L2 software complete

The check is l2_software_complete. It is SPEC-stage. Default severity is error. It always runs unless you pass --skip-level L2. It loads every active software and integration requirement. Terminal and rejected tombstones are out of the denominator. For each remaining SW-REQ or INT-REQ it asks whether at least one traces.satisfies target resolves to a live system requirement: the id exists, the spec type is system, and the status is still in the active set. It does not rewrite the YAML. It does not call Z3. It does not call Kind2.

The L1 body hop stays on L1 system complete. That hop asks whether each active SYS-REQ has a description and an upward edge. This hop asks whether each active SW-REQ or INT-REQ still has a live SYS parent. The formula hop for lower-layer guarantees stays on software formalization complete. The graph of declared levels stays on levels connected. Interface existence stays on interface coverage.

Each SW-REQ can look fine on its own. The Jama cell still names the function. Reviewers signed the English in another tool. A presence-only check is green because a SYS-REQ id is present. That parent can already be superseded by the child that still cites it. Other SPEC hops miss this because they never resolve the target, or they only count whether a level exists.

The expensive miss is a deploy that treats the id as the parent. The system requirement was retired. The software requirement stayed active. This hop is the gate that names the missing satisfies list, the id that does not exist, the wrong-layer target, or the tombstone parent.

# SW-REQ-310
# status: approved
# traces.satisfies: [SYS-REQ-200]
# SYS-REQ-200 status: superseded
# a presence-only hop
# pass. the id is there
# proof audit --check l2_software_complete
# [SPECIFICATION] l2_software_complete
# SW-REQ-310 has no satisfies link to a live SYS-REQ:
# SYS-REQ-200 is superseded
# ERROR
# proof req link add SW-REQ-310 satisfies <live SYS-REQ>

The fix is a human authorization, not a rewrite of Go. Point satisfies: at a live SYS-REQ. Drop the dead entry. Do not delete the SW-REQ to silence the checker. A second live parent next to a historical tombstone still passes: one live SYS is enough. Then re-run SPEC.

proof audit --check l2_software_complete --verbose
proof workflow check --stage spec --only l2_software_complete
proof help l2_software_complete

The teaching graph is still one active SW-REQ whose satisfies id points at a superseded SYS-REQ. Close it by pointing at a live parent. Do not delete the YAML. Do not invent a second SW-REQ. A satisfies list that only names another SW-REQ is a wrong-layer finding on the same hop. Zero SW-REQs and INT-REQs is a pass, not completeness. --skip-level L2 skips the hop. Rejected and terminal tombstones are out of the count. One live SYS among extra historical links is enough.

# SW-REQ-310 kept. satisfies SYS-REQ-210 (live). SYS-REQ-200 dropped
# proof audit --check l2_software_complete
# N SW/INT-REQs fully linked to SYS-REQs
# SPEC may move on. pass sits on a live parent

The L1 hop stays on L1 system complete. The formula hop stays on software formalization complete. The graph hop stays on levels connected. The rewrite hop stays on characterization testing and mirrors. Jama still authors. Proof vs Jama.

Error when an active SW-REQ or INT-REQ lacks a live SYS parent. Default severity fails the merge unless you lower it in proof.yaml, add a waiver, or skip the L2 level. Zero software and integration requirements is a pass, not a complete software layer. The hop does not write the satisfies list. It does not add a shall. It does not write a description. It does not prove the Go. It does not run Kind2. It does not measure independence. It does not say every SW-REQ has FRETish. That hop is software formalization complete. A quiet hop is not a proof that Jama's shall matches the Go, only that every in-scope L2 requirement currently has a live system parent. We have not scored this floor against a frozen Jama pack or a VectorCAST corpus. The loss is named, not scored.

The L1 hop stays on L1 system complete. The rewrite hop stays on characterization testing and mirrors. The engagement stays on software correctness audit. Jama still authors.

What is L2 software complete? Same question. Same URL.

Is this L1 system complete? No. That hop is whether each active SYS-REQ has a description and an upward edge. This hop is whether each active SW-REQ or INT-REQ still has a live SYS parent. See L1 system complete.

Is this software formalization complete? No. That hop is whether a lower-layer guarantee under a FRETish parent has a formula. This hop is the parent edge. See software formalization complete.

Is this levels connected? No. That hop is whether declared L0, L1, and L2 join as one graph. This hop is whether each active L2 requirement is itself complete. See levels connected.

Is this interface coverage? No. That hop is whether a boundary has an INT-REQ. This hop is whether that INT-REQ still satisfies a live SYS-REQ. See interface coverage.

Does a historical tombstone next to a live SYS fail this hop? No. One live system parent is enough. Extra retired ids do not fail the row.

Does a quiet hop prove the named SYS-REQ is the right parent? No. The hop observes that a live system id is present. It does not score the sentence.

Does a quiet hop prove the Go matches the shall? No. The hop observes links. It does not prove the Go.

Does a dead parent fail the merge? Yes by default. The check keeps error severity unless you lower it in proof.yaml or skip L2.

Is zero SW-REQs a complete L2? No. Zero rows is a pass of this hop, not a software layer.

Is this characterization testing? No. That page is rewrite-with-a-ledger. This hop is a dead parent on a SW-REQ. See characterization testing and mirrors.

Is Proof an LDRA alternative for the instrument? No. LDRA still owns the avionics toolchain. Proof vs LDRA.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.