OpenPacketCore SDK Implementation Status Matrix

September 1, 2026 · View on GitHub

This document is a human-maintained cross-reference from RFC acceptance criteria to owning crates and cited tests. It records the scope reported by the dated snapshots below; it is not generated release evidence, a current CI result, or a production-readiness attestation. It does not by itself satisfy RFC 006's machine-readable, signed, candidate-specific evidence requirements. Architectural rationale for earlier hardening decisions is recorded in docs/adr/.

Legend

implemented — Code and automated tests exist for the stated criterion within the documented SDK/profile scope. This does not assert current CI status or production-deployment readiness.

partial — Core structures exist; behavior is incomplete or untested.

not-implemented — No code yet.

not-applicable — Requirement is outside this SDK/profile boundary.

gap — Tracked missing behavior with owner and mitigation.

closed — Historical task/gap label used by older rows. Closure is scoped to the named criterion or task and is not production approval.

Feature-profile note: Most workspace validation uses --all-features, which is a test-coverage profile and may enable experimental or test-only capabilities such as opc-persist/dangerous-test-hooks. Production readiness requires an explicit feature/deployment profile and candidate-specific validation of that profile. RuntimeMode::Production similarly selects fail-closed runtime configuration rules; it is not a crate-maturity or release-approval designation.

Historical foundation validation snapshot — T-9be95f92 (2026-05-30; updated 2026-06-07)

This snapshot records the foundation hardening validation after the concrete seam tasks T-a2ed9b0f, T-01342432, T-099afa77, the umbrella seam task T-bdfee7cb, the follow-on ConfigBus authorization seam, the June 6 SDK stability remediation pass for session TTL/profile/handover and runtime drain visibility, and the June 7 completion of Milestone 4 (Process-Level HA Test Harness & Verification) and Milestone 5 (Runbooks & Documentation). The operator-facing handoff is operator-readiness.md.

Validated gates for this pass:

cargo fmt --all --check
cargo clippy --workspace --all-targets -- -D warnings
cargo clippy --workspace --all-targets --all-features -- -D warnings
cargo test --workspace
cargo test --workspace --all-features

Note: The later T-8c57ecee final-hardening pass (see below) re-ran the workspace all-features tests as cargo test --workspace --exclude opc-persist --all-features -- --test-threads=4 plus cargo test -p opc-persist --all-features -- --test-threads=1.

The dated hardening tasks listed in this snapshot were closed within their stated SDK/library scopes. This matrix does not establish that every current P0 production-readiness blocker is closed: the registry below is a historical RFC gap ledger, has no P0 classification, and includes partial, experimental, and deployment-owned boundaries.

An implemented entry means that the cited SDK behavior and tests exist within the stated scope. A production-profile claim additionally requires the target feature set, external adapters, privileged/kernel validation, release-evidence policy, downstream integration, and deployment acceptance gates to pass. Single-node SQLite-backed config/session profiles remain development, lab, conformance, or explicitly accepted single-replica profiles and must not be used to claim HA or active-active readiness.

The RFC 009 controller helper gaps, including machine-readable Operator/NF/version compatibility policy enforcement (GAP-009-001), are closed as reusable SDK crates. The Go SDK reference operator harness (operators/sdk-reference-operator) has been added to prove that the SDK's lifecycle contracts and policy rules can be cleanly consumed by Go controller-runtime operators. This harness implements Kubernetes reference plumbing, including CRDs, validating and conversion webhook registration, status conditions, Kustomize manifests, a Go-to-Rust JSON CLI bridge, and fake-client controller/webhook tests, closing the plumbing gap (GAP-K8S-001 and GAP-K8S-002) in a reference capacity. Production CNF operators must still build their own product-specific operators using these SDK contracts, package the Rust operator-lifecycle-cli beside the Go manager, and run their own envtest, kind, and cluster end-to-end suites. (Note: GAP-008-002, GAP-011-003 through GAP-011-007, and GAP-012-001 through GAP-012-004 are fully closed as SDK foundation gaps).

Current authoritative route-steering collection foundation — 2026-07-19

opc-route-steering implements the SDK portion of issue #381 as an additive collection contract alongside the existing singleton and legacy APIs. OwnedRouteRuleScope declares one exclusive writer's address family, route/rule table, route output interface and canonical metric, and rule priority. OwnedRouteRuleSet validates the complete desired state, and OwnedRouteRuleSnapshot exposes a bounded, deterministic enumeration of all representable protocol-242 objects in that scope. The separate owned_route_rule_collection capability prevents callers from inferring this stronger contract from legacy mutation, typed singleton readback, or paired convergence support. For Linux it means the implementation is present and a fail-closed, self-verifying attempt is permitted; it is not positive FRA_PROTOCOL retention evidence. LinuxRuleProtocolCapability::Unknown and ExpectedByKernelVersion permit fresh-namespace bootstrap, while only Confirmed attests a tag read back from the kernel and cached rejection or discard disables subsequent attempts. Requiring Confirmed before the first reconcile would deadlock an empty namespace with no resident marker to observe. Third-party trait implementations retain fail-closed defaults until they implement the collection contract explicitly. Desired and final collections admit at most 50,000 routes and 50,000 rules each; the install-before-delete old∪new intermediate has a distinct ceiling of 100,000 routes and 100,000 rules. Reconciliation's initial recovery snapshot also accepts the transient ceiling so a restart can garbage-collect an interrupted old∪new residual above the final bound; public and successful final snapshots retain the lower ceiling.

Within an owned collection, rules may intentionally share one family and priority only when every sibling is a source-only, non-wildcard selector and the prefixes are provably disjoint. Overlap, exact duplicates, destination or firewall-mark siblings, wildcard selectors, foreign collisions, ownership- tagged objects that cannot be represented, and ambiguous resident state fail closed before destructive cleanup. This preserves the conservative singleton contract except for one narrow Linux-only singleton readback/removal exception: stock, protocol-242-owned, same-table, source-only rules with provably disjoint non-/0 source prefixes may coexist as siblings. Linux then proves the exact target absent after deletion while preserving those siblings; it does not claim the entire broad family/priority key is absent. Every other sibling, including malformed, unknown, unrepresentable, foreign, overlapping, wildcard, destination-qualified, or firewall-mark-qualified state remains fail-closed rather than being excluded from the broad collision key. Collection reconciliation remains the authoritative complete-set path for siblings.

Linux and mock reconciliation perform one authoritative workflow serialized among clones of the same backend: validate a complete bounded resident snapshot and complete desired set, install and verify every missing desired route and rule, remove stale rules before stale routes, and verify a final exact snapshot. An incomplete, over-limit, malformed, or changing snapshot never proves absence. Known attempt-owned installs are the only rollback targets; partial or uncertain completion is returned as typed redaction-safe ReconcileIncomplete phase/count evidence so the caller can retry the complete desired set. When attempted cleanup is itself incomplete, that result also retains a separate typed rollback-failure classification. This workflow is deliberately not described as kernel-atomic because it spans multiple netlink mutations. Separate backend instances require external serialization. Each Linux snapshot uses one complete route dump and one complete rule dump under the separate LinuxOwnedRouteRuleCollectionLimits; the defaults allow at most 65,535 datagrams, 131,072 decoded messages, and 64 MiB of aggregate reply bytes for each dump. The collection path does not repeat a full dump for every desired member or weaken the established singleton limits.

Linux mutation progress is ACK-exact: only one matching zero-error NLMSG_ERROR ACK completes a requested mutation. Empty and NOOP-only datagrams keep waiting, while DONE, arbitrary payload messages, duplicate ACKs, malformed replies, and timeout fail closed. ACK uncertainty is therefore reported as incomplete progress rather than counted as an acknowledged change.

Default-limit synthetic Linux gates classify 50,000 owned routes plus 50,000 source-disjoint, same-priority owned rules returned by exactly one AF_UNSPEC route-dump request and one AF_UNSPEC rule-dump request, and separately pass 50,000 multipart messages through the production byte/datagram/message accounting parser. This is bounded enumeration/parser evidence, not evidence for 50,000 kernel installs/deletes, end-to-end reconciliation throughput, or kernel-atomic application.

Complete protocol-tagged enumeration allows a restarted writer to garbage- collect stale routes and rules even after process-local attempt history has been lost. Product code must durably reconstruct the authoritative desired set before invoking reconciliation; the SDK does not persist intent. Protocol 242 is still only a namespace-local reservation, not authentication, so safe cleanup depends on one orchestrated exclusive writer for each declared scope and external coordination for overlapping scopes or deliberate marker reuse. Legacy static routes, untagged rules, and their existing migration requirements remain unchanged. Scripted Linux tests cover same-priority sibling install, exact retry, and targeted removal; foreign conflict and cross-set prefix-overlap rejection without mutation, including an exact retry; marker omission/substitution rollback preserving owned state; IPv6 reconciliation; cancellation-safe completion behind the clone-shared lock; retained-state restart reconciliation that installs the desired route/rule before deleting the orphan rule and then orphan route; recovery from a resident transient set above a configured final limit; applied route and rule creates with lost ACKs plus rollback ACK loss; production multipart accounting; and the bounded 50,000-route/50,000-rule two-dump enumeration above. Mock tests provide collection parity, including full 50,002-rule transient-union replacement and restart recovery, without per-key reads. Neither the synthetic parser gate nor the mock evidence qualifies kernel mutation/reconciliation throughput or atomicity. Privileged isolated-namespace qualification remains consuming-release evidence.

Current conflict-safe route-steering foundation — 2026-07-18

opc-route-steering and opc-linux-route-sys implement the SDK portion of issue #371. Backend-neutral route/rule readback and convergence now distinguish installed, exact resident, conflicting, and indeterminate state. Linux uses bounded, strict multipart route/rule dumps and compares every request field plus the fixed kernel semantics emitted by the adapter; malformed, truncated, oversized, unsupported, or unrepresented colliding state fails closed. The parser handles Linux's extended-table dump marker and bounded non-identity IPv6 route metadata, while nonzero cache expiry/error fails closed. Route metrics follow kernel family semantics (None/zero is absent for IPv4 and effective 1024 for IPv6), and route destinations use the effective network address after clearing IPv4/IPv6 host bits. Rule selectors are not canonicalized. Conflict-safe Linux routes and rules carry the reserved nonzero LINUX_ROUTE_STEERING_PROTOCOL; missing, legacy, or other values are foreign conflicts. The original mutation API remains wire-compatible (RTPROT_STATIC routes with exact caller destination bytes and untagged rules) and accepts IPv4/IPv6 /0 selectors and mark zero. Only convergence and explicit remove_converged_* reject those wildcard-unsafe rule shapes. Typed capability flags distinguish the legacy and conflict-safe contracts. The bounded multimap mock covers multiple candidates, exact-plus-conflict, foreign ownership, and the same metric normalization while keeping legacy MockOperation exhaustive matches source-compatible. External backends can construct typed conflicts through public nonzero-count constructors. Isolated-namespace tests exercise IPv4/IPv6 default metrics, multiple route/rule candidates, exact-plus-conflict, external protocol and zero-mark preservation, exact retry/removal, pair rollback, clone serialization, and cancellation against the running kernel.

Paired convergence owns only objects installed by that same attempt. Exact removal requires one uniquely owned candidate before delete and absence after; ambiguity refuses deletion. Plain upstream pre-4.17 kernels fail before rule convergence mutation; older vendor/custom versions remain unknown because they may backport FRA_PROTOCOL. Every allowed create is read back, and an ACKed rule whose marker was silently discarded is removed through the serialized attempt-owned rollback path before the capability is cached unsupported. This uses no global probe rule. Validated IPv4 creates rejected with an unsupported-attribute kernel error become separate cached typed evidence only before positive tagged readback and cannot leak state. Confirmed capability is monotonic: later generic IPv4 errors and non-IPv4 family/operation failures keep their original typed result, do not poison capability state, and do not block a subsequent attempt. One clone-shared lock is acquired inside the blocking worker and held through an entire pair and rollback even when the async waiter is cancelled. This prevents sibling clones from interleaving, but the protocol value is a namespace-local reservation rather than authentication. Separate backend instances and external writers must be coordinated under one authority. This is an implemented SDK safety contract, not a production route-policy or kernel qualification claim. Products still own table/priority allocation, network namespaces, CNI coexistence, external ownership records for intentional stale-state replacement, privileged kernel-version evidence, BGP policy for convergence route protocol 242, and traffic-readiness policy. Pre-upgrade static state is never silently adopted; known-provenance legacy cleanup is an operator/product migration step.

Current dedicated-bearer shared protocol foundation — 2026-07-15

opc-proto-tft now owns the canonical product-neutral TS 24.008 V18.8.0 TFT value model shared by GTPv2-C and IKEv2. Its complete standalone codec scope includes every defined operation, E-bit and parameter form, all twenty Release 18 packet-filter components, TS 23.060 combination validation, bounded strict decode, structured redaction-safe errors, deterministic encode, unknown parameter preservation, specification-authored fixtures, property/negative tests, stable corpus replay, and registered decode/round-trip fuzz targets. See crates/opc-proto-tft/CONFORMANCE.md.

opc-proto-gtpv2c now consumes that canonical model for strict S2b Create, Update, and Delete Bearer Request/Response procedures. The GTP boundary covers mandatory and conditional IE instances, Create-new/uplink TFT semantics, typed Bearer QoS/ARP and standardized QCI rate rules, APN-AMBR and multi-context Update changes, S2b-U F-TEID roles, partial results, exact response correlation, Message Priority propagation, bounded ordered request-only Load/Overload/PGW Change control IEs, precise TS 29.274 TFT syntax/semantic rejection Causes, specification-authored fixtures, and bounded generation-safe triggered transaction replay. A timed-out application side effect remains fenced behind an explicit cancellation acknowledgement instead of becoming eligible for accidental redispatch.

This closes the shared TFT model and the declared GTPv2-C dedicated-bearer protocol/transaction portion. It does not claim completion of the consuming IKEv2 multiple-bearer and Child-SA lifecycle work, or any product policy/dataplane behavior.

Current external routing-stack prefix-intent foundation — 2026-07-20

opc-ipsec-lb implements the SDK portion of issue #309. PrefixAdvertiserService accepts bounded exact /32 and /128 sets grouped by opaque routing domain, enforces injected-clock leases and monotonic generations, serializes cancellation-safe adapter mutations, and publishes typed, redaction-safe peer-session, prefix, and routing-stack-reported BFD events. Startup must establish known absence across both configured domains and bounded durable state left by removed domains before an advertisement is admitted. A bounded priority scheduler coalesces queued domain intent, gives withdrawals priority, and batches simultaneous expiry so the lease bound does not scale with routing-domain count. Failed cleanup quarantines the complete bounded possibly-affected prefix union as unconfirmed until exact absence.

The production adapter uses BIRD 2's documented control socket rather than implementing BGP or BFD. It renders atomic exact-set fragments, classifies configure refusal separately from ambiguous completion, reads back originated routes and each established peer's exact local Adj-RIB-Out, and removes any rejected subset from durable intent. Local export evidence is not represented as proof that the remote peer installed a route. Withdrawal keeps durable intent absent while boundedly confirming queued configuration; refusal, ambiguity, timeout, or surviving protocol state fail-stops owned BIRD. Fragment storage uses a private owned descriptor-pinned directory with no-follow reads, exclusive unpredictable temporary files, and descriptor-relative inventory, rename, and removal. The complete canonical owned namespace is validated and durably cleared before child launch. A small SDK helper owns foreground BIRD under a versioned nonce handshake, expected-parent check, dedicated parent thread, and Linux parent-death signal. The lifecycle admission cannot be constructed by a caller; helper or BIRD exit withdraws local mutation readiness, requests fail-stop termination, and retains the child until kernel wait status is available. The configured shutdown wait is not presented as a reap deadline or an upstream route-withdrawal claim. Executables that can clear the parent-death contract through set-ID or file capabilities are rejected. Helper, BIRD, main-config, control-socket, and fragment authorities are descriptor-pinned; the BIRD adapter caps exact export polling to 32 peer protocols in one bounded concurrent wave.

Deterministic fake, hostile control-socket, cancellation, clock, durable-drift, and local process-death tests cover the generic boundary. An explicitly ignored, operator-invoked BIRD 2 integration test proves exact advertisement/readback, session-state relay, ambiguous reconfiguration retry, and exact withdrawal using documentation prefixes and private ASNs. The SDK does not select peers, ASNs, BGP/BFD policy or timers, decide application health, program forwarding, or claim an upstream withdrawal bound without real peer/BFD evidence. Its private locked socket namespace can remove only a proven-dead owned stale socket after an unclean process exit.

Current durable multi-SA re-pin and applied ESP counter foundation — 2026-07-21

opc-ipsec-lb now implements the SDK portion of issue #365. SessionRePinPlan binds one privacy-preserving session ID and one operation ID to a canonical bounded IKE/default-ESP/dedicated-ESP order and each complete RePinRequest fingerprint. SessionRePinCoordinator composes the existing single-SA ownership-fence, audit, and idempotent steering boundary with a monotonic durable journal. A completed-fence prefix and any current post-commit fence are recorded before whole-session success can escape. Restart reloads the complete exact requests only for the caller's retained operation-plus-plan identity and uses authoritative grant recovery; it never mints a replacement transition, rolls ownership back, or falls through to birth/upsert. Every later operation must also name the exact terminal predecessor plan fingerprint, so a delayed retry of an older completed operation cannot replace the newest durable restart/status authority. Successor admission rejects reuse of either the predecessor operation ID or any predecessor per-SA transition ID and leaves that predecessor intact. Resume and status take a redaction-safe SessionRePinIdentity containing both operation ID and whole-plan fingerprint, so stale callers cannot observe or drive the successor.

