@memoarchitect/ontology 0.6.5 → 0.8.22

package/src/artifacts/templates/dhf/system/syrs.md

@@ -0,0 +1,128 @@
+---
+id: syrs
+title: System Requirements Specification
+standard: IEC 60601-1:2005+AMD1:2012+AMD2:2020
+clauses: ["4.2", "IEC 62304:2006+AMD1:2015 §5.2", "ISO 14971:2019 §5"]
+required_for: ["CE", "FDA_510k", "MDR"]
+---
+
+{{include:shared/snippets/document-control-header.md}}
+
+{{toc}}
+
+---
+
+## 1. Purpose
+
+This System Requirements Specification (SyRS) defines the top-level requirements for the **{{project.product}}** cyber-physical system, serving as the bridge between user needs and the lower-level hardware (IEC 60601-1) and software (IEC 62304) requirements.
+
+One standard is named above because a document claims one; the others it feeds are carried in `clauses:`.
+
+---
+
+## 2. System Requirements Summary
+
+Summary metrics for the system requirements captured in the model:
+
+```memo-query
+kind: Requirement
+where: requirementKind == "RequirementKind::system"
+display: count
+label: Total system requirements
+```
+
+---
+
+## 3. Functional Requirements
+
+Binding system requirements — those carrying a `shall` obligation:
+
+```memo-query
+kind: Requirement
+where: obligation == "ObligationKind::shall"
+display: table
+columns: name, requirementKind, doc
+sort: name
+empty: "No requirements carry a `shall` obligation. Set `obligation` on Requirement elements."
+```
+
+### All System Requirements
+
+```memo-query
+kind: Requirement
+where: requirementKind == "RequirementKind::system"
+display: table
+columns: name, requirementKind, safetyClass, doc
+sort: name
+empty: "No system requirements defined. Add Requirement elements with requirementKind = system."
+```
+
+---
+
+## 4. Requirements Allocation
+
+How system requirements are allocated down to hardware and software.
+
+### 4.1 Elements System Requirements Are Satisfied By
+
+```memo-query
+kind: Requirement
+where: requirementKind == "RequirementKind::system"
+traverse: outgoing satisfiedBy
+display: table
+columns: name, kind, layer, doc
+sort: name
+empty: "No system requirements are linked to a satisfying element. Add SatisfiedBy links."
+```
+
+### 4.2 Function Allocation
+
+The allocation table proper — which element allocates to which — is a relationship table, not an element table. It is grouped by the kind of the receiving element, which is where the hardware/software split actually lives: `AllocatedTo` joins two architecture elements and carries no layer of its own, so a single comparison cannot ask for "the hardware ones" without naming one hardware kind and dropping the rest.
+
+```memo-query
+select: relationships
+kind: allocatedTo
+display: grouped
+group_by: target.kind
+columns: source, source.kind, target, target.layer
+sort: source
+empty: "No allocations defined. Add AllocatedTo links."
+```
+
+---
+
+## 5. Non-Functional Requirements
+
+### 5.1 System Performance Requirements
+
+_[TODO: Define system performance requirements (e.g. overall throughput, latency, physical capacities)]_
+
+### 5.2 System Safety Requirements
+
+Hazards from the ISO 14971 analysis that system-level risk controls must address:
+
+```memo-query
+kind: [Hazard, HazardousSituation]
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No hazards defined in the risk model."
+```
+
+The risk controls answering them:
+
+```memo-query
+kind: RiskControlMeasure
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No risk controls defined."
+```
+
+---
+
+{{include:shared/snippets/revision-history-table.md}}
+
+{{include:shared/snippets/approval-block.md}}
+
+{{include:shared/snippets/references-section.md}}

package/src/assurance/cybersecurity/memo_cybersecurity.sysml

@@ -1,5 +1,7 @@
 package memo_assurance_cybersecurity {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
+    private import memo_core_relationships::*;   // MemoRelationship
 
     private import memo_core_common::*;
     private import memo_core_enumerations::*;
@@ -27,7 +29,7 @@ package memo_assurance_cybersecurity {
         attribute authenticationExpected : Boolean;
     }
 
