No authored change surface reviewed

The check is no_authored_change_surface_reviewed. It is VERIFY-stage. It warns. It does not fail the merge. You can still advance. It is off by default. Enable it, then run the hop. It complements authored delta expected. That hop reports a missing no-authored-change review. This hop reports a present review that covers new public surface. It does not write the YAML. It does not prove the Go.

Under Proof's model every code change is refactor, fix, or feature. A no-authored-change review is legitimate only for a pure refactor. A fix should carry a DEFECT. A feature should carry a LocalChange and a spec update. The cheapest enforcement proxy is public surface: when a no-authored-change review covers a Go file whose in-branch diff adds a new exported identifier, that is the strongest available signal the change was not a pure refactor, so the review should be re-confirmed rather than silently accepted.

The missing-stamp hop stays on authored delta expected. The backing hop stays on change evidence complete. The branch brief stays on pull request review. Description-only edits belong to description delta reviewed, not this URL.

# SYS-REQ-1374  traces.implemented_by: pkg/cli/flag.go
#               impact review: no-authored-change on flag.go
# flag.go added exported ParseCategory this branch
# a stamp-only hop
# pass. the extra tests are green. the stamp says refactor
# proof config set project.checks.no_authored_change_surface_reviewed.enabled true
# proof audit --check no_authored_change_surface_reviewed
# [VERIFY] no_authored_change_surface_reviewed
# SYS-REQ-1374:pkg/cli/flag.go added ParseCategory, undocumented
# WARNING
# proof help no_authored_change_surface_reviewed

The new-exported-surface set is computed with go/ast, never a regex. For each no-authored-change review over a non-test, non-generated .go artifact, the file is read at the review's recorded base ref and in the current working tree. Both are parsed. Added surface is the current exported set minus the base set. Only added symbols matter. Removed or renamed surface is a different concern and is ignored. Methods on an unexported receiver are not public surface.

Classify the change before you reach for another stamp. Options 1-4 are alternatives, not steps. Option 5 is a human risk-acceptance decision. Do not run proof waive yourself.

proof config set project.checks.no_authored_change_surface_reviewed.enabled true
proof audit --check no_authored_change_surface_reviewed --verbose
proof spec show SYS-REQ-1374
proof req edit SYS-REQ-1374 --description "<text naming ParseCategory>"
proof review impact SYS-REQ-1374 --change-type feature --change CHG-<id> --reason "Feature slice; requirement now documents the new surface"
proof help no_authored_change_surface_reviewed

The teaching graph is still one requirement that lists flag.go and one production file that gained an exported identifier under a refactor stamp. Close it by naming the symbol in a tracing requirement (if it really is a helper that changed no obligation), filing a DEFECT (if it is a fix), recording a feature slice and updating the shall (if the new surface is the added behaviour), or unexporting the identifier (if the export was accidental). Re-recording the same no-authored-change review does not clear it. The check compares exported-symbol sets, not review counts. A decorative mention of the symbol name in a description, written only to satisfy the spec-backing predicate, is an anti-pattern. The hop does not write that description for you.

# SYS-REQ-1374 description now names ParseCategory
# proof audit --check no_authored_change_surface_reviewed
# 0 surface findings
# VERIFY may move on. pass sits on documented public surface

The missing-stamp hop stays on authored delta expected. The rewrite hop stays on characterization testing and mirrors. Jama still authors. Proof vs Jama.

Warning when a no-authored-change review covers an existing Go production file that gained an exported identifier no tracing requirement documents. Off by default. Default severity does not fail the merge. You can still advance. Zero in-scope findings is a pass, not a proved graph. Go production source only. _test.go and generated files are ignored. A wholly-new file (no base blob) is skipped. Removed or renamed surface is ignored. Methods on an unexported receiver are excluded. When a sibling requirement that traces the file already names the new symbol in its description, the surface is treated as reviewed and is not flagged. Overlay-audit is not this hop. The hop does not write the impact review. It does not add a shall. It does not write a description. It does not prove the Go. It does not invent an Implements line. A quiet hop is not a proof that Jama's shall matches the Go, only that every in-scope refactor stamp currently covers no spec-orphaned added export, or that the check is still off. We have not scored this floor against a frozen Jama pack or a VectorCAST corpus. The loss is named, not scored.

The missing-stamp hop stays on authored delta expected. The rewrite hop stays on characterization testing and mirrors. The engagement stays on software correctness audit. Jama still authors.

What is no authored change surface reviewed? Same question. Same URL.

Is this authored delta expected? No. That hop reports a missing no-authored-change stamp. This hop reports a present stamp over new public surface. See authored delta expected.

Is this change evidence complete? No. That hop is whether the declared change type still has its backing. This hop is the added export under a refactor stamp. See change evidence complete.

Is this a pull request review? No. That hop is the brief for the whole branch. See pull request review.

Do extra tests clear a new export under a refactor stamp? No. A green suite is not a review of the new public API.

Is a new exported function a no-authored-change? Not by default. A new exported identifier is the strongest available signal the change was not a pure refactor. Name it, file a DEFECT, record a feature, or unexport it.

Does re-recording the same no-authored-change review clear it? No. The check compares exported-symbol sets, not review counts.

Does a quiet hop prove the Go matches the shall? No. The hop observes AST symbol sets and tracing descriptions. It does not prove the Go.

Does this finding fail the merge? No by default. The check keeps warning severity. You can still advance. It is also off until you enable it.

Are new files in scope? No. A wholly-new file has no base blob. That surface lands with its spec on the feature path, not this silent-refactor miss.

Is this characterization testing? No. That page is rewrite-with-a-ledger. This hop is a refactor stamp over new public surface. See characterization testing and mirrors.

Is Proof an LDRA alternative for the instrument? No. LDRA still owns the avionics toolchain. Proof vs LDRA.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.