Quality

RFC Compliance Gate Report

How far Ze meets each RFC it implements, and the tests that prove it. Source: internal/le/rfc, rfc/short/*.md, and rfc/audit/*/*.json.

How to read this page

This page shows how far Ze meets the standards (RFCs) it implements, and how that is proven. For each RFC, Ze keeps a summary that lists every requirement the RFC states and links each requirement to the tests that prove Ze meets it. An automatic check, the gate, reads those summaries and the tests, and the figures on this page are computed from the same summaries and tests.

If you are evaluating Ze for one role, start with Coverage by profile. To check one RFC, find it in the Enrolled RFCs table and open its own page, which lists each requirement and the tests behind it. The terms below are used throughout this page; the per-RFC pages and Ze's source use the same terms.

Glossary of the terms this page uses

Summary: Ze's file for one RFC: it lists the RFC's requirements, the tests behind each one, and the support status Ze publishes for the RFC.
Requirement: one obligation an RFC states, kept in the summary with an identifier such as RFC4271-8.2.2-12 that names the RFC and its section.
MUST-level (mandatory): a requirement stated with MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT. The optional levels are MAY, NOT RECOMMENDED, OPTIONAL, RECOMMENDED, SHOULD, SHOULD NOT.
Enrolled: an RFC whose summary the gate holds Ze to. Summaries that are not enrolled are listed at the end of the page, each with its reason.
Gate, gated: the gate is the automatic check that reads every summary and the tests. A gated requirement is a MUST-level requirement of an enrolled RFC, one the gate holds Ze to.
Positive and negative test (polarity): a positive test proves Ze does what the requirement demands; a negative test proves Ze refuses what the requirement forbids. Tested both ways means both exist.
Tagged unit: one test that names, in a tag, the requirement it proves. One requirement can have several.
Recorded break: the proof that a test can fail: the code under the test was broken once on purpose, the test was seen to fail, and a record stores what the test, its claim and the code looked like. The break is not run again. Ze's source calls this a discrimination record.
Escaped: a tagged unit whose record claims that no break of the code exists. It is not counted as a proof.
Lapsed: a recorded break whose test, claim or code has changed since it was recorded. It is not counted as a proof.
Gap: a requirement the summary openly declares Ze does not meet yet. Every gap is work Ze owes.
Annotation: a note on a requirement, written in braces, that says why it needs no ordinary pair of tests. {single-polarity}: the requirement admits no counter-case, so one direction plus a recorded reason is the whole proof. {not-applicable}: the obligation does not bind Ze. {feature-declined}: the obligation applies only to a feature the RFC makes optional and Ze does not offer. {lower-layer}: a layer under Ze performs the behavior, on state Ze installs into that layer. {gap}: a declared gap. A partial requirement has tests for part of it; the rest is unmet or unproven and earns no credit.
Linux cannot do this: a verified kernel limitation prevents the required primitive. The annotation names the Linux Limitations Register entry. The row is OS blocked: a limit of the kernel, never counted against Ze, so it sits with the rows not owed and in no section of the MUST bar.
Walked, sign-off: a reviewer read the RFC's own text sentence by sentence and checked the requirement list against it; the sign-off records that review. Not walked means the review has not been done, so no figure is counted.
Excluded sentence: a sentence of the RFC that the review decided not to turn into a requirement, with a kind and a reason.
Semantic verdict: a reviewer's recorded judgement that a requirement's tests enforce what the requirement says. Fresh: still current. Shifted: the test is unchanged and only the file around it moved. Stale: what it judged has changed.
Ze proven, Ze MUST proven (bar segment): a MUST row Ze's own code performs, with a tagged test whose recorded break was seen to fail.
OS verified (bar segment): a row a layer under Ze performs (the Linux kernel Ze ships, or a Go library Ze links), with a tagged test that checks that layer's behavior on the state Ze installs, and a recorded break.
OS testing gap (bar segment): a row a layer under Ze performs, with no verified test of that behavior yet. It is a gap in testing, not in correctness.
Ze correctness gap (bar segment): a MUST row Ze's own code owes that no recorded break proves yet: a declared gap, a partial row, a row with no proof, or an exclusion whose evidence does not hold. Every one is work Ze owes.
SHOULD proven (bar segment): a SHOULD or MAY row Ze's code performs, with a tagged test whose recorded break was seen to fail.
Not owed (bar segment): a row that does not bind Ze, shown by checked evidence: it binds a role Ze does not fill, it applies only to an optional feature Ze does not offer, or Linux cannot provide its primitive (OS blocked). It is left out of the MUST bar.
SHOULD not ever (bar segment): a SHOULD or MAY row Ze will never support. Only the project owner sets it.
SHOULD not yet (bar segment): a SHOULD or MAY row Ze intends to support and does not support yet.
SHOULD not decided (bar segment): a SHOULD or MAY row nobody has decided on yet: every unproven optional row starts here.

The gate holds Ze to every MUST-level requirement of the RFCs it implements. The bars and the Total row below put each MUST row of a walked enrolled RFC in one section: proven by Ze's tests, verified in the operating system, not owed, or still owed by Ze or by the operating system's tests. The cards after them say how many tagged tests carry a recorded break and whether the gate passes.

How the enrolled RFCs' requirements are answered

MUST bar

Ze proven 2,121, OS testing gap 239, Ze correctness gap 2,409

Overview bar

Ze MUST proven 2,121, SHOULD proven 109, Not owed 18, SHOULD not decided 1,871, OS testing gap 239, Ze correctness gap 2,409

Total	Ze proven	OS verified	OS testing gap	Ze correctness gap	Not owed	MUST rows
Total	2,121	0	239	2,409	18	4,787

Check: 2,121 + 0 + 239 + 2,409 + 18 = 4,787 MUST rows: the four MUST bar sections and the rows not owed add up to every MUST row of the walked RFCs.

203 enrolled RFCs, of which 0 not walked, so their rows count in no figure above. Ze implements 195 of them: the enrolled RFCs that render a public row. Behind them, rfc/short/ holds 240 summary files, enrolled or not and including those that declare no requirement, listing 7,738 requirements at every level: the size of the lists, not a measure of Ze. Until 2026-10-31 this page led with Gated MUSTs, which counted every MUST row of the enrolled RFCs, annotated rows included, and a percentage proven by test taken over it. The sections replace both: each MUST row of a walked enrolled RFC sits in exactly one of them.

Positive

what Ze has

Proven by a recorded break6,3956,395 of 9,234 tagged units in enrolled RFCs, 11 escaped and 21 lapsed

a red was observed once under a recorded procedure, and the unit, the claim and the producer it rested on still hash to what was recorded. The break is not re-run. A test pair is not a proof until one has been observed

Neutral

measures that are neither good news nor bad

Semantic verdicts2,26717 shifted, 4 stale, 2,499 missing

requirements a reader has judged and whose judgement is still current. A missing verdict is not claimed, and the shifted and stale ones are named on their own RFC's page

Negative

what Ze owes

Gate verdictRED45 open gate issues

whether ./le rfc check passes over this tree

No card above is a part of a population, so there is nothing to add up.

How to read the colors

A color names what the measure MEANS, not how well Ze scores on it. Green is a good outcome at any value, red is a bad one, and neither a population nor a scope count is an outcome, so both take no color. The number under the label is what says how far Ze has got.

Card	Tone here	Why that color
Proven by a recorded break	ok	green at every value: an observed break is the outcome the discrimination gate exists to produce. It counts TAGGED UNITS, not obligations, so this count is not one of the parts above
Gate verdict	bad	the verdict IS the value: green when the gate passes, red when it does not
Semantic verdicts	neutral	no color: a count of judgements recorded is a scale rather than an outcome, and the shifted and stale counts beside it are the states that need reading

Gate verdictRED

45 open gate issues. Check results below names them, up to the 25 this page inlines.

Contributors reproduce it with ./le rfc check. The gate's own line reads rfc-requirements: 45 violation(s).

Coverage by profile

A profile groups the RFCs one kind of deployment needs. If you are evaluating Ze for one role, its profile page gives the figures for that role alone.

This page covers every RFC. Each use case Ze serves and each technology aggregate has its own page, with its MUST bar and overview bar and the RFCs it lists ordered roots to leaves: RFC coverage by profile.

Who implements each document

Some RFCs are carried out by Ze's own code, some by a layer under or beside Ze, and some oblige no implementation at all. This section says which is which, because the figures on this page count only what Ze's own code is held to.

The ledger counts what Ze implements in its own Go. A document another layer performs leaves the gated population and names what performs it, and where Ze can observe the behavior the requirement still carries a test over the state Ze installs.

Implemented by	Summaries	What it means
`foundation`	8	The document defines, registers or describes, and obliges no implementer.
`mixed`	32	Ze implements part in Go and another layer performs the rest. The part Ze's Go answers stays gated.
`third-party`	3	A layer under or beside Ze performs it and Ze holds no Go code for it, so its MUSTs are not gated against Ze.
`ze`	197	Ze's own Go implements the document, and its MUSTs are gated.

Gap disclosure

A gap is a requirement Ze does not meet yet and says so in public. This section counts the requirements declared as gaps and the RFCs that carry them.

Declared gaps	Count
Requirements declared as gaps	1,540
RFCs declaring a gap	132

Exclusion disclosure

Not every sentence of an RFC becomes a requirement. This section counts the sentences a review left out, by the reason given, so you can check what was left out and why.

A reviewer walks an RFC's own text sentence by sentence and decides which sentences become requirements. One that does not is EXCLUDED, with a kind and a reason, and it never reaches the gated ledger at all. That is a different mechanism from the Out of scope card above, which counts requirements that exist and carry a {not-applicable} annotation. Across the sign-offs done so far, 4,863 sentences were mapped to a requirement and 2,236 were declined. 2 of those declines are not scope at all: they are obligations Ze OWES, relocated to a named spec, and they are stated apart below.

227 of the 240 summary files carry an extraction sign-off, 203 of them among the 203 enrolled. The other 13 have no exclusion ledger at all, so what follows counts the walks that HAVE been done and is not the whole picture.

Excluded kind	Means	Sites	Summaries	What it means
`duplicate-of`	never bound Ze	583	90	the same obligation is already captured under another requirement id
`not-a-requirement`	never bound Ze	578	123	the sentence states a fact or describes another document, and directs no implementation
`binds-another-role`	never bound Ze	550	46	the obligation is addressed to a role Ze never acts as
`feature-out-of-scope`	never bound Ze	399	19	the RFC makes a feature OPTIONAL, Ze decided not to offer it, and this obligation is conditional on offering it
`cross-document`	never bound Ze	98	41	the obligation belongs to another document that this one only cites
`advisory-in-context`	never bound Ze	26	13	the sentence advises on applying a rule stated elsewhere and adds no obligation of its own
`relocated-to-spec`	Ze owes it	2	1	the obligation is real and unbuilt, and a named spec owes it
Sentences declined	-	2,236	-	2,234 say the obligation never bound Ze and 2 say Ze owes it, of 7,099 normative sentences the walks found

duplicate-of (583): DRAFT-IETF-BESS-MUP-SAFI, RFC 1035, RFC 1195, RFC 1661, RFC 2131, RFC 2181, RFC 2205, RFC 2516, RFC 2661, RFC 2759, RFC 2865, RFC 2866, RFC 2869, RFC 2890, RFC 2966, RFC 3031, RFC 3032, RFC 3101, RFC 3209, RFC 3579, RFC 3623, RFC 3748, RFC 3768, RFC 3786, RFC 3948, RFC 3954, RFC 4035, RFC 4090, RFC 4213, RFC 4271, RFC 4301, RFC 4302, RFC 4303, RFC 4364, RFC 4456, RFC 4555, RFC 4577, RFC 4684, RFC 4760, RFC 4787, RFC 4862, RFC 5036, RFC 5072, RFC 5216, RFC 5250, RFC 5280, RFC 5303, RFC 5340, RFC 5382, RFC 5549, RFC 5561, RFC 5798, RFC 5880, RFC 5998, RFC 6549, RFC 6793, RFC 6810, RFC 7011, RFC 7166, RFC 7296, RFC 7311, RFC 7432, RFC 7474, RFC 7854, RFC 7871, RFC 8210, RFC 8221, RFC 8247, RFC 8277, RFC 8414, RFC 8522, RFC 8665, RFC 8669, RFC 8671, RFC 8907, RFC 8950, RFC 8955, RFC 9003, RFC 9012, RFC 9069, RFC 9136, RFC 9190, RFC 9234, RFC 9252, RFC 9494, RFC 9552, RFC 9568, RFC 9728, RFC 9915, SFLOW-V5

not-a-requirement (578): DRAFT-ABRAITIS-BGP-VERSION-CAPABILITY, DRAFT-IETF-IDR-LINKLOCAL-CAPABILITY, DRAFT-WALTON-BGP-HOSTNAME-CAPABILITY, RFC 1035, RFC 1071, RFC 1195, RFC 1332, RFC 1334, RFC 1350, RFC 1661, RFC 1994, RFC 2131, RFC 2132, RFC 2181, RFC 2205, RFC 2328, RFC 2347, RFC 2348, RFC 2349, RFC 2385, RFC 2473, RFC 2516, RFC 2545, RFC 2661, RFC 2759, RFC 2782, RFC 2784, RFC 2865, RFC 2869, RFC 2918, RFC 2966, RFC 3022, RFC 3031, RFC 3032, RFC 3101, RFC 3209, RFC 3579, RFC 3623, RFC 3748, RFC 3765, RFC 3768, RFC 3882, RFC 3948, RFC 4033, RFC 4035, RFC 4271, RFC 4301, RFC 4303, RFC 4360, RFC 4364, RFC 4456, RFC 4552, RFC 4577, RFC 4684, RFC 4724, RFC 4761, RFC 4787, RFC 4861, RFC 4862, RFC 5036, RFC 5176, RFC 5250, RFC 5280, RFC 5282, RFC 5301, RFC 5303, RFC 5310, RFC 5382, RFC 5392, RFC 5443, RFC 5492, RFC 5575, RFC 5701, RFC 5709, RFC 5798, RFC 5881, RFC 5883, RFC 6071, RFC 6286, RFC 6396, RFC 6482, RFC 7296, RFC 7427, RFC 7454, RFC 7474, RFC 7534, RFC 7535, RFC 7606, RFC 7705, RFC 7854, RFC 7858, RFC 7871, RFC 7911, RFC 792, RFC 7948, RFC 7999, RFC 8050, RFC 8097, RFC 8221, RFC 8247, RFC 8522, RFC 8571, RFC 8654, RFC 8669, RFC 8955, RFC 8956, RFC 905, RFC 9072, RFC 9085, RFC 9086, RFC 9117, RFC 9190, RFC 9252, RFC 9370, RFC 9384, RFC 9494, RFC 9514, RFC 9552, RFC 9568, RFC 9582, RFC 9687, RFC 9830, SFLOW-V5

binds-another-role (550): DRAFT-IETF-BESS-MUP-SAFI, DRAFT-IETF-SIDROPS-ASPA-VERIFICATION, RFC 1035, RFC 1195, RFC 1350, RFC 1661, RFC 1997, RFC 2132, RFC 2545, RFC 2759, RFC 2865, RFC 2866, RFC 2869, RFC 3032, RFC 3579, RFC 3748, RFC 4106, RFC 4301, RFC 4302, RFC 4303, RFC 4360, RFC 4364, RFC 4456, RFC 4761, RFC 4861, RFC 5176, RFC 5280, RFC 5561, RFC 5575, RFC 5685, RFC 5998, RFC 6396, RFC 7011, RFC 7012, RFC 7296, RFC 7535, RFC 7854, RFC 7871, RFC 8522, RFC 8654, RFC 8907, RFC 8955, RFC 9552, RFC 9728, RFC 9915, SFLOW-V5
ai/rules/rfc-compliance.md treats binds-another-role as PRESUMED WRONG until it is justified: Ze rarely implements one side of a protocol, so an obligation addressed to "the sender" or "the receiver" almost always binds it, and the label reads as "not our problem" where the truth is usually "our problem, unbuilt". Each one is justified on its own RFC's page, under Extraction sign-off, and the justification MUST name the role, show Ze never acts as it, and cite the producer that would act as it if Ze did.