-    item def Threat specializes RiskDriver {
+    part def Threat specializes RiskDriver {
         attribute threatCategory : ThreatCategoryKind;
         attribute attackVector : String;
         attribute threatSource : String;
@@ -37,7 +39,7 @@ package memo_assurance_cybersecurity {
         attribute strideCategory : ThreatCategoryKind;
     }
 
-    item def Vulnerability specializes MemoPart {
+    item def Vulnerability specializes RiskItem {
         attribute weakness : String;
         attribute exploitability : String;
         attribute discoveryMethod : String;
@@ -46,18 +48,6 @@ package memo_assurance_cybersecurity {
         attribute remediable : Boolean;
     }
 
-    // A scenario specialization: an attack path through the
-    // system, classified by the shared scenario dimensions with purpose
-    // `cybersecurity`.
-    part def ThreatScenario specializes MemoScenario {
-        attribute actorDescription : String;
-        attribute assumptionSummary : String;
-        attribute guaranteeSummary : String;
-        attribute securityObjective : String;
-        attribute abuseCaseReference : String;
-        attribute defaultCategory : ThreatCategoryKind;
-    }
-
     item def CyberHazard specializes Hazard {
         attribute securityImpact : String;
         attribute safetyImpact : String;
@@ -66,7 +56,7 @@ package memo_assurance_cybersecurity {
         attribute linkedSafetyHazardId : String;
     }
 
-    item def CyberRisk specializes Risk {
+    part def CyberRisk specializes Risk {
         attribute exploitabilityEstimate : String;
         attribute attackComplexity : String;
         attribute detectability : DetectionKind;
@@ -88,15 +78,44 @@ package memo_assurance_cybersecurity {
         attribute defaultConcern : ConcernKind;
     }
 
-    item def TrustBoundary specializes InterfaceElement {
+    part def TrustBoundary specializes InterfaceElement {
         attribute boundaryType : String;
         attribute crossingConstraint : String;
         attribute trustAssumption : String;
     }
 
-    part def SecurityClaim specializes MemoEvidence {
-        attribute claimText : String;
-        attribute claimScope : String;
-        attribute supportedByEvidence : String;
+    // ── Relations owned by this package ─────────────────────────────
+    // Moved out of memo_core_relationships: their ends are typed against
+    // types declared here, and core must not depend on a domain package.
+    connection def Exploits :> MemoRelationship {
+        end realizedThreat : RequirementDriver :>> source;
+        end enablingVulnerability : Vulnerability :>> target;
+    }
+    abstract connection exploitsLinks : Exploits[*];
+    metadata def <exploits> ExploitsMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = exploitsLinks meta SysML::Usage;
+    }
+    connection def RealizedByScenario :> MemoRelationship {
+        end realizedThreat : RequirementDriver :>> source;
+        end scenario : MemoScenario :>> target;
+    }
+    abstract connection realizedByScenarioLinks : RealizedByScenario[*];
+    metadata def <realizedByScenario> RealizedByScenarioMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = realizedByScenarioLinks meta SysML::Usage;
+    }
+    connection def ImpactsSafety :> MemoRelationship {
+        attribute tracePurpose : String;
+        end cyberElement : MemoPart :>> source;
+        end safetyElement : RiskItem :>> target;
+    }
+    abstract connection impactsSafetyLinks : ImpactsSafety[*];
+    metadata def <impactsSafety> ImpactsSafetyMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = impactsSafetyLinks meta SysML::Usage;
     }
 }

package/src/assurance/human_factors/memo_human_factors.sysml

@@ -4,6 +4,7 @@
 // engineering chain: user → task → use error → hazard → risk control →
 // usability validation.
 package memo_assurance_human_factors {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
 
     private import memo_core_common::*;
@@ -19,32 +20,38 @@ package memo_assurance_human_factors {
         attribute rootCauseType : String;
     }
 
