Doc-as-Code Tool Verification Report

This page is the authoritative Tool Verification Report for the S-CORE Docs-as-Code tool. It records the classification of intended usage, potential malfunctions, safety impact and detection, together with qualification evidence and lifecycle state.

Introduction

Scope and purpose

The S-CORE Docs-as-Code tool (Bazel module score_docs_as_code) builds HTML documentation from RST/Markdown sources, including process descriptions, requirements, and traceability data. It validates the sources with the S-CORE extensions and metamodel.

Inputs and outputs

• Inputs: RST/Markdown sources, Sphinx configuration, the S-CORE metamodel, Bazel build files, source-code links, and test results.

• Outputs: HTML documentation, traceability data (needs.json), and coverage and linkage statistics (metrics.json).

        flowchart LR
   sources["RST/Markdown sources"] --> tool["S-CORE Docs-as-Code"]
   config["Configuration and metamodel"] --> tool
   links["Source-code links"] --> tool
   tests["Test results"] --> tool
   tool --> html["HTML documentation"]
   tool --> needs["needs.json"]
   tool --> metrics["metrics.json"]
    

Available information

• Repository: eclipse-score/docs-as-code

• Documentation: https://eclipse-score.github.io/docs-as-code/v8.1.2/

• Bazel module: score_docs_as_code

Installation and integration

The tool is consumed as a Bazel module and integrated through the repository’s documentation build targets. The evaluated configuration is the one defined by the repository’s MODULE.bazel, BUILD files, Sphinx configuration, and S-CORE metamodel. The relevant checks are run through //:docs_check and the associated documentation and traceability targets.

Environment

The evaluation runs in the repository’s supported Bazel environment on Linux, using the configured Sphinx, Python, and diagram-generation toolchains.

Report record

Doc-as-Code		status: evaluated
safety_affected: YES security_affected: YES tcl: LOW tool_version: v8.1.2 version: 3 realizes: wp__tool_verification_report has: tool_usecase__docs_as_code__architecture, tool_usecase__docs_as_code__assumptions, tool_usecase__docs_as_code__backlinks, tool_usecase__docs_as_code__coverage, tool_usecase__docs_as_code__generation, tool_usecase__docs_as_code__metamodel, tool_usecase__docs_as_code__safety_links, tool_usecase__docs_as_code__test_linkage, tool_usecase__docs_as_code__test_refs
Evaluates the S-CORE Docs-as-Code tool for building and checking documentation and traceability data from RST/Markdown sources.
doc_tool__score_docs_as_code		Tool Verification Report

Purpose and intended use

Generated from linked report records.

The tool is evaluated for the following intended use cases. The use case title is the concise statement of the project context in which the tool is used; the detailed evaluation is shown in the sections below.

• Enforce document types and attributes (tool_usecase__docs_as_code__metamodel): Enforce document types and mandatory attributes such as id, status, security, safety, and realizes. See, for example, gd_req__doc_attr_status, gd_req__req_attr_uid, gd_req__req_attr_safety, gd_req__arch_attr_safety, and gd_req__req_check_mandatory.

• Enforce safety-critical links (tool_usecase__docs_as_code__safety_links): Enforce that links between safety-relevant needs preserve the required safety relationships. See gd_req__req_linkage_safety.

• Calculate requirement coverage (tool_usecase__docs_as_code__coverage): Count, per requirement type, the requirements carrying a testlink and compute link-coverage percentages. See gd_req__verification_reporting.

• Generate architecture diagrams (tool_usecase__docs_as_code__architecture): Generate architecture diagrams. See gd_req__arch_viewpoints.

• Resolve testcase verification links (tool_usecase__docs_as_code__test_linkage): For each testcase need, resolve its partially_verifies/fully_verifies references against the needs set. See gd_req__req_attr_testlink and gd_req__verification_reporting.

• Validate testcase references (tool_usecase__docs_as_code__test_refs): Check that test references are present and point to the intended requirements. See gd_req__req_attr_testlink.

• List assumptions of use (tool_usecase__docs_as_code__assumptions): Use needtable to communicate safety-critical assumptions of use in safety manuals. See gd_guidl__saf_man and wp__platform_safety_manual.

