npm - @memoarchitect/ontology - Versions diffs - 0.13.2 → 0.15.1 - Mend

@memoarchitect/ontology 0.13.2 → 0.15.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (315) hide show

package/src/rules/ontology/ontology_invariants.sysml CHANGED Viewed

@@ -11,20 +11,146 @@ package memo_rules_ontology {
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
+    private import memo_artifacts_standards_traceability::EnforcesClause;
+    private import memo_artifacts_standards_iec_62366_1::*;
+    private import memo_artifacts_standards_iso_13485::*;
     // ─── Structure ───────────────────────────────────────────────────────
     constraint def ContainmentAcyclicRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-001"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "Model";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Containment/composition relations (Composes) must form no cycles.";
         attribute predicateExpression = "acyclic(composes)";
         constraint { true }
     }
+    constraint def ModelDeclaresSystemRule :> MemoConsistencyRule {
+        @MemoIdentity { :>> providedId = "CR-ONT-084"; }
+        // Tailorable, not an invariant: a library or a model that only extends another has no
+        // system of its own, and its method says so with a rationale.
+        attribute tailoring = RuleTailoringKind::methodology;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
+        attribute appliesTo = "Model";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "A model declares at least one System (a part def that specializes System). A workspace is the closure of what is linked to the definition of a System, so a model with only a usage typed by System, or none, has no workspace: nothing can be scoped, and every element is Unassigned.";
+        attribute predicateExpression = "allOfKind('System')->exists(isDefinition == 'true')";
+        constraint { true }
+    }
+    // ─── Use case scope (plan O8) ─────────────────────────────────────────
+    //
+    // A use case is at the level of its subject: one whose subject is a SystemOfSystems is a clinical
+    // procedure, one whose subject is a System is a system use case. There is no kind for either; the
+    // level is read from the subject, and the subject from `hasSubject`. A use case with no subject
+    // is at neither level and neither rule judges it.
+    constraint def SosUseCaseIncludesSystemUseCaseRule :> MemoConsistencyRule {
+        @MemoIdentity { :>> providedId = "CR-ONT-085"; }
+        attribute tailoring = RuleTailoringKind::methodology;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
+        attribute appliesTo = "UseCase";
+        attribute severity = RuleSeverityKind::warning;
+        attribute rationaleText = "A use case whose subject is a system of systems is made of what its systems do: it includes at least one use case whose subject is a system.";
+        attribute predicateExpression = "not(downstream(hasSubject)->exists(conformsTo(SystemOfSystems))) or downstream(includesStep)->exists(downstream(hasSubject)->exists(conformsTo(System)))";
+        constraint { true }
+    }
+    constraint def SystemUseCaseIncludedRule :> MemoConsistencyRule {
+        @MemoIdentity { :>> providedId = "CR-ONT-086"; }
+        attribute tailoring = RuleTailoringKind::methodology;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
+        attribute appliesTo = "UseCase";
+        attribute severity = RuleSeverityKind::warning;
+        attribute rationaleText = "A use case whose subject is a system is included by a use case of the system of systems, or says it stands alone (standalone = true).";
+        attribute predicateExpression = "not(downstream(hasSubject)->exists(conformsTo(System))) or upstream(includesStep)->size() >= 1 or attributes.standalone == 'true'";
+        constraint { true }
+    }
+    // A system is a boundary (plan O16). The workspace closure never reaches another system or the
+    // system of systems, and drops such a link silently; this rule reports it. Evaluated by the
+    // workspace evaluator because it needs what each workspace holds, which no predicate can say:
+    // the subject is the element inside a system that is typed by, or relates to, a System-kind or
+    // SystemOfSystems-kind element outside it. The system of systems' own references to its systems
+    // are what it is for and are not findings.
