Connect code signals to reviewed obligations

What the check reads

This is an opt-in verify-stage warning check. It reads supported live scanner signals from requirement-linked implementation artifacts and normalized reports from enabled external providers. Reports carry source hashes and provider metadata. Disabled providers are ignored. External analyzers are not normally executed by audit; refresh_on_audit can enable a configured refresh path for missing or stale reports.

proof audit --check code_signal_obligations_reviewed

An illustrative case

Illustrative case: an HTTP client call creates an obligation to define timeout behavior. A requirement that owns the file gives the signal somewhere to land, but ownership alone does not satisfy the obligation. The team can supply an applicable requirement and evidence, justify a scoped suppression, or retain the unresolved work as linked debt. A cached clean report from an earlier source revision cannot establish the current scan result.

Resolve the finding

1. Check that the relevant provider is enabled and its report covers the current source and configured paths.
2. Inspect proof signals matrix and resolve missing or ambiguous ownership.
3. Connect each applicable obligation to its requirement and evidence, or record a specific suppression or tracked deferral. Review unresolved rows after rerunning.

What a clear result means

Signals are deterministic prompts, not confirmed defects. Provider coverage and freshness constrain the result, and reviewed debt is not satisfied behavior. A warning only becomes a delivery restriction through the configured audit and CI policy.

Continue with one real issue

Code signal suppressions reviewed · Code signal unbindable

Bring one finding, its requirement and the current evidence to scope a walkthrough of what your reviewer can establish and what still needs work.