feat: RFC 9000 requirements manifest + MCP test report

.gitignore

@@ -23,6 +23,7 @@ ivy_termtab.py
 *.drawio.xml
 *.dsc
 
+.backup/
 
 # Python setup creates this
 panther_ms_ivy.egg-info
@@ -84,3 +85,10 @@ ivy/lib/
 #Ignore vscode AI rules
 .github/instructions/codacy.instructions.md
 # VSCode extension build artifacts (managed by vscode-ivy submodule's own .gitignore)
+
+# Active workspace state (session-specific, not committed)
+.ivy-workspace-state.json
+
+.observability/
+.ivy-index/
+.serena/

.ivyworkspace

@@ -1,6 +1,54 @@
 {
-  "version": 1,
-  "include_paths": ["protocol-testing"],
-  "exclude_paths": ["doc/examples", "examples/ivy", "test", "notebooks", "patches"],
-  "standard_library": "ivy/include/1.7"
+  "version": 3,
+  "standard_library": "ivy/include/1.7",
+  "scope_detection": "auto",
+  "workspace_groups": {
+    "quic": ["quic", "quic_tests"],
+    "apt": ["apt", "apt_tests"],
+    "minip": ["minip"],
+    "bgp": ["bgp"],
+    "coap": ["coap"],
+    "scaffolds": ["scaffolds"]
+  },
+  "workspace_layers": [
+    {"id": "quic", "include_paths": [
+      "protocol-testing/quic/quic_stack",
+      "protocol-testing/quic/quic_utils",
+      "protocol-testing/quic/tls_stack",
+      "protocol-testing/quic/quic_shims",
+      "protocol-testing/quic/quic_config",
+      "protocol-testing/quic/quic_entities",
+      "protocol-testing/quic/quic_entities_behavior",
+      "protocol-testing/quic/quic_extensions",
+      "protocol-testing/quic/quic_fsm",
+      "protocol-testing/quic/quic_recovery",
+      "protocol-testing/quic/quic_attacks_stack"
+    ], "priority": 1},
+    {"id": "quic_tests", "include_paths": [
+      "protocol-testing/quic/quic_tests"
+    ], "priority": 2, "depends_on": ["quic"]},
+    {"id": "minip", "include_paths": ["protocol-testing/minip"], "priority": 3},
+    {"id": "apt", "include_paths": [
+      "protocol-testing/apt/apt_entities",
+      "protocol-testing/apt/apt_entities_behavior",
+      "protocol-testing/apt/apt_lifecycle",
+      "protocol-testing/apt/apt_network",
+      "protocol-testing/apt/apt_shims",
+      "protocol-testing/apt/apt_stack",
+      "protocol-testing/apt/apt_utils",
+      "protocol-testing/apt/apt_protocols/quic",
+      "protocol-testing/apt/apt_protocols/minip",
+      "protocol-testing/apt/apt_protocols/tls"
+    ], "priority": 4},
+    {"id": "apt_tests", "include_paths": [
+      "protocol-testing/apt/apt_tests"
+    ], "priority": 5, "depends_on": ["apt"]},
+    {"id": "bgp", "include_paths": ["protocol-testing/bgp"], "priority": 6},
+    {"id": "coap", "include_paths": ["protocol-testing/coap"], "priority": 7},
+    {"id": "scaffolds", "include_paths": ["protocol-testing/new_prot", "protocol-testing/http"], "priority": 8}
+  ],
+  "exclude_paths": ["doc", "examples", "test", "notebooks", "patches", "submodules", "ivy",
+                   "protocol-testing/apt/apt_protocols/dns",
+                   "protocol-testing/apt/apt_protocols/http",
+                   "protocol-testing/apt/apt_protocols/smtp"]
 }

CLAUDE.md

@@ -118,7 +118,7 @@ A key concept: the Ivy tester's role is the **opposite** of what it tests. Testi
 - `use_system_models`: Toggle between standard and APT model architectures
 - `log_level_events` / `log_level_binary`: Debug verbosity controls
 
-Version-specific configs are loaded from `version_configs/{protocol}/` YAML files.
+Load version-specific configs from `version_configs/{protocol}/` YAML files.
 
