[rules score] add AoU forwarding to dependable elements

Implement automatic and chain-forwarding of Assumptions of Use (AoU)
between dependable elements:

- Add ForwardedAoUInfo provider carrying own and chain-forwarded AoU
  lobster entries as depsets
- Add aou_lobster field to AssumptionsOfUseInfo for lobster extraction
  from AoU TRLC sources
- Extend dependable_element rule to collect own AoUs from deps,
  receive chain-forwarded AoUs, and emit ForwardedAoUInfo
- Add aou_forwarding attribute accepting a YAML file that selects
  which received AoUs to forward further (with mandatory justification)
- Add aou_forwarding_to_lobster.py tool for filtering received AoUs
  based on the forwarding YAML (supports versioned lobster tags)
- Add lobster_aou.yaml config for lobster-trlc extraction of AoU records
- Extend lobster_de.conf.tpl with Forwarded AoUs tier

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: castler

bazel/rules/rules_score/BUILD

@@ -76,6 +76,18 @@ py_binary(
     visibility = ["//visibility:public"],
 )
 
+# AoU forwarding filter: filters received AoU lobster entries for chain-forwarding
+py_binary(
+    name = "aou_forwarding_to_lobster",
+    srcs = ["src/aou_forwarding_to_lobster.py"],
+    imports = ["src"],
+    main = "src/aou_forwarding_to_lobster.py",
+    visibility = ["//visibility:public"],
+    deps = [
+        requirement("pyyaml"),
+    ],
+)
+
 # HTML merge tool
 py_binary(
     name = "sphinx_html_merge",

bazel/rules/rules_score/lobster/config/BUILD

@@ -44,6 +44,12 @@ filegroup(
     visibility = ["//visibility:public"],
 )
 
+filegroup(
+    name = "aou_config",
+    srcs = ["lobster_aou.yaml"],
+    visibility = ["//visibility:public"],
+)
+
 # ---------------------------------------------------------------------------
 # Lobster report config templates: static structure with {PLACEHOLDER} markers
 # for source file lists. Used by rules_score to generate per-target configs

bazel/rules/rules_score/lobster/config/lobster_aou.yaml

@@ -0,0 +1,21 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+# lobster-trlc configuration for Assumptions of Use records.
+inputs:
+  - .
+conversion-rules:
+  - package: ScoreReq
+    record-type: AoU
+    namespace: req
+    version-field: version
+    description-fields: description

bazel/rules/rules_score/lobster/config/lobster_de.conf.tpl

@@ -2,6 +2,10 @@ requirements "Feature Requirements" {
 {FEAT_REQ_SOURCES}
 }
 
+requirements "Forwarded AoUs" {
+{FORWARDED_AOU_SOURCES}
+}
+
 requirements "Component Requirements" {
 {COMP_REQ_SOURCES}{COMP_REQ_TRACE}}
 

bazel/rules/rules_score/private/assumptions_of_use.bzl

@@ -19,6 +19,7 @@ following S-CORE process guidelines. Assumptions of Use define the safety-releva
 operating conditions and constraints for a Safety Element out of Context (SEooC).
 """
 
+load("@lobster//:lobster.bzl", "subrule_lobster_trlc")
 load("@trlc//:trlc.bzl", "TrlcProviderInfo", "trlc_requirements_test")
 load("//bazel/rules/rules_score:providers.bzl", "AssumptionsOfUseInfo", "ComponentRequirementsInfo", "FeatureRequirementsInfo", "SphinxSourcesInfo")
 load("//bazel/rules/rules_score/private:rst_to_trlc.bzl", "rst_srcs_to_trlc")
@@ -61,6 +62,14 @@ def _assumptions_of_use_impl(ctx):
 
     all_srcs = depset(rendered_files)
 