Before advancing another SA and before terminal success, the coordinator first idempotently repairs steering across the entire completed prefix. It then starts a separate global mutation-free sweep of every owner, fence, transition ID, complete request fingerprint, retry proof, and target shard owner. Monotonic non-ABA fences make a successful second sweep the prefix linearization point. A supported direct per-SA transition that displaces an earlier entry while a later repair waits therefore fails closed before a later mutation. Every activation acquires an exact non-cloneable RePinSteeringBackend permit before its final reads and retains it through the ownership CAS and Host publication. Host-XDP binds the permit to its backend, canonical ownership key, and fixed operation stripe; the private update separately binds target owner and authoritative generation. Host-XDP destination-scoped mode has no legacy raw SteeringBackend mutation path; downstream adapters that bypass the permit remain explicitly outside the contract because they can drift without advancing an ownership fence. The first owner record for an SA this node negotiated itself is published through RePinCoordinator::activate and the OwnershipActivationAuthority port, not through install_owner, which stays rejected in this mode. That boundary takes no predecessor owner, predecessor fence, or resume evidence, because a first activation has none; it mints the generation from the session store's own per-key monotonic fence and refuses a record that is absent, retiring, or held by a different owner or transition. RePinCoordinator::retire_activation is the paired teardown for an activation that never re-pinned. Because the store retains a key's fence floor across the fenced delete, a completed retirement can never be undone by a replay: absence from the eBPF maps and from the record set is not treated as evidence that a key was never activated. Its ABI v5 datapath requires an exact non-zero generation match between the destination-scoped IPSEC_LB_OWNERS entry and IPSEC_LB_KEY_FENCES entry. Activation clears the keyed fence, stages and reads back the owner while it is stale, and performs the keyed-fence write/readback last. Retirement advances durable authority before removing and reading back both entries. Ambiguous cleanup triggers a per-key stale cut, CONFIG removal, and detach; a detached backend is mutation-ready again only if fresh pins are also proven feasible.

Successful start or resume proves one whole-prefix convergence point during that invocation. It is not an ownership or steering lease and does not guarantee that the validated state remains current when the future returns or afterward: a later supported transition may advance a fence after validation. Consumers must serialize subsequent transitions and use current fenced authority at each action boundary. status() exposes durable journal progress without rerunning convergence validation; it is not live ownership or steering authority.

The production journal adapter uses the existing session-store lease/CAS authority, bounded v3 Active payload envelope, tenant/NF/session key scope, and AuthoritativeSession record profile. Competing plans cannot replace active progress, while identical helpers converge idempotently. With the normal EncryptingSessionBackend over the quorum store, exact request metadata is sealed before persistence and follows the existing HKMS/KMS rotation path; no second encryption or consensus implementation was added. Startup and every read/write validate the complete lease/CAS authority capability set and fixed checkpoint budget, so a downgraded backend cannot replay terminal success. The journal persists the key-free OutboundSaBindingId, not live InstalledOutboundSaBinding, receipt, target, namespace-actor identity, or SA key material. The existing HKMS API, wrapping and rotation behavior, and encrypted-at-rest boundary are unchanged.

After quiescing product transitions and removing product-owned IKE/XFRM SAs, keys, and other dataplane objects, a consumer can call only the typed SessionRePinCoordinator::retire boundary with the exact terminal session and operation-plus-plan identity. The low-level journal exposes no direct Active-to-retired-tombstone completion operation; its granular transition and progress methods are proof-gated recovery primitives, not a supported teardown shortcut. While the session is still Active, the coordinator acquires the complete bounded Host operation batch, rechecks every exact ownership grant, and writes non-expiring v4 Retiring progress. It then advances each ownership record to a higher retirement fence, removes and reads back the exact Host owner and keyed fence, durably records CleanupComplete, and only then fenced-deletes ownership. A strictly newer different lineage is recorded as finalized Superseded without Host mutation; same-lineage and unbound states fail closed.

Only fully finalized v4 progress becomes the encrypted fenced-CAS v2 tombstone. Exact retries are idempotent across lost acknowledgements, cancellation, and restart; the admitted worker is owned so cancellation cannot abandon a CAS, Host cleanup, or marker write. Activation and retirement share fixed keyed Host operation stripes; an indeterminate authority outcome poisons its stripe and makes re-pin readiness false until restart. Prepared/forward progress, stale predecessors, stale successors, and concurrent losing generations conflict without discarding known ownership progress. The v2 payload binds retired_at and expires_at; record expiry must match it exactly and the interval must equal the fixed seven-day SESSION_REPIN_RETIREMENT_RETENTION. Decoder dispatch accepts only exact Active v3, Retiring v4, and Retired v2 envelopes and rejects unknown versions and fields instead of interpreting another shape.

There is intentionally no unsafe Active-v1-to-v3 conversion. The old v1 numeric/SPI-only checkpoint does not contain the destination, outbound binding, or live actor proof now required by issue #333, so it fails closed. Operators must drain or complete an Active v1 transition on the old SDK before upgrade, or rekey and begin a fresh v3 transition. Exact Retired v2 tombstones remain valid and continue fencing stale retries; they are not interpreted as Active state.

Tombstone storage is bounded by retirement rate over seven days and is cleaned through the session store's already-required per-key TTL capability. Stale recreation is prevented exactly during that horizon. After cleanup, callers must rely on the documented outer invariant: privacy-safe logical-session IDs are never reused and all teardown retries expire before the tombstone. The tombstone uses the existing private tenant/NF/session key and EncryptingSessionBackend, so the configured encryption-at-rest and HKMS/KMS rotation boundary is unchanged.

Tests cover failures before ownership, immediately after commit, during steering, and at all three audit positions for every SA position; restart from prepared, committed, completed-prefix, and terminal stages; exact-helper races; foreign-plan rejection; successor identity reuse; stale resume/status identities; completed-prefix owner/fence/transition/fingerprint and steering conflicts; direct single-SA displacement; deterministic earlier/later repair interleavings on both mock and session-store journals; cancellation at the session cut, Host cleanup, and marker write; activation/retirement ordering; every Host partial-cleanup acknowledgement cut; foreign Host state with zero mutation; malformed or missing ambiguous ownership readback and Host-stripe poisoning; more than 65,536 activation/retirement cycles returning both Host maps to baseline while the store fence floor survives deletion; v4 maximum-plan CleanupComplete/Superseded restart and tamper rejection; lost-acknowledgement restart; exact v2 tombstone TTL cleanup; encrypted raw storage; and redaction.

This is an SDK recovery foundation, not a product continuity attestation. The consumer remains responsible for enumerating the complete live SA set, privacy-safe session-ID derivation, operation/transition-ID generation, key custody, retry and operator-quarantine policy, and dataplane qualification. For counter-based ESP transitions, issue #333 (including the Host-XDP keyed-fence regression tracked by issue #444) is implemented by the public InstalledOutboundSaBinding flow. A fully acknowledged, exact-readback, committed outbound SA/policy install issues the constructor-private live binding and its key-free durable ID. The namespace actor accepts that binding, the same ID, and EspCounterResumeApplyRequest, advances only through Linux XFRM_MSG_NEWAE, then returns an opaque AppliedEspCounterReceipt. The caller independently derives the process-local OutboundEspCounterTarget from the same installed binding. RePinRequest::new_esp carries the ID; the coordinator receives the receipt and live target, rejecting numeric resume fields alone.

Linux exposes the last-assigned outbound sequence, so fresh proof requires oseq + 1 == next and rejects zero, wrap, non-ESN, ambiguous bitmap, foreign, absent, or indeterminate state. The actor revalidates that exact next value at the ownership boundary and again under a short-lived guard at the first publication boundary. Host-XDP consumes the guard around its synchronous keyed-fence-last cut. Other RePinSteeringBackend implementations must call RePinSteeringOperationPermit::publish_with_esp_counter_guard at their exact synchronous externally visible cut and return the permit; the legacy SPI-only adapter rejects this guarded ESP path. Already-committed restart recovery uses the distinct read-only recover_committed_outbound_esp_counter boundary and may issue proof only for a value at or above the durable floor. Later proof checks also reject rollback below the observed issuance watermark; committed recovery cannot authorize a new fence.

The session journal stores neither receipts, live targets, bindings, actor identity, nor key material. A consumer builds bounded receipt and target sets before start; after restart it recovers the live installed binding by exact kernel readback, reapplies uncommitted entries, and uses committed recovery only for an exact v3 ownership grant already known committed. IKE counters remain product-owned. Privileged tests cover the exact first emitted sequence, cross-namespace rejection, destination-scoped v5 packet verdicts, and fence-last activation/retirement containment.

Current authenticated ingress-redirect foundation — 2026-07-18

opc-ipsec-lb now implements the SDK portion of issue #307: a versioned, authenticated cross-node redirect boundary for already-observed IKE/ESP packets. Fresh SPIFFE mTLS handshakes authenticate an exact peer manifest and derive directional AES-256-GCM (default) or explicit HMAC-SHA-256 packet keys through a dedicated exporter context. The data format contains canonical destination ownership and public fencing metadata but no SA keys. Strict framing, mode binding, sender binding, replay windows, hop bounds, routing-domain admission, exact MTU accounting, bounded packet/byte queues, typed receipts, exact-datagram retries, committed receipt replay, mandatory packet-too-big feedback, hard authentication lifetimes, and bounded AES-GCM usage fail closed. Raw authenticated frames and cryptographic open/seal methods are crate-private. A peer session is permanently consumed by one endpoint; a fresh mTLS session is required after shutdown or failure.

The receiver's only delivery authority is a fresh FencedOwnershipCache lookup plus exact packet reclassification, repeated at application dequeue. Endpoint-owned operation handles distinguish proven-not-sent, authenticated receipt, and unknown-delivery outcomes without making task cancellation an implicit transport cancellation. Receipt-cache admission never evicts a live entry: its authenticated capacity is reserved before cryptographic open, and saturation or commit failure sends no uncached receipt and publishes no effect. Committed entries expire at the retry horizon or either participating epoch, while queued delivery capabilities retain their independent epoch lifetime. Admission, materialization, stale capability, cache saturation, commit failure, and current/peak cache occupancy have separate metrics. Forwardable outcomes are opaque, one-shot capabilities rather than public packet containers. Graceful shutdown drains admitted operations and remains cancellation-safe; terminal receive failure resolves pending work. Every detached task uses the runtime captured at endpoint start, and packet-too-big work consumes the same bounded queue and absolute deadline as ordinary sends.

Tests cover delivery, dequeue-time ownership invalidation, fresh non-owner forwarding, superseded and receiver-ahead generation evidence, stale committed views, terminal classification mismatch, cryptographic tamper before queue admission, two-node forwarding cycles, maximum MTU packets, non-evicting cache pressure and progress after expiry, exact cached rejection replay, commit failure with no effect, queued delivery beyond receipt expiry, queue saturation/closure, receipt loss/replay/expiry, dropped operation observers, outside-runtime operation starts, checked lifecycle-counter overflow, every adapter-send error, hung sends/reporters, bounded oversize feedback, absolute PTB deadlines, authenticated malformed exact-length frames, UDP truncation, Linux IPv4/IPv6 DO path-MTU socket policy, transient PMTU refresh failure, runtime PMTU shrink, cancellation-safe shutdown, committed-queue drain, generation-before-owner precedence, AES-GCM data/receipt shared budgets, peer-open and failed-authentication caps, RFC 4231 HMAC-SHA-256 vectors, and redaction. Control tests cover canonical peer negotiation, full mTLS exporter establishment and rotation, serialized lifecycle operations, live-previous and expired-pending handling, every logical two-phase failure boundary, cancellation before every initial-establishment await, final authentication expiry, ambiguous-outcome retention, reconciliation selection, and compile-time Send assertions for every public async control operation. The integration evidence rotates independent CA/leaf material A to B through overlapping trust and mixed endpoint epochs while sending bidirectional traffic in crates/opc-ipsec-lb/tests/ingress_redirect_tls.rs; wire, crypto, ownership, and transport evidence is colocated under redirect::{tests,control::tests,transport::tests} and opc-ipsec-lb-ebpf-common.

This is an implemented SDK foundation, not production-deployment attestation. Credential issuance and revocation, peer membership, Kubernetes/CNI reachability, routing/BGP/VIP failover, packet capture/redirect attachment, ICMP policy, application ingress reinjection, and candidate-specific fault/performance qualification remain product and deployment responsibilities.

Current typed GTP-U control-codec foundation — 2026-07-19

opc-proto-gtpu now models the TS 29.281 Release 18 codec boundary for Echo Request/Response, Recovery, Error Indication, Supported Extension Headers Notification, and End Marker. The typed decoder enforces message flags and TEIDs, mandatory/singleton IE cardinality, ascending IE order, exact fixed and TLV lengths, IPv4/IPv6 peer-address widths, unique supported-header lists (including the specification-permitted empty list), and configured message/IE limits. Recovery and receiver-ignored sequence values are not promoted into application state; canonical Echo Response always emits Recovery=0. Unknown TLVs follow the shared preserve/drop/reject policy, while unknown TV IEs fail closed because there is no safe length boundary. TEIDs, peer addresses, private/unknown values, and raw extension data are redacted from typed diagnostics.

Extension-header types expose all four endpoint/intermediate comprehension classes. Unsupported endpoint-required types produce a typed, value-free failure that a downstream bounded notification planner can consume; optional unknown types remain structurally skippable and raw-preserved. Standardized G-PDU-only types are rejected as procedure-inapplicable even when their comprehension bits are optional. The Error Indication model also covers its optional four-octet UDP Port extension. The shared PDU Session Container model is explicitly the QFI/PPI/RQI base subset and rejects reserved PDU types or presence flags requiring unmodelled conditional fields. Its public encoding and typed builders also reject oversized or direction-incompatible caller models; semantic decode failures retain a stable reason and offending extension offset. Adding an applicable UDP Port or PDU container preserves unrelated optional unknown headers from a decoded chain. Typed End Marker canonical encoding rebuilds its PDU Session Container from the typed value, clears permitted spare bits, and places it first while retaining unrelated optional unknown headers in relative order; generic raw-preserving encoding remains byte-exact. Tunnel Status remains outside this codec slice.

This is only the codec slice of #341. Backend-neutral control datagram receive/send ports, local/remote tuple metadata, Linux/eBPF integration, admission and amplification limits, live unknown-TEID response behavior, End Marker ordering, and cross-backend tests remain open. This section therefore does not close #341 or make a production dataplane claim.

Current conflict-safe GTP-U reconciliation foundation — 2026-07-18

opc-gtpu-dataplane now exposes an additive backend-neutral PDP-context reconciliation contract. Typed selectors cover the local TEID and uplink (UE PAA, optional bearer mark) axes; typed readback returns complete context identity. Classified install distinguishes new, exact-present, conflict, and indeterminate outcomes after inspecting both axes. Conflict diagnostics retain only axis occupancy and mismatch field names. Exact stale removal is a separate capability and operation; no API claims atomic replacement or hides the bounded forwarding gap between an owned stale removal and desired install. Existing third-party backends inherit typed unsupported defaults and can construct redaction-safe conflicts through the public validated API.

The eBPF implementation reconstructs only complete default or marked FAR/PDR/endpoint-binding/DSCP/active-owner graphs while holding its reconciler lease and exact program/map identities. A host-only default UE-to-TEID index is transactionally maintained and rebuilt from validated v3 pins, without a datapath map or schema revision. Restart adoption, both selector-collision shapes, exact default/marked retry and removal, transitional owners, one-sided graphs, map/index corruption, identity loss, cancellation retry, and a second reconciler all fail closed or converge through authoritative readback.

The Linux implementation performs response-required GETPDP queries twice for each selector, binds the outer generic-netlink family identity, strictly decodes the independently typed MS/PAA and peer attributes, and handles the kernel's historical family-ID command quirk. GTPA_FAMILY applies only to the MS/PAA; the peer follows the GTP socket and may use the other IP family. Family omission is inferred only from one unambiguous MS/PAA attribute, while the independently required peer attribute remains part of the complete identity. Unsupported family behavior is not absence. NEWPDP success, EEXIST, and ACK-uncertain errors are followed by full classification. Mainline DELPDP is unconditional and there is no cross-process writer lease, so exact removal is explicitly unavailable. The stateful mock provides parity and corrupt/transitional/changing evidence injection through a separate typed log that preserves the externally exhaustive legacy operation enum.

Unit and external-API tests cover the complete contract and hostile netlink responses. Ignored fresh-network-namespace tests exercise actual Linux GETPDP exact retry and eBPF pinned-state adoption where the host exposes the required kernel, BPF, bpffs, and capability support. This is reusable SDK reconciliation behavior, not ownership policy, drain orchestration, route/XFRM sequencing, or deployment qualification.