feature-out-of-scope (399): RFC 1195, RFC 1332, RFC 2131, RFC 3748, RFC 4090, RFC 4271, RFC 5082, RFC 5176, RFC 5216, RFC 5280, RFC 5305, RFC 7084, RFC 7634, RFC 7950, RFC 8221, RFC 8247, RFC 905, RFC 9069, RFC 9774

cross-document (98): DRAFT-ABRAITIS-BGP-VERSION-CAPABILITY, DRAFT-IETF-SIDROPS-ASPA-VERIFICATION, RFC 1195, RFC 1334, RFC 2205, RFC 2545, RFC 2782, RFC 2869, RFC 2966, RFC 3032, RFC 3101, RFC 3579, RFC 3748, RFC 3948, RFC 4033, RFC 4303, RFC 4364, RFC 4577, RFC 4724, RFC 4761, RFC 4818, RFC 5082, RFC 5176, RFC 5250, RFC 5280, RFC 5282, RFC 5308, RFC 5492, RFC 5575, RFC 6071, RFC 7474, RFC 7535, RFC 7854, RFC 7950, RFC 8571, RFC 8654, RFC 8955, RFC 8956, RFC 9069, RFC 9085, RFC 9252

advisory-in-context (26): RFC 1035, RFC 2866, RFC 3032, RFC 3748, RFC 3948, RFC 4552, RFC 4761, RFC 5176, RFC 7084, RFC 7474, RFC 8221, RFC 8247, RFC 8955

Obligations relocated to a spec

These 2 sentences are NOT scope. Each is an obligation Ze owes and has not built, moved to a named spec that reserves a requirement id for it. ./le rfc check refuses the sign-off unless that spec exists and still reserves the id, so each row is tracked work rather than an obligation that went away.

RFC	Reserved id	The obligation	The spec that owes it
`RFC 7296`	`RFC7296-2.22-1`	These payloads MUST NOT occur in messages that do not contain SA payloads.	`plan/spec-ipsec-ipcomp.md`
`RFC 7296`	`RFC7296-2.22-2`	Although there has been discussion of allowing multiple compression algorithms to be accepted and to have different compression algorithms available for the two directions of a Child SA, implementations of this specification MUST NOT accept an IPComp algorithm that was not proposed, MUST NOT accept more than one, and MUST NOT compress using an algorithm other than one proposed and accepted in the setup of the Child SA.	`plan/spec-ipsec-ipcomp.md`

Top gap clusters

The RFCs that declare the most gaps. If one of them matters to your deployment, its own page names each gap.

RFC	Declared gaps
`RFC 4035`	94
`RFC 7432`	90
`RFC 5036`	59
`RFC 7950`	51
`RFC 9012`	50
`RFC 4577`	45
`RFC 2205`	44
`RFC 4301`	41
`RFC 9915`	40
`RFC 6810`	38
`RFC 7871`	34
`RFC 3209`	32

How this is checked

Where the figures come from: the files that hold the requirements and the tests, and the command that reproduces the verdict. You do not need this section to read the results.

This gate runs before a commit is verified: ./le rfc check is 1 stage of the 56 that ./le verify current runs.

Input	Producer	What it answered here
Reproduce it	`./le rfc check`	1 of 56 full-mode verify stages run it
Requirement source	`rfc/short/*.md`	4,787 MUST rows in the walked enrolled RFCs
Enrolment	`rfc/short/*.md`, the `\| Enrolment \|` Meta row	203 enrolled RFCs
Test tags	`internal/`, `pkg/`, `test/`	9,546 resolved tags
Public ledger	`rfc/short/*.md`, the `\| Support \|` Meta row	132 RFCs with gaps
Semantic audits	`rfc/audit//.json`	2,267 fresh, 17 shifted, 4 stale, 2,499 missing
Pre-commit verification	`internal/le/verify/engine/stages.go`	./le rfc check, 1 of 56 full-mode stages
Published artifacts	`data/rfc-compliance.json`, `data/rfc-requirements.json`	the same answers this page renders, machine-readable

Check results

The gate runs several groups of checks. Each line below says what one group verifies and whether it passed, and for a group that failed, what that means for the figures. The raw findings, written for Ze's contributors, are in the collapsed block after the list.

Requirement lists: Passed. Each RFC's requirement list is readable and consistent: requirement identifiers are not reused or lost, each requirement quotes the RFC text it cites, and the links it declares between RFCs and profiles agree with the RFC texts.
Test evidence: Passed. Every gated MUST-level requirement has its tests, or an annotation that says why not, test evidence already recorded is not lost, and every test that claims a requirement compiles and is named for what it covers.
Requirement annotations: Passed. Every annotation that excuses a requirement from Ze's own tests still names code that exists, quotes the RFC sentence it relies on, or names a verified blocking kernel entry in the Linux limitations register with evidence for that exact requirement at the shipped kernel version.
Published ledger rows: Passed. Every enrolled RFC with an unmet requirement renders a public row that discloses it, a public row never disappears while its summary remains, and each summary's enrolment disposition gives a reason a reviewer can check.
Reviewer verdicts: Failed, 24 problems. Each reviewer verdict recorded on a requirement is well formed and still describes the code and tests it judged. What this means: A reviewer verdict is malformed or out of date, and that requirement must be reviewed again before the verdict counts.
Recorded breaks: Failed, 21 problems. Each recorded break still matches the test, the claim and the code it was recorded against, and no recorded proof is lost. What this means: A test's proof is missing or no longer matches what it rests on, so it is not counted as proven by a recorded break.
Reviews of RFC text: Passed. Each sign-off of a sentence-by-sentence review of an RFC's text is valid and current.

For contributors: the raw findings and the commands that fix them

RFC	Requirement	Level	What is wrong	The requirement
-	`-`	-	RFC2545-3-3 partial scope needs a current verified mutant/revert for negative internal/component/bgp/reactor/peer_initial_sync_test.go::TestDefaultOriginateOmitsLinkLocalWhenPeerOffLink	-
-	`-`	-	RFC2545-3-3 partial scope needs a current verified mutant/revert for positive internal/component/bgp/reactor/peer_initial_sync_test.go::TestDefaultOriginateAppendsLinkLocalWhenSection3Holds	-
-	`-`	-	rfc/short/draft-ietf-sidrops-aspa-verification.md:354: DRAFT-IETF-SIDROPS-ASPA-VERIFICATION-5.6-1 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/bgp/plugins/rib/draft_ietf_sidrops_aspa_verification_rib_aspa_retention_test.go::TestASPARetentionReceiveRecovery, internal/component/bgp/plugins/rib/draft_ietf_sidrops_aspa_verification_rib_aspa_retention_test.go::TestASPARetentionReplacementWithdrawal), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem draft-ietf-sidrops-aspa-verification	-
-	`-`	-	rfc/short/rfc2545.md:203: RFC2545-3-1 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/bgp/reactor/peer_initial_sync_test.go::TestDefaultOriginateAppendsLinkLocalWhenSection3Holds, internal/component/bgp/reactor/peer_initial_sync_test.go::TestDefaultOriginateRefusesUnusableIPv6NextHop, internal/component/bgp/reactor/peer_initial_sync_test.go::TestDefaultOriginateRefusesUnusableIPv6NextHop#2), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc2545	-
-	`-`	-	rfc/short/rfc2545.md:204: RFC2545-3-2 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/bgp/reactor/peer_initial_sync_test.go::TestDefaultOriginateAppendsLinkLocalWhenSection3Holds), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc2545	-
-	`-`	-	rfc/short/rfc2545.md:205: RFC2545-3-3 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/bgp/reactor/peer_initial_sync_test.go::TestDefaultOriginateAppendsLinkLocalWhenSection3Holds, internal/component/bgp/reactor/peer_initial_sync_test.go::TestDefaultOriginateOmitsLinkLocalWhenPeerOffLink), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc2545	-
-	`-`	-	rfc/short/rfc2545.md:207: RFC2545-3-4 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/bgp/reactor/peer_initial_sync_test.go::TestDefaultOriginateOmitsLinkLocalWhenPeerOffLink), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc2545	-
-	`-`	-	rfc/short/rfc4271.md:789: RFC4271-5.1.4-1 has a STALE audit verdict -- what it judged changed: test/plugin/med-locally-set-reaches-peer.ci (file-scoped). This is NOT a line shift and ./le rfc reseal will refuse it. Re-read rfc4271 with the ze-rfc-audit skill (ai/skills/ze-rfc-audit.md)	-
-	`-`	-	rfc/short/rfc4271.md:820: RFC4271-8.2.2-13 has a STALE audit verdict -- what it judged changed: internal/component/bgp/fsm/fsm.go::handleActive (func-scoped). This is NOT a line shift and ./le rfc reseal will refuse it. Re-read rfc4271 with the ze-rfc-audit skill (ai/skills/ze-rfc-audit.md)	-
-	`-`	-	rfc/short/rfc4724.md:402: RFC4724-4-1 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/bgp/reactor/peer_initial_sync_test.go::TestInitialSyncEORReachesTheSilentFamilyToo, internal/component/bgp/reactor/peer_initial_sync_test.go::TestInitialSyncEORSentWhenNeitherSideDeclaredAFamily, internal/component/bgp/reactor/peer_initial_sync_test.go::TestInitialSyncMarkerWaitsForNoProcess, internal/component/bgp/reactor/peer_initial_sync_test.go::TestInitialSyncShutsTheQueueGateAndFreesTheRailsWithTheMarker, internal/component/bgp/reactor/peer_initial_sync_test.go::TestRoutePushingBindingsCountBothRails), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc4724	-
-	`-`	-	rfc/short/rfc4724.md:420: RFC4724-4.2-9 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/bgp/reactor/peer_initial_sync_test.go::TestInitialSyncEORReachesTheSilentFamilyToo), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc4724	-
-	`-`	-	rfc/short/rfc7911.md:271: RFC7911-2-1 has a STALE audit verdict -- what it judged changed: internal/component/bgp/reactor/adj_rib_out.go::clearRoutes (func-scoped), internal/component/bgp/reactor/session_ownership.go::recordDeletion (func-scoped), internal/component/bgp/reactor/session_ownership.go::recordSection (func-scoped), internal/component/bgp/reactor/session_ownership.go::release (func-scoped). This is NOT a line shift and ./le rfc reseal will refuse it. Re-read rfc7911 with the ze-rfc-audit skill (ai/skills/ze-rfc-audit.md)	-
-	`-`	-	rfc/short/rfc7911.md:272: RFC7911-2-2 has a STALE audit verdict -- what it judged changed: internal/component/bgp/reactor/adj_rib_out.go::clearRoutes (func-scoped), internal/component/bgp/reactor/session_ownership.go::recordDeletion (func-scoped), internal/component/bgp/reactor/session_ownership.go::recordSection (func-scoped), internal/component/bgp/reactor/session_ownership.go::release (func-scoped). This is NOT a line shift and ./le rfc reseal will refuse it. Re-read rfc7911 with the ze-rfc-audit skill (ai/skills/ze-rfc-audit.md)	-
-	`-`	-	rfc/short/rfc8277.md:418: RFC8277-2.4-1 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/plugin/ipc/rfc8277_rpc_decode_nlri_context_test.go::TestRPCDecodeNLRIRealSDKConsumers, internal/component/plugin/ipc/rfc8277_rpc_decode_nlri_context_test.go::TestRPCDecodeNLRIRealSDKConsumers#2), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc8277	-
-	`-`	-	rfc/short/rfc8671.md:127: RFC8671-4-1 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/bgp/plugins/bmp/rfc8671_test.go::TestRFC8671ReservedPeerFlagsIgnoredOnReceipt, internal/component/bgp/plugins/bmp/rfc8671_test.go::TestRFC8671ReservedPeerFlagsTransmittedAsZero), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc8671	-
-	`-`	-	rfc/short/rfc8671.md:131: RFC8671-6.1-1 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/bgp/plugins/bmp/rfc8671_test.go::TestRFC8671OFlagClearOnAdjRIBInMessages, internal/component/bgp/plugins/bmp/rfc8671_test.go::TestRFC8671OFlagSetOnAdjRIBOutMessages), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc8671	-
-	`-`	-	rfc/short/rfc8671.md:134: RFC8671-7.2-1 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/bgp/plugins/bmp/rfc8671_test.go::TestRFC8671BehaviorChangeBouncesEachPeerAndKeepsTheSession, internal/component/bgp/plugins/bmp/rfc8671_test.go::TestRFC8671RemovingEveryCollectorBouncesTheSession, internal/component/bgp/plugins/bmp/rfc8671_test.go::TestRFC8671UnrelatedBGPChangeBouncesNothing), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc8671	-
-	`-`	-	rfc/short/rfc9012.md:224: RFC9012-11-9 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/bgp/reactor/rfc9012_encapsulation_filter_test.go::TestRFC9012ConfiguredEncapsulationECIngress, internal/component/bgp/reactor/rfc9012_encapsulation_filter_test.go::TestRFC9012ConfiguredEncapsulationECIngress#2), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc9012	-
-	`-`	-	rfc/short/rfc9012.md:225: RFC9012-11-10 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/bgp/reactor/rfc9012_encapsulation_filter_test.go::TestRFC9012ConfiguredEncapsulationECEgress, internal/component/bgp/reactor/rfc9012_encapsulation_filter_test.go::TestRFC9012ConfiguredEncapsulationECEgress#2), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc9012	-
-	`-`	-	rfc/short/rfc9012.md:254: RFC9012-11-7 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/bgp/reactor/rfc9012_session_filter_test.go::TestRFC9012TunnelFilterDoesNotAffectOtherSession, internal/component/bgp/reactor/rfc9012_session_filter_test.go::TestRFC9012TunnelFilterSelectedSession), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc9012	-
-	`-`	-	rfc/short/rfc9069.md:105: RFC9069-x-6 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/bgp/plugins/bmp/rfc8671_test.go::TestRFC9069ReloadTurningLocRIBOnAnnouncesTheRouterIdentity), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc9069	-
-	`-`	-	rfc/short/rfc9069.md:106: RFC9069-5.3-1 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/component/bgp/plugins/bmp/rfc8671_test.go::TestBMPReloadTurningLocRIBOffUnsubscribesAndSaysSo), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc9069	-
-	`-`	-	rfc/short/rfc9552.md:720: RFC9552-5.2.1-1 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/plugins/ospf/rfc9552_router_id_test.go::TestRFC9552OSPFRouterIDsReachExporter), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc9552	-
-	`-`	-	rfc/short/rfc9552.md:721: RFC9552-5.3.2.1-1 has a SHIFTED audit verdict -- the tagged unit is byte-identical and only the file around it moved (internal/plugins/ospf/rfc9552_router_id_test.go::TestRFC9552OSPFInterASRouterIDsReachExporter, internal/plugins/ospf/rfc9552_router_id_test.go::TestRFC9552OSPFRouterIDAbsenceReachExporter, internal/plugins/ospf/rfc9552_router_id_test.go::TestRFC9552OSPFRouterIDsReachExporter), so nothing was re-judged. Re-stamp it mechanically: ./le rfc reseal stem rfc9552	-
-	`-`	-	rfc/discrimination/rfc2545/RFC2545-3-1.json: the revert record for RFC2545-3-1 positive at internal/component/bgp/reactor/peer_initial_sync_test.go::TestDefaultOriginateAppendsLinkLocalWhenSection3Holds no longer verifies (producer-changed): the producer's behavior changed since the break was applied to it. The break "body of sendDefaultOriginateRoutes replaced by panic(\"BUG: ./le rfc discriminate-record disabled this producer to observe the red\")" was observed to redden that unit when applied to internal/component/bgp/reactor/peer_initial_sync.go::sendDefaultOriginateRoutes. `./le rfc check` replays nothing: it compares the fingerprints the proof was taken against, so a moved fingerprint means the red was never re-observed over the code that is there now. Re-record it with `./le rfc discriminate`, or delete the record with the tag it proved	-

20 further findings not shown here. The whole list is in data/rfc-compliance.json, and each one is on its own RFC's page under the requirement it names.

