System formalization complete

The check is system_formalization_complete. It is SPEC-stage. Default severity is error. It always runs. It looks at every active system requirement. System requirements do not have an informal strategy exemption. formalized: false, a requirement-level formalization_strategy: informal, and project.spec_types.system.formalization_strategy: informal do not exempt a SYS-REQ. proof config set rejects the unsupported system-level informal strategy. proof validate warns when it finds that value in a hand-authored manifest. Legacy exceptions require an explicit waiver. They are not configuration strategies. Lower-layer FRETish under a FRETish parent stays on software formalization complete. Cross-component guarantees stay on interface formalization complete. The FRETish language itself stays on FRETish. A lemma cache that still says valid after a timeout stays on formalization lemma verdict consistency.

Each SYS-REQ can look fine on its own. The Jama cell still names the system. Reviewers signed the English. Downstream hops that need a formula then skip or pass empty, because there is no FRETish to vacuity-check, no envelope to reject, no independence pair to measure. Other SPEC hops miss this because they never ask whether the active system requirement actually has a non-envelope formula.

The expensive miss is a deploy that treats the shall as the contract. The English implied a bound. The formula never encoded that bound. This hop is the gate that names the empty fretish:, the informal strategy, or the two-bool !P | Q envelope that dropped a bound the description already named.

# SYS-REQ-712
# status: approved
# formalization_strategy: informal
# fretish:   (empty)
# proof audit --check system_formalization_complete
# [SPECIFICATION] system_formalization_complete
# SYS-REQ-712: formalization_strategy is not fretish
# and fretish is empty
# ERROR
# write the formula. informal is not an opt-out here

The fix is a human authorization, not a rewrite of Go. Set formalization_strategy: fretish and write real FRETish for the listed system requirement. Keep the resulting model aligned with the component variables. For a one-off exception, add a narrow waiver for this check and that ID. Do not configure the system layer as informal. Do not delete the SYS-REQ to silence the checker. Then re-run SPEC.

proof audit --check system_formalization_complete --verbose
proof workflow check --stage spec --only system_formalization_complete
proof help system_formalization_complete

The teaching graph is still one active SYS-REQ with empty FRETish. Close it by writing the formula. Do not set informal on the requirement. Do not set informal on the system spec type. Do not delete the YAML. Do not invent a second SYS-REQ. A two-bool !P | Q envelope fails this hop when the description already named a bound the formula omitted. A bound is a digit, a word numeral above two, a URL grammar term, or a retry count. The check strips requirement identifiers and zero-decision phrases from the prose before it scans for a digit, so an identifier or an honest zero-decision leaf does not read as a bound. Honest mutex prose and a zero-decision raise leaf stay complete. When the prose names a real bound, replace the bare envelope with a non-envelope formalization that models the bound or the extra conjunct.

# SYS-REQ-712 kept. strategy fretish. fretish written
# RateLimit shall always satisfy
#   if request_count > limit then response_status = 429
# proof audit --check system_formalization_complete
# all active SYS-REQs formalized in FRETish
# SPEC may move on. pass sits on a formula

The lower-layer hop stays on software formalization complete. The cross-component hop stays on interface formalization complete. The language hop stays on FRETish. The lemma hop stays on formalization lemma verdict consistency. The rewrite hop stays on characterization testing and mirrors. Jama still authors. Proof vs Jama.

Error when an active SYS-REQ lacks usable FRETish. Default severity fails the merge unless you lower it in proof.yaml or add a waiver. Informal is not a skip. An omitted strategy is not a skip. The hop does not write the formula. It does not add a shall. It does not prove the Go. It does not run Kind2. It does not measure independence. It does not say a lower-layer guarantee is formal. That hop is software formalization complete. It does not say a cross-component guarantee is formal. That hop is interface formalization complete. A quiet hop is not a proof that Jama's shall matches the Go, only that every in-scope SYS-REQ currently has a non-envelope formula. We have not scored this floor against a frozen Jama pack or a VectorCAST corpus. The loss is named, not scored.

The lower-layer hop stays on software formalization complete. The rewrite hop stays on characterization testing and mirrors. The engagement stays on software correctness audit. Jama still authors.

What is system formalization complete? Same question. Same URL.

Is this L1 system complete? No. That hop is whether an active SYS-REQ has a satisfies id, a description, and a FRETish sentence when it claimed one. Informal is allowed there. This hop is the formula floor, with no informal opt-out. See L1 system complete.

Is this software formalization complete? No. That hop is whether a lower-layer spec under a FRETish parent has non-envelope FRETish, and informal is allowed there. This hop is the system layer, with no informal opt-out. See software formalization complete.

Is this interface formalization complete? No. That hop is whether a cross-component guarantee has non-envelope FRETish. This hop is whether every active SYS-REQ has it. See interface formalization complete.

Is this FRETish? No. That page is the language. This hop is whether a SYS-REQ actually wrote it. See FRETish.

Is this formalization lemma verdict consistency? No. That hop is a cached lemma that still says valid. This hop is presence of a formula. See formalization lemma verdict consistency.

Can I mark a SYS-REQ informal to skip this hop? No. Informal is not an opt-out at the system layer. Use a waiver for a legacy exception.

Does a quiet hop prove the Go matches the shall? No. The hop observes formulas. It does not prove the Go.

Does a missing formula fail the merge? Yes by default. The check keeps error severity unless you lower it in proof.yaml.

Is this characterization testing? No. That page is rewrite-with-a-ledger. This hop is empty FRETish on a SYS-REQ. See characterization testing and mirrors.

Is Proof an LDRA alternative for the instrument? No. LDRA still owns the avionics toolchain. Proof vs LDRA.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.