Suspect clean

The check is suspect_clean. It is VERIFICATION-stage. It warns. It does not fail the merge. You can still advance. It asks one question at the requirement: has anything on this trace moved since the last review. It compares traces.reviewed_at with the requirement history.last_modified_at and with the linked artifact times. Both sides must still be older than that stamp, or the link is suspect. The kinds are satisfies, implemented_by, verified_by, and documented_by. It does not write the YAML. It does not prove the Go.

The scan-health hop stays on autolink clean. That hop is whether autolink produced errors. This hop is whether a link you already have may be stale. Missing Implements: stays on orphan code. Missing Verifies: stays on orphan tests. The matrix hop stays on requirements traceability matrix. The lifecycle hop, including changed_requirements_reviewed, stays on requirement lifecycle.

Each neighbor can look fine on its own. Autolink reports zero errors because the comment still parses. Orphan-code is quiet because the function still carries a live annotation. The RTM still draws the edge. Reviewers signed the English in another tool. The expensive miss is a file that moved after the review stamp, with the graph still drawing last month's edge.

# SYS-REQ-142  traces.implemented_by: pkg/cache/ttl.go
#              traces.reviewed_at: 2026-08-01
# ttl.go edited 2026-09-12
# a presence-only graph hop
# pass. the Implements line is still there
# proof audit --check suspect_clean
# [VERIFICATION] suspect_clean
# SYS-REQ-142 implemented_by pkg/cache/ttl.go is newer than traces.reviewed_at
# WARNING
# proof help suspect_clean

The fix is a review, not a rewrite of Go. List the stale owners with proof trace suspect. Re-read the requirement whose trace drifted. Record current state with proof trace review --suspect, or supply a --citation that still names one of that requirement's own targets. Re-run autolink after a real source change. Do not clear the finding by deleting the link. Then re-run VERIFICATION.

proof audit --check suspect_clean --verbose
proof trace suspect
proof trace review --suspect
proof help suspect_clean

The teaching graph is still one requirement that lists ttl.go and one file that moved after the review stamp. Close it by re-reading the requirement, recording proof trace review --suspect, or citing a location that still names that ID. Do not delete the YAML. Do not invent a second SYS-REQ. Zero in-scope suspects is a pass, not a proved graph. A baseline does not make the links go away. One review does not suppress the link forever. Terminal and out-of-scope owners stay off the default list unless you pass --all.

# SYS-REQ-142 kept. traces.reviewed_at now covers ttl.go
# proof audit --check suspect_clean
# 0 suspect links
# VERIFICATION may move on. pass sits on a current stamp

The scan hop stays on autolink clean. The missing-annotation hop stays on orphan code. The rewrite hop stays on characterization testing and mirrors. Jama still authors. Proof vs Jama.

Warning when a requirement or a linked artifact is newer than traces.reviewed_at. Default severity does not fail the merge. You can still advance. Zero in-scope suspects is a pass, not a complete graph. A requirement with no traces.reviewed_at cannot suppress a suspect. A baseline separates old debt from new drift; it does not change the underlying evidence. proof trace review --suspect records current state for the stale owners this hop already named. --all is only for terminal or out-of-scope owners you meant to include. A --citation must name one of that requirement's own targets and still reference the ID, or it is a hard error. The hop does not write the review stamp by itself. It does not add a shall. It does not write a description. It does not prove the Go. It does not invent an Implements line. It does not measure independence. A quiet hop is not a proof that Jama's shall matches the Go, only that every in-scope link currently sits under a stamp that still covers both sides. We have not scored this floor against a frozen Jama pack or a VectorCAST corpus. The loss is named, not scored.

The scan hop stays on autolink clean. The rewrite hop stays on characterization testing and mirrors. The engagement stays on software correctness audit. Jama still authors.

What is suspect clean? Same question. Same URL.

Is this autolink clean? No. That hop is whether the scan produced errors. This hop is whether a link you already have may be stale. See autolink clean.

Is this orphan code? No. That hop is a production function with no live Implements line. This hop is a live link whose stamp no longer covers both sides. See orphan code.

Is this a requirements traceability matrix? No. That hop rebuilds requirement, code, test. This hop asks whether an edge on that graph is newer than its review. See requirements traceability matrix.

Is this requirement lifecycle? No. That hop includes the change-set floor. This hop is the trace stamp. See requirement lifecycle.

Does a baseline make suspect links go away? No. Baselines separate old debt from new drift. They do not change the underlying evidence.

Does one review suppress the link forever? No. If either side moves, the review should stop suppressing the link.

Does a quiet hop prove the Go matches the shall? No. The hop observes review stamps. It does not prove the Go.

Does a stale link fail the merge? No by default. The check keeps warning severity. You can still advance.

Is zero in-scope suspects a complete graph? No. Zero in-scope suspects is a pass of this hop, not a proved trace.

Is this characterization testing? No. That page is rewrite-with-a-ledger. This hop is a stale review stamp. See characterization testing and mirrors.

Is Proof an LDRA alternative for the instrument? No. LDRA still owns the avionics toolchain. Proof vs LDRA.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.