x-FuSa spec §9.2 tara: no closed enum or combination table for impact/risk (unlike attackFeasibility or HARA's ASIL table) #87

Context

Implementing x-FuSa spec v1.13.0/v1.14.0 conformance in rust-FuSa (SoundMatt/rust-FuSa#37), against docs/x-fusa-spec.md §9.2 tara.

The gap

§9.2's tara.json schema (and §1.6.1/§1.6.2) is precise almost everywhere it matters for cross-tool interop:

• attackFeasibility has a closed enum stated explicitly: high|medium|low|very-low (ISO 21434 attack-potential rating).
• treatment has a closed enum stated explicitly: mitigate|accept|transfer|avoid.
• HARA's risk.asil derivation has a citable, reproducible source: ISO 26262-3:2018 Table 4, S x E x C -> ASIL, spelled out well enough that two independent implementations should agree (I found and fixed a real discrepancy in rust-FuSa's own pre-existing approximation of this table while doing this work — happy to open a separate note on that if useful, it was a local bug not a spec issue).

impact and risk have neither:

• "impact": { "safety": "medium", "financial": "low", "operational": "low", "privacy": "low" } is documented as "SFOP categories (ISO 21434 Clause 15.7)" but the spec doesn't state what the four axes' value domain actually is. ISO/SAE 21434's own Clause 15 impact rating uses Severe / Major / Moderate / Negligible, not high/medium/low — a materially different vocabulary from attackFeasibility's high|medium|low|very-low.
• risk is documented as "derived from attackFeasibility × the highest SFOP impact" but there's no combination table (analogous to HARA's Table 4) saying how a feasibility level and an impact level combine into a risk level — and that's doubly ambiguous if the impact axes and the feasibility axis don't even share a vocabulary.

Why this matters for interop

This is exactly the kind of per-tool guess the spec exists to prevent (§9.2's own framing: "so a cross-language aggregate is unambiguous"). If rust-FuSa picks high|medium|low for impact and some other x-FuSa tool picks the literal ISO 21434 Severe|Major|Moderate|Negligible wording, a FuSaOps-side TARA aggregate (or a future tara --min-coverage-style cross-tool roll-up) can't compare or sort risk levels across tools without a translation table nobody has written down.

What rust-FuSa did in the meantime

Rather than block on this, rust-FuSa v0.3.11 reuses the attackFeasibility domain (high|medium|low|very-low) for all four SFOP impact axes and for risk, and derives risk as max(attackFeasibility, max(SFOP impacts)) by ordinal rank. This is called out in a code comment (src/cmd/tara.rs) as a documented local choice pending upstream clarification, not a claim that it's the canonical answer.

Ask

Could §9.2 get an explicit value domain for impact's four axes (either adopt high|medium|low|very-low for consistency with attackFeasibility, or specify the literal ISO 21434 wording and a mapping) and a stated (or at least SHOULD-recommended) combination rule for risk, the way §1.2.5 cites ISO 26262-3 Table 4 for HARA's ASIL? Happy to adjust rust-FuSa's implementation to match whatever's decided.

Referencing SoundMatt/rust-FuSa#37 and docs/x-fusa-spec.md §9.2 (the tara subsection).