Enrolled RFCs

Every RFC the gate holds Ze to, with its own figures. Open an RFC to see each of its requirements and the tests behind it.

Every RFC listed

MUST bar

Ze proven 2,175, OS testing gap 239, Ze correctness gap 2,693

Overview bar

Ze MUST proven 2,175, SHOULD proven 112, Not owed 18, SHOULD not decided 2,190, OS testing gap 239, Ze correctness gap 2,693

Total	Ze proven	OS verified	OS testing gap	Ze correctness gap	Not owed	MUST rows
Total	2,175	0	239	2,693	18	5,125

Check: 2,175 + 0 + 239 + 2,693 + 18 = 5,125 MUST rows: the four MUST bar sections and the rows not owed add up to every MUST row of the walked RFCs.

240 RFCs, of which 13 not walked, so their rows count in no figure.

Area: the area the RFC's public row is filed under, or that its summary declares no public row
MUST bar: the RFC's MUST, MUST NOT, REQUIRED, SHALL and SHALL NOT rows the stack owes, by section, read from data/rfc/<stem>.json. "not walked" means the requirement list has not yet been checked against the RFC text, so no row is counted
Overview bar: the same MUST rows with its MAY, NOT RECOMMENDED, OPTIONAL, RECOMMENDED, SHOULD and SHOULD NOT rows and the rows not owed, which do not bind Ze
MUSTs: the mandatory requirements the gate holds Ze to
Gaps: requirements the summary declares Ze does not meet yet
Gaps tested: of those gaps, the ones a test demonstrates
Untested: mandatory requirements with no test at all

