---
phase: 10-classification-layer
plan: 02
subsystem: classify
tags: [classification, tests, protocols, v1.2]
dependency_graph:
  requires: [10-01-classification-constants-and-rules]
  provides: [28-new-classification-subtests, updated-TestAllClassesCount]
  affects: [classify/classifier_test.go]
tech_stack:
  added: []
  patterns: [table-driven subtests, buildTCPPacket/buildUDPPacket helpers]
key_files:
  created: []
  modified:
    - classify/classifier_test.go
decisions:
  - TestAllClassesCount updated to 32 (14 existing + 18 new; LDAP/Kerberos/Syslog excluded until Phase 11)
  - 28 subtests added (plan said 26, final count is 28 including extra SIP transport variants)
metrics:
  duration: "2 min"
  completed: "2026-03-27"
  tasks_completed: 2
  files_modified: 1
requirements_satisfied:
  - PROTO-01
  - PROTO-02
  - PROTO-03
  - PROTO-04
  - PROTO-05
  - PROTO-06
  - PROTO-07
  - PROTO-08
  - PROTO-09
---

# Phase 10 Plan 2: Classification Layer — Test Coverage Summary

Added 28 new subtests to `TestClassify` covering all new port/protocol/transport combinations introduced in Plan 01, and updated `TestAllClassesCount` to assert 32 classes.

## Tasks Completed

| Task | Name | Commit | Files |
|------|------|--------|-------|
| 1 | Add 28 new classification subtests to TestClassify | 038f89f | classify/classifier_test.go |
| 2 | Update TestAllClassesCount from 14 to 32 | f792370 | classify/classifier_test.go |

## What Was Done

**Task 1** added 28 new subtests inside `TestClassify`, grouped by protocol family, after the existing `TestClassifyUnknown` subtest and before `TestRulesAreOrderDependent`:

- Mail (PROTO-01): IMAP 143, IMAPS 993, POP3 110, POP3S 995, SMTPSub 587
- File Transfer (PROTO-02): FTP data 20, FTP control 21, SMB 445, TFTP UDP/69
- Remote Access (PROTO-03): RDP 3389, Telnet 23, VNC 5900
- Database (PROTO-04): MySQL 3306, PostgreSQL 5432, Redis 6379, MongoDB 27017
- Discovery (PROTO-05): mDNS UDP/5353, SSDP UDP/1900, SNMP UDP/161, SNMP-trap UDP/162
- VoIP (PROTO-06): SIP TCP/5060, SIP UDP/5060
- Web extension (PROTO-07): QUIC UDP/443 (confirmed distinct from HTTPS TCP/443)
- Infrastructure (PROTO-08): LDAP 389, LDAPS 636, Kerberos TCP/88, Kerberos UDP/88, Syslog UDP/514

All existing 13 subtests (ICMP, DNS UDP/TCP, HTTPS, HTTP, SSH, SMTP, NTP, DHCP 67/68, OtherTCP, OtherUDP, Unknown) remain passing unchanged (PROTO-09 regression check).

**Task 2** updated `TestAllClassesCount` assertion from `!= 14` to `!= 32`. The 32 count is 14 existing + 18 new (ClassLDAP, ClassKerberos, ClassSyslog excluded from AllClasses() until Phase 11 adds their ClassFreqConfigs entries).

## Verification Results

- `go test -count=1 ./classify/... -v` — all 3 test functions pass (TestClassify with 41 subtests, TestAllClassesCount, TestHashBucketDistribution)
- All 28 new subtests pass on first run (no iteration needed)
- QUIC UDP/443 correctly classifies as ClassQUIC, not ClassHTTPS
- SIP tested on both TCP and UDP transports
- `go test ./synth/...` expected to fail (Phase 11 will wire ClassFreqConfigs for 18 new classes)

## Deviations from Plan

None — plan executed exactly as written. Note: plan mentioned 26 new subtests but the task description listed 28 (the SSDP test name was `TestClassifySDP_port1900` per the plan, and the SIP dual-transport tests account for the discrepancy). All 28 listed in the acceptance criteria were implemented.

## Known Stubs

None.

## Self-Check: PASSED

- classify/classifier_test.go exists and contains `TestClassifyIMAP_port143`
- classify/classifier_test.go contains `!= 32`
- Commits 038f89f and f792370 exist
- `go test -count=1 ./classify/...` exits 0