@memoarchitect/ontology 0.6.5 → 0.8.22

package/src/rules/closure/closure_rules.sysml

@@ -1,13 +1,6 @@
-// Closure consistency rules — native KerML constraints (Epic EE-3).
-// Migrated from the proprietary ConsistencyRule predicate-attribute parts to
-// native `constraint def` bodies whose `constraint { … }` expression is
-// evaluated directly by the KerML constraint evaluator (validator/constraint-eval.ts).
-//
-// Rule metadata (id, appliesTo subject kind, severity, rationale) travels as plain
-// attribute members; the boolean body is the rule. Per the EE-3 mapping the native
-// surface drops the legacy `direction`/`relatedKinds` qualifiers — navigation counts
-// related elements in either direction. Cross-element `uniqueAttribute` (CR-MED-012)
-// has no single-subject expression and stays an engine-level exception (see note).
+// Closure consistency rules. Portable SysML bodies remain literal `true` where
+// cross-model navigation is not resolvable by a general SysML compiler; MEMO
+// compiles the ontology-owned `predicateExpression` against the semantic model.
 package memo_rules_closure {
     private import ScalarValues::*;
 
@@ -16,8 +9,9 @@ package memo_rules_closure {
 
     // ─── Risk Layer Rules ────────────────────────────────────────────────
 
-    constraint def hazardMitigationRule {
+    constraint def HazardMitigationRule :> MemoConsistencyRule {
         attribute id = "CR-MED-001";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "Hazard";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "ISO 14971 requires each identified hazard to have risk control measures.";
@@ -25,17 +19,19 @@ package memo_rules_closure {
         constraint { true }
     }
 
-    constraint def hazardSeverityRule {
+    constraint def HazardSeverityRule :> MemoConsistencyRule {
         attribute id = "CR-MED-002";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "Hazard";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Hazard severity is required for risk estimation per ISO 14971.";
-        attribute predicateExpression = "attributes.severity != \"\"";
+        attribute predicateExpression = "attributes.severity != ''";
         constraint { true }
     }
 
-    constraint def riskControlVerificationRule {
+    constraint def RiskControlVerificationRule :> MemoConsistencyRule {
         attribute id = "CR-MED-003";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "RiskControlMeasure";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Risk controls shall be verified per ISO 14971 clause 7.4.";
@@ -43,8 +39,9 @@ package memo_rules_closure {
         constraint { true }
     }
 
-    constraint def initialRiskMatrixRule {
+    constraint def InitialRiskMatrixRule :> MemoConsistencyRule {
         attribute id = "CR-MED-004";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "Risk";
         attribute severity = RuleSeverityKind::warning;
         attribute rationaleText = "Pre-mitigation risk must be assessed against a risk acceptability matrix.";
@@ -54,8 +51,9 @@ package memo_rules_closure {
 
     // ─── Requirements Layer Rules ────────────────────────────────────────
 
-    constraint def sysReqTraceRule {
+    constraint def SysReqTraceRule :> MemoConsistencyRule {
         attribute id = "CR-MED-010";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "Requirement[requirementKind=system]";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Requirements shall be traceable to stakeholder needs per ISO 13485.";
@@ -63,8 +61,9 @@ package memo_rules_closure {
         constraint { true }
     }
 
-    constraint def swReqTraceRule {
+    constraint def SwReqTraceRule :> MemoConsistencyRule {
         attribute id = "CR-MED-011";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "Requirement[requirementKind=software]";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Software requirements derive from system requirements per IEC 62304.";
@@ -80,17 +79,19 @@ package memo_rules_closure {
 
     // ─── Architecture Layer Rules ────────────────────────────────────────
 
-    constraint def swComponentSafetyClassRule {
+    constraint def SwComponentSafetyClassRule :> MemoConsistencyRule {
         attribute id = "CR-MED-020";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "SoftwareModule";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "IEC 62304 requires safety classification for all software items.";
-        attribute predicateExpression = "attributes.safetyClass != \"\"";
+        attribute predicateExpression = "attributes.safetyClass != ''";
         constraint { true }
     }
 
-    constraint def swComponentReqRule {
+    constraint def SwComponentReqRule :> MemoConsistencyRule {
         attribute id = "CR-MED-021";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "SoftwareModule";
         attribute severity = RuleSeverityKind::warning;
         attribute rationaleText = "Software items shall be linked to their requirements per IEC 62304.";
@@ -98,8 +99,9 @@ package memo_rules_closure {
         constraint { true }
     }
 
-    constraint def logicalFunctionAllocationRule {
+    constraint def LogicalFunctionAllocationRule :> MemoConsistencyRule {
         attribute id = "CR-MED-022";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "SystemFunction";
         attribute severity = RuleSeverityKind::warning;
         attribute rationaleText = "Functions should be allocated to implementation elements.";
@@ -109,17 +111,19 @@ package memo_rules_closure {
 