RFC	Area	MUST bar	Overview bar	MUSTs	Gaps
`DRAFT-ABRAITIS-BGP-VERSION-CAPABILITY` Software Version Capability for BGP	BGP Software Version capability code 75	Ze proven 11	Ze MUST proven 11, SHOULD not decided 4	11	0
`DRAFT-ABRAITIS-IDR-ADDPATH-PATHS-LIMIT` Scalability Considerations for ADD-PATH with PATHS-LIMIT	BGP PATHS-LIMIT	Ze proven 1, Ze correctness gap 3	Ze MUST proven 1, SHOULD proven 3, Ze correctness gap 3	4	0
`DRAFT-IETF-BESS-MUP-SAFI` BGP Extensions for the Mobile User Plane (MUP) SAFI	BGP Mobile User Plane SAFI 85	Ze proven 17, Ze correctness gap 30	Ze MUST proven 17, SHOULD not decided 20, Ze correctness gap 30	47	30
`DRAFT-IETF-IDR-BGP-BFD-STRICT-MODE` BGP BFD Strict-Mode	BFD strict mode for BGP, capability code 74	Ze proven 4	Ze MUST proven 4	4	0
`DRAFT-IETF-IDR-LINKLOCAL-CAPABILITY` Link-Local Next Hop Capability for BGP	Link-local next-hop capability code 77	Ze proven 13, Ze correctness gap 2	Ze MUST proven 13, SHOULD not decided 12, Ze correctness gap 2	15	2
`DRAFT-IETF-SIDROPS-ASPA-VERIFICATION` BGP AS_PATH Verification Based on Autonomous System Provider Authorization (ASPA) Objects	ASPA path verification	Ze proven 6, Ze correctness gap 2	Ze MUST proven 6, SHOULD not decided 10, Ze correctness gap 2	8	1
`DRAFT-WALTON-BGP-HOSTNAME-CAPABILITY` Hostname Capability for BGP	BGP FQDN capability code 73	no rows	SHOULD not decided 1	0	0
`RFC 1071` Computing the Internet Checksum	Internet checksum (OSPF, VRRP, ICMP probe, RSVP-TE)	Ze proven 6	Ze MUST proven 6, SHOULD not decided 3	6	0
`RFC 1195` Use of OSI IS-IS for Routing in TCP/IP and Dual Environments	Integrated IS-IS for IPv4	Ze proven 25, Ze correctness gap 16	Ze MUST proven 25, SHOULD not decided 1, Ze correctness gap 16	41	7
`RFC 1332` The PPP Internet Protocol Control Protocol (IPCP)	IPCP	Ze proven 8	Ze MUST proven 8, SHOULD not decided 6	8	0
`RFC 1334` PPP Authentication Protocols	PAP	Ze proven 13	Ze MUST proven 13, SHOULD not decided 3	13	0
`RFC 1350` The TFTP Protocol (Revision 2)	TFTP	Ze proven 8, Ze correctness gap 2	Ze MUST proven 8, SHOULD proven 2, SHOULD not decided 2, Ze correctness gap 2	10	2
`RFC 1661` The Point-to-Point Protocol (PPP)	PPP LCP	Ze proven 42, OS testing gap 2, Ze correctness gap 32	Ze MUST proven 42, SHOULD not decided 25, OS testing gap 2, Ze correctness gap 32	76	17
`RFC 1877` PPP Internet Protocol Control Protocol Extensions for Name Server Addresses	IPCP DNS options	no rows	no rows	0	0
`RFC 1994` PPP Challenge Handshake Authentication Protocol (CHAP)	PPP CHAP (MD5)	Ze proven 8, Ze correctness gap 8	Ze MUST proven 8, SHOULD proven 2, SHOULD not decided 9, Ze correctness gap 8	16	3
`RFC 1997` BGP Communities Attribute	Standard communities	Ze proven 5	Ze MUST proven 5, SHOULD not decided 4	5	0
`RFC 2003` IP Encapsulation within IP	IP-in-IP tunnels (ipip, protocol 4)	Ze correctness gap 13	SHOULD not decided 24, Ze correctness gap 13	13	13
`RFC 2131` Dynamic Host Configuration Protocol	DHCPv4	Ze proven 18, OS testing gap 9, Ze correctness gap 44	Ze MUST proven 18, SHOULD proven 2, SHOULD not decided 36, OS testing gap 9, Ze correctness gap 44	71	29
`RFC 2132` DHCP Options and BOOTP Vendor Extensions	DHCP options	Ze proven 1, Ze correctness gap 33	Ze MUST proven 1, SHOULD not decided 34, Ze correctness gap 33	34	26
`RFC 2181` Clarifications to the DNS Specification	DNS clarifications	Ze proven 12, Ze correctness gap 11	Ze MUST proven 12, SHOULD proven 1, SHOULD not decided 46, Ze correctness gap 11	23	5
`RFC 2205` Resource ReSerVation Protocol (RSVP) -- Version 1 Functional Specification	RSVP base protocol	Ze proven 31, Ze correctness gap 44	Ze MUST proven 31, SHOULD not decided 5, Ze correctness gap 44	75	44
`RFC 2328` OSPF Version 2	OSPFv2	Ze proven 58, Ze correctness gap 9	Ze MUST proven 58, SHOULD proven 2, SHOULD not decided 13, Ze correctness gap 9	67	0
`RFC 2347` TFTP Option Extension	TFTP option negotiation	Ze proven 3	Ze MUST proven 3, SHOULD proven 1, SHOULD not decided 1	3	0
`RFC 2348` TFTP Blocksize Option	No public row declared	Ze proven 5	Ze MUST proven 5	5	0
`RFC 2349` TFTP Timeout Interval and Transfer Size Options	TFTP timeout and transfer size options	Ze proven 3, Ze correctness gap 1	Ze MUST proven 3, SHOULD proven 1, SHOULD not decided 1, Ze correctness gap 1	4	1
`RFC 2385` Protection of BGP Sessions via the TCP MD5 Signature Option	TCP MD5	Ze proven 8	Ze MUST proven 8, SHOULD not decided 1	8	0
`RFC 2473` Generic Packet Tunneling in IPv6 Specification	IPv6 tunnels (ip6tnl, ipip6)	Ze proven 1, OS testing gap 7, Ze correctness gap 3	Ze MUST proven 1, SHOULD not decided 10, OS testing gap 7, Ze correctness gap 3	11	3
`RFC 2516` A Method for Transmitting PPP Over Ethernet (PPPoE)	PPPoE	Ze proven 25, OS testing gap 1, Ze correctness gap 11	Ze MUST proven 25, SHOULD not decided 3, OS testing gap 1, Ze correctness gap 11	37	4
`RFC 2545` Use of BGP-4 Multiprotocol Extensions for IPv6 Inter-Domain Routing	IPv6 next-hop handling	Ze proven 3, Ze correctness gap 2	Ze MUST proven 3, SHOULD not decided 2, Ze correctness gap 2	5	0
`RFC 2661` Layer Two Tunneling Protocol "L2TP"	L2TPv2	Ze proven 81, OS testing gap 1, Ze correctness gap 12	Ze MUST proven 81, SHOULD proven 2, SHOULD not decided 6, OS testing gap 1, Ze correctness gap 12	94	9
`RFC 2759` Microsoft PPP CHAP Extensions, Version 2	MS-CHAPv2 (PPP and EAP inside IKEv2)	Ze proven 4, Ze correctness gap 3	Ze MUST proven 4, SHOULD proven 2, SHOULD not decided 2, Ze correctness gap 3	7	0
`RFC 2782` A DNS RR for specifying the location of services (DNS SRV)	DNS SRV records	Ze correctness gap 5	Not owed 2, SHOULD not decided 7, Ze correctness gap 5	7	5
`RFC 2784` Generic Routing Encapsulation (GRE)	GRE tunnels (gre, gretap)	Ze correctness gap 11	SHOULD not decided 2, Ze correctness gap 11	11	11
`RFC 2865` Remote Authentication Dial In User Service (RADIUS)	RADIUS authentication	Ze proven 27, Ze correctness gap 4	Ze MUST proven 27, SHOULD not decided 1, Ze correctness gap 4	31	0
`RFC 2866` RADIUS Accounting	RADIUS accounting	Ze proven 8, Ze correctness gap 7	Ze MUST proven 8, SHOULD not decided 1, Ze correctness gap 7	15	0
`RFC 2869` RADIUS Extensions	RADIUS extensions	Ze proven 4, Ze correctness gap 4	Ze MUST proven 4, SHOULD not decided 3, Ze correctness gap 4	8	0
`RFC 2890` Key and Sequence Number Extensions to GRE	GRE key and sequence number extensions	Ze correctness gap 3	SHOULD not decided 4, Ze correctness gap 3	3	3
`RFC 2918` Route Refresh Capability for BGP-4	Route Refresh	Ze proven 3, Ze correctness gap 3	Ze MUST proven 3, SHOULD proven 1, SHOULD not decided 4, Ze correctness gap 3	6	0
`RFC 2966` Domain-wide Prefix Distribution with Two-Level IS-IS	IS-IS up/down bit	Ze proven 3, Ze correctness gap 3	Ze MUST proven 3, SHOULD not decided 2, Ze correctness gap 3	6	0
`RFC 3031` Multiprotocol Label Switching Architecture	MPLS architecture	Ze proven 2, Ze correctness gap 8	Ze MUST proven 2, SHOULD not decided 2, Ze correctness gap 8	10	8
`RFC 3032` MPLS Label Stack Encoding	MPLS label stack encoding	Ze proven 1, OS testing gap 5, Ze correctness gap 12	Ze MUST proven 1, SHOULD not decided 6, OS testing gap 5, Ze correctness gap 12	18	12
`RFC 3101` The OSPF Not-So-Stubby Area (NSSA) Option	OSPF NSSA	Ze proven 15, Ze correctness gap 13	Ze MUST proven 15, SHOULD proven 2, SHOULD not decided 5, Ze correctness gap 13	28	1
`RFC 3162` RADIUS and IPv6	RADIUS IPv6 attributes	Ze proven 3, Ze correctness gap 3	Ze MUST proven 3, SHOULD not decided 7, Ze correctness gap 3	6	3
`RFC 3209` RSVP-TE: Extensions to RSVP for LSP Tunnels	RSVP-TE	Ze proven 23, OS testing gap 2, Ze correctness gap 34	Ze MUST proven 23, SHOULD not decided 3, OS testing gap 2, Ze correctness gap 34	59	32
`RFC 3579` RADIUS (Remote Authentication Dial In User Service) Support For Extensible Authentication Protocol (EAP)	RADIUS/EAP	Ze proven 17, Ze correctness gap 14	Ze MUST proven 17, SHOULD proven 2, SHOULD not decided 17, Ze correctness gap 14	31	14
`RFC 3623` Graceful OSPF Restart	OSPFv2 Graceful Restart	Ze proven 8, Ze correctness gap 5	Ze MUST proven 8, SHOULD not decided 13, Ze correctness gap 5	13	4
`RFC 3630` Traffic Engineering (TE) Extensions to OSPF Version 2	OSPFv2 Traffic Engineering LSA	Ze correctness gap 5	SHOULD not decided 5, Ze correctness gap 5	5	4
`RFC 3748` Extensible Authentication Protocol (EAP)	EAP	Ze proven 42, Ze correctness gap 17	Ze MUST proven 42, SHOULD not decided 4, Ze correctness gap 17	59	6
`RFC 3765` NOPEER Community for Border Gateway Protocol (BGP) Route Scope Control	NOPEER community	no rows	SHOULD not decided 2	0	0
`RFC 3768` Virtual Router Redundancy Protocol (VRRP)	VRRPv2 (IPv4 only)	Ze proven 31, Ze correctness gap 10	Ze MUST proven 31, SHOULD not decided 11, Ze correctness gap 10	41	3
`RFC 3786` Extending the Number of Intermediate System to Intermediate System (IS-IS) Link State PDU (LSP) Fragments Beyond the 256 Limit	No public row declared	Ze proven 1, Ze correctness gap 8	Ze MUST proven 1, SHOULD not decided 4, Ze correctness gap 8	9	0
`RFC 3787` Recommendations for Interoperable IP Networks using Intermediate System to Intermediate System (IS-IS)	IS-IS interoperability guidelines	Ze proven 5	Ze MUST proven 5, SHOULD not decided 3	5	0
`RFC 3948` UDP Encapsulation of IPsec ESP Packets	UDP encapsulation of ESP	Ze proven 6, Ze correctness gap 5	Ze MUST proven 6, SHOULD proven 2, SHOULD not decided 3, Ze correctness gap 5	11	1
`RFC 3954` Cisco Systems NetFlow Services Export Version 9	NetFlow v9	Ze proven 4, Ze correctness gap 6	Ze MUST proven 4, Not owed 4, SHOULD not decided 12, Ze correctness gap 6	14	6
`RFC 4035` Protocol Modifications for the DNS Security Extensions	DNSSEC protocol modifications	Ze proven 4, Ze correctness gap 104	Ze MUST proven 4, SHOULD not decided 50, Ze correctness gap 104	108	94
`RFC 4090` Fast Reroute Extensions to RSVP-TE for LSP Tunnels	RSVP-TE Fast Reroute	Ze proven 29, Ze correctness gap 4	Ze MUST proven 29, SHOULD proven 6, SHOULD not decided 2, Ze correctness gap 4	33	2
`RFC 4106` The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)	ESP	Ze proven 5, OS testing gap 3	Ze MUST proven 5, SHOULD not decided 5, OS testing gap 3	8	0
`RFC 4213` Basic Transition Mechanisms for IPv6 Hosts and Routers	IPv6 over IPv4 configured tunnels (6in4, sit)	Ze proven 1, OS testing gap 17, Ze correctness gap 5	Ze MUST proven 1, SHOULD not decided 24, OS testing gap 17, Ze correctness gap 5	23	5
`RFC 4271` A Border Gateway Protocol 4 (BGP-4)	BGP-4 base protocol	Ze proven 83, Ze correctness gap 50	Ze MUST proven 83, SHOULD proven 3, SHOULD not decided 31, Ze correctness gap 50	133	19
`RFC 4301` Security Architecture for the Internet Protocol	IPsec architecture	Ze proven 52, OS testing gap 2, Ze correctness gap 47	Ze MUST proven 52, SHOULD proven 1, SHOULD not decided 2, OS testing gap 2, Ze correctness gap 47	101	41
`RFC 4302` IP Authentication Header	Authentication Header	Ze proven 9, OS testing gap 19, Ze correctness gap 4	Ze MUST proven 9, SHOULD not decided 10, OS testing gap 19, Ze correctness gap 4	32	4
`RFC 4303` IP Encapsulating Security Payload (ESP)	ESP	Ze proven 7, Ze correctness gap 16	Ze MUST proven 7, SHOULD not decided 4, Ze correctness gap 16	23	15
`RFC 4360` BGP Extended Communities Attribute	Extended communities	Ze proven 2, Ze correctness gap 3	Ze MUST proven 2, SHOULD not decided 4, Ze correctness gap 3	5	3
`RFC 4364` BGP/MPLS IP Virtual Private Networks (VPNs)	BGP/MPLS IP VPNs	Ze correctness gap 8	SHOULD not decided 5, Ze correctness gap 8	8	8
`RFC 4456` BGP Route Reflection: An Alternative to Full Mesh Internal BGP (IBGP)	Route Reflection	Ze proven 1, Ze correctness gap 3	Ze MUST proven 1, SHOULD not decided 5, Ze correctness gap 3	4	0
`RFC 4486` Subcodes for BGP Cease NOTIFICATION Message	BGP Cease subcodes and prefix maximum	Ze correctness gap 1	SHOULD not decided 10, Ze correctness gap 1	1	0
`RFC 4552` Authentication/Confidentiality for OSPFv3	OSPFv3 IPsec authentication	Ze proven 6, OS testing gap 6, Ze correctness gap 15	Ze MUST proven 6, SHOULD not decided 11, OS testing gap 6, Ze correctness gap 15	27	6
`RFC 4555` IKEv2 Mobility and Multihoming Protocol (MOBIKE)	MOBIKE	Ze proven 3, Ze correctness gap 11	Ze MUST proven 3, SHOULD proven 2, SHOULD not decided 10, Ze correctness gap 11	14	0
`RFC 4576` Using a Link State Advertisement (LSA) Options Bit to Prevent Looping in BGP/MPLS IP Virtual Private Networks (VPNs)	OSPF DN bit for BGP/MPLS IP VPNs	Ze correctness gap 4	Ze correctness gap 4	4	4
