Location: .fusa-reqs.json, requirements REQ-LIN-001 through REQ-LIN-003 (rationale fields citing 'SG-05')
Finding: REQ-LIN-001 ('reject frame ID above the maximum valid identifier') and REQ-LIN-002/003 (data-length bounds) all cite SG-05 in their rationale text. Per HARA.md, SG-05 is 'Detect E2E protection errors' — an unrelated safety goal. The ID-range requirement plainly corresponds to SG-02 ('Reject frames with ID > 0x3F'), and the data-length requirements should trace to whichever safety goal actually covers frame-length/data-corruption bounds. This is a wrong cross-reference in the HARA-to-requirement trace for three ASIL-B-classified requirements, which undermines the safety case's traceability.
Recommendation: Correct the rationale's safety-goal references for these three requirements (SG-02 for the ID-range requirement; the correct SG for the data-length ones), and add a CI check that verifies every requirement's cited safety goal actually exists and matches HARA's own goal descriptions.
Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.
Location:
.fusa-reqs.json, requirements REQ-LIN-001 through REQ-LIN-003 (rationale fields citing 'SG-05')Finding: REQ-LIN-001 ('reject frame ID above the maximum valid identifier') and REQ-LIN-002/003 (data-length bounds) all cite SG-05 in their rationale text. Per
HARA.md, SG-05 is 'Detect E2E protection errors' — an unrelated safety goal. The ID-range requirement plainly corresponds to SG-02 ('Reject frames with ID > 0x3F'), and the data-length requirements should trace to whichever safety goal actually covers frame-length/data-corruption bounds. This is a wrong cross-reference in the HARA-to-requirement trace for three ASIL-B-classified requirements, which undermines the safety case's traceability.Recommendation: Correct the rationale's safety-goal references for these three requirements (SG-02 for the ID-range requirement; the correct SG for the data-length ones), and add a CI check that verifies every requirement's cited safety goal actually exists and matches HARA's own goal descriptions.
Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.