@memoarchitect/ontology 0.13.2 → 0.15.1

package/src/core/common/memo_common.sysml

@@ -1,26 +1,29 @@
 // MEMO base hierarchy. Construct-specific foundations: one base per
 // SysML v2 metaclass family (part, action, port, interface, item, use case,
 // requirement, constraint, verification, state, connection), each carrying
-// the shared MEMO semantics. Common inheritance
-// across metaclasses is not portable, so non-part bases re-declare the small
-// identification core and share classification through the metadata defs in
-// memo_core_dimensions.
+// the shared MEMO semantics. Common inheritance across metaclasses is not
+// portable, so classification is shared through the metadata defs in
+// memo_core_dimensions rather than through a superclass.
 //
-// ─── The identification core ────────────────────────────────────────────
-// Every MEMO base below declares the SAME attributes, in the same order,
-// with no exceptions:
+// ─── Where identity lives ───────────────────────────────────────────────
+// Not in these bases. `@MemoIdentity`, below, is the one carrier: a
+// `metadata def` annotates an element of ANY metaclass, so it reaches the
+// action, port, item, requirement and connection families that KerML will
+// not let inherit from a part def. The bases used to re-declare an
+// "identification core" ten times over for exactly that reason, and ten
+// copies of one fact drifted every time (MemoPort carried no sourceReference
+// and no status; MemoRequirement and MemoNeed each invented their own status
+// attribute). One declaration replaced ten.
 //
-//     id, uuid, name, shortDescription, description,
-//     rationale, sourceReference, status
+// `name` and `description` were the last two to go. Neither was ever MEMO's
+// to declare: every SysML element already has a native name, and `doc` is
+// already the native slot for prose. What the bases added was a second place
+// to write the same fact, and 188 of the 1373 elements that set `name` set it
+// to the identifier they were already declared under. Display text is now
+// `@MemoIdentity { label }` and prose is `doc`.
 //
-// They are re-declared per metaclass only because KerML will not let an
-// action, port, item, requirement, or connection inherit from a part def.
-// The duplication is a language constraint, not a design choice — so treat
-// the block as one unit: anything added or removed here is added or removed
-// in all of them. The drift this replaces was real (MemoPort carried no
-// sourceReference and no status; MemoRequirement and MemoNeed each invented
-// their own status attribute), and drift here shows up as an element whose
-// properties panel is missing fields its neighbours have.
+// What remains on a base is domain semantics — `status`, and whatever that
+// metaclass family genuinely needs.
 //
 // `uuid` is the stable technical identity: never displayed, never used as a
 // label, never reused. Authors normally leave it unset and let the compiler
@@ -40,8 +43,8 @@ package memo_core_common {
     // opt-in through `annotatedElement`, and this one declares none. That is
     // what the per-metaclass base definitions below cannot do: KerML will not
     // let an action, port, item, requirement or connection inherit from a part
-    // def, which is why the identification core is currently declared ten
-    // times. Metadata has no such limit, so one declaration replaces ten.
+    // def, which is why the identification core was once declared ten times
+    // over. Metadata has no such limit, so one declaration replaced ten.
     //
     // An element has five identities and they are not interchangeable:
     //
@@ -84,6 +87,16 @@ package memo_core_common {
         attribute sourceReference : String[0..1];
     }
 
+    // Marks a definition as a KIND — an extension of the ontology — rather than a model element.
+    // A project definition that specializes an ontology kind is, structurally, either a new kind
+    // (`AfferaStakeholder`) or one particular thing (`HospitalEpRecordingSystem`); nothing in the
+    // SysML tells the two apart, so the author says which. A marked definition, and what is typed
+    // by it, takes `idPrefix` as the family of its display ids (`<idPrefix>-1`). Anything unmarked
+    // takes the family of the ontology kind it descends from.
+    metadata def MemoKind {
+        attribute idPrefix : String;
+    }
+
     // ─── Single abstract part root ──────────────────────────────────
     // Every structural MEMO concept specializes MemoPart. Identity and
     // traceability are attributes of this one root — MEMO has no separate
@@ -96,18 +109,18 @@ package memo_core_common {
     // (memo_architecture_* xor memo_assurance_*), enforced by CR-ONT-045.
     // The remaining dimensions are orthogonal to the axis: realization stage,
     // cross-cutting concern, and editorial status.
+    // Deliberately NOT declared here: `name` and `description`. A name slot on
+    // a MEMO base is a second spelling of the native name every SysML element
+    // already has, and a description slot is a second spelling of `doc`. Both
+    // were carried for years and both drifted: 1373 elements set `name`, and
+    // 188 of them set it to the identifier they were already declared under.
+    // The display label — free text, legitimately repeating — lives on
+    // `@MemoIdentity { label }`, which annotates any metaclass and so reaches
+    // the behaviours and views that cannot specialize a part. The long prose
+    // lives in `doc`. `shortDescription` on `@MemoIdentity` remains the
+    // one-line register a table cell or chip shows whole; it is a different
+    // density, not a different authority.
     abstract part def MemoPart {
-        // identity
-        attribute name : String;
-        // Two description registers on every MEMO element, because views have
-        // two densities. `shortDescription` is the one-line form a table cell,
-        // matrix header, chip, or diagram node can show whole; `description` is
-        // the full prose a properties panel or a generated document section
-        // renders. A view picks the register that fits — it never truncates
-        // the long one, because a silently clipped sentence in a DHF table is
-        // a defect, not a layout choice.
-        attribute description : String;
-        // traceability
         // editorial status and lifecycle
         attribute status : ElementStatusKind;
         attribute lifecycleState : LifecycleStateKind;
@@ -148,35 +161,16 @@ package memo_core_common {
     }
     abstract part def AnalysisArtifact specializes MemoPart;
 