• Generate traceability backlinks (tool_usecase__docs_as_code__backlinks): Generate correct backlinks for links between Needs items to provide bi-directional traceability. See doc_concept__general_traceability.

• Generate HTML documentation (tool_usecase__docs_as_code__generation): Generate complete and correct HTML apart from the aspects covered by the other use cases. See gd_req__doc_attributes_manual and gd_req__doc_attr_status.

Conclusion

Generated from linked report records.

The generated conclusion is summarized from the owned potential_tool_malfunction records:

• Safety: 8/9 potential tool malfunctions affect safety → safety_affected: YES.

• Detection: 7/8 safety- relevant malfunctions have insufficient detection → tcl: LOW.

• Qualification: → qualification of 50 tool requirements is required.

• Testcase coverage: 0/7 qualification-relevant malfunctions are fully covered by passed, fully-verifying testcases.

Tool verification graph

Generated from linked report records.

The box labels show the Need type. Colors distinguish the report, tool requirements, use cases, and potential malfunctions.

        ---
config:
  layout: elk
  securityLevel: loose
---
flowchart LR
classDef report fill:#D5E8D4,stroke:#82B366,color:#000
classDef requirement fill:#DAE8FC,stroke:#6C8EBF,color:#000
classDef usecase fill:#E1D5E7,stroke:#9673A6,color:#000
classDef malfunction fill:#F8CECC,stroke:#B85450,color:#000

report["Tool Verification Report (doc_tool)"]
requirements["Tool requirements (tool_req)"]
class report report
class requirements requirement
click report href "#doc_tool__score_docs_as_code"
click requirements href "#tool-qualification-matrix"


usecase_1["Enforce document types and attributes (tool_usecase)"]
class usecase_1 usecase
report --> usecase_1
click usecase_1 href "#tool_usecase__docs_as_code__metamodel"


usecase_1_malfunction_1["Invalid document passes metamodel checks (potential_tool_malfunction)"]
class usecase_1_malfunction_1 malfunction
usecase_1 --> usecase_1_malfunction_1
click usecase_1_malfunction_1 href "#potential_tool_malfunction__docs_as_code__m1"

usecase_1_malfunction_1 -->|violates| requirements




usecase_2["Enforce safety-critical links (tool_usecase)"]
class usecase_2 usecase
report --> usecase_2
click usecase_2 href "#tool_usecase__docs_as_code__safety_links"


usecase_2_malfunction_1["Unsafe link passes validation (potential_tool_malfunction)"]
class usecase_2_malfunction_1 malfunction
usecase_2 --> usecase_2_malfunction_1
click usecase_2_malfunction_1 href "#potential_tool_malfunction__docs_as_code__m2"

usecase_2_malfunction_1 -->|violates| requirements




usecase_3["Calculate requirement coverage (tool_usecase)"]
class usecase_3 usecase
report --> usecase_3
click usecase_3 href "#tool_usecase__docs_as_code__coverage"


usecase_3_malfunction_1["Requirement coverage is wrong (potential_tool_malfunction)"]
class usecase_3_malfunction_1 malfunction
usecase_3 --> usecase_3_malfunction_1
click usecase_3_malfunction_1 href "#potential_tool_malfunction__docs_as_code__m3"

usecase_3_malfunction_1 -->|violates| requirements




usecase_4["Generate architecture diagrams (tool_usecase)"]
class usecase_4 usecase
report --> usecase_4
click usecase_4 href "#tool_usecase__docs_as_code__architecture"


usecase_4_malfunction_1["Architecture diagram is wrong (potential_tool_malfunction)"]
class usecase_4_malfunction_1 malfunction
usecase_4 --> usecase_4_malfunction_1
click usecase_4_malfunction_1 href "#potential_tool_malfunction__docs_as_code__m4"




usecase_5["Resolve testcase verification links (tool_usecase)"]
class usecase_5 usecase
report --> usecase_5
click usecase_5 href "#tool_usecase__docs_as_code__test_linkage"