-    // A use scenario whose performance could lead to a hazardous situation
-    // (IEC 62366-1 3.9); selected for summative evaluation.
-    part def HazardRelatedUseScenario specializes MemoScenario {
-        attribute hazardReference : String;
-        attribute selectionRationale : String;
+    connection def CommitsUseError :> MemoRelationship {
+        end task : UserTask :>> source;
+        end useError : UseError :>> target;
     }
-
-    part def FormativeEvaluation specializes MemoEvidence {
-        attribute evaluationMethod : String;
-        attribute findingsSummary : String;
-        attribute designChangesTriggered : String;
+    abstract connection commitsUseErrorLinks : CommitsUseError[*];
+    metadata def <commitsUseError> CommitsUseErrorMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = commitsUseErrorLinks meta SysML::Usage;
     }
-
-    part def UsabilityValidation specializes MemoEvidence {
-        attribute participantProfile : String;
-        attribute participantCount : Integer;
-        attribute acceptanceCriteria : String;
-        attribute resultSummary : String;
+    connection def EvaluatesTask :> MemoRelationship {
+        end evaluation : MemoEvidence :>> source;
+        end task : UserTask :>> target;
+    }
+    abstract connection evaluatesTaskLinks : EvaluatesTask[*];
+    metadata def <evaluatesTask> EvaluatesTaskMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = evaluatesTaskLinks meta SysML::Usage;
     }
 
-    connection def CommitsUseError :> MemoRelationship {
-        end task : UserTask;
-        end useError : UseError;
+    // ── Relations owned by this package ─────────────────────────────
+    // Moved out of memo_core_relationships: their ends are typed against
+    // types declared here, and core must not depend on a domain package.
+    connection def TestedByUsability :> MemoRelationship {
+        end uiElementOrTask : MemoPart :>> source;
+        end usabilityTest : MemoEvidence :>> target;
     }
-    connection def EvaluatesTask :> MemoRelationship {
-        end evaluation : MemoEvidence;
-        end task : UserTask;
+    abstract connection testedByUsabilityLinks : TestedByUsability[*];
+    metadata def <testedByUsability> TestedByUsabilityMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = testedByUsabilityLinks meta SysML::Usage;
     }
 }

package/src/assurance/requirements/memo_requirements.sysml

@@ -40,12 +40,15 @@ package memo_assurance_requirements {
         enum designControl;
     }
 
-    requirement def Requirement specializes VerifiableElement {
+    requirement def Requirement specializes MemoRequirement {
         attribute requirementKind : RequirementKind;
         attribute statement : String;
         attribute sourceKind : RequirementSourceKind;
         attribute concernKind : ConcernKind;
-        attribute requirementStatus : RequirementStatusKind;
+        // Editorial state is the inherited `status : ElementStatusKind` — the
+        // one status vocabulary in MEMO. Whether a requirement is implemented,
+        // verified, or validated is read from its Realizes / VerifiedBy /
+        // Validates links, not restated here.
         attribute acceptanceCriteria : String;
         attribute subjectDescription : String;
         attribute actorDescription : String;

package/src/assurance/requirements/needs/memo_needs.sysml

@@ -27,7 +27,7 @@ package memo_assurance_requirements_needs {
         enum designControl;
     }
 
-    requirement def Need specializes MemoNeed, RequirementDriver {
+    requirement def Need specializes MemoNeed {
         attribute needKind : NeedKind;
         // user need (IEC 62366-1)
         attribute userPopulationReference : String;

package/src/assurance/safety_risk/analysis/memo_fmea.sysml

@@ -1,37 +1,57 @@
 package memo_assurance_safety_risk_analysis {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
+    private import memo_core_relationships::*;   // MemoRelationship
 
