textual-notation-of-model/packages/features/aebs/aebs_visualization_verification_evidence.sysml

Source

1/*2 * DE4SDV INC-AEBS-010 Phase 10 verification and evidence model slice.3 *4 * This slice is the Phase 10 V&V portion of the INC-AEBS-010 visualization5 * chain. It defines the verification cases, acceptance criteria, retained6 * evidence records, bounded assurance claim, deferred counterclaims, and7 * claim-boundary semantics for the System 2 read-only AEBS forward-situation8 * visualization test system.9 *10 * It consumes the retained evidence committed by the implementation campaign11 * (implementation/aebs-aaos-sdv-visualization-bench/evidence/010/). Every12 * evidence part below names the exact retained artifact; the dispositions13 * follow the evidence ladder vocabulary (observed_bounded /14 * deferred_not_proven / not_claimed) with scenario-safety outcome explicitly15 * deferred_not_proven. No safety, certification, homologation,16 * production-readiness, or vehicle-command claim is made or implied.17 *18 * Package name note: the visualization chain increment ID is INC-AEBS-010,19 * and this slice is its Phase 10 V&V evidence record20 * (DE4SDV_AEBSVisualizationVerificationEvidence). The package drops the21 * increment number per naming-conventions.md section 7: it is the enduring22 * canonical verification-evidence model of the visualization concern; the23 * increment identity stays owned by the framing slice (incAEBS010).24 */2526package DE4SDV_AEBSVisualizationVerificationEvidence {27  private import DE4SDV_MethodContext::*;28  private import DE4SDV_ProductLine::*;29  private import DE4SDV_Stakeholders::*;30  private import DE4SDV_ExecutionEnvironments::*;31  private import DE4SDV_AEBSVisualizationFraming::*;32  private import DE4SDV_AEBSVisualizationNeedsRequirements::*;33  private import DE4SDV_AEBSVisualizationPhysicalSoftwareRealization::*;34  private import DE4SDV_AEBSVisualizationVariabilityConfiguration::*;35  private import VerificationCases::*;36  private import VerificationMethodKind::*;37  private import ScalarValues::*;38  private import SAF_Viewpoints::*;39  private import Views::*;4041  /*42   * INC-AEBS-010 increment identity: owned by the canonical framing slice43   * (DE4SDV_AEBSVisualizationFraming::incAEBS010). This evidence slice is44   * bounded Phase 10 V&V content for that increment, not a second increment45   * identity; visualizationVerificationSystem below carries the slice's trace.46   */47  references incAEBS010;4849  /* ──────────────────────────────────────────50   * Evidence vocabulary and observation records51   * ────────────────────────────────────────── */5253  enum def VisualizationScenario {54    liveChainCorrelation;55    lifecycleArc;56    readOnlyBoundary;57    provenanceSeparation;58    failClosedStaleness;59    degradedStateRendering;60    restorationBehavior;61  }6263  enum def VisualizationEvidenceDisposition {64    planned;65    observedBounded;66    partial;67    blocked;68    notClaimed;69  }7071  item def VisualizationObservation {72    attribute callbackCount : ScalarValues::Integer;73    attribute sequenceSpan : ScalarValues::String;74    attribute observedRateHz : ScalarValues::Real;75    attribute gapCount : ScalarValues::Integer;76    attribute independentCapture : Boolean;77  }7879  item def RetainedVisualizationEvidence {80    attribute configurationIdentity : ScalarValues::String;81    attribute executionEnvironmentIdentity : ScalarValues::String;82    attribute contractIdentity : ScalarValues::String;83    attribute rawObservationArtifact : ScalarValues::String;84    attribute independentObserverIdentity : ScalarValues::String;85    attribute disposition : VisualizationEvidenceDisposition;86    attribute claimBoundary : ScalarValues::String;87  }8889  item def ReplayedVisualizationEvaluation {90    attribute scenario : VisualizationScenario;91    attribute outcome : VisualizationEvidenceDisposition;92    attribute acceptanceSummary : ScalarValues::String;93  }9495  /*96   * Verdict mapping: only observedBounded evidence produces pass. partial97   * maps to inconclusive — a partial observation cannot upgrade into an98   * acceptance claim without a separately justified bounded-pass99   * interpretation (none exists for the retained campaign).100   */101  calc def MapVisualizationOutcomeToVerdict {102    in outcome : VisualizationEvidenceDisposition;103    return verdict : VerdictKind =104      if outcome == VisualizationEvidenceDisposition::observedBounded? VerdictKind::pass105      else if outcome == VisualizationEvidenceDisposition::partial? VerdictKind::inconclusive106      else if outcome == VisualizationEvidenceDisposition::blocked? VerdictKind::inconclusive107      else if outcome == VisualizationEvidenceDisposition::notClaimed? VerdictKind::inconclusive108      else VerdictKind::inconclusive;109  }110111  /* ──────────────────────────────────────────112   * Verification bench (System 1 unchanged / System 2 instrument)113   * ────────────────────────────────────────── */114115  part def VisualizationVerificationBench {116    doc /*117     * System 1 is the configured member executing unchanged AEBS behavior:118     * the uninstrumented AAOS-integrated Autoware member governed by the119     * accepted product-line scope. System 2 is the visualization test system120     * and its campaign environment — the instrumented test article plus121     * observation instrumentation; it is not a product selection. The122     * instrument observes System 1 read-only and issues no vehicle command.123     */124    /* System 1 subject: uninstrumented configured member (scope member). */125    part system1MemberProduct : DE4SDV_MiddlewareVariabilityConfiguration::MiddlewareAutowareAAOSSDVConfiguredMember;126    /* System 2 subject: instrumented visualization test article. */127    part system2TestArticle : AEBSAutowareAAOSSDVVisualizationTestArticle;128    part system2Instrument : System2EngineeringAndAssuranceSystem;129    attribute scenario : VisualizationScenario;130  }131132  part liveChainCorrelationBench : VisualizationVerificationBench {133    attribute :>> scenario = VisualizationScenario::liveChainCorrelation;134  }135  part lifecycleArcBench : VisualizationVerificationBench {136    attribute :>> scenario = VisualizationScenario::lifecycleArc;137  }138  part readOnlyBoundaryBench : VisualizationVerificationBench {139    attribute :>> scenario = VisualizationScenario::readOnlyBoundary;140  }141  part provenanceSeparationBench : VisualizationVerificationBench {142    attribute :>> scenario = VisualizationScenario::provenanceSeparation;143  }144  part failClosedStalenessBench : VisualizationVerificationBench {145    attribute :>> scenario = VisualizationScenario::failClosedStaleness;146  }147  part degradedStateRenderingBench : VisualizationVerificationBench {148    attribute :>> scenario = VisualizationScenario::degradedStateRendering;149  }150  part restorationBehaviorBench : VisualizationVerificationBench {151    attribute :>> scenario = VisualizationScenario::restorationBehavior;152  }153154  /* ──────────────────────────────────────────155   * Acceptance criteria (System 2 evidence contracts)156   * ────────────────────────────────────────── */157158  requirement def VisualizationAcceptanceCriterion159    :> EvidenceContractTraceabilityRequirementCandidate;160161  requirement acceptanceCriterionChainCorrelation : VisualizationAcceptanceCriterion {162    doc /* AC-AEBS-S2-001; bounded verification of source-to-screen correlation. */163    subject bench : VisualizationVerificationBench;164    require constraint statement { language "English" /* The visualization test system shall retain source, transport, ingress, and guest identity, sequence, timestamp, log, and guest-native capture records for each rendered state so that each rendered state can be correlated with its observed source event, with consecutive accepted callbacks and zero sequence gaps over the retained take. */ }165  }166167  requirement acceptanceCriterionLifecycleArc : VisualizationAcceptanceCriterion {168    doc /* AC-AEBS-S2-002; bounded verification of the four-state arc in one take. */169    subject bench : VisualizationVerificationBench;170    require constraint statement { language "English" /* The visualization test system shall present the reducer-driven MONITORING, WARNING, INTERVENTION, and RELEASED dispositions from accepted frames of one uninterrupted real-time take, with the release disposition accompanied by a verified zero-speed stop observation and no edited or older-generation footage presented as part of the take. */ }171  }172173  requirement acceptanceCriterionReadOnlyBoundary : VisualizationAcceptanceCriterion {174    doc /* AC-AEBS-S2-003; read-only boundary verification. */175    subject bench : VisualizationVerificationBench;176    require constraint statement { language "English" /* The visualization test system shall publish nothing to the vehicle runtime and shall issue no vehicle command, and the public interface shall state the read-only engineering-visualization boundary in every rendered session. */ }177  }178179  requirement acceptanceCriterionProvenanceSeparation : VisualizationAcceptanceCriterion {180    doc /* AC-AEBS-S2-004; display-derived versus native decision semantics separation. */181    subject bench : VisualizationVerificationBench;182    require constraint statement { language "English" /* The visualization test system shall render obstacle geometry only from the display-derived filtered point cloud, shall not present coordinator-derived distance values or any display-derived scalar as a native Autoware decision metric, and shall state in the public interface that AEB decision distances are not visualized. */ }183  }184185  requirement acceptanceCriterionFailClosedStaleness : VisualizationAcceptanceCriterion {186    doc /* AC-AEBS-S2-005; fail-closed staleness verification. */187    subject bench : VisualizationVerificationBench;188    require constraint statement { language "English" /* When the filtered obstacle-cloud source stops updating, the visualization test system shall suppress the expired display-derived obstacle geometry while accepted live frames continue, and no interpolation, smoothing, or prediction shall substitute for missing fresh data. */ }189  }190191  requirement acceptanceCriterionDegradedRendering : VisualizationAcceptanceCriterion {192    doc /* AC-AEBS-S2-006; degraded-state rendering verification (fixture path). */193    subject bench : VisualizationVerificationBench;194    require constraint statement { language "English" /* Under deterministic closed-loop frame injection, the visualization test system shall render the stale, unavailable, and invalid degraded dispositions with live geometry cleared and the health chip identifying the degraded condition, with color never the sole state cue. */ }195  }196197  requirement acceptanceCriterionRestoration : VisualizationAcceptanceCriterion {198    doc /* AC-AEBS-S2-007; restoration behavior criterion (planned). */199    subject bench : VisualizationVerificationBench;200    require constraint statement { language "English" /* After a failure disposition, the visualization test system shall present a bounded restored indication after the selected consecutive-valid-frame criterion is met, without application restart. */ }201  }202203  requirement acceptanceCriterionEvidenceIntegrity : VisualizationAcceptanceCriterion {204    doc /* AC-AEBS-S2-008; evidence integrity and claim-boundary criterion. */205    subject bench : VisualizationVerificationBench;206    require constraint statement { language "English" /* Every retained verdict shall bind the configured test article, execution environment, wire