+    constraint def SystemBoundaryRule :> MemoConsistencyRule {
+        @MemoIdentity { :>> providedId = "CR-ONT-087"; }
+        attribute tailoring = RuleTailoringKind::methodology;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
+        attribute evaluator = "workspace";
+        attribute appliesTo = "Model";
+        attribute severity = RuleSeverityKind::warning;
+        attribute rationaleText = "A system does not reference another system or the system of systems from inside itself. Two systems meet at an interface the system of systems owns.";
+        constraint { true }
+    }
+    // ─── Release selections (plan O14) ────────────────────────────────────
+    //
+    // A release record selects features (`#SelectsFeature`), and through them the variants that realize
+    // them (`#RealizesFeature`, variant to feature). The rules read a record's selection by navigation;
+    // `selectRelease` (memo-tools `model/variability.ts`) is the same join in code and a test holds the
+    // two equal. `upstream` / `downstream` are transitive and directed; the bare relation name is one
+    // hop in both directions, which is what the symmetric `excludesFeature` needs (a transitive reading
+    // would make A and C exclusive because each excludes B).
+    constraint def ReleaseSelectsProposedVariantRule :> MemoConsistencyRule {
+        @MemoIdentity { :>> providedId = "CR-ONT-088"; }
+        attribute tailoring = RuleTailoringKind::methodology;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
+        attribute appliesTo = "ReleaseRecord";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "An approved or released record contains what it selects. A feature whose variant is still proposed has no approved design behind it, so a record that has passed approval cannot select it. A record with no status, or one still being drafted, is not judged.";
+        attribute predicateExpression = "not(attributes.status == 'ElementStatusKind::approved' or attributes.status == 'ElementStatusKind::released') or downstream(selectsFeature)->forAll(upstream(realizesFeature)->forAll(attributes.status != 'ElementStatusKind::proposed'))";
+        constraint { true }
+    }
+    constraint def ReleaseSelectionConsistentRule :> MemoConsistencyRule {
+        @MemoIdentity { :>> providedId = "CR-ONT-089"; }
+        // An invariant: requires and excludes are the family's own declarations, and a selection that
+        // breaks them contradicts the model, whatever the record's status.
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
+        attribute appliesTo = "ReleaseRecord";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "A record selects a set of features that satisfies the family's rules: every feature a selected feature requires is selected too, and no two selected features exclude each other.";
+        attribute predicateExpression = "downstream(selectsFeature)->forAll(downstream(requiresFeature)->forAll(upstream(selectsFeature)->exists(id == subject.id)) and excludesFeature->forAll(upstream(selectsFeature)->forAll(id != subject.id)))";
+        constraint { true }
+    }
+    // Every variation point of the item a record is a release of is resolved to ONE variant, and no
+    // variation point anywhere has two. Two halves, one rule:
+    //   at most one  -- any record, any status: a record that selects the features of two variants
+    //                   of one point describes no product. Needs no item.
+    //   exactly one  -- an approved or released record that is `#ReleaseOf` an item: each variation
+    //                   point the item owns (`composes`, transitive, so an SoS record judges the
+    //                   points of the SoS and each system record those of its own system; ownership
+    //                   does not cross typing) has one selected variant. A draft is allowed to be
+    //                   unfinished, as in CR-ONT-088.
+    // Not asked of the exactly-one half: a point none of whose variants realizes a feature (a
+    // release can neither select nor drop its variants, so it cannot resolve it), a point owned by
+    // a variant the record does not select (it is not in the product), and a record with no
+    // `#ReleaseOf` (no item to judge, a limit; the at-most-one half still runs).
+    // `selectRelease` (memo-tools `model/variability.ts`) is the same definition in code and a test
+    // holds the two equal. Limit: `variant` is followed transitively, so a variant that is itself a
+    // variation point counts its own variants against its parent's.
+    constraint def ReleaseSelectsOneVariantRule :> MemoConsistencyRule {
+        @MemoIdentity { :>> providedId = "CR-ONT-090"; }
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
+        attribute appliesTo = "ReleaseRecord";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "A variation point is one choice. A record that selects the features of two of its variants builds both, and an approved or released record of an item that selects none of a variation point's variants builds neither, so it describes no single product.";
+        attribute predicateExpression = "downstream(selectsFeature)->forAll(upstream(realizesFeature)->forAll(upstream(variant)->forAll(downstream(variant)->select(downstream(realizesFeature)->exists(upstream(selectsFeature)->exists(id == subject.id)))->size() <= 1))) and (not(attributes.status == 'ElementStatusKind::approved' or attributes.status == 'ElementStatusKind::released') or downstream(releaseOf)->forAll(downstream(composes)->select(attributes.isVariation == 'true')->forAll(not(downstream(variant)->exists(downstream(realizesFeature)->notEmpty())) or upstream(composes)->exists(upstream(variant)->notEmpty() and downstream(realizesFeature)->notEmpty() and not(downstream(realizesFeature)->exists(upstream(selectsFeature)->exists(id == subject.id)))) or downstream(variant)->select(downstream(realizesFeature)->exists(upstream(selectsFeature)->exists(id == subject.id)))->size() == 1)))";
+        constraint { true }
+    }
     constraint def NestedPartConnectedRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "AR-IBD-001"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         // Internal-block connectivity is a structural-architecture concern, so
         // the subject is the structural component — not every MemoPart. UI
         // elements, captured evidence, and review comments nest in compositions
@@ -48,6 +174,8 @@ package memo_rules_ontology {
     constraint def RuntimeTracesToModuleRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-011"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "SoftwareComponent";
         attribute severity = RuleSeverityKind::warning;
         attribute rationaleText = "Every runtime component must trace to a module-view definition (Realizes).";
@@ -56,7 +184,9 @@ package memo_rules_ontology {
     }
     constraint def PatientContactCharacterizedRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-032"; }
-        attribute tailoring = RuleTailoringKind::invariant;
+        attribute tailoring = RuleTailoringKind::assurance;
+        attribute domain = RuleDomainKind::medicalDevice;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "PhysicalComponent";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Patient-contact components must identify contact nature and duration (ISO 10993-1).";
@@ -68,31 +198,50 @@ package memo_rules_ontology {
     constraint def SafetyCriticalFunctionVerifiedRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-040"; }
-        attribute tailoring = RuleTailoringKind::invariant;
+        attribute tailoring = RuleTailoringKind::assurance;
+        attribute domain = RuleDomainKind::medicalDevice;
+        attribute obligation = RuleObligationKind::required;
+        // To confirm: inferred from the clause scope; confirm.
         attribute appliesTo = "MemoFunction";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Safety-critical functions (criticality high or catastrophic) must trace to at least one verification case.";
         attribute predicateExpression = "not(criticality == 'high' or criticality == 'catastrophic') or verifiedBy->size() >= 1";
         constraint { true }
     }
+    #EnforcesClause dependency from SafetyCriticalFunctionVerifiedRule to iso13485::iso13485Clause7::iso13485Clause7_3::iso13485Clause7_3_6;
     constraint def CriticalTaskValidatedRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-041"; }
-        attribute tailoring = RuleTailoringKind::invariant;
-        attribute appliesTo = "OperativeAction[criticality=high]";
+        attribute tailoring = RuleTailoringKind::assurance;
+        attribute domain = RuleDomainKind::medicalDevice;
+        attribute obligation = RuleObligationKind::required;
+        // To confirm: inferred from the clause scope; the FDA human-factors guidance it also cites is not in the library yet.
+        // The selector used to be `[criticality=high]`, which left the
+        // catastrophic tasks — the most critical — outside the rule while the
+        // predicate still spelled out the catastrophic case. The criticality
+        // test lives in the predicate alone now. `testedByUsability` is the
+        // relation the human-factors package declares for exactly this link;
+        // reading only `validates` meant a task linked the way the ontology
+        // asks was still reported.