     private import memo_core_common::*;
     private import memo_core_enumerations::*;
-    item def FMEAWorksheet specializes AnalysisArtifact {
+    private import memo_assurance_safety_risk::*;   // RiskItem
+    part def FMEAWorksheet specializes AnalysisArtifact {
         attribute analysisScope : String;
         attribute standardReference : String;
         attribute analysisBasis : String;
         attribute revisionDate : String;
         attribute reviewer : String;
     }
-    item def FailureMode specializes MemoPart {
+    // An FMEA worksheet row states, on one line, what fails, what that does,
+    // how likely it is, and what controls it. The RPN triple carries the
+    // *scoring*; `effect` and `probability` carry the two facts a reader of the
+    // row needs in words. They are summaries, not replacements: the modelled
+    // form of an effect is a FailureEffect linked by Causes, and the modelled
+    // form of a control is a RiskControlMeasure linked by
+    // Mitigates(mitigationKind = failureMode) — traversable as
+    // `traverse: incoming mitigates`. MEMO deliberately does not add a second
+    // failure-mode-to-control relation; one whole/part and one mitigation
+    // relation is the lean shape the rest of the ontology already uses.
+    item def FailureMode specializes RiskItem {
         attribute failureModeKind : FailureModeKind;
+        doc /* One-line statement of what this failure does, for the worksheet
+             * row. The structured form is a FailureEffect. */
+        attribute effect : String[0..1];
         attribute severityRating : Integer;
+        doc /* Qualitative likelihood, the ISO 14971 register. `occurrenceRating`
+             * is the same fact as an FMEA score; both are kept because an FMEA
+             * reports the score and a risk file reports the qualitative band. */
+        attribute probability : ProbabilityKind[0..1];
         attribute occurrenceRating : Integer;
         attribute detectionRating : Integer;
         attribute rpn : Integer;
         attribute criticality : CriticalityKind;
     }
-    item def FailureEffect specializes MemoPart {
+    item def FailureEffect specializes RiskItem {
         attribute effectLevel : FailureEffectLevelKind;
         attribute effectOnPatient : String;
         attribute effectOnOperator : String;
         attribute effectOnSystem : String;
         attribute severity : SeverityKind;
     }
-    item def FailureCause specializes MemoPart {
+    item def FailureCause specializes RiskItem {
         attribute causeCategory : FailureCauseCategoryKind;
         attribute causeDescription : String;
         attribute occurrenceRating : ProbabilityKind;
         attribute preventionMethod : String;
     }
-    item def DetectionMethod specializes MemoPart {
+    part def DetectionMethod specializes MemoPart {
         attribute methodKind : DetectionMethodKind;
         attribute detectionPoint : String;
         attribute confidence : DetectionKind;
@@ -42,43 +62,41 @@ package memo_assurance_safety_risk_analysis {
         attribute targetCompletionDate : String;
         attribute revisedRpn : Integer;
     }
-    item def FaultTree specializes AnalysisArtifact {
+    part def FaultTree specializes AnalysisArtifact {
         attribute standardReference : String;
         attribute analysisScope : String;
         attribute topEventDescription : String;
         attribute cutSetSummary : String;
         attribute revisionDate : String;
     }
-    item def FaultTreeEvent specializes MemoPart {
+    part def FaultTreeNode specializes MemoPart {
         attribute eventKind : FaultTreeEventKind;
         attribute probability : Real;
         attribute failureRate : Real;
         attribute exposureTime : Real;
         attribute :>> description : String;
-    }
-    item def FaultTreeGate specializes MemoPart {
         attribute gateKind : FaultTreeGateKind;
         attribute kValue : Integer;
         attribute nValue : Integer;
     }
-    item def MinimalCutSet specializes MemoPart {
+    item def MinimalCutSet specializes RiskItem {
         attribute cutSetOrder : Integer;
         attribute probability : Real;
         attribute involvedEvents : String;
         attribute significance : String;
