Obligation suppression reviewer

The check is obligation_suppression_reviewer. It walks every ObligationSuppression on every requirement (STK, SYS, SW, INT). It only counts a row whose class still matches the requirement's tags and whose effective severity is at or above the project threshold. Default threshold is error, set in proof.yaml as catalog.baseline.require_reviewer_at_severity. At warn, author authority is enough. At error, the skip of a control an auditor will read needs a name that is not empty after trim.

Severity of the hop itself is warning, not error. Two pass shapes. No suppressions sit at the threshold: no obligation suppressions at or above reviewer-required severity. Every counted row already has review.reviewed_by. Fail names the count and the threshold, then lists needs review.reviewed_by. A suppress whose class no longer matches the tag set is skipped here. An empty suppressions list is a silent pass: there is nothing at the threshold.

proof audit --check obligation_suppression_reviewer
# STK-REQ-014 obligation_suppressions: rate_limit_respected
# class severity: error (catalog.baseline.overrides)
# reason: internal-only behind ZTNA gateway with platform-level rate limits
# review: missing
# fail: STK-REQ-014: suppression "rate_limit_respected"
#       (severity=error) needs review.reviewed_by
# silent unsigned skip: the reason exists. the second name does not

obligation_suppression_rationale only asks whether the reason is still a sentence. This hop asks whether that skip still carries a reviewer at error severity. obligation_baseline only asks whether a tag-matched class was listed, suppressed, or delegated. A covering SYS-REQ on the parent list stays on obligation_completeness. Required triples stay on obligation_evidence_complete. A named owner stays on obligation_delegation_resolves.

Fix by adding the review block on the suppression. proof req edit --suppress-obligation writes the reason and does not write review. Edit the YAML. proof req review is the help bar for a named reviewer, not a second counted finding here. Do not copy suppressed_by into reviewed_by and call it a second pair of eyes. The hop does not enforce that inequality yet. Auditors still expect it.

obligation_suppressions:
  - id: rate_limit_respected
    reason: "internal-only behind ZTNA gateway with platform-level rate limits"
    suppressed_by: alice
    suppressed_at: "2026-05-02T14:23:11Z"
    review:
      reviewed_by: bob
      reviewed_at: "2026-05-02T16:00:00Z"
      decision: accept

The teaching graph is still one error-severity suppress whose reason is long and whose review is empty. Write reviewed_by. Do not treat a Jama note as this hop. Do not treat a 32-character reason as a second pair of eyes.

proof audit --check obligation_suppression_reviewer --verbose
proof catalog show rate_limit_respected
proof audit --check obligation_suppression_rationale --verbose

The silent-placeholder hop stays on obligation suppression rationale. The silent-omission hop stays on obligation baseline. The silent-pointer hop stays on obligation delegation resolves. The silent-drop hop stays on obligation decomposition complete. The covering-child hop stays on obligation completeness. The triple hop stays on obligation evidence complete. The silent-no-op hop stays on obligation enforcement backed. Jama still authors. Proof vs Jama.

The hop does not write a review block. It does not run proof req review for you. No suppressions at the threshold is a silent pass. Severity of the hop is warning, not fail. reviewed_by is counted after trim. reviewed_at and decision are not this hop. The hop does not enforce that reviewed_by differs from suppressed_by. A suppress whose class no longer matches the tag set is skipped. --skip-level L0 skips the hop. Opt-out is skip, never pass. The hop does not prove that the class is truly inapplicable. The hop does not prove the Go. We have not scored this floor against a frozen Jama pack. The loss is named, not scored.

The child-file hop stays on requirements decomposition. The engagement stays on software correctness audit. Jama still authors.

What is obligation suppression reviewer? Same question. Same URL.

Is this a suppress listing? No. Listing the class as suppressed is obligation baseline. This hop is whether an error-severity suppress still carries reviewed_by.

Is this obligation suppression rationale? No. That hop is whether the reason is still a sentence. A 32-character reason with no reviewer still fails here. See obligation suppression rationale.

Is this obligation baseline? No. That hop is whether a tag-matched class was listed, suppressed, or delegated. This hop is whether the suppress at error still has a reviewer. See obligation baseline.

Is this obligation delegation resolves? No. That hop is whether a named owner still carries the class. A suppress says the class does not apply. See obligation delegation resolves.

Is this obligation decomposition complete? No. That hop is whether a listed class flowed to a satisfying child. See obligation decomposition complete.

Is this obligation completeness? No. That hop is whether each listed class has a covering SYS-REQ. See obligation completeness.

Is this obligation evidence complete? No. That hop is whether required evidence kinds exist. A suppress with a reviewer and no triples still passes here. See obligation evidence complete.

Is this obligation enforcement backed? No. That hop is whether a listed class has a signal or any evidence. See obligation enforcement backed.

Does a green hop prove two people agreed? No. The hop counts a non-empty reviewed_by. It does not compare that name to suppressed_by. It does not execute a test. It does not prove the shall.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.