+    # Generate lobster file from AoU TRLC sources for traceability forwarding
+    all_trlc_files = []
+    for src in ctx.attr.srcs:
+        all_trlc_files.extend(src[DefaultInfo].files.to_list())
+    aou_lobster_file = None
+    if all_trlc_files and ctx.file.lobster_config:
+        aou_lobster_file, _ = subrule_lobster_trlc(all_trlc_files, ctx.file.lobster_config)
+
     # Collect requirements providers and lobster files
     reqs = []
     lobster_files = []
@@ -84,6 +93,7 @@ def _assumptions_of_use_impl(ctx):
         DefaultInfo(files = all_srcs),
         AssumptionsOfUseInfo(
             srcs = depset(transitive = lobster_files),
+            aou_lobster = depset([aou_lobster_file] if aou_lobster_file else []),
             name = ctx.label.name,
         ),
         SphinxSourcesInfo(
@@ -111,13 +121,19 @@ _assumptions_of_use = rule(
             mandatory = False,
             doc = "List of feature or component requirements targets that these Assumptions of Use trace to",
         ),
+        "lobster_config": attr.label(
+            allow_single_file = True,
+            mandatory = True,
+            doc = "Lobster YAML configuration file for AoU traceability extraction.",
+        ),
         "_renderer": attr.label(
             default = Label("@trlc//tools/trlc_rst:trlc_rst"),
             executable = True,
             allow_files = True,
             cfg = "exec",
         ),
     },
+    subrules = [subrule_lobster_trlc],
 )
 
 # ============================================================================
@@ -129,6 +145,7 @@ def assumptions_of_use(
         srcs,
         requirements = [],
         ref_package = None,
+        lobster_config = Label("//bazel/rules/rules_score/lobster/config:aou_config"),
         **kwargs):
     """Define Assumptions of Use following S-CORE process guidelines.
 
@@ -149,6 +166,8 @@ def assumptions_of_use(
             traceability as defined in the S-CORE process.
         ref_package: Optional TRLC package prefix used for ``derived_from``
             cross-references when converting RST sources.
+        lobster_config: Lobster YAML configuration for AoU traceability
+            extraction. Defaults to the standard S-CORE AoU config.
         visibility: Bazel visibility specification for the generated targets.
 
     Generated Targets:
@@ -179,6 +198,7 @@ def assumptions_of_use(
         name = name,
         srcs = trlc_srcs,
         requirements = requirements,
+        lobster_config = lobster_config,
         **kwargs
     )
     trlc_requirements_test(

bazel/rules/rules_score/private/dependable_element.bzl

@@ -29,12 +29,14 @@ load(
     "//bazel/rules/rules_score:providers.bzl",
     "ArchitecturalDesignInfo",
     "AssumedSystemRequirementsInfo",
+    "AssumptionsOfUseInfo",
     "CertifiedScope",
     "ComponentInfo",
     "DependabilityAnalysisInfo",
     "DependableElementInfo",
     "DependableElementLobsterInfo",
     "FeatureRequirementsInfo",
+    "ForwardedAoUInfo",
     "SphinxIndexFileInfo",
     "SphinxModuleInfo",
     "SphinxNeedsInfo",
@@ -1011,19 +1013,72 @@ def _dependable_element_index_impl(ctx):
     cm_list = [sa_lobster_files["controlmeasures.lobster"]] if "controlmeasures.lobster" in sa_lobster_files else []
     rc_list = [sa_lobster_files["root_causes.lobster"]] if "root_causes.lobster" in sa_lobster_files else []
 
