Check reference
Find inputs with no specified output
A realizable contract can still leave important behavior unspecified. gaps_clean looks for modeled input situations in which the requirement set does not constrain an output.
A missing rule is different from a contradiction
If an authorization model specifies an allow response only for valid credentials, it may leave all other responses open. A solver can find a behavior that satisfies that incomplete contract. The implementation can still make an unacceptable choice on rejected credentials. Gap analysis asks a different question: which relevant modeled situations have no defined output? The check has error severity by default.
Illustrative example: three authentication outcomes
Input situation Required response
Valid credentials allow
Invalid credentials deny
Identity service down error
If the third row is absent, the model has not committed to an outage response. Choosing deny, returning a retryable error, or using a documented fallback are different product decisions. Write the agreed rule and test its observable result. Do not constrain the environment to “the service is always up” just to remove the missing case.
Inspect the enumerated domain
Run gap analysis for the affected component. Check declared input and mode variables, numeric bounds, enum values and mutex groups. Mutual-exclusion declarations prune impossible combinations. That pruning is useful only when the domain fact is true. If both supposedly exclusive signals can occur during a transition, removing their combination from analysis hides a real case.
proof gaps specs/system authentication
proof audit --check gaps_clean --verbose
Know when enumeration becomes sampling
Large combined input spaces are bounded by the configured determinism state budget. Boolean states may be sampled, and numeric inputs use derived domain boundaries rather than every possible value. A found gap is actionable; a clean sample is not exhaustive evidence over an unbounded system. Review notices about truncation and coverage. A controlled auxiliary variable can be exempted with a reason, but a user-visible output needs a behavioral rule. After changing that rule, refresh dependent proof and test evidence.
Follow the evidence
Take one reported input state and write down the output a reviewer would accept.
Review one unconstrained output. Bring the reported input state and requirement set so we can identify the missing behavior and the evidence needed to check it.