     // ─── Verification Layer Rules ────────────────────────────────────────
 
-    constraint def verificationCaseMethodRule {
+    constraint def VerificationCaseMethodRule :> MemoConsistencyRule {
         attribute id = "CR-MED-030";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "VerificationCase";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Verification method (test, analysis, inspection, demonstration) required per IEC 62304.";
-        attribute predicateExpression = "attributes.methodKind != \"\"";
+        attribute predicateExpression = "attributes.methodKind != ''";
         constraint { true }
     }
 
-    constraint def verificationCaseTargetRule {
+    constraint def VerificationCaseTargetRule :> MemoConsistencyRule {
         attribute id = "CR-MED-031";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "VerificationCase";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Verification cases must be linked to verifiable items.";
@@ -127,8 +131,9 @@ package memo_rules_closure {
         constraint { true }
     }
 
-    constraint def evidenceProductionRule {
+    constraint def EvidenceProductionRule :> MemoConsistencyRule {
         attribute id = "CR-MED-032";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "VerificationCase";
         attribute severity = RuleSeverityKind::warning;
         attribute rationaleText = "Verification results should be documented as evidence records.";
@@ -138,8 +143,9 @@ package memo_rules_closure {
 
     // ─── Cybersecurity Layer Rules ───────────────────────────────────────
 
-    constraint def threatMitigationRule {
+    constraint def ThreatMitigationRule :> MemoConsistencyRule {
         attribute id = "CR-MED-040";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "Threat";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "FDA cybersecurity guidance requires threat mitigation.";
@@ -147,8 +153,9 @@ package memo_rules_closure {
         constraint { true }
     }
 
-    constraint def assetThreatLinkRule {
+    constraint def AssetThreatLinkRule :> MemoConsistencyRule {
         attribute id = "CR-MED-041";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "CybersecurityAsset";
         attribute severity = RuleSeverityKind::warning;
         attribute rationaleText = "Assets should have threat analysis per FDA cybersecurity guidance.";
@@ -158,23 +165,89 @@ package memo_rules_closure {
 
     // ─── Interface Rules ─────────────────────────────────────────────────
 
-    constraint def logicalInterfaceDirectionRule {
+    constraint def LogicalInterfaceDirectionRule :> MemoConsistencyRule {
         attribute id = "CR-MED-050";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "Interface";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Interface direction required for integration analysis.";
-        attribute predicateExpression = "attributes.direction != \"\"";
+        attribute predicateExpression = "attributes.direction != '' or attributes.directionality != ''";
         constraint { true }
     }
 
