Deletion without retirement

The check is deletion_without_retirement. It is SPECIFICATION-stage. It warns. It only fires under --scope baseline. A default full audit never sees it. It compares the baseline set of requirement ids to the files on disk. An id that was in the baseline and is gone, with no retire, supersede, or deprecate event, is the finding. It does not write the YAML. It does not prove the Go.

This hop is the deletion companion to requirement lifecycle. That page is the status field: draft, review, approved, deprecated, retired, superseded. This hop is the case where the file disappeared instead of taking one of those terminal statuses. A Slack note that says the shall is gone is not a lifecycle event. A rename that deletes SYS-REQ-OLD and creates SYS-REQ-NEW, while other files still cite SYS-REQ-OLD, is the same miss. The loader drops those dangling traces silently. This hop names the missing file before that drop becomes the new normal.

The two resolutions are alternatives, not steps. If the removal was a mistake, restore the file. If the shall is really leaving, retire it with a reason, or supersede it with the replacement id. Do not waive the hop. There is no waiver. The lifecycle action is the audit trail. Do not delete the file to silence the finding. That is the finding.

# SYS-REQ-OLD was in the baseline
# git rm specs/system/requirements/SYS-REQ-OLD.req.yaml
# extra tests still green. Jama still lists the old id
# proof audit --scope baseline --check deletion_without_retirement
# [SPECIFICATION] deletion_without_retirement
# SYS-REQ-OLD removed without retire/supersede
# WARN
# proof help deletion_without_retirement

Read both sides before you edit anything. The baseline id that used to exist, and the file that is no longer on disk. A no-baseline run skips this hop. That skip is a pass, not a proof that nobody deleted a shall:

proof audit --scope baseline --check deletion_without_retirement
proof spec show SYS-REQ-OLD
proof req supersede SYS-REQ-OLD --replacement SYS-REQ-NEW \
  --reason "rename to canonical spelling" --yes
proof audit --scope baseline --check deletion_without_retirement --verbose
proof help deletion_without_retirement

The teaching graph is still one baseline id whose file left the tree with no retire and no supersede. Close it by restoring the file if the removal was a mistake, or by retiring or superseding the id if the shall is really leaving. Do not delete the file to make the sets match. That is the finding. The hop does not write that event for you. The hop does not waive itself.

# SYS-REQ-OLD superseded by SYS-REQ-NEW
# proof audit --scope baseline --check deletion_without_retirement
# 0 untraced deletions
# SPECIFICATION may move on. pass sits on a lifecycle event, not a missing file

The status hop stays on requirement lifecycle. The rewrite hop stays on characterization testing and mirrors. Jama still authors. Proof vs Jama.

Warning when a baseline requirement id is gone from disk without retire, supersede, or deprecate. Only under --scope baseline. A default full audit never sees it. Default severity is warning, not error. It does not fail the merge by itself. No waiver. The lifecycle action is the audit trail. No baseline available is a skip, and that skip is a pass. Zero in-scope findings is a pass. The hop does not write the retire or supersede event. It does not restore the file. It does not run proof req retire for you. It does not prove the Go. A quiet hop is not a proof that Jama's shall still exists, only that every in-scope baseline id currently has a file or a terminal status, or that nothing asked. We have not scored this floor against a frozen Jama pack or a VectorCAST corpus. The loss is named, not scored.

The status hop stays on requirement lifecycle. The rewrite hop stays on characterization testing and mirrors. The engagement stays on software correctness audit. Jama still authors.

What is deletion without retirement? Same question. Same URL.

Is this requirement lifecycle? No. That hop is the status field on a file that is still on disk. This hop is a file that left without taking a terminal status. See requirement lifecycle.

Is this suspect clean? No. That hop reports a live link whose stamp no longer covers both sides. This hop reports a missing file. See suspect clean.

Is this authored delta expected? No. That hop reports a missing no-authored-change stamp on a moved production file. This hop reports a missing spec file. See authored delta expected.

Do extra tests clear a missing shall? No. A green suite is not a retirement.

Does this finding fail the merge? No by default. The check keeps warning severity and only runs under --scope baseline.

Can an agent waive the deletion? No. There is no waiver. Restore the file, or retire or supersede the id.

Does a quiet hop prove nobody deleted a shall? No. A run with no baseline skips. The hop observes two id sets. It does not prove the Go.

Is this characterization testing? No. That page is rewrite-with-a-ledger. This hop is a missing file versus a baseline. See characterization testing and mirrors.

Is Proof an LDRA alternative for the instrument? No. LDRA still owns the avionics toolchain. Proof vs LDRA.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.