+        attribute appliesTo = "OperativeAction";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Critical tasks (criticality high or catastrophic) must trace to usability validation (FDA HF guidance; IEC 62366-1 summative evaluation).";
-        attribute predicateExpression = "not(criticality == 'high' or criticality == 'catastrophic') or validates->size() >= 1";
+        attribute predicateExpression = "not(criticality == 'high' or criticality == 'catastrophic') or testedByUsability->size() >= 1 or validates->size() >= 1";
         constraint { true }
     }
+    #EnforcesClause dependency from CriticalTaskValidatedRule to iec62366_1::iec62366_1Clause5::iec62366_1Clause5_9;
     constraint def UseErrorTracesToHazardRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-042"; }
-        attribute tailoring = RuleTailoringKind::invariant;
+        attribute tailoring = RuleTailoringKind::assurance;
+        attribute domain = RuleDomainKind::medicalDevice;
+        attribute obligation = RuleObligationKind::required;
+        // To confirm: inferred from the clause scope; confirm.
         attribute appliesTo = "UseError";
         attribute severity = RuleSeverityKind::warning;
         attribute rationaleText = "Safety-relevant use errors (severity serious or worse) must trace to a hazard.";
         attribute predicateExpression = "not(severity == 'serious' or severity == 'critical' or severity == 'catastrophic') or causes->size() >= 1 or tracesRisk->size() >= 1";
         constraint { true }
     }
+    #EnforcesClause dependency from UseErrorTracesToHazardRule to iec62366_1::iec62366_1Clause5::iec62366_1Clause5_3;
     // ─── Relation end conformance (Track A0) ─────────────────────────────
     //
     // These rules carry the constraints that `connection def` end TYPES used to
@@ -131,6 +280,8 @@ package memo_rules_ontology {
     constraint def SatisfiedBySourceKindRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-060"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "Model";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Only a requirement or a need is satisfied by something. The source end of SatisfiedBy must conform to MemoRequirementElement.";
@@ -140,6 +291,8 @@ package memo_rules_ontology {
     constraint def SatisfiedByTargetKindRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-061"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "Model";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "A requirement is satisfied by a designed part, a behaviour, or a port. Never by another requirement or by a document.";
@@ -149,6 +302,8 @@ package memo_rules_ontology {
     constraint def VerifiedByTargetKindRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-062"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "Model";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "A verification case verifies a requirement, a risk control, an architecture element, a behaviour, or a port — something a test can be run against. Not a view, not an evidence record.";
@@ -158,24 +313,30 @@ package memo_rules_ontology {
     constraint def AllocatedToSourceKindRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-063"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "Model";
         attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "Allocation runs from a function or a behaviour to where it runs. The source end of AllocatedTo is a part or an action.";
-        attribute predicateExpression = "sourcesOf(allocatedTo)->forAll(conformsTo(MemoPart) or construct == 'action')";
+        attribute rationaleText = "Allocation runs from a function or a behaviour to where it runs. The source end of AllocatedTo is a part, an action, or a functional exchange (allocated to a component exchange, as ARCADIA allocates one).";
+        attribute predicateExpression = "sourcesOf(allocatedTo)->forAll(conformsTo(MemoPart) or construct == 'action' or conformsTo(FunctionalExchange))";
         constraint { true }
     }
     constraint def AllocatedToTargetKindRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-064"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "Model";
         attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "A function is allocated to a part — including a system or actor — as ARCADIA System Analysis requires.";
-        attribute predicateExpression = "targetsOf(allocatedTo)->forAll(conformsTo(MemoPart))";
+        attribute rationaleText = "A function is allocated to a part — including a system or actor — as ARCADIA System Analysis requires; a functional exchange is allocated to a component exchange.";
+        attribute predicateExpression = "targetsOf(allocatedTo)->forAll(conformsTo(MemoPart) or conformsTo(ComponentExchange))";
         constraint { true }
     }
     constraint def ComposesParentKindRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-065"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "Model";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "A whole in a decomposition is a part, a behaviour, or a state machine. A requirement does not compose anything.";
@@ -185,6 +346,8 @@ package memo_rules_ontology {
