Interface coverage

The check is interface_coverage. It is SPEC-stage. Default severity is error. It always runs. It asks whether every real component boundary is backed by a real interface requirement. If two components communicate, the spec should say so. Hiding the interaction inside an unrelated shall is not coverage. It does not ask whether the INT-REQ YAML still matches the last review sha256. That freshness hop stays on interface staleness clean. It does not ask whether an ICD-shaped document still names the caller and callee. That document hop stays on interface control document. The wired-boundary witness stays on integration testing.

A genuine leaf (a pure data model, an in-process analysis stage) used to face a bad choice: invent a thin interface spec to silence the finding, or carry the warning forever. Inventing interfaces is theater. The honest path is a component-level attestation in <component>.vars.yaml:

no_interface:
  declared: true
  reason: "pure in-process analysis stage; consumed only via the gaps facade, no cross-component boundary"

The reason is mandatory (at least 16 characters). proof validate hard-fails a declared attestation without one. A validly attested component is suppressed from the no-interface findings but stays visible as component "x" attested: <reason>. The justification is reviewable, not vanished. Attestations never suppress the other finding categories: interfaces without covering requirements, and broken references. The broken-reference fallback text-scans only integration-interface requirements that do not yet have a structured interface: block. Software or system requirements with category: interface can contain FRETish variable names such as go_compatible_json_written. Those variables are not component names and should not produce interface gaps.

When an interface has no covering requirement but a near-miss exists, the finding names the closest candidate and the structural difference. Example: interface hash→write_tx has no covering requirement; closest candidate: INT-REQ-102, caller matched ("hash") but callee differs (req="writer_tx", iface="write_tx"). The hint surfaces when a structured block differs by one field, when a category: interface requirement names the right component but has no structured block yet, or when the description mentions caller xor callee. If no requirement scored above zero, no hint is appended.

The expensive miss is Conway's law in production: the producer evolves the schema, the consumer is the only one with the old expectation written down, and a deploy that reorders the two services hits production with mismatched payload shapes. Without an INT-REQ, suspect_clean and contract_alignment_clean both run on a partial graph and may pass spuriously. This hop is the gate that forces the contract into the spec set, where both sides own it.

# auth-service calls user-service
# no INT-REQ with matching caller/callee
# proof audit --check interface_coverage
# [SPECIFICATION] interface_coverage
# 1 interface boundary not covered: auth -> user
# ERROR
# write the INT-REQ. a fire-and-forget call still needs a contract

The fix is to add or repair the integration requirement under specs/integration/requirements, keep component names consistent, and add the matching software decomposition on both sides when needed. If the call is intentionally best-effort fire-and-forget, an INT-REQ that says so is still the contract. There is no silent waiver. Then re-run SPEC. Deleting a component from the graph to silence the checker is not coverage.

proof audit --check interface_coverage --verbose
proof gaps specs/system --check interface
proof help interface_coverage

The teaching graph is still one call in Go whose covering INT-REQ was never written. Close it by authoring the integration requirement, or by attesting no_interface when the component is a genuine leaf. Do not invent a thin interface to silence the checker. Do not delete the component from the graph. Duplicate (callee, signature) pairs are a later hop, not this one.

# INT-REQ-046
# caller: auth
# callee: user
# GET /users/{id} returns the profile or 404
# proof audit --check interface_coverage
# all 73 interfaces covered
# SPEC may move on. pass sits on a written contract

The document hop stays on interface control document. The freshness hop stays on interface staleness clean. The wired-boundary hop stays on integration testing. The rewrite hop stays on characterization testing and mirrors. Jama still authors. Proof vs Jama.

Error when a real boundary has no covering INT-REQ, or when a covering requirement is a broken reference. A valid no_interface attestation is a reviewed skip, not coverage: the reason stays in the output. Attestations never hide uncovered interfaces or broken refs. The hop does not write the INT-REQ. It does not add a shall. It does not prove the Go. It does not run Kind2. It does not measure independence. It does not detect two active INT-REQs that describe the same (callee, signature). That duplicate hop is still unpublished. It does not say the implementation sha256 still matches the last review. That freshness hop is interface staleness clean. It does not say an ICD-shaped document exists. That document hop is interface control document. A quiet hop is not a proof that the authored contract is the one you meant, only that every real boundary has a covering requirement, or that the missing ones were attested. We have not scored this floor against a frozen Jama pack or a VectorCAST corpus. The loss is named, not scored.

The document hop stays on interface control document. The freshness hop stays on interface staleness clean. The rewrite hop stays on characterization testing and mirrors. The engagement stays on software correctness audit. Jama still authors.

What is interface coverage? Same question. Same URL.

Is this an interface control document? No. That hop is whether an INT-REQ still names the caller and callee. This hop is whether a real boundary has any covering INT-REQ at all. See interface control document.

Is this interface staleness clean? No. That hop is whether the implementation sha256 still matches the last review. This hop is existence of the covering requirement. See interface staleness clean.

Is this integration testing? No. That hop is the wired-boundary witness. This hop is the authored contract's existence. See integration testing.

Is this characterization testing? No. That page is rewrite-with-a-ledger. This hop is uncovered component boundaries. See characterization testing and mirrors.

Does a quiet hop prove the Go matches the shall? No. The hop observes covering requirements. It does not prove the Go.

Does a leaf fail this hop? Not if it attests no_interface with a reason of at least 16 characters. That skip is reviewable. It is not coverage.

Does inventing a thin interface pass this hop? Yes, and that is theater. Write the real INT-REQ, or attest the leaf.

Does an uncovered boundary fail the merge? Yes by default. The check keeps error severity unless you lower it in proof.yaml.

Is Proof an LDRA alternative for the instrument? No. LDRA still owns the avionics toolchain. Proof vs LDRA.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.