Implement a defensive, OFFLINE Cisco ASA IPv4 access-list analyzer and before/after semantic comparator. Python stdlib only; no network, scans or configuration writes. Input {policy:str,baseline?:str} <=128KiB max200rules. Parse documented strict subset: access-list NAME [line N] extended permit|deny ip|tcp|udp SOURCE [source-port] DEST [dest-port], where address=any/any4/host IPv4/IPv4 contiguous-netmask and port=eq integer|range integer integer; named ports optional explicit lookup. Accept remarks and blank/comments; do NOT silently ignore unsupported commands or configuration. One ACL per input; reject mixed lists, unsupported object/object-group unless fully resolved, IPv6, inactive,time-range,established,noncontiguous masks and ambiguous syntax. Use multidimensional interval rectangle subtraction for exact ordered first-match reachability including IPv4 src,dst,protocol,source/destport. Classify fully/partially/unshadowed rules; concrete packet witnesses for reachable fragments AND shadow intersections. Baseline comparison must compute all changed decision regions (not just per-rule overlap), merge/bound reporting honestly, include implicit deny. Bound intermediate rectangles and refuse complexity exhaustion rather than issue safe verdict. Export rules.csv,witnesses.json,changes.json,analysis.html,report.json with status PASS for analysis completion, never security certification. Independent evaluator replays every packet witness against original rule order. Test algorithm against brute-force enumeration on small generated addresses/ports for many seeded policies, including UNION of earlier rules jointly shadowing a later rule, tiny boundary regions and implicit default changes. verify independently replay output witnesses and validate completeness via regenerated partition/baseline calculation or separate finite boundary enumeration with bounded oracle (never hash-only). Escaped HTML/CSV formula protection. Deterministic output, no source changes, empty output only, symlink refusal, unknown keys fail. CLI and exact documented dialect. README explicitly not full device/NAT/statefulness evaluation.

Common API: engine.py process(input_path,empty_output_directory)->dict with status PASS; verify(input_path,output_directory)->True or raises ValueError. Write report.json containing product=slug,status=PASS,metrics,summary,limitations plus exact output manifest hashes. No writes outside assigned product folder and temporary directories for tests. Parent fixtures good.json,bad.json,required.json,parent_acceptance.py,SMOKE.sh immutable. No import of mutable parent app code.