`RFC 4577` OSPF as the Provider/Customer Edge Protocol for BGP/MPLS IP Virtual Private Networks (VPNs)	OSPF as the PE/CE protocol for BGP/MPLS IP VPNs	Ze correctness gap 46	SHOULD proven 1, SHOULD not decided 19, Ze correctness gap 46	46	63
`RFC 4578` Dynamic Host Configuration Protocol (DHCP) Options for the Intel Preboot eXecution Environment (PXE)	DHCP PXE options	Ze proven 1, Ze correctness gap 3	Ze MUST proven 1, Not owed 1, SHOULD not decided 3, Ze correctness gap 3	5	3
`RFC 4638` Accommodating a Maximum Transit Unit/Maximum Receive Unit (MTU/MRU) Greater Than 1492 in the Point-to-Point Protocol over Ethernet (PPPoE)	PPPoE MTU/MRU above 1492	Ze correctness gap 6	SHOULD not decided 3, Ze correctness gap 6	6	6
`RFC 4659` BGP-MPLS IP Virtual Private Network (VPN) Extension for IPv6 VPN	VPNv6	Ze proven 4, Ze correctness gap 14	Ze MUST proven 4, SHOULD not decided 6, Ze correctness gap 14	18	13
`RFC 4684` Constrained Route Distribution for Border Gateway Protocol/MultiProtocol Label Switching (BGP/MPLS) Internet Protocol (IP) Virtual Private Networks (VPNs)	Route Target Constraint	Ze proven 2, Ze correctness gap 4	Ze MUST proven 2, SHOULD not decided 4, Ze correctness gap 4	6	4
`RFC 4724` Graceful Restart Mechanism for BGP	Graceful Restart	Ze proven 14, Ze correctness gap 12	Ze MUST proven 14, SHOULD proven 1, SHOULD not decided 4, Ze correctness gap 12	26	9
`RFC 4739` Multiple Authentication Exchanges in the Internet Key Exchange (IKEv2) Protocol	Multiple authentication exchanges	Ze proven 2	Ze MUST proven 2	2	0
`RFC 4754` IKE and IKEv2 Authentication Using the Elliptic Curve Digital Signature Algorithm (ECDSA)	ECDSA authentication methods 9, 10 and 11	Ze proven 1	Ze MUST proven 1	1	0
`RFC 4760` Multiprotocol Extensions for BGP-4	Multiprotocol BGP	Ze proven 6	Ze MUST proven 6, SHOULD proven 1, SHOULD not decided 10	6	0
`RFC 4761` Virtual Private LAN Service (VPLS) Using BGP for Auto-Discovery and Signaling	VPLS NLRI	Ze correctness gap 18	SHOULD not decided 9, Ze correctness gap 18	18	18
`RFC 4787` Network Address Translation (NAT) Behavioral Requirements for Unicast UDP	NAT behavior for UDP	Ze correctness gap 13	SHOULD not decided 16, Ze correctness gap 13	13	13
`RFC 4861` Neighbor Discovery for IP version 6 (IPv6)	IPv6 Neighbor Discovery and Router Advertisement	Ze proven 30, OS testing gap 91, Ze correctness gap 17	Ze MUST proven 30, SHOULD not decided 79, OS testing gap 91, Ze correctness gap 17	138	17
`RFC 4862` IPv6 Stateless Address Autoconfiguration	IPv6 stateless address autoconfiguration	OS testing gap 6, Ze correctness gap 10	SHOULD not decided 14, OS testing gap 6, Ze correctness gap 10	16	10
`RFC 5036` LDP Specification	LDP	Ze proven 29, Ze correctness gap 62	Ze MUST proven 29, SHOULD not decided 4, Ze correctness gap 62	91	60
`RFC 5072` IP Version 6 over PPP	IPv6CP	Ze proven 9, Ze correctness gap 7	Ze MUST proven 9, SHOULD not decided 12, Ze correctness gap 7	16	4
`RFC 5082` The Generalized TTL Security Mechanism (GTSM)	GTSM and TTL security	Ze proven 4	Ze MUST proven 4, SHOULD proven 1, SHOULD not decided 5	4	0
`RFC 5176` Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS)	RADIUS CoA and Disconnect Message	Ze proven 26, Ze correctness gap 4	Ze MUST proven 26, SHOULD proven 1, Ze correctness gap 4	30	0
`RFC 5187` OSPFv3 Graceful Restart	OSPFv3 Graceful Restart	Ze proven 4	Ze MUST proven 4	4	0
`RFC 5216` The EAP-TLS Authentication Protocol	EAP-TLS (EAP inside IKEv2)	Ze proven 30, OS testing gap 2, Ze correctness gap 15	Ze MUST proven 30, SHOULD proven 2, SHOULD not decided 5, OS testing gap 2, Ze correctness gap 15	47	9
`RFC 5250` The OSPF Opaque LSA Option	OSPFv2 opaque LSAs	Ze proven 10, Ze correctness gap 5	Ze MUST proven 10, SHOULD not decided 2, Ze correctness gap 5	15	0
`RFC 5280` Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile	X.509 certificates and CRLs	Ze proven 26, OS testing gap 50, Ze correctness gap 26	Ze MUST proven 26, SHOULD not decided 108, OS testing gap 50, Ze correctness gap 26	102	26
`RFC 5282` Using Authenticated Encryption Algorithms with the Encrypted Payload of the Internet Key Exchange version 2 (IKEv2) Protocol	IKEv2 AEAD algorithms	Ze proven 19	Ze MUST proven 19, SHOULD not decided 11	19	0
`RFC 5286` Basic Specification for IP Fast Reroute: Loop-Free Alternates	Loop-Free Alternate FRR	Ze proven 2, Ze correctness gap 4	Ze MUST proven 2, SHOULD not decided 24, Ze correctness gap 4	6	3
`RFC 5301` Dynamic Hostname Exchange Mechanism for IS-IS	IS-IS dynamic hostname	Ze correctness gap 7	SHOULD not decided 8, Ze correctness gap 7	7	0
`RFC 5303` Three-Way Handshake for IS-IS Point-to-Point Adjacencies	IS-IS point-to-point three-way	Ze proven 8, Ze correctness gap 9	Ze MUST proven 8, SHOULD not decided 1, Ze correctness gap 9	17	6
`RFC 5304` IS-IS Cryptographic Authentication	IS-IS HMAC-MD5 authentication	Ze correctness gap 9	SHOULD not decided 5, Ze correctness gap 9	9	1
`RFC 5305` IS-IS Extensions for Traffic Engineering	IS-IS wide metrics and TE TLVs	Ze proven 8, Ze correctness gap 6	Ze MUST proven 8, SHOULD not decided 8, Ze correctness gap 6	14	5
`RFC 5308` Routing IPv6 with IS-IS	IS-IS IPv6	Ze proven 8	Ze MUST proven 8, SHOULD not decided 1	8	0
`RFC 5310` IS-IS Generic Cryptographic Authentication	IS-IS generic crypto authentication	Ze proven 6, Ze correctness gap 3	Ze MUST proven 6, SHOULD proven 1, SHOULD not decided 2, Ze correctness gap 3	9	1
`RFC 5340` OSPF for IPv6	OSPFv3 (partial, experimental)	Ze proven 6, OS testing gap 1, Ze correctness gap 16	Ze MUST proven 6, SHOULD not decided 23, OS testing gap 1, Ze correctness gap 16	23	5
`RFC 5382` NAT Behavioral Requirements for TCP	NAT behavior for TCP	Ze correctness gap 11	SHOULD not decided 11, Ze correctness gap 11	11	11
`RFC 5392` OSPF Extensions in Support of Inter-Autonomous System (AS) MPLS and GMPLS Traffic Engineering	OSPF inter-AS TE (OSPFv2)	Ze proven 5, Ze correctness gap 9	Ze MUST proven 5, SHOULD not decided 18, Ze correctness gap 9	14	5
`RFC 5443` LDP IGP Synchronization	LDP IGP Synchronization (OSPF)	Ze proven 5, Ze correctness gap 3	Ze MUST proven 5, SHOULD not decided 6, Ze correctness gap 3	8	3
`RFC 5492` Capabilities Advertisement with BGP-4	BGP capability advertisement	Ze proven 8, Ze correctness gap 1	Ze MUST proven 8, SHOULD not decided 7, Ze correctness gap 1	9	1
`RFC 5549` Advertising IPv4 Network Layer Reachability Information with an IPv6 Next Hop	Legacy extended next-hop encoding	Ze proven 3, Ze correctness gap 3	Ze MUST proven 3, SHOULD not decided 3, Ze correctness gap 3	6	0
`RFC 5561` LDP Capabilities	LDP	Ze proven 1, Ze correctness gap 16	Ze MUST proven 1, SHOULD not decided 1, Ze correctness gap 16	17	16
`RFC 5575` Dissemination of Flow Specification Rules	BGP Flowspec (obsoleted by RFC 8955)	Ze proven 4, Ze correctness gap 5	Ze MUST proven 4, SHOULD not decided 4, Ze correctness gap 5	9	1
`RFC 5635` Remote Triggered Black Hole Filtering with Unicast Reverse Path Forwarding (uRPF)	RTBH filtering with uRPF	no rows	SHOULD not decided 1	0	0
`RFC 5701` IPv6 Address Specific BGP Extended Community Attribute	IPv6 extended communities	Ze correctness gap 4	SHOULD not decided 2, Ze correctness gap 4	4	1
`RFC 5709` OSPFv2 HMAC-SHA Cryptographic Authentication	OSPFv2 HMAC-SHA authentication	Ze proven 5, Ze correctness gap 10	Ze MUST proven 5, SHOULD proven 2, SHOULD not decided 5, Ze correctness gap 10	15	0
`RFC 5798` Virtual Router Redundancy Protocol (VRRP) Version 3 for IPv4 and IPv6	VRRPv3 (obsoleted by RFC 9568)	Ze proven 49, OS testing gap 3, Ze correctness gap 7	Ze MUST proven 49, SHOULD proven 1, SHOULD not decided 25, OS testing gap 3, Ze correctness gap 7	59	7
`RFC 5838` Support of Address Families in OSPFv3	OSPFv3 multiple address families	Ze proven 4, Ze correctness gap 12	Ze MUST proven 4, SHOULD not decided 11, Ze correctness gap 12	16	10
`RFC 5880` Bidirectional Forwarding Detection (BFD)	BFD base	Ze proven 72, Ze correctness gap 39	Ze MUST proven 72, SHOULD proven 6, SHOULD not decided 20, Ze correctness gap 39	111	12
`RFC 5881` Bidirectional Forwarding Detection (BFD) for IPv4 and IPv6 (Single Hop)	BFD single-hop	Ze proven 13, Ze correctness gap 10	Ze MUST proven 13, SHOULD not decided 10, Ze correctness gap 10	23	8
`RFC 5882` Generic Application of Bidirectional Forwarding Detection (BFD)	BFD generic application	Ze correctness gap 3	SHOULD proven 5, SHOULD not decided 24, Ze correctness gap 3	3	2
`RFC 5883` Bidirectional Forwarding Detection (BFD) for Multihop Paths	BFD multi-hop	Ze proven 3, Ze correctness gap 3	Ze MUST proven 3, SHOULD not decided 1, Ze correctness gap 3	6	0
`RFC 5905` Network Time Protocol Version 4: Protocol and Algorithms Specification	NTP client (SNTP subset)	Ze correctness gap 8	Ze correctness gap 8	8	8
`RFC 5998` An Extension for EAP-Only Authentication in IKEv2	IKEv2 EAP	Ze proven 1, Ze correctness gap 5	Ze MUST proven 1, SHOULD not decided 1, Ze correctness gap 5	6	5
`RFC 6138` LDP IGP Synchronization for Broadcast Networks	No public row declared	Ze proven 2	Ze MUST proven 2	2	0
`RFC 6286` Autonomous-System-Wide Unique BGP Identifier for BGP-4	AS-wide unique BGP Identifier	Ze correctness gap 4	SHOULD proven 1, Ze correctness gap 4	4	0
`RFC 6396` Multi-Threaded Routing Toolkit (MRT) Routing Information Export Format	MRT	Ze proven 6, Ze correctness gap 7	Ze MUST proven 6, SHOULD not decided 12, Ze correctness gap 7	13	6
`RFC 6397` Multi-Threaded Routing Toolkit (MRT) Border Gateway Protocol (BGP) Routing Information Export Format with Geo-Location Extensions	MRT geo-location	Ze correctness gap 4	SHOULD not decided 1, Ze correctness gap 4	4	4
`RFC 6549` OSPFv2 Multi-Instance Extensions	No public row declared	Ze correctness gap 1	SHOULD not decided 3, Ze correctness gap 1	1	0
`RFC 6608` Subcodes for BGP Finite State Machine Error	BGP FSM Error subcodes	Ze correctness gap 3	Ze correctness gap 3	3	3
`RFC 6793` BGP Support for Four-Octet Autonomous System (AS) Number Space	4-byte AS numbers	Ze proven 20, Ze correctness gap 10	Ze MUST proven 20, SHOULD not decided 6, Ze correctness gap 10	30	1
`RFC 6810` The Resource Public Key Infrastructure (RPKI) to Router Protocol	RPKI-to-Router Protocol v0 (RPKI-RTR), not spoken: ze speaks versions 1 and 2 only (RFC 8210)	Ze correctness gap 38	Not owed 2, SHOULD not decided 28, Ze correctness gap 38	40	38
`RFC 6811` BGP Prefix Origin Validation	RPKI origin validation	Ze proven 1, Ze correctness gap 4	Ze MUST proven 1, SHOULD not decided 4, Ze correctness gap 4	5	0
`RFC 6996` Autonomous System (AS) Reservation for Private Use	No public row declared	Ze proven 1	Ze MUST proven 1, SHOULD not decided 2	1	0
`RFC 7011` Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information	IPFIX	Ze proven 12, Ze correctness gap 38	Ze MUST proven 12, SHOULD not decided 7, Ze correctness gap 38	50	32
`RFC 7012` Information Model for IP Flow Information Export (IPFIX)	IPFIX Information Model	Ze proven 1, Ze correctness gap 5	Ze MUST proven 1, Ze correctness gap 5	6	5
`RFC 7084` Basic Requirements for IPv6 Customer Edge Routers	IPv6 customer edge router	Ze proven 14, OS testing gap 7, Ze correctness gap 20	Ze MUST proven 14, SHOULD not decided 25, OS testing gap 7, Ze correctness gap 20	41	20
`RFC 7166` Supporting Authentication Trailer for OSPFv3	OSPFv3 authentication trailer	Ze correctness gap 17	SHOULD not decided 17, Ze correctness gap 17	17	19
`RFC 7296` Internet Key Exchange Protocol Version 2 (IKEv2)	IKEv2	Ze proven 84, Ze correctness gap 150	Ze MUST proven 84, SHOULD proven 4, SHOULD not decided 5, Ze correctness gap 150	234	0
`RFC 7311` The Accumulated IGP Metric Attribute for BGP	AIGP attribute	Ze proven 13, Ze correctness gap 9	Ze MUST proven 13, SHOULD not decided 4, Ze correctness gap 9	22	0
`RFC 7313` Enhanced Route Refresh Capability for BGP-4	Enhanced Route Refresh	Ze proven 5, Ze correctness gap 6	Ze MUST proven 5, SHOULD not decided 6, Ze correctness gap 6	11	5
`RFC 7427` Signature Authentication in the Internet Key Exchange Version 2 (IKEv2)	No public row declared	Ze proven 4	Ze MUST proven 4, SHOULD not decided 3	4	0
`RFC 7432` BGP MPLS-Based Ethernet VPN	EVPN	Ze proven 11, Ze correctness gap 92	Ze MUST proven 11, SHOULD not decided 17, Ze correctness gap 92	103	90
`RFC 7440` TFTP Windowsize Option	TFTP windowsize	Ze proven 9	Ze MUST proven 9, SHOULD proven 1, SHOULD not decided 5	9	0
