TLS-Anvil Conformance Summary
Generated: 2026-09-20T10:34:53.120806+00:00

Provenance:
  source_run_dir       : zig-out/anvil/server/ci-35504511374
  git_revision         : 8814f1e
  git_dirty            : False
  adapter_allow_partial: False
  report_complete      : True
  report_finished      : 437/437

Counts:
  total              :    437
  expected_skipped   :    175
  unexpected_skipped :      0
  passed             :    105
  failed             :      0
  expected_failed    :      0
  errored            :      0
  timeout            :      0
  not_attempted      :    157

Pass rate (total): 105/437 = 24.0%
Pass rate (attempted): 105/105 = 100.0%

Expected skip count by reason:
  -    7 DTLS is out of scope
  -    1 FFDHE named groups are outside the supported TLS 1.3 surface
  -    3 TLS 1.0/1.1/1.2 compatibility behavior is out of scope
  -  130 TLS 1.2 is out of scope
  -    2 TLS 1.2/DTLS/legacy-version tests are out of scope for the TLS 1.3-only runner (#9)
  -    1 TLS compression is outside the TLS 1.3-only runner scope (#9)
  -    5 TLS-Anvil @Disabled because this runner does not issue the session tickets needed for server-side EarlyData tests
  -    1 TLS-Anvil configuration-option self-test is not ztls conformance evidence
  -    6 TLS-Anvil disabled sender-restriction test; no execution evidence
  -    2 TLS-Anvil disabled this exact EC point-format length case because NAMED_GROUP derivation selected no case. No execution evidence exists (#108).
  -    1 TLS-Anvil disables this client-side PSK test; pre_shared_key ordering has separate local coverage
  -   11 TLS-Anvil runner does not provision caller-owned PSK/ticket state; resumption has separate local and OpenSSL coverage
  -    1 legacy compression/cipher-suite compatibility behavior is out of scope for the TLS 1.3-only runner (#9)
  -    2 max_fragment_length is intentionally outside the supported surface (#34)
  -    1 ztls accepts externally managed PSKs but does not issue server tickets through this TLS-Anvil runner
  -    1 ztls accepts externally managed PSKs but this server runner does not issue NewSessionTicket messages

Unmatched skip-list patterns (no test matched):
  - *0Rtt*
  - *Client does not support legacy rsa signature and hash algorithms*
  - *Client does not support maximum fragment length*
  - *PSKModeExtension is not supported*
  - *RecordSizeLimit*
  - *Specific features required for the test have not been met by the SUT for derivation parameter CIPHER_SUITE*
  - *Target does not send a Hello Retry Request*
  - *Target does not support Record fragmentation*
  - de.rub.nds.tlstest.suite.tests.client.tls13.rfc8446.HelloRetryRequest.actsCorrectlyUponHelloRetryRequest
  - de.rub.nds.tlstest.suite.tests.client.tls13.rfc8446.HelloRetryRequest.cipherSuiteDisparity
  - de.rub.nds.tlstest.suite.tests.client.tls13.rfc8446.HelloRetryRequest.copiesCookieValue
  - de.rub.nds.tlstest.suite.tests.client.tls13.rfc8446.HelloRetryRequest.helloRetryCompressionValue
  - de.rub.nds.tlstest.suite.tests.client.tls13.rfc8446.HelloRetryRequest.helloRetryGreaseCipherSuite
  - de.rub.nds.tlstest.suite.tests.client.tls13.rfc8446.HelloRetryRequest.helloRetryGreaseExtension
  - de.rub.nds.tlstest.suite.tests.client.tls13.rfc8446.HelloRetryRequest.helloRetryGreaseVersionSelected
  - de.rub.nds.tlstest.suite.tests.client.tls13.rfc8446.HelloRetryRequest.helloRetryLegacySessionId
  - de.rub.nds.tlstest.suite.tests.client.tls13.rfc8446.HelloRetryRequest.helloRetryRequestsTls12CipherSuite
  - de.rub.nds.tlstest.suite.tests.client.tls13.rfc8446.HelloRetryRequest.namedGroupDisparity
  - de.rub.nds.tlstest.suite.tests.client.tls13.rfc8446.HelloRetryRequest.sendSecondHelloRetryRequest
  - de.rub.nds.tlstest.suite.tests.client.tls13.rfc8446.HelloRetryRequest.versionDisparity