Current eBPF GTP-U endpoint-binding foundation — 2026-07-18

opc-gtpu-dataplane now binds every eBPF downlink PDR to a canonical outer peer/local pair, address family, exact ingress attachment, and explicit bounded UDP source-port policy. The shared no-std schema covers IPv4/IPv6 semantics and fixed redaction-safe encodings. The frozen legacy single-context graph remains IPv4-only; the additive current grouped tc path supports independently selected inner and outer IPv4/IPv6 families, including simultaneous inner IPv4 and IPv6 entries. Ingress retains its full envelope and checksum validation, then requires the binding before inspecting or delivering the inner packet. Missing, non-canonical, wrong-family, wrong-peer, wrong-local, wrong-interface, and wrong-port state fails closed through six fixed aggregate reason counters.

The host reconciler includes endpoint identity in fresh publication, exact default and marked peer relocation, rollback, marked owner phases, removal, restart adoption, live-map/program snapshots, and readiness probing. One atomic binding replacement is the default-bearer authorization cutover; marked bearers require the live binding and Active owner journal to agree exactly. Persisted graph validation rejects partial, stale, duplicate, or unowned state before accepting either tc hook. Endpoint-unbound populated state is never upgraded by assumption: committed v2 pins require drain/reprovision, and older populated graphs fail closed rather than acquiring an implicit Any policy.

Unit evidence covers canonical IPv4/IPv6 models, corrupt encodings, every source-port policy, redaction, graph adoption, failure injection at relocation cutovers, and rollback authorization. The ignored privileged proof loads the committed object in a fresh network namespace and exercises correct forwarding, all six live mismatch classes, restored forwarding, exact program/map identity, restart adoption, and endpoint-unbound legacy rejection. This is implemented SDK behavior, not a product traffic-readiness attestation. Consumers must gate on GtpuProbe::downlink_endpoint_binding; peer discovery, site port policy, routing, XFRM, CNI attachment, operational drain, and deployment qualification remain downstream responsibilities.

Current-schema orphaned GTP-U eBPF graph recovery — 2026-07-21

opc-gtpu-dataplane exposes a typed maintenance operation for recovering a current-schema graph left in node-persistent bpffs after its process and old interface namespace are gone. Its authority is the canonical configured pin root plus validated pin-namespace leaf, not an old or replacement ifindex. A permanent bpffs control-directory inode and nonblocking exclusive flock serialize cooperating SDK processes across network namespaces. Replacement interface identity and both configured tc slots are validated separately; a finalizer may omit the replacement only when product orchestration has removed both namespaces.

The implementation requires an explicit previous-writer-stopped attestation. Populated forwarding state additionally requires a separate sessions-and- traffic-drained attestation. Before proof publication it validates the exact 21 current map names, ABIs, schema marker, configuration, PMTU state, and IDs, loads and identifies both committed current classifier artifacts against those maps, drops those temporary programs, then completely enumerates loaded BPF program map references. An exact current program is classified as a live owner; a foreign or subset reference is an identity conflict; unavailable program map-ID evidence is indeterminate. No program tied to a visible replacement hook or an inaccessible old namespace can be treated as absent merely because the old interface name is unreachable.

The durable cleanup proof binds the pin-namespace hash, graph filesystem device/inode, all exact map IDs, populated-state authorization, and its own kernel map ID. Normal current create/adopt rejects the reserved proof. Cleanup holds every surviving map and proof FD, removes the proof last, and restores the exact same IDs on ordinary map, proof, or final directory-removal failure. Those recoverable post-commit failures return typed Partial progress; an unrestorable proof never permits map republishing. A process crash retains proof-backed retry authority; repeated recovery returns typed AlreadyAbsent after terminal cleanup. Refusal before proof publication does not remove any graph pin. Redaction-safe typed outcomes distinguish active owner, managed attachment, replacement identity change, non-current schema, populated state, foreign identity, indeterminate evidence, committed partial progress, removal, and absence.

Unit evidence covers different replacement ifindexes, live and concurrent owners, foreign/schema conflicts, drain gating, precommit proof failure, ordinary cleanup rollback, interruption/resume, request redaction, committed replacement disappearance/rename/reindex and managed-conflict retries, and idempotency. An ignored privileged fresh-netns test provisions the real current artifact, first proves the held lease fences recovery, then drops that lease while retaining the old interface and proves the surviving loaded programs' map references still return ActiveOwner. It deletes the old interface, creates a different-ifindex replacement, removes the exact orphan graph, and observes AlreadyAbsent on retry. This is SDK graph-ownership and cleanup evidence, not product proof that a writer or traffic was drained. Writer shutdown, session/traffic drain, out-of-band privileged-writer exclusion, finalizer scheduling, and deployment qualification remain downstream.

Current drained eBPF v2 teardown foundation — 2026-07-19

opc-gtpu-dataplane now exposes a maintenance-only, backend-neutral request and typed outcome for removing a positively identified, drained endpoint-unbound v2 eBPF graph before endpoint-bound v3 reprovisioning. The eBPF implementation requires an explicit product-owned sessions-and-traffic drain attestation and exact interface name/index, then independently acquires the normal reconciler lease, requires both exact legacy hooks and their complete program-to-map binding before the first proof, rejects same-name extras and cross-direction legacy SDK names across complete ingress/egress dumps, and proves empty forwarding/session maps. The same two hook-wide scans run on every proof-backed retry before mutation. Hook absence is accepted only on a proof-backed retry. Normal startup and adoption still reject committed v2 state and any proof-only interrupted teardown state.

Before mutation, the implementation commits a durable kernel-pinned proof of the exact interface, hook program IDs/live tags, nine map IDs, and the proof map's own kernel ID. Proof retries revalidate the full proof-map ABI, its self-ID, and both directional tags against the frozen artifact. Both hooks are detached with exact readback; every surviving pin is re-opened and checked for recorded identity and ABI, and every surviving mutable forwarding/session map is re-read before each individual unlink. The proof is removed last. Interrupted work therefore returns bounded, redaction-safe progress and can be retried with the exact request. State repopulation after proof commit has a distinct partial result and stops further cleanup until the product drains the writer and traffic again. Foreign hooks, replaced pins, populated state, ABI mismatch, and unreadable state fail closed without being relabelled as absent. Missing pin state is reported absent only after complete target-bound ingress/egress dumps find no legacy SDK program name at any priority or handle.

The production runtime's parse-only child module keeps the frozen v2 bytes private and exposes only derived, provenance-checked program tags; production loader code cannot receive the embedded object through that module. CI binds the exact bytes to the Apache-2.0 historical repository blob and separately checks a rebuild's public program/map inventory. That rebuild check is structural evidence, not an exact-byte reproducibility claim. A privileged fresh-namespace qualification test loads and attaches the exact hash-pinned object without traffic solely to prove the live program tags, program-to-map binding, exact hook removal, nine-pin cleanup, and subsequent fresh source-port-v4 provisioning. Unit tests cover each mutation failure phase, acknowledgement loss, idempotent retry, proof-only crash fencing, concurrent state reappearance, foreign path shapes, and refusal classifications.

This closes the missing typed SDK maintenance primitive. Stopping all writers, preventing traffic, proving product/session drain, persisting operator evidence, retry scheduling, and deciding when to reprovision remain downstream/operator responsibilities; the SDK does not infer those conditions. The maintenance window must also exclude external interface, tc, and bpffs mutation that bypasses the cooperating SDK reconciler lease.

Historical EPC/untrusted-access hardening snapshot — T-8c57ecee (2026-06-28)

This snapshot records the final EPC/untrusted-access SDK readiness pass after the concrete final-hardening tasks T-0e9cac9a, T-0cc9d976, and T-0a1f3cdd closed. The evidence ledger is epdg-sdk-final-hardening-triage.md, and the operator-facing addendum is operator-readiness.md.

The pass keeps the ADR 0018 boundary explicit:

opc-proto-gtpv2c, opc-proto-diameter, and opc-proto-ikev2 are experimental protocol crates with conformance notes, hostile-input tests, and fuzz targets, not product transport/state-machine implementations.
opc-testbed exposes EPC/ePDG simulator skeletons and manifest provenance for decoded messages; raw protocol bytes are still decoded by protocol crates before simulator use.
opc-evidence packet-core packs are experimental evidence-formatting and validation mechanisms, not carrier-readiness sign-off.
operators/operator-sdk-go packet-core additions are product-neutral helper packages. Downstream CNF operators own CRDs, Helm/RBAC policy, Multus/XFRM privilege wiring, readiness thresholds, traffic-shift policy, and product release evidence.

No final-hardening candidate remained open in that historical triage ledger; this does not assert that later production-readiness findings are closed. Downstream ePDG adapter and carrier-acceptance work remains outside this SDK matrix. Final validation for this historical snapshot was not complete: its cargo-deny advisories gate was environment-limited and supervisor-waived. Current CI includes cargo-deny advisories, bans, licenses, and sources checks; every candidate must rely on its own current results. This historical waiver is not current release evidence or production/carrier-acceptance approval.

Deferred/waived final-validation gates

The following gates are deferred (environment-limited), supervisor-waived for this readiness snapshot. Evidence source: supervisor decision by claude-supervisor recorded for T-8c57ecee. The deferral is due to environment limitations in the worker pane, not code defects.

Go operator verification was re-run on July 3, 2026 with Go 1.26.4 for both operators/sdk-reference-operator and operators/operator-sdk-go: gofmt -l, go vet ./..., go test ./..., go test -race ./..., and govulncheck ./... passed. The reusable Go SDK downstream-import smoke also passed through the local go.work fixture.

Gate	Status	Evidence / limitation
`cargo deny check advisories`	Deferred (environment-limited), supervisor-waived	The installed `cargo-deny` 0.17.0 cannot parse a CVSS 4.0 entry in the cached advisory database (`RUSTSEC-2026-0146`), so the advisories check fails before scanning the local lockfile. `cargo audit --no-fetch` of the same lockfile passes.

At that snapshot the deferred gate still required a compatible cargo-deny/advisory-db environment. It does not describe the status of a current candidate.

The gates that passed in this pane and remain recorded as evidence are: cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, cargo clippy --workspace --all-targets --all-features -- -D warnings, MSRV check (cargo +1.88 check --workspace --all-targets --all-features), cargo audit --no-fetch, cargo deny check bans / licenses / sources, split workspace all-features tests, docs consistency, Kustomize/Helm rendering, Rust-side operator-lifecycle CLI tests, and the Go operator verification listed above.

Phase 5 gate summary

This gate confirms that the SDK foundation composes into a first NF migration slice without forcing per-NF crates to invent their own runtime, config, security, session, SBI, alarm, or evidence subsystems. The toy integration crate stays limited to NF-specific config and orchestration glue in opc-sdk-integration and opc-sdk-integration/src/lib.rs, while the shared behavior stays in the foundation crates listed below. These rows mirror the detailed RFC matrices later in this document, so partial or not-yet-integrated shared crates are called out explicitly instead of being treated as complete.

Shared concern	Shared crate(s)	Gate evidence
Runtime lifecycle, readiness, supervision	`opc-runtime`	`toy_runtime.rs`, `graceful_shutdown.rs`, `health.rs`, `supervisor.rs`
Config commit, publish, rollback, and persistence	`opc-config-bus`, `opc-config-bus-consensus`, `opc-config-model`, `opc-persist`, `opc-nacm`	`config_bus.rs`, `adapter.rs`, `encryption.rs`, `model_contract.rs`, `config_fixture_commit.rs`, `persist.rs`
Tenant identity and redaction surfaces	`opc-types`, `opc-redaction`, `opc-config-bus`	`shared_types.rs`, `config_bus.rs`, `opc-redaction/src/digest.rs` (inline tests), `opc-redaction/src/level.rs` (inline tests), `fault_injection.rs`
Key and crypto helpers	`opc-key`, `opc-crypto`	`opc-key/src/lib.rs` (inline tests), `opc-crypto/src/lib.rs` (inline tests), `encryption.rs`, `encryption.rs`
Session fencing, stale-owner rejection, and payload envelopes	`opc-session-store`	`fault_injection.rs` (stale-fence CAS integration test), `fake.rs` (unit tests), `encryption.rs`, `sqlite.rs` (durable integration tests)
Shared SBI contract and NRF behavior	`opc-sbi`	`contract.rs`, `nrf.rs`
Alarm model and manager	`opc-alarm`	`opc-alarm/src/manager.rs`, `lib.rs`, `config_bus.rs`; GAP-013-001 tracks only per-CNF adoption after CNF crates land
Testbed and simulator framework	`opc-testbed`	`basic_framework.rs`, `toy_runtime.rs`
RFC 006 evidence output and validation	`opc-evidence`	`opc-evidence` test suite, `toy_runtime.rs`

RFC 001 – Transactional Management Substrate

AC	Criterion	Crate(s)	Tests	Status	Known Gaps
001-1	Commit cannot publish unless authorization, validation, encryption, and durable append all succeed.	`opc-config-bus`, `opc-config-bus-consensus`, `opc-config-model`, `opc-nacm`, `opc-persist`	`config_bus.rs`, `adapter.rs`, `security_defaults_verification.rs`, `encryption.rs`, `model_contract.rs`, `config_fixture_commit.rs`, `persist.rs`	implemented	Production-facing `ConfigBus` constructors require an explicit `ConfigAuthorizer`; allow-all construction is limited to clearly named `*_dev_only` helpers. The shared production adapter accepts only `SealedConfig`, delegates wholesale to `ConsensusConfigStore`, and creates named rollback labels in the same state-machine mutation as the encrypted commit. Multi-group production qualification remains open under `GAP-001-006`.
001-2	Data-plane snapshot access is independent of commit queue and persistence health.	`opc-config-bus`	`config_bus.rs`	implemented	—
001-3	SQLite preflight rejects unsafe durable deployments.	`opc-persist`	`persist.rs`, `consensus_openraft.rs`	implemented	SQLite unsafe-deployment preflight is implemented for its single-replica profile. The separate `ConsensusConfigStore` now uses the shared Openraft engine, atomically fences standalone writes, admits only sealed/redacted commands, and fails closed on unapproved legacy authority. That implementation evidence does not make standalone SQLite HA or establish carrier-production consensus readiness; qualification remains `GAP-001-006`.
001-4	Recovery handles clean restart, crash restart, rollback, and commit-confirmed expiry.	`opc-config-bus`, `opc-persist`	`config_bus.rs`, `persist.rs`	implemented	Recovery handles clean/crash restart, rollback, and commit-confirmed expiry rollback.
001-5	Audit logs are tamper-evident and redacted.	`opc-mgmt-audit`, `opc-mgmt-audit-store`, `opc-persist`, `opc-types`	`opc-mgmt-audit-store/src/lib.rs`, `persist.rs`, `shared_types.rs`	implemented	Production management sinks now require safe durable storage and an explicit non-zero `AuditKey`, persist only bounded structured event fields, atomically maintain an authenticated retention anchor, verify the retained chain on restart/query, and use bounded fail-closed acknowledgement. This local evidence detects retained-row/anchor disagreement; coherent whole-store rollback requires a deployment-owned external monotonic checkpoint.
001-6	Metrics expose queue, phase latency, persistence, and authorization health.	`opc-config-bus`, `opc-nacm`, `opc-persist`, `opc-session-store`, `opc-alarm`, `opc-redaction`	`observability.rs`	implemented	Prometheus metrics registry and exporters cover queue depth, phase latency, persistence / HA consensus, session store, authorization (NACM), alarms, and runtime health. Session durable-readiness metrics expose only fixed gauges/counters and bounded failure reasons, without per-replica or raw-error labels.
001-7	Fault injection tests cover all failures listed in RFC 001 §14.3.	`opc-sdk-integration`	`fault_injection.rs`	implemented	—

RFC 002 – YANG-to-Rust Projection and Codegen Engine

AC	Criterion	Crate(s)	Tests	Status	Known Gaps
002-1	Generated Rust preserves YANG presence, defaults, ordering, keys, and namespace semantics.	`opc-yanggen`	`codegen.rs`, `generated_features.rs`	implemented	Fully implemented presence container, defaults, nested list, and multi-key list struct and enum generation (GAP-002-001).
002-2	RFC 7951 round trips pass for all supported types.	`opc-yanggen`	`generated_features.rs`	implemented	Fully implemented serde helper serialization/deserializer generation (GAP-002-002).
002-3	Large config validation is bounded and does not use unbounded recursive DFS.	`opc-yanggen`	`generator.rs`, `generated_features.rs`	implemented	Fully implemented semantic constraint validation checks (GAP-002-003).
002-4	Unsupported XPath/YANG constructs fail generation with diagnostics.	`opc-yanggen`	`generator.rs`, `generated_features.rs`	implemented	`compile_with_diagnostics` rejects unsupported lowered features, and Rust generation rejects unsupported model shapes, dangling children, constraints, lists, and unsupported types.
002-5	Generated patch applicators support gNMI and NETCONF operation semantics.	`opc-yanggen`	`generated_features.rs`	implemented	Fully implemented fail-closed patch applicator supporting gNMI/NETCONF operations (GAP-002-004).
002-6	Secret metadata integrates with audit redaction and persistence.	`opc-yanggen`, `opc-redaction`, `opc-data-governance`	`generated_features.rs`	implemented	Fully implemented explicit data-class extensions, metadata maps, and Redactable integration (GAP-002-005, GAP-010-001).
002-7	Operator policy helpers can consume generated schema metadata without a hand-maintained side schema or generated Go/Kubernetes projection.	`opc-yanggen`, `operator-lifecycle`, `operator-controller`	`generated_features.rs`, `controller_tests.rs`	implemented	RFC 002 now defines the SDK boundary as Rust schema metadata plus RFC 009 operator policy contracts; product Go/Kubernetes CRD generation is operator-owned rather than an `opc-yanggen` output (GAP-002-006).
002-8	Output is deterministic and suitable for parallel implementation.	`opc-yanggen`	`generator.rs`	implemented	Deterministic ordering and stable schema-digest tests pass.