`RFC 7474` Security Extensions for OSPFv2 when Using Manual Key Management	OSPFv2 manual-key security extension	Ze proven 7, Ze correctness gap 5	Ze MUST proven 7, SHOULD proven 1, SHOULD not decided 3, Ze correctness gap 5	12	1
`RFC 7534` AS112 Nameserver Operations	AS112 operations	Ze proven 2, Ze correctness gap 1	Ze MUST proven 2, SHOULD not decided 13, Ze correctness gap 1	3	0
`RFC 7535` AS112 Redirection Using DNAME	EMPTY.AS112.ARPA	Ze correctness gap 1	SHOULD not decided 6, Ze correctness gap 1	1	1
`RFC 7606` Revised Error Handling for BGP UPDATE Messages	Revised UPDATE error handling	Ze proven 28, Ze correctness gap 25	Ze MUST proven 28, SHOULD not decided 4, Ze correctness gap 25	53	1
`RFC 7607` Codification of AS 0 Processing	Codification of AS 0 processing	Ze correctness gap 5	Ze correctness gap 5	5	0
`RFC 7611` BGP ACCEPT_OWN Community Attribute	ACCEPT_OWN community	Ze proven 2, Ze correctness gap 3	Ze MUST proven 2, SHOULD not decided 3, Ze correctness gap 3	5	2
`RFC 7634` ChaCha20, Poly1305, and Their Use in the Internet Key Exchange Protocol (IKE) and IPsec	ESP	Ze proven 1, OS testing gap 1	Ze MUST proven 1, SHOULD not decided 3, OS testing gap 1	2	0
`RFC 7684` OSPFv2 Prefix/Link Attribute Advertisement	OSPF Extended Prefix and Link LSAs	Ze proven 4, Ze correctness gap 5	Ze MUST proven 4, SHOULD not decided 11, Ze correctness gap 5	9	3
`RFC 7705` Autonomous System Migration Mechanisms and Their Effects on the BGP AS_PATH Attribute	AS migration: Local AS, No Prepend Inbound, Replace Old AS, Internal BGP AS Migration	Ze proven 9	Ze MUST proven 9, SHOULD not decided 8	9	0
`RFC 7752` North-Bound Distribution of Link-State and Traffic Engineering (TE) Information Using BGP	BGP-LS	Ze proven 8, Ze correctness gap 18	Ze MUST proven 8, SHOULD not decided 26, Ze correctness gap 18	26	16
`RFC 7770` Extensions to OSPF for Advertising Optional Router Capabilities	OSPF Router Information LSA	Ze proven 1, Ze correctness gap 9	Ze MUST proven 1, SHOULD proven 1, Not owed 1, SHOULD not decided 13, Ze correctness gap 9	11	6
`RFC 7854` BGP Monitoring Protocol (BMP)	BMP v3	Ze proven 25, Ze correctness gap 14	Ze MUST proven 25, SHOULD proven 3, SHOULD not decided 6, Ze correctness gap 14	39	0
`RFC 7858` Specification for DNS over Transport Layer Security (TLS)	DNS over TLS (DoT)	Ze proven 3, Ze correctness gap 16	Ze MUST proven 3, SHOULD not decided 19, Ze correctness gap 16	19	12
`RFC 7871` Client Subnet in DNS Queries	EDNS0 Client Subnet	Ze correctness gap 36	SHOULD not decided 52, Ze correctness gap 36	36	34
`RFC 7911` Advertisement of Multiple Paths in BGP	ADD-PATH	Ze proven 9	Ze MUST proven 9, SHOULD not decided 4	9	0
`RFC 792` Internet Control Message Protocol	No public row declared	Ze proven 6, Ze correctness gap 4	Ze MUST proven 6, SHOULD not decided 4, Ze correctness gap 4	10	0
`RFC 7947` Internet Exchange BGP Route Server	BGP Route Server	Ze proven 2, Ze correctness gap 1	Ze MUST proven 2, SHOULD proven 3, SHOULD not decided 2, Ze correctness gap 1	3	1
`RFC 7950` The YANG 1.1 Data Modeling Language	YANG 1.1 data modeling	Ze proven 37, Ze correctness gap 54	Ze MUST proven 37, Ze correctness gap 54	91	51
`RFC 7999` BLACKHOLE Community	BLACKHOLE community	Ze proven 4	Ze MUST proven 4, SHOULD proven 3, SHOULD not decided 9	4	0
`RFC 8050` Multi-Threaded Routing Toolkit (MRT) Routing Information Export Format with BGP Additional Path Extensions	MRT ADD-PATH	Ze proven 5, Ze correctness gap 1	Ze MUST proven 5, Ze correctness gap 1	6	0
`RFC 8092` BGP Large Communities Attribute	Large communities	Ze proven 7	Ze MUST proven 7, SHOULD not decided 4	7	0
`RFC 8097` BGP Prefix Origin Validation State Extended Community	RPKI origin validation state extended community	Ze correctness gap 5	SHOULD not decided 5, Ze correctness gap 5	5	5
`RFC 8106` IPv6 Router Advertisement Options for DNS Configuration	RA DNS options (RDNSS, DNSSL)	Ze correctness gap 11	SHOULD not decided 13, Ze correctness gap 11	11	11
`RFC 8203` BGP Administrative Shutdown Communication	Administrative Shutdown Communication	Ze proven 3, Ze correctness gap 2	Ze MUST proven 3, SHOULD not decided 4, Ze correctness gap 2	5	0
`RFC 8210` The Resource Public Key Infrastructure (RPKI) to Router Protocol, Version 1	RPKI RTR v1	Ze proven 12, Ze correctness gap 44	Ze MUST proven 12, SHOULD proven 6, Not owed 3, SHOULD not decided 21, Ze correctness gap 44	59	29
`RFC 8212` Default External BGP (EBGP) Route Propagation Behavior without Policies	EBGP default reject without policy	Ze proven 2	Ze MUST proven 2, SHOULD not decided 1	2	0
`RFC 8221` Cryptographic Algorithm Implementation Requirements and Usage Guidance for Encapsulating Security Payload (ESP) and Authentication Header (AH)	ESP algorithms	Ze proven 16	Ze MUST proven 16, SHOULD not decided 3	16	0
`RFC 8247` Algorithm Implementation Requirements and Usage Guidance for the Internet Key Exchange Protocol Version 2 (IKEv2)	IKEv2 algorithms	Ze proven 17, Ze correctness gap 3	Ze MUST proven 17, SHOULD not decided 5, Ze correctness gap 3	20	3
`RFC 8277` Using BGP to Bind MPLS Labels to Address Prefixes	BGP Labeled Unicast	Ze proven 11, Ze correctness gap 24	Ze MUST proven 11, SHOULD proven 1, SHOULD not decided 6, Ze correctness gap 24	35	24
`RFC 8414` OAuth 2.0 Authorization Server Metadata	OAuth 2.0 Authorization Server Metadata (MCP resource server)	Ze proven 9, Ze correctness gap 22	Ze MUST proven 9, SHOULD not decided 2, Ze correctness gap 22	31	3
`RFC 8484` DNS Queries over HTTPS (DoH)	DNS Queries over HTTPS (DoH)	Ze proven 1, Ze correctness gap 14	Ze MUST proven 1, Not owed 1, SHOULD not decided 11, Ze correctness gap 14	16	6
`RFC 8522` Looking Glass Command Set	Looking Glass command set API	Ze correctness gap 18	SHOULD not decided 5, Ze correctness gap 18	18	18
`RFC 8571` BGP - Link State (BGP-LS) Advertisement of IGP Traffic Engineering Performance Metric Extensions	No public row declared	no rows	no rows	0	0
`RFC 8654` Extended Message Support for BGP	BGP Extended Message	Ze proven 9, Ze correctness gap 2	Ze MUST proven 9, SHOULD proven 1, Not owed 1, SHOULD not decided 3, Ze correctness gap 2	12	1
`RFC 8665` OSPF Extensions for Segment Routing	OSPF Segment Routing extensions	Ze proven 13, Ze correctness gap 38	Ze MUST proven 13, SHOULD proven 1, SHOULD not decided 34, Ze correctness gap 38	51	14
`RFC 8666` OSPFv3 Extensions for Segment Routing	OSPFv3 Segment Routing	Ze proven 6, Ze correctness gap 26	Ze MUST proven 6, SHOULD not decided 26, Ze correctness gap 26	32	6
`RFC 8669` Segment Routing Prefix Segment Identifier Extensions for BGP	BGP Prefix-SID attribute	Ze proven 13, Ze correctness gap 11	Ze MUST proven 13, SHOULD proven 3, SHOULD not decided 18, Ze correctness gap 11	24	7
`RFC 8671` Support for Adj-RIB-Out in the BGP Monitoring Protocol (BMP)	BMP Adj-RIB-Out	Ze proven 2, Ze correctness gap 9	Ze MUST proven 2, SHOULD not decided 1, Ze correctness gap 9	11	2
`RFC 8707` Resource Indicators for OAuth 2.0	Resource Indicators for OAuth 2.0 (MCP resource server)	Ze correctness gap 2	SHOULD not decided 5, Ze correctness gap 2	2	3
`RFC 8893` Resource Public Key Infrastructure (RPKI) Origin Validation for BGP Export	RPKI origin validation on export	Ze correctness gap 4	SHOULD not decided 2, Ze correctness gap 4	4	4
`RFC 8907` The Terminal Access Controller Access-Control System Plus (TACACS+) Protocol	TACACS+	Ze proven 38, Ze correctness gap 18	Ze MUST proven 38, SHOULD not decided 2, Ze correctness gap 18	56	6
`RFC 8950` Advertising IPv4 Network Layer Reachability Information (NLRI) with an IPv6 Next Hop	Extended Next Hop	Ze proven 3, Ze correctness gap 3	Ze MUST proven 3, SHOULD not decided 2, Ze correctness gap 3	6	0
`RFC 8955` Dissemination of Flow Specification Rules	IPv4 FlowSpec	Ze proven 13, Ze correctness gap 15	Ze MUST proven 13, SHOULD proven 6, Not owed 1, SHOULD not decided 14, Ze correctness gap 15	29	1
`RFC 8956` Dissemination of Flow Specification Rules for IPv6	IPv6 FlowSpec	Ze proven 7, Ze correctness gap 2	Ze MUST proven 7, SHOULD not decided 5, Ze correctness gap 2	9	0
`RFC 9003` Extended BGP Administrative Shutdown Communication	Administrative Shutdown Communication update	Ze proven 1, Ze correctness gap 3	Ze MUST proven 1, SHOULD not decided 7, Ze correctness gap 3	4	0
`RFC 9012` The BGP Tunnel Encapsulation Attribute	Tunnel Encapsulation attribute	Ze proven 25, Ze correctness gap 50	Ze MUST proven 25, Not owed 1, SHOULD not decided 22, Ze correctness gap 50	76	50
`RFC 905` ISO Transport Protocol Specification (ISO DP 8073)	Fletcher checksum (ISO Transport Annex B)	Ze proven 8, Ze correctness gap 3	Ze MUST proven 8, Ze correctness gap 3	11	3
`RFC 9069` Support for Local RIB in the BGP Monitoring Protocol (BMP)	BMP Loc-RIB monitoring	Ze proven 9, Ze correctness gap 7	Ze MUST proven 9, Ze correctness gap 7	16	0
`RFC 9072` Extended Optional Parameters Length for BGP OPEN Message	Extended Optional Parameters Length for BGP OPEN	Ze proven 5, Ze correctness gap 4	Ze MUST proven 5, SHOULD proven 1, SHOULD not decided 2, Ze correctness gap 4	9	4
`RFC 9085` Border Gateway Protocol - Link State (BGP-LS) Extensions for Segment Routing	BGP-LS Segment Routing extensions	Ze proven 9	Ze MUST proven 9, SHOULD proven 3, SHOULD not decided 2	9	0
`RFC 9086` Border Gateway Protocol - Link State (BGP-LS) Extensions for Segment Routing BGP Egress Peer Engineering	BGP-LS Egress Peer Engineering SIDs	Ze proven 7, Ze correctness gap 4	Ze MUST proven 7, SHOULD not decided 9, Ze correctness gap 4	11	3
`RFC 9117` Revised Validation Procedure for BGP Flow Specifications	FlowSpec validation	Ze proven 2	Ze MUST proven 2, SHOULD not decided 3	2	0
`RFC 9136` IP Prefix Advertisement in Ethernet VPN (EVPN)	EVPN IP Prefix (RT-5)	Ze proven 3, Ze correctness gap 11	Ze MUST proven 3, SHOULD not decided 6, Ze correctness gap 11	14	8
`RFC 9234` Route Leak Prevention and Detection Using Roles in UPDATE and OPEN Messages	BGP Role and OTC	Ze proven 8, Ze correctness gap 11	Ze MUST proven 8, SHOULD proven 1, SHOULD not decided 4, Ze correctness gap 11	19	3
`RFC 9252` BGP Overlay Services Based on Segment Routing over IPv6 (SRv6)	BGP SRv6 Service TLV (Prefix-SID)	Ze proven 14, Ze correctness gap 11	Ze MUST proven 14, SHOULD not decided 5, Ze correctness gap 11	25	3
`RFC 9256` Segment Routing Policy Architecture	Segment Routing Policy Architecture	Ze correctness gap 22	SHOULD not decided 47, Ze correctness gap 22	22	20
`RFC 9494` Long-Lived Graceful Restart for BGP	Long-Lived Graceful Restart	Ze proven 8, Ze correctness gap 17	Ze MUST proven 8, SHOULD proven 1, SHOULD not decided 10, Ze correctness gap 17	25	7
`RFC 9514` Border Gateway Protocol - Link State (BGP-LS) Extensions for Segment Routing over IPv6 (SRv6)	BGP-LS SRv6 extensions	Ze proven 15, Ze correctness gap 5	Ze MUST proven 15, SHOULD not decided 3, Ze correctness gap 5	20	3
`RFC 9552` Distribution of Link-State and Traffic Engineering Information Using BGP	BGP-LS (obsoletes RFC 7752)	Ze proven 44, Ze correctness gap 14	Ze MUST proven 44, SHOULD proven 1, Not owed 1, SHOULD not decided 29, Ze correctness gap 14	59	7
`RFC 9568` Virtual Router Redundancy Protocol (VRRP) Version 3 for IPv4 and IPv6	VRRPv3 (IPv4 and IPv6)	Ze proven 37, Ze correctness gap 29	Ze MUST proven 37, SHOULD proven 3, SHOULD not decided 25, Ze correctness gap 29	66	10
`RFC 9687` Border Gateway Protocol 4 (BGP-4) Send Hold Timer	Send Hold Timer	Ze proven 3, Ze correctness gap 10	Ze MUST proven 3, SHOULD not decided 7, Ze correctness gap 10	13	0
`RFC 9728` OAuth 2.0 Protected Resource Metadata	OAuth 2.0 Protected Resource Metadata (MCP resource server)	Ze proven 9, Ze correctness gap 17	Ze MUST proven 9, SHOULD proven 2, SHOULD not decided 4, Ze correctness gap 17	26	6
`RFC 9774` Deprecation of AS_SET and AS_CONFED_SET in BGP	Deprecation of AS_SET and AS_CONFED_SET	Ze proven 2, Ze correctness gap 1	Ze MUST proven 2, Ze correctness gap 1	3	1
`RFC 9830` BGP Extensions for the Advertisement of Segment Routing (SR) Policies	BGP SR Policy	Ze proven 37, Ze correctness gap 60	Ze MUST proven 37, SHOULD not decided 41, Ze correctness gap 60	97	24
`RFC 9915` Dynamic Host Configuration Protocol for IPv6 (DHCPv6)	DHCPv6	Ze proven 82, OS testing gap 3, Ze correctness gap 41	Ze MUST proven 82, OS testing gap 3, Ze correctness gap 41	126	40
`SFLOW-V5` sFlow: A Method for Monitoring Traffic in Switched and Routed Networks	sFlow export	Ze proven 22, OS testing gap 1, Ze correctness gap 9	Ze MUST proven 22, SHOULD proven 3, SHOULD not decided 8, OS testing gap 1, Ze correctness gap 9	32	9

