aspice-traceability-audit

name	aspice-traceability-audit
description	Full bidirectional traceability audit workflow for ASPICE 4.0 CL2 automotive embedded software. Use when auditing the complete SYS-REQ → SWE-REQ → SWC → UT/IT/QT traceability chain across documents, source code, and test files; identifying orphan requirements, uncovered test IDs, missing inline tags, and broken derivation links; or preparing a traceability compliance report for milestone reviews or release gates.
argument-hint	Provide file paths, folder, or paste content to audit (can include SRS, SAD, source files, and test files together)
user-invocable	true

ASPICE Traceability Audit Skill (Full Bidirectional Chain)

When to Use

• Pre-release traceability compliance check (required for SWE.6 release gate)
• Milestone review preparation (SWE.1, SWE.4, SWE.6 baseline checks)
• Auditing a new feature branch for traceability completeness before merge
• Investigating a traceability gap identified during review or testing
• Generating evidence of bidirectional traceability for ASPICE CL2 assessment

---

Workflow

Phase 1 — Scope and Input Collection

1. Identify all input artefacts provided:

   • Requirements documents (SRS, containing SWE-REQ-XXXX)
   • Architecture documents (SAD, containing SWC-XXXX, SWI-XXXX)
   • Source code files (.c, .cpp, .h, .hpp, containing @component, @req, and /* [SWE-REQ-XXXX] */ tags)
   • Test files (unit test, integration test, qualification test files)
   • Any traceability matrix documents

2. Build the complete artefact inventory:

   ARTEFACT INVENTORY
   ------------------
   SRS documents        : <list filenames>
   Architecture docs    : <list filenames>
   Source files         : <list filenames>
   Test files           : <list filenames>
   

3. Report any expected artefact types that are absent:

   • ⚠️ SCOPE GAP: No SRS provided — SWE-REQ derivation from SYS-REQ cannot be verified
   • ⚠️ SCOPE GAP: No test files provided — test coverage cannot be verified

Phase 2 — ID Extraction

Scan all provided content and extract every ID instance:

ID Type	Pattern	Where Found
SYS-REQ-XXXX	SYS-REQ-\d{4}	SRS (Derives From field)
SWE-REQ-XXXX	SWE-REQ-\d{4}	SRS, code, test headers
SWC-XXXX	SWC-\d{4}	SAD, file headers
SWI-XXXX	SWI-\d{4}	SAD, interface headers
UT-XXXX	UT-\d{4}	Test files, SRS Verified-By
IT-XXXX	IT-\d{4}	Integration test files
QT-XXXX	QT-\d{4}	Qualification test files

For each occurrence record: ID value, source file, context (function name, section, or attribute line).

Phase 3 — Build the Traceability Matrix

Construct the full chain for every SWE-REQ-XXXX found:

SYS-REQ-XXXX
  └─ SWE-REQ-XXXX
       ├─ Allocation: SWC-XXXX
       ├─ Inline tag: <source file>:<function>
       ├─ Unit test:  UT-XXXX
       ├─ Int. test:  IT-XXXX
       └─ Qual. test: QT-XXXX

For each SWE-REQ-XXXX, evaluate:

Link	Check	Result
Derivation	Has Derives From: SYS-REQ-YYYY or confirmed N/A	✅ / ❌ / ⚠️
SWC allocation	Appears in SAD allocation matrix or code @req header	✅ / ❌
Inline implementation tag	/* [SWE-REQ-XXXX] */ present in at least one source function	✅ / ❌
Unit test coverage	Linked to at least one UT-XXXX	✅ / ❌
System-level test	Linked to at least one IT-XXXX or QT-XXXX	✅ / ❌

Phase 4 — Reverse Trace (Bottom-Up)

For every UT-XXXX, IT-XXXX, and QT-XXXX found:

• Is the test ID referenced in the Verified By field of at least one SWE-REQ-XXXX?
• Does the test file contain a @req SWE-REQ-XXXX attribute?

Orphan tests (tests with no linked requirement) are MAJOR defects.