 ### Build Modes (Z3 Compilation)
 

Dockerfile

@@ -101,6 +101,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     uuid-dev
 
 # Install pyenv (skip if already exists from base image)
+# Use bash explicitly — pyenv init outputs bash-specific syntax that dash cannot parse
+SHELL ["/bin/bash", "-c"]
 RUN if [ -d "$HOME/.pyenv" ]; then \
         echo "pyenv already installed, configuring environment..."; \
     else \
@@ -125,6 +127,7 @@ RUN if [ -d "$HOME/.pyenv" ]; then \
     ln -sf "$(pyenv which python3.10)" /usr/local/bin/python3.10 && \
     ln -sf "$(pyenv which python)"     /usr/local/bin/python && \
     python3.10 -V && which python3.10 && python -V && which python
+SHELL ["/bin/sh", "-c"]
 
 # Build external dependencies
 RUN cd /opt && \

Dockerfile.buildkit

@@ -52,35 +52,30 @@ RUN bash -c '\
   ls /etc/apt/sources.list.d || true'
 
 # APT package installation with cache mounts for Ubuntu 20.04 + Deadsnakes PPA
+# All system dependencies in single RUN to maximize cache hit
 RUN --mount=type=cache,target=/var/cache/apt-${TARGETPLATFORM},sharing=locked \
     --mount=type=cache,target=/var/lib/apt-${TARGETPLATFORM},sharing=locked \
-    apt update && \
-    apt install -y software-properties-common && \
-    apt update && \
-    apt --fix-missing -y install \
-    build-essential python3-ply alien iptables iproute2 iputils-ping \
-    tzdata curl tar gcc g++ cmake tix pkg-config libssl-dev lsof \
-    graphviz graphviz-dev doxygen faketime libscope-guard-perl \
-    libtest-tcp-perl libbrotli-dev libev-dev libhttp-parser-dev \
-    libbsd-dev snapd rand binutils binutils-dev autoconf automake \
-    autotools-dev libtool libjemalloc-dev libboost-all-dev libboost-dev \
-    ca-certificates mime-support libevent-dev libdouble-conversion-dev \
-    libgflags-dev libgoogle-glog-dev libiberty-dev liblz4-dev liblzma-dev \
-    libsnappy-dev zlib1g-dev libsodium-dev libffi-dev cargo libunwind-dev \
-    radare2 strace bridge-utils libreadline-dev tk libgv-tcl libgraphviz-dev \
-    libdevil1c2 libgts-0.7-5 liblasi0 tcl-dev tcl libgmp-dev dsniff sudo jq ninja-build \
-    libomp-dev git clang clang-tidy clang-format
-
-
-# 0) System toolchain + CPython feature headers (bz2, sqlite, zlib, ssl, tk, etc.)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    build-essential make gcc g++ curl ca-certificates git \
-    zlib1g-dev libbz2-dev liblzma-dev \
-    libsqlite3-dev libssl-dev libffi-dev libreadline-dev \
-    tk-dev tcl-dev libncursesw5-dev libgdbm-dev libnss3-dev libedit-dev \
-    uuid-dev
+    printf 'Acquire::Retries "3";\nAcquire::http::Timeout "120";\nAcquire::https::Timeout "120";\n' > /etc/apt/apt.conf.d/99-retries && \
+    sed -i 's|://archive.ubuntu.com|://fr.archive.ubuntu.com|g' /etc/apt/sources.list && \
+    apt-get update --fix-missing  -y && apt upgrade -y && \
+    apt-get install -y --no-install-recommends \
+    software-properties-common build-essential make gcc g++ curl \
+    python3-ply alien iptables iproute2 iputils-ping tzdata tar \
+    cmake tix pkg-config libssl-dev lsof graphviz graphviz-dev doxygen faketime \
+    libscope-guard-perl libtest-tcp-perl libbrotli-dev libev-dev libhttp-parser-dev \
+    libbsd-dev snapd rand binutils binutils-dev autoconf automake autotools-dev libtool \
+    libjemalloc-dev libboost-all-dev libboost-dev ca-certificates mime-support \
+    libevent-dev libdouble-conversion-dev libgflags-dev libgoogle-glog-dev libiberty-dev \
+    liblz4-dev liblzma-dev libsnappy-dev zlib1g-dev libbz2-dev libsqlite3-dev \
+    libffi-dev libreadline-dev cargo libunwind-dev radare2 strace bridge-utils \
+    tk libgv-tcl libgraphviz-dev libdevil1c2 libgts-0.7-5 liblasi0 tcl-dev tcl \
+    libgmp-dev dsniff sudo jq ninja-build libomp-dev git clang clang-tidy clang-format \
+    tk-dev libncursesw5-dev libgdbm-dev libnss3-dev libedit-dev uuid-dev && \
+    rm -rf /var/lib/apt/lists/*
 