     constraint def ComposesChildKindRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-066"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "Model";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "A part in a decomposition is a part, a behaviour, a state, or a port — a component owns its ports, and a workflow owns its steps.";
@@ -194,6 +357,8 @@ package memo_rules_ontology {
     constraint def PrecedesEndKindRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-067"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "Model";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Precedence orders things that happen: parts or behaviours, at both ends.";
@@ -203,6 +368,8 @@ package memo_rules_ontology {
     constraint def PerformsPerformerKindRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-068"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "Model";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "A performer is an operational entity, an actor, or a system action — a part or a behaviour. The end's own documentation said 'or system action' while its MemoPart type forbade one.";
@@ -212,6 +379,8 @@ package memo_rules_ontology {
     constraint def BindsToInterfaceEndKindRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-070"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "Model";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "A port binds to an interface. The bound end is an interface definition, which the former InterfaceElement-typed end could not hold at all — Interface specializes MemoInterface, an interface def, not a part.";
@@ -221,34 +390,45 @@ package memo_rules_ontology {
     constraint def CrossesTrustBoundaryEndKindRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-071"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "Model";
         attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "A boundary is a boundary element or a port; what crosses it is an asset or an exchange item.";
-        attribute predicateExpression = "sourcesOf(crossesTrustBoundary)->forAll(conformsTo(InterfaceElement) or construct == 'port') and targetsOf(crossesTrustBoundary)->forAll(conformsTo(MemoPart) or construct == 'item')";
+        attribute rationaleText = "A boundary is a boundary element or a port; what crosses it is an asset, an item, or an exchange: an interface or a flow.";
+        attribute predicateExpression = "sourcesOf(crossesTrustBoundary)->forAll(conformsTo(InterfaceElement) or construct == 'port') and targetsOf(crossesTrustBoundary)->forAll(conformsTo(MemoPart) or construct == 'item' or construct == 'interface' or construct == 'flow')";
         constraint { true }
     }
-    // CR-ONT-002's replacement. ComponentExchange's endpoints are `ref`
-    // features, not links, and the builder projects them as element-ID STRINGS
-    // in the attribute map (a §13.3 string pseudo-reference) — so they cannot be
-    // reached with sourcesOf/targetsOf. They are resolved here by looking the id
-    // up in the kind extent, which is the same statement made the long way.
+    // CR-ONT-002's replacement, now asked of the edge. A ComponentExchange is
+    // an interface, so its ends are the ports it connects, and `sourceEnd` /
+    // `targetEnd` are those elements. The compiler does not check this:
+    // a compiler accepts a part at an interface end even when the definition types
+    // the ends.
+    //
+    // It used to read `sourceEndpoint` refs, whose dotted values the builder
+    // cut to their first segment, and compare them as strings, which drop
+    // everything up to the last `::`. On gpca-pump that matched the enclosing
+    // device for 44 of 46 exchanges and passed.
     constraint def ComponentExchangeSourceEndpointKindRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-072"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "ComponentExchange";
         attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "An exchange starts at a component or at a boundary port. Stating it as a rule is what let the endpoint refs stop being MemoPart-typed, which is what lets PhysicalPort and SoftwarePort become port defs.";
-        attribute predicateExpression = "attributes.sourceEndpoint == '' or allOfKind('MemoPart')->exists(id == subject.attributes.sourceEndpoint) or allOfKind('InterfaceElement')->exists(id == subject.attributes.sourceEndpoint) or allOfKind('MemoPort')->exists(id == subject.attributes.sourceEndpoint)";
+        attribute rationaleText = "A component exchange starts at a port. An exchange that starts at a component names no boundary, so nothing says where on the component it enters or leaves, and no port can carry its item type or direction.";
+        attribute predicateExpression = "sourceEnd->size() == 1 and sourceEnd->forAll(construct == 'port')";
         constraint { true }
     }
     constraint def ComponentExchangeTargetEndpointKindRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-073"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "ComponentExchange";
         attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "An exchange ends at a component or at a boundary port, on the same grounds as CR-ONT-072.";
-        attribute predicateExpression = "attributes.targetEndpoint == '' or allOfKind('MemoPart')->exists(id == subject.attributes.targetEndpoint) or allOfKind('InterfaceElement')->exists(id == subject.attributes.targetEndpoint) or allOfKind('MemoPort')->exists(id == subject.attributes.targetEndpoint)";