RFC 003 – Security Substrate

AC	Criterion	Crate(s)	Tests	Status	Known Gaps
003-1	Every management connection is authenticated with SPIFFE-aware mTLS or an explicitly configured SSH identity profile.	`opc-identity`, `opc-tls`	`security_tests.rs`	implemented	TLS acceptor/client reload and SPIFFE-SVID watch are implemented.
003-2	Tenant identity is explicit and enforced across authz, persistence, audit, and telemetry.	`opc-types`, `opc-nacm`, `opc-config-bus`, `opc-persist`, `opc-redaction`	`shared_types.rs`, `nacm.rs`, `config_bus.rs`, `metrics.rs`, `observability.rs`	implemented	Tenant scoping is enforced in core types, NACM, config bus, and persistence; Prometheus labels are sanitized through `metrics_label_safe` before export (GAP-003-002).
003-3	gNSI services can stage, validate, apply, audit, and roll back security policy.	`opc-persist`	`security_policy_tests.rs`	implemented	Implemented as a gNSI-inspired SDK API (`SecurityPolicyService` in `opc-persist`) supporting tenant-scoped, audited, and encrypted staging, validation, atomic apply, and rollback of security policies.
003-4	Config, shadow-security, session, and audit keys are purpose-separated and rotatable.	`opc-key`	`security_tests.rs`, `opc-key/src/lib.rs` (inline tests), `encryption_tests.rs`	implemented	`KeyPurpose`, `KeyProvider`, rotatable `MemoryKeyProvider`, and `KmsKeyProvider` are implemented. The optional admitted-custody boundary binds one module's declared sealed-storage capability evidence to its remote-seal operations, returns bounded admission evidence without independently certifying the declarations, rechecks the complete grant against live readiness before dispatch, and rejects oversized/non-canonical provider AAD. Direct providers remain explicitly unadmitted compatibility paths. Remote unseal selects the exact validated historical envelope key ID; process-local atomic publication changes only future seals while an in-flight seal retains its captured ID. KMS/HKMS owns historical retention/revocation; the SDK has no local historical cache, retirement API, or enforcement gate. Production KMS framing and redacted failures are tested separately from scoped three-node in-process Openraft snapshot-install/restart evidence with actual file-backed nodes and controllable RPC. This does not qualify multi-process or deployed-network behavior. Direct PKCS#11/HSM plugins remain optional future adapters.
003-5	AEAD envelopes bind ciphertext to tenant, purpose, version, and schema/state metadata.	`opc-crypto`, `opc-key`, `opc-config-bus`, `opc-session-store`	`opc-crypto/src/lib.rs` (inline tests), `opc-key/src/lib.rs` (inline tests), `encryption.rs`, `encryption.rs`	implemented	`EncryptingManagedDatastore` and `EncryptingSessionBackend` use the shared envelope helpers and bind tenant, purpose, version, schema, generation, and fence metadata in AAD.
003-6	Break-glass is scoped, time-limited, audited, and disabled by default in production unless carrier policy enables it.	`opc-persist`	`break_glass_tests.rs`, `break_glass_stress_tests.rs`	implemented	—
003-7	Security failure modes fail closed and are covered by fault injection tests.	`opc-sdk-integration`, `opc-security-testkit`	`fault_injection.rs`, `security_tests.rs`	implemented	SPIRE socket unavailability, expired-SVID rejection, removed-trust-bundle reload rejection with last-good retention, KMS unavailability, timeout, missing key, and wrong tenant/purpose fail-closed behaviors are covered. This does not claim generic certificate revocation.

RFC 004 – High-Performance Session Store

AC	Criterion	Crate(s)	Tests	Status	Known Gaps
004-1	Authoritative session writes require monotonic fencing and CAS.	`opc-session-store`	`fake.rs`, `sqlite.rs`, `fault_injection.rs`	implemented	Monotonic fencing and CAS are fully implemented and verified via unit tests, integration tests, and fault injection.
004-2	Stale owners cannot overwrite newer session state after lease expiry.	`opc-session-store`	`fake.rs`, `sqlite.rs`, `ttl_verification.rs`, `ttl_bounds.rs`, `fenced_ownership.rs`, `fault_injection.rs`	implemented	Lease expiry, stale fence rejection, owner mismatch, and takeover are covered. Generalized opaque-key ownership now commits claim, renewal, transfer, and release through the existing backend lease/CAS authority; every live mutation advances a fence-derived generation, retained mutation identities replay exactly, ABA returns advance, and injected-clock expiry retains the backend fence floor. Under #137, every `Duration` input used for session refresh or lease TTL is bounded by the public 365-day maximum; zero is immediate expiry for the lower-level store and is rejected for logical ownership leases, checked integer deadline arithmetic cannot unwind, and larger direct/nested/persisted/wire inputs return typed errors before application/backend effects. Replicated cross-field validation retains only a one-microsecond positive-deadline tolerance for legacy `seconds_f64` rounding; it does not enlarge the TTL bound. #148 separately bounds caller-authored absolute expiry to the same horizon at coordinator-authored time, admits intentional `None` by state profile, revalidates committed/replayed CAS without follower clocks, and supplies a version-4 count-only audit plus operator migration path.
004-3	Handover state transitions are idempotent and recoverable.	`opc-session-store`	`handover.rs`, `handover_stress.rs`, `handover_challenger_verification.rs`	implemented	`HandoverManager` provides CAS-backed prepare, prepared, activate, complete, abort, and finalize-abort transitions with stale-owner, competing-transaction, retry/idempotency, and SQLite restart coverage. New envelopes use exact `OPCH` magic/version; the bounded classifier rejects malformed/ambiguous claims and exposes syntactic source format, which products must verify against provenance. The identity audit does not classify live or nested-log payloads: rollout requires a complete decrypted replay preflight, all handover readers/writers upgrading together, and no old-binary rollback after any live/replayable `OPCH` write without coherent fleet-wide checkpoint restore or reviewed reverse migration of records/logs/snapshots/restore sources.
004-4	Geo-replication does not use wall-clock LWW for authoritative state.	`opc-consensus`, `opc-session-store`, `opc-session-net`	`consensus_openraft.rs`, `quorum_topology.rs`, `restore_evidence.rs`, `consensus_transport.rs`	partial	#127 replaces the custom majority-prefix coordinator with exact-pinned Openraft for election, voting, log matching, commitment, membership, snapshots, and linearizable reads. The deterministic state machine commits monotonic logical time before expiry-sensitive reads, so leader change or clock rollback cannot select state by wall-clock LWW. #128 supplies current-format reconciliation, and #129 supplies a bounded, audited offline whole-fleet legacy campaign without adding runtime consensus authority. #133 adds bounded scoped restore from the locally applied committed state with payload/SQLite-work limits and stale snapshot-bound cursor rejection. Stable cluster-scoped node IDs are independent of endpoint/FQDN text. Session and config now consume one shared fail-closed runtime and transport timing profile and the exact interim Openraft revision `f607e636406b16bd0ad7925dbb631da1b7a4cd96`, which resamples every election campaign. Real mTLS component tests prove bounded cached-connection reuse, the contained 1.5-second cold cap, exact RPC-family deadlines, and same-leader/same-term follower-listener restart and catch-up without a preflight. Domain tests observe and stop the actual leader, require a different higher-term survivor, commit session lease/CAS work or a configuration transaction through the surviving quorum, restart the old leader's durable state, and wait for convergence. The 3- and 5-process foundation records the same transition plus a generation read while the old leader is down. The additive v4 candidate profile and closed manifest now digest-bind the frozen v1 sequential and v3 concurrent independent-checker contracts to one exact candidate campaign, while fixing every production-credit field to false. The exact 26-crate normal reverse-dependency closure is source-build-only until an official fixed release, registry checksum pin, and full #143 requalification. Writes during cluster formation, deployed-network/mTLS failover, complete crash matrices, resource/soak, and multi-node restart/rejoin remain unqualified. The partial status reflects remaining production qualification (#143), not missing commit, recovery, or bounded-restore authority.
004-5	Backend capabilities are declared and enforced by profile.	`opc-session-store`	`profile_validation_tests.rs`, `fake.rs`, `sqlite.rs`	implemented	`BackendCapabilities`, `SessionStateProfile`, `StateClass::required_profile`, and `validate_backend_for_profile` provide standalone profile validation. `FakeSessionBackend` enforces configurable capabilities, and `SqliteSessionBackend` reports its single-node durable capability envelope without `watch` or `ordered_replication_log`. Capabilities and configuration-parsed `SessionStorePlatformProfile::Quorum` are admission intent, not liveness. `QuorumSessionStore::probe_durable_readiness` supplies bounded Openraft engine/lab evidence only; production traffic requires authenticated topology, the time-aware production profile, and `probe_production_durable_readiness`.
004-6	Session payloads are encrypted and tenant-bound.	`opc-session-store`, `opc-crypto`, `opc-key`	`encryption.rs`, `encryption_tests.rs`, `replication_structure_bounds.rs`	implemented	`EncryptingSessionBackend` and `RemoteSealingSessionBackend` iteratively transform every nested replicated CAS on replicate/rebuild/log/watch paths. Outbound entry/prefix preflight occurs before provider/backend work; returned-page/item preflight occurs after the backend read and before transformation/exposure. Public limits are depth 16 from a depth-1 root and 256 total nodes counting every `Batch`; failures use fieldless `ReplicationOperationLimitExceeded`. Transformations are staged and provider calls sequential, so a late failure causes no backend delegation or partial entry/page exposure. Remote historical lookup validates canonical envelope/AAD scope before passing the exact key ID to the provider; redacted missing/revoked/wrong-scope failures and old/new rotation reads are covered. Scoped three-node in-process Openraft snapshot-install/shutdown/restart evidence proves provider calls stay above consensus; it is not multi-process or deployed-network qualification. Historical tree shape and payload encoding still require an offline audit. #143 distributed failure/resource/soak qualification remains open; it is not a missing historical-key-selection gate.
004-7	Local cache supports fast reads without compromising write correctness.	`opc-session-cache`, `opc-session-store`	`cache_tests.rs`, `fenced_ownership.rs`	implemented	`SessionCache` provides read-through local caching, sequence tracking, background invalidation, direct-backend fallback while lagging, manual resync, exact requested-cursor filtering, and an atomic bounded backlog-to-live registration handoff. `FencedOwnershipCache` adds a no-I/O owner hot path with allocation-sharing `Arc` hits, independent entry/retained-byte bounds, ordered passive-expiry reclamation, explicit staleness, local lease-expiry checks, owner-free `Stale`, and lag/byte/hit/miss/stale/feed-failure metrics. An unseeded view can only replay from committed sequence 1 through a proven `FencedOwnershipCacheReplayHead`; a partial backlog remains stale. An arbitrary later cursor requires an explicitly caller-proven namespace-bound coherent `FencedOwnershipCacheSeed`. The restore-scan API does not currently prove an atomic log watermark, so no turnkey arbitrary-cursor bootstrap is claimed. A quiet watch is not a heartbeat and ages stale. Gaps, malformed/future evidence, capacity exhaustion, local clock regression, and stopped feeds clear and invalidate the complete owner view. Absolute-expiry authority preflight now precedes cache invalidation and delegated mutation side effects. Distributed resource/soak qualification remains #143.
004-8	Fault injection covers split-brain, failover, replication lag, and stale fences.	`opc-session-testkit`, `opc-session-store`	`consensus_openraft.rs`, `qualification_multiprocess.rs`, `replication_atomicity.rs`	partial	Openraft fixtures use distinct file-backed databases and controllable in-process RPC paths. Coverage includes formed-cluster quorum loss/heal, response loss, raw-authority rejection, current-format reconciliation, two-/three-branch legacy campaigns, backup/snapshot/epoch/rejoin failpoints, stale-plan/corrupt-artifact rejection, atomic bounded watch handoff, and bounded journal cursor semantics. The multi-process foundation now coherently observes and stops the actual leader in 3- and 5-member fleets, requires a different leader at a strictly higher term, records a generation read while the old leader is down, bounds restart catch-up, converges, and independently checks the original workload history. It does not claim writes during cluster formation, deployed-network/mTLS failover, complete leader/follower crash points, multi-node restart/rejoin, or long-running lag/resource/soak qualification. Distributed production qualification remains #143 and the profile stays experimental.

RFC 005 – Zero-Copy Protocol Framework

AC	Criterion	Crate(s)	Tests	Status	Known Gaps
005-1	Borrowed decoders express lifetimes safely and owned conversion is available.	`opc-protocol`	`lifetime_fixture.rs`	implemented	`BorrowDecode`, `OwnedDecode`, and `ToOwnedPdu` traits are defined and tested.
005-2	Fast-path header decode is allocation-free for supported protocols.	`opc-protocol`, `opc-proto-gtpu`	`gtpu_tests.rs`	implemented	`opc-proto-gtpu` proves the borrowed zero-copy parser path for GTP-U headers, optional fields, extension headers, and owned slicing (GAP-005-001).
005-3	All length and offset math is checked.	`opc-protocol`	`checked_arithmetic.rs`	implemented	`wire_len` uses checked arithmetic; overflow tests pass.
005-4	Decoders reject hostile input without panic, hang, or unbounded allocation.	`opc-protocol`, `opc-proto-gtpu`	`decode_errors.rs`, `gtpu_tests.rs`	implemented	`DecodeContext` limits are enforced by the protocol traits and the GTP-U crate adds hostile/truncated/oversized/extension-depth regression tests plus fuzz targets (GAP-005-002).
005-5	Round-trip tests distinguish canonical and raw-preserving modes.	`opc-protocol`	`roundtrip_docs.rs`	implemented	Canonical and raw-preserving round-trip properties are tested.
005-6	Fuzz targets and regression corpora exist for every protocol crate.	`opc-protocol`, `opc-proto-gtpu`, `opc-proto-pfcp`, `opc-proto-nas`, `opc-proto-ngap`, `opc-proto-gtpv2c`, `opc-proto-ikev2`, `opc-proto-diameter`	`crates/opc-proto-gtpu/fuzz/`, `crates/opc-proto-pfcp/fuzz/`, `crates/opc-proto-nas/fuzz/`, `crates/opc-proto-ngap/fuzz/`, `crates/opc-proto-gtpv2c/fuzz/`, `crates/opc-proto-ikev2/fuzz/`, `crates/opc-proto-diameter/fuzz/`	implemented	GTP-U, PFCP, NAS-5GS, NGAP v0, the experimental `opc-proto-gtpv2c` S2b subset, and the experimental `opc-proto-diameter` scaffold include protocol-specific fuzz targets plus fixture/corpus replay; the experimental `opc-proto-ikev2` scaffold adds initial fuzz targets and seed corpus within its documented scaffold scope (GAP-005-002, GAP-PROTO-003, GAP-PROTO-005, GAP-PROTO-006, GAP-PROTO-007, GAP-PROTO-008, GAP-PROTO-009).
005-7	Spec traceability tags feed RFC 006 evidence.	`opc-protocol`, `opc-proto-gtpu`	`decode_errors.rs`, `lib.rs`	implemented	`SpecRef` remains in the error model and `opc-proto-gtpu` parser code carries `@spec`, `@req`, and `@conformance` tags for TS 29.281 evidence extraction (GAP-005-004).
005-8	Protocol modules follow the standard layout for parallel implementation.	`opc-protocol`, `opc-proto-gtpu`, `opc-proto-pfcp`, `opc-proto-nas`, `opc-proto-ngap`, `opc-proto-gtpv2c`, `opc-proto-ikev2`, `opc-proto-diameter`	`crates/opc-proto-gtpu/CONFORMANCE.md`, `crates/opc-proto-pfcp/CONFORMANCE.md`, `crates/opc-proto-nas/CONFORMANCE.md`, `crates/opc-proto-ngap/CONFORMANCE.md`, `crates/opc-proto-gtpv2c/CONFORMANCE.md`, `crates/opc-proto-ikev2/CONFORMANCE.md`, `crates/opc-proto-diameter/CONFORMANCE.md`	implemented	GTP-U, PFCP, NAS-5GS, NGAP v0, the experimental `opc-proto-gtpv2c` S2b subset, the experimental `opc-proto-diameter` scaffold, and the experimental `opc-proto-ikev2` scaffold follow the concrete protocol-crate layout with crate manifest, parser implementation, tests, fuzz targets, corpus, and conformance notes (GAP-005-005, GAP-PROTO-003, GAP-PROTO-005, GAP-PROTO-006, GAP-PROTO-007, GAP-PROTO-008, GAP-PROTO-009).

