Software formalization complete

The check is software_formalization_complete. It is SPEC-stage. Default severity is warning. It always runs. A spec is in scope when it is not cross_component, its spec type still requires FRETish, and its parent spec also requires FRETish. Inside those specs it looks at requirements whose status is review or approved, whose req_type is guarantee or omitted (omitted is treated as a guarantee), and whose formalization_strategy is fretish or omitted (omitted is treated as FRETish). Draft, in-progress, and terminal statuses are not this hop. Assumptions are not this hop. A genuine prose-only requirement sets formalization_strategy: informal and leaves this hop. A genuine prose-only lower layer sets the same flag on the spec type. A child whose parent is informal is out of scope: there is no formal parent to sit under. Cross-component guarantees stay on interface formalization complete. System-layer FRETish (no informal opt-out) is a different check and a different URL. The FRETish language itself stays on FRETish. A lemma cache that still says valid after a timeout stays on formalization lemma verdict consistency.

Each SW-REQ can look fine on its own. The Jama cell still names the module. The parent SYS-REQ still has a formula. Reviewers signed the English. Downstream hops that need a formula then skip or pass empty, because there is no FRETish to vacuity-check, no envelope to reject, no independence pair to measure. Other SPEC hops miss this because they never ask whether the approved lower-layer guarantee actually has a non-envelope formula.

The expensive miss is a deploy that treats the shall as the contract. The English implied a bound. The formula never encoded that bound. This hop is the gate that names the empty fretish:, or the two-bool !P | Q envelope that dropped a bound the description, rationale, or implements already named.

# MOD-REQ-001
# parent: platform (FRETish)
# status: approved
# req_type: guarantee
# fretish:   (empty)
# proof audit --check software_formalization_complete
# [SPECIFICATION] software_formalization_complete
# 1 review or approved guarantee requirement(s) lack a
# non-envelope FRETish formalization across 1 configured
# lower formal-layer spec(s)
# MOD-REQ-001 missing FRETish
# WARNING
# write the formula, or mark the requirement informal

The fix is a human authorization, not a rewrite of Go. Write real FRETish for the listed guarantee. For a genuine prose-only requirement, set formalization_strategy: informal on that requirement. For a genuine prose-only lower layer, set it on the spec type. For a one-off exception, add a narrow waiver for this check and that ID. Do not delete the SW-REQ to silence the checker. Then re-run SPEC.

proof audit --check software_formalization_complete --verbose
proof workflow check --stage spec --only software_formalization_complete
proof help software_formalization_complete

The teaching graph is still one approved lower-layer guarantee with empty FRETish, sitting under a parent that also requires FRETish. Close it by writing the formula, or by marking the requirement informal. Do not delete the YAML. Do not invent a second SW-REQ. A two-bool !P | Q envelope fails this hop only when the description, rationale, or implements already named a bound the formula omitted. Honest mutex prose and a zero-decision raise leaf stay complete. Zero configured lower formal-layer specs that require FRETish is a pass, not a proof that every module is formal. A child whose parent is informal is out of scope. Cross-component formalization is a different check and a different URL.

# MOD-REQ-001 kept. fretish written
# the module shall always satisfy processed
# proof audit --check software_formalization_complete
# all review or approved guarantee requirement(s) in
# 1 configured lower formal-layer spec(s) have a
# non-envelope FRETish formalization
# SPEC may move on. pass sits on a formula

The cross-component hop stays on interface formalization complete. The language hop stays on FRETish. The lemma hop stays on formalization lemma verdict consistency. The rewrite hop stays on characterization testing and mirrors. Jama still authors. Proof vs Jama.

Warning when a review or approved guarantee in a configured lower formal-layer spec lacks non-envelope FRETish. Default severity does not fail the merge unless you raise it in proof.yaml. Zero configured lower-layer specs that require FRETish under a FRETish parent is a pass, not a proof that every module is formal. Zero review or approved guarantees in those specs is also a pass. Draft and in-progress IDs are skipped. Informal strategy is skipped. An omitted req_type is treated as a guarantee. An omitted strategy is treated as FRETish. A child whose parent is informal is out of scope. The hop does not write the formula. It does not pick informal versus FRETish. It does not add a shall. It does not prove the Go. It does not run Kind2. It does not measure independence. It does not say a system requirement is formal. That layer is a different check. It does not say a cross-component guarantee is formal. That hop is interface formalization complete. A quiet hop is not a proof that Jama's shall matches the Go, only that every in-scope lower-layer guarantee currently has a non-envelope formula, or that nothing in-scope asked for one. We have not scored this floor against a frozen Jama pack or a VectorCAST corpus. The loss is named, not scored.

The cross-component hop stays on interface formalization complete. The rewrite hop stays on characterization testing and mirrors. The engagement stays on software correctness audit. Jama still authors.

What is software formalization complete? Same question. Same URL.

Is this interface formalization complete? No. That hop is whether a cross-component guarantee has non-envelope FRETish. This hop is whether a lower-layer spec under a FRETish parent has it. See interface formalization complete.

Is this system formalization complete? No. That hop is the system layer, with no informal opt-out. This hop allows informal on the requirement or the spec type. That check is a different URL.

Is this FRETish? No. That page is the language. This hop is whether a lower-layer guarantee actually wrote it. See FRETish.

Is this formalization lemma verdict consistency? No. That hop is a cached lemma that still says valid. This hop is presence of a formula. See formalization lemma verdict consistency.

Does a child under an informal parent fail this hop? No. Scope requires the parent to require FRETish too.

Does a quiet hop prove the Go matches the shall? No. The hop observes formulas. It does not prove the Go.

Does an empty configured set fail this hop? No. Zero lower-layer specs that require FRETish under a FRETish parent is a pass, not a proof.

Does a missing formula fail the merge? No by default. The check keeps warning severity unless you raise it in proof.yaml.

Is this characterization testing? No. That page is rewrite-with-a-ledger. This hop is empty FRETish on a lower-layer guarantee. See characterization testing and mirrors.

Is Proof an LDRA alternative for the instrument? No. LDRA still owns the avionics toolchain. Proof vs LDRA.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.