+        attribute rationaleText = "A component exchange ends at a port, on the same grounds as CR-ONT-072.";
+        attribute predicateExpression = "targetEnd->size() == 1 and targetEnd->forAll(construct == 'port')";
         constraint { true }
     }
@@ -261,6 +441,8 @@ package memo_rules_ontology {
     constraint def ComponentFunctionAllocatedRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-074"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "ComponentFunction";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "A component function is the responsibility of exactly one component, and AllocatedTo is what names it. A component function allocated nowhere is a responsibility nobody has accepted; one allocated twice is a responsibility nobody owns. A system-level responsibility with no single owner is a SystemFunction, which allows that.";
@@ -270,6 +452,8 @@ package memo_rules_ontology {
     constraint def FunctionDecomposesIntoFunctionsRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-075"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "MemoFunction";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "The functional chain decomposes functions into functions. A function composed of a component, or owned by one, is confusing allocation with decomposition — the component is named by AllocatedTo, never by Composes.";
@@ -294,7 +478,12 @@ package memo_rules_ontology {
     //
     // They read the `composes` edge, which the builder synthesizes from native
     // nesting, so they cover the nesting spelling and the retired connection
-    // form identically.
+    // form identically. They read it DOWNSTREAM: a bare relation name navigates
+    // both ways, so `composes` alone also reached the subject's own parent and
+    // judged a software system by the assembly it sat in. That reported one
+    // cross-family nesting twice, once on each side, and the child's copy
+    // blamed the element that was not doing the containing. `downstream` is
+    // transitive, so the rule reads as "the subtree stays in the family".
     //
     // Ports are exempt. A port is a boundary FEATURE of its owner, not a member
     // of its owner's family, and any element may carry one whatever family it
@@ -305,47 +494,61 @@ package memo_rules_ontology {
     constraint def SoftwareContainsSoftwareRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-077"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "SoftwareElement";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Software contains software. A software element containing a logical or physical one is realization, not containment — that is a refinement dependency.";
-        attribute predicateExpression = "composes->forAll(construct == 'port' or construct == 'package' or conformsTo(SoftwareElement))";
+        attribute predicateExpression = "downstream(composes)->forAll(construct == 'port' or construct == 'package' or conformsTo(SoftwareElement))";
         constraint { true }
     }
     constraint def LogicalContainsLogicalRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-078"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "LogicalComponent";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "The logical hierarchy decomposes into logical components. A logical component containing a software module or a physical part is realization — the implementation element refines the logical one, it is not part of it.";
-        attribute predicateExpression = "composes->forAll(construct == 'port' or construct == 'package' or conformsTo(LogicalComponent))";
+        attribute predicateExpression = "downstream(composes)->forAll(construct == 'port' or construct == 'package' or conformsTo(LogicalComponent))";
         constraint { true }
     }
     constraint def PhysicalContainsPhysicalRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-079"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "PhysicalElement";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "An assembly contains physical things. PhysicalElement is the shared root the family gained for this rule — PhysicalAssembly and PhysicalComponent previously specialized MemoPart separately, which left no type meaning 'a physical thing' to name here.";
-        attribute predicateExpression = "composes->forAll(construct == 'port' or construct == 'package' or conformsTo(PhysicalElement))";
+        attribute predicateExpression = "downstream(composes)->forAll(construct == 'port' or construct == 'package' or conformsTo(PhysicalElement))";
         constraint { true }
     }
-    // Track A3. The flow is the edge; the exchange part carries the budget and
-    // assurance attributes. The two halves are bound by a SHARED NAME — the flow
-    // usage is named with its exchange — and this is what makes that binding a
-    // checked fact rather than a convention someone can quietly break.
+    // An interface is the path between two ports; the flow over it is what
+    // moves. This rule asks that a component exchange carries one: a flow
+    // whose ends are the exchange's own two ports. The ends are compared as
+    // elements (`intersects` matches exact ids), not as names.