Summaries that are not enrolled

RFCs Ze keeps a summary for that the gate does not hold Ze to, each with the kind of reason and the reason itself.

backlog: the requirements have not been extracted from the document yet; this is work owed rather than a decision
blocked: something outside the summary stops the extraction, and it is named in the reason
foundation: the document defines, registers or describes, and obliges no implementer, so there is no implementation anywhere for a gate to hold
non-normative: the document imposes no MUST-level obligation on an implementation, so there is nothing to gate
out-of-scope: the requirements ARE extracted and the owner decided not to offer the feature for now, so the absence is a scope decision rather than a conformance gap
third-party: a layer under or beside Ze performs the document and Ze holds no Go code for it, so the reason beside this kind names the component that does

RFC	MUST bar	Overview bar	Disposition	Reason
`DRAFT-IETF-SIDROPS-8210BIS` The Resource Public Key Infrastructure (RPKI) to Router Protocol, Version 2	not walked	not walked	backlog	Existing RTR v2 ledger awaiting requirement reattribution from the historical RFC 9582 identifiers. The cached authority is revision 27; proof relocation and enrolment must preserve the source requirements and their tests.
`RFC 1035` Domain Names - Implementation and Specification	Ze proven 12, Ze correctness gap 15	Ze MUST proven 12, SHOULD not decided 6, Ze correctness gap 15	backlog	Domain Names: Implementation and Specification. Re-authored 2026-07-30 and it now declares 27 MUST-level obligations read from the indicative prose of a 1987 document (0 capitalised keywords, 23 lowercase must), so this is no longer an empty checklist. It is not enrolled because the obligations are not all proven and the unproven ones need an owner ruling, not an implementer's annotation. The obligation with no code path in Ze is zone transfer: Ze performs none, and the owner ruled RFC 1035 out of scope on 2026-08-18, so that work is not to be started. The 512-octet UDP bound and the TC bit ARE enforced -- send calls Msg.Truncate(udpReplyLimit(r)) for a datagram reply in internal/core/dnsserver/handler.go, and udpReplyLimit holds the Section 2.3.4 floor while letting an RFC 6891 Section 6.2.3 OPT record raise it. An unsupported inverse query DOES draw Not Implemented: Authoritative branches on the opcode before any zone lookup, in the same file. It was the one obligation the 73-section walk found OUTSIDE the summary's declared scope and added to it. The response TTL is deliberately not raised to the SOA MINIMUM -- RFC 2308 Section 4 withdrew that rule, hdr in internal/plugins/geodns/server.go applies no floor, and TestRFC2308_NoZoneWideTTLFloor holds the decision. About 6 requirements admit only a positive polarity because miekg/dns owns the wire codec and no Ze-side change can break them. Escalated for scoping per OR-1b.
`RFC 1570` PPP LCP Extensions	Ze correctness gap 22	SHOULD not decided 16, Ze correctness gap 22	out-of-scope	OUT OF SCOPE as a document by owner decision, 2026-10-26: the owner rule committed in 1e7a9dbc34 (ai/META-DECISIONS.md, Goal and scope) counts an RFC a profile lists as optional only once Thomas brings it into scope, and this summary's `Optional use cases` row lists this RFC in the optional tier of the lns profile. The extraction is COMPLETE: the source text is at rfc/full/rfc1570.txt, every capitalised MUST-level sentence is a row of this summary or an exclusion in rfc/extraction/rfc1570.json (walked 2026-10-26), and none is gated. Ze's PPP implements none of the LCP codes or options this document adds (internal/component/l2tp/ppp/lcp_options.go carries options 1, 2, 3, 5, 7 and 8 only), so an Identification or Time-Remaining packet is answered as an unknown code under RFC 1661.
`RFC 2867` RADIUS Accounting Modifications for Tunnel Protocol Support	Ze correctness gap 1	SHOULD not decided 16, Ze correctness gap 1	out-of-scope	OUT OF SCOPE as a document by owner decision, 2026-10-26: the owner rule committed in 1e7a9dbc34 (ai/META-DECISIONS.md, Goal and scope) counts an RFC a profile lists as optional only once Thomas brings it into scope, and this summary's `Optional use cases` row lists this RFC in the optional tier of the lns profile. The extraction is COMPLETE: the source text is at rfc/full/rfc2867.txt, every capitalised MUST-level sentence is a row of this summary or an exclusion in rfc/extraction/rfc2867.json (walked 2026-10-26), and none is gated. Ze's accounting records carry no tunnel attributes and no tunnel Acct-Status-Type values (internal/component/l2tp/plugins/authradius/acct.go buildAcctPacket).
`RFC 2868` RADIUS Attributes for Tunnel Protocol Support	Ze correctness gap 18	SHOULD not decided 43, Ze correctness gap 18	out-of-scope	OUT OF SCOPE as a document by owner decision, 2026-10-26: the owner rule committed in 1e7a9dbc34 (ai/META-DECISIONS.md, Goal and scope) counts an RFC a profile lists as optional only once Thomas brings it into scope, and this summary's `Optional use cases` row lists this RFC in the optional tier of the lns profile. The extraction is COMPLETE: the source text is at rfc/full/rfc2868.txt, every capitalised MUST-level sentence is a row of this summary or an exclusion in rfc/extraction/rfc2868.json (walked 2026-10-26), and none is gated. Ze's radius dictionary holds none of the tunnel attributes (types 64 to 67, 69, 81, 82, 83, 90, 91; internal/component/radius/dict.go), and the LNS reads none from an Access-Accept.
`RFC 3022` Traditional IP Network Address Translator (Traditional NAT)	no rows	no rows	non-normative	Traditional IP Network Address Translator, published with IETF category Informational. The text carries no RFC 2119 key-words section and a capitalised MUST / MUST NOT / SHALL / SHALL NOT / REQUIRED / SHOULD / MAY scan over rfc/full/rfc3022.txt finds zero keywords. Its lowercase "must" sentences describe how the Basic NAT and NAPT operations it defines rewrite a packet; the normative NAT behavioral requirements are stated by RFC 4787 (UDP) and RFC 5382 (TCP), which carry their own summaries.
`RFC 3145` L2TP Disconnect Cause Information	Ze correctness gap 8	SHOULD not decided 10, Ze correctness gap 8	out-of-scope	OUT OF SCOPE as a document by owner decision, 2026-10-26: the owner rule committed in 1e7a9dbc34 (ai/META-DECISIONS.md, Goal and scope) counts an RFC a profile lists as optional only once Thomas brings it into scope, and this summary's `Optional use cases` row lists this RFC in the optional tier of the lns profile. The extraction is COMPLETE: the source text is at rfc/full/rfc3145.txt, every capitalised MUST-level sentence is a row of this summary or an exclusion in rfc/extraction/rfc3145.json (walked 2026-10-26), and none is gated. Ze's L2TP stack defines no AVP 46 (internal/component/l2tp/avp.go) and sends none in a Call-Disconnect-Notify.
`RFC 3882` Configuring BGP to Block Denial-of-Service Attacks	no rows	no rows	non-normative	Configuring BGP to Block Denial-of-Service Attacks, IETF category Informational. A capitalised MUST / MUST NOT / SHALL / SHALL NOT / REQUIRED / SHOULD / MAY scan over rfc/full/rfc3882.txt hits zero keywords, and the document invokes neither RFC 2119 nor BCP 14 anywhere, so it declares no key-words machinery for a reader to read its prose by. It describes an operator configuration recipe: per-border-router BGP communities that rewrite the next hop of an attacked prefix to a null or sinkhole tunnel interface. The four lower-case modal sentences the prose inventory finds are steps of that recipe ("R1 and R2 must be configured with the following", "The advertisement must contain the community value"), a description ("It might also be required"), and copyright boilerplate. The summary captures no requirement. The walk is recorded in rfc/extraction/rfc3882.json at register prose, all 4 sites excluded as not-a-requirement.
`RFC 4033` DNS Security Introduction and Requirements	no rows	no rows	non-normative	DNS Security Introduction and Requirements, the introduction to the DNSSEC document set. The text carries no RFC 2119 key-words section, and a capitalised MUST / MUST NOT / SHALL / SHALL NOT / REQUIRED / SHOULD / MAY scan over rfc/full/rfc4033.txt finds zero keywords. Its lowercase "must" sentences introduce obligations that RFC 4034 (the resource records) and RFC 4035 (the protocol modifications) state with RFC 2119 keywords; both carry their own summaries. Every such sentence is classified in rfc/extraction/rfc4033.json.
`RFC 4034` Resource Records for the DNS Security Extensions	Ze correctness gap 59	Ze correctness gap 59	out-of-scope	Decision taken 2026-10-26: the owner ruled that DNSSEC is not urgent and lists RFC 4033 and RFC 4034 as optional only, never required, for the fttx-edge use case (spec-rfc-profile-declared-membership), and moved DNSSEC validation to post-release the same day (commit 5ff4834b67). The extraction is done: every MUST-level sentence of the text is a row below and is mapped in rfc/extraction/rfc4034.json. The declined feature is DNSSEC record handling itself: ze signs no zone, holds and serves no DNSKEY, RRSIG, NSEC or DS record of its own, and validates no signature. Its resolver is a security-aware non-validating stub whose obligations are gated in rfc/short/rfc4035.md.
`RFC 4762` Virtual Private LAN Service (VPLS) Using Label Distribution Protocol (LDP) Signaling	not walked	not walked	blocked	VPLS using LDP signaling. Written 2026-09-01 so the public row this RFC has always carried is declared by a summary rather than authored on a page nobody could tie back to a document. It is not enrolled because there is no source text at rfc/full/rfc4762.txt: fetch https://www.rfc-editor.org/rfc/rfc4762.txt, then extract. Ze speaks the BGP-signalled VPLS of RFC 4761 and not this one, so the row claims Unsupported and no obligation here is gated.
`RFC 4818` RADIUS Delegated-IPv6-Prefix Attribute	Ze correctness gap 3	SHOULD not decided 3, Ze correctness gap 3	out-of-scope	OUT OF SCOPE as a document by owner decision, 2026-10-26: the owner rule committed in 1e7a9dbc34 (ai/META-DECISIONS.md, Goal and scope) counts an RFC a profile lists as optional only once Thomas brings it into scope, and this summary's `Optional use cases` row lists this RFC in the optional tier of the lns profile. The extraction is COMPLETE: the source text is at rfc/full/rfc4818.txt, every capitalised MUST-level sentence is a row of this summary or an exclusion in rfc/extraction/rfc4818.json (walked 2026-10-26), and none is gated. Ze reads no Delegated-IPv6-Prefix from an Access-Accept and writes none (internal/component/l2tp/plugins/authradius/extract.go extractAuthMetadata, handler.go buildAccessRequestAttrs, acct.go buildAcctPacket).
`RFC 5065` Autonomous System Confederations for BGP	not walked	not walked	blocked	BGP confederations. Written 2026-09-01 for the same reason as the other six rows that had no summary: the public claim now lives in the document it is about. It is not enrolled because there is no source text at rfc/full/rfc5065.txt: fetch https://www.rfc-editor.org/rfc/rfc5065.txt, then extract. The row claims Unsupported, so no obligation here is gated.
`RFC 5120` M-ISIS: Multi Topology (MT) Routing in Intermediate System to Intermediate Systems (IS-ISs)	not walked	not walked	blocked	IS-IS multi-topology routing. Written 2026-09-01 so the public row is declared by a summary. It is not enrolled because there is no source text at rfc/full/rfc5120.txt: fetch https://www.rfc-editor.org/rfc/rfc5120.txt, then extract. Ze runs IS-IS single-topology dual-stack only and the row claims Unsupported, so no obligation here is gated.
`RFC 5685` Redirect Mechanism for the Internet Key Exchange Protocol Version 2 (IKEv2)	Ze correctness gap 26	SHOULD not decided 9, Ze correctness gap 26	out-of-scope	OUT OF SCOPE as a document by owner decision, 2026-10-26: the owner rule committed in 1e7a9dbc34 (ai/META-DECISIONS.md, Goal and scope) counts an RFC a profile lists as optional only once Thomas brings it into scope, and this summary's `Optional use cases` row lists this RFC in the optional tier of the vpn-concentrator profile. The extraction is COMPLETE: the source text is at rfc/full/rfc5685.txt and the extraction sign-off is rfc/extraction/rfc5685.json. Ze implements none of it, and each MUST-level row keeps its `{gap}` note naming the absent producer: all 26 MUST-level requirements are classified, and all 26 are `{gap}`, because Ze's IKE engine implements neither the gateway nor the client side of redirect. `internal/component/ike/wire/payload_notify.go` declares none of REDIRECT_SUPPORTED (16406), REDIRECT (16407) or REDIRECTED_FROM (16408). Three sites are excluded in the extraction sign-off: two bind a Mobile IPv6 mobile node, which Ze does not implement, and one binds the author of a future specification.
`RFC 5925` The TCP Authentication Option	not walked	not walked	blocked	The TCP Authentication Option. Written 2026-09-01 so the public row is declared by a summary. It is not enrolled because there is no source text at rfc/full/rfc5925.txt: fetch https://www.rfc-editor.org/rfc/rfc5925.txt, then extract. Ze implements the RFC 2385 TCP MD5 signature option and not TCP-AO, and the row claims Unsupported, so no obligation here is gated.
`RFC 6071` IP Security (IPsec) and Internet Key Exchange (IKE) Document Roadmap	Ze correctness gap 8	SHOULD not decided 12, Ze correctness gap 8	foundation	An informational roadmap over the IPsec and IKE document set. It defines no behaviour of its own.
`RFC 6482` A Profile for Route Origin Authorizations (ROAs)	Ze correctness gap 9	SHOULD not decided 1, Ze correctness gap 9	third-party	The RPKI cache validates the CMS-signed ROA object. Ze consumes an already-validated payload over the RTR protocol, internal/component/bgp/plugins/rpki/rtr_pdu.go.
`RFC 6514` BGP Encodings and Procedures for Multicast in MPLS/BGP IP VPNs	not walked	not walked	out-of-scope	BGP Encodings and Procedures for Multicast in MPLS/BGP IP VPNs. OUT OF SCOPE by owner decision, 2026-09-01, marked for future development. The extraction is COMPLETE: the source text is at rfc/full/rfc6514.txt and this summary declares all 201 requirements, 133 of them MUST-level, so a later decision to build MVPN starts from the obligations rather than from nothing. What Ze has today is NLRI plumbing and nothing the RFC is about: the Section 4 route-type split (splitMVPN, internal/core/bgp/nlri/nlrisplit/mvpn.go), an NLRI codec, a config route parser for three of the seven route types, and opaque Adj-RIB-In storage. Exactly one MUST-level requirement is met and it is met vacuously -- RFC6514-9.1.1-10 says the Leaf Information Required flag "MUST be set to zero and MUST be ignored on receipt", and Ze ignores it by never parsing a PMSI byte, because knownAttrParsers leaves attribute code 22 nil. Absent entirely: the PMSI Tunnel attribute, the PE Distinguisher Labels attribute (code 27 has no constant), the Source AS and VRF Route Import extended communities, auto-discovery, the C-multicast route exchange, S-PMSI routes, inter-AS and ASBR operation, upstream multicast hop selection (SAFI 129 is unregistered), and every protocol the document leans on -- PIM, mLDP, RSVP-TE P2MP and MSDP. No {gap} annotation is written for any of it: a gap is an ISSUE and this is a DECISION (ai/rules/rfc-compliance.md), and 132 gap rows would record a feature nobody chose to build as 132 conformance failures.
`RFC 6911` RADIUS Attributes for IPv6 Access Networks	Ze correctness gap 3	SHOULD not decided 9, Ze correctness gap 3	out-of-scope	OUT OF SCOPE as a document by owner decision, 2026-10-26: the owner rule committed in 1e7a9dbc34 (ai/META-DECISIONS.md, Goal and scope) counts an RFC a profile lists as optional only once Thomas brings it into scope, and this summary's `Optional use cases` row lists this RFC in the optional tier of the lns profile. The extraction is COMPLETE: the source text is at rfc/full/rfc6911.txt, every capitalised MUST-level sentence is a row of this summary or an exclusion in rfc/extraction/rfc6911.json (walked 2026-10-26), and none is gated. Ze reads none of the five attributes (types 168 to 172) from an Access-Accept and writes none (internal/component/l2tp/plugins/authradius/extract.go extractAuthMetadata).
`RFC 6987` OSPF Stub Router Advertisement	not walked	not walked	backlog	OSPF Stub Router Advertisement. Its five obligations sit behind bare [LSA]-style category tags, which parse_checklist_line reads as prose rather than as requirements, so the summary captures zero at any level while the source is normative. Declared backlog and not non-normative on purpose: calling it non-normative would launder five unparsed obligations into a decision, which is exactly the shape D5 exists to expose.
`RFC 7383` Internet Key Exchange Protocol Version 2 (IKEv2) Message Fragmentation	Ze correctness gap 25	SHOULD not decided 15, Ze correctness gap 25	out-of-scope	OUT OF SCOPE as a document by owner decision, 2026-10-26: the owner rule committed in 1e7a9dbc34 (ai/META-DECISIONS.md, Goal and scope) counts an RFC a profile lists as optional only once Thomas brings it into scope, and this summary's `Optional use cases` row lists this RFC in the optional tier of the vpn-endpoint and vpn-concentrator profiles. The extraction is COMPLETE: the source text is at rfc/full/rfc7383.txt and this summary declares all 25 MUST-level requirements its sites state. Ze implements none of it: internal/component/ike/wire/payload_notify.go names IKEV2_FRAGMENTATION_SUPPORTED (16430) for display only, ze never sends it, and no Encrypted Fragment payload (53) is built or reassembled.
`RFC 7454` BGP Operations and Security	no rows	SHOULD not decided 64	non-normative	BGP Operations and Security, published as BCP 194 with IETF category Best Current Practice. A capitalised MUST / MUST NOT / SHALL / SHALL NOT scan over rfc/full/rfc7454.txt hits four keywords and all four sit inside the RFC 2119 key-words sentence of section 1.1, which tells a reader how to read the other sentences and states no obligation of its own. Outside that sentence the document uses no MUST-level keyword except one NOT REQUIRED in section 5.1, and that phrase negates a requirement instead of stating one. The summary written 2026-08-08 therefore captures 64 requirements and gates none of them: 42 SHOULD, 12 SHOULD NOT, 8 RECOMMENDED, 1 MAY, and the single NOT REQUIRED of section 5.1 recorded at the OPTIONAL level. The document also addresses network administrators rather than protocol implementers, and section 12 states that it "does not aim to describe existing BGP implementations". A zero-MUST BCP can reach the public ledger two ways, as a non-normative disposition or as a manual-walk extraction sign-off with a register-reason, and that choice is a ledger judgement for the owner. Thomas made it on 2026-08-12: non-normative, on the grounds that the scan recorded above finds no MUST-level keyword outside the key-words sentence, so backlog overstated a debt this text does not create. The choice is no longer open.
