spar accepts property associations from UNDECLARED property sets silently (rc=0) — a typo'd or invented property is indistinguishable from a satisfied one

[avrabe]

Summary

spar 0.40.0 accepts property associations from property sets that were never declared and are not imported, on both memory and processor declarations, with exit 0 and no diagnostic. Undeclared property sets are invalid AADL — the standard requires a property set … end …; declaration and a with reference. spar silently drops them instead.

The consequence is specific and bad for a source-of-truth model: a typo'd, renamed, or entirely invented property name looks exactly like a satisfied one. The model appears to assert a fact; nothing ever reads it; nothing says so.

Reproduction (spar 0.40.0, via varve run)

Starting from a model that codegens cleanly (jess's hardware/pixhawk6x-rt.aadl, 52 components):

Case A — invented property set on a memory:

memory DTCM
  properties
    Nonsense_Properties::Not_A_Real_Thing => 16#DEADBEEF#;
end DTCM;

$ spar codegen --root Pixhawk6XRT::Pixhawk6XRT.v2a --format wit --output out/ probe.aadl
Generating code for Pixhawk6XRT::Pixhawk6XRT. (52 components)
codegen: wrote 3 files (3 .wit) (format: wit) to out/
rc=0

Case B — invented property set on a processor:

processor implementation FMU_M7.imxrt1176
  properties
    Totally_Fake::Reserved_Registers => "R9 R10 R11 R12";
    Also_Fake::Clock_Speed_Mhz       => 996;
end FMU_M7.imxrt1176;

Same result: rc=0, no diagnostic.

Positive control — the parser really is reading the file

This is not "spar skipped the file". A genuine syntax error in the same declaration is caught precisely:

$ spar codegen ... syntaxerr.aadl
syntaxerr.aadl:55:15: expected SEMICOLON
syntaxerr.aadl:55:15: expected `package` or `property set`
Cannot codegen: parse errors in syntaxerr.aadl
rc=1

So the parser reaches line 55, parses the property block, and chooses to accept an undeclared namespace.

Second observation, reported as an open question rather than a defect

Adding the real, standard properties —

Memory_Properties::Base_Address => 16#20000000#;
Memory_Properties::Memory_Size  => 256 KByte;
Word_Size                       => 4 Bytes;

— produces WIT that is byte-identical to the run without them (diff -rq clean).

I do not think that is a bug: WIT is an interface description language with no memory model, so there is no place for a base address to land. I raise it because it bears directly on pulseengine/synth#1136, where the plan is to make AADL the source of truth for a memory/register layout contract. The AADL→WIT path cannot carry that contract by construction; it needs a different codegen target (linker script, embedder header, synth embedder config). Worth stating in spar's docs so consumers don't discover it the way I did.

Why this matters here

jess owns the RT1176 AADL as a single source of truth. Its memory regions are currently written as comments (memory DTCM end DTCM; -- 256 KB @ 0x20000000) — zero Base_Address properties in 440 lines. I went to convert those comments into real properties, and found I could not distinguish "spar read my property" from "spar ignored my property", because both exit 0 with identical output.

The sharpest version: Totally_Fake::Reserved_Registers => "R9 R10 R11 R12" in Case B is precisely the property synth#1136 proposes adding to express the embedder register contract. spar accepts it today, and reads nothing.

Ask

1. Reject property associations from undeclared/unimported property sets — exit non-zero, name the file:line and the unknown set. Per the CLI conventions baseline, an input error is exit 2.
2. If a permissive mode is genuinely wanted for partial models, make it an explicit opt-in flag rather than the default, so silence is something a model author chose.
3. Document that --format wit cannot carry memory/binding properties, and what target would.

Happy to test a fix against jess's 440-line RT1176 model plus relay's cascade models before you ship it.

Refs pulseengine/synth#1136