July 2026 addendum for AC 005-6 and 005-8: opc-proto-tft and opc-proto-eap follow the same protocol-crate layout and add stable corpus replay plus registered fuzz targets. Their conformance sources are crates/opc-proto-tft/CONFORMANCE.md and crates/opc-proto-eap/CONFORMANCE.md.

RFC 006 – Conformance and Evidence Pipeline

AC	Criterion	Crate(s)	Tests	Status	Known Gaps
006-1	Conformance claims are calculated from requirement inventory, code tags, tests, and gaps.	`opc-evidence`	`evidence_extract.rs`, `evidence_status.rs`, `evidence_requirements.rs`	partial	Tag scanning and standalone status-calculation primitives are implemented and tested. Remaining: a versioned repository requirement/mapping/gap inventory, end-to-end calculation from that inventory, and CI/release invocation.
006-2	A requirement cannot silently remain partial without a structured known gap.	`opc-evidence`	`evidence_gap.rs`, `evidence_gap_gate.rs`	partial	Gap-validation APIs fail closed for supplied records. They are not yet applied to a repository-owned inventory in PR/release workflows.
006-3	SBOM and VEX are generated and release-gated.	`opc-evidence`	`evidence_sbom_vex.rs`	partial	Rust SBOM generation and VEX record-validation APIs exist. The release workflow emits Rust/Go SBOMs but does not generate/evaluate VEX or invoke release policy.
006-4	Provenance ties artifacts to source commit, builder, inputs, and digests.	`opc-evidence`	`evidence_provenance.rs`	partial	The provenance model/generator is tested. The release workflow currently emits only `git-revision.txt`; it does not emit or validate SLSA/in-toto provenance.
006-5	Evidence bundles include signed manifests and verifiable artifact digests.	`opc-evidence`	`evidence_bundle.rs`	partial	Deterministic domain-separated signing bytes, embedded-blob coverage, authenticated verifier identity binding, strict manifest validation, external signer/verifier traits, and digest checks are tested. No production external signer/verifier adapter is wired, and the release workflow does not assemble, sign, or verify a bundle.
006-6	Performance baselines include environment details and regression thresholds.	`opc-evidence`	`evidence_performance.rs`	partial	Schema, environment-capture, and threshold helpers exist. Required benchmark coverage and release performance-baseline capture/gating are not wired.
006-7	PR and release gates fail closed on missing or inconsistent evidence.	`opc-evidence`	`evidence_policy.rs`	partial	`GateEvaluator` is library-tested and requires separately supplied policy artifacts to exactly match the signed bundle, binds the canonical record/gap/waiver inputs in signed manifest metadata, cross-checks signed conformance records, and requires configured/provenance/report/manifest commits to agree. It is not invoked by PR or release workflows, so end-to-end enforcement remains open.
006-8	Generated code must supply traceable tags and tests before it can support conformance claims.	`opc-evidence`	`evidence_extract.rs`	partial	Tag parsing exists, but generated-code CI does not enforce requirement/test mappings. The parser validates known keys and non-empty values, not semantic conformance-status values.
006-9	Packet-core evidence packs provide versioned experimental schemas for protocol fixtures, attach procedures, and kernel dataplane proof, with redaction validation that fails closed on raw sensitive identifiers.	`opc-evidence`	`evidence_packet_core.rs`	partial	Experimental v1 packet-core schemas and redaction checks are implemented. Schema stability and production graduation remain dependent on compatibility policy and downstream producer evidence.

RFC 007 – SBI Service Framework

AC	Criterion	Crate(s)	Tests	Status	Known Gaps
007-1	All SBI NFs use shared ProblemDetails, header, auth, retry, and NRF code.	`opc-sbi`	`contract.rs`, `nrf.rs`, `sbi_integration.rs`	implemented	Shared HTTP/2 `SbiServerBuilder`/`SbiClient` logic exists. Production mode fails closed unless TLS, auth policy, and trust bundles are configured; dev/test plaintext is explicit.
007-2	OAuth2 validation and client-credential acquisition are test-covered.	`opc-sbi`	`contract.rs`, `sbi_integration.rs`	implemented	`SbiJwtValidator` validates RS256 JWT-SVID issuer, audience, `exp`, `nbf`, strict SPIFFE subject layout, and fail-closed JWKS refresh. `ClientTokenCache` has explicit TTL/capacity bounds.
007-3	NRF registration, heartbeat, discovery, and cache behavior are shared.	`opc-sbi`	`nrf.rs`, `sbi_integration.rs`	implemented	`NrfClient`, heartbeat driver with backoff, and discovery cache are implemented with encoded query parameters and production stale-cache rejection for security-sensitive discovery paths.
007-4	Retry behavior is idempotency-aware.	`opc-sbi`	`contract.rs`	implemented	`RetryPolicy` honors `POST` idempotency keys and distinguishes safe/idempotent methods.
007-5	Overload control returns consistent 429/503/Retry-After semantics.	`opc-sbi`	`contract.rs`, `sbi_integration.rs`	implemented	Admission-control middleware limits concurrency and body sizes; concurrency overload returns typed 503 `ProblemDetails` with `Retry-After`, while retry policy handles both 429 and 503 from peers.
007-6	Circuit breaker state is observable and bounded.	`opc-sbi`	`sbi_integration.rs`	implemented	Client circuit breaker with state transitions, metrics, and probe limits is complete.
007-7	Generated models are reproducible and evidence-tagged.	`crates/opc-api-nnrf`	`scripts/generate-api-nnrf.py` (content-hash pinned, deterministic), `tests/compat_sbi.rs`	partial	Pilot expanded: TS 29.510 `NfProfile`/`NfService` plus NFManagement `SubscriptionData`/`NotificationData` and event/condition enums. Broader TS 29.5xx interfaces remain tracked in GAP-007-006.
007-8	A shared SBI testkit can exercise producer and consumer behavior for every SBI NF.	`opc-sbi`	`nrf.rs`, `sbi_integration.rs`	implemented	MockProducer, MockConsumer, and fixtures are complete.

RFC 008 – CNF Runtime Chassis and Resource Governance

AC	Criterion	Crate(s)	Tests	Status	Known Gaps
008-1	Every NF binary uses `opc-runtime` for startup, supervision, health, and shutdown.	`opc-runtime`, `opc-sdk-integration`	`toy_runtime.rs`, `workspace_smoke.rs`	implemented	`run()`, `Builder`, and `RuntimeHandle` provide the full lifecycle.
008-2	Long-lived tasks are supervised and named.	`opc-runtime`	`toy_runtime.rs`	implemented	`Supervisor` tracks `TaskSpec`, `Criticality`, and `RestartPolicy`.
008-3	Readiness semantics are consistent across CNFs.	`opc-runtime`	`toy_runtime.rs`	implemented	`HealthModel` and `Readiness` enum expose `Ready`/`Degraded`/`NotReady`.
008-4	Shutdown drains safely and predictably.	`opc-runtime`, `opc-sbi`	`toy_runtime.rs`, `graceful_shutdown.rs`, `nrf_discoverability_validation.rs`, `nrf.rs`	implemented	Drain transitions through `Draining` → `Stopped`, Unix SIGTERM triggers graceful shutdown, hook timeouts and hook `Err` results raise drain-incomplete alarms, production AMF/SMF/UPF profiles require the NRF drain hook, and `NrfDrainHook` delegates deregistration through the shared SBI NRF interface.
008-5	Production debug endpoints are gated or disabled.	`opc-runtime`	`observability.rs`	implemented	`RuntimeProfile::mode` distinguishes `production`/`dev`; admin / probe / debug routes (`/metrics`, `/livez`, `/readyz`, `/startupz`, `/debug/runtime`, `/debug/tasks`, `/debug/config-version`) with production authorization are fully implemented and verified.
008-6	Runtime pools and queues are bounded.	`opc-runtime`, `opc-config-bus`	`config_bus.rs`	implemented	`RuntimeProfile::tokio_runtime_builder` applies worker/blocking-thread bounds for owned runtimes; `ResourceBudget` validation fails closed in production; supervisor admission enforces registered task and memory-pressure limits. Queue bounds are enforced by queue-owning components such as `opc-config-bus`.
008-7	Panic and fatal-error handling is redacted and observable.	`opc-runtime`	`workspace_smoke.rs`	implemented	Panic hook metadata installs per-runtime; redaction is handled by `opc-types`.
008-8	Runtime behavior is covered by shared testkit and fault injection tests.	`opc-runtime`, `opc-sdk-integration`	`fault_injection.rs`, `toy_runtime.rs`	implemented	`FakeClock` and deterministic shutdown tests exist; hung-task, heartbeat timeout, restart loop, and memory-budget fault injection are fully covered.

RFC 009 – Operator Lifecycle, Upgrade, Migration, and Rollback

AC	Criterion	Crate(s)	Tests	Status	Known Gaps
009-1	Operator/NF/version compatibility is machine-readable and enforced.	`operator-lifecycle`, `operator-controller`	`lifecycle_tests.rs`, `controller_tests.rs`	closed	Implemented machine-readable compatibility policy and matrix validation for admission, config apply, CRD conversion, and migration orchestration (GAP-009-001).
009-2	Lifecycle phases and conditions are stable across all CNFs.	`operator-lifecycle`	`lifecycle_tests.rs`	closed	Implemented stable lifecycle phases and conditions with monotonic observed generation/timestamp transitions (GAP-009-002).
009-3	Config apply uses RFC 001 validate/commit/readback behavior.	`operator-lifecycle`	`lifecycle_tests.rs`	closed	Implemented config-apply decision logic enforcing commit-confirmed timeouts, alarm blocks, and degraded rules (GAP-009-003).
009-4	CRD conversions are deterministic and tested.	`operator-controller`	`controller_tests.rs`	closed	Implemented deterministic CRD conversion helpers between v1alpha1 and v1beta1 specs with Kubernetes-style `apiVersion`/camelCase JSON, strict unknown field rejection, defaulting, lifecycle status preservation, and redacted errors (GAP-009-004).
009-5	YANG and state migrations are explicit and evidence-linked.	`operator-controller`	`controller_tests.rs`	closed	Implemented state/schema migration plans, static plan validation, preflight safety checks, and fail-closed transaction execution that never publishes invalid or partial migrations (GAP-009-005).
009-6	Stateful rollouts drain or transfer ownership before termination.	`operator-controller`, `operator-lifecycle`	`controller_tests.rs`	closed	Implemented out-of-process drain executor executing NRF deregistration, session drain, quorum, and workload fencing under strict deadline limits, sanitization, and fail-closed handling for empty/non-drain plans (GAP-009-006).
009-7	Rollback eligibility is evaluated before workload mutation.	`operator-lifecycle`	`lifecycle_tests.rs`	closed	Rollback evaluator implemented choosing only confirmed configurations (GAP-009-007).
009-8	Multi-cluster rollout status is explicit and safe.	`operator-controller`	`controller_tests.rs`	closed	Implemented multi-cluster rollout status aggregation model with monotonic generations/resource versions, cluster identity validation, stale status update rejection, and split-brain warning propagation (GAP-009-008).

RFC 010 – Data Governance, Privacy, and Regulated Records

AC	Criterion	Crate(s)	Tests	Status	Known Gaps
010-1	Every generated and hand-written sensitive field has a data class.	`opc-data-governance`, `opc-yanggen`	`generated_features.rs`	closed	Data-class extension lowering has been proved (GAP-010-001).
010-2	Raw subscriber identifiers do not appear in logs, metrics, traces, events, backend keys, or support bundles by default.	`opc-redaction`, `opc-types`, `opc-config-bus`	`shared_types.rs`, `config_bus.rs`, `observability.rs`, `privacy_governance.rs`	closed	Redaction helpers, keyed-digest, metrics-label enforcement, and support-bundle redaction API are fully implemented and tested (GAP-010-002).
010-3	Retention and legal hold policies are declarative and tested.	`opc-data-governance`	`retention.rs`, `privacy_governance.rs`	closed	`RetentionPolicy` schema and validation rules are fully defined and tested in `opc-data-governance` (GAP-010-003).
010-4	Backups, restores, and exports preserve classification metadata.	`opc-export`	`lib.rs`, `privacy_governance.rs`	closed	Export metadata contract `ExportMetadata`/`ExportedItem` implemented in `opc-export` (GAP-010-004). Product multi-cluster backup orchestration is outside this SDK foundation and belongs to downstream operators.
010-5	Lawful-intercept data is separated from ordinary telemetry and analytics.	`opc-data-governance`, `opc-redaction`, `opc-export`, `opc-privacy`	`class.rs`, `level.rs`, `privacy_governance.rs`	closed	`DataClass::LawfulIntercept` exists, cleartext rendering is denied, and export/analytics paths require explicit classification policy. Product LI mediation and collection workflows are outside the SDK foundation (GAP-010-005).
010-6	Analytics exports record minimization policy.	`opc-privacy`	`lib.rs`, `privacy_governance.rs`	closed	Analytics minimization, k-anonymity validation, cohort size checks, and subscriber ID digesting are implemented in `opc-privacy` (GAP-010-006).
010-7	RFC 006 evidence reports classification, redaction, retention, and privacy behavior.	`opc-evidence`	`evidence_policy.rs`, `privacy_governance.rs`	closed	`DataGovernanceEvidenceReport` schema defined, and validation rules integrated into `opc-evidence` (GAP-010-007).

RFC 011 – Node and Data-Plane Resource Contract

AC	Criterion	Crate(s)	Tests	Status	Known Gaps
011-1	Data-plane CNFs declare structured resource profiles.	`opc-node-resources`	`lib.rs`	closed	Implemented structured `ResourceProfile`, `DataPlaneProfile`, `CpuLayout`, node capability, NIC, hugepage, BPF artifact, and pod-security models (GAP-011-001).
011-2	Operator admission rejects unsatisfied production resource requirements.	`operator-lifecycle`	`lifecycle_tests.rs`	closed	Admission preflight checks reject single-node config/session HA backends, weak tokens, missing KMS/SPIFFE, missing resource profiles, and incorrect CPU layouts (GAP-011-002).
011-3	CPU, NUMA, hugepage, NIC, and CNI assumptions are explicit.	`opc-node-resources`	`lib.rs`	closed	Implemented explicit CPU isolated/reserved sets, NUMA node mappings, hugepage pools, NIC capability matching, and CNI assumptions in the validator (GAP-011-003).
011-4	AF_XDP/eBPF programs are governed by signed/digest-pinned artifacts.	`opc-node-resources`	`lib.rs`	closed	Implemented BPF artifact model verifying digest pinning, signer validation, attach-point constraints, and security capabilities (GAP-011-004).
011-5	Pod security exceptions are minimal and evidence-linked.	`opc-node-resources`	`lib.rs`	closed	Implemented pod security exception validation rejecting overbroad permissions and verifying evidence link IDs (GAP-011-005).
011-6	Readiness depends on data-plane preflight.	`operator-lifecycle`, `opc-node-resources`	`lifecycle_tests.rs`, `lib.rs`	closed	Implemented `DataPlanePreflightReport` checks integrating into admission evaluation and configuration-apply readiness gating (GAP-011-006).
011-7	Lab fallback cannot silently enter production.	`opc-node-resources`	`lib.rs`	closed	Implemented lab/dev fallback gating rejecting any fallback paths in Production environment mode (GAP-011-007).

RFC 012 – Testbed and Simulator Framework

AC	Criterion	Crate(s)	Tests	Status	Known Gaps
012-1	A versioned scenario DSL exists.	`opc-testbed`	`basic_framework.rs`	implemented	`Scenario`, `Step`, `Topology`, and `DSL_VERSION` exist with schema validation.
012-2	Shared peer simulators cover core 5G procedures.	`opc-testbed`	`basic_framework.rs`	implemented	Closed (June 2026): Added stateful, procedure-faithful AMF, SMF, and UPF simulator state machines with deterministic chaos/failure injection (GAP-012-001).
012-3	Virtual time is integrated with runtime/test clocks.	`opc-testbed`, `opc-runtime`	`basic_framework.rs`, `toy_runtime.rs`	implemented	`VirtualClock` implements the `Clock` trait used by the runtime testkit.
012-4	Fixtures carry provenance and sanitization metadata.	`opc-testbed`	`basic_framework.rs`	implemented	`FixtureProvenance` and `FixtureRegistry` enforce provenance fields.
012-5	Scenarios emit RFC 006 evidence records.	`opc-testbed`	`basic_framework.rs`	implemented	`ScenarioEvidence` and `ScenarioOutcome` integrate with the evidence format.
012-6	NF testkits build on the shared framework.	`opc-amf-lite-testkit`, `opc-amf-lite`, `opc-testbed`	`amf_lite_tests.rs`, `fault_injection.rs`	implemented	Closed (June 2026): Added the first real NF vertical integration slice in `opc-amf-lite` and the reusable `opc-amf-lite-testkit` package, providing documented testkit patterns for downstream CNFs (GAP-012-002).
012-7	Conformance and chaos scenarios are reusable across local and Kubernetes modes.	`opc-testbed`	`basic_framework.rs`	implemented	Closed (June 2026): Scenario DSL supports Local, Kind (K8s manifest and dry-run planner), and Hardware-Lab (node capability and layout preflight validation) runners (GAP-012-003).