     }
-    item def HAZOPStudy specializes AnalysisArtifact {
+    part def HAZOPStudy specializes AnalysisArtifact {
         attribute standardReference : String;
         attribute processDescription : String;
         attribute studyScope : String;
         attribute teamComposition : String;
     }
-    item def HAZOPNode specializes MemoPart {
+    part def HAZOPNode specializes MemoPart {
         attribute nodeDescription : String;
         attribute designIntent : String;
         attribute operatingConditions : String;
     }
-    item def HAZOPDeviation specializes MemoPart {
+    item def HAZOPDeviation specializes RiskItem {
         attribute guideWord : HAZOPGuideWordKind;
         attribute parameter : String;
         attribute cause : String;
@@ -88,4 +106,91 @@ package memo_assurance_safety_risk_analysis {
         attribute likelihood : ProbabilityKind;
         attribute recommendation : String;
     }
+
+    // ── Relations owned by this package ─────────────────────────────
+    // Moved out of memo_core_relationships: their ends are typed against
+    // types declared here, and core must not depend on a domain package.
+    // Causes unifies the former causal edges of the ISO 14971 / FMEA / FTA
+    // chains — CausesEffect, CausedBy, ContributesToHazard, LeadsToHazard,
+    // OriginatesFrom, UseErrorLeadsToHazard — keyed by causeKind. cause is the
+    // originating element, effect the consequence.
+    enum def CauseKind {
+        enum failureCausesEffect;
+        enum failureCausedBy;
+        enum contributesToHazard;
+        enum leadsToHazard;
+        enum originatesFrom;
+        enum useErrorLeadsToHazard;
+    }
+    connection def Causes :> MemoRelationship {
+        attribute causeKind : CauseKind;
+        end cause : MemoPart :>> source;
+        end effect : RiskItem :>> target;
+    }
+    abstract connection causesLinks : Causes[*];
+    metadata def <causes> CausesMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = causesLinks meta SysML::Usage;
+    }
+    connection def DetectedBy :> MemoRelationship {
+        end failureMode : FailureMode :>> source;
+        end detectionMethod : DetectionMethod :>> target;
+    }
+    abstract connection detectedByLinks : DetectedBy[*];
+    metadata def <detectedBy> DetectedByMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = detectedByLinks meta SysML::Usage;
+    }
+    connection def InputToGate :> MemoRelationship {
+        end input : FaultTreeNode :>> source;
+        end gate : FaultTreeNode :>> target;
+    }
+    abstract connection inputToGateLinks : InputToGate[*];
+    metadata def <inputToGate> InputToGateMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = inputToGateLinks meta SysML::Usage;
+    }
+    connection def ProducesEvent :> MemoRelationship {
+        end gate : FaultTreeNode :>> source;
+        end eventElement : FaultTreeNode :>> target;
+    }
+    abstract connection producesEventLinks : ProducesEvent[*];
+    metadata def <producesEvent> ProducesEventMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = producesEventLinks meta SysML::Usage;
+    }
+    connection def ContainsEvent :> MemoRelationship {
+        end cutSet : MinimalCutSet :>> source;
+        end eventElement : FaultTreeNode :>> target;
+    }
+    abstract connection containsEventLinks : ContainsEvent[*];
+    metadata def <containsEvent> ContainsEventMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = containsEventLinks meta SysML::Usage;
+    }
+    connection def IdentifiesHazard :> MemoRelationship {
+        end deviation : HAZOPDeviation :>> source;
+        end hazard : Hazard :>> target;
+    }
+    abstract connection identifiesHazardLinks : IdentifiesHazard[*];
+    metadata def <identifiesHazard> IdentifiesHazardMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = identifiesHazardLinks meta SysML::Usage;
+    }
+    connection def HasFailureMode :> MemoRelationship {
+        end element : ArchitectureElement :>> source;
+        end failureMode : FailureMode :>> target;
+    }
+    abstract connection hasFailureModeLinks : HasFailureMode[*];
+    metadata def <hasFailureMode> HasFailureModeMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = hasFailureModeLinks meta SysML::Usage;
+    }
 }

