcap",
         "syslog",
     }
-    actual = set(QoeMeasurementClientDevice.__protocol_attrs__)
+    actual = protocol_attrs(QoeMeasurementClientDevice)
     assert expected <= actual, f"missing: {expected - actual}"
 
 
 def test_qoe_measurement_client_is_a_qoe_client() -> None:
     """Strict-superset invariant: the measurement client subsumes QoeClientDevice."""
-    assert set(QoeClientDevice.__protocol_attrs__) <= set(
-        QoeMeasurementClientDevice.__protocol_attrs__
-    )
+    assert protocol_attrs(QoeClientDevice) <= protocol_attrs(QoeMeasurementClientDevice)
 
 
 def test_acs_aggregates_expected_capabilities() -> None:
@@ -341,43 +340,43 @@ def test_acs_aggregates_expected_capabilities() -> None:
         "file_transfer",
         "packet_filter",
     }
-    actual = set(AcsDevice.__protocol_attrs__)
+    actual = protocol_attrs(AcsDevice)
     assert expected <= actual, f"missing: {expected - actual}"
 
 
 def test_provisioner_aggregates_expected_capabilities() -> None:
     expected = {"dhcp_server", "pcap", "file_transfer", "packet_filter"}
-    actual = set(ProvisionerDevice.__protocol_attrs__)
+    actual = protocol_attrs(ProvisionerDevice)
     assert expected <= actual, f"missing: {expected - actual}"
 
 
 def test_tftp_aggregates_expected_capabilities() -> None:
     expected = {"tftp_server"}
-    actual = set(TftpDevice.__protocol_attrs__)
+    actual = protocol_attrs(TftpDevice)
     assert expected <= actual, f"missing: {expected - actual}"
 
 
 def test_traffic_controller_aggregates_expected_capabilities() -> None:
     expected = {"netem", "ip_interface", "pcap", "syslog"}
-    actual = set(TrafficControllerDevice.__protocol_attrs__)
+    actual = protocol_attrs(TrafficControllerDevice)
     assert expected <= actual, f"missing: {expected - actual}"
 
 
 def test_iperf_traffic_generator_aggregates_expected_capabilities() -> None:
     expected = {"iperf_generator", "ip_interface"}
-    actual = set(IperfTrafficGeneratorDevice.__protocol_attrs__)
+    actual = protocol_attrs(IperfTrafficGeneratorDevice)
     assert expected <= actual, f"missing: {expected - actual}"
 
 
 def test_sip_phone_device_aggregates_expected_capabilities() -> None:
     expected = {"sip_phone", "ip_interface", "dhcp_client", "number"}
-    actual = set(SipPhoneDevice.__protocol_attrs__)
+    actual = protocol_attrs(SipPhoneDevice)
     assert expected <= actual, f"missing: {expected - actual}"
 
 
 def test_sip_server_device_aggregates_expected_capabilities() -> None:
     expected = {"sip_server", "pcap", "file_transfer"}
-    actual = set(SipServerDevice.__protocol_attrs__)
+    actual = protocol_attrs(SipServerDevice)
     assert expected <= actual, f"missing: {expected - actual}"
 
 
@@ -400,7 +399,7 @@ def test_wan_server_aggregates_expected_capabilities() -> None:
         "nat",
         "conntrack",
     }
-    actual = set(WanServerDevice.__protocol_attrs__)
+    actual = protocol_attrs(WanServerDevice)
     assert expected <= actual, f"missing: {expected - actual}"
 
