Interface formalization complete

The check is interface_formalization_complete. It is SPEC-stage. Default severity is warning. It always runs. A spec is in scope when its proof.yaml entry has cross_component: true and that spec type still requires FRETish. Inside those specs it looks at requirements whose status is review or approved, whose req_type is guarantee or omitted (omitted is treated as a guarantee), and whose formalization_strategy is fretish or omitted (omitted is treated as FRETish). Draft, in-progress, and terminal statuses are not this hop. A genuine prose-only requirement sets formalization_strategy: informal and leaves this hop. A genuine prose-only cross-component layer sets the same flag on the spec type. It does not ask whether a real A → B call has any covering INT-REQ. That existence hop stays on interface coverage. It does not ask whether two live INT-REQs share caller, callee, and signature. That uniqueness hop stays on interface contract duplicates. It does not ask whether an INT-REQ's artifacts still match the last review sha256. That freshness hop stays on interface staleness clean. It does not ask whether an ICD-shaped document still names the caller and callee. That document hop stays on interface control document. Lower-layer FRETish (parent also formal) stays on software formalization complete, which is not this URL. The FRETish language itself stays on FRETish. A lemma cache that still says valid after a timeout stays on formalization lemma verdict consistency.

Each INT-REQ can look fine on its own. The Jama cell still names the payload. The ICD still names auth → user. Reviewers signed the English. Downstream hops that need a formula then skip or pass empty, because there is no FRETish to vacuity-check, no envelope to reject, no independence pair to measure. Other SPEC hops miss this because they never ask whether the approved cross-component guarantee actually has a non-envelope formula.

The expensive miss is a deploy that treats the shall as the contract. The producer ships a bound the English implied. The consumer never encoded that bound. This hop is the gate that names the empty fretish:, or the two-bool !P | Q envelope that dropped a bound the description, rationale, or implements already named.

# INT-REQ-041
# cross_component: true
# status: approved
# req_type: guarantee
# fretish:   (empty)
# proof audit --check interface_formalization_complete
# [SPECIFICATION] interface_formalization_complete
# 1 review or approved guarantee requirement(s) lack a
# non-envelope FRETish formalization across 1 configured
# cross-component spec(s)
# INT-REQ-041 missing FRETish
# WARNING
# write the formula, or mark the requirement informal

The fix is a human authorization, not a rewrite of Go. Write real FRETish for the listed guarantee. For a genuine prose-only requirement, set formalization_strategy: informal on that requirement. For a genuine prose-only cross-component layer, set it on the spec type. For a one-off exception, add a narrow waiver for this check and that ID. Do not delete the INT-REQ to silence the checker. Then re-run SPEC.

proof audit --check interface_formalization_complete --verbose
proof workflow check --stage spec --only interface_formalization_complete
proof help interface_formalization_complete

The teaching graph is still one approved cross-component guarantee with empty FRETish. Close it by writing the formula, or by marking the requirement informal. Do not delete the YAML. Do not invent a second INT-REQ. A two-bool !P | Q envelope fails this hop only when the description, rationale, or implements already named a bound the formula omitted. Zero configured cross-component specs that require FRETish is a pass, not a proof that every boundary is formal. Lower-layer software formalization is a different check and a different URL.

# INT-REQ-041 kept. fretish written
# whenever auth calls user, the profile is returned
# or the status is 404
# proof audit --check interface_formalization_complete
# all review or approved guarantee requirement(s) in
# 1 configured cross-component spec(s) have a
# non-envelope FRETish formalization
# SPEC may move on. pass sits on a formula

The existence hop stays on interface coverage. The uniqueness hop stays on interface contract duplicates. The document hop stays on interface control document. The freshness hop stays on interface staleness clean. The wired-boundary hop stays on integration testing. The rewrite hop stays on characterization testing and mirrors. Jama still authors. Proof vs Jama.

Warning when a review or approved guarantee in a configured cross-component spec lacks non-envelope FRETish. Default severity does not fail the merge unless you raise it in proof.yaml. Zero configured cross-component specs that require FRETish is a pass, not a proof that every boundary is formal. Zero review or approved guarantees in those specs is also a pass. Draft and in-progress IDs are skipped. Informal strategy is skipped. An omitted req_type is treated as a guarantee. An omitted strategy is treated as FRETish. The hop does not write the formula. It does not pick informal versus FRETish. It does not add a shall. It does not prove the Go. It does not run Kind2. It does not measure independence. It does not say a real boundary is covered. That existence hop is interface coverage. It does not say two live IDs share one surface. That uniqueness hop is interface contract duplicates. It does not say the implementation sha256 still matches the last review. That freshness hop is interface staleness clean. It does not say an ICD-shaped document exists. That document hop is interface control document. A quiet hop is not a proof that Jama's shall matches the Go, only that every in-scope cross-component guarantee currently has a non-envelope formula, or that nothing in-scope asked for one. We have not scored this floor against a frozen Jama pack or a VectorCAST corpus. The loss is named, not scored.

The existence hop stays on interface coverage. The uniqueness hop stays on interface contract duplicates. The document hop stays on interface control document. The rewrite hop stays on characterization testing and mirrors. The engagement stays on software correctness audit. Jama still authors.

What is interface formalization complete? Same question. Same URL.

Is this interface coverage? No. That hop is whether a real boundary has any covering INT-REQ at all. This hop is whether that covering INT-REQ has non-envelope FRETish. See interface coverage.

Is this interface contract duplicates? No. That hop is whether two live INT-REQs share caller, callee, and signature. This hop is whether the remaining ID has a formula. See interface contract duplicates.

Is this an interface control document? No. That hop is whether an INT-REQ still names the caller and callee. This hop is whether the named INT-REQ has FRETish. See interface control document.

Is this interface staleness clean? No. That hop is whether the implementation sha256 still matches the last review. This hop is presence of a formula. See interface staleness clean.

Is this FRETish? No. That page is the language. This hop is whether a cross-component guarantee actually wrote it. See FRETish.

Is this software formalization complete? No. That check is lower-layer specs whose parent also requires FRETish. Cross-component specs stay on this URL.

Is this integration testing? No. That hop is the wired-boundary witness. This hop is the authored formula. See integration testing.

Is this characterization testing? No. That page is rewrite-with-a-ledger. This hop is empty FRETish on a cross-component guarantee. See characterization testing and mirrors.

Does a quiet hop prove the Go matches the shall? No. The hop observes formulas. It does not prove the Go.

Does an empty configured set fail this hop? No. Zero cross-component specs that require FRETish is a pass, not a proof.

Does a missing formula fail the merge? No by default. The check keeps warning severity unless you raise it in proof.yaml.

Is Proof an LDRA alternative for the instrument? No. LDRA still owns the avionics toolchain. Proof vs LDRA.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.