usecase_5_malfunction_1["Requirement appears tested when it is not (potential_tool_malfunction)"]
class usecase_5_malfunction_1 malfunction
usecase_5 --> usecase_5_malfunction_1
click usecase_5_malfunction_1 href "#potential_tool_malfunction__docs_as_code__m5"

usecase_5_malfunction_1 -->|violates| requirements




usecase_6["Validate testcase references (tool_usecase)"]
class usecase_6 usecase
report --> usecase_6
click usecase_6 href "#tool_usecase__docs_as_code__test_refs"


usecase_6_malfunction_1["Test reference is missing or outdated (potential_tool_malfunction)"]
class usecase_6_malfunction_1 malfunction
usecase_6 --> usecase_6_malfunction_1
click usecase_6_malfunction_1 href "#potential_tool_malfunction__docs_as_code__m6"

usecase_6_malfunction_1 -->|violates| requirements




usecase_7["List assumptions of use (tool_usecase)"]
class usecase_7 usecase
report --> usecase_7
click usecase_7 href "#tool_usecase__docs_as_code__assumptions"


usecase_7_malfunction_1["Assumption of use is missing or wrong (potential_tool_malfunction)"]
class usecase_7_malfunction_1 malfunction
usecase_7 --> usecase_7_malfunction_1
click usecase_7_malfunction_1 href "#potential_tool_malfunction__docs_as_code__m7"

usecase_7_malfunction_1 -->|violates| requirements




usecase_8["Generate traceability backlinks (tool_usecase)"]
class usecase_8 usecase
report --> usecase_8
click usecase_8 href "#tool_usecase__docs_as_code__backlinks"


usecase_8_malfunction_1["Backlink is wrong or missing (potential_tool_malfunction)"]
class usecase_8_malfunction_1 malfunction
usecase_8 --> usecase_8_malfunction_1
click usecase_8_malfunction_1 href "#potential_tool_malfunction__docs_as_code__m8"

usecase_8_malfunction_1 -->|violates| requirements




usecase_9["Generate HTML documentation (tool_usecase)"]
class usecase_9 usecase
report --> usecase_9
click usecase_9 href "#tool_usecase__docs_as_code__generation"


usecase_9_malfunction_1["HTML output is incomplete or wrong (potential_tool_malfunction)"]
class usecase_9_malfunction_1 malfunction
usecase_9 --> usecase_9_malfunction_1
click usecase_9_malfunction_1 href "#potential_tool_malfunction__docs_as_code__m9"
    

Evaluation overview

Generated from linked report records.

Table 1 Evaluation overview

Use case Capability being evaluated.	Potential malfunction Failure mode if the capability is wrong.	Safety affected Can this affect safety?	Safety measures Measures used during normal operation.	Detection sufficient Detected before the output is relied on?	SCORE TCL Per-malfunction classification.
Enforce document types and attributes tool_usecase__docs_as_code__metamodel	Invalid document passes metamodel checks potential_tool_malfunction__docs_as_code__m1	YES	PR review	NO	LOW
Enforce safety-critical links tool_usecase__docs_as_code__safety_links	Unsafe link passes validation potential_tool_malfunction__docs_as_code__m2	YES	PR review	NO	LOW
Calculate requirement coverage tool_usecase__docs_as_code__coverage	Requirement coverage is wrong potential_tool_malfunction__docs_as_code__m3	YES	—	NO	LOW
Generate architecture diagrams tool_usecase__docs_as_code__architecture	Architecture diagram is wrong potential_tool_malfunction__docs_as_code__m4	YES	PR review includes architecture inspection	YES	HIGH
Resolve testcase verification links tool_usecase__docs_as_code__test_linkage	Requirement appears tested when it is not potential_tool_malfunction__docs_as_code__m5	YES	—	NO	LOW
Validate testcase references tool_usecase__docs_as_code__test_refs	Test reference is missing or outdated potential_tool_malfunction__docs_as_code__m6	YES	PR review	NO	LOW
List assumptions of use tool_usecase__docs_as_code__assumptions	Assumption of use is missing or wrong potential_tool_malfunction__docs_as_code__m7	YES	PR review	NO	LOW
Generate traceability backlinks tool_usecase__docs_as_code__backlinks	Backlink is wrong or missing potential_tool_malfunction__docs_as_code__m8	YES	—	NO	LOW
Generate HTML documentation tool_usecase__docs_as_code__generation	HTML output is incomplete or wrong potential_tool_malfunction__docs_as_code__m9	NO	—	—	HIGH

Tool qualification matrix

Generated from linked report records.

The qualification matrix contains only safety-relevant malfunctions whose detection is insufficient. Every such malfunction must violate at least one tool_req. Requirements are grouped by their strongest available testcase link: full verification, partial verification without full verification, or no verification link.

Table 2 Tool qualification matrix

Use case	Potential malfunction	Fully verified tool requirements	Partially verified tool requirements	Unverified tool requirements
Enforce document types and attributes tool_usecase__docs_as_code__metamodel	Invalid document passes metamodel checks potential_tool_malfunction__docs_as_code__m1	tool_req__docs_doc_generic_mandatory, tool_req__docs_common_attr_safety, tool_req__docs_req_attr_rationale, tool_req__docs_req_attr_reqtype, tool_req__docs_tvr_safety, tool_req__docs_tvr_security, tool_req__docs_tvr_status, tool_req__docs_tvr_confidence_level, tool_req__docs_saf_attrs_mitigation_issue, tool_req__docs_saf_attrs_sufficient, tool_req__docs_saf_attrs_content, tool_req__docs_saf_attr_fmea_fault_id, tool_req__docs_saf_attr_fmea_failure_effect, tool_req__docs_sec_attrs_mandatory	tool_req__docs_common_attr_id_scheme, tool_req__docs_common_attr_status, tool_req__docs_common_attr_description, tool_req__docs_common_attr_title, tool_req__docs_common_attr_desc_wording, tool_req__docs_common_attr_security, tool_req__docs_common_attr_version, tool_req__docs_req_attr_validity_correctness, tool_req__docs_req_attr_validity_consistency, tool_req__docs_tvr_version, tool_req__docs_saf_attrs_violates, tool_req__docs_saf_attrs_mandatory	tool_req__docs_common_attr_id, tool_req__docs_common_attr_suspicious, tool_req__docs_req_attr_testcov, tool_req__arch_linkage_safety, tool_req__arch_consistency_interf, tool_req__docs_saf_attrs_mitigated_by, tool_req__docs_saf_attrs_sufficient_check, tool_req__docs_sec_attr_stride_threat_id
Enforce safety-critical links tool_usecase__docs_as_code__safety_links	Unsafe link passes validation potential_tool_malfunction__docs_as_code__m2	tool_req__docs_req_link_covers_aou	tool_req__docs_common_attr_safety_link_check, tool_req__docs_req_arch_link_safety_to_arch, tool_req__docs_req_link_satisfies_allowed	tool_req__docs_arch_link_fulfils, tool_req__docs_arch_link_fulfils_aou, tool_req__docs_arch_link_aou_check, tool_req__docs_arch_link_safety_to_req, tool_req__docs_arch_link_security
Calculate requirement coverage tool_usecase__docs_as_code__coverage	Requirement coverage is wrong potential_tool_malfunction__docs_as_code__m3	—	tool_req__docs_test_linkage_metrics, tool_req__docs_verification_report_need	—
Resolve testcase verification links tool_usecase__docs_as_code__test_linkage	Requirement appears tested when it is not potential_tool_malfunction__docs_as_code__m5	—	tool_req__docs_test_link_testcase, tool_req__docs_test_linkage_metrics, tool_req__docs_verification_report_need	tool_req__docs_test_metadata_mandatory_1, tool_req__docs_test_metadata_mandatory_2, tool_req__docs_test_metadata_link_levels
Validate testcase references tool_usecase__docs_as_code__test_refs	Test reference is missing or outdated potential_tool_malfunction__docs_as_code__m6	—	tool_req__docs_test_link_testcase	—
List assumptions of use tool_usecase__docs_as_code__assumptions	Assumption of use is missing or wrong potential_tool_malfunction__docs_as_code__m7	tool_req__docs_req_link_covers_aou	tool_req__docs_req_types	tool_req__docs_arch_link_fulfils_aou
Generate traceability backlinks tool_usecase__docs_as_code__backlinks	Backlink is wrong or missing potential_tool_malfunction__docs_as_code__m8	—	tool_req__docs_req_link_satisfies_allowed	—

Details

The safety evaluation uses the following shared facts:

• Build/CI behavior: Builds run with -W; any warning trips CI. The safety-relevant danger is the silent failure — a missing warning or a wrong output published undetected. A loud CI abort is safe: no wrong output enters the baseline.