 
@@ -411,7 +410,7 @@ def test_wan_server_aggregates_expected_capabilities() -> None:
 
 def test_acs_firewall_facets() -> None:
     """ACS aggregates packet_filter only — no NAT / port-forwarding / conntrack / zones."""
-    attrs = set(AcsDevice.__protocol_attrs__)
+    attrs = protocol_attrs(AcsDevice)
     assert "packet_filter" in attrs
     for absent in ("nat", "port_forwarding", "conntrack", "firewall_zones"):
         assert absent not in attrs, f"AcsDevice unexpectedly aggregates {absent}"
@@ -419,13 +418,13 @@ def test_acs_firewall_facets() -> None:
 
 def test_provisioner_firewall_facets() -> None:
     """Provisioner aggregates packet_filter."""
-    attrs = set(ProvisionerDevice.__protocol_attrs__)
+    attrs = protocol_attrs(ProvisionerDevice)
     assert "packet_filter" in attrs
 
 
 def test_lan_client_firewall_facets() -> None:
     """LanClientDevice aggregates packet_filter only."""
-    attrs = set(LanClientDevice.__protocol_attrs__)
+    attrs = protocol_attrs(LanClientDevice)
     assert "packet_filter" in attrs
     for absent in ("nat", "port_forwarding", "conntrack", "firewall_zones"):
         assert absent not in attrs, f"LanClientDevice unexpectedly aggregates {absent}"
@@ -433,7 +432,7 @@ def test_lan_client_firewall_facets() -> None:
 
 def test_wan_server_firewall_facets() -> None:
     """WanServerDevice aggregates packet_filter, nat, conntrack — no port-forwarding / zones."""
-    attrs = set(WanServerDevice.__protocol_attrs__)
+    attrs = protocol_attrs(WanServerDevice)
     for present in ("packet_filter", "nat", "conntrack"):
         assert present in attrs
     for absent in ("port_forwarding", "firewall_zones"):
@@ -442,7 +441,7 @@ def test_wan_server_firewall_facets() -> None:
 
 def test_cpe_full_firewall_surface() -> None:
     """CpeDevice aggregates the complete firewall surface."""
-    attrs = set(CpeDevice.__protocol_attrs__)
+    attrs = protocol_attrs(CpeDevice)
     for present in ("firewall", "nat", "conntrack", "firewall_zones"):
         assert present in attrs
     # PortForwarding is no longer a separate attribute — it's bundled into firewall.
@@ -455,7 +454,12 @@ def test_cpe_full_firewall_surface() -> None:
 def test_devices_without_firewall() -> None:
     """These archetypes must not pull in any of the firewall capabilities."""
     firewall_attrs = (
-        "packet_filter", "firewall", "nat", "port_forwarding", "conntrack", "firewall_zones"
+        "packet_filter",
+        "firewall",
+        "nat",
+        "port_forwarding",
+        "conntrack",
+        "firewall_zones",
     )
     for archetype in (
         TftpDevice,
@@ -466,7 +470,7 @@ def test_devices_without_firewall() -> None:
         TrafficControllerDevice,
         IperfTrafficGeneratorDevice,
     ):
-        attrs = set(archetype.__protocol_attrs__)
+        attrs = protocol_attrs(archetype)
         for absent in firewall_attrs:
             assert absent not in attrs, f"{archetype.__name__} unexpectedly aggregates {absent}"
 
@@ -497,10 +501,10 @@ def test_archetype_inherits_base_device_protocol(archetype: type) -> None:
 @pytest.mark.parametrize("archetype", _ALL_ARCHETYPES, ids=lambda a: a.__name__)
 def test_archetype_carries_universal_identity(archetype: type) -> None:
     """Every archetype's protocol-attrs include device_name and device_type."""
-    attrs = set(archetype.__protocol_attrs__)
+    attrs = protocol_attrs(archetype)
     assert {"device_name", "device_type"} <= attrs, (
         f"{archetype.__name__} missing universal-identity attrs: "
-        f"{ {'device_name', 'device_type'} - attrs}"
+        f"{ {'device_name', 'device_type'} - attrs }"
     )
 
