Open interfaces for MOSA programs
Last updated: October 13, 2026 · VerifyPlan 0.4
A Modular Open Systems Approach applies to a program and its system. No tool can be MOSA certified. What a program needs from a tool in its engineering chain is that it does not lock the program in. This page says how VerifyPlan is built for that, and what is not claimed.
Your data stays in open formats
VerifyPlan reads ReqIF, Office Open XML spreadsheets and documents, and CSV. It writes the verification matrix and fix list as XLSX and CSV, findings back into ReqIF for reimport, CI reports as SARIF and JUnit XML, and the full result as JSON with a published JSON Schema. Requirement text is never changed. A program that stops using VerifyPlan keeps every file it produced, readable without it.
Modules you can replace or add
File importers, rules, requirements tool connectors, AI providers and output exporters each sit behind a published, versioned plugin interface. Another supplier can add one as a separately installed package without changing VerifyPlan. Plugins add modules and cannot replace built-in ones, so a competitor's module works alongside the built-in importers and outputs rather than in place of them. A plugin that fails to load stops the run instead of being skipped, and every result records the plugins and versions loaded for it. Programs can also add their own checks in the configuration file with no code.
Documented interfaces under an open license
Fourteen interfaces are documented with their standard, specification and version, from input files to the command line, the Python API and the plugin interface. The JSON Schemas, plugin interface, conformance checks and interface documents are marked for release under Apache-2.0, so a program, its contractors or another supplier can build to them; until that release they are available on request. The rule engine itself is proprietary commercial software.
The DOORS Next live connector uses OSLC, an open standard. The Polarion and Jama live connectors use those vendors' own REST APIs, although Polarion also offers OSLC. They are kept separate from everything else, and export and reimport through ReqIF or spreadsheets cover reading requirements and returning results without them. The optional AI pass, off by default, also uses its providers' own APIs.
Conformance you can check yourself
The conformance checks ship with VerifyPlan. One command runs them offline on every built-in module and every installed plugin, and all built-in modules pass. Live connectors and AI providers are only partly exercised offline, and the checks say so. Because the checks are under the open license, a program or another supplier can verify a module independently.
A profile for interface reviews
The mosa profile adds two warnings to the standard rules: an interface, protocol, data link, API or connector requirement that names no published standard or numbered ICD, and wording such as proprietary or vendor-specific that ties a requirement to one supplier. These are pattern rules that find wording. They do not judge whether a system is modular, and they have not yet been measured on a real program's specification.
StarDrive has scored VerifyPlan against the OUSD(R&E) MOSA Assessment Criteria, criterion by criterion, and a different AI model reviewed those scores adversarially; the scores went down. The scored assessment and its open gaps are available on request.
This is StarDrive's own statement. No government or third-party MOSA assessment of VerifyPlan has been done. VerifyPlan is not a MOSA assessment tool and does not assess a system's architecture. Plugins run with VerifyPlan's permissions, so install only plugins you trust. Programs evaluating VerifyPlan can request the full MOSA statement, interface documents, schemas and data rights position at partners@verifyplan.com.