Phase 5 — Gap Classification

For each gap found, assign severity:

Gap Type	Severity	Definition
SWE-REQ with no test (UT/QT)	CRITICAL	Release blocker — requirement is untested
Test with no SWE-REQ	MAJOR	Orphan test — cannot assess coverage
SWE-REQ with no SWC allocation	MAJOR	Unimplemented requirement — architecture gap
SWE-REQ with no inline tag	MAJOR	Cannot confirm where requirement is implemented
SWE-REQ with no derivation	MAJOR	Origin unknown — traceability chain broken
SWC-XXXX in code, not in SAD	MINOR	Undocumented component
Missing file header IDs	MINOR	Source file lacks @component or @req tags

Phase 6 — ASIL-Specific Completeness Check

For all requirements tagged @ASIL: A or @ASIL: B:

• At least one UT-XXXX linked (unit test is mandatory for ASIL A/B)
• MC/DC coverage documented in the Unit Test Plan (ASIL A/B)
• At least one QT-XXXX linked (qualification test mandatory for ASIL A/B)
• Inline /* [SWE-REQ-XXXX] */ tag in source

Any ASIL A/B requirement failing these checks is a CRITICAL finding.

Phase 7 — Produce the Traceability Compliance Report

ASPICE Bidirectional Traceability Audit Report
==============================================
Audit Scope       : <list of artefacts audited>
Audit Date        : <today's date>
Auditor           : GitHub Copilot (automated audit)
ASPICE Process    : SWE.1 → SWE.6 Golden Thread

ID INVENTORY
------------
SYS-REQ IDs found  : <n>
SWE-REQ IDs found  : <n>
SWC IDs found      : <n>
UT IDs found       : <n>
IT IDs found       : <n>
QT IDs found       : <n>

TRACEABILITY MATRIX (condensed)
--------------------------------
| SWE-REQ       | Derives From | SWC Alloc | Inline Tag | UT  | IT  | QT  | Status |
|---------------|-------------|-----------|-----------|-----|-----|-----|--------|
| SWE-REQ-0001  | SYS-REQ-0010 | SWC-0002 | ✅        | ✅  | ✅  | ✅  | ✅ FULL |
| SWE-REQ-0042  | TBD          | ❌        | ❌        | ❌  | N/A | ❌  | ❌ GAPS |

FINDINGS
--------
[TRC-001] Severity: CRITICAL
  Gap Type   : SWE-REQ with no test
  ID         : SWE-REQ-XXXX
  Location   : <SRS file>
  Description: SWE-REQ-XXXX has no linked UT-XXXX, IT-XXXX, or QT-XXXX. This is a release blocker.
  Action     : Create a test case (UT-XXXX or QT-XXXX) that verifies this requirement and link it.

[TRC-002] Severity: MAJOR
  ...

SUMMARY
-------
Total SWE-REQs audited          : <n>
Fully traced (all links present) : <n> (<nn.n %>)
Requirements with CRITICAL gaps  : <n>
Requirements with MAJOR gaps     : <n>
Requirements with MINOR gaps     : <n>
Orphan tests (no req link)       : <n>
Total findings                   : <n>
Overall Verdict                  : COMPLIANT | NON-COMPLIANT

Compliance Status: <NON-COMPLIANT if any CRITICAL findings; COMPLIANT only if zero CRITICAL and MAJOR>

Phase 8 — Remediation Roadmap

For each CRITICAL and MAJOR finding, provide a specific remediation instruction:

• "Add UT-XXXX to Test_<Module>.c with @req SWE-REQ-XXXX header attribute."
• "Add /* [SWE-REQ-XXXX] */ inline tag to function <name> in <file> at the line implementing the core logic."
• "Add Verified By: UT-XXXX attribute to SWE-REQ-XXXX in the SRS."
• "Allocate SWE-REQ-XXXX to SWC-XXXX in the SAD allocation matrix."

---

Output Artefacts

• Traceability Compliance Report (CL2 work product — used as release evidence)
• Traceability matrix table (full chain per SWE-REQ)
• Prioritised findings list
• Remediation roadmap

References

• Workspace Instructions (Golden Thread)
• SWE.1 Instructions
• SWE.4 Instructions
• Check Traceability Prompt