Interface staleness clean

The check is interface_staleness_clean. It is VERIFY-stage. Default severity is warning. It always runs. It computes the current sha256 of every artifact in traces.implemented_by plus implemented_by_extra, compares that map against implementation_fingerprints on the latest review_history entry, and names any path whose stored fingerprint diverges. It does not ask whether an INT-REQ exists for the boundary. That document hop stays on interface control document. It does not ask whether generated FLIP JSON still matches the FRETish. That hop stays on fixture staleness clean. The wired-boundary witness stays on integration testing.

Zero interface requirements is a pass: 0 interface contracts checked, 0 stale. That pass is silence, not a freshness proof. A requirements load error, or a staleness evaluation that cannot run, is fail: the hop cannot decide whether the contracts still match. When an active INT-REQ has a drifted fingerprint, the hop warns: N stale interface contracts. Guidance says the warning is non-blocking. Retired, superseded, or rejected INT-REQs are skipped. Review entries authored before 2026-05-13, with no implementation_fingerprints map, fall back to "trust the review, cannot detect drift." Back-fill those stamps with proof review interface <INT-REQ-ID> --migrate-fingerprints. That command is idempotent. It does not need a new rationale. The old mtime comparison is gone: a fresh CI clone used to look stale because every file mtime equalled checkout time. The hop is content-bound now, not time-bound.

The expensive miss is a review that treats the INT-REQ YAML as the pack, then a green existence of the file, then a callee that no longer matches the last stamped sha256. The document still exists. Jama still shows the shall. This hop is the gate that says the implementation still matches the last review, or names the INT-REQ whose artifacts drifted.

Typical drifted rows are a path under traces.implemented_by whose current sha256 is not the stamped map. Recording a review without inspecting the caller and callee is not freshness. Deleting the INT-REQ to silence the checker is not a review. Updating one side of the boundary without the other is how the next hop fires again.

# INT-REQ-036 last review_history
# implementation_fingerprints stamped
# traces.implemented_by: pkg/core/schedule.go
# current sha256 != stamped map
# proof audit --check interface_staleness_clean
# 1 stale interface contracts
# WARNING (non-blocking)
# warning: last review no longer names this file

The fix is to inspect the named interface, then either record an explicit re-review if the contract still matches, or update the authored INT-REQ fields if the contract changed. Re-review restamps current fingerprints: proof review interface INT-REQ-036 --review-rationale "signature and guarantees still match". Then re-run VERIFY. Do not edit YAML by hand to fake a review. A quiet hop after you ignore the warning is still not freshness. The default warning does not block advancement.

proof audit --check interface_staleness_clean --verbose
proof review interface INT-REQ-036 \
  --review-rationale "signature still matches"
proof help interface_staleness_clean

The teaching graph is still one INT-REQ whose last review sits in YAML while the implementation sha256 moved. Close it by re-reviewing the named contract, or by updating the authored fields if the caller or callee changed. Do not delete the INT-REQ to silence the checker. With no interfaces the empty pass still prints, and the freshness question did not go anywhere. It just was never in scope.

# proof review interface INT-REQ-036
#   --review-rationale "signature still matches"
# restamps implementation_fingerprints
# proof audit --check interface_staleness_clean
# 1 interface contracts checked, 0 stale
# VERIFY may move on. pass sits on a restamped review

The document hop stays on interface control document. The fixture-freshness hop stays on fixture staleness clean. The wired-boundary hop stays on integration testing. The rewrite hop stays on characterization testing and mirrors. Jama still authors. Proof vs Jama.

Warning when an active INT-REQ's implementation sha256 drifted from the last stamped review. Fail when requirements cannot be loaded, or when staleness cannot be evaluated, so the hop cannot decide. Zero interfaces is a pass, not a fail: the hop does not invent contracts. Legacy reviews without implementation_fingerprints cannot detect drift until you migrate. The hop does not write the INT-REQ. It does not add a shall. It does not prove the Go. It does not run Kind2. It does not measure independence. A quiet hop is not a proof that the authored contract is the one you meant, only that every active INT-REQ still matches its last review, or that none were in scope. It does not say an INT-REQ exists. That document hop is interface control document. It does not say FLIP files still match the FRETish. That freshness hop is fixture staleness clean. The default warning does not block advancement. We have not scored this floor against a frozen Jama pack or a VectorCAST corpus. The loss is named, not scored.

The document hop stays on interface control document. The fixture-freshness hop stays on fixture staleness clean. The rewrite hop stays on characterization testing and mirrors. The engagement stays on software correctness audit. Jama still authors.

What is interface staleness clean? Same question. Same URL.

Is this an interface control document? No. That hop is whether an INT-REQ still names the caller and callee. This hop is whether the implementation sha256 still matches the last review. See interface control document.

Is this fixture staleness clean? No. That hop is whether existing FLIP files still match the formalization. This hop is interface-review fingerprints. See fixture staleness clean.

Is this integration testing? No. That hop is the wired-boundary witness. This hop is the authored contract's current files. See integration testing.

Is this characterization testing? No. That page is rewrite-with-a-ledger. This hop is interface-review freshness for an INT-REQ. See characterization testing and mirrors.

Does a quiet hop prove the Go matches the shall? No. The hop observes fingerprints. It does not prove the Go.

Does zero interfaces fail this hop? No. That is a pass. A pass with nothing in scope is not freshness.

Does a pre-2026-05-13 review fail this hop? No. Legacy entries without fingerprints cannot detect drift. Migrate them with --migrate-fingerprints.

Does a drifted fingerprint fail the merge? No. The check keeps warning severity unless you raise it in proof.yaml.

Is Proof an LDRA alternative for the instrument? No. LDRA still owns the avionics toolchain. Proof vs LDRA.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.