-    // Document-bound elements add only what a document needs beyond the two
-    // description registers every MemoPart now carries: a title and its place
-    // in a document. The former `shortDescription`/`longDescription` pair is
-    // gone — short is inherited, and `description` IS the long form.
-    // Top-level goal a system or operation exists to fulfil, with its success
-    // criteria and context. Domain layers specialize it; the medical-device
-    // intended use (memo_architecture_operational_structure::IntendedUse) is a
-    // MemoMission. Specializes MemoPart directly — name/description/rationale
-    // already live there, so no DocumentedElement layer is needed.
-    abstract part def MemoMission specializes MemoPart {
-        attribute missionKind : String;
-        attribute successCriteria : String;
-        attribute operationalContext : String;
-    }
-
     // ─── Construct-specific foundations (non-part metaclasses) ───────
 
     // Behavioral foundation: operational activities, tasks, system actions,
     // and interaction steps specialize MemoAction.
     action def MemoAction {
-        attribute name : String;
-        attribute description : String;
         attribute status : ElementStatusKind;
     }
 
     // Boundary feature foundation for typed ports.
     port def MemoPort {
-        attribute name : String;
-        attribute description : String;
         attribute status : ElementStatusKind;
     }
 
@@ -184,8 +178,6 @@ package memo_core_common {
     abstract interface def MemoInterface {
         end source;
         end target;
-        attribute name : String;
-        attribute description : String;
     }
 
     // Single item foundation. Standards, hazards, stored software data, and
@@ -193,8 +185,6 @@ package memo_core_common {
     // exchanged is expressed by its use in a port or flow, not by a second
     // ontology root.
     abstract item def MemoItem {
-        attribute name : String;
-        attribute description : String;
         attribute status : ElementStatusKind;
         // What the item CARRIES, as distinct from what it is called. Removed
         // by `595bfac` while modelling native wrappers; nothing replaced them,
@@ -212,19 +202,14 @@ package memo_core_common {
     }
 
     // Use-case foundation. The domain UseCase adds its goal and actor
-    // references; identity is carried here so use cases do not maintain a
-    // partial hand-written copy of the MEMO identification core.
+    // references; identity is `@MemoIdentity`, as everywhere else.
     abstract use case def MemoUseCase {
-        attribute name : String;
-        attribute description : String;
         attribute status : ElementStatusKind;
     }
 
     // General constraint foundation. Executable consistency rules and
     // reusable quantitative constraints are both native constraint defs.
     abstract constraint def MemoConstraint {
-        attribute name : String;
-        attribute description : String;
         attribute status : ElementStatusKind;
     }
 
@@ -235,8 +220,6 @@ package memo_core_common {
     // say "a need or a requirement" with one type name — before it, every end
     // that had to accept both was left untyped.
     abstract requirement def MemoRequirementElement {
-        attribute name : String;
-        attribute description : String;
         attribute status : ElementStatusKind;
         attribute statement : String;
     }
@@ -250,27 +233,37 @@ package memo_core_common {
         attribute acceptanceCriteria : String;
     }
 
+    // Top-level goal a system or operation exists to fulfil, with its success
+    // criteria and context. Domain layers specialize it; the medical-device
+    // intended use (memo_architecture_operational_structure::IntendedUse) is a
+    // MemoMission. It is a `requirement def` because a mission is the top
+    // obligation everything below it derives from, not a structural thing —
+    // it was a `part def` under MemoPart. The prose a document renders is
+    // `doc`, and the one-line register a table cell shows is
+    // `@MemoIdentity`'s `shortDescription`.
+    abstract requirement def MemoMission :> MemoRequirementElement {
+        attribute missionKind : String;
+        attribute successCriteria : String;
+        attribute operationalContext : String;
+    }
+
     // Verification-case foundation. A SysML v2 verification case is a behaviour
     // (it checks requirements), and KerML forbids a behaviour from specializing
-    // the part-based MemoPart — so, like MemoAction, it re-declares the small
-    // identification core rather than inheriting it.
+    // the part-based MemoPart — so, like MemoAction, it stands on its own and
+    // takes its identity from `@MemoIdentity`.
     verification def MemoVerificationCase {
-        attribute name : String;
-        attribute description : String;
         attribute status : ElementStatusKind;
     }
 