+    # =========================================================================
+    # AoU Forwarding: collect own AoUs and received AoUs from deps
+    # =========================================================================
+
+    # Collect own AoU lobster files from assumptions_of_use targets
+    own_aou_lobster_files = []
+    for aou_target in ctx.attr.assumptions_of_use:
+        if AssumptionsOfUseInfo in aou_target:
+            own_aou_lobster_files.append(aou_target[AssumptionsOfUseInfo].aou_lobster)
+
+    own_aou_lobster_depset = depset(transitive = own_aou_lobster_files)
+
+    # Collect forwarded AoU lobster files from deps (received AoUs)
+    received_aou_lobster_files = []
+    for dep in ctx.attr.processed_deps:
+        if ForwardedAoUInfo in dep:
+            fwd_info = dep[ForwardedAoUInfo]
+            received_aou_lobster_files.append(fwd_info.own_aou_lobster)
+            received_aou_lobster_files.append(fwd_info.chain_forwarded_lobster)
+
+    received_aou_lobster_depset = depset(transitive = received_aou_lobster_files)
+    received_aou_list = received_aou_lobster_depset.to_list()
+
+    # Chain-forwarding: if aou_forwarding YAML is provided, filter received AoUs
+    chain_forwarded_lobster_depset = depset()
+    if ctx.file.aou_forwarding and received_aou_list:
+        chain_forwarded_lobster_file = ctx.actions.declare_file(
+            ctx.label.name + "/chain_forwarded_aous.lobster",
+        )
+        fwd_args = ctx.actions.args()
+        fwd_args.add("--yaml", ctx.file.aou_forwarding)
+        fwd_args.add("--output", chain_forwarded_lobster_file)
+        fwd_args.add("--input-lobster")
+        fwd_args.add_all(received_aou_list)
+        ctx.actions.run(
+            inputs = [ctx.file.aou_forwarding] + received_aou_list,
+            outputs = [chain_forwarded_lobster_file],
+            executable = ctx.executable._aou_forwarding_tool,
+            arguments = [fwd_args],
+            progress_message = "Filtering chain-forwarded AoUs for %s" % ctx.label.name,
+            mnemonic = "AoUForwarding",
+        )
+        chain_forwarded_lobster_depset = depset([chain_forwarded_lobster_file])
+        output_files.append(chain_forwarded_lobster_file)
+
     lobster_report_file = None
     lobster_html_report = None
     lobster_rst_dir = None
     lobster_files = []
     if feat_req_list:
+        # Build comp_req trace-to lines (Feature Requirements + optionally Forwarded AoUs)
+        comp_req_trace_lines = ""
+        if comp_req_list:
+            comp_req_trace_lines = "  trace to: \"Feature Requirements\";\n"
+            if received_aou_list:
+                comp_req_trace_lines += "  trace to: \"Forwarded AoUs\";\n"
+
         lobster_config = ctx.actions.declare_file(ctx.label.name + "/de_traceability_config")
         ctx.actions.expand_template(
             template = ctx.file._lobster_de_template,
             output = lobster_config,
             substitutions = {
                 "{FEAT_REQ_SOURCES}": format_lobster_sources(feat_req_list),
+                "{FORWARDED_AOU_SOURCES}": format_lobster_sources(received_aou_list),
                 "{COMP_REQ_SOURCES}": format_lobster_sources(comp_req_list),
-                "{COMP_REQ_TRACE}": ("  trace to: \"Feature Requirements\";\n") if comp_req_list else "",
+                "{COMP_REQ_TRACE}": comp_req_trace_lines,
                 "{ARCH_SOURCES}": format_lobster_sources(comp_arch_list),
                 "{UNIT_TEST_SOURCES}": format_lobster_sources(comp_test_list),
                 "{PUBLIC_API_SOURCES}": format_lobster_sources(interface_req_list),
@@ -1033,7 +1088,7 @@ def _dependable_element_index_impl(ctx):
             },
         )
 
-        all_lobster_inputs = feat_req_list + comp_req_list + comp_arch_list + comp_test_list + interface_req_list + fm_list + cm_list + rc_list
+        all_lobster_inputs = feat_req_list + comp_req_list + comp_arch_list + comp_test_list + interface_req_list + fm_list + cm_list + rc_list + received_aou_list
         lobster_report_file = subrule_lobster_report(all_lobster_inputs, lobster_config)
         lobster_html_report = subrule_lobster_html_report(lobster_report_file)
 