contract, raw observation artifacts, and independent observer identities, and missing evidence shall be recorded as planned, partial, blocked, or not claimed, never as an observed runtime pass. */ }207  }208209  /* ──────────────────────────────────────────210   * Retained evidence records (exact artifacts in the implementation bench)211   * ────────────────────────────────────────── */212213  part liveChainEvidence : RetainedVisualizationEvidence {214    doc /*215     * EVID-AEBS-S2-001. Retained live-chain correlation evidence for the216     * corrected final campaign (2026-09-01): 1090 consecutive app-side217     * onGatewayFrame callbacks, sequence span 22891-23980, zero gaps, 10 Hz,218     * mirrored by ingress-side publishes over the chain pinned Autoware AEB219     * f603d8759c92fb2f423f1544844e13086d79ad09 -> ROS bridge frame assembler220     * -> TCP frame server :4721 -> adb reverse -> native ingress -> Gateway221     * Data Tunnel topic aebs-visualization-frame (schema v1.1) -> app222     * onGatewayFrame. Observer pass_observed_chain, exit 0, 1597223     * observations, 0 errors.224     */225    attribute :>> configurationIdentity = "AEBS-CONFIG-010-001";226    attribute :>> executionEnvironmentIdentity = "gcp-europe-west4-a de4sdv-aaos-build + de4sdv-ros2-autoware, sdv_ivi_cf guest, corrected final generation";227    attribute :>> contractIdentity = "interface/aebs_visualization.proto schema v1.1, topic aebs-visualization-frame";228    attribute :>> rawObservationArtifact = "implementation/aebs-aaos-sdv-visualization-bench/evidence/010/forward-ui/final-hmi-v21-corrected/app-ingress-frame.log";229    attribute :>> independentObserverIdentity = "scenario_observer (pass_observed_chain, 1597 observations, 0 errors)";230    attribute :>> disposition = VisualizationEvidenceDisposition::observedBounded;231    attribute :>> claimBoundary = "Live observation-chain evidence on the bench deployment; not safety, braking-authority, certification, or production evidence.";232  }233234  part lifecycleArcEvidence : RetainedVisualizationEvidence {235    doc /*236     * EVID-AEBS-S2-002. Retained continuous-take lifecycle evidence: one237     * uninterrupted 70.15 s screenrecord of the corrected final UI238     * generation covering MONITORING 0-10 s, WARNING ~10-11.5 s (24 obstacle239     * points, no braking), INTERVENTION ~11.5-14 s (braking latched), and240     * RELEASED ~14 s onward (ego speed 0.0 m/s, verified stop). Release241     * relation honestly recorded as release_while_native_diagnostic_retained;242     * scenario-safety outcome remains deferred_not_proven. The approved243     * publication cut composes a 3 s title card, the untouched 0-20 s of this244     * take, and a 3 s end card; the cards are editing frames, not app output.245     */246    attribute :>> configurationIdentity = "AEBS-CONFIG-010-001";247    attribute :>> executionEnvironmentIdentity = "gcp-europe-west4-a de4sdv-aaos-build + de4sdv-ros2-autoware, sdv_ivi_cf guest, corrected final generation";248    attribute :>> contractIdentity = "screenrecord display 0, 1080x600";249    attribute :>> rawObservationArtifact = "implementation/aebs-aaos-sdv-visualization-bench/evidence/010/forward-ui/final-hmi-v21-corrected/raw-continuous.mp4";250    attribute :>> independentObserverIdentity = "scenario_observer state boundary extraction (segment.yaml)";251    attribute :>> disposition = VisualizationEvidenceDisposition::observedBounded;252    attribute :>> claimBoundary = "One continuous take of the corrected generation; title/end cards are editing frames; not safety or certification evidence.";253  }254255  part readOnlyBoundaryEvidence : RetainedVisualizationEvidence {256    doc /*257     * EVID-AEBS-S2-003. Read-only boundary evidence: the wire contract carries258     * no command path, the bridge subscribes only (no publishers, no259     * services, no actions), the ingress publishes into the Gateway Data260     * Tunnel only, and the provenance ribbon is present in every retained261     * public frame. Enforced additionally by the presentation-contract guard262     * tests in the repository test suite.263     */264    attribute :>> configurationIdentity = "AEBS-CONFIG-010-001";265    attribute :>> executionEnvironmentIdentity = "repository test suite + retained campaign artifacts";266    attribute :>> contractIdentity = "implementation/aebs-aaos-sdv-visualization-bench/interface/aebs_visualization.proto";267    attribute :>> rawObservationArtifact = "implementation/aebs-aaos-sdv-visualization-bench/evidence/010/forward-ui/final-hmi-v21-corrected/state-monitoring.png";268    attribute :>> independentObserverIdentity = "tests/test_aebs_visualization_hmi_presentation_contract.py + bridge non-interference tests";269    attribute :>> disposition = VisualizationEvidenceDisposition::observedBounded;270    attribute :>> claimBoundary = "Structural and rendered-session read-only evidence; no vehicle-interaction behavior is exercised or claimed.";271  }272273  part provenanceSeparationEvidence : RetainedVisualizationEvidence {274    doc /*275     * EVID-AEBS-S2-004. Display-derived versus native decision semantics276     * separation evidence for the corrected generation: no277     * Target range / AEB braking threshold pair or RSS reference line is278     * rendered anywhere in the retained stills or UI dumps, obstacle geometry279     * is drawn only from the filtered cloud in base_link, and the280     * engineering-status panel states that AEB decision distances are not281     * visualized. Verified pre-recording against guest UI dumps and after by282     * visual review of the retained stills.283     */284    attribute :>> configurationIdentity = "AEBS-CONFIG-010-001";285    attribute :>> executionEnvironmentIdentity = "gcp-europe-west4-a de4sdv-aaos-build + de4sdv-ros2-autoware, sdv_ivi_cf guest, corrected final