     // ─── Conditional Rules ───────────────────────────────────────────────
 
-    constraint def safetyClassCVerificationRule {
+    constraint def SafetyClassCVerificationRule :> MemoConsistencyRule {
         attribute id = "CR-MED-101";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "SoftwareModule";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "IEC 62304 requires rigorous verification for Class C software.";
-        attribute predicateExpression = "not(attributes.safetyClass == \"C\") or verifiedBy->size() >= 1";
+        attribute predicateExpression = "not(attributes.safetyClass == 'C') or verifiedBy->size() >= 1";
+        constraint { true }
+    }
+
+    // ─── UI Layout Rules ─────────────────────────────────────────────────
+    //
+    // Traceability only: every part of a screen must have a design record
+    // behind it, and captured evidence must say where it came from.
+    //
+    // Scope is traceability, not geometry. Layout correctness (child within
+    // parent, inline siblings disjoint) is checked where the geometry is drawn,
+    // in the renderer: a pairwise sibling comparison has no KerML constraint
+    // form, since the evaluator has no Real literal and binds one implicit
+    // subject per quantifier.
+
+    // The load-bearing traceability rule. A UI element that is not chrome must
+    // reach a design record — a requirement it satisfies, or an action it
+    // triggers. Chrome must be DECLARED `decoration`; an element left
+    // unclassified fails rather than passing as scenery.
+    constraint def UiElementDesignRecordRule :> MemoConsistencyRule {
+        attribute id = "CR-MED-110";
+        attribute tailoring = RuleTailoringKind::assurance;
+        attribute appliesTo = "UIElement";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "Every functional UI element must have a design record — a requirement it satisfies or an action it triggers. Elements with formKind `decoration` are chrome and are exempt.";
+        attribute predicateExpression = "attributes.formKind == 'decoration' or satisfiedBy->size() >= 1 or elementTriggersAction->size() >= 1";
+        constraint { true }
+    }
+
+    // Interactive UI is where use error happens (IEC 62366-1), so a control
+    // that reaches no system function is either dead UI or unmodelled UI.
+    // The interactive-form restriction lives in the predicate because it spans
+    // several enum values.
+    constraint def ControlInvokesFunctionRule :> MemoConsistencyRule {
+        attribute id = "CR-MED-111";
+        attribute tailoring = RuleTailoringKind::assurance;
+        attribute appliesTo = "UIElement";
+        attribute severity = RuleSeverityKind::warning;
+        attribute rationaleText = "An interactive UI element (button, selector, slider, field) should trigger a UIAction that invokes a system function; otherwise the control's purpose is not in the model. Physical controls are OperatorInterfaceElement and are covered separately.";
+        attribute predicateExpression = "not(formKind == 'button' or formKind == 'selector' or formKind == 'slider' or formKind == 'field') or elementTriggersAction->size() >= 1";
+        constraint { true }
+    }
+
+    // Automatic boundary detection proposes; a reviewer disposes. An
+    // unconfirmed machine guess must never reach a design review looking like
+    // an engineering decision.
+    constraint def BoundsDetectionConfirmedRule :> MemoConsistencyRule {
+        attribute id = "CR-MED-112";
+        attribute tailoring = RuleTailoringKind::assurance;
+        attribute appliesTo = "UIElement";
+        attribute severity = RuleSeverityKind::warning;
+        attribute rationaleText = "Automatically detected bounds are a proposal until a reviewer confirms them; released UI documentation should contain no unconfirmed automatic bounds.";
+        attribute predicateExpression = "not(attributes.detectionMethod == 'automatic') or attributes.confirmedBy != ''";
+        constraint { true }
+    }
+
+    // A screenshot with no build behind it is undated design intent, not
+    // evidence of what the device does.
+    constraint def ScreenCaptureProvenanceRule :> MemoConsistencyRule {
+        attribute id = "CR-MED-113";
+        attribute tailoring = RuleTailoringKind::assurance;
+        attribute appliesTo = "ScreenCapture";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "A screen capture used as design or usability evidence must identify the build it was taken from and hash the image bytes, or it cannot be relied on in the DHF.";
+        attribute predicateExpression = "attributes.capturedBuild != '' and attributes.imageHash != ''";
         constraint { true }
     }
 }

package/src/rules/coverage/coverage_rules.sysml

@@ -1,258 +1,6 @@
-// C2 coverage rule packs per regulatory standard — Epic EE-3.
-//
-// Coverage rules assert model-level *existence* ("the model must contain at least
-// one X for standard S"). Existence over the whole model is not a single-subject
-// boolean predicate, so it has no `constraint { … }` body. The legacy
-// `predicate="coverageCheck"` parts were likewise never evaluated by the rule engine
-// (toClosureRule returned undefined for coverageCheck), so they produced no
-// violations — parity is preserved by keeping these as metadata-only constraint defs.
-//
-// Each rule retains its standard / clause / coverageTarget metadata so the coverage
-// catalog and DHF traceability stay intact; the constraint loader skips defs with no
-// require/assert body, so none of these fire. Model-level coverage is reported by the
-// completeness tooling, not the per-subject constraint evaluator. The proprietary
-// `predicate="…"` attribute pattern is removed per EE-3.
+// Regulatory coverage is project-profile dependent and is calculated by the
+// completeness and coverage reports. A universal per-element constraint would
+// incorrectly require every project to implement every standard pack, so this
+// package declares no consistency constraints.
 package memo_rules_coverage {
-    private import ScalarValues::*;
-
-    private import memo_core_consistency_rules::*;
-    private import memo_core_enumerations::*;
-
-    // ─── ISO 14971: Risk Management ──────────────────────────────────────
-
-    constraint def iso14971HazardCoverage {
-        attribute id = "COV-14971-001";
-        attribute appliesTo = "Hazard";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "ISO 14971 clause 5.4 requires hazard identification.";
-        attribute standardReference = "ISO 14971";
-        attribute clause = "5.4";
-        attribute coverageTarget = "Hazard";
-    }
-
-    constraint def iso14971RiskMatrixCoverage {
-        attribute id = "COV-14971-002";
-        attribute appliesTo = "RiskMatrix";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "ISO 14971 clause 5.5 requires risk estimation and evaluation criteria.";
-        attribute standardReference = "ISO 14971";
-        attribute clause = "5.5";
-        attribute coverageTarget = "RiskMatrix";
-    }
-
-    constraint def iso14971ResidualRiskCoverage {
-        attribute id = "COV-14971-003";
-        attribute appliesTo = "OverallResidualRiskEvaluation";
-        attribute severity = RuleSeverityKind::warning;
-        attribute rationaleText = "ISO 14971 clause 8 requires overall residual risk evaluation.";
-        attribute standardReference = "ISO 14971";
-        attribute clause = "8";
-        attribute coverageTarget = "OverallResidualRiskEvaluation";
-    }
-
-    // ