Gaps clean

The check is gaps_clean. It is spec-stage. Severity of an unconstrained output is warning, not error. The hop is non-blocking. The inspect command is proof gaps specs/system.

It loads the requirements and the variable files, then asks only whether each declared output is constrained by an active requirement at that layer. It does not run the full determinism matrix. A hit names the output, first ten, then how many more: unconstrained specs/system/Auth:auth_decision. The JSON also carries those ids so a caller does not have to re-parse the prose.

A component that only writes when AuthOK satisfy auth_decision = allow is the case the help file teaches. Kind2 reports the spec realisable because the other partitions stay ?. The bug ships because the solver looked clean.

# Auth.vars.yaml
# auth_decision: enum allow|deny|error, output
# only the happy path
Module shall when AuthOK satisfy auth_decision = allow
# proof audit --check gaps_clean
# [SPECIFICATION] gaps_clean -- unconstrained Auth:auth_decision
# silent output: Kind2 still printed realisable

Write the missing partitions. Deny on AuthFailed. Error on AuthError. Or retire the declaration if nothing owns it. Then re-run the same check. Do not mint a Jama note to carry the ?.

proof audit --check gaps_clean
proof gaps specs/system
proof gaps specs/system Auth --suggest
proof workflow check --stage spec --verbose
proof audit --scope baseline --verbose

The teaching graph is still one enum whose board called Kind2 done and whose error path stayed ?. Close it by writing the missing partitions, or by retiring the declaration. Do not treat a Jama note as this hop. Do not treat a green solver stamp as a complete output.

Module shall when AuthOK satisfy auth_decision = allow
Module shall when AuthFailed satisfy auth_decision = deny
Module shall when AuthError satisfy auth_decision = error
# proof audit --check gaps_clean
# gaps_clean 0 unconstrained outputs

The drift hop stays on variable drift. The cycle hop stays on circular deps clean. Jama still authors. Proof vs Jama.

Warning, not fail. Non-blocking. If the requirements or the variable files cannot load, the hop fails. A layer with no unconstrained outputs passes with 0 unconstrained outputs. Details stop after ten outputs. The hop looks at output variables only. It does not run the full determinism matrix, and it does not prune mutex groups. That work lives on proof gaps, not this hop. A debug field marked auxiliary is a documented way to leave an output unconstrained on purpose. A declaration constrained at another layer that shares the same physical vars file is not counted here. The hop does not write the requirement. It does not retire the variable. It does not prove the Go. Copied live ids that already constrain the output still pass. We have not scored this floor against a frozen Jama pack or a ReqIF export. The loss is named, not scored.

The drift hop stays on variable drift. The engagement stays on software correctness audit. Jama still authors.

What is gaps clean? Same question. Same URL.

Is this a Kind2 realisability check? No. Kind2 asks whether a model exists. This hop asks whether every declared output is in the constraints.

Is this variable drift? No. That hop asks whether one requirement's list matches its FRETish sentence. This hop asks whether any requirement constrains the output. See variable drift.

Is this circular deps clean? No. That hop asks whether the parent walk is a tree. See circular deps clean.

Does a green hop mean the spec is deterministic? No. This hop does not run the full gap matrix. Use proof gaps specs/system for that scan.

Can I leave a debug field unconstrained? Mark it auxiliary if that is the intent. Do not invent a shall to silence the checker.

Does a green hop prove the code matches the shall? No. The hop observes the declared outputs. It does not prove the Go.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.