Topic · change record lands

Change record lands

Gist

Change record lands is whether every CHG or DEFECT with a non-empty affects: list is cited back by each named requirement, in the current motivation or in history. Proof runs proof audit --check change_record_lands. Jama still authors.

proof audit --check change_record_lands

Keep GitHub if it already owns the PR. Keep Jama if it already authors the shall. Neither one asks whether a closed change actually moved the spec it named.

Request demo Last silent closed CHG vs this hop

01 · The silent closed change

A CHG can close with an affects list while no requirement cites it back.

The affects: field is the author's claim that this record moved those requirements. Without the inverse cite, the claim is a list, not a landing.

The check is change_record_lands. Stage spec. Default-on. Severity warning. It walks every CHG under proof/changes/ and every DEFECT under proof/problem-reports/ whose affects: list is non-empty. Empty lists are skipped. A corpus with no such records passes with nothing to cross-check.

The reverse hop lives on approval motivation present. That page's command is proof audit --check approval_motivation_present: this requirement's latest re-approval carries a valid kind. That check is an error. This one is a warning. A requirement can carry a motivation while the CHG never listed it, or a CHG can list a requirement that never cited it. Those are two holes.

proof change new --type feature --affects SYS-REQ-501
# CHG-12 closes. SYS-REQ-501 still has no motivation.ref
# change_record_lands warns: affects never cited back

Each named id must exist in the corpus. Then the record id (case-insensitive) must appear in the requirement's current verification.review.motivation.ref or in any entry of the append-only motivation_history. A later re-approval for an unrelated reason displaces the slot. History keeps the older cite, so two records that both legitimately moved the same shall stay satisfiable: one in the slot, one in history.

The hop does not rewrite history. Withdrawn citations stay visible. If a CHG was withdrawn and no requirement should have moved, drop the id from that record's affects: list. Leaving it there keeps the warning even when the current slot names something else.

proof approve SYS-REQ-501 --role system_owner \
    --motivation-kind chg --motivation-ref CHG-12
proof change edit CHG-12 --add-affects SYS-REQ-501
proof audit --check change_record_lands --verbose

A missing requirement is its own finding: affects: "SYS-REQ-501" does not resolve to a known requirement. A present requirement with no matching cite names the current ref and the history count. Findings are capped at ten in the details list. The issue ids are the CHG or DEFECT records, not the requirements.

02 · The exhibit

Same CHG-12. Silent closed change, or this hop.

Affects SYS-REQ-501. No inverse motivation. Click the tabs.

The row

Ask does CHG-12 exist and list SYS-REQ-501 under affects
Stamp the change record is closed, the list is filled, no requirement cites CHG-12
Why an affects list never asks whether the spec moved

Status green

This hop

Nobody asked whether SYS-REQ-501 cites CHG-12 in the current motivation or in history. The finding kind is this hop.

Cite unread

The row

Keep the GitHub merge. Keep the Jama field. That is not this hop.

Keep the record

Proof

Ask does every affects entry on CHG-12 land in a matching motivation
Out CHG-12: affects: SYS-REQ-501 has no verification.review.motivation pointing back at this record

Cite missing

Same CHG-12. Silent closed change, or this hop. Click the tabs.

Surface	What they do	What Proof does	What we lose
GitHub merge	A closed PR that touched the files.	A CHG whose `affects:` list is cited back from each named shall.	Not the PR. See pull request review.
approval_motivation_present	Whether this requirement's re-approval carries a valid kind.	Whether the CHG or DEFECT that claimed the move is cited back.	Not the reverse hop. That check is an error; this one is a warning. See approval motivation present.
change_evidence_complete	Whether a declared fix or feature still has the backing that kind requires.	Whether an existing CHG or DEFECT actually landed in the spec it named.	Not the backing hop. That check is opt-in. See change evidence complete.
software change impact analysis	The blast radius write-up.	The bidirectional cite on one CHG and one shall.	Not the blast radius. See software change impact analysis.
Jama field	The authoring programme. Attributes if you put them there.	A YAML `affects:` list the audit can name next to the motivation.	Not Jama's V&V. Jama still authors. We have not run a frozen Jama pack.

The teaching graph is still one closed CHG next to one missing inverse cite. Re-approve against the record, or drop the id from affects:.

proof approve SYS-REQ-501 --role system_owner \
    --motivation-kind chg --motivation-ref CHG-12
proof audit --check change_record_lands

A DEFECT uses --motivation-kind defect and a DEFECT-N ref. Live unfixed bugs are Known Issues, not DEFECT records. See software problem report.

The reverse hop stays on approval motivation present. The backing hop stays on change evidence complete. Do not treat a Jira "affects REQ-501" field as this cell. Jama still authors. Proof vs Jama.

03 · The honest loss

Proof names a missing inverse cite. It does not write the approval, and it does not prove the Go.

A quiet proof audit --check change_record_lands can still mean no CHG or DEFECT declared affects:. Jama still authors.

The hop does not call proof approve. It does not create a CHG. It does not drop a withdrawn id. Records with empty affects: are skipped. A pass of "no CHG / DEFECT records declared affects: (nothing to cross-check)" is a silent pass, not proof that every change landed. Severity is warning, not error: both directions can lag in flight. History matching means a displaced cite still counts, including a withdrawn one you forgot to remove. The hop does not prove the Go. We have not scored this floor against a frozen Jama pack. The loss is named, not scored.

The reverse hop stays on approval motivation present. The engagement stays on software correctness audit. Jama still authors.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What is change record lands? Same question. Same URL.

Is this approval motivation present? No. That hop is whether this requirement's re-approval carries a valid kind. This hop is whether the CHG or DEFECT that claimed the move is cited back. See approval motivation present.

Is this change evidence complete? No. That hop is whether a declared fix or feature still has the backing that kind requires. It is opt-in. See change evidence complete.

Is this software change impact analysis? No. That page is the blast radius write-up. See software change impact analysis.

Does an empty affects list fail? No. Empty lists are skipped. A corpus with none of them passes with nothing to cross-check.

Does a later re-approval break the cite? No. The displaced motivation stays in motivation_history. The hop matches current slot or history.

Does a green hop prove the Go? No. The hop does not execute the function. It does not prove the shall.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.