 # Install pyenv (skip if already present from base image)
+# Use bash explicitly — pyenv init outputs bash-specific syntax that dash cannot parse
+SHELL ["/bin/bash", "-c"]
 RUN if [ ! -d "$HOME/.pyenv" ]; then \
         curl https://pyenv.run | bash && \
         echo 'export PATH="$HOME/.pyenv/bin:$PATH"' >> ~/.bashrc && \
@@ -100,13 +95,14 @@ RUN if [ ! -d "$HOME/.pyenv" ]; then \
     ln -sf "$(pyenv which python3.10)" /usr/local/bin/python3.10 && \
     ln -sf "$(pyenv which python)"     /usr/local/bin/python  && \
     python3.10 -V && which python3.10 && python -V && which python
+SHELL ["/bin/sh", "-c"]
 
 # Install pip with Python cache mount
-RUN --mount=type=cache,target=/root/.cache-${TARGETPLATFORM}/pip \
+RUN --mount=type=cache,target=/root/.cache-${TARGETPLATFORM}/pip,id=pip-bootstrap-${TARGETPLATFORM} \
     curl -sS https://bootstrap.pypa.io/get-pip.py | python3.10
 
 # Python packages with pip cache
-RUN --mount=type=cache,target=/root/.cache-${TARGETPLATFORM}/pip \
+RUN --mount=type=cache,target=/root/.cache-${TARGETPLATFORM}/pip,id=pip-deps-${TARGETPLATFORM} \
     python3.10 -m pip install \
     pexpect chardet pandas scandir ply pygraphviz pydot progressbar2
 
@@ -239,8 +235,8 @@ RUN --mount=type=cache,target=/var/cache/apt,id=toolchain-$TARGETPLATFORM,sharin
 # BUILD_MODE passed as env var (not as layer ENV) to avoid invalidating COPY layers.
 # NOTE: When Z3_SOURCE=local, both Python bindings and C++ test binaries
 #   use Z3 4.7.1 from the submodule. When Z3_SOURCE=pip, Python uses 4.13.4.0.
-RUN --mount=type=cache,target=/root/.cache/pip-$TARGETPLATFORM,sharing=locked \
-    --mount=type=cache,target=/tmp/python-build-$TARGETPLATFORM,sharing=locked \
+RUN --mount=type=cache,target=/root/.cache/pip,id=pip-build-${TARGETPLATFORM} \
+    --mount=type=cache,target=/tmp/python-build-${TARGETPLATFORM},id=pybuild-${TARGETPLATFORM} \
     BUILD_MODE=${BUILD_MODE} python3.10 build_submodules.py --skip-z3 && \
     if [ "$Z3_SOURCE" = "local" ]; then \
         # Install locally-built Z3 Python bindings as the system 'z3' package. \
@@ -299,6 +295,16 @@ RUN --mount=type=cache,target=/root/.cache/pip-$TARGETPLATFORM,sharing=locked \
         fi; \
     fi
 
+# =============================================================================
+# STAGE 4: Z3-VERIFY - Isolated Z3 verification (only runs on Z3 changes)
+# Does NOT depend on ivy/ or protocol-testing, so changes to those files
+# don't invalidate this cached stage.
+# =============================================================================
+
+FROM base AS z3-verify
+
+ARG Z3_SOURCE
+
 # Verify egg has the z3_shim fix (catches pyenv egg caching stale code)
 RUN python3.10 -c "\
 import importlib.util, pathlib; \
@@ -329,15 +335,12 @@ assert 'Z3_MINOR_VERSION >= 12' in src, \
     'STALE: ivy_to_cpp.py missing Z3 4.12 version guard for mk_enum/mk_decl'; \
 print('OK: ivy_to_cpp.py uses Python-based Z3 version macros with 4.12 guards')"
 
-# Add protocol testing files (last to optimize layer caching)
-COPY protocol-testing /opt/panther_ivy/protocol-testing/
-
 # =============================================================================
 # FINAL STAGE: Runtime configuration with platform metadata
 # =============================================================================
 
-# Target platform runtime stage (inherits platform from base)
-FROM base AS final
+# Target platform runtime stage (inherits platform from z3-verify)
+FROM z3-verify AS final
 
 # Platform and build metadata for debugging and compliance
 ARG BUILDPLATFORM
@@ -364,6 +367,9 @@ LABEL build.syntax="docker/dockerfile:1"
 HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
     CMD python3.10 --version && echo "IVY tester runtime healthy" || exit 1
 
+# Add protocol testing files (last to optimize layer caching)
+COPY protocol-testing /opt/panther_ivy/protocol-testing/
+
 # Set working directory
 WORKDIR /opt/panther_ivy
 

_shared.py

@@ -118,6 +118,43 @@ def oppose_role(role: str) -> str:
     return "client" if role == "server" else "server"
 