@@ -1077,6 +1132,10 @@ def _dependable_element_index_impl(ctx):
             lobster_html_report = lobster_html_report,
             lobster_rst_dir = lobster_rst_dir,
         ),
+        ForwardedAoUInfo(
+            own_aou_lobster = own_aou_lobster_depset,
+            chain_forwarded_lobster = chain_forwarded_lobster_depset,
+        ),
         OutputGroupInfo(debug = depset([validation_log])),
     ]
 
@@ -1132,6 +1191,11 @@ _dependable_element_index = rule(
                 default = [],
                 doc = "Dependencies on other dependable element modules (submodules).",
             ),
+            "aou_forwarding": attr.label(
+                allow_single_file = [".yaml", ".yml"],
+                default = None,
+                doc = "Optional YAML file listing received AoU IDs to further-forward to this element's own dependees. Only needed for chain-forwarding.",
+            ),
             "integrity_level": attr.string(
                 mandatory = True,
                 values = _INTEGRITY_LEVELS,
@@ -1159,6 +1223,12 @@ _dependable_element_index = rule(
                 cfg = "exec",
                 doc = "Lobster RST report tool for generating the multi-page Sphinx traceability report.",
             ),
+            "_aou_forwarding_tool": attr.label(
+                default = Label("//bazel/rules/rules_score:aou_forwarding_to_lobster"),
+                executable = True,
+                cfg = "exec",
+                doc = "Tool for filtering received AoU lobster entries based on chain-forwarding YAML.",
+            ),
         },
         **VERBOSITY_ATTR
     ),
@@ -1272,6 +1342,7 @@ def dependable_element(
         integrity_level,
         checklists = [],
         deps = [],
+        aou_forwarding = None,
         maturity = "release",
         sphinx = Label("//bazel/rules/rules_score:score_build"),
         testonly = True,
@@ -1308,6 +1379,9 @@ def dependable_element(
             safety checklists and verification documents.
         deps: Optional list of other module targets this element depends on.
             Cross-references will work automatically.
+        aou_forwarding: Optional label to a YAML file listing received AoU IDs
+            to further-forward to this element's own dependees. Only needed for
+            chain-forwarding received AoUs that this element cannot handle.
         sphinx: Label to sphinx build binary. Default: //bazel/rules/rules_score:score_build
         testonly: If True, only testonly targets can depend on this target.
 
@@ -1337,6 +1411,7 @@ def dependable_element(
         tests = tests,
         deps = deps,
         processed_deps = processed_deps,
+        aou_forwarding = aou_forwarding,
         integrity_level = integrity_level,
         maturity = maturity,
         testonly = testonly,

bazel/rules/rules_score/providers.bzl

@@ -122,11 +122,25 @@ AssumptionsOfUseInfo = provider(
     doc = "Provider for assumptions of use artifacts.",
     fields = {
         "srcs": "Depset of .lobster traceability files collected from all linked requirements targets.",
+        "aou_lobster": "Depset of .lobster traceability files generated from the AoU TRLC sources themselves (used for forwarding to dependees).",
         "requirements": "List of FeatureRequirementsInfo or ComponentRequirementsInfo providers this AoU traces to.",
         "name": "Name of the assumptions of use target.",
     },
 )
 
+ForwardedAoUInfo = provider(
+    doc = """Carries AoU lobster files that dependees must satisfy.
+
+    When a dependable element is listed in another element's `deps`, the
+    dependee receives this element's AoUs and must either link them in its
+    lobster traceability report or further-forward them.
+    """,
+    fields = {
+        "own_aou_lobster": "Depset of .lobster files from this element's own assumptions_of_use (always forwarded to dependees).",
+        "chain_forwarded_lobster": "Depset of .lobster files for received AoUs being further-forwarded (selected via aou_forwarding YAML).",
+    },
+)
+
 ComponentInfo = provider(
     doc = "Provider for component artifacts.",
     fields = {

bazel/rules/rules_score/requirements.in

@@ -1,4 +1,5 @@
 myst-parser
+pyyaml
 readthedocs-sphinx-ext
 rst2pdf
 sphinx