The row
- Ask does SYS-REQ-010 exist, sit active, and name classes in the catalog
- Stamp catalog completeness is green, the scan JSON is committed, the checklist is empty
- Why completeness never reads semantic-scan.json
Topic · catalog semantic bindings reviewed
Catalog semantic bindings reviewed
Gist
Catalog semantic bindings reviewed is whether every flagged (requirement, class) pair in committed proof/catalog/semantic-scan.json is bound on the live obligation_checklist or rejected with a reason. Proof runs proof audit --check catalog_semantic_bindings_reviewed. Jama still authors.
proof audit --check catalog_semantic_bindings_reviewedKeep the wiki if it already lists the classes. Keep Jama if it already authors the shall. Neither one asks whether this scan match was bound or rejected after the YAML moved.
01 · The silent match
A scan that named rate_limit_respected still looks reviewed if nobody bound it and nobody wrote a rejection.
Presence of the catalog class is not this hop. This hop is whether live YAML still owns the pair the artifact flagged.
The check is catalog_semantic_bindings_reviewed. Stage spec. Default severity is warning, and it is on unless you opt out. It reads only the committed artifact at proof/catalog/semantic-scan.json and the requirement YAMLs. It never computes embeddings. The scan that wrote the artifact is a separate command: proof catalog semantic-scan.
Every adjacent hop in Proof is scoped to a different object. Catalog completeness asks whether yaml, catalog, signal rules, and checklists still name the same classes. It never asks whether a scan match was reviewed. Catalog version pinned asks whether the shipped catalog still matches the pin. It is quiet when the pin is honest. Obligation completeness asks whether each listed class has a covering SYS-REQ. It is not a scan-pair review. Leave SYS-REQ-010 with a committed match and no checklist row, and those hops stay green. That is the hole.
id: SYS-REQ-010 status: active obligation_checklist: [] # proof/catalog/semantic-scan.json still flags # SYS-REQ-010 × rate_limit_respected
Two live dispositions resolve a pair. Bound: the class sits on the requirement's obligation_checklist. Rejected: the requirement carries a semantic_rejections entry with decision: rejected and a reason of at least 16 characters after trimming. Anything else is a warning that names the req id, the class id, the score, and the rank. The artifact's own declared snapshot is display provenance only. A binding removed after the scan warns again. Cheap staleness (artifact older than the newest referenced revision, or a non-pinned model) rides as [info], never as a warning face.
No artifact is a silent pass: no semantic-scan artifact, with an info note that adoption is opt-in until the first scan. An unreadable or invalid JSON file is a fail, not a warning. A result whose requirement no longer exists is skipped, counted, not warned. Empty results is a pass that inspected nothing of this kind.
proof catalog semantic-scan proof audit --check catalog_semantic_bindings_reviewed --verbose
The two honest exits are alternatives, not steps. Bind the class, or record why it does not apply. Refreshing a stale artifact is a third exit when the YAML moved after the scan. Deleting the JSON also silences the hop. It destroys the finding rather than recording the decision.
02 · The exhibit
Same SYS-REQ-010. Silent unmatched pair, or this hop.
Active spec, scan match present, empty checklist, no rejection. Click the tabs.
This hop
Nobody asked whether rate_limit_respected was bound or rejected after the scan. The finding kind is this hop.
Pair unreadThe row
Keep the wiki. Keep the Jama field. That is not this hop.
Keep the recordProof
- Ask is SYS-REQ-010 × rate_limit_respected bound or rejected on live YAML
- Out SYS-REQ-010: class rate_limit_respected scored 0.8120 (rank 1) — bind it via obligation_checklist or record a semantic_rejections entry with a reason
Same SYS-REQ-010. Silent unmatched pair, or this hop. Click the tabs.
| Surface | What they do | What Proof does | What we lose |
|---|---|---|---|
| Catalog completeness | Four inventories still name the same classes. | Whether a scan match was bound or rejected on this shall. | Not the class-drift hop. See catalog completeness. |
| Catalog version pinned | Whether the shipped catalog still matches the pin. | Whether this pair still has a live disposition. | Not the pin hop. See catalog version pinned. |
| Obligation completeness | Whether each listed class has a covering SYS-REQ. | Whether this flagged class was accepted or refused here. | Not that hop. See obligation completeness. |
| Embedding product | A similarity score. A dashboard of neighbours. | A warning next to the shall, or a recorded rejection. | The hop never computes embeddings. We have not scored this floor against a frozen neighbour pack. |
| Jama field | The authoring programme. Attributes if you put them there. | A YAML disposition the audit can name next to the shall. | Not Jama's V&V. Jama still authors. We have not run a frozen Jama pack. |
The teaching graph is still one active spec next to one unmatched pair. Bind it, or write why it does not apply.
proof req edit SYS-REQ-010 --add-obligation rate_limit_respected proof audit --check catalog_semantic_bindings_reviewed
The other honest exit is a recorded rejection, not silence:
semantic_rejections:
- class_id: rate_limit_respected
decision: rejected
reason: Enforced upstream by the gateway before traffic reaches this component.
Class drift stays on catalog completeness. The pin stays on catalog version pinned. Covering SYS-REQs stay on obligation completeness. Do not treat a wiki of class names as this cell. Jama still authors. Proof vs Jama.
03 · The honest loss
Proof names an unmatched pair. It does not bind the class, and it does not prove the Go.
A quiet proof audit --check catalog_semantic_bindings_reviewed can still mean the project never ran a scan. Default is warning, not fail. Jama still authors.
The hop does not compute embeddings, does not write the checklist, and does not author the rejection. proof validate enforces rejection shape at authoring time; this hop only reads what is already there. A missing artifact is a pass that inspected nothing of this kind. Stale created_at and a non-pinned model_sha256 ride as info. Deleted requirements are skipped. Empty results are a pass. Unreadable JSON is a fail. A finding is not a waiver: proof waive is a human authorization gate. The hop does not prove the Go. We have not scored this floor against a frozen Jama pack or a second human's embedding review. The loss is named, not scored.
Class drift stays on catalog completeness. The pin stays on catalog version pinned. The engagement stays on software correctness audit. Jama still authors.
04 · Nearby questions
What people type next.
What is catalog semantic bindings reviewed? Same question. Same URL.
Is this catalog completeness? No. That hop is whether yaml, catalog, rules, and checklists still name the same classes. This hop is whether a scan match was bound or rejected. See catalog completeness.
Is this catalog version pinned? No. That hop is whether the shipped catalog still matches the pin. This hop never looks at the pin. See catalog version pinned.
Is this obligation completeness? No. That hop is whether each listed class has a covering SYS-REQ. This hop is one flagged pair on one shall. See obligation completeness.
Is this code signal unbindable? No. Unbindable is a draft class id that does not resolve. This hop is a cataloged class the scan already named. See code signal unbindable.
Does a missing artifact fail? No. No proof/catalog/semantic-scan.json is a silent pass until the first scan.
Does a stale scan fail? No. An old created_at or a non-pinned model is info. The warning is an unresolved pair on live YAML.
Does a green hop prove the Go? No. The hop does not run the embedding backend. It does not prove the function.
Is Proof a Jama alternative for the catalog? No. Jama still authors. Proof vs Jama.