RFC 013 – Fault Management and Alarm Substrate

AC	Criterion	Crate(s)	Tests	Status	Known Gaps
013-1	Every CNF uses shared alarm model and manager.	`opc-alarm`, `opc-runtime`, `opc-config-bus`	`manager.rs`, `lib.rs`, `config_bus.rs`	implemented	Shared runtime and config-bus alarm paths are wired; CNF contract and integration tests verify direct adoption hooks (GAP-013-001).
013-2	Alarm severity and probable cause taxonomy are stable and versioned.	`opc-alarm`	`model.rs`, `taxonomy_and_sink.rs`	implemented	Defined `TAXONOMY_VERSION` and compatibility rules for `Severity` and `ProbableCause` with serialization stability tests (GAP-013-008).
013-3	Raise/update/clear semantics are deterministic.	`opc-alarm`	`manager.rs`	implemented	`AlarmManager::raise`, `update`, and `clear` are covered by 30+ unit tests in `manager.rs` (dedup, severity transitions, clear-path cases, suppression, acknowledgement, readiness impact).
013-4	Kubernetes conditions and events are derived consistently.	`opc-alarm-k8s`	`lib.rs`	implemented	`opc-alarm-k8s` projects active and cleared alarms to standard K8s conditions and events (GAP-013-003).
013-5	gNMI/NETCONF alarm operational state and notifications are available.	`opc-alarm-yang`	`lib.rs`	implemented	`opc-alarm-yang` exposes static YANG schema and projects alarms to RFC 7951 YANG JSON (GAP-013-004).
013-6	Suppression and acknowledgement are authorized and audited.	`opc-alarm`, `opc-nacm`, `opc-persist`	`manager.rs`, `adapters.rs`	implemented	Concrete `opc-nacm` and `opc-persist` adapters are implemented and verified via unit and integration tests (including security-critical overrides, default-deny policy, redaction boundary, and fail-closed audit).
013-7	External sink failures do not block service paths.	`opc-alarm`	`sink.rs`, `taxonomy_and_sink.rs`	implemented	Implemented `BoundedAlarmSink` async wrapper with bounded queue buffering, fail-closed behavior, backpressure, retries, and shutdown (GAP-013-006).
013-8	Alarm behavior is covered by shared testkit and evidence.	`opc-alarm-testkit`	`lib.rs`, `testkit_tests.rs`	implemented	`opc-alarm-testkit` provides asserters, polling helpers, and sensitive data redaction checks (GAP-013-007).

RFC 016 – Opaque Durable GTP-U Selector Namespace

RFC 016 is proposed and experimental. The rows below are design requirements for issue #662, not implementation claims. Maintainer approval and merge of the RFC are required before an implementation PR can rely on it.

AC	Criterion	Crate(s)	Tests	Status	Known Gaps
016-1	SDK-minted opaque affine capability replaces caller-constructible `Fresh` provenance for a complete selector group.	`opc-gtpu-dataplane`, `opc-session-store`	Planned compile-fail and deterministic namespace tests	not-implemented	Proposed RFC requirement; no implementation is claimed.
016-2	One device/pin-namespace durable ledger atomically binds all TEID/PAA/mark atoms, generation, nonce, and permanent tombstones.	`opc-gtpu-dataplane`, `opc-session-store`	Planned CAS, fault-injection, restart, and tombstone tests	not-implemented	Proposed RFC requirement; mixed provenance and same-group republish are excluded to #663.
016-3	eBPF control binding and backend conformance fail closed across map/program loss, replacement, cancellation, and conflicting authority.	`opc-gtpu-dataplane`, `opc-gtpu-dataplane-ebpf`	Planned privileged isolated-eBPF and backend conformance tests	not-implemented	Proposed RFC requirement; traffic-proof authority rebind is excluded to #664.
016-4	Public diagnostics and RFC 006 evidence remain bounded and identity-free.	`opc-gtpu-dataplane`, `opc-evidence`, `opc-redaction`	Planned redaction and evidence-mutation tests	not-implemented	Proposed RFC requirement; it does not establish product readiness or carrier acceptance.

RFC 017 – Mixed Selector Provenance and Loss-Qualified Restore

RFC 017 is proposed and experimental. The rows below are design requirements for issue #663, not implementation claims. Maintainer approval and merge of the RFC are required before an implementation PR can rely on it.

AC	Criterion	Crate(s)	Tests	Status	Known Gaps
017-1	One protected selector-ledger CAS admits an exact partition of SDK-derived never-published atoms and subsets from multiple fully retired, drain-qualified predecessors.	`opc-gtpu-dataplane`, `opc-session-store`	Planned codec, model, CAS-race, restart, fix-removal, and mutation tests	not-implemented	RFC 016 supports only uniform fresh or one whole retired predecessor.
017-2	Durable atom rows and bounded immutable lineage reject gaps, overlap, contradictory provenance, stale authority, partial drain, and replay before any backend effect.	`opc-gtpu-dataplane`, `opc-session-store`	Planned public-API, coverage, lineage, capacity, stale-fence, and fault-injection tests	not-implemented	No RFC 017 ledger-v2 codec, stamp-v2 ABI, or explicit stopped migration exists.
017-3	Exact retained state is adopted, while same-group republish requires opaque qualified total mutable-backend loss and one fenced whole-namespace restore that preserves the marker, binding, epoch, desired graph, and lineage.	`opc-gtpu-dataplane`, `opc-gtpu-dataplane-ebpf`	Planned adoption, total-loss, restore, restart, replacement, and privileged isolated-eBPF tests	not-implemented	The built-in eBPF restore profile remains unsupported until the privileged qualification is implemented and passes.
017-4	Backend authority and diagnostics remain SDK-owned, affine, bounded, and non-identifying; structural convergence, semantic absence, mocks, and traffic cannot qualify provenance or loss.	`opc-gtpu-dataplane`, `opc-evidence`, `opc-redaction`	Planned compile-fail, conformance, redaction, and adversarial-mutation tests	not-implemented	External adapters remain unsupported until #671 publishes the SDK-owned codec and conformance boundary.

Known Gaps Registry

Gap titles preserve the original condition that created each record. The disposition/reference and mitigation columns describe its current status and supporting design or conformance reference where one exists.

Session-net now consumes the generic TLS reload/material-epoch boundary through #163's finite authentication-age and drain contract for pooled requests, consensus calls, and long-lived watches. Scoped real-mTLS tests cover local and peer leaf-expiry retirement, overlapping trust, full replacement handshakes, old-trust rejection, and request/watch continuity. The current #164 component slice additionally carries the earliest configured/presented-chain expiry through material admission and local/peer lifecycle deadlines, gives earlier intermediate expiry distinct fixed metrics, and classifies certificate/trust, TLS-protocol, and transport failures separately. Short-lived SVID expiry is the bounded same-issuer credential-compromise mechanism; immediate generic CRL/OCSP/certificate-or-identity-denylist revocation is unsupported. A first in-process #164 fleet-mechanics test covers real three- and five-voter Openraft/SQLite operation over production mTLS while leaf, presented intermediate, roots, overlap, old-trust removal, and both rollback procedures change. The private testkit now adds a single-host three- and five-process core using atomic projected ..data generations and production lifecycle defaults. Every changed member separately advances projected-source and TLS-controller status, reauthenticates the fleet, proves fresh handshakes in both directions on its incident edges, obtains all-voter readiness, and reads an encrypted canary; each completed fleet phase additionally covers every directed path and advances the acknowledged CAS. New-only servers reject separate stale old-root clients, and the exact test canary bytes remain absent from SQLite/WAL/SHM. This is MemoryKeyProvider wrapper evidence, not remote-HKMS or deployed evidence. The immutable v1 candidate schema and the broader profile deliberately retain counts_for_seamless_tls_rotation = false and qualification_complete = false. The separate v2 candidate schema now digest-binds each successful local rotation-core, fault/expiry-recovery, or traffic/resource run to its exact pre-execution source state, child and parent harness artifacts, generated configuration, ordered public certificate/trust publication manifest, exact declared orchestration schedule, 3/5-member topology, directed-path count, and ordered coverage. The pre-execution bindings are verified unchanged after the campaign. Emission is rejected with insecure test support compiled, and it is ephemeral unless the existing evidence-output contract is explicitly set. Its public decoder rejects over-limit bytes before closed-JSON parsing and applies the cross-field validator before returning. The preserved bundle contains only the bounded typed record and immutable schema, published from a private fsynced staging directory with atomic no-replace rename. It cannot carry material, private-key digests, identities, addresses, paths, payloads, or backend text. Its production-credit fields remain fixed false; deployed network/storage faults, CNF/Kubernetes execution, supported-platform soak, remote-HKMS, live metrics/alerts, independently signed evidence, and HA-profile graduation remain explicit gates, so #164/#158 stay open. The non-ignored single-host 3/5-process slice now covers one unavailable member plus a different member's malformed retained-last-good reload, short-lived-SVID expiry/hard drain, exact-address watcher restart/catch-up, one unclean same-disk active-mutator restart with survivor commits and higher-fence resume, and bounded mixed mutation/read/watch/restore/readiness traffic. The valid post-expiry replacement advances only the recovered member's explicit reauthentication generation, proves fresh bidirectional incident paths, leaves unrelated survivor explicit/material-epoch retirement counters unchanged, and settles lifecycle plus survivor availability before the next phase baseline. That schedule-bound member-scoped-reauth-settled-baseline/v4 checkpoint starts its 86-second fail-safe and 60-second two-stage server tail at the atomic projected-data rename, then requires a final 2.5-second outbound quiet tail. A prepublication common-key pulse plus 13-second observation checkpoints requires one active key to advance on every survivor observer and conservatively bounds that pulse's actual event gap to 26 seconds. An independent 26-second checkpoint requires every active key on every observer and cannot be reset by a faster key. At most one rejoin availability episode per survivor may settle within that SLO. Its consecutive typed retry outcomes remain separately bounded by the unchanged eight-outcome ceiling; a second or late episode fails closed. The checkpoint also retains bounded 85/161 per-node fault-era new-attempt/reconnect evidence (ordinary 24/40, fifteen five-second refresh rounds over four/eight incident paths, and one scheduled post-hard-expiry survivor-to-expired network-negative attempt per involved node; the reverse probe fails local material preflight without dialing). Terminal outcomes may additionally contain only the exact attempts already outstanding at the baseline, with interval conservation enforced under the schedule-bound new-attempts-plus-baseline-outstanding/v1 profile. Schedule v6 also binds the rolling proof as common-key-pulse-all-active-key-coverage/v1. It requires zero cancellation-classified abandoned, protocol/backend, or drain-overrun evidence. Recovery polling is non-intrusive; final watch-head settlement retains its fail-closed authoritative replication-head read. Schedule v6 now binds the active-mutator scenario as same-disk-exact-address-active-mutator/v3: independent 5-second termination, 26-second outage/survivor-progress, 45-second startup, 37-second Openraft recovery/readiness-observation (a 26-second recovery envelope plus one reserved 11-second final all-voter readiness round: 10 seconds for the backend operation and 1 second for bounded local result delivery), 25-second journal-reconciliation, and 26-second higher-fence-resume deadlines compose to a 164-second crash-to-resume ceiling. Each stage fails independently; the total is not a shared timer. This fixes an under-composed v1 qualification deadline that charged all six stages to one 26-second clock without changing the separate 26-second survivor-availability and operation-recovery SLOs. It does not change Openraft's sole commit authority, HKMS/provider placement, encryption, AAD, or durable formats, and it does not prove deployed production readiness. Real network/storage partitions, broader active-mutator restart, fault, and reconnect-storm matrices, deployed resource/soak, remote-HKMS, deployed-network, and signed independent evidence remain open under #164/#143. #159 implements ordinary response/watch frame and write-deadline enforcement plus transaction-ID wire containment. #167 now supplies the production StableId model, bounded Serde, store/cache/Openraft/restore/replication/watch enforcement, privacy derivation, and version-3 migration audit/runbook. #168 implements the bounded durable transaction-ID type, canonical coordinator mint, exact legacy preservation, relational/JSON checks, and migration runbook coordinated with #127/#128/#143; #171 implements bounded log-range cursor semantics. #177 removes opc-persist's private TCP transport entirely: config consensus consumes the shared opc-consensus ports, while production mTLS deadlines and credential lifecycle remain opc-session-net/CNF responsibilities. #143 owns distributed and payload-key production qualification; #168's implementation is not by itself that qualification.

For revision-2 rollout, any retained stable/transaction ID outside the wire profile requires a decoder-first #167/#168 migration or coherent store replacement while writers are quiesced; the strict decoder must verify the result before writers restart. Rollback must likewise install a decoder for the retained target representation before old writers restart, or restore a coherent checkpoint/run a reviewed reverse migration. #159 supplies no such model/persistence migration and never authorizes truncating or renaming an identity.