     // State foundation. SysML v2 states (state machines and their mode states)
     // are behaviours, so — like MemoAction and MemoVerificationCase — they
-    // re-declare the identification core instead of specializing MemoPart
+    // cannot specialize MemoPart and are annotated instead.
     // Transitions stay part-based to keep their traceable safety
     // attributes (id, sourceReference, priority, sameStepCritical).
     enum def StateKind { enum mode; enum logical; }
 
     state def MemoState {
         attribute stateKind : StateKind;
-        attribute name : String;
-        attribute description : String;
         attribute status : ElementStatusKind;
         attribute modeKind : String;
         attribute entryCondition : String;

package/src/core/enumerations/memo_enumerations.sysml

@@ -89,6 +89,41 @@ package memo_core_enumerations {
         enum mechanical;
         enum fluidic;
     }
+    // How a physical interface encodes what it carries. InterfaceKind says
+    // WHAT crosses (data, control, power); this says HOW the signal is
+    // represented, which decides what has to be specified about it:
+    enum def SignalingKind {
+        doc /* Continuous value: the quantity IS the information (a 0.5-4.5 V
+             * sensor output, a 4-20 mA loop). Needs a range, accuracy and
+             * noise bound. */
+        enum analog;
+        doc /* Encoded symbols: the information is bits, serial or parallel,
+             * framed by a protocol (SPI, CAN, Ethernet). Needs a protocol,
+             * a bit rate and a logic level. */
+        enum digital;
+        doc /* One level means one of two states (a switch contact, an
+             * enable line). Needs a logic level and a debounce, not a
+             * protocol. */
+        enum discrete;
+        doc /* The information is in the timing of edges: PWM duty, step and
+             * direction, frequency output. Needs a frequency range and a
+             * resolution. */
+        enum pulse;
+        doc /* Power transfer, not signalling: the quantity is delivered for
+             * its energy. Needs a rating, not a protocol. */
+        enum powerTransfer;
+    }
+    // The physical medium a hardware connection runs over.
+    enum def PhysicalMediumKind {
+        enum electrical;
+        enum fluidic;
+        enum pneumatic;
+        enum mechanical;
+        enum optical;
+        enum acoustic;
+        enum thermal;
+        enum radioFrequency;
+    }
     // AADL (SAE AS5506) port category. Distinct from InterfaceKind, which says
     // WHAT crosses a port; this says HOW it is delivered, and the difference is
     // safety-relevant: when a deadline is missed a `data` port overwrites the
@@ -135,12 +170,12 @@ package memo_core_enumerations {
     //
     //   Interface.direction / .directionality   (interface def)
     //   LogicalConnector.direction              (connection def)
-    //   LogicalExchange.direction               (part def)
-    //   ComponentExchange.direction             (part def)
+    //   ComponentExchange.direction             (interface def)
     //   OperationalInteraction.direction        (part def)
     //
-    // Deleting it would have cost those five their direction; the reinvention
-    // was only ever the port case.
+    // Deleting it would have cost those four their direction; the reinvention
+    // was only ever the port case. `LogicalExchange.direction` was a fifth and
+    // went when the exchange became a flow between ports (2026-09-25).
     enum def DirectionKind {
         enum input;
         enum output;
@@ -180,11 +215,11 @@ package memo_core_enumerations {
         enum formalProof;
         enum modelChecking;
     }
-    // The submission regime a project targets, and the regimes a standard has
-    // standing in. This is the axis that decides which clauses a project is
-    // required to claim: `required(project)` is the clauses of every standard
-    // whose `appliesToRegime` intersects the regimes the project's
-    // ProjectMethodBinding declares.
+    // The submission regime a model targets, and the regimes a standard has
+    // standing in. This is the axis that decides which clauses a model is
+    // required to claim: `required(model)` is the clauses of every standard
+    // whose `appliesToRegime` intersects the regimes the model's
+    // ModelMethodBinding declares.
     //
     // The members are spelled as the regulatory designations themselves rather
     // than in the lowerCamel convention the rest of this file uses. All 44 DHF
@@ -367,6 +402,33 @@ package memo_core_enumerations {
         enum assurance;
         enum methodology;
     }
+    // Why a rule exists. `modelling` rules keep a model well formed whatever the
+    // product is. `medicalDevice` rules exist because a medical-device standard or
+    // guidance asks for the thing they check, and each should say which clause it
+    // enforces (`#EnforcesClause dependency from <rule> to <clause>`). `organisation` rules are a user's own.
+    enum def RuleDomainKind {
+        enum modelling;
+        enum medicalDevice;
+        enum organisation;
+    }
+    // How firmly the rule's source asks for what it checks, separate from the
+    // severity a finding carries and from how far the rule may be tailored. A
+    // `required` rule enforces a clause that says "shall"; a `recommended` one a
+    // clause that says "should", or a practice the ontology holds as sound;
+    // `bestPractice` is advice with no clause behind it. A rule that states no
+    // severity takes one from this: error, warning, info.
+    enum def RuleObligationKind {
+        enum required;
+        enum recommended;
+        enum bestPractice;
+    }
+    // How a relation places elements in a workspace; see
+    // memo_core_relationships_workspace_membership.
+    enum def WorkspaceMembershipKind {
+        enum sourceFollowsTarget;
+        enum targetFollowsSource;
+        enum neither;
+    }
     enum def RuleDispositionKind {
         enum enabled;
         enum disabled;
@@ -391,6 +453,19 @@ package memo_core_enumerations {
         enum verificationStage;
         enum evidence;
         enum documents;
+        // The stages of the default method's steps (plan O11), beyond the six above.
+        enum operational;
+        enum functional;
+        enum logical;
+        enum physical;
+        enum humanFactors;
+        enum security;
+        enum release;
+    }
+    // The level a method step is worked at: the system of systems, or one system.
+    enum def MethodLevelKind {
+        enum systemOfSystems;
+        enum system;
     }
     enum def ThreatCategoryKind {
         enum spoofing;
@@ -426,6 +501,15 @@ package memo_core_enumerations {
         enum auditRecord;
         enum safetyCriticalFunction;
     }
+    // How much an asset needs confidentiality, integrity or availability
+    // protection. A rating, not prose, so assets can be compared and a rule
+    // can select the ones whose integrity need is high.
+    enum def SecurityNeedKind {
+        enum low;
+        enum medium;
+        enum high;
+        enum veryHigh;
+    }
     enum def ViewOutputKind {
         enum diagram;
         enum table;