+    //
+    // It replaces the same-name coupling this id used to check, which tied a
+    // ComponentExchange PART to a flow of the same name. That was unsatisfiable
+    // once the model compiled: two members of one namespace may not share a
+    // name (`namespace-distinguishability`), and a `bind` could not be named at
+    // all. With the exchange an interface there is no second record to keep in
+    // step, and what is left to check is transport.
     //
-    // It needs `linksOf`, because the question is about a link's IDENTITY, not
-    // about what sits at its ends: `sourcesOf`/`targetsOf` yield the elements at
-    // the ends and can never answer it. Naming the flow is what the grammar's
-    // restored FlowDeclaration name makes possible at all.
+    // `assurance`, not `invariant`: whether every interface must declare its
+    // transport is a method's call (§9.2 of the architecture plan), and a
+    // method that models interfaces before their flows may tailor it.
     constraint def ExchangeHasFlowRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-076"; }
-        attribute tailoring = RuleTailoringKind::invariant;
+        attribute tailoring = RuleTailoringKind::assurance;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "ComponentExchange";
         attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "An exchange states that something crosses a boundary, which is an EDGE, and the edge is a native flow. The part def exists for the budget and assurance attributes a reader has to find from the edge, so the two are named alike and this rule holds them together. An exchange with no flow is a budget attached to nothing.";
-        attribute predicateExpression = "linksOf(flow)->exists(id == subject.id)";
+        attribute rationaleText = "A component exchange is the connection between two ports; the flow is what crosses it. An exchange with no flow between its ports declares a path that nothing uses, so its timing and kind describe no transfer.";
+        attribute predicateExpression = "linksOf(flow)->exists(sourceEnd->intersects(subject.sourceEnd) and targetEnd->intersects(subject.targetEnd))";
         constraint { true }
     }
@@ -359,6 +562,8 @@ package memo_rules_ontology {
     constraint def AlternateScenarioHasBaseRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-043"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "OperativeScenario";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "An alternate scenario is a variation of a nominal path, so it belongs to a workflow that has one. An alternate with no nominal sibling is either a workflow with no happy path or a scenario filed under the wrong parent.";
@@ -366,20 +571,37 @@ package memo_rules_ontology {
         // the definition, and a default is not written onto every usage. So the
         // sibling test is "not alternate", and `conformsTo` keeps it from being
         // satisfied by an ordinary step of the same workflow.
-        attribute predicateExpression = "not(scenarioKind == 'alternate') or composes.composes->exists(conformsTo(OperativeScenario) and scenarioKind != 'alternate')";
+        //
+        // The base may be found three ways, and the workflow sibling is only
+        // the first. A use case is what a main scenario and its extensions
+        // vary from, so an alternate realizing a use case that a nominal
+        // scenario also realizes has its base, whichever workflow holds each
+        // (gpca-pump files its alarm responses in a workflow of their own). A
+        // scenario with no workflow at all has its package as its parent, so
+        // its siblings are the package's other workflow-less scenarios.
+        attribute predicateExpression = "not(scenarioKind == 'alternate') or composes.composes->exists(conformsTo(OperativeScenario) and scenarioKind != 'alternate') or downstream(realizes).realizes->exists(conformsTo(OperativeScenario) and scenarioKind != 'alternate') or (upstream(composes)->isEmpty() and allOfKind('OperativeScenario')->exists(package == subject.package and scenarioKind != 'alternate' and upstream(composes)->isEmpty()))";
         constraint { true }
     }
     // ─── Assurance-trace warnings ────────────────────────────────────────
-    // Both are WARNINGS, not errors: each describes a trace graph that is
-    // suspicious rather than invalid, and a regulated model has legitimate
-    // exceptions to both. They needed `upstream` / `downstream` — the bare
-    // relation name is bidirectional, so before those existed no rule could
-    // ask which way a derivation ran.
+    // A WARNING, not an error: it describes a trace graph that is suspicious
+    // rather than invalid, and a regulated model has legitimate exceptions.