generation";286    attribute :>> contractIdentity = "implementation/aebs-aaos-sdv-visualization-bench/VISUALIZATION-CONTRACT.md section 3 removal list";287    attribute :>> rawObservationArtifact = "implementation/aebs-aaos-sdv-visualization-bench/evidence/010/forward-ui/final-hmi-v21-corrected/state-warning.png";288    attribute :>> independentObserverIdentity = "tests/test_aebs_visualization_hmi_presentation_contract.py";289    attribute :>> disposition = VisualizationEvidenceDisposition::observedBounded;290    attribute :>> claimBoundary = "Presentation-separation evidence for the corrected generation; not a claim about native Autoware AEB decision internals.";291  }292293  part failClosedStalenessEvidence : RetainedVisualizationEvidence {294    doc /*295     * EVID-AEBS-S2-005. Fail-closed staleness evidence: within the retained296     * take, when the filtered obstacle-cloud source stopped updating, the297     * display-derived obstacle geometry was suppressed (range/bearing/points298     * cleared) while accepted live frames continued; obstacle geometry also299     * expired after cloud silence per the receipt-based bound. No300     * interpolation or prediction substituted for missing fresh data.301     */302    attribute :>> configurationIdentity = "AEBS-CONFIG-010-001";303    attribute :>> executionEnvironmentIdentity = "gcp-europe-west4-a de4sdv-aaos-build + de4sdv-ros2-autoware, sdv_ivi_cf guest, corrected final generation";304    attribute :>> contractIdentity = "frame assembler receipt-based staleness bound (bridge source)";305    attribute :>> rawObservationArtifact = "implementation/aebs-aaos-sdv-visualization-bench/evidence/010/forward-ui/final-hmi-v21-corrected/segment.yaml";306    attribute :>> independentObserverIdentity = "app-ingress-frame.log field-level observation";307    attribute :>> disposition = VisualizationEvidenceDisposition::observedBounded;308    attribute :>> claimBoundary = "Bounded staleness observation within one take; not a certification-grade freshness argument.";309  }310311  part degradedRenderingEvidence : RetainedVisualizationEvidence {312    doc /*313     * EVID-AEBS-S2-006. Degraded-state rendering evidence from the state314     * campaign: stale, unavailable, and invalid dispositions rendered with315     * live geometry cleared and the health chip identifying the degraded316     * condition. The frame source was the PF-004 deterministic publisher,317     * NOT live Autoware 009B data; this evidence is fixture-path only and318     * must not be presented as live-chain evidence.319     */320    attribute :>> configurationIdentity = "AEBS-CONFIG-010-001";321    attribute :>> executionEnvironmentIdentity = "gcp-europe-west4-a de4sdv-aaos-build, sdv_ivi_cf guest, state-campaign generation";322    attribute :>> contractIdentity = "PF-004 deterministic publisher injection contract";323    attribute :>> rawObservationArtifact = "implementation/aebs-aaos-sdv-visualization-bench/evidence/010/state-campaign/stale.png";324    attribute :>> independentObserverIdentity = "per-state UI hierarchy dumps (state-campaign/*.xml)";325    attribute :>> disposition = VisualizationEvidenceDisposition::observedBounded;326    attribute :>> claimBoundary = "Fixture-path rendering evidence only; not live Autoware degradation evidence.";327  }328329  part restorationEvidencePlanned : PlannedExecutionEnvironmentEvidence {330    doc /*331     * EVID-AEBS-S2-007 (planned). Restoration behavior after a failure332     * disposition was not exercised in any retained INC-AEBS-010 campaign.333     * This record is explicitly planned evidence: it supports no observed334     * claim and is bound to the restoration gap below. Planned scope: the335     * restored indication after the selected consecutive-valid-frame336     * criterion, without application restart.337     */338  }339340  /* ──────────────────────────────────────────341   * Verification cases342   * ────────────────────────────────────────── */343344  verification def VisualizationChainCorrelationVerification {345    subject verifiedBench : VisualizationVerificationBench;346    objective chainCorrelationObjective {347      verify acceptanceCriterionChainCorrelation;348      verify acceptanceCriterionEvidenceIntegrity;349    }350    action collectData {351      @VerificationMethod{ kind = (test, inspect); }352      out item retainedEvidence : RetainedVisualizationEvidence;353    }354    action processData {355      @VerificationMethod{ kind = analyze; }356      in scenarioIdentity : VisualizationScenario = verifiedBench.scenario;357      in item retainedEvidence : RetainedVisualizationEvidence = collectData.retainedEvidence;358      out item replayedEvaluation : ReplayedVisualizationEvaluation;359    }360    action evaluateData {361      @VerificationMethod{ kind = analyze; }362      in item replayedEvaluation : ReplayedVisualizationEvaluation = processData.replayedEvaluation;363      out verdict : VerdictKind = MapVisualizationOutcomeToVerdict(replayedEvaluation.outcome);364    }365    return verdict : VerdictKind = evaluateData.verdict;366  }367368  verification def VisualizationLifecycleArcVerification {369    subject verifiedBench : VisualizationVerificationBench;370    objective lifecycleArcObjective {371      verify acceptanceCriterionLifecycleArc;372      verify acceptanceCriterionEvidenceIntegrity;373    }374    action collectData {375      @VerificationMethod{ kind = (test, inspect); }376      out item retainedEvidence : RetainedVisualizationEvidence;377    }378    action processData {379      @VerificationMethod{ kind = analyze; }380      in scenarioIdentity : VisualizationScenario = verifiedBench.scenario;381      in item retainedEvidence : RetainedVisualizationEvidence = collectData.retainedEvidence;382      out item replayedEvaluation : ReplayedVisualizationEvaluation;383    }384    action evaluateData {385      @VerificationMethod{ kind = analyze; }386      in item replayedEvaluation : ReplayedVisualizationEvaluation = processData.replayedEvaluation;387      out verdict : VerdictKind = MapVisualizationOutcomeToVerdict(replayedEvaluation.outcome);388    }389    return verdict : VerdictKind = evaluateData.verdict;390  }391392  verification def VisualizationReadOnlyBoundaryVerification {393    subject verifiedBench : VisualizationVerificationBench;394    objective readOnlyBoundaryObjective {395      verify acceptanceCriterionReadOnlyBoundary;396      verify acceptanceCriterionEvidenceIntegrity;397    }398    action collectData {399      @VerificationMethod{ kind = (inspect, test); }400      out item retainedEvidence : RetainedVisualizationEvidence;401    }402    action processData {403      @VerificationMethod{ kind = analyze; }404      in scenarioIdentity : VisualizationScenario = verifiedBench.scenario;405      in item retainedEvidence : RetainedVisualizationEvidence = collectData.retainedEvidence;406      out item replayedEvaluation : ReplayedVisualizationEvaluation;407    }408    action evaluateData {409      @VerificationMethod{ kind = analyze; }410      in item replayedEvaluation : ReplayedVisualizationEvaluation = processData.replayedEvaluation;411      out verdict : VerdictKind = MapVisualizationOutcomeToVerdict(replayedEvaluation.outcome);412    }413    return verdict : VerdictKind = evaluateData.verdict;414  }415416  verification def VisualizationProvenanceSeparationVerification {417    subject verifiedBench : VisualizationVerificationBench;418    objective provenanceSeparationObjective {419      verify acceptanceCriterionProvenanceSeparation;420      verify acceptanceCriterionEvidenceIntegrity;421    }422    action collectData {423      @VerificationMethod{ kind = (test, inspect); }424      out item retainedEvidence : RetainedVisualizationEvidence;425    }426    action processData {427      @VerificationMethod{ kind = analyze; }428      in scenarioIdentity : VisualizationScenario = verifiedBench.scenario;429      in item retainedEvidence : RetainedVisualizationEvidence = collectData.retainedEvidence;430      out item replayedEvaluation : ReplayedVisualizationEvaluation;431    }432    action evaluateData {433      @VerificationMethod{ kind = analyze; }434      in item replayedEvaluation : ReplayedVisualizationEvaluation = processData.replayedEvaluation;435      out verdict : VerdictKind = MapVisualizationOutcomeToVerdict(replayedEvaluation.outcome);436    }437    return verdict : VerdictKind = evaluateData.verdict;438  }439440  verification def VisualizationFailClosedStalenessVerification {441    subject verifiedBench : VisualizationVerificationBench;442    objective failClosedStalenessObjective {443      verify acceptanceCriterionFailClosedStaleness;444      verify acceptanceCriterionEvidenceIntegrity;445    }446    action collectData {447      @VerificationMethod{ kind = (test, inspect); }448      out item retainedEvidence : RetainedVisualizationEvidence;449    }450    action processData {451      @VerificationMethod{ kind = analyze; }452      in scenarioIdentity : VisualizationScenario = verifiedBench.scenario;453      in item retainedEvidence : RetainedVisualizationEvidence = collectData.retainedEvidence;454      out item replayedEvaluation : ReplayedVisualizationEvaluation;455    }456    action evaluateData {457      @VerificationMethod{ kind = analyze; }458      in item replayedEvaluation : ReplayedVisualizationEvaluation = processData.replayedEvaluation;459      out verdict : VerdictKind = MapVisualizationOutcomeToVerdict(replayedEvaluation.outcome);460    }461    return verdict : VerdictKind = evaluateData.verdict;462  }463464  verification def VisualizationDegradedRenderingVerification {465    doc /*466     * Fixture-path verification case. Its subject scenario uses the PF-004467     * deterministic publisher; any verdict from it is bounded to that path468     * and does not transfer to the live Autoware chain.469     */470    subject verifiedBench : VisualizationVerificationBench;471    objective degradedRenderingObjective {472      verify acceptanceCriterionDegradedRendering;473      verify acceptanceCriterionEvidenceIntegrity;474    }475    action collectData {476      @VerificationMethod{ kind = (test, inspect); }477      out item retainedEvidence : RetainedVisualizationEvidence;478    }479    action processData {480      @VerificationMethod{ kind = analyze; }481      in scenarioIdentity : VisualizationScenario = verifiedBench.scenario;482      in item retainedEvidence : RetainedVisualizationEvidence = collectData.retainedEvidence;483      out item replayedEvaluation : ReplayedVisualizationEvaluation;484    }485    action evaluateData {486      @VerificationMethod{ kind = analyze; }487      in item replayedEvaluation : ReplayedVisualizationEvaluation = processData.replayedEvaluation;488      out verdict : VerdictKind = MapVisualizationOutcomeToVerdict(replayedEvaluation.outcome);489    }490    return verdict : VerdictKind = evaluateData.verdict;491  }492493  verification def VisualizationRestorationVerification {494    doc /*495     * Planned verification case. No retained campaign exercised restoration;496     * the case exists to bind the criterion and the gap, and its verdict497     * remains inconclusive until evidence is retained by a later campaign.498     */499    subject verifiedBench : VisualizationVerificationBench;500    objective restorationObjective {501      verify acceptanceCriterionRestoration;502      verify acceptanceCriterionEvidenceIntegrity;503    }504    action collectData {505      @VerificationMethod{ kind = test; }506      out item retainedEvidence : RetainedVisualizationEvidence;507    }508    action processData {509      @VerificationMethod{ kind = analyze; }510      in scenarioIdentity : VisualizationScenario = verifiedBench.scenario;511      in item retainedEvidence : RetainedVisualizationEvidence = collectData.retainedEvidence;512      out item replayedEvaluation : ReplayedVisualizationEvaluation;513    }514    action evaluateData {515      @VerificationMethod{ kind = analyze; }516      in item replayedEvaluation : ReplayedVisualizationEvaluation = processData.replayedEvaluation;517      out verdict : VerdictKind = MapVisualizationOutcomeToVerdict(replayedEvaluation.outcome);518    }519    return verdict : VerdictKind = evaluateData.verdict;520  }521522  doc /* VC-AEBS-S2-001 verification case usage. */523  verification chainCorrelationVerification : VisualizationChainCorrelationVerification {524    @VerificationMethod{ kind = (test, inspect, analyze); }525    subject verifiedBench :> liveChainCorrelationBench;526  }527528  doc /* VC-AEBS-S2-002 verification case usage. */529  verification lifecycleArcVerification : VisualizationLifecycleArcVerification {530    @VerificationMethod{ kind = (test, inspect, analyze); }531    subject verifiedBench :> lifecycleArcBench;532  }533534  doc /* VC-AEBS-S2-003 verification case usage. */535  verification readOnlyBoundaryVerification : VisualizationReadOnlyBoundaryVerification {536    @VerificationMethod{ kind = (test, inspect, analyze); }537    subject verifiedBench :> readOnlyBoundaryBench;538  }539540  doc /* VC-AEBS-S2-004 verification case usage. */541  verification provenanceSeparationVerification : VisualizationProvenanceSeparationVerification {542    @VerificationMethod{ kind = (test, inspect, analyze); }543    subject verifiedBench :> provenanceSeparationBench;544  }545546  doc /* VC-AEBS-S2-005 verification case usage. */547  verification failClosedStalenessVerification : VisualizationFailClosedStalenessVerification {548    @VerificationMethod{ kind = (test, inspect, analyze); }549    subject verifiedBench :> failClosedStalenessBench;550  }551552  doc /* VC-AEBS-S2-006 verification case usage. */553  verification degradedRenderingVerification : VisualizationDegradedRenderingVerification {554    @VerificationMethod{ kind = (test, inspect, analyze); }555    subject verifiedBench :> degradedStateRenderingBench;556  }557558  doc /* VC-AEBS-S2-007 verification case usage. */559  verification restorationVerification : VisualizationRestorationVerification {560    @VerificationMethod{ kind = (test, analyze); }561    subject verifiedBench :> restorationBehaviorBench;562  }563564  part visualizationVerificationSystem {565    perform chainCorrelationVerification;566    perform lifecycleArcVerification;567    perform readOnlyBoundaryVerification;568    perform provenanceSeparationVerification;569    perform failClosedStalenessVerification;570    perform degradedRenderingVerification;571    perform restorationVerification;572  }573574  /* ──────────────────────────────────────────575   * Requirement derivation dependencies (System 2 candidates only)576   * ────────────────────────────────────────── */577578  dependency chainCorrelationToEvidenceRequirement579    from acceptanceCriterionChainCorrelation580    to reqEvidenceCorrelation;581  dependency chainCorrelationToRealAAOSRenderingRequirement582    from acceptanceCriterionLifecycleArc583    to reqRealAAOSRendering;584  dependency readOnlyBoundaryToNonInterferenceRequirement585    from acceptanceCriterionReadOnlyBoundary586    to reqNonInterference;587  dependency provenanceSeparationToNoImpersonationRequirement588    from acceptanceCriterionProvenanceSeparation589    to reqNoNativeImpersonation;590  dependency failClosedStalenessToFreshnessRequirement591    from acceptanceCriterionFailClosedStaleness592    to reqFailClosedFreshness;593  dependency degradedRenderingToAvailabilityRequirement594    from acceptanceCriterionDegradedRendering595    to reqAvailabilityDisposition;596  dependency restorationToRestorationRequirement597    from acceptanceCriterionRestoration598    to reqRestorationBehavior;599600  /* Cross-increment traceability to the accepted chain baseline. */601  dependency verificationTestArticleTrace602    from visualizationVerificationSystem603    to testArticle;604  dependency verificationPhysicalSystemTrace605    from visualizationVerificationSystem606    to physicalSystem;607  dependency chainEvidenceToPhysicalSystemTrace608    from liveChainEvidence609    to physicalSystem;610  dependency lifecycleEvidenceToPhysicalSystemTrace611    from lifecycleArcEvidence612    to physicalSystem::iviGuest::displayApp;613  dependency provenanceEvidenceToSourceProvenanceTrace614    from provenanceSeparationEvidence615    to coordinatorStateProvenance;616617  /* ──────────────────────────────────────────618   * Claim-argument-evidence layer (INC-AEBS-010 Phase 10)619   * ────────────────────────────────────────── */620621  requirement def VisualizationClaim622    :> EvidenceContractTraceabilityRequirementCandidate;623624  requirement def VisualizationArgument625    :> EvidenceContractTraceabilityRequirementCandidate;626627  requirement def VisualizationCounterClaim628    :> EvidenceContractTraceabilityRequirementCandidate;629630  requirement visualizationInstrumentationClaim : VisualizationClaim {631    doc /*632     * CLM-AEBS-S2-001: for AEBS-CONFIG-010-001 on the retained campaign633     * environment, the read-only visualization instrumentation observed the634     * live pinned-Autoware chain into the AAOS guest, rendered the complete635     * reducer-driven four-state arc in one uninterrupted take, preserved the636     * display-derived versus native decision-semantics separation in every637     * public frame, suppressed expired display-derived geometry fail-closed,638     * and rendered degraded dispositions under deterministic fixture639     * injection. The scenario-safety outcome remains deferred_not_proven:640     * this claim is about the instrumentation, never about AEBS safety.641     */642    subject claimSubject : VisualizationVerificationBench;643    require constraint {644      doc /*645       * The claim requires retained EVID-AEBS-S2-001 through EVID-AEBS-S2-006646       * evidence bound to the configured test article, exact wire contract,647       * execution environment, and independent observer identities. It648       * excludes restoration behavior, live degradation beyond the retained649       * take, inter-VM transport without the bounded bench route, signed-650       * policy enforcement, post-release re-approach, safety, certification,651       * homologation, and production-readiness claims.652       */653    }654  }655656  requirement chainCorrelationArgument : VisualizationArgument {657    doc /* AGT-AEBS-S2-01: argues AC-AEBS-S2-001 (source-to-screen correlation with zero gaps) within the claim boundary. */658    subject bench : VisualizationVerificationBench;659  }660661  requirement lifecycleArcArgument : VisualizationArgument {662    doc /* AGT-AEBS-S2-02: argues AC-AEBS-S2-002 (one-take four-state arc with verified stop) within the claim boundary. */663    subject bench : VisualizationVerificationBench;664  }665666  requirement readOnlyBoundaryArgument : VisualizationArgument {667    doc /* AGT-AEBS-S2-03: argues AC-AEBS-S2-003 (read-only, no vehicle command) within the claim boundary. */668    subject bench : VisualizationVerificationBench;669  }670671  requirement provenanceSeparationArgument : VisualizationArgument {672    doc /* AGT-AEBS-S2-04: argues AC-AEBS-S2-004 (display-derived versus native separation) within the claim boundary. */673    subject bench : VisualizationVerificationBench;674  }675676  requirement failClosedStalenessArgument : VisualizationArgument {677    doc /* AGT-AEBS-S2-05: argues AC-AEBS-S2-005 (fail-closed suppression of expired geometry) within the claim boundary. */678    subject bench : VisualizationVerificationBench;679  }680681  requirement degradedRenderingArgument : VisualizationArgument {682    doc /* AGT-AEBS-S2-06: argues AC-AEBS-S2-006 bounded to the fixture path; live-chain degradation is not argued by this branch. */683    subject bench : VisualizationVerificationBench;684  }685686  requirement counterClaimRestoration : VisualizationCounterClaim {687    doc /* CCM-AEBS-S2-01: bounds the claim for restoration behavior (AC-AEBS-S2-007); no retained campaign exercised it. */688    subject bench : VisualizationVerificationBench;689  }690691  requirement counterClaimLiveDegradation : VisualizationCounterClaim {692    doc /* CCM-AEBS-S2-02: bounds the claim for live degraded dispositions (stale/unavailable/invalid) from real Autoware source conditions; retained degraded-state evidence is fixture-path only. */693    subject bench : VisualizationVerificationBench;694  }695696  requirement counterClaimProductionBoundaries : VisualizationCounterClaim {697    doc /* CCM-AEBS-S2-03: bounds the claim against inter-VM transport without the bounded adb-reverse bench route, signed-policy enforcement, production HMI, and any safety or certification reading. */698    subject bench : VisualizationVerificationBench;699  }700701  dependency claimSupportedByChainArgument702    from chainCorrelationArgument to visualizationInstrumentationClaim;703  dependency claimSupportedByLifecycleArgument704    from lifecycleArcArgument to visualizationInstrumentationClaim;705  dependency claimSupportedByReadOnlyArgument706    from readOnlyBoundaryArgument to visualizationInstrumentationClaim;707  dependency claimSupportedByProvenanceArgument708    from provenanceSeparationArgument to visualizationInstrumentationClaim;709  dependency claimSupportedByStalenessArgument710    from failClosedStalenessArgument to visualizationInstrumentationClaim;711  dependency claimSupportedByDegradedArgument712    from degradedRenderingArgument to visualizationInstrumentationClaim;713714  dependency chainVerificationReinforcesArgument715    from chainCorrelationVerification to chainCorrelationArgument;716  dependency lifecycleVerificationReinforcesArgument717    from lifecycleArcVerification to lifecycleArcArgument;718  dependency readOnlyVerificationReinforcesArgument719    from readOnlyBoundaryVerification to readOnlyBoundaryArgument;720  dependency provenanceVerificationReinforcesArgument721    from provenanceSeparationVerification to provenanceSeparationArgument;722  dependency stalenessVerificationReinforcesArgument723    from failClosedStalenessVerification to failClosedStalenessArgument;724  dependency degradedVerificationReinforcesArgument725    from degradedRenderingVerification to degradedRenderingArgument;726727  dependency chainEvidenceReinforcesChainArgument728    from liveChainEvidence to chainCorrelationArgument;729  dependency lifecycleEvidenceReinforcesLifecycleArgument730    from lifecycleArcEvidence to lifecycleArcArgument;731  dependency readOnlyEvidenceReinforcesReadOnlyArgument732    from readOnlyBoundaryEvidence to readOnlyBoundaryArgument;733  dependency provenanceEvidenceReinforcesProvenanceArgument734    from provenanceSeparationEvidence to provenanceSeparationArgument;735  dependency stalenessEvidenceReinforcesStalenessArgument736    from failClosedStalenessEvidence to failClosedStalenessArgument;737  dependency degradedEvidenceReinforcesDegradedArgument738    from degradedRenderingEvidence to degradedRenderingArgument;739740  dependency chainEvidenceTraceToClaim741    from liveChainEvidence to visualizationInstrumentationClaim;742  dependency lifecycleEvidenceTraceToClaim743    from lifecycleArcEvidence to visualizationInstrumentationClaim;744  dependency readOnlyEvidenceTraceToClaim745    from readOnlyBoundaryEvidence to visualizationInstrumentationClaim;746  dependency provenanceEvidenceTraceToClaim747    from provenanceSeparationEvidence to visualizationInstrumentationClaim;748  dependency stalenessEvidenceTraceToClaim749    