Skip to content

chore: register 157 orphan requirement tags found by trace --gaps audit - #70

Merged
SoundMatt merged 1 commit into
mainfrom
chore/audit-orphan-reqs-and-doc-drift
Jul 28, 2026
Merged

chore: register 157 orphan requirement tags found by trace --gaps audit#70
SoundMatt merged 1 commit into
mainfrom
chore/audit-orphan-reqs-and-doc-drift

Conversation

@SoundMatt

Copy link
Copy Markdown
Owner

Summary

Routine requirement/test/doc completeness audit (post v0.5.45 spec-conformance sweep, no known bugs to fix — issue #66 confirmed still open and out of scope as an AUTOSAR/Coverity/CBMC feature request).

  • cfusa trace --dir . --gaps against the repo's own source found 157 real //cfusa:req///cfusa:test tags across the ANA, BADGE, BOU, CFG, CYB, DIFF, DISP, FIX, FMEA, IMP, LINT, PR, REQ, RPT, SCI, TRA, UTIL, VULN families referencing requirement IDs that were never registered in .fusa-reqs.json. Registered all 157, with titles/descriptions derived from the tagged code's own doc comment where one exists (e.g. cmd_analyze.c's A003 — signed/unsigned comparison, cmd_cyber.c's CY0nn — CWEnnn: ... lines) or, for test-only tags, from the exercised CLI behavior. Requirement count: 163 → 320, all traced and tested (0 untested, down from 0 already — test-gap count was already zero before and after).
  • Deliberately left alone: REQ-GHOST999 is synthetic fixture data inside test_req_trace_cov.c's own dangling-reference regression test, not a real requirement. A handful of bare-word "IDs" (REQ-ID, test, reference, security-test, entry, has, in, matching, no, or) are just cfusa trace's scanner picking up words from usage/help text and explanatory comments sharing a line with a real tag — not annotations of anything.
  • Fixed three stale v0.5.0 version references that were never bumped since the initial release: CMakeLists.txt's project() VERSION, and the Project: headers in safety-case.md / tara.md. Now read 0.5.45.

Verification

  • --func-coverage 1 in a clean git worktree (no local build clutter): 100% (116/116) function annotation density. The 82% seen in the dirty working tree was stray build_asan//build_fortify/ directories not matched by .gitignore's build-*/ pattern — not a real gap, and not touched by this PR.
  • Line coverage via lcov + cfusa coverage --threshold 80: 85.2%, above the CI gate, no regression.
  • Full ctest suite: 38/38 passing.

Test plan

  • cmake --build build && ctest --test-dir build --output-on-failure — 38/38 pass
  • cfusa trace --dir . --gaps — 0/320 requirements untested, zero real orphan tags
  • cfusa trace --dir . --func-coverage 1 in a clean worktree — 100% (116/116)
  • lcov + cfusa coverage --threshold 80 — 85.2% PASS
  • python3 -m json.tool .fusa-reqs.json — valid JSON, 320 unique IDs

cfusa trace --dir . --gaps against the repo's own source found 157 real
//cfusa:req/test tags (ANA, BADGE, BOU, CFG, CYB, DIFF, DISP, FIX, FMEA,
IMP, LINT, PR, REQ, RPT, SCI, TRA, UTIL, VULN families) referencing
requirement IDs that were never registered in .fusa-reqs.json, so trace
flagged them as dangling. Each title/description was derived from the
tagged code's own doc comment where one exists (e.g. cmd_analyze.c's
"A003 — signed/unsigned comparison", cmd_cyber.c's "CY0nn — CWEnnn: ..."
lines) or, for test-only tags, from the exercised CLI behavior. Requirement
count goes from 163 to 320, all traced and tested (0 untested).

Left two things alone deliberately: REQ-GHOST999 is synthetic fixture data
inside test_req_trace_cov.c's dangling-reference regression test, not a
real requirement; and the handful of bare-word "IDs" (REQ-ID, test,
reference, security-test, entry, has, in, matching, no, or) are just
cfusa trace's own scanner picking up words from usage/help text and
explanatory comments that happen to sit on the same line as a real tag —
not annotations of anything.

Also fixed three stale v0.5.0 version references (CMakeLists.txt's
project() VERSION, and the "Project:" headers in safety-case.md/tara.md)
that had never been bumped since the initial v0.5.0 release, now at
v0.5.45.

Verified clean: --func-coverage reports 100% (116/116) in a clean
worktree — the 82% seen in the dirty working tree was stray local
build_asan/build_fortify directories not matched by .gitignore's
build-*/ pattern, not a real gap. Line coverage via lcov is 85.2%,
comfortably above the 80% CI gate. Full ctest suite (38/38) passes.

Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
@SoundMatt
SoundMatt merged commit 48c47b8 into main Jul 28, 2026
10 checks passed
@SoundMatt
SoundMatt deleted the chore/audit-orphan-reqs-and-doc-drift branch July 28, 2026 02:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant