Update trustable tenet TT-EXPECTATIONS

.dotstop.dot

@@ -31,6 +31,7 @@ digraph G {
 "AOU-28" [sha="76887b683a1e5a2f36a029bf80c7489226d1728e6f148f69f7b2167211f1f443"];
 "AOU-29" [sha="cb3302e313dae237d67bf249c61419232a83aa6245af30a0f33c795ab1b3a8f5"];
 "AOU-30" [sha="ee747671350441b0ca2438c651e0c30a90ac9b126540308415e1645eeea2707a"];
+"AOU-31" [sha="e6dfb726b06bf38ff27602695bdfafee64605da7ab6540b2ec0ae479ab73f3dc"];
 "JLEX-01" [sha="1cd16efee6db392909248a77c773e0c5aa76b4c05001ab0b981201004f2162b0"];
 "JLEX-02" [sha=f40046dae47252d62f28c935db90460772263ced0fa9ed1a5e1383436b89daa9];
 "JLS-01" [sha=dce41089598ceff4a3ce3df7a8d3d16183346b785d791d60c8292f51c055946d];
@@ -82,6 +83,9 @@ digraph G {
 "JLS-51" [sha="190e17d59795c9ed3b25a0a8bf57497de1e0d06ab90b3f6ba47b543c95edea43"];
 "JLS-52" [sha="8539f924c31974a2722615d2410a25336a5d6a9f399f16dc485be83f7f87a5ff"];
 "JLS-53" [sha="d9f7e732e34b0ec79305dde4c5b3d60906559ef1d90bc3ce2906e28a90293844"];
+"JLS-54" [sha="f1ff5d3aff697980bcf072e27e00f9916052aceb4796fe1417486ddc80d5e241"];
+"JLS-55" [sha="321c775e2acf0267ac1753eb772fedf1bcca18029714071c6e55d999f6dd008a"];
+"JLS-56" [sha="6fdd3ab1172c1df5658f140d104d51559080aa32389a5a842b93cfbd394593b3"];
 "JLS-57" [sha="6261b6cf44be2e742af1e1d687f1233161ab7cdaf6f1c0a6e31e671a7451adc5"];
 "JLS-58" [sha="dbdb83427fd82fd3be5e90ab761945a0346b33740b9ea80fd37122dfa6baaa60"];
 "JLS-61" [sha="151f1cda2384ae4935d29d300c3424bca710378fa3689bbcff69b06dc86bb692"];
@@ -91,6 +95,11 @@ digraph G {
 "JLS-65" [sha="e413de6c831c1c019c67c3e3477b9dc9302cc79433ec894beaee0c95e053b545"];
 "JLS-66" [sha="cf57eaf55654ef52589b1879c7294de13ddf1258ecdff4f6371178c6e8e6975b"];
 "JLS-74" [sha="c161214f0f206f3c0826750978fcc4c99e2765a0c3333592e1293b323434ca34"];
+"JLS-70" [sha="5958335832f06baaa624a093c06ce9abc2ee88c8034819ace3be2c5fff0e0a74"];
+"JLS-71" [sha="83bb8658b1b8914e0f37cdd0333d5f9351a75763486565ce7804a240d9a418ac"];
+"JLS-72" [sha="0b061840170a819c7daf1005b2eee53d121e04e921413935f5eed4fec98a8726"];
+"JLS-73" [sha="42d8dd90dc4a321923567287216e216a30c55ede8836824e19fba046a2121a97"];
+"JLS-76" [sha="ebcfc023f88ef50a3c804cb72318428e7566dc44c3539c54742e25f261ff3249"];
 "NJF-01" [sha="548dc86014e093974f68660942daa231271496a471885bbed092a375b3079bd8"];
 "NJF-02" [sha="6ea015646d696e3f014390ff41612eab66ac940f20cf27ce933cbadf8482d526"];
 "NJF-03" [sha="4bd1f8210b7bba9a248055a437f377d9da0b7576c5e3ed053606cf8b5b2febe3"];
@@ -407,6 +416,7 @@ digraph G {
 "TA-BEHAVIOURS" -> "JLEX-02" [sha=cb26451e31a56b1eb51a4d45283ba4a7c6e898efbd045b59cba10d3c6aa093de];
 "TA-BEHAVIOURS" -> "JLS-03" [sha=cf9211c07452914cb2d0b455f859b26cb2724423eae5187e8cbfdff06d1b5ba3];
 "TA-BEHAVIOURS" -> "JLS-27" [sha="880ec996ed026258b58299c356aab7d02652ae55cbf1f98494e2a7770fd96275"];
+"TA-BEHAVIOURS" -> "JLS-56" [sha="96132477a8b2090f75ca56db2af3ac142a26423915a2f76e328734ae3347a5dd"];
 "TA-CONFIDENCE" -> "JLS-08" [sha="506164051180023c8533ea1f6dedf1bad894c3ee6020ff16b002e33b109c2791"];
 "TA-CONFIDENCE" -> "JLS-09" [sha="80bbde95fc14f89acf3dad10b3831bc751943fe4a1d79d5cbf4702416c27530f"];
 "TA-CONFIDENCE" -> "JLS-20" [sha="1bfd214ab8186a3c095262ae503451b8d71ada8db5b13ecc7b906739a05bc102"];
@@ -438,6 +448,11 @@ digraph G {
 "TA-CONSTRAINTS" -> "AOU-10" [sha="54e2cf65bcc7544eda66fd5aca9763008a094dd7389db2463b28c81e1c586375"];
 "TA-CONSTRAINTS" -> "AOU-11" [sha="376c75481202bdc4c6d8f9073f5173ab307859b0495735b204de05e58ef2742c"];
 "TA-CONSTRAINTS" -> "AOU-30" [sha="28a722163059e712168605d165311d28bbb6e0d88f34e4b8b317f18d47d02843"];
+"TA-CONSTRAINTS" -> "JLS-70" [sha="8672df0fe5ac8addb8adfb527e2735606966e66d45c112b87c23cf4e57f34909"];
+"TA-CONSTRAINTS" -> "JLS-71" [sha="06bc97101b9f4119cb3f5bdac28ec3f25f35bb51a593893fcfe1fc5d67cd17a3"];
+"TA-CONSTRAINTS" -> "JLS-72" [sha="ed3451acf602f0f25d33250a55bfe6311a47d6e5f7bd2b1b7d5beb08ca781094"];
+"TA-CONSTRAINTS" -> "JLS-73" [sha="4e3de24e57b1865345cebeb654b0b29d89558f3fddb0c76f8b26db0d4ff92993"];
+"TA-CONSTRAINTS" -> "AOU-31" [sha="858726a396aa2b29254e4f84a815ac07b0cddfd13d3f69b9e520cf8ebe5c0172"];
 "TA-DATA" -> "JLS-18" [sha=af2567d28552ab32643e995a9c9c9fd73b2208ce3d5255fba333c8ddd28f72a6];
 "TA-DATA" -> "JLS-45" [sha="9cc0a42711c2d7c03dab3a2d633abf41a7451c375f68bed9907429a86077d2d8"];
 "TA-FIXES" -> "JLS-05" [sha="7264d31fb391f7ab77e3719a732b06a366579f7ee8b398d185daa4431aee4224"];
@@ -448,6 +463,9 @@ digraph G {
 "TA-FIXES" -> "JLS-28" [sha="0adb7ec9c6cc4338fa810442d22c8e4ca2a39cf33f0efaf859457ab32946991d"];
 "TA-FIXES" -> "JLS-33" [sha="56b526e261afa2da0793ec172850d227e4ed1d8c8a06e616c680c3db29648d45"];
 "TA-FIXES" -> "JLS-57" [sha="ada11447792ac70d2f87b81253379dd31d73eefa57554c9f0b1e067bf995812c"];
+"TA-INDICATORS" -> "JLS-54" [sha="b8d659e9fa897e4f13ceace28a2c71e38d41be22a52ca34162ca907c82e160fc"];
+"TA-INDICATORS" -> "JLS-55" [sha="0d048eab93d9d675bf346fb93b80a5af1b7752352b28e1b80b4b9e8b85e5fc3d"];
+"TA-INDICATORS" -> "JLS-56" [sha="a27def8655040fb7b0feb8c88ce79962442cd8f7fab0e64ec7a7ff576ff1b7e6"];
 "TA-INPUTS" -> "JLS-04" [sha="262db6d430e99ef3a23645c93a1cc5bda1270ceba90b4d8cccb40b1eb85e9860"];
 "TA-INPUTS" -> "JLS-47" [sha="b2da62290125ecc680f953dde166bb5f22e7f8c6e7e53a73136102e01dd013a7"];
 "TA-INPUTS" -> "JLS-34" [sha="b39b1a808b02bfcd5450ffea835179c862c19f7759de0508bac9249c02db58c1"];
@@ -469,6 +487,8 @@ digraph G {
 "TA-MISBEHAVIOURS" -> "JLS-24" [sha=e8de01ff7c316debcd96afa4b3b6b62be73522e4531214c18b3ad7eec826275e];
 "TA-MISBEHAVIOURS" -> "JLS-25" [sha="56ba396580f90e5a10fd5adfe33864921537d47e21b215a8faf531855af40ecd"];
 "TA-MISBEHAVIOURS" -> "JLS-31" [sha="ff3352e20146a81904da6d8d94b003b4e0acbc2a8a63a73ea017ea0535e45e79"];
+"TA-MISBEHAVIOURS" -> "JLS-76" [sha="7528c4228bbe5a1d4ccfcd7efe4254b2f2443c9746b28de5903d2a925dba8436"];
+"TA-MISBEHAVIOURS" -> "JLS-11" [sha="d03c18218f8e022c1210c63a6dcea2729a0584bc3b31aba1370e5f5037b0ef94"];
 "TA-RELEASES" -> "JLS-14" [sha="1202b9934353436fba927de6762cf62a8fc23ab0815a3c06f9d0a77b55830720"];
 "TA-RELEASES" -> "JLS-38" [sha="ed0d250c8c191ac4fc03712a321bf399d26e932edabb13067fbcffae1640cb90"];
 "TA-RELEASES" -> "JLS-10" [sha="33c316a9040c7d27c830ca453e39d3bb423acf42e14d1d561c952291ba66078b"];

.dotstop_extensions/references.py

@@ -36,16 +36,19 @@ class CPPTestReference(BaseReference):
     section declaration, and the closing brace `}` must have the same indentation 
     as the opening brace. This is the case for the tests from nlohmann_json.
     """
-    def __init__(self, name: str, path: str) -> None:
+    def __init__(self, name: str, path: str, description: str = "") -> None:
         """
         Initialize CPPTestReference.
 
         Args:
-            name: Section name, use colon-separated for nested sections (e.g., "testcase1:section1:section2")
+            name: Section name, use colon-separated for nested sections
+                  (e.g., "testcase1:section1:section2")
             path: Relative path from project root to the file
+            description: Optional human-readable description of the test section
         """
         self._name = name
         self._path = Path(path)
+        self._description = description
 
     @classmethod
     def type(cls) -> str:
@@ -167,13 +170,16 @@ def content(self) -> bytes:
     def as_markdown(self, filepath: None | str = None) -> str:
         content = self.content.decode('utf-8')
         content = self.remove_leading_whitespace_preserve_indentation(content)
-        return format_cpp_code_as_markdown(content)
+        md = format_cpp_code_as_markdown(content)
+
+        if self._description:
+            return f"Description: {self._description}\n\n{md}"
+        return md
 
     def __str__(self) -> str:
         # this is used as a title in the trudag report
         return f"cpp-test: [{self._name}]\n({self._path})"
 
-
 class JSONTestsuiteReference(CPPTestReference):
     """
     Represents a reference to one or more JSON testsuite files, where the CPP test 

.github/workflows/coverage_gate.yml

@@ -0,0 +1,81 @@
+name: Coverage Gate
+
+on:
+  workflow_call:
+    inputs:
+      artifact_id:
+        description: "Artifact name for the coverage-gate result"
+        required: true
+        type: string
+
+jobs:
+  coverage_gate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Download coverage HTML artifact
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          name: code-coverage-report
+          path: coverage_html
+
+      - name: Debug list coverage files
+        run: |
+          echo "=== coverage_html contents ==="
+          ls -R coverage_html
+
+      - name: Enforce coverage threshold
+        run: |
+          THRESHOLD=99.19
+
+          echo "=== Extracting line coverage for 'Lines:' from index.html ==="
+
+          HEADER_BLOCK=$(grep -A1 'Lines:' coverage_html/index.html || true)
+          echo "$HEADER_BLOCK"
+
+          LINE_COV=$(echo "$HEADER_BLOCK" | grep -oE "[0-9]+(\.[0-9]+)?" | head -n1 || true)
+          echo "Extracted Line coverage: '${LINE_COV}'"
+
+          if [ -z "$LINE_COV" ]; then
+            echo "Could not extract line coverage for 'Lines:' from index.html"
+            exit 1
+          fi
+
+          COMPARE=$(awk -v cov="$LINE_COV" -v thr="$THRESHOLD" 'BEGIN { if (cov < thr) print "lt"; else print "ge"; }')
+
+          if [ "$COMPARE" = "lt" ]; then
+            echo "Coverage below threshold, failing job."
+            exit 1
+          fi
+
+          echo "Coverage is above threshold."
+
+      - name: Create coverage-gate result
+        if: always()
+        run: |
+          mkdir -p coverage_gate
+
+          THRESHOLD=99.19
+
+          LINE_COV=""
+          if [ -f coverage_html/index.html ]; then
+            HEADER_BLOCK=$(grep -A1 'Lines:' coverage_html/index.html || true)
+            LINE_COV=$(echo "$HEADER_BLOCK" | grep -oE "[0-9]+(\.[0-9]+)?" | head -n1 || true)
+          fi
+
+          {
+            echo "status=${{ job.status }}"
+            echo "line_coverage=${LINE_COV}"
+            echo "threshold=${THRESHOLD}"
+          } > coverage_gate/coverage_gate.txt
+
+
+      - name: Upload coverage-gate artifact
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: ${{ inputs.artifact_id }}
+          path: coverage_gate/coverage_gate.txt

.github/workflows/docs.yml

@@ -81,7 +81,7 @@ jobs:
       - name: Download trudag report artifact
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
-          name: trudag-report-${{ github.event.pull_request.head.sha || github.sha }}
+          name: trudag-report-${{ github.sha }}
           path: TSF/docs/generated/
 
       - name: Build documentation

.github/workflows/parent-workflow.yml

@@ -10,6 +10,7 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   labeler:
@@ -63,6 +64,22 @@ jobs:
     with:
       artifact_id: "ubuntu-${{ github.sha }}"
 
+  coverage_gate:
+    name: Run Coverage Gate Workflow
+    needs: [ubuntu]
+    if: ${{ github.event_name == 'pull_request' && github.base_ref == 'main'
+        || github.event_name == 'push' && github.ref == 'refs/heads/main'
+        || github.event_name == 'schedule' }}
+    uses: ./.github/workflows/coverage_gate.yml
+    with:
+      artifact_id: "coverage_gate-${{ github.sha }}"
+
+  pr_count_gate:
+    name: Run PR Count Gate Workflow
+    uses: ./.github/workflows/pr_count_gate.yml
+    with:
+      artifact_id: "pr_count_gate-${{ github.sha }}"
+
   dependency_review:
     name: Run dependency_review Workflow
     if: ${{ github.event_name == 'pull_request' }}  # only run dependency_review for PRs
@@ -73,11 +90,11 @@ jobs:
   collect_artifacts_pr:
     name: "Collect Results & Deploy (PR)"
     if: github.event_name == 'pull_request'
-    needs: [labeler, SME_review_checker, check_amalgamation, test_trudag_extensions, dependency_review, codeql, ubuntu]
+    needs: [labeler, SME_review_checker, check_amalgamation, test_trudag_extensions, dependency_review, codeql, ubuntu, coverage_gate, pr_count_gate]
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        target: [labeler, SME_review_checker, check_amalgamation, test_trudag_extensions, dependency_review, codeql, ubuntu]
+        target: [labeler, SME_review_checker, check_amalgamation, test_trudag_extensions, dependency_review, codeql, ubuntu, coverage_gate, pr_count_gate]
 
     steps:
       - name: Checkout code
@@ -89,7 +106,7 @@ jobs:
           result="${{ needs[matrix.target].result }}"
           echo "${{ matrix.target }} workflow result: $result"
 
-          if [[ "$result" != "success" ]]; then
+          if [[ "$result" != "success" && "$result" != "skipped" ]]; then
             echo "❌ ${{ matrix.target }} workflow failed! Exiting..."
             exit 1
           fi
@@ -106,11 +123,11 @@ jobs:
   collect_artifacts_non_pr:
     name: "Collect Results & Deploy (Non-PR)"
     if: github.event_name != 'pull_request'
-    needs: [labeler, test_trudag_extensions, codeql, ubuntu]  # no check_amalgamation, dependency_review or SME_review_checker if non PR
+    needs: [labeler, test_trudag_extensions, codeql, ubuntu, coverage_gate, pr_count_gate]  # no check_amalgamation, dependency_review or SME_review_checker if non PR
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        target: [labeler, test_trudag_extensions, codeql, ubuntu]
+        target: [labeler, test_trudag_extensions, codeql, ubuntu, coverage_gate, pr_count_gate]
 