Per-feature breakdown:
  A5CipherSuite: expected_skipped=2
  AEADCiphers: expected_skipped=2
  AlertProtocol: expected_skipped=3, not_attempted=4, passed=7
  AntiReplay: expected_skipped=2
  CBCBlockCipher: expected_skipped=4
  Certificate: not_attempted=11, passed=1
  CertificateStatusRequest: expected_skipped=1
  CertificateVerify: expected_skipped=1, not_attempted=9, passed=1
  ChangeCipherSpecProtocol: expected_skipped=1
  CipherSuites: expected_skipped=1
  ClientAuthentication: not_attempted=1
  ClientCertificateMessage: not_attempted=1
  ClientHello: expected_skipped=8, not_attempted=8, passed=7
  ClientInitiatedExtensionPoints: expected_skipped=5, passed=5
  ComplianceRequirements: passed=2
  Cookie: expected_skipped=1, not_attempted=1
  CryptographicNegotiation: passed=2
  DoNotUseSSLVersion30: expected_skipped=3, not_attempted=1
  DoS: expected_skipped=5, not_attempted=1
  E1CompatibilityWithTLS10_11andSSL30: expected_skipped=3, not_attempted=1
  EarlyData: expected_skipped=5
  EncThenMacExtension: expected_skipped=2, not_attempted=2
  EncryptedExtensions: not_attempted=6, passed=1
  Extensions: not_attempted=2
  FfDheShare: expected_skipped=5, not_attempted=4
  Finished: expected_skipped=7, not_attempted=5, passed=7
  Fragmentation: expected_skipped=11, not_attempted=2
  HappyFlow: expected_skipped=1, passed=1
  HelloRetryRequest: not_attempted=15, passed=5
  KeyShare: expected_skipped=2, not_attempted=6, passed=7
  KeyUpdate: passed=4
  MaxFragmentLengthExtension: expected_skipped=1
  MaximumFragmentLength: expected_skipped=2, not_attempted=3
  MiddleboxCompatibility: passed=2
  NewSessionTicket: expected_skipped=1, not_attempted=1
  PaddingExtension: expected_skipped=2, not_attempted=1
  PointFormatExtension: expected_skipped=3
  PreSharedKey: expected_skipped=9, passed=1
  PreSharedKeyExchangeModes: not_attempted=1
  ProhibitingSSLv2: expected_skipped=2, not_attempted=3
  RC4Ciphersuites: expected_skipped=2, not_attempted=2
  RSAEncryptedPremasterSecretMessage: expected_skipped=2
  RecordLayer: expected_skipped=2, not_attempted=5, passed=3
  RecordProtocol: passed=12
  RespectClientExtensions: expected_skipped=3
  Resumption: expected_skipped=4
  SCSV: expected_skipped=2, not_attempted=1
  ServerHello: expected_skipped=5, not_attempted=7, passed=5
  ServerInitiatedExtensionPoints: not_attempted=11
  ServerKeyExchange: expected_skipped=1, not_attempted=6
  ServerNameIndication: expected_skipped=1, not_attempted=1
  SignatureAlgorithms: expected_skipped=4, not_attempted=3, passed=4
  SupportedCiphersuites: not_attempted=4
  SupportedVersions: expected_skipped=5, not_attempted=6, passed=4
  TLSExtensionForECC: expected_skipped=8, not_attempted=6
  TLSRecordProtocol: expected_skipped=2, not_attempted=2
  unknown: expected_skipped=39, not_attempted=14, passed=24

Note: 175/437 tests (40.0%) were expected-skipped by the configured skip list. 0 failed test(s) were classified as expected_failed (DSA-root certificate parameter combinations, #52; ztls correctly rejects DSA under RFC 8446 §4.2.3 / Appendix D) and remain visible, not hidden as expected_skipped. not_attempted tests are runner-direction gaps, not conformance passes. Review unexpected_pass entries as license-to-claim signals and unmatched_skip_patterns as stale-skip candidates.