Gap ID	RFC	Title	Disposition / reference	Owner	Mitigation
GAP-001-004	001	Prometheus metrics not emitted for queue/latency/authz/persistence/audit failures	none (closed)	`opc-config-bus`, `opc-nacm`, `opc-persist`, `opc-session-store`, `opc-alarm`, `opc-redaction`	Closed (June 2026): Implemented SdkMetrics registry and text exporter covering config-bus queue/latency, persistence HA consensus, session store, NACM authz, alarms, and runtime health.
GAP-001-005	001	Disk-full, fsync-failure, corrupt-WAL fault injection missing	none (closed)	`opc-sdk-integration`	Closed (June 2026): Added reusable `FaultInjectingStore` and `FaultType` harness behind `opc-persist/dangerous-test-hooks`, proving config persistence, rollback, audit-chain verification, and recovery fencing fail closed under disk-full, fsync/write failure, corrupt database/WAL, and partial persistence faults.
GAP-001-006	001	Config-store carrier HA qualification	high (open)	`opc-config-bus-consensus`, `opc-consensus`, `opc-persist`, `opc-session-net`	#177 moves `ConsensusConfigStore` to the single Openraft engine, removes the custom Raft/majority/TCP authorities, fences SQLite atomically, enforces the sealed/redacted payload boundary, and implements exact offline legacy recovery by checksum, applied head, and explicit unknown-suffix discard. #250 adds the shared ciphertext-only config-bus adapter and atomic named rollback labels without creating another consensus path. A deterministic two-writer integration proves that competing encrypted successors with the same parent and version are decided at Openraft apply: exactly one succeeds and all three replicas retain the same strict lineage without the loser. Bounded in-process lifecycle integrations stop actual Openraft engines rather than merely isolating their transports. Follower evidence commits and reads through the live survivor pair, reopens the same stable identity from its existing SQLite-backed Openraft state with every peer path still disconnected, proves that the non-empty pre-stop encrypted history and applied/committed indices are restored before any catch-up traffic, and then proves exact history/metadata catch-up plus continued writes on all three replicas. Actual-leader evidence requires a different higher-term replacement, performs confirmation and recovery-marker mutations through that authority, proves exact stable-parent `Previous` rollback semantics while pending targets remain unavailable, commits a compensating rollback, reopens the stopped leader from the same disk, and converges exact encrypted history and markers before and after a full rebuild. A bounded unclean-restart slice starts all three in-process config engines in one child process, publishes only a synced SHA-256 digest after a rich encrypted append returns `Ok` and reads back, kills the child without Openraft shutdown, reopens the same three SQLite paths, and proves every replica's full-record digest plus known lineage, recovery, and replay fields match while durable canary scans remain clear. This is whole-child same-host crash/rebuild evidence, not separate per-member processes, deployed storage/network, or remote-HKMS evidence. Co-resident in-process evidence rejects wrong-scope requests and correct-scope foreign-group members before inner decoding without changing either authority, fully stops and reopens config engines while session writes continue, and drives a complete session quorum-path outage and heal while config commits continue. The session phase does not claim engine or process teardown. The frozen v2/v4 session-HA profiles remain byte-identical at their historical 26-crate closure and do not qualify this adapter; a locked metadata test independently enforces the current 27-crate closure until an additive follow-up qualification change defines candidate evidence. AMF-lite evidence qualifies the three-node provider/HKMS boundary across key rotation, followers, snapshots, restart, and durable canary scans. Shared transport evidence forms a real three-node config Openraft cluster and commits/linearizably reads over mTLS; it also qualifies a renewed SVID on a subsequent new call/full handshake and wrong-scope rejection, not seamless connection retirement. Production qualification under `GAP-001-006` still requires multi-group deployed evidence plus remote-HKMS, out-of-process/deployed-network compatibility and multi-process restart/rejoin, resource/failover/soak evidence, seamless fleet credential rotation under the existing shared transport lifecycle, and candidate-specific release evidence. Rollback from migration is only the preserved pre-migration backup.
GAP-002-001	002	Full Rust code emission for presence/default semantics	none (closed)	`opc-yanggen`	Closed (June 2026): Implemented Rust struct and enum generation supporting presence containers, defaults, nested lists, and multi-key lists.
GAP-002-002	002	RFC 7951 serializer/deserializer generated	none (closed)	`opc-yanggen`	Closed (June 2026): Extended serde helper logic to qualification, YangEmpty, decimal64, leaf-list array serialization, and invalid format rejection.
GAP-002-003	002	Generated iterative validation emitted	none (closed)	`opc-yanggen`	Closed (June 2026): Added semantic constraint generation for XPath must, when, O(n log n) leafref lookup, unique constraints, and bounded depth.
GAP-002-004	002	Patch-applicator generation	none (closed)	`opc-yanggen`	Closed (June 2026): Implemented fail-closed patch applicator supporting gNMI/NETCONF operations (replace, update, merge, delete, remove) with robust escaped path keys.
GAP-002-005	002	Generated `SecretLeaf` and data-class annotation emission	none (closed)	`opc-yanggen`	Closed (June 2026): Added support for explicit OPC data-class extensions, generating metadata maps, and Redactable synchronization using deterministic FNV-1a hashing for list keys.
GAP-002-006	002	Go/Kubernetes projection removed from SDK codegen boundary	none (not-applicable)	`opc-yanggen`, `operator-lifecycle`, `operator-controller`	Scope corrected (June 2026): RFC 002 now requires Rust schema metadata consumable by RFC 009 operator policy helpers. Product Go/Kubernetes CRD generation is operator-owned, not an `opc-yanggen` feature.
GAP-003-001	003	TLS acceptor/client reload and SPIFFE-SVID watch missing	none (closed)	`opc-identity`, `opc-tls`	Closed base gap (June 2026): Implemented reloadable SvidWatcher and dynamic mTLS client/server configs. Hardened projected-volume publication under #161 with one immutable `..data` generation, fixed material/work bounds, monotonic typed status, and expiry-safe last-good retention. #162 implements coherent handshake material epochs and #163 consumes them for finite session-net connection retirement/reauthentication; fleet rotation evidence remains #164 under #158.
GAP-003-002	003	Telemetry label cardinality enforcement missing	none (closed)	`opc-redaction`, `opc-types`	Closed (June 2026): `metrics_label_safe` sanitizes and bounds Prometheus label values, redacting tenant-like identifiers, SPIFFE IDs, subscriber IDs, IP addresses, paths, SQL/database details, tokens, secrets, UUIDs, and high-cardinality values before export.
GAP-003-003	003	gNSI-inspired security policy service	none (closed)	`opc-persist`	Closed (June 2026): Implemented gNSI-inspired SDK security policy service (`SecurityPolicyService`) in `opc-persist` with tenant-scoped, audited, and encrypted staging, validation, atomic apply, and rollback. See docs/gnsi-compatibility.md.
GAP-003-004	003	Durable KMS-backed key providers	none (closed)	`opc-key`	Closed (June 2026): Implemented `KmsKeyProvider` supporting purpose-separation, tenant-scoping, rotation, historical-key lookup, and zeroization over mTLS TCP KMS or local Unix-socket KMS agents. Unauthenticated TCP KMS fails closed. Direct PKCS#11/HSM plugins remain optional adapters rather than part of this closure.
GAP-003-006	003	Break-glass module does not exist	none (closed)	`opc-persist` / `opc-nacm`	Closed (June 2026): Implemented stateful request, approval, duration limits, migrations, alarms, metrics, and HMAC-chained audit log for emergency break-glass sessions.
GAP-003-007	003	SPIRE/KMS fault injection tests missing	none (closed)	`opc-sdk-integration`, `opc-security-testkit`	Closed (June 2026): Added mock SPIRE socket and KMS fault injection fixtures with comprehensive fail-closed integration tests.
GAP-004-004	004	Session-store HA/ordered-replication backend is not production-ready	high (open)	`opc-consensus`, `opc-session-store`, `opc-session-net`	#127 provides one Openraft commit authority, exact cluster/configuration/epoch and stable-node identity, dedicated authenticated consensus transport, linearizable readiness/reads, deterministic committed journal/watch output, bounded snapshots, response-loss idempotency, and payload-encryption isolation from HKMS. It removes the custom majority-prefix coordinator and rejects raw replication/rebuild authority. #128 provides current-format reconciliation; #129 provides bounded default-deny legacy recovery with full-fleet quarantine, immutable checkpoint installation, Openraft-committed fencing, and HKMS isolation; and #133 provides bounded snapshot-bound applied-state restore. #145/#171 provide atomic bounded watch handoff and bounded replication-log cursor semantics. #167/#168 structurally bound stable and durable transaction identities and supply count-only migration audits without changing HKMS payload boundaries. #148 adds bounded coordinator-authored absolute expiry, deterministic apply/replay checks, a payload-free authenticated authority preflight before cache/provider/HKMS/backend side effects, and an offline migration audit without changing payload/HKMS boundaries. #161 projected-material safety, #162 coherent material epochs, and #163 finite retained-connection retirement/reauthentication with request/watch continuity are implemented without changing the HKMS/payload boundary. Both durable domains now use one shared runtime/transport timing profile and the exact per-campaign-resampling Openraft fork; cached mTLS reuse, contained cold reconnect, exact family deadlines, and stable-leader follower-listener catch-up have component evidence; its 26-crate release closure is source-build-only. Actual-leader-loss foundation evidence is green but does not graduate the profile. Production status remains high/open on #164 fleet trust overlap/removal, short-lived-SVID expiry/root cutover, rollback, and reconnect evidence plus #143's distributed compatibility, full failover matrix, resource, soak, payload-key, and candidate-release qualification. Immediate generic CRL/OCSP/certificate-or-identity-denylist revocation remains unsupported.
GAP-004-006	004	Dedicated cache invalidation module	none (closed)	`opc-session-cache`	Closed (June 2026): Implemented `SessionCache` in `opc-session-cache` providing read-through local caching gated by verified watch-cursor coherence, background watch-based invalidation, direct backend fallback while lagging, delegated mutation invalidation, sequence tracking, and manual resync.
GAP-004-007	004	Session HA/split-brain/failover testkit	#143 (open)	`opc-session-testkit`	The testkit drives the production-path Openraft adapter through controllable in-process peer paths and covers formed-cluster quorum loss/heal and response loss without implementing another quorum algorithm. File-backed #128/#129 tests cover current divergence, two-/three-branch legacy recovery, full-fleet backup-before-mutation, failpoint resume, stale evidence, corrupt artifacts, recovery fencing, atomic watch handoff, and bounded journal cursor semantics. The 3- and 5-process foundation covers coherent actual-leader observation, different higher-term survivor election, an old-leader-outage generation read, same-disk restart/catch-up, convergence, and independent checking of the original history. A bounded external Kubernetes runner drives the private same-binary socket, resets and updates an AND-only custom Pod evidence gate from exact-identity fresh Openraft barrier reports, executes the frozen v1 15-operation lease/fence/CAS/read schedule across the fleet, latches the first failure, and atomically retains an exact command/reply transcript, v1 schedule/history, and readiness-only v3 fragment. An independent kubelet exec probe uses layered deadlines against the local UDS, so quorum loss, probe hangs, and process exit self-expire readiness without external cleanup. The v1 artifacts are schema-bound and independently checkable; the v3 fragment still supplies no batch/watch/restore evidence. The additive v5 contract/checker reflects the real per-slot partial batch semantics, binds every key to one pre-acquired campaign-valid lease guard, compares the complete non-expiring authoritative record shape, caps watches at possible journal heads, indexes each restore prefix once, derives quorum from a digest-bound fault schedule, and separates application-journal sequences from Openraft indices. Its pure bounded collector validates the full schedule and history-derived isolated state type, transactionally admits typed child observations, correlates real watch events in serialized batch/slot order, and models terminal state. A deployed adapter reuses the shell-free kubectl/private-UDS port to preflight the isolated scope, execute the protected batch once, retain per-member gate intervals, conservatively mark loss from earliest disable dispatch through latest enable acknowledgement, boundedly sample loss/recovery, require the unchanged common terminal journal head, consume the real watch, scan terminal restore state, and feed the typed result to that collector; staggered three- and five-member fake-port outputs pass the frozen independent checker, while partial actuation and non-convergence withhold history. A separate Linux-only executable now preflights a trusted destination/interpreter before mutation and atomically publishes only cleanup-complete frozen-checker and additive workload-verifier passes. The exact v5 machine-readable profile pins the crate/feature/platform/protocol/threshold inventory and all v5 verifier contracts named by the evidence; each private atomic bundle retains those profile bytes and binds them in its v2 summary alongside the v5 history, fault and workload schedules, closed candidate evidence, both explicitly digest-pinned programs, and both bounded outputs. Pre-commit token cancellation, verification faults, and untrusted parents withhold publication; no-replace races fail closed, while abort-versus-commit ambiguity is quarantine-only. The candidate remains experimental; `qualification_complete` and `counts_for_production` remain false. No live Kubernetes campaign or retained exact release-image/platform inventory is included, and frozen v3/v4 remain unchanged. Multi-node restart/rejoin, deployed-network/mTLS failover, full crash/partition matrices, permanent-record cleanup/attestation, resource bounds, soak, and complete live independently checked release evidence remain #143; maturity remains experimental.
GAP-005-001	005	Concrete allocation-free GTP-U parser proof	none (closed)	`opc-proto-gtpu`	Closed (June 2026): Added `opc-proto-gtpu`, proving borrowed zero-copy GTP-U header and extension parsing over the shared `opc-protocol` traits.
GAP-005-002	005	Protocol-specific fuzz harnesses	none (closed)	`opc-proto-gtpu`	Closed (June 2026): Added protocol-specific `decode` and `roundtrip` fuzz targets, corpora, fuzz build validation, and deterministic regression tests for prior fuzz inputs.
GAP-005-004	005	`@spec`/`@conformance` tags not yet emitted from parsers	none (closed)	`opc-proto-gtpu`	Closed (June 2026): GTP-U parser code includes `@spec`, `@req`, and `@conformance` tags mapped to 3GPP TS 29.281 sections.
GAP-005-005	005	No `crates/opc-proto-*` crates exist yet	none (closed)	`opc-proto-gtpu`	Closed (June 2026): `crates/opc-proto-gtpu` establishes the first concrete protocol-crate layout with tests, fuzzing, corpus, and conformance notes.
GAP-006-001	006	Automated evidence extraction from source code not yet wired	none (library scope closed)	`opc-evidence`	`extract.rs` provides the scanner API. End-to-end repository/workflow integration remains tracked by `GAP-006-007`.
GAP-006-002	006	SBOM/VEX generation modules not yet implemented	none (library scope closed)	`opc-evidence`	SBOM generation and VEX validation APIs exist. Release production and evaluation remain tracked by `GAP-006-007`.
GAP-006-003	006	SLSA/in-toto provenance emission not yet implemented	none (library scope closed)	`opc-evidence`	The provenance generator API exists. Release emission and validation remain tracked by `GAP-006-007`.
GAP-006-004	006	Signing and bundle assembly not yet implemented	none (library scope closed)	`opc-evidence`	Bundle and external signer/verifier traits exist; signing inputs are deterministic and domain-separated, signer identity is bound, manifest structure fails closed, embedded blobs are signature-covered, and release policy evaluates only the exact signed artifact values. Production signer/verifier wiring and workflow verification remain tracked by `GAP-006-007`.
GAP-006-005	006	Performance-baseline schema and capture not yet implemented	none (library scope closed)	`opc-evidence`	Performance schema and comparison helpers exist. Candidate capture and gating remain tracked by `GAP-006-007`.
GAP-006-006	006	Gate enforcement scripts not yet implemented	none (library scope closed)	`opc-evidence`	`GateEvaluator` exists as a library API. PR/release invocation and complete fail-closed evidence enforcement remain tracked by `GAP-006-007`.
GAP-006-007	006	End-to-end RFC 006 PR/release workflow integration	high (open)	`opc-evidence`, release engineering	Wire repository inventories, artifact producers, a production external signer/verifier, bundle construction, and `GateEvaluator` into CI/release; fail releases on missing or inconsistent evidence. Exact signed-artifact cross-checking is enforced by the library.
GAP-007-001	007	Full HTTP/2 client/server integration incomplete	none (closed)	`opc-sbi`	Closed (June 2026): Added `SbiServerBuilder` and `SbiClientBuilder` implementing HTTP/2 connection handling, bounded pooling, request/response body limits, timeouts, and redacted error handling. Post-review hardening added explicit production-mode TLS/auth/trust-bundle validation.
GAP-007-002	007	JWT-SVID validation and token cache not yet implemented	none (closed)	`opc-sbi`	Closed (June 2026): Implemented `SbiJwtValidator` with fail-closed JWKS cache, RS256 key filtering, required `exp`/`nbf`, strict SPIFFE subject parsing, and bounded `ClientTokenCache` token acquisition.
GAP-007-003	007	Full NRF registration lifecycle is a shell	none (closed)	`opc-sbi`	Closed (June 2026): Implemented `NrfClient` registration, deregistration, heartbeat driver with backoff, encoded discovery requests, and discovery cache with TTL/stale controls.
GAP-007-004	007	Admission-control middleware is a shell	none (closed)	`opc-sbi`	Closed (June 2026): Implemented concurrency-based admission-control middleware returning safe 503 `ProblemDetails` with `Retry-After`; retry handling is idempotency-aware for both 429 and 503 peer responses.
GAP-007-005	007	Circuit-breaker state machine and metrics not yet implemented	none (closed)	`opc-sbi`	Closed (June 2026): Implemented client circuit breaker with closed, open, and half-open state transitions, metrics, and half-open probe limits.
GAP-007-006	007	OpenAPI/model generation	partial — `openapi-codegen-plan.md`	`opc-api-nnrf`	Partially closed (June 2026): `opc-api-nnrf` pilot generates `NfProfile`/`NfService` from pinned TS 29.510 YAML. Remaining: extend generation to further TS 29.5xx interfaces.
GAP-007-007	007	Full producer/consumer mock pair not yet complete	none (closed)	`opc-sbi`	Closed (June 2026): Expanded testkit with MockProducer, MockConsumer, MockJwksResolver, and failure fixtures.
GAP-008-002	008	Authorized admin/probe routes	none (closed)	`opc-runtime`	Closed (June 2026): Implemented full authorized admin/probe router in `opc-runtime` providing token-gated access in Production/Lab mode for health, metrics, and debug routes (`/debug/runtime`, `/debug/tasks`, `/debug/config-version`) with HTTP hardening and error/path redaction.