     steps:
       - name: Checkout code

.github/workflows/pr_count_gate.yml

@@ -0,0 +1,78 @@
+name: PR Count Gate
+
+on:
+  workflow_call:
+    inputs:
+      artifact_id:
+        required: true
+        type: string
+
+jobs:
+  pr_count_gate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Count open pull requests
+        id: pr-count
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { owner, repo } = context.repo;
+            const per_page = 100;
+            let page = 1;
+            let total = 0;
+
+            while (true) {
+              const { data } = await github.rest.pulls.list({
+                owner,
+                repo,
+                state: 'open',
+                base: 'main',
+                per_page,
+                page,
+              });
+              if (data.length === 0) break;
+              total += data.length;
+              if (data.length < per_page) break;
+              page++;
+            }
+
+            core.info(`Open pull requests: ${total}`);
+            core.setOutput('open_prs', total.toString());
+
+      - name: fail if too many open PRs
+        id: gate
+        shell: bash
+        run: |
+          MAX=15
+          OPEN="${{ steps.pr-count.outputs.open_prs }}"
+
+          echo "Open PRs: ${OPEN}"
+          echo "Max allowed: ${MAX}"
+
+          if [ "$OPEN" -gt "$MAX" ]; then
+            echo "Gate failed: too many open PRs (${OPEN} > ${MAX})"
+            exit 1
+          fi
+
+          echo "Gate passed: (${OPEN} <= ${MAX})"
+
+      - name: Write PR count result
+        if: always()
+        run: |
+          mkdir -p pr_count_gate
+          echo "status=${{ job.status }}" > pr_count_gate/pr_count_gate.txt
+          echo "open_prs=${{ steps.pr-count.outputs.open_prs }}" >> pr_count_gate/pr_count_gate.txt
+          echo "max_open_prs=15" >> pr_count_gate/pr_count_gate.txt
+          echo "sha=${{ github.sha }}" >> pr_count_gate/pr_count_gate.txt
+          echo "run_id=${{ github.run_id }}" >> pr_count_gate/pr_count_gate.txt
+
+      - name: Upload PR count gate artifact
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: ${{ inputs.artifact_id }}
+          path: pr_count_gate/pr_count_gate.txt
+
+

.github/workflows/publish_documentation.yml

@@ -189,6 +189,8 @@ jobs:
           TSF_SCORING_DB: ${{ steps.select_db.outputs.db_path }}
         run: |
           set -euo pipefail
+          git checkout "$branch_name"
+          git checkout save_historical_data -- "$TSF_SCORING_DB" TSF/misbehaviours.md
           echo "[verify] TSF_SCORING_DB='$TSF_SCORING_DB'"
           test -n "$TSF_SCORING_DB"
           test -f "$TSF_SCORING_DB"
@@ -200,9 +202,13 @@ jobs:
 
       - name: Checkout data storage branch
         run: |
-          git stash push --include-untracked -- . ':(exclude)TSF/data_storage' ':(exclude)TSF/data_storage/**' ':(exclude)TSF/TrustableScoring.db'
+          set -euo pipefail
+          temp_db="$RUNNER_TEMP/$(basename "$TSF_SCORING_DB").working"
+          cp "$TSF_SCORING_DB" "$temp_db"
+          git stash push --include-untracked -- .
           git checkout save_historical_data
           git pull
+          cp "$temp_db" "$TSF_SCORING_DB"
 
       - name: Store persistent data
         run: |
@@ -221,7 +227,8 @@ jobs:
 
       - name: Recover stash
         run: |
-          git checkout $branch_name
+          set -euo pipefail
+          git checkout "$branch_name"
           git stash apply
 
       - name: Upload trudag artifact

TSF/trustable/assertions/TA-BEHAVIOURS-CHECKLIST.md

@@ -1,4 +1,4 @@
-#### Checklist for TA-BEHAVIOURS from [Codethink](https://codethinklabs.gitlab.io/trustable/trustable/print_page.html)
+#### Checklist for TA-BEHAVIOURS from [Codethink](https://pages.eclipse.dev/eclipse/tsf/tsf/print_page.html)
 
 * How has the list of Expectations varied over time?