Enforce LSER and ASER subprogram-call protocol restrictions 🤖

[lwrage]

Summary

The predeclared Behavior_Properties::Subprogram_Call_Protocol definition matches AS5506/3 Rev. A D.8, but validation does not enforce its LSER/ASER legality rules. LSER and ASER may not be combined with a synchronous called-subprogram type or with out/in-out parameters.

No BA or core validator check consuming Subprogram_Call_Protocol was found in the audited path.

Reproduction

This issue comes from the source audit in ba/doc/conformance.md; no additional runtime reproduction was performed. ba_example_007.aadl describes legal protocol usage in comments but does not provide negative legality coverage.

Expected behavior

For both LSER and ASER, report a provides-subprogram-access protocol association whose called subprogram is synchronous or has out/in-out parameters. Preserve HSER as the default and accept valid semisynchronous signatures.

Relevant code

• ba/org.osate.ba.contrib/resources/properties/behavior_properties.aadl.
• ba/org.osate.ba/src/org/osate/ba/analyzers/AadlBaRulesCheckersDriver.java.
• ba/org.osate.ba/examples/standard_examples/ba_example_007.aadl.

[lwrage]

Instance-model implementation boundary

Behavior_Properties::Subprogram_Call_Protocol is an effective property on a particular subprogram-access instance. A contained property association can make the same declarative access HSER in one component instance and LSER or ASER in another.

The called-subprogram signature and the synchronous versus semisynchronous structural facts can be resolved declaratively. Choosing the active protocol and deciding whether that combination is legal must run on the corresponding access FeatureInstance. A regression should instantiate the same access declaration twice, override the protocol for one instance through a contained association, and require different results.