Obligation baseline

The check is obligation_baseline. It walks every requirement at every level (STK, SYS, SW, INT). For each one it computes the catalog's baseline as a pure tag intersection: the classes whose applies_when.tag_match_all is a subset of that requirement's tags. Description-phrase matching no longer participates. A finding fires when a baseline class is not on obligation_checklist and not in obligation_suppressions.

Severity defaults to warning. Per-framework escalation in proof.yaml catalog.baseline.overrides can promote a cited framework (OWASP-ASVS-v4, IEC-62304-class-C) to error. The run severity is the maximum across findings.

proof audit --check obligation_baseline
# STK-REQ-014 tags: [http_server, public_endpoint, state_changing]
# catalog match: csrf_protection (tag_match_all subset of those tags)
# not on obligation_checklist. not in obligation_suppressions.
# warn: STK-REQ-014: 1 baseline obligation(s) unresolved
# silent omission: the tags fired a class and nobody decided

software baseline is a named snapshot of IDs at a gate. This hop is not that snapshot. catalog_completeness only asks whether a listed name resolves. This hop asks whether a tag-matched class was listed at all. A covering SYS-REQ stays on obligation_completeness. A listed class with no signal stays on obligation_enforcement_backed.

Fix one of two ways. Accept the class onto the checklist. Or suppress it with a rationale of at least 32 characters. Stakeholder findings can use proof req review. SYS, SW, and INT findings use proof req edit; pointing review at those ids exits 0 without resolving anything.

proof req review STK-REQ-014
proof req edit STK-REQ-014 --add-obligation csrf_protection
proof req edit STK-REQ-014 --suppress-obligation rate_limit_respected --reason "..."
proof catalog show csrf_protection

The teaching graph is still one tag set that fired a class with no accept and no suppress. Accept it, suppress it, or DRAFT a project-local class if nothing shipped fits. Do not treat a Jama cell as this hop. Do not treat a CM snapshot as this hop.

proof audit --check obligation_baseline --verbose
proof catalog show csrf_protection
proof catalog list --tag http_server

The CM hop stays on software baseline. The name hop stays on catalog completeness. The covering-child hop stays on obligation completeness. The silent-no-op hop stays on obligation enforcement backed. Hazard worksheets that already run this command stay on hazard analysis to code. Jama still authors. Proof vs Jama.

The hop does not write the checklist. It does not write a suppression. Severity is warning; findings do not fail the first install unless a framework override raises them. Zero tags is an empty match set, which is a silent pass. A project that never tags its requirements gets a vacuously green hop. Description-phrase matching is retired: prose that names CSRF without the tags will not fire. proof req review only walks stakeholder ids. The hop does not invent classes the reviewer never opened. A green hop means every considered class got a decision. It does not mean every hazard that exists was considered. Opt-out is skip, never pass. The hop does not prove the Go. We have not scored this floor against a frozen Jama pack. The loss is named, not scored.

The CM hop stays on software baseline. The engagement stays on software correctness audit. Jama still authors.

What is obligation baseline? Same question. Same URL.

Is this a software baseline? No. That hop snapshots requirement IDs at a named gate. This hop asks whether tags on a live requirement fired a catalog class with no decision. See software baseline.

Is this catalog completeness? No. That hop is whether a listed class name resolves. This hop is whether a tag-matched class was listed or suppressed. See catalog completeness.

Is this obligation completeness? No. That hop is whether each listed class has a covering SYS-REQ. See obligation completeness.

Is this obligation enforcement backed? No. That hop is whether a listed class has a signal or any evidence. This hop is whether the class was listed at all. See obligation enforcement backed.

Is this obligation evidence complete? No. That hop is whether required evidence kinds exist. See obligation evidence complete.

Is this hazard analysis to code? That page already runs this command as the worksheet gate. This URL is the check. See hazard analysis to code.

Does a green hop prove the Go? No. The hop does not execute a test. It does not prove the shall.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.