 
@@ -529,36 +533,57 @@ def test_l3_switch_routed_registered() -> None:
 
 def test_l3_switch_is_strict_superset_of_l2() -> None:
     # Protocol inheritance: every L3 attribute set includes the full L2 set.
-    l2_attrs = set(L2Switch.__protocol_attrs__)
-    l3_attrs = set(L3Switch.__protocol_attrs__)
+    l2_attrs = protocol_attrs(L2Switch)
+    l3_attrs = protocol_attrs(L3Switch)
     assert l2_attrs <= l3_attrs, f"L3Switch missing L2 attrs: {l2_attrs - l3_attrs}"
     expected_l3 = {
-        "routed_interfaces", "static_routes", "routing_read",
-        "ospf", "interface_dhcp", "gateway_redundancy",
+        "routed_interfaces",
+        "static_routes",
+        "routing_read",
+        "ospf",
+        "interface_dhcp",
+        "gateway_redundancy",
     }
     assert expected_l3 <= l3_attrs, f"missing: {expected_l3 - l3_attrs}"
     assert "bgp" not in l3_attrs, "bgp belongs only on L3SwitchRouted"
 
 
 def test_l3_switch_routed_adds_bgp() -> None:
-    attrs = set(L3SwitchRouted.__protocol_attrs__)
+    attrs = protocol_attrs(L3SwitchRouted)
     assert "bgp" in attrs
-    assert set(L3Switch.__protocol_attrs__) <= attrs  # still a superset of L3Switch
+    assert protocol_attrs(L3Switch) <= attrs  # still a superset of L3Switch
 
 
 def test_l2_switch_aggregates_expected_capabilities() -> None:
     expected = {
-        "switch_ports", "switch_vlans", "spanning_tree", "link_aggregation",
-        "port_poe", "port_security", "radius", "first_hop_security",
-        "storm_control", "switch_acl", "discovery", "mac_table",
-        "port_status", "switch_qos", "syslog", "ntp",
+        "switch_ports",
+        "switch_vlans",
+        "spanning_tree",
+        "link_aggregation",
+        "port_poe",
+        "port_security",
+        "radius",
+        "first_hop_security",
+        "storm_control",
+        "switch_acl",
+        "discovery",
+        "mac_table",
+        "port_status",
+        "switch_qos",
+        "syslog",
+        "ntp",
     }
-    actual = set(L2Switch.__protocol_attrs__)
+    actual = protocol_attrs(L2Switch)
     assert expected <= actual, f"missing: {expected - actual}"
     # host-substrate levers stay on the Linux twins, never on a managed switch
     for host_lever in (
-        "conntrack", "pcap", "ip_interface", "nat",
-        "packet_filter", "firewall_zones", "wan_admin",
+        "conntrack",
+        "pcap",
+        "ip_interface",
+        "nat",
+        "packet_filter",
+        "firewall_zones",
+        "wan_admin",
     ):
         assert host_lever not in actual, f"{host_lever} must not be on L2Switch"
 
@@ -570,19 +595,29 @@ def test_l3_switch_excludes_host_substrate_levers() -> None:
     Linux-host-shaped ``ip_interface``; firewall / NAT / conntrack belong on the
     CPE/router archetypes; wan_admin is a Linux-only forced link-down lever.
     """
-    actual = set(L3Switch.__protocol_attrs__)
+    actual = protocol_attrs(L3Switch)
     for host_lever in (
-        "conntrack", "pcap", "ip_interface", "nat",
-        "packet_filter", "firewall_zones", "wan_admin",
+        "conntrack",
+        "pcap",
+        "ip_interface",
+        "nat",
+        "packet_filter",
+        "firewall_zones",
+        "wan_admin",
     ):
         assert host_lever not in actual, f"{host_lever} must not be on L3Switch"
 
 
 def test_l3_switch_routed_excludes_host_substrate_levers() -> None:
     """L3SwitchRouted (the BGP-capable variant) likewise excludes host-substrate levers."""
-    actual = set(L3SwitchRouted.__protocol_attrs__)
+    actual = protocol_attrs(L3SwitchRouted)
     for host_lever in (
-        "conntrack", "pcap", "ip_interface", "nat",
-        "packet_filter", "firewall_zones", "wan_admin",
+        "conntrack",
+        "pcap",
+        "ip_interface",
+        "nat",
+        "packet_filter",
+        "firewall_zones",
+        "wan_admin",
     ):
         assert host_lever not in actual, f"{host_lever} must not be on L3SwitchRouted"