from failClosedStalenessEvidence to visualizationInstrumentationClaim;750  dependency degradedEvidenceTraceToClaim751    from degradedRenderingEvidence to visualizationInstrumentationClaim;752753  dependency counterClaimRestorationCountersClaim754    from counterClaimRestoration to visualizationInstrumentationClaim;755  dependency counterClaimLiveDegradationCountersClaim756    from counterClaimLiveDegradation to visualizationInstrumentationClaim;757  dependency counterClaimProductionCountersClaim758    from counterClaimProductionBoundaries to visualizationInstrumentationClaim;759760  /* ──────────────────────────────────────────761   * Gaps (deferred scope owned by this slice's successors)762   * ────────────────────────────────────────── */763764  part gap010RestorationUnexercised : IncrementGap {765    doc /*766     * GAP-AEBS-010-006: Restoration after a failure disposition767     * (AC-AEBS-S2-007) was not exercised in any retained INC-AEBS-010768     * campaign; the deterministic PF-004 publisher can exercise it without769     * live bench time. Owner: successor increment in this chain.770     */771  }772  part gap010LiveDegradationUnproven : IncrementGap {773    doc /*774     * GAP-AEBS-010-007: Degraded dispositions from real Autoware source775     * conditions (stale/unavailable/invalid on the live chain) are not776     * observed in retained evidence; the retained degraded-state campaign is777     * fixture-path only. Owner: successor increment in this chain.778     */779  }780  part gap010InterVmRouteDeferred : DeferredProductLineScope {781    doc /*782     * GAP-AEBS-010-008: The retained route is the bounded bench transport783     * (TCP :4721 + adb reverse). An inter-VM route without the adb-reverse784     * shortcut and a signed-policy enforcement path (SELinux stays permissive785     * on the bench guest) remain deferred; production must enforce policy.786     * Owner: successor increment in this chain.787     */788  }789790  dependency counterClaimRestorationGapTrace791    from counterClaimRestoration to gap010RestorationUnexercised;792  dependency counterClaimLiveDegradationGapTrace793    from counterClaimLiveDegradation to gap010LiveDegradationUnproven;794  dependency counterClaimProductionGapTrace795    from counterClaimProductionBoundaries to gap010InterVmRouteDeferred;796  dependency plannedRestorationEvidenceGapTrace797    from restorationEvidencePlanned to gap010RestorationUnexercised;798799  /* Safety non-claim anchor: the scenario-safety outcome stays deferred. */800  part scenarioSafetyDeferred : DeferredProductLineScope {801    doc /*802     * The visualization observes AEBS behavior; it contributes no braking803     * authority, hazard control, or safety argument. The scenario-safety804     * outcome remains deferred_not_proven by design of this instrumentation.805     */806  }807  dependency readOnlyArgumentSafetyNonClaimTrace808    from readOnlyBoundaryArgument to scenarioSafetyDeferred;809810  /* ──────────────────────────────────────────811   * Concern and views (ArgumentationAssurance for evidence claims)812   * ────────────────────────────────────────── */813814  concern visualizationArgumentationAssuranceConcern : ArgumentationAssuranceConcern {815    doc /* Evidence-based assurance claim, counterclaims, retained evidence, and gaps for the visualization instrumentation. */816    subject;817    stakeholder systemsEngineer : SystemsEngineer;818    stakeholder verificationEngineer : VerificationEngineer;819    stakeholder reviewer : OpenSourceReviewer;820  }821822  view aebsVisualizationVerificationAssuranceView {823    viewpoint selectedAssuranceViewpoint : ArgumentationAssuranceViewpoint {824      frame visualizationArgumentationAssuranceConcern;825    }826    doc /*827     * Positive Phase 10 slice: the bounded instrumentation claim, its828     * supporting arguments, and the retained evidence branches.829     */830    expose visualizationInstrumentationClaim;831    expose chainCorrelationArgument;832    expose lifecycleArcArgument;833    expose readOnlyBoundaryArgument;834    expose provenanceSeparationArgument;835    expose failClosedStalenessArgument;836    expose degradedRenderingArgument;837    expose liveChainEvidence;838    expose lifecycleArcEvidence;839    expose readOnlyBoundaryEvidence;840    expose provenanceSeparationEvidence;841    expose failClosedStalenessEvidence;842    expose degradedRenderingEvidence;843    expose claimSupportedByChainArgument;844    expose claimSupportedByLifecycleArgument;845    expose claimSupportedByReadOnlyArgument;846    expose claimSupportedByProvenanceArgument;847    expose claimSupportedByStalenessArgument;848    expose claimSupportedByDegradedArgument;849    attribute maxCompartmentEntries = 0;850    attribute showAnnotationRows = false;851    render asTreeDiagram;852  }853854  view aebsVisualizationOpenCounterclaimAssuranceView {855    viewpoint selectedOpenCounterclaimViewpoint : ArgumentationAssuranceViewpoint {856      frame visualizationArgumentationAssuranceConcern;857    }858    doc /*859     * Challenge slice: unresolved counterclaims and gaps that prevent860     * broader restoration, live-degradation, inter-VM, and safety assurance.861     */862    expose visualizationInstrumentationClaim;863    expose counterClaimRestoration;864    expose counterClaimLiveDegradation;865    expose counterClaimProductionBoundaries;866    expose gap010RestorationUnexercised;867    expose gap010LiveDegradationUnproven;868    expose gap010InterVmRouteDeferred;869    expose counterClaimRestorationGapTrace;870    expose counterClaimLiveDegradationGapTrace;871    expose counterClaimProductionGapTrace;872    expose restorationEvidencePlanned;873    expose scenarioSafetyDeferred;874    attribute maxCompartmentEntries = 0;875    attribute showAnnotationRows = false;876    render asTreeDiagram;877  }878}879