package/src/core/relationships/memo_relationships.sysml

@@ -67,6 +67,23 @@ package memo_core_relationships {
         attribute isUnique : Boolean;
     }
 
+    // ─── Typed dependencies ─────────────────────────────────────────────
+    //
+    // A link whose ends are not both usages cannot be a `connection def`: a
+    // connection joins features, and a `ref` cannot point at a definition. SysML
+    // already has the construct for a client and a supplier that are any element,
+    // the Dependency (SysML-textual-bnf.kebnf:51-59), and a metadata prefix
+    // names what kind of dependency it is (`#RealizesFeature dependency from a to
+    // b;`, PrefixMetadataAnnotation, kebnf:52). A `metadata def` that specializes
+    // this marker declares such a link as a MEMO relation: it joins the
+    // relationship registry under camelCase(name), is navigated like any other
+    // relation, and needs a row in the workspace-membership table. A metadata
+    // def that does not specialize it (`EnforcesClause`) is plain metadata on a
+    // dependency and builds no relation. Source is the client, target the
+    // supplier. Ends are untyped: what a relation may join is a rule's to say
+    // (see the note above on metaclass-neutral ends).
+    abstract metadata def MemoTypedDependency;
+
     // ─── Metaclass-neutral ends (Track A0) ──────────────────────────────
     //
     // An end is left UNTYPED (`:>> source` / `:>> target`) wherever its
@@ -148,17 +165,6 @@ package memo_core_relationships {
     // the tree (same free-deletion shape R10-S5 found for `rationale`), so
     // there was no content to carry forward.
 
-    connection def ThreatenedBy :> MemoRelationship {
-        attribute threatRole : String;
-        end protectedAsset : MemoPart :>> source;
-        end realizedThreat : RequirementDriver :>> target;
-    }
-    abstract connection threatenedByLinks : ThreatenedBy[*];
-    metadata def <threatenedBy> ThreatenedByMetadata :> SemanticMetadata {
-        :> annotatedElement : SysML::ConnectionDefinition;
-        :> annotatedElement : SysML::ConnectionUsage;
-        :>> baseType = threatenedByLinks meta SysML::Usage;
-    }
     connection def DerivesCyberRequirement :> MemoRelationship {
         end sourceThreatOrRisk : RequirementDriver :>> source;
         end targetRequirement : MemoRequirementElement :>> target;