 
+def classify_endpoint_type(test_name: str, role_name: str) -> str:
+    """Classify a test into its endpoint type for directory-based filtering.
+
+    Uses the naming convention ``{protocol}_{endpoint}_test_{scenario}`` to
+    extract the endpoint.  Only underscore-delimited segments **before** the
+    first ``test`` segment are considered keywords.  This prevents scenario
+    words like ``mim`` in ``quic_client_test_0rtt_mim_replay`` from causing
+    a misclassification.
+
+    Checks keywords in priority order: mim > client > server > attacker.
+    First match wins. Falls back to oppose_role() when no keyword matches.
+
+    Returns 'mim', 'client', or 'server'. The 'attacker' keyword maps to
+    'server' because attacker tests live in server_tests/.
+    """
+    segments = test_name.lower().split("_")
+
+    # Identify endpoint segments: everything before the first "test" segment.
+    # E.g., quic_client_test_0rtt_mim_replay -> segments before "test" = {quic, client}
+    try:
+        test_idx = segments.index("test")
+        endpoint_segments = set(segments[:test_idx])
+    except ValueError:
+        # No "test" segment found; fall back to checking all segments.
+        endpoint_segments = set(segments)
+
+    for keyword, result in [
+        ("mim", "mim"),
+        ("client", "client"),
+        ("server", "server"),
+        ("attacker", "server"),
+    ]:
+        if keyword in endpoint_segments:
+            return result
+    return oppose_role(role_name)
+
+
 def detect_role(test_name: str) -> str:
     """Infer role from test name convention: *_server_* or *_client_*."""
     if "_server_" in test_name or test_name.endswith("_server"):

api/_shared.py

@@ -0,0 +1,43 @@
+"""Shared utilities re-exported from package root for API layer.
+
+This module re-exports panther_ivy._shared names that the API layer
+depends on, preserving the zero-PANTHER-imports contract while
+eliminating code duplication.
+
+The root _shared.py is the single source of truth for verdict logic,
+regex patterns, crash indicators, and role utilities.
+"""
+
+from .._shared import (  # relative import: api/ -> parent package -> _shared.py
+    ASSUMPTION_FAILED_PATTERN,
+    CRASH_INDICATORS_IUT,
+    CRASH_INDICATORS_TESTER,
+    PROTOCOL_ACTIVITY_PATTERN,
+    TEST_COMPLETED_PATTERN,
+    VERDICT_IUT_CRASH,
+    VERDICT_NON_COMPLIANT,
+    VERDICT_NO_VIOLATION_FOUND,
+    VERDICT_TESTER_CRASH,
+    VERDICT_UNKNOWN,
+    classify_endpoint_type,
+    detect_role,
+    determine_verdict,
+    oppose_role,
+)
+
+__all__ = [
+    "ASSUMPTION_FAILED_PATTERN",
+    "CRASH_INDICATORS_IUT",
+    "CRASH_INDICATORS_TESTER",
+    "PROTOCOL_ACTIVITY_PATTERN",
+    "TEST_COMPLETED_PATTERN",
+    "VERDICT_IUT_CRASH",
+    "VERDICT_NON_COMPLIANT",
+    "VERDICT_NO_VIOLATION_FOUND",
+    "VERDICT_TESTER_CRASH",
+    "VERDICT_UNKNOWN",
+    "classify_endpoint_type",
+    "detect_role",
+    "determine_verdict",
+    "oppose_role",
+]

api/compiler.py

@@ -22,19 +22,16 @@
 _DEFAULT_DOCKER_IVY_INCLUDE_DIR = "$PYTHON_IVY_DIR/ivy/include/1.7"
 
 
-def _extract_test_directory(test_name: str) -> str:
+def _extract_test_directory(test_name: str, role_name: str = "server") -> str:
     """Extract test subdirectory from test name.
 
-    Mirrors ivy_command_mixin.py:597-605 logic for nested test directories.
+    Delegates to classify_endpoint_type() for consistent behavior
+    with ivy_command_mixin._extract_test_directory_from_name().
     """
-    lower = test_name.lower()
-    if "client" in lower:
-        return "client_tests"
-    elif "server" in lower:
-        return "server_tests"
-    elif "mim" in lower:
-        return "mim_tests"
-    return ""
+    from ._shared import classify_endpoint_type
+
+    endpoint = classify_endpoint_type(test_name, role_name)
+    return f"{endpoint}_tests"
 
 
 def _detect_ivy_include_dir() -> str:

config_schema.py

@@ -101,7 +101,7 @@ class Test(BaseModel):
 
 
 class PantherIvyVersion(VersionBase):
-    """Version information for PantherIvy following PANTHER standards. (TODO not used)"""
+    """Version information for PantherIvy following PANTHER standards."""
 
     # Provide defaults for required base fields
     version: str = Field(default="", description="Version string")