Annotation validity

The check is annotation_validity. It is implement-stage. Severity of a dangling ID is error, not warning. The hop is blocking. The inspect command is the same audit, plus proof workflow check --stage implement --verbose.

It scans source, tests, and docs the way autolink already does, then asks whether each named ID still exists in the active spec set. For a three-part triple <REQ>:<obligation>:<evidence> it also asks whether that obligation still belongs to the requirement, is suppressed, or is carried by a satisfying child. A hit names the file and the missing ID: cache.go:41 SYS-REQ-9999 does not exist. Details stop after ten, then how many more.

A helper that still says // Verifies: SYS-REQ-9999 after a rename is the case the help file teaches. Coverage still prints 100% because the comment is still there. The bug ships because the matrix looked linked.

// cache.go:41
// Verifies: SYS-REQ-9999
func parseHeader(b []byte) (Header, error) { ... }
# SYS-REQ-9999.yaml is gone
# proof audit --check annotation_validity
# [IMPLEMENT] annotation_validity -- cache.go:41 SYS-REQ-9999 does not exist
# silent comment: coverage still printed 100%

Replace the missing ID with the live one. Move a stale triple to the child that now carries the obligation. Or remove the comment if nothing owns it. Then re-run the same check. Do not invent a placeholder ID to silence the checker.

proof audit --check annotation_validity
proof workflow check --stage implement --verbose
proof workflow check --only annotation_validity
proof test affected --requirement SYS-REQ-12 --run
proof audit --scope baseline --verbose

The teaching graph is still one comment whose board called coverage done and whose YAML was gone. Close it by pointing at a live ID, or by removing the comment. The same hop also catches a two-part // SYS-REQ-12:nominal (the obligation class is missing), an evidence type sitting in the middle slot, a :positive triple that obligation-evidence will not credit, a // Reproduces: slug with no KnownIssue file, and, under overlay_audit only, a triple whose file is not an accepted verified_by target. Do not treat a Jama note as this hop. Do not treat a green coverage stamp as a live ID.

// Verifies: SYS-REQ-12
// SYS-REQ-12:malformed_input:negative
func parseHeader(b []byte) (Header, error) { ... }
# proof audit --check annotation_validity
# annotation_validity 0 invalid refs

The scan-health hop stays on autolink clean. The missing-annotation hop stays on orphan code. Jama still authors. Proof vs Jama.

Error, not warning. Blocking. If the annotation scan or the requirements cannot load, the hop fails. A tree with no invalid refs passes. Details stop after ten. The hop looks at named IDs, obligation tokens, evidence tokens, KnownIssue slugs, and overlay membership. It does not write the requirement. It does not rewrite the comment. It does not create the KnownIssue. It does not prove the Go. Copied live IDs that still exist still pass. Bracket form // SYS-REQ-12 [boundary] is not the three-part obligation-evidence contract, so it is not judged as a triple. Under default source_native every triple is credited; the overlay membership rule is mode-scoped. We have not scored this floor against a frozen Jama pack or a ReqIF export. The loss is named, not scored.

The scan-health hop stays on autolink clean. The engagement stays on software correctness audit. Jama still authors.

What is annotation validity? Same question. Same URL.

Is this autolink clean? No. That hop asks whether the scan itself produced errors. This hop asks whether each scanned ID still resolves. Zero annotations still pass there. See autolink clean.

Is this orphan code? No. That hop is a production function with no live Implements line. This hop is a comment that names an ID that is gone. See orphan code.

Is this orphan tests? No. That hop is a Test* with no live Verifies line. A Verifies line that names a missing ID is this hop. See orphan tests.

Is this obligation evidence complete? No. That hop counts required evidence types. This hop asks whether the tokens are valid to credit at all. See obligation evidence complete.

Why is :positive a fail? That token is the MC/DC-witness token. It is not credited as obligation evidence. Use :nominal for the positive floor, or :negative when the class requires a rejection test.

Does overlay_audit change this hop? Yes, one rule. Under overlay, a source triple is credited only when its file is an accepted verified_by target or the same file carries // Verifies: for that requirement. Under source_native every triple is credited.

Does a green hop prove the code matches the shall? No. The hop observes named IDs. It does not prove the Go.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.