Variables declared

The check is variables_declared. It is SPEC-stage preflight. Default severity is error on undeclared names and invalid directions. The hop reads the component variable model against the formulas that consume it, before Kind2 or Z3 run. It does not rewrite the YAML. It does not call Z3. It does not call Kind2.

It fires on the contract boundary. An undeclared name in FRETish is an error. A caller-controlled value written as a guarantee, or a component-owned value written as an assumption, is the wrong side. A mode selected by the caller is still an input, even if people call it a mode. A remembered value flattened into a stateless input is the wrong shape. An input-only guarantee conjunct is a warning, not a solver proof.

The expensive miss is a SYS-REQ that "PROVES" because a referenced variable was silently dropped. The encoder substitutes a fresh unconstrained name. Every concrete bound then passes vacuously. This hop rejects that model before Kind2 runs, so the audit cannot show the requirement holds on a phantom.

This is not leftover inventory. That hop is variable orphans clean. A declared name with no consumer is an orphan. A used name with no declaration, or a declaration on the wrong side of the contract, is this hop. The help file teaches that first.

# component-a/variables.yaml
#   quota_used    direction input
#   quota_max     MISSING
#
# the shall: Limit shall hold quota_used <= quota_max
# Kind2 still prints valid
#
# proof audit --check variables_declared
# [SPEC] variables_declared
# quota_max referenced but not declared
# silent VALID: last stamp still on a phantom bound

The fix is on the model, not on another test. Add the variable to the component that owns it, with the right direction. Or rename the FRETish term to the name that already exists. Or move the requirement to the component that owns the name. Then re-run the SPEC stage. Do not jump to realize to hide a preflight miss.

proof audit --check variables_declared --verbose
proof workflow check --stage spec --verbose
proof validate --preflight specs/system component-a

The teaching graph is still one component whose live shall named quota_max while the vars file did not. Close it by declaring the name with the right direction on the component that owns it, or by renaming the FRETish term to the live name, or by moving the requirement. Do not add a spare name only to silence non-boolean inputs constrained. That leftover then fails variable orphans clean. With no declaration the hop still fires, and the bound did not go anywhere. It just never sat in the YAML.

# component-a/variables.yaml now holds the bound
#   quota_used    direction input
#   quota_max     direction input, constraint >= 1
#
# proof audit --check variables_declared
# 92 formalized components passed solver preflight
#
# Kind2 is allowed to run. a VALID now sits on a declared bound

Leftover inventory stays on variable orphans clean. List-versus-sentence on one requirement stays on variable drift. An unconstrained output while Kind2 still printed realisable stays on gaps clean. Jama still authors. Proof vs Jama.

Error on undeclared names and invalid directions. Warning on an input-only guarantee conjunct. Direct proof validate --preflight reports that warning and exits zero when no errors exist. proof audit --fail-level warn keeps it blocking. Auxiliary is silence with a reason: mark proof_auxiliary: true and the encoder ignores it. The hop does not rewrite the YAML. It does not add a shall. It does not prove the Go. It does not run Kind2. A quiet hop is not a proof that the model is the one you meant, only that every collected FRETish name is declared with a direction the contract can use. We have not scored this floor against a frozen Jama pack or a ReqIF export. The loss is named, not scored.

The leftover-inventory hop stays on variable orphans clean. The list-versus-sentence hop stays on variable drift. The unconstrained-output hop stays on gaps clean. The engagement stays on software correctness audit. Jama still authors.

What is variables declared? Same question. Same URL.

Is this variable orphans clean? No. That hop is leftover inventory: a declared name with no consumer, or a used name with no declaration as a count. This hop is the preflight that refuses a phantom before Kind2 runs, including wrong direction and input-only guarantees. See variable orphans clean.

Is this variable drift? No. That hop is list versus sentence on one requirement. See variable drift.

Is this gaps clean? No. That hop is an unconstrained output while Kind2 still printed realisable. See gaps clean.

Is this undeclared variable? No. Ads 10 on that string is a C compiler error. The H1 stays this check.

Does an auxiliary flag prove the name is safe? No. It names why the encoder needs a name no behavioral shall consumes. The hop still counts it in the exemption inventory.

Does a quiet hop prove the code matches the shall? No. The hop observes declarations against consumers and directions. It does not prove the Go.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.