Provide a ReqIF export/import profile for requirements traceability (Risk→ReqIF)

[github-actions]

Motivation

Many automotive organizations use formal requirements tooling and ReqIF for supplier/OEM exchange of requirements and downstream traceability. RDX already targets ISO/SAE 21434 traceability (damage→goals→controls), but there is no machine-tested pathway to export RDX cybersecurity goals, derived cybersecurity requirements, and allocated controls as ReqIF artifacts for handoff to requirements management tools (DOORS Next, Polarion, Jama). A standardized ReqIF profile reduces friction in supplier/OEM workflows and supports Whole Vehicle TARA composition.

Proposed change

1. New "ReqIF profile" module (non-breaking)

   • Add a new document in methodology/ named ReqIF-Profile.md that defines a canonical 1:1 mapping from RDX objects → ReqIF artifacts. The profile specifies:
     • RDX objects exported: riskSet.securityGoals (if present), riskSet.cybersecurityRequirements[] (new array — optional), controls[], riskTreatmentDecisions[], itemDefinition.components[] (if present).
     • Mapping rules for fields: e.g. RDX id -> ReqIF identifier, title -> longName, description -> description, rationale -> specification element. Include mapping of relationships as ReqIF relations.
     • Recommended ReqIF type definitions for common RDX elements (SecurityGoal, CyberReq, Control, TARA-Trace).
     • Versioning strategy: include documentId -> ReqIF source meta and schemaVersion in the ReqIF header; export should include export timestamp and exporter identity.

2. Schema / examples

   • Add examples/rdx-reqif-export-example.json and examples/rdx-reqif-export-example.reqif.xml (human-readable ReqIF export produced by a small tooling script) showing:
     • Export of a securityGoal derived from a damageScenario.
     • Allocation of cybersecurityRequirement to a control with verificationMethod and evidenceRef.
   • Include a small CLI tool tools/rdx_to_reqif.py demonstrating export (standalone, optional) using stdlib only or a minimal dependency.

3. Import guidance

   • To support bidirectional workflows, document recommended import rules: when importing ReqIF back into RDX, create RDX objects with externalIds referencing the originating ReqIF identifier, and set createdBy to the importer tool. Define conflict resolution rules (prefer newest lastModified unless documentId matches).

4. Backwards compatibility

   • No changes to core schema required. The profile is an export/import mapping and uses additionalProperties/externalIds for linking; RDX consumers that ignore ReqIF outputs are unaffected.

References

• ReqIF (Requirements Interchange Format) as a common exchange format for requirements management tools (OASIS). https://www.omg.org/spec/ReqIF/
• ISO/SAE 21434 mapping importance of traceability from goals → controls → evidence. https://saemobilus.sae.org/standards/isosae21434-road-vehicles-cybersecurity-engineering
• Industry practice: OEM/supplier handoffs commonly rely on ReqIF/requirements tools; enabling a canonical mapping reduces integration work (industry sources and best practices). See Auto-ISAC best practices and UNECE R155 traceability expectations. https://automotiveisac.com/best-practice-guides and UNECE R155 overview guidance (INCIBE). https://www.incibe.es/sites/default/files/2024-06/INCIBE-CERT_VEHICLES_CYBERSECURITY_REGULATIONS_2024_GUIDE_v1.0_0.pdf

Acceptance criteria

• Methodology: methodology/ReqIF-Profile.md added with explicit 1:1 mapping tables and import rules (including conflict resolution) and an example mapping for at least: SecurityGoal → ReqIF Requirement, CybersecurityRequirement → ReqIF Requirement with attributes, Control → ReqIF Requirement/Spec.
• Examples: examples/rdx-reqif-export-example.json (RDX source) and examples/rdx-reqif-export-example.reqif.xml (resulting ReqIF) are included and validate syntactically as ReqIF XML.
• Tooling: tools/rdx_to_reqif.py minimal exporter exists and is described in CLAUDE.md with usage instructions.
• Documentation: Update REQUIREMENTS.md to reference the new interoperability pathway and map this feature to existing RDX requirements: RDX-103 (bidirectional conversion support to legacy formats), RDX-075 (whole vehicle TARA composition), and RDX-004 (data quality & governance). If cybersecurityRequirements[] is introduced by a follow-on change, mark it as a new requirement (new requirement).

---

Generated by tools/ai_idea_scout.py via the AI Idea Scout workflow.
Review the proposal, refine the title/body/labels, and close if not desired.