• PR Review: Repository contents are the source of truth and every change is reviewed by a committer (rl__committer, doc_concept__wp_inspections). Still, for silent wrong outputs the gated CI stays green.

• Derived-view: The rendered HTML output is a derived view; the authoritative safety artifacts are mostly the source-controlled work products. There are two exceptions, the architecture views and backlinks. Rendering/preview defects affect reviewer convenience, not safety evidence.

Each of the following tool capabilities is evaluated as an intended use case with its corresponding potential malfunction.

Enforce document types and attributes
version: 1 contains: potential_tool_malfunction__docs_as_code__m1 belongs to: doc_tool__score_docs_as_code
Enforce document types and mandatory attributes such as id, status, security, safety, and realizes. See, for example, gd_req__doc_attr_status, gd_req__req_attr_uid, gd_req__req_attr_safety, gd_req__arch_attr_safety, and gd_req__req_check_mandatory. Invalid document passes metamodel checks detection_sufficient: NO safety_affected: YES safety_measures: PR review version: 1 contained by: tool_usecase__docs_as_code__metamodel violates: tool_req__arch_consistency_interf, tool_req__arch_linkage_safety, tool_req__docs_common_attr_desc_wording, tool_req__docs_common_attr_description, tool_req__docs_common_attr_id, tool_req__docs_common_attr_id_scheme, tool_req__docs_common_attr_safety, tool_req__docs_common_attr_security, tool_req__docs_common_attr_status, tool_req__docs_common_attr_suspicious, tool_req__docs_common_attr_title, tool_req__docs_common_attr_version, tool_req__docs_doc_generic_mandatory, tool_req__docs_req_attr_rationale, tool_req__docs_req_attr_reqtype, tool_req__docs_req_attr_testcov, tool_req__docs_req_attr_validity_consistency, tool_req__docs_req_attr_validity_correctness, tool_req__docs_saf_attr_fmea_failure_effect, tool_req__docs_saf_attr_fmea_fault_id, tool_req__docs_saf_attrs_content, tool_req__docs_saf_attrs_mandatory, tool_req__docs_saf_attrs_mitigated_by, tool_req__docs_saf_attrs_mitigation_issue, tool_req__docs_saf_attrs_sufficient, tool_req__docs_saf_attrs_sufficient_check, tool_req__docs_saf_attrs_violates, tool_req__docs_sec_attr_stride_threat_id, tool_req__docs_sec_attrs_mandatory, tool_req__docs_tvr_confidence_level, tool_req__docs_tvr_safety, tool_req__docs_tvr_security, tool_req__docs_tvr_status, tool_req__docs_tvr_version Silent false-negative: a too-permissive metamodel.yaml regex is accepted without a guard, or a check bug skips a case. Impact on safety: yes. Impact safety measures available: yes: PR review. Impact safety detection sufficient: no: Qualify metamodel enforcement. Further additional safety measure required: yes (qualification). Confidence (automatic calculation): low. potential_tool_malfunction__docs_as_code__m1 Potential Tool Malfunction
tool_usecase__docs_as_code__metamodel		Tool Use Case

Enforce safety-critical links
version: 1 contains: potential_tool_malfunction__docs_as_code__m2 belongs to: doc_tool__score_docs_as_code
Enforce that links between safety-relevant needs preserve the required safety relationships. See gd_req__req_linkage_safety. Unsafe link passes validation detection_sufficient: NO safety_affected: YES safety_measures: PR review version: 1 contained by: tool_usecase__docs_as_code__safety_links violates: tool_req__docs_arch_link_aou_check, tool_req__docs_arch_link_fulfils, tool_req__docs_arch_link_fulfils_aou, tool_req__docs_arch_link_safety_to_req, tool_req__docs_arch_link_security, tool_req__docs_common_attr_safety_link_check, tool_req__docs_req_arch_link_safety_to_arch, tool_req__docs_req_link_covers_aou, tool_req__docs_req_link_satisfies_allowed Silent false-negative: links are allowed which cannot be safe derivations. Impact on safety: yes. Impact safety measures available: yes: PR review. Impact safety detection sufficient: no: Qualify graph checks. Further additional safety measure required: yes (qualification). The clearest gap is satisfied_by (and arguably covers), which carry the same “target at least as safe” obligation as the checked fulfils/implements yet are unconstrained. Confidence (automatic calculation): low. potential_tool_malfunction__docs_as_code__m2 Potential Tool Malfunction
tool_usecase__docs_as_code__safety_links		Tool Use Case

Calculate requirement coverage
version: 1 contains: potential_tool_malfunction__docs_as_code__m3 belongs to: doc_tool__score_docs_as_code
Count, per requirement type, the requirements carrying a testlink and compute link-coverage percentages. See gd_req__verification_reporting. Requirement coverage is wrong detection_sufficient: NO safety_affected: YES version: 1 contained by: tool_usecase__docs_as_code__coverage violates: tool_req__docs_test_linkage_metrics, tool_req__docs_verification_report_need Silent wrong-output: a coverage statistic is computed incorrectly. Impact on safety: yes. Impact safety measures available: no. Impact safety detection sufficient: no: Qualify coverage statistics. Further additional safety measure required: yes (qualification). Confidence (automatic calculation): low. potential_tool_malfunction__docs_as_code__m3 Potential Tool Malfunction
tool_usecase__docs_as_code__coverage		Tool Use Case

Generate architecture diagrams
version: 1 contains: potential_tool_malfunction__docs_as_code__m4 belongs to: doc_tool__score_docs_as_code
Generate architecture diagrams. See gd_req__arch_viewpoints. Architecture diagram is wrong detection_sufficient: YES safety_affected: YES safety_measures: PR review includes architecture inspection version: 1 contained by: tool_usecase__docs_as_code__architecture violates: tool_req__docs_arch_views Silent wrong-output: a diagram misrepresents the architecture. Impact on safety: yes. Impact safety measures available: yes: PR review includes architecture inspection. Impact safety detection sufficient: yes. Further additional safety measure required: no. Confidence (automatic calculation): high. potential_tool_malfunction__docs_as_code__m4 Potential Tool Malfunction
tool_usecase__docs_as_code__architecture		Tool Use Case

Resolve testcase verification links
version: 1 contains: potential_tool_malfunction__docs_as_code__m5 belongs to: doc_tool__score_docs_as_code
For each testcase need, resolve its partially_verifies/fully_verifies references against the needs set. See gd_req__req_attr_testlink and gd_req__verification_reporting. Requirement appears tested when it is not detection_sufficient: NO safety_affected: YES version: 1 contained by: tool_usecase__docs_as_code__test_linkage violates: tool_req__docs_test_link_testcase, tool_req__docs_test_linkage_metrics, tool_req__docs_test_metadata_link_levels, tool_req__docs_test_metadata_mandatory_1, tool_req__docs_test_metadata_mandatory_2, tool_req__docs_verification_report_need Silent wrong-output: the safety case believes the requirement is tested where it is not. Impact on safety: yes. Impact safety measures available: no. Impact safety detection sufficient: no: Qualify linkage statistics. Further additional safety measure required: yes (qualification). Confidence (automatic calculation): low. potential_tool_malfunction__docs_as_code__m5 Potential Tool Malfunction
tool_usecase__docs_as_code__test_linkage		Tool Use Case

