Location: .fusa-reqs.json (138 entries); requirements/requirements.json (100 entries); README.md (names .fusa-reqs.json as the tracker)
Finding: The repository ships two separate requirement registries whose populations diverge by 38 entries. The README names .fusa-reqs.json as the authoritative tracker, but requirements/requirements.json carries a richer project metadata block (and has its own independently-stale declared spec version). Nothing in the repo states which file traceability tooling or the safety case should actually consume, so depending on which file a given tool reads, the reported requirement coverage and safety-case traceability could diverge significantly.
Recommendation: Pick one file as the single source of truth, and either delete the other or generate it mechanically from the authoritative one. Add a CI check that fails the build if the two files disagree.
Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.
Location:
.fusa-reqs.json(138 entries);requirements/requirements.json(100 entries);README.md(names.fusa-reqs.jsonas the tracker)Finding: The repository ships two separate requirement registries whose populations diverge by 38 entries. The README names
.fusa-reqs.jsonas the authoritative tracker, butrequirements/requirements.jsoncarries a richer project metadata block (and has its own independently-stale declared spec version). Nothing in the repo states which file traceability tooling or the safety case should actually consume, so depending on which file a given tool reads, the reported requirement coverage and safety-case traceability could diverge significantly.Recommendation: Pick one file as the single source of truth, and either delete the other or generate it mechanically from the authoritative one. Add a CI check that fails the build if the two files disagree.
Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.