Location
SAFETY_PLAN.md, README.md (Safety & compliance section), HARA.md, and .fusa-hara.json.
Finding
SAFETY_PLAN.md and README.md both describe the whole library as a single ASIL-B / SIL 2 target. But the HARA itself derives two ASIL-A safety goals (SG-03, covering LDF decoding, and SG-04, covering E2E sequence/CRC handling) alongside the ASIL-B goals, from hazards H-05 and H-06. Neither document states an ASIL-decomposition rationale or an explicit "we apply the highest ASIL across the board" policy, so as written the LDF and E2E code paths are simultaneously described as ASIL-A (per the HARA) and covered only by an ASIL-B plan (per SAFETY_PLAN/README). The requirements data also splits into two different ASIL buckets rather than a single uniform one, reinforcing that the mixed classification is real, not a typo. I confirmed at current HEAD that this mismatch is unchanged.
Recommendation
State the classification policy explicitly in SAFETY_PLAN.md and README.md (e.g. "we apply the worst-case ASIL-B envelope to the whole library" or a proper decomposition argument), and make sure the per-goal ASIL is consistent across HARA.md, SAFETY_PLAN.md, and README.md.
Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.
Location
SAFETY_PLAN.md,README.md(Safety & compliance section),HARA.md, and.fusa-hara.json.Finding
SAFETY_PLAN.mdandREADME.mdboth describe the whole library as a single ASIL-B / SIL 2 target. But the HARA itself derives two ASIL-A safety goals (SG-03, covering LDF decoding, and SG-04, covering E2E sequence/CRC handling) alongside the ASIL-B goals, from hazards H-05 and H-06. Neither document states an ASIL-decomposition rationale or an explicit "we apply the highest ASIL across the board" policy, so as written the LDF and E2E code paths are simultaneously described as ASIL-A (per the HARA) and covered only by an ASIL-B plan (per SAFETY_PLAN/README). The requirements data also splits into two different ASIL buckets rather than a single uniform one, reinforcing that the mixed classification is real, not a typo. I confirmed at current HEAD that this mismatch is unchanged.Recommendation
State the classification policy explicitly in SAFETY_PLAN.md and README.md (e.g. "we apply the worst-case ASIL-B envelope to the whole library" or a proper decomposition argument), and make sure the per-goal ASIL is consistent across HARA.md, SAFETY_PLAN.md, and README.md.
Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.