Cross component clean

The check is cross_component_clean. It is SPEC-stage. Default severity is warning. It does not fail the merge. You can still advance. It loads the requirement set, drops terminal and rejected tombstones from the demand, and asks two questions. First: a requirement that lives in a spec marked cross_component must list every component the contract spans under traces.components. Second: every in-system name on that list must have a covering child whose component matches, via traces.satisfies, unless this requirement is itself an INT-REQ that already names that name as caller, callee, or assigned component. It does not write the YAML. It does not prove the Go.

The existence hop for an A to B call stays on interface coverage. That hop is whether a real boundary has any INT-REQ at all. This hop is whether a list you already wrote is covered. Duplicate INT-REQs stay on interface contract duplicates. FRETish on an approved cross-component guarantee stays on interface formalization complete. The fingerprint hop stays on interface staleness clean. The document hop stays on interface control document.

Each component can look fine on its own. Auth's local audit only sees auth-owned variables. Quota's local audit only sees quota-owned variables. Reviewers signed the English in another tool. The expensive miss is a flow that only exists as the combination: auth.allow and quota.hasCapacity, with no child that owns quota, and a refactor of quota that still passes quota's own gate.

# SYS-REQ-310  traces.components: [auth, quota]
# SW-REQ-441   component: auth
#              traces.satisfies: [SYS-REQ-310]
# a presence-only graph hop
# pass. auth still names the parent
# proof audit --check cross_component_clean
# [SPECIFICATION] cross_component_clean
# component "quota" not covered by SYS-REQ-310
# WARNING
# proof help cross_component_clean

The fix is a product decision, not a rewrite of Go. Add a child for the missing owner (proof req new <spec> --component quota --parent SYS-REQ-310), drop the name from traces.components if it was never in the contract, or keep an INT-REQ that already names caller and callee so that boundary covers itself. Do not invent a thin child to silence the checker. Then re-run SPEC.

proof audit --check cross_component_clean --verbose
proof gaps specs/system --check cross-component
proof help cross_component_clean

The teaching graph is still one parent that lists auth and quota and one child that only covers auth. Close it by adding a quota child, dropping quota from the list, or keeping an INT-REQ that already names those two as caller and callee. Do not delete the YAML. Do not invent a second SYS-REQ. Zero in-scope cross-component lists is a pass, not a proved architecture. External parties declared on the interface block are skipped. Terminal and rejected tombstones are skipped. A superseded child still counts when its replacement is active.

# SYS-REQ-310 kept. SW-REQ-552 component: quota, satisfies SYS-REQ-310
# proof audit --check cross_component_clean
# 2 cross-component reqs fully covered
# SPEC may move on. pass sits on a covered list

The existence hop stays on interface coverage. The uniqueness hop stays on interface contract duplicates. The FRETish hop stays on interface formalization complete. The rewrite hop stays on characterization testing and mirrors. Jama still authors. Proof vs Jama.

Warning when a cross_component spec requirement lists no traces.components, or when a listed in-system component has no covering child. Default severity does not fail the merge. You can still advance. Zero in-scope lists is a pass, not a complete architecture. An INT-REQ that declares interface.caller and interface.callee covers those two names, and its assigned component, without a further child. External parties are skipped, including from the coverage totals. Terminal and rejected requirements are not active contracts. A superseded child still counts when its replacement is live. The hop does not write the component list. It does not add a shall. It does not write a description. It does not prove the Go. It does not invent an INT-REQ. It does not measure independence. A quiet hop is not a proof that Jama's shall matches the Go, only that every in-scope declared name currently has a covering child. We have not scored this floor against a frozen Jama pack or a VectorCAST corpus. The loss is named, not scored.

The existence hop stays on interface coverage. The rewrite hop stays on characterization testing and mirrors. The engagement stays on software correctness audit. Jama still authors.

What is cross component clean? Same question. Same URL.

Is this interface coverage? No. That hop is whether a real A to B call has any INT-REQ. This hop is whether a list you already wrote is covered. See interface coverage.

Is this interface contract duplicates? No. That hop is uniqueness of live INT-REQs. This hop is coverage of declared owners. See interface contract duplicates.

Is this interface formalization complete? No. That hop is FRETish on an approved cross-component guarantee. This hop is covering children. See interface formalization complete.

Is this interface staleness clean? No. That hop is whether the implementation sha256 still matches the last review. See interface staleness clean.

Is this an interface control document? No. That hop is whether an INT-REQ still names caller and callee. See interface control document.

Does an INT-REQ need a further child? Not for the names it already declares as caller, callee, or assigned component. A stranger on traces.components still counts as a gap.

Does an external party fail this hop? No. Actors declared external on the interface block are skipped, including from the coverage totals.

Does a quiet hop prove the Go matches the shall? No. The hop observes covering children. It does not prove the Go.

Does an uncovered owner fail the merge? No by default. The check keeps warning severity. You can still advance.

Is zero in-scope lists a complete architecture? No. Zero in-scope lists is a pass of this hop, not a proved component graph.

Is this characterization testing? No. That page is rewrite-with-a-ledger. This hop is an uncovered declared owner. See characterization testing and mirrors.

Is Proof an LDRA alternative for the instrument? No. LDRA still owns the avionics toolchain. Proof vs LDRA.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.