L1 system complete

The check is l1_system_complete. It is SPEC-stage. Default severity is error. It always runs unless you pass --skip-level L1. It loads every active system requirement. Terminal and rejected tombstones are out of the denominator. For each remaining SYS-REQ it asks three questions: does traces.satisfies name at least one stakeholder requirement, is description: non-empty, and if formalization_strategy is fretish, is fretish: also non-empty. It does not rewrite the YAML. It does not call Z3. It does not call Kind2.

The upward-edge hop stays on system requirements linked. That hop only asks whether satisfies: is populated. This hop also asks whether the body was written, and whether a FRETish claim actually has a sentence. The formula floor for every active SYS-REQ, with no informal opt-out, stays on system formalization complete. Informal is allowed here. It is not allowed there. The graph of declared levels stays on levels connected. L0 file existence stays on stakeholder requirements.

Each SYS-REQ can look fine on its own. The Jama cell still names the system. Reviewers signed the English in another tool. system_requirements_linked is green because an STK-REQ id is present. Downstream hops that need a behavior then skip or pass empty, because there is no description to decompose and no FRETish to vacuity-check. Other SPEC hops miss this because they never ask those three fields together.

The expensive miss is a deploy that treats the id as the contract. The English was never written. The formula was never written. This hop is the gate that names the empty description, the missing satisfies list, or the FRETish strategy with an empty formula.

# SYS-REQ-200
# status: approved
# traces.satisfies: [STK-REQ-010]
# description:   (empty)
# proof audit --check system_requirements_linked
# pass. the id is there
# proof audit --check l1_system_complete
# [SPECIFICATION] l1_system_complete
# SYS-REQ-200 has empty description
# ERROR
# say what the system must do

The fix is a human authorization, not a rewrite of Go. Add a satisfies: link if it is missing. Write a description that says what the system must do. If you claimed FRETish, write the sentence, or drop the claim and set the strategy to informal in the .req.yaml. Do not delete the SYS-REQ to silence the checker. Then re-run SPEC.

proof audit --check l1_system_complete --verbose
proof workflow check --stage spec --only l1_system_complete
proof help l1_system_complete

The teaching graph is still one active SYS-REQ with an STK-REQ id and an empty description. Close it by writing the body. Do not delete the YAML. Do not invent a second SYS-REQ. A FRETish strategy with empty fretish: is a second finding on the same hop. Informal strategy is a pass of this hop and a fail of system formalization complete. Zero SYS-REQs is a pass, not completeness. --skip-level L1 skips the hop. Rejected and terminal tombstones are out of the count.

# SYS-REQ-200 kept. satisfies STK-REQ-010. description written
# The rate limiter shall reject a request that exceeds the
# configured limit with status 429.
# proof audit --check l1_system_complete
# N SYS-REQs fully linked and described
# SPEC may move on. pass sits on a body

The linked hop stays on system requirements linked. The formula hop stays on system formalization complete. The graph hop stays on levels connected. The rewrite hop stays on characterization testing and mirrors. Jama still authors. Proof vs Jama.

Error when an active SYS-REQ lacks those three fields. Default severity fails the merge unless you lower it in proof.yaml, add a waiver, or skip the L1 level. Zero SYS-REQs is a pass, not a complete system layer. The hop does not write the description. It does not add a shall. It does not prove the named STK-REQ exists. HasSatisfies is a boolean on the row, not a lookup of the target file. It does not prove the Go. It does not run Kind2. It does not measure independence. It does not say every active SYS-REQ has non-envelope FRETish. That hop is system formalization complete. Informal is allowed here. A quiet hop is not a proof that Jama's shall matches the Go, only that every in-scope SYS-REQ currently has a body and an upward edge. We have not scored this floor against a frozen Jama pack or a VectorCAST corpus. The loss is named, not scored.

The linked hop stays on system requirements linked. The rewrite hop stays on characterization testing and mirrors. The engagement stays on software correctness audit. Jama still authors.

What is L1 system complete? Same question. Same URL.

Is this system requirements linked? No. That hop is whether satisfies: is populated. This hop also asks for a description and a FRETish sentence when the strategy claims one. See system requirements linked.

Is this system formalization complete? No. That hop requires non-envelope FRETish on every active SYS-REQ. Informal is not an opt-out there. Informal is allowed here. See system formalization complete.

Is this levels connected? No. That hop is whether declared L0, L1, and L2 join as one graph. This hop is whether each active SYS-REQ is itself complete. See levels connected.

Is this stakeholder requirements? No. That hop is L0 file existence. This hop is L1 completeness. See stakeholder requirements.

Can I mark a SYS-REQ informal to skip this hop? Informal skips the FRETish field on this hop. It does not skip the description or the satisfies list. It does not skip system formalization complete.

Does a quiet hop prove the named STK-REQ exists? No. The hop observes that a satisfies list is non-empty. It does not open the target file.

Does a quiet hop prove the Go matches the shall? No. The hop observes fields. It does not prove the Go.

Does an empty description fail the merge? Yes by default. The check keeps error severity unless you lower it in proof.yaml or skip L1.

Is zero SYS-REQs a complete L1? No. Zero rows is a pass of this hop, not a system layer.

Is this characterization testing? No. That page is rewrite-with-a-ledger. This hop is an empty body on a SYS-REQ. See characterization testing and mirrors.

Is Proof an LDRA alternative for the instrument? No. LDRA still owns the avionics toolchain. Proof vs LDRA.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.