Validate testcase references
version: 1 contains: potential_tool_malfunction__docs_as_code__m6 belongs to: doc_tool__score_docs_as_code
Check that test references are present and point to the intended requirements. See gd_req__req_attr_testlink. Test reference is missing or outdated detection_sufficient: NO safety_affected: YES safety_measures: PR review version: 1 contained by: tool_usecase__docs_as_code__test_refs violates: tool_req__docs_test_link_testcase Silent wrong-output: a test references an outdated or missing requirement. Impact on safety: yes. Impact safety measures available: yes: PR review. Impact safety detection sufficient: no: Qualify test reference check. Further additional safety measure required: yes (qualification). Confidence (automatic calculation): low. potential_tool_malfunction__docs_as_code__m6 Potential Tool Malfunction
tool_usecase__docs_as_code__test_refs		Tool Use Case

List assumptions of use
version: 1 contains: potential_tool_malfunction__docs_as_code__m7 belongs to: doc_tool__score_docs_as_code
Use needtable to communicate safety-critical assumptions of use in safety manuals. See gd_guidl__saf_man and wp__platform_safety_manual. Assumption of use is missing or wrong detection_sufficient: NO safety_affected: YES safety_measures: PR review version: 1 contained by: tool_usecase__docs_as_code__assumptions violates: tool_req__docs_arch_link_fulfils_aou, tool_req__docs_req_link_covers_aou, tool_req__docs_req_types Silent wrong-output: aou_req items might be missing or wrong. Impact on safety: yes. Impact safety measures available: yes: PR review. Impact safety detection sufficient: no: Qualify needtable. Further additional safety measure required: yes (qualification). Confidence (automatic calculation): low. potential_tool_malfunction__docs_as_code__m7 Potential Tool Malfunction
tool_usecase__docs_as_code__assumptions		Tool Use Case

Generate traceability backlinks
version: 1 contains: potential_tool_malfunction__docs_as_code__m8 belongs to: doc_tool__score_docs_as_code
Generate correct backlinks for links between Needs items to provide bi-directional traceability. See doc_concept__general_traceability. Backlink is wrong or missing detection_sufficient: NO safety_affected: YES version: 1 contained by: tool_usecase__docs_as_code__backlinks violates: tool_req__docs_req_link_satisfies_allowed Silent wrong-output: generated backlinks are wrong or missing. Impact on safety: yes. Impact safety measures available: no. Impact safety detection sufficient: no: Qualify backlinks in HTML. Further additional safety measure required: yes (qualification). Confidence (automatic calculation): low. potential_tool_malfunction__docs_as_code__m8 Potential Tool Malfunction
tool_usecase__docs_as_code__backlinks		Tool Use Case

Generate HTML documentation
version: 1 contains: potential_tool_malfunction__docs_as_code__m9 belongs to: doc_tool__score_docs_as_code
Generate complete and correct HTML apart from the aspects covered by the other use cases. See gd_req__doc_attributes_manual and gd_req__doc_attr_status. HTML output is incomplete or wrong safety_affected: NO version: 1 contained by: tool_usecase__docs_as_code__generation violates: tool_req__docs_doc_types Wrong output: incomplete, outdated, or mis-rendered HTML. Impact on safety: no: rendered-view defects affect reviewer convenience, not safety evidence. Impact safety measures available: no. Impact safety detection sufficient: not applicable for a non-safety malfunction. Further additional safety measure required: no. Confidence (automatic calculation): high. potential_tool_malfunction__docs_as_code__m9 Potential Tool Malfunction
tool_usecase__docs_as_code__generation		Tool Use Case

Security evaluation

The threat model reduces to a single class: source tampering. The tool has no runtime attack surface — it is a build-time Sphinx extension reading source-controlled inputs and writing generated output.

Table 3 S-CORE Docs-as-Code security evaluation

Threat identification	Use case description	Threats	Impact on security?	Impact security measures available?	Impact security detection sufficient?	Further additional security measure required?
T1	Source tampering — applies to all tool use cases. See gd_req__req_attr_security, gd_req__arch_attr_security, gd_req__req_linkage, gd_req__req_traceability, gd_req__arch_linkage_security_trace.	An attacker with write access tampers with sources, configuration, or extension code to weaken/disable security checks or inject misleading content into published output.	yes	yes: PR review.	yes	no