`RFC 7627` Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension	not walked	not walked	backlog	TLS Session Hash and Extended Master Secret Extension. Summary written 2026-08-24 against rfc/full/rfc7627.txt, which was fetched the same day. It declares 27 requirements: 17 MUST-level over 5 sections, 9 at SHOULD level (8 SHOULD / SHOULD NOT plus one NOT RECOMMENDED) and 1 MAY. It is NOT enrolled because not one of the 17 has a producer inside Ze, so neither route to enrolment is an implementer's to take: there is no Ze function a positive and a negative test could tag, and annotating the remainder is a conformance judgement ai/rules/rfc-compliance.md reserves to the owner. WHERE THE OBLIGATIONS ARE DISCHARGED. Go's crypto/tls owns the extension end to end. Its client sets extendedMasterSecret on every ClientHello it builds (makeClientHello, crypto/tls/handshake_client.go), clearing it only for an ECH inner hello; its server copies the client's bit into the ServerHello (serverHandshakeState.processClientHello, crypto/tls/handshake_server.go); the negotiated result lands on Conn.extMasterSecret; and the Section 5.3 abbreviated-handshake mismatch rules are enforced in clientHandshakeState.processServerHello and serverHandshakeState.checkForResumption. Ze holds no ClientHello or ServerHello encoder and no master-secret derivation, so RFC7627-5.1-1, 5.2-1, 5.2-2, 5.2-4, 5.2-6, 5.3-3, 5.3-4, 5.3-6, 5.3-8, 5.3-9, 5.3-10 and 6.4-2 have no Ze-side producer at all. The Section 5.4 downgrade containment (RFC7627-5.4-1 to 5.4-4 and 5.4-6) is enforced below Ze too: Conn.connectionStateLocked selects noEKMBecauseNoEMS on `c.vers != VersionTLS13 && !c.extMasterSecret` (Conn.connectionStateLocked, crypto/tls/conn.go), which is the MUST NOT of RFC7627-5.4-1 executed by the library rather than by its caller. Ze sets no tls.Config.Renegotiation and computes no tls-unique -- the sha256(TLSUnique) fallback was removed from tlsMethod.deriveKeys -- and the authenticator now issues a TLS 1.3 session ticket per RFC 9190 Section 2.1.2, whose resumption is a TLS 1.3 PSK exchange and not the RFC 7627 abbreviated handshake this document governs (newTLSMethod, internal/core/eap/eap_tls.go). WHAT ZE ACTUALLY PRODUCES is the refusal path, and it is two functions in internal/core/eap/eap_tls.go: exportEAPTLSKeys returns the crypto/tls error rather than a zero MSK, and eapTLS12ExportRefused names the peer, the negotiated version, RFC 7627 and the operator's three remedies (move the peer to TLS 1.3 per RFC 9190, add RFC 7627 to its TLS 1.2 stack, or configure another EAP method). RFC 5216 Section 2.3 defines the EAP-TLS MSK as that export, so a TLS 1.2 peer whose session carries no extended master secret cannot authenticate. strongSwan 5.9.14 reaches that state by DEFAULT rather than by limitation: charon ships version_max = 1.2 and negotiates no RFC 7627, while charon.tls.version_max = 1.3 on the same build reaches an established SA (test/interop-ipsec/scenarios/eap-tls13/strongswan.conf, and the failing counterpart is test/interop-ipsec/scenarios/eap-tls). TWO FACTS AN OWNER RULING HAS TO ABSORB. First, RFC 7627 IS OBSOLETE. RFC 9846 (The Transport Layer Security (TLS) Protocol Version 1.3, July 2026) obsoletes RFC 5077, 5246, 6961, 7627, 8422 and 8446; its Appendix D renames the extension to Extended Main Secret and the code point to extended_main_secret, and leaves the Section 4 PRF label unchanged for compatibility; its Appendix E states the only obligation it adds about the extension, a SHOULD that an implementation supporting both TLS 1.3 and earlier versions indicate the use of the Extended Main Secret extension in its APIs whenever TLS 1.3 is used. ai/rules/rfc-compliance.md says the lineage that matters runs FORWARD, so the document that states what Ze owes today is RFC 9846, and rfc/full/rfc9846.txt is not in this repository. Enrolling rfc7627 would gate a superseded text. Second, the tlsunsafeekm override is GONE from this checkout, as of the toolchain bump on 2026-08-25. go.mod pins `toolchain go1.27.0`, whose internal/godebugs/table.go carries `{Name: "tlsunsafeekm", Removed: 27, Old: one}`, so a process that sets it to its old value raises a fatal error before main() rather than getting the unsafe export. crypto/tls agrees at the other end: noEKMBecauseNoEMS (crypto/tls/prf.go) now returns the bare sentence with no override clause at all. So the claim cmd/ze/main.go and the RFC 5216 row of docs/features/rfc-status.md both make, that no override remains, is true of what this tree builds; it was false while the toolchain was 1.26. Escalated for a scoping ruling, per the route rfc1035 and rfc9190 took.
`RFC 7948` Internet Exchange BGP Route Server Operations	no rows	SHOULD not decided 11	non-normative	Internet Exchange BGP Route Server Operations, IETF category Informational. A capitalised MUST / MUST NOT / SHALL / SHALL NOT / REQUIRED scan over rfc/full/rfc7948.txt hits zero keywords outside the Section 1.1 key-words paragraph. The capitalised keywords it does use are RECOMMENDED (five times, Sections 4.3, 4.4 and 4.5) and SHOULD (six times, Sections 4.6.1, 4.6.3, 4.8, 4.9 and 5), so the text states operational guidance at advisory level only. The lower-case "must" sentences the prose inventory finds describe consequences (the Decision Process "must be applied" to every Loc-RIB, routes "must be transmitted individually") or the operator's dependence on client data, and none binds an implementation. The summary captures 11 advisory requirements and gates none. The walk is recorded in rfc/extraction/rfc7948.json at register prose, all 8 sites excluded as not-a-requirement.
`RFC 8031` Curve25519 and Curve448 for the Internet Key Exchange Protocol Version 2 (IKEv2) Key Agreement	Ze correctness gap 3	Ze correctness gap 3	out-of-scope	OUT OF SCOPE as a document by owner decision, 2026-10-26: the owner rule committed in 1e7a9dbc34 (ai/META-DECISIONS.md, Goal and scope) counts an RFC a profile lists as optional only once Thomas brings it into scope, and this summary's `Optional use cases` row lists this RFC in the optional tier of the vpn-endpoint and vpn-concentrator profiles. The extraction is COMPLETE: the source text is at rfc/full/rfc8031.txt and the extraction sign-off is rfc/extraction/rfc8031.json. Ze implements none of it, and each MUST-level row keeps its `{gap}` note naming the absent producer: all 3 MUST-level requirements are classified, and all 3 are `{gap}`, because Ze's IKE engine implements neither Diffie-Hellman group 31 nor group 32. `internal/component/ike/crypto/dh.go::NewDHExchange` builds MODP group 14 and ECP groups 19 and 20 only, and answers `ErrUnsupportedGroup` for every other group number.
`RFC 8195` Use of BGP Large Communities	not walked	not walked	non-normative	Use of BGP Large Communities, IETF category Informational. A capitalised MUST / MUST NOT / SHALL / SHALL NOT / REQUIRED scan over rfc/full/rfc8195.txt hits zero keywords, and the document invokes neither RFC 2119 nor RFC 8174 nor BCP 14 anywhere, so it declares no key-words machinery for a reader to read its prose by. Its own abstract calls it examples and inspiration for operator application of BGP Large Communities. The summary written against it captures 3 requirements and gates none: RFC8195-2-1, RFC8195-2.2-1 and RFC8195-4.3.3-1, all at SHOULD. Section 3.2 and Section 4.1.1 both say an AS could assign a function number, which states a convention rather than an obligation. Thomas ruled on 2026-08-12 that this is non-normative rather than backlog.
`RFC 8326` Graceful BGP Session Shutdown	not walked	not walked	blocked	Graceful BGP Session Shutdown. The text is at rfc/full/rfc8326.txt (fetched 2026-09-26); enrolment waits on its extraction walk.
`RFC 8362` OSPFv3 Link State Advertisement (LSA) Extensibility	not walked	not walked	out-of-scope	OSPFv3 Link State Advertisement (LSA) Extensibility. OUT OF SCOPE as a document by owner decision, 2026-09-01, marked for future development. The extraction is COMPLETE: the source text is at rfc/full/rfc8362.txt and this summary declares all 50 requirements, 38 of them MUST-level. What Ze has is a by-product of RFC 8666 Segment Routing rather than the framework this document defines: three of the seven Extended LSA types are originated, and only when segment routing is enabled (v6OriginateSR, internal/plugins/ospf/sr_origination_v6.go); receipt decoding is reached from one place and reads Prefix-SIDs alone (v6ReceivedPrefixSIDs, sr_reception_v6.go); no SPF calculation reads an Extended LSA, because the base Router-LSA remains the sole SPF vertex; and there is no RFC 8362 configuration surface and none of its Appendix A or B migration machinery. Nine MUST-level requirements are genuinely unmet and 20 more are met only because Ze performs no action on their subject. RFC8362-2-1 was the most serious until a9d0b54387 (2026-09-20) set the U-bit on the Extended LS type constants (internal/plugins/ospf/v3/types/lsa.go, 0xA021 E-Router-LSA), as Section 2 requires; TestRFC8362ExtendedLSAsSetUBitOnTheWire reads it on the wire for all three Extended LSA types Ze originates (E-Router, E-Intra-Area-Prefix and, from 2026-10-21, E-Inter-Area-Prefix).
`RFC 8538` Notification Message Support for BGP Graceful Restart	not walked	not walked	blocked	Notification message support for BGP graceful restart. Written 2026-09-01 so the public row is declared by a summary. It is not enrolled because there is no source text at rfc/full/rfc8538.txt: fetch https://www.rfc-editor.org/rfc/rfc8538.txt, then extract. The row claims Unsupported, so no obligation here is gated.
`RFC 9129` YANG Data Model for the OSPF Protocol	not walked	not walked	blocked	YANG Data Model for the OSPF Protocol. The text is at rfc/full/rfc9129.txt (fetched 2026-09-26); enrolment waits on its extraction walk.
`RFC 9190` EAP-TLS 1.3: Using the Extensible Authentication Protocol with TLS 1.3	Ze proven 42, Ze correctness gap 11	Ze MUST proven 42, SHOULD proven 2, SHOULD not decided 41, Ze correctness gap 11	backlog	EAP-TLS 1.3: Using EAP with TLS 1.3. Summary written 2026-08-01, extraction sign-off walked 2026-09-08 (rfc/extraction/rfc9190.json, 52 sites in 36 sections, register prose, 48 mapped and 4 excluded). It declares 52 MUST-level obligations over 20 sections. It is NOT enrolled because 33 of them are not proven in both polarities: 26 carry no tagged test at all and 7 carry a positive only. Measured 2026-09-08 by counting `RFC requirement: RFC9190-<id> <polarity>` tags under internal/, test/, cmd/ and pkg/ against the gated rows of this checklist. Enrolment demands every gated MUST proven in both polarities or annotated, and annotating is the conformance judgement ai/rules/rfc-compliance.md reserves to the owner; the owner ruling of 2026-08-01 chose to implement the features and enrol with everything proven, so the annotation route is closed. WHAT IS BUILT AND PROVEN, all in both polarities. Section 2.3 key derivation: exportEAPTLSKeys (internal/core/eap/eap_tls.go) selects the exporter label EXPORTER_EAP_TLS_Key_Material and the EAP Type octet as context whenever the negotiated version is TLS 1.3, asks for the 128-octet length on every version, and cuts the result into MSK = Key_Material(0, 63) and EMSK = Key_Material(64, 127), and test/interop-ipsec/scenarios/eap-tls13 exercises that path against strongSwan. Section 2.5 protected success indication, both roles: tlsMethod.indicateSuccess (same file) writes the encrypted TLS record carrying application data 0x00 in the round that completes the handshake, and PeerSession.requireSuccessIndication (internal/core/eap/peer_indication.go) refuses the EAP-Success without it; scenario responder-eap-tls13 proves the server half against strongSwan, which logs `missing protected success indication for EAP-TLS with TLS 1.3` when the write is reverted. The peer half is STRICTER than the published RFC, which addresses Section 2.5 only to the server, so no requirement id covers it and its tests carry no RFC requirement tag. Section 2.1.2 and 2.1.3 resumption, both roles: Resumption (internal/core/eap/resumption.go) owns the ticket keys and the client cache per peering, and serverChainCheck.rebuildResumedChains (internal/core/eap/peer_chain.go) rebuilds the chain crypto/tls skips on a resumed handshake so the Section 5.4 check still runs. ALL FIVE Section 5.4 requirements are built as of 2026-09-08: checkChainRevocation (internal/core/eap/revocation.go) walks every certificate on each chain except the trust anchor on both roles (5.4-1), newTLSMethod staples the operator's ocsp-response (5.4-2), checkStapledChainStatus (internal/core/eap/ocsp.go) refuses a CertificateEntry with no valid status while certificate-status-request is set (5.4-3), and startServerCertRecheck (internal/component/ike/engine/postauth_revocation.go) re-checks the chain over https once the Child SA is up, refusing an http responder URL before any connection opens (5.4-4 and 5.4-5). Section 5.10-1 is proven by sixteen tagged units in internal/core/eap/rfc9190_attack_mitigation_test.go over the RFC 7457 Section 2 attacks. THE TWO OBLIGATIONS THAT WERE UNMET IN CODE ARE MET AND PROVEN AS OF 2026-09-08. RFC9190-2.1.9-1, the MUST NOT to set the L bit in an unfragmented message: tlsFragmenter.nextFragment (internal/core/eap/eap_tls.go) is the one producer of outbound EAP-TLS TypeData on both roles, and it now declares a length only where the first fragment is not also the last, so a message that fits in one fragment leaves as a bare flags octet with its TLS data at offset 1. RFC9190-2.1.9-2, the receive half of the same sentence, is proven beside it over tlsFragmenter.reassemble, which takes an unfragmented message with the L bit and without it. RFC9190-1-1, the Section 1 MUST to limit the maximum TLS version to 1.3 unless the administrator enables a later one: newTLSMethod (eap_tls.go) and PeerSession.tlsClientConfig (internal/core/eap/peer.go) each set MaxVersion to tls.VersionTLS13, and ze exposes no leaf that raises that ceiling, so the exception has nothing to switch on. RFC9190-1-1 was added to this checklist by the 2026-09-08 extraction walk, which found the summary had missed it.
`RFC 9319` The Use of maxLength in the Resource Public Key Infrastructure (RPKI)	Ze correctness gap 4	SHOULD not decided 7, Ze correctness gap 4	foundation	A Best Current Practice addressed to operators and ROA issuers rather than to a router.
`RFC 9329` TCP Encapsulation of Internet Key Exchange Protocol (IKE) and IPsec Packets	Ze correctness gap 30	SHOULD not decided 44, Ze correctness gap 30	out-of-scope	OUT OF SCOPE as a document by owner decision, 2026-10-26: the owner rule committed in 1e7a9dbc34 (ai/META-DECISIONS.md, Goal and scope) counts an RFC a profile lists as optional only once Thomas brings it into scope, and this summary's `Optional use cases` row lists this RFC in the optional tier of the vpn-concentrator profile. The extraction is COMPLETE: the source text is at rfc/full/rfc9329.txt and the extraction sign-off is rfc/extraction/rfc9329.json. Ze implements none of it, and each MUST-level row keeps its `{gap}` note naming the absent producer: all 30 MUST-level requirements are classified, and all 30 are `{gap}`, because Ze carries IKE and ESP over UDP ports 500 and 4500 and directly over IP only. `internal/component/ike/transport/udp.go::newTransport` opens a UDP socket, and nothing under `internal/component/ike/` listens on or dials TCP, frames a Length-prefixed stream or sends the IKETCP stream prefix.
`RFC 9370` Multiple Key Exchanges in the Internet Key Exchange Protocol Version 2 (IKEv2)	Ze correctness gap 23	SHOULD not decided 4, Ze correctness gap 23	out-of-scope	OUT OF SCOPE as a document by owner decision, 2026-10-26: the owner rule committed in 1e7a9dbc34 (ai/META-DECISIONS.md, Goal and scope) counts an RFC a profile lists as optional only once Thomas brings it into scope, and this summary's `Optional use cases` row lists this RFC in the optional tier of the vpn-endpoint and vpn-concentrator profiles. The extraction is COMPLETE: the source text is at rfc/full/rfc9370.txt and the extraction sign-off is rfc/extraction/rfc9370.json. Ze implements none of it, and each MUST-level row keeps its `{gap}` note naming the absent producer: all 23 MUST-level requirements are classified, and all 23 are `{gap}`, because Ze's IKE engine implements neither the IKE_INTERMEDIATE exchange (RFC 9242) nor IKE_FOLLOWUP_KE, nor the ADDKE Transform Types 6 to 12. `internal/component/ike/wire/header.go` declares exchange types 34 to 37 only, and `internal/component/ike/wire/payload_notify.go` declares neither ADDITIONAL_KEY_EXCHANGE (16441) nor STATE_NOT_FOUND (47). One Appendix C site states the rationale for a discarded alternative design and is excluded in the extraction sign-off.
`RFC 9384` A BGP Cease NOTIFICATION Subcode for Bidirectional Forwarding Detection (BFD)	no rows	SHOULD proven 1, SHOULD not decided 2	non-normative	A BGP Cease NOTIFICATION Subcode for Bidirectional Forwarding Detection (BFD), IETF category Standards Track. The document carries the RFC 2119 / RFC 8174 key-words paragraph at Section 2, and a capitalised MUST / MUST NOT / SHALL / SHALL NOT / REQUIRED scan over rfc/full/rfc9384.txt hits those five words on one line only, line 101, which is the key-words sentence itself. That sentence tells a reader how to read the other sentences and states no obligation of its own. Outside it the text uses no MUST-level keyword anywhere. The summary written 2026-09-01 therefore captures three requirements and gates none: RFC9384-3-1 at Section 3, and RFC9384-4-1 and RFC9384-4-2 at Section 4, all three at SHOULD. Section 5 says the subcode "is purely informational and has no impact on the BGP Finite State Machine beyond that already documented by [RFC4271], Sections 6.6 and 6.7", so the document adds one registry value and three recommendations about using it. A zero-MUST document can reach the public ledger two ways, as this disposition or as a manual-walk extraction sign-off with a register-reason. This disposition is the route taken, because the sign-off at rfc/extraction/rfc9384.json declares the register the source derives, prose, and the second route would need it to declare the weaker manual-walk grade instead. That sign-off bounds the three-row checklist against the source text.
`RFC 9582` A Profile for Route Origin Authorizations (ROAs)	Ze correctness gap 16	SHOULD not decided 6, Ze correctness gap 16	third-party	The configured relying-party cache, such as Routinator or rpki-client, validates the CMS and X.509 ROA profile. Ze's RTR client consumes the resulting validated prefix payload through `internal/component/bgp/plugins/rpki/rtr_pdu.go::parsePrefixPDU`.