package/src/assurance/safety_risk/memo_risk.sysml

@@ -1,5 +1,7 @@
 package memo_assurance_safety_risk {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
+    private import memo_core_relationships::*;   // MemoRelationship
 
     private import memo_core_common::*;
     private import memo_core_enumerations::*;
@@ -46,32 +48,52 @@ package memo_assurance_safety_risk {
         attribute normalUseRelevant : Boolean;
         attribute faultConditionRelevant : Boolean;
     }
-    item def Hazard specializes MemoPart {
+    // ─── Risk-element base ──────────────────────────────────────────
+    // The common supertype of the item-based elements an ISO 14971 / FMEA /
+    // FTA chain relates: hazards, sequences of events, hazardous situations,
+    // harms, causes, failure modes, fault-tree events, cut sets, HAZOP
+    // deviations, vulnerabilities.
+    //
+    // It exists so the risk relations can TYPE their ends. Before it, every
+    // one of them (Causes, TracesRisk, DetectedBy, InputToGate, ProducesEvent,
+    // ContainsEvent, IdentifiesHazard, Mitigates, ImpactsSafety) fell back to
+    // MemoPart — which every element in MEMO is — so the authoring picker
+    // offered fault-tree edges when linking a screen to a requirement.
+    //
+    // It is deliberately an `item def` and deliberately does NOT cover Risk /
+    // ResidualRisk / RiskMatrix, which are parts: a risk is an assessed
+    // judgement about a chain, not a link in it, and it is reached by
+    // AssessedAgainst instead. One base per metaclass is the right shape here
+    // — forcing the two families under one supertype would put a hazard and a
+    // risk matrix back in the same picker.
+    abstract item def RiskItem specializes MemoItem;
+
+    item def Hazard specializes RiskItem {
         attribute hazardType : HazardTypeKind;
         attribute severity : SeverityKind;
         attribute foreseeable : Boolean;
     }
-    item def SequenceOfEvents specializes MemoPart {
+    item def SequenceOfEvents specializes RiskItem {
         attribute initiatingEvent : String;
         attribute contributingFactors : String;
     }
     // A categorized root cause in a hazard causal tree (FDA GIIP
     // taxonomy pattern: cause -> hazard -> hazardous situation -> harm;
     // several HazardCause elements may converge on one Hazard).
-    item def HazardCause specializes MemoPart {
+    item def HazardCause specializes RiskItem {
         attribute causeSource : CauseSourceKind;
         attribute contributingFactors : String;
     }
-    item def HazardousSituation specializes MemoPart {
+    item def HazardousSituation specializes RiskItem {
         attribute exposedPersons : String;
         attribute operatingCondition : String;
     }
-    item def Harm specializes MemoPart {
+    item def Harm specializes RiskItem {
         attribute clinicalImpact : String;
         attribute reversibility : String;
         attribute severity : SeverityKind;
     }
-    item def RiskControlMeasure specializes VerifiableElement {
+    part def RiskControlMeasure specializes VerifiableElement {
         attribute controlKind : RiskControlKind;
         attribute implementationKind : RiskControlImplementationKind;
         attribute verificationStatus : String;
@@ -82,8 +104,57 @@ package memo_assurance_safety_risk {
         attribute clinicalSignificance : String;
         attribute supportingEvidence : String;
     }
-    item def OverallResidualRiskEvaluation specializes MemoPart {
+    part def OverallResidualRiskEvaluation specializes MemoPart {
         attribute conclusion : String;
         attribute reviewer : String;
     }
+
+    // ── Relations owned by this package ─────────────────────────────
+    // Moved out of memo_core_relationships: their ends are typed against
+    // types declared here, and core must not depend on a domain package.
+    // ISO 14971 risk chain — distinct sequence-of-events relations over risk elements.
+    connection def TracesRisk :> MemoRelationship {
+        end sourceRiskElement : RiskItem :>> source;
+        end targetRiskElement : RiskItem :>> target;
+    }
+    abstract connection tracesRiskLinks : TracesRisk[*];
+    metadata def <tracesRisk> TracesRiskMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = tracesRiskLinks meta SysML::Usage;
+    }
+    connection def AssessedAgainst :> MemoRelationship {
+        end risk : Risk :>> source;
+        end riskMatrix : RiskMatrix :>> target;
+    }
+    abstract connection assessedAgainstLinks : AssessedAgainst[*];
+    metadata def <assessedAgainst> AssessedAgainstMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = assessedAgainstLinks meta SysML::Usage;
+    }
+    // Mitigates unifies the control/action → risk-element edges of the
+    // ISO 14971 / FMEA / FTA / cyber chains — MitigatesHazard,
+    // MitigatesVulnerability, MitigatedByControl, BrokenByControl,
+    // AddressedByAction — keyed by mitigationKind. control is the mitigating
+    // control/action; mitigatedElement is the hazard/vulnerability/failure/cut set.
+    enum def MitigationKind {
+        enum hazard;
+        enum vulnerability;
+        enum failureMode;
+        enum cutSet;
+        enum fmeaAction;
+    }
+    connection def Mitigates :> MemoRelationship {
+        attribute mitigationKind : MitigationKind;
+        // Untyped: controls/hazards may be item defs (RiskControlMeasure, Hazard, …).
+        end control :>> source;
+        end mitigatedElement : RiskItem :>> target;
+    }
+    abstract connection mitigatesLinks : Mitigates[*];
+    metadata def <mitigates> MitigatesMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = mitigatesLinks meta SysML::Usage;
+    }
 }