Topic · levels connected

Levels connected

Gist

A component with SYS-REQ and SW-REQ but no satisfies: between them is two islands. Proof runs proof audit --check levels_connected. A green stamp on each pile is not one graph. Jama still authors.

proof audit --check levels_connected

Keep the live shall if it is still true. Keep Jama if it already holds it. Neither one fails the merge when L2 never pointed at L1.

Request demo Last silent pass vs this hop

01 · The silent island

Each level can look 100% covered. The audit still cannot reason end to end.

You can import stakeholder shalls from a spreadsheet, write system shalls in a new namespace, and never wire them. Lint still prints clean. Coverage still prints 100% on each pile.

The check is levels_connected. It is SPEC-stage. Default severity is error. The hop asks whether the active spec levels in this repo are one graph. It does not rewrite the YAML. It does not call Z3. It does not call Kind2.

It fires on three classes. A declared spec level with zero requirements is an error: author one, or remove that level from project.specs in proof.yaml. L0 and L2 with no L1 is an error: the chain has a hole. A component that has both L1 and L2 with no satisfies: from software or integration to a SYS-REQ in that component is an error: split the component if the two levels are genuinely unrelated, otherwise link them. There is no island waiver.

The expensive miss is six months of system-level work that never pointed at a stakeholder need, or a software pile that never pointed at the system shall it claims to implement. Downstream coverage then passes on each island. The audit never asks about the island nobody linked. This hop is the gate that says the four levels are one graph, the only graph the rest of the audit can reason about.

This is not whether each SYS-REQ names a live STK-REQ. That hop is system requirements linked. A per-file upward edge can still pass while a software pile in the same component never points at L1. The graph is this hop. The help file teaches that first.

# gateway has SYS-REQ-200 and SW-REQ-310
# SW-REQ-310 never satisfies a SYS-REQ
id: SW-REQ-310
component: gateway
traces:
  satisfies: []

# proof audit --check levels_connected
# [SPEC] levels_connected
# 1 cross-level connectivity issue
# component "gateway" has both L1 and L2 requirements
# but no satisfies links between them
# silent pass: last stamp still on two islands

The fix is on the link, or on the level list, not on another test. Add a real satisfies: from the SW-REQ or INT-REQ to the SYS-REQ it implements. Or split the component if the two levels do not belong together. If a level is out of scope, remove it from project.specs rather than leaving it empty. Then re-run the SPEC stage. Do not jump to realize to hide a preflight miss. Hotfix mode skips this check: that skip is not a pass.

proof audit --check levels_connected --verbose
proof workflow check --stage spec --verbose
proof help levels_connected

02 · The exhibit

Same empty L2 link. Silent pass, or this hop.

One last green SPEC on gateway. The SYS-REQ pointed up. The SW-REQ never pointed at L1. Click the tabs.

The stamp

Ask did each pile still print 100% inside itself
Stamp SYS-REQ-200 last pass. SW-REQ-310 last pass. empty L2 satisfies
Why the islands are covered. nobody asked whether they join

Suite green

This hop

Nobody asked whether gateway joined L1 to L2. A clean per-file stamp is not one graph. The finding kind is this hop.

Need unread

The stamp

Keep the live shall. Keep the Jama cell. That is not this hop.

Keep the record

Proof

Ask are the declared spec levels one graph, with L2 satisfying L1 in each component that has both
Out levels_connected, component gateway has both L1 and L2 but no satisfies links between them

Island counted

Same empty L2 link. Silent pass, or this hop. Click the tabs.

Surface	What they do	What Proof does	What we lose
Green validate	The last clean parse on each requirement file.	Whether those files join as one graph.	We do not reparse YAML here. A green stamp is not this hop.
System requirements linked	Whether each SYS-REQ names a live STK-REQ.	Whether L2 in that component still points at L1.	Not the per-SYS-REQ edge. See system requirements linked.
Stakeholder requirements	Whether the L0 files exist.	Whether a declared L0 is empty, or L0+L2 skip L1.	Not L0 existence. See stakeholder requirements.
Requirements decomposition	Whether a parent was split into children with more detail.	Whether adjacent levels still join.	Not the split. See requirements decomposition.
Traceability matrix	The table of requirement, code, and test cells.	The chain L0 to L1 to L2, or the empty level.	Not the matrix. See requirements traceability matrix.
Jama cell	A shall, and a parent if you type it.	An error the audit can name next to the missing join.	Not Jama's V&V. Jama still authors. We have not run a frozen Jama pack.

The teaching graph is still one component whose SYS-REQ pointed up while the SW-REQ never pointed at L1. Close it by linking the SW-REQ to the SYS-REQ it implements, or by splitting the component if the two levels do not belong together. Do not point at the nearest SYS-REQ only to silence the checker. With no L2-to-L1 edge in that component the hop still fires, and the island did not go anywhere. It just never sat in the YAML.

# SW-REQ-310.req.yaml now names the system shall
id: SW-REQ-310
component: gateway
traces:
  satisfies: [SYS-REQ-200]

# proof audit --check levels_connected
# all 3 spec levels connected (L0:31, L1:12, L2:4)
#
# SPEC is allowed to move on. a pass now sits on one graph

The per-SYS-REQ edge stays on system requirements linked. The split stays on requirements decomposition. The table of cells stays on requirements traceability matrix. Jama still authors. Proof vs Jama.

03 · The honest loss

Proof names the island. It does not write the YAML, and it does not prove the Go.

A quiet proof audit --check levels_connected can still mean every declared level has requirements and every component with both L1 and L2 has a join. Jama still authors.

Error on an empty declared level, on L0+L2 with no L1, or on a component whose L2 never satisfies L1. No island waiver: link the islands, or remove the empty level. The hop does not rewrite the YAML. It does not add a shall. It does not prove the Go. It does not run Kind2. A quiet hop is not a proof that the named parent is the one you meant, only that the declared levels join. It does not count how many SYS-REQs reach a STK-REQ. That count is the other hop. Hotfix mode skips this check. We have not scored this floor against a frozen Jama pack or a ReqIF export. The loss is named, not scored.

The per-SYS-REQ hop stays on system requirements linked. The L0 existence hop stays on stakeholder requirements. The split hop stays on requirements decomposition. The matrix hop stays on requirements traceability matrix. The engagement stays on software correctness audit. Jama still authors.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What is levels connected? Same question. Same URL.

Is this system requirements linked? No. That hop is the upward edge from each SYS-REQ. This hop is whether the declared levels join as one graph. See system requirements linked.

Is this stakeholder requirements? No. That hop is L0 file existence. This hop is an empty declared level, or L0+L2 with no L1. See stakeholder requirements.

Is this requirements decomposition? No. That hop is the split. This hop is whether adjacent levels still join. See requirements decomposition.

Is this the traceability matrix? No. That hop is the table of cells. See requirements traceability matrix.

Does a quiet hop prove the named parent is the right need? No. The hop observes joins. It does not score the sentence.

Does a quiet hop prove the code matches the shall? No. The hop observes the graph. It does not prove the Go.

Does hotfix mode pass this hop? No. Hotfix skips it. A skip is not a pass.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.