GAP-008-003	008	Tokio runtime builder enforcement incomplete	none (closed)	`opc-runtime`	Closed (June 2026): Added `RuntimeProfile::tokio_runtime_builder` for binaries that let the SDK own Tokio runtime creation, validating worker/blocking-thread bounds and production budgets before build. `Builder::build()` remains the async in-runtime chassis builder and enforces production budget presence, budget validity, registered task limits, and memory-pressure admission. Queue byte limits remain component-owned and are enforced where queues are allocated, such as `opc-config-bus`.
GAP-008-004	008	Hung-task and memory-budget fault injection missing	none (closed)	`opc-sdk-integration`	Closed (June 2026): Implemented deterministic integration fault injection tests for task hangs (shutdown hang, lack of heartbeat progress, exceeding restart policies) and memory-budget pressure (allocation watchdog limiter), verifying fail-closed task spawning, health status degradation, alarm emission, and `opc_runtime_budget_exhausted_total` metrics tracking.
GAP-009-001	009	Operator/NF/version compatibility policy enforcement	none (closed)	`operator-lifecycle`, `operator-controller`	Closed (June 2026): Implemented machine-readable compatibility policy and matrix validation for admission, config apply, CRD conversion, and migration orchestration.
GAP-009-002	009	Stable lifecycle phases/conditions	none (closed)	`operator-lifecycle`	Closed (June 2026): Implemented stable operator lifecycle phases and conditions with monotonic timestamp/generation transition validation.
GAP-009-003	009	Operator config-apply decision module	none (closed)	`operator-lifecycle`	Closed (June 2026): Implemented operator config-apply decision logic enforcing commit-confirmed timeouts, rollback deadlines, critical alarms, and degraded states.
GAP-009-004	009	CRD conversion webhook helpers	none (closed)	`operator-controller`	Closed (June 2026): Implemented deterministic conversion between v1alpha1 and v1beta1 specs with Kubernetes-style JSON names, strict unknown field rejection, defaulting, status preservation, and redacted errors.
GAP-009-005	009	Migration orchestration	none (closed)	`operator-controller`	Closed (June 2026): Implemented schema/state migration plans, static plan validation, preflight safety gates, and fail-closed sequential execution.
GAP-009-006	009	Operator drain client	none (closed)	`operator-controller`	Closed (June 2026): Implemented out-of-process drain executor executing NRF deregistration, session drain, quorum, and workload fencing under strict deadline limits; empty/non-drain plans fail closed.
GAP-009-007	009	Rollback evaluator	none (closed)	`operator-lifecycle`	Closed (June 2026): Implemented rollback evaluator choosing only confirmed configurations in history.
GAP-009-008	009	Multi-cluster orchestration	none (closed)	`operator-controller`	Closed (June 2026): Implemented multi-cluster rollout status aggregation model with monotonic generations/resource versions, cluster identity validation, stale status updates rejection, and split-brain warning propagation.
GAP-010-001	010	YANG-to-DataClass annotation emission	none (closed)	`opc-yanggen`, `opc-data-governance`	Closed (June 2026): Integrated YANG extensions (security-secret and subscriber-id) from IR lowering through codegen to emit persistent classification mappings.
GAP-010-002	010	Metrics-label enforcement and support-bundle redaction missing	none (closed)	`opc-redaction`	Closed (June 2026): Implemented support bundle redaction API with key diagnostics types, redaction summary tracking, and Production mode fail-closed policies.
GAP-010-003	010	`RetentionPolicy` schema	none (closed)	`opc-data-governance`	Closed (June 2026): Implemented RetentionPolicy schema and validation logic with PolicyError and safe Display implementation.
GAP-010-004	010	Backup/restore/export metadata contract	none (closed)	`opc-export`	Closed (June 2026): Implemented opc-export contract model with round-trip serialization and production-safe validation rules. Product multi-cluster backup/restore orchestration is outside the SDK foundation and belongs to downstream operators.
GAP-010-005	010	Lawful-intercept SDK boundary	none (closed)	`opc-data-governance`, `opc-redaction`, `opc-export`, `opc-privacy`	Closed as SDK boundary (June 2026): LI material is represented as a protected data class with cleartext denial and classification-aware export/analytics policy. Product LI mediation, collection, and jurisdiction-specific workflows are not SDK foundation requirements.
GAP-010-006	010	Analytics minimization module	none (closed)	`opc-privacy`	Closed (June 2026): Implemented privacy minimization policy, cohort size thresholds, k-anonymity validation, binning, and subscriber ID digest hashing.
GAP-010-007	010	Data-governance-specific evidence report	none (closed)	`opc-evidence`	Closed (June 2026): Extended opc-evidence with DataGovernanceEvidenceReport struct and integrated it into GateEvaluator with safe checks.
GAP-011-001	011	`opc-node-resources` resource model	none (closed)	`opc-node-resources`	Closed (June 2026): Implemented structured resource profile and node capability models, including `DataPlaneProfile`, CPU/NUMA layout, NIC, hugepage, BPF artifact, pod-security, and preflight validation. Go CRD projection and live Kubernetes operator wiring are outside this crate boundary because the Go operator remains a reference harness only.
GAP-011-002	011	Operator admission preflight	none (closed)	`operator-lifecycle`	Closed (June 2026): Implemented preflight admission checks for production specs: checks HA config/session backends, tokens, KMS/SPIFFE, resource profiles, and CPU layout with redaction-safe messages.
GAP-011-003	011	CPU, NUMA, hugepage, NIC, and CNI assumptions are explicit	none (closed)	`opc-node-resources`	Closed (June 2026): Implemented layout modeling and validation for CPU isolated/reserved sets, NUMA node mappings, hugepage pools, NIC capabilities, and CNI assumptions.
GAP-011-004	011	AF_XDP/eBPF programs are governed by signed/digest-pinned artifacts	none (closed)	`opc-node-resources`	Closed (June 2026): Implemented BPF artifact model enforcing digest pinning, signer validation, attach-point constraints, and security capabilities.
GAP-011-005	011	Pod security exceptions are minimal and evidence-linked	none (closed)	`opc-node-resources`	Closed (June 2026): Implemented pod security exception validation rejecting overbroad permissions and verifying evidence link IDs.
GAP-011-006	011	Readiness depends on data-plane preflight	none (closed)	`operator-lifecycle`, `opc-node-resources`	Closed (June 2026): Implemented `DataPlanePreflightReport` checks integrating into admission webhook and configuration-apply readiness gating.
GAP-011-007	011	Lab fallback cannot silently enter production	none (closed)	`opc-node-resources`	Closed (June 2026): Implemented lab/dev fallback gating rejecting any fallback paths in Production environment mode.
GAP-012-001	012	Procedure-faithful AMF/SMF/UPF simulators not yet complete	none (closed)	`opc-testbed`	Closed (June 2026): Implemented stateful, procedure-faithful AMF, SMF, and UPF simulator state machines with deterministic chaos/failure/clock injection.
GAP-012-002	012	Per-NF `opc-<nf>-testkit` crates do not yet exist	none (closed)	`opc-amf-lite-testkit`	Closed (June 2026): Implemented `opc-amf-lite-testkit` exposing reusable test fixtures, profile builders, config bus, validated in-process session topology setups, and documented a standard pattern for downstream CNFs.
GAP-012-003	012	`kind` and `hardware-lab` mode runners not yet implemented	none (closed)	`opc-testbed`	Closed (June 2026): Implemented `LocalRunner`, `KindRunner` (manifest dry-run plan generator and Kubernetes configuration validator), and `HardwareLabRunner` (preflight validator via `opc-node-resources` and dry-run plan generator, falling closed when hardware evidence is missing and skipping live execution without live lab resources).
GAP-012-004	012	First real NF vertical integration proof	none (closed)	`opc-amf-lite`	Closed (June 2026): Implemented `opc-amf-lite` control-plane vertical slice integrating the core SDK seams (runtime, config-bus, validated in-process session topology, NACM, alarms, KMS, metrics) under test-only failover chaos, strict-prefix catch-up, and security scenarios. This is composition evidence, not production session HA qualification.
GAP-013-001	013	Per-CNF alarm adoption remains pending until CNF crates land	none (closed)	`opc-alarm`, `opc-runtime`, `opc-config-bus`	Closed (June 2026): Defined the per-CNF alarm adoption contract in docs/operator-readiness.md and added testkit validation coverage.
GAP-013-008	013	Alarm taxonomy lacks explicit version marker and compatibility contract	none (closed)	`opc-alarm`	Closed (June 2026): Added `TAXONOMY_VERSION` and documented severity/cause compatibility rules with serialization tests.
GAP-013-003	013	`opc-alarm-k8s` does not exist	none (closed)	`opc-alarm-k8s`	Closed (June 2026): Created the `opc-alarm-k8s` crate to project alarms to Kubernetes conditions and events.
GAP-013-004	013	`opc-alarm-yang` does not exist	none (closed)	`opc-alarm-yang`	Closed (June 2026): Created the `opc-alarm-yang` crate containing the static YANG schema and RFC 7951 JSON projections.
GAP-013-006	013	Async sink adapter with bounded buffering not yet implemented	none (closed)	`opc-alarm`	Closed (June 2026): Implemented `BoundedAlarmSink` with queue limits, retries, fail-closed handling, and Recording/Tracing sinks.
GAP-013-007	013	`opc-alarm-testkit` does not exist	none (closed)	`opc-alarm-testkit`	Closed (June 2026): Created the `opc-alarm-testkit` crate with asserters, polling helpers, and sensitive data redaction checks.
GAP-K8S-001	009	Go SDK reference operator harness	none (closed)	`operators/sdk-reference-operator`	Closed (June 2026): Implemented a Go controller-runtime reference operator under `operators/sdk-reference-operator` demonstrating admission, conversion, reconciliation, and packaging. Post-review hardening aligned Go CRD and bridge schemas with the Rust SDK policy JSON contract and made Go tests build the Rust CLI from a clean checkout.
GAP-K8S-002	009	Live Kubernetes webhook/controller plumbing	none (closed)	`operators/sdk-reference-operator`	Closed (June 2026): Added webhook registration, conversion endpoints, reconciler loop plumbing, and Kustomize manifests using the Rust-Go CLI boundary. Validation currently uses rendered manifests plus fake-client controller/webhook tests; downstream CNF operators still need envtest/kind/cluster suites.
GAP-PROTO-003	005	NGAP codec (ASN.1 APER)	partial — `ADR 0013`	`opc-proto-ngap`	Partially closed (June 2026): `rasn` spike succeeded on MSRV 1.88; the codec ships outcome-aware NGAP-PDU framing, fixture-proven NGSetupRequest decode, structural typed dispatch for the first AMF N2 procedure subset, fail-closed recognized-message decode errors, raw-preserving encode, and a pinned Wireshark ASN.1 source. Remaining: external field-level fixtures for the structural subset and canonical typed encoding (blocked on the `rasn` 0.28 APER encoder alignment issue).
GAP-PROTO-004	005	OpenAPI SBI codegen	partial — `openapi-codegen-plan.md`	`opc-api-nnrf`	Partially closed (June 2026): pilot expanded to TS 29.510 NFManagement `NfProfile`/`NfService` plus `SubscriptionData`/`NotificationData` and supporting event/condition enums; compatibility test with `opc-sbi` added. Remaining: broader TS 29.5xx interfaces and schema-sanitization hardening.
GAP-PROTO-005	005	PFCP codec (TS 29.244)	closed (codec scope) — `CONFORMANCE.md`	`opc-proto-pfcp`	Closed (June 2026): `opc-proto-pfcp` ships a header + IE TLV layer, heartbeat/association/session messages, and typed session-management IEs including QFI, Gate Status, MBR, GBR, and QER grouping. Spec-byte fixtures, byte-exact round-trips, negative tests, and a fuzz target are in place. Full message semantic validation and non-SMF/UPF message types are outside the codec boundary.
GAP-PROTO-006	005	NAS v2 codec: first-CNF body dispatch and NAS security hooks	closed (scoped) — `opc-proto-nas`	`opc-proto-nas`	Closed (June 2026): Added IE-level decoding for Registration Request/Accept and Security Mode Command/Complete, named raw-preserving 5GMM/5GSM first-CNF body dispatch, optional-IE raw preservation, BCD unpacking for PLMN/routing indicator/IMEI/IMEISV, NAS COUNT/replay helpers, `opc-key` session key-handle validation, and caller-provided NAS integrity/ciphering hooks. In-tree null algorithms cover NIA0/NEA0; concrete NIA1/2/3 and NEA1/2/3 implementations and NAS procedure state machines remain external to the codec.
GAP-PROTO-007	005	GTPv2-C S2b typed subset	partial — `CONFORMANCE.md`	`opc-proto-gtpv2c`	Partially closed (July 2026): `opc-proto-gtpv2c` ships an experimental S2b subset with raw-preserving GTPv2-C header/IE handling, typed Echo/Create/Modify/Delete session views, and complete claimed triggered Create/Update/Delete Bearer message shapes. ProcedureAware receive applies TS 29.274 first-occurrence singleton semantics per exact top-level/Bearer-Context-instance scope, classifies crate-known type/instance keys with a message grammar before value decoding, applies explicit S2b applicability for exact endpoint roles, preserves genuinely unknown optional keys, retains bounded value-free duplicate evidence, and truncates declared lists at their table bounds while canonical builders remain duplicate-strict; typed projections enforce endpoint value semantics and correlation. S2b Create Session sends the requested family only in PAA, exposes explicit dynamic/static allocation constructors, rejects top-level PDN Type, and discards that unexpected known IE on receive. Its conditional intent now distinguishes subscriber/UICC-less emergency identity, records AAA/HSS MSISDN provenance, types charging/trace/WLAN/UE-NAT context, and separates the optional Create-only ePDG IKEv2 endpoint from the UE endpoint. Delete Session requires the S2b UE Local IP and types its procedure-specific UDP/TCP instances, WLAN context, and Diameter/IKEv2 release cause. Accepted Create Session Responses default to PGW control instance 1/type 32 and user-plane type 33; a finite one-shot receive policy can independently add only standardized S5/S8 control type 7 and user-plane type 5 while builders and all no-policy entry points remain strict. S2b Modify Bearer models the UE-initiated IPsec tunnel update with independently optional typed WLAN location/timestamp, a Fixed Broadband local-IP/conditional-UDP endpoint, first-occurrence receive, discard of the non-S2b Bearer Context shape, and Cause/sequence/TEID response correlation. Dedicated-bearer coverage uses the canonical shared TFT codec, validates Create-new/uplink TFT semantics, typed Bearer QoS/ARP and standardized QCI rate rules, APN-AMBR, S2b-U F-TEID roles, partial outcomes, exact per-bearer correlation, and Message Priority propagation. Bounded generation-safe triggered transactions fence timed-out work until explicit cancellation acknowledgement, prevent duplicate side effects, and replay exact committed bytes. Hostile-input tests, conformance fixtures, and fuzz seeds cover the declared boundary. Remaining work includes other S2b procedures/IEs outside the declared matrix, independent capture provenance where used, and downstream product UDP, persistence, IKEv2 Child-SA lifecycle, and dataplane policy outside the SDK boundary.
GAP-PROTO-008	005	IKEv2 codec scaffold	partial — `CONFORMANCE.md`	`opc-proto-ikev2`, `opc-ipsec-xfrm`	Partially closed (July 2026): `opc-proto-ikev2` ships an experimental IKEv2 fixed-header and generic payload-chain scaffold, unknown payload preservation, typed executable SA_INIT profiles and product-neutral proposal selection, a strict opened IKE-SA rekey `CREATE_CHILD_SA` request/selection/exact-response boundary, PRF-HMAC-SHA2-256/384/512 initial/rekey/Child key derivation and restore, AES-GCM-128/192/256 plus AES-CBC-128/192/256 with SHA2 integrity for `SK` and `SKF`, typed ENCR_NULL authenticated-only ESP Child-SA negotiation/restore and zero-encryption-key KEYMAT, NAT-D semantic evaluation, typed IKE_AUTH cleartext helpers for ID/AUTH/EAP/CP/SA/TS/Notify/Delete payloads, shared-key AUTH MIC computation/verification, product-neutral Child SA selection intent, RFC 7383 fragment framing and decrypted-fragment reassembly helpers, and typed TS 24.302 R17 multiple-bearer notifications plus strict opened-payload primitives for new non-rekey dedicated-bearer `CREATE_CHILD_SA`, modification, deletion, and response correlation. RFC/independent vectors, a literal synthetic capture-shaped SA_INIT-to-protected-IKE_AUTH proof, byte-exact AEAD and encrypt-then-MAC IKE-SA rekey vectors, and hostile-input tests cover the claimed crypto mechanisms; registered fuzz targets cover the message/raw/dedicated-bearer codec boundaries listed in the crate conformance matrix. `opc-ipsec-xfrm` adds an opt-in exact mapper from negotiated ESP Child SA intent to bidirectional XFRM SA/policy install requests, including Linux's canonical zero-key NULL cipher plus separate auth representation, and an exact current-upstream single-SA outer-endpoint/NAT-T relocation primitive with a collision-free missing-SA capability probe. A privileged namespace test proves bidirectional authenticated-only ESP delivery and tamper rejection; no SDK policy enables or prefers ENCR_NULL. The relocation primitive is SA-only, not cancellation-safe once polled, and requires product-owned authenticated signalling, policy coordination, writer serialization, cancellation/process-loss reconciliation, supporting kernel UAPI, and live mobility evidence. Remaining work includes broader remaining payload-body coverage, independent-peer fixture provenance where used, and downstream IKE SA/EAP-AKA state, retransmission timers/caches and fragment queues, SPI allocation, Child SA lifecycle/XFRM policy, and carrier qualification outside the SDK boundary.
GAP-PROTO-009	005	Diameter base scaffold (RFC 6733)	partial — `CONFORMANCE.md`	`opc-proto-diameter`, `opc-testbed`	Partially closed (July 2026): `opc-proto-diameter` ships an experimental Diameter base-protocol scaffold with RFC 6733 header/AVP framing, raw-preserving message/AVP storage, AVP-region validation, dictionary metadata, feature-gated base peer procedure helpers for CER/CEA, DWR/DWA, and DPR/DPA, typed Rf accounting helpers, typed SWm Diameter-EAP DER/DEA helpers with ePDG-subset semantic validation, and typed SWm STR/STA, ASR/ASA, RAR/RAA, and AAR/AAA lifecycle helpers. The authorization slice includes typed RFC 6733 Authorization-Lifetime/Auth-Grace-Period and TS 29.273 AAA Session-Timeout with command-authoritative cardinality and cross-field validation. Requests retain request-bound identifiers, checked 5005 omission provenance, typed vendor state, exact present session/user/Proxy-Info state, and authenticated connection-generation binding with explicit direct/routed logical-Origin policy; failover retransmission atomically replaces the Hop-by-Hop Identifier and connection binding while preserving End-to-End duplicate identity. Generic E-bit answers may skip logical-Origin policy but remain connection- and transaction-bound. Fully modeled answer emission, deterministic committed-answer reconstruction, maintained-state administrative STR derivation, a public RAR→RAA→AAR→AAA type-state sequence, command-authoritative cardinality, dictionary-validated additional values, and bounded RFC 7683 overload/RFC 8583 Load groups are included. A compiler-external deterministic public-API fixture proves DER/DEA→RAR/RAA→AAR/AAA→STR/STA and a separate DER/DEA→ASR/ASA→derived administrative STR/STA, closing #351's requested generic SWm lifecycle scope without importing product policy. Hostile-input tests, independently authored fixtures, fixture/corpus replay, registered fuzz targets, conformance notes, and an ePDG SDK composition harness in `opc-testbed` are in place. Remaining work includes broader typed application helpers beyond the current Rf/SWm subsets, additional independently sourced fixture intake, and downstream product realm routing/transport/AAA/session-authority behavior outside the SDK boundary.