+    // It needed `upstream` / `downstream` — the bare relation name is
+    // bidirectional, so before those existed no rule could ask which way a
+    // derivation ran.
+    //
+    // CR-ONT-081 (RedundantAncestorTraceRule) was deleted 2026-09-25. It called
+    // a trace redundant when one element satisfied both a requirement and one
+    // derived from it, "already implied by the derivation". It is not: a
+    // `derive` does not make its source satisfied, and a response-time
+    // requirement derived from "select a drug from the library" says nothing
+    // about whether the selector lets you select one.
     constraint def DerivationGapRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "CR-ONT-080"; }
         attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "MemoRequirementElement";
         attribute severity = RuleSeverityKind::warning;
         attribute rationaleText = "A requirement that others derive from should itself be justified. If nothing is upstream of it and it is not a stakeholder need, the derivation chain dead-ends at an unexplained requirement — the gap an assessor asks about first. Needs are the legitimate roots, so they are exempt by type rather than by convention.";
@@ -387,13 +609,31 @@ package memo_rules_ontology {
         constraint { true }
     }
-    constraint def RedundantAncestorTraceRule :> MemoConsistencyRule {
-        @MemoIdentity { :>> providedId = "CR-ONT-081"; }
+    // ─── Causes ─────────────────────────────────────────────────────────
+    //
+    // Causes' ends are untyped because its CauseKind spans parts and items
+    // (memo_fmea.sysml). These carry what the types cannot.
+    constraint def CausesCauseKindRule :> MemoConsistencyRule {
+        @MemoIdentity { :>> providedId = "CR-ONT-082"; }
         attribute tailoring = RuleTailoringKind::invariant;
-        attribute appliesTo = "MemoRequirementElement";
-        attribute severity = RuleSeverityKind::warning;
-        attribute rationaleText = "When one element satisfies both a requirement and something derived from that requirement, the trace to the ancestor is already implied by the derivation and adds no coverage. Two elements satisfying the two ends is ordinary decomposition and is not reported.";
-        attribute predicateExpression = "not satisfiedBy->intersects(downstream(derivesFrom).satisfiedBy)";
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
+        attribute appliesTo = "Model";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "A cause is a risk-chain element (a failure mode, failure cause, hazard cause or fault-tree event) or a part that originates one (a component, a use error). A requirement or a behaviour causes nothing.";
+        attribute predicateExpression = "sourcesOf(causes)->forAll(conformsTo(RiskItem) or conformsTo(MemoPart))";
+        constraint { true }
+    }
+    constraint def CausesEffectKindRule :> MemoConsistencyRule {
+        @MemoIdentity { :>> providedId = "CR-ONT-083"; }
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
+        attribute appliesTo = "Model";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "An effect is a link in a risk chain, or the fault-tree event a component originates. Not a component, not a requirement.";
+        attribute predicateExpression = "targetsOf(causes)->forAll(conformsTo(RiskItem) or conformsTo(FaultTreeNode))";
         constraint { true }
     }
 }

package/src/rules/quantitative/quantitative_rules.sysml CHANGED Viewed

@@ -11,6 +11,8 @@ package memo_rules_quantitative {
     constraint def HazardMaxControlsRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "QT-001"; }
         attribute tailoring = RuleTailoringKind::assurance;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "Hazard";
         attribute severity = RuleSeverityKind::info;
         attribute rationaleText = "Excessive controls per hazard suggests the hazard is too broad and should be decomposed.";
@@ -21,6 +23,8 @@ package memo_rules_quantitative {
     constraint def SwComponentMaxInterfacesRule :> MemoConsistencyRule {
         @MemoIdentity { :>> providedId = "QT-002"; }
         attribute tailoring = RuleTailoringKind::assurance;
+        attribute domain = RuleDomainKind::modelling;
+        attribute obligation = RuleObligationKind::recommended;
         attribute appliesTo = "SoftwareModule";
         attribute severity = RuleSeverityKind::info;
         attribute rationaleText = "High interface count indicates excessive coupling; consider decomposition.";