High severity obligation without vector

The check is default-on at warning, verify stage. It walks active requirements. Inactive and terminal rows are ignored. Medium and low severities are not gated. For each high or critical class (case-insensitive) it asks whether some vector YAML lists that class. If none does, one warning names the class and the requirement. No active requirements, or no high or critical hazards, is a clean pass.

This hop does not ask whether the YAML still resolves. That is vector campaign hygiene. It does not ask whether a P0 hunt is still unopened. That is unresearched P0 vectors. It does not ask whether an opened hunt took an exit. That is vector campaign closure. A covering vector can still sit at unresearched. This hop still passes. The hunt never started. That miss belongs on the P0 URL, not here.

id: SYS-REQ-H1
status: approved
obligation_hazards:
  - class: deadline_arithmetic_faithful
    severity: HIGH

The suite can still be green. The class was authored. No campaign lists it. Missing proof/vectors/ does not no-op this hop. Every high or critical class is then uncovered, and the findings fire. That is the opposite of the hygiene and open-P0 hops, which pass when the directory is absent.

proof vector suggest --apply
proof vector new --template deadline-cast --class deadline_arithmetic_faithful
proof vector list --class deadline_arithmetic_faithful
proof audit --check high_severity_obligation_without_vector

Open a campaign for the class, or lower the hazard grade with a reason. Do not drop the hazard so the hop goes green. A must-hunt class with no campaign is still a must-hunt class.

The teaching graph is still one high class next to one missing campaign. Read the finding. Then open a vector, or lower the grade with a reason.

proof vector suggest --apply
proof vector new --id V-H1 --title "deadline cast packing" --priority P0 --class deadline_arithmetic_faithful
proof vector list --class deadline_arithmetic_faithful
proof audit --check high_severity_obligation_without_vector --verbose
proof help vector-campaign

Close a coverage finding by listing the class on a vector, or by changing the hazard with rationale. Hygiene stays on vector campaign hygiene. Unopened P0 status stays on unresearched P0 vectors. Opened hunts without an exit stay on vector campaign closure. Residual-only measured kills stay on residual kill hygiene. Do not treat a covering unresearched YAML as proof the hunt ran. Jama still authors. Proof vs Jama.

Warning severity. Medium and low hazards are not gated. Inactive and terminal requirements are ignored. A covering vector at unresearched is a pass here. Missing proof/vectors/ does not inspect nothing: every high or critical class then fires. Opt-out is project.checks.high_severity_obligation_without_vector.enabled false. The hop reports skip, never pass, so a silenced check does not count toward the audit pass total. The hop does not run the campaign. It does not inspect the implementation. It does not write the YAML. Hygiene, open-P0, and closure are different checks, not this URL. We have not scored this floor against a frozen Jama pack, a CVSS workbook, or a STRIDE sheet. The loss is named, not scored.

The link-floor hop stays on vector campaign hygiene. The open-P0 hop stays on unresearched P0 vectors. The exit hop stays on vector campaign closure. The sample-table hop stays on residual kill hygiene. The engagement stays on software correctness audit. Jama still authors.

What is high severity obligation without vector? Same question. Same URL.

Is this vector campaign hygiene? No. That hop is whether the YAML still resolves. This hop is whether a high class is listed on any vector. See vector campaign hygiene.

Is this unresearched P0 vectors? No. That hop is whether a P0 campaign is still unopened. A covering unresearched YAML still passes here. See unresearched P0 vectors.

Is this vector campaign closure? No. That hop is whether a non-terminal status took an exit. This hop is whether the class was campaignized at all. See vector campaign closure.

Is this a CVSS high? No. Ads and CVE pages own that score. A catalog class on an ObligationHazard is not that cell.

Does a missing vectors directory pass? No. Missing proof/vectors/ leaves every high or critical class uncovered. The findings fire. Put a YAML there that lists the class.

Does an uncovered class fail the merge? No. The check keeps warning severity. Opt-out is skip, not pass.

Does an unresearched vector cover the class? Yes, for this hop. Listing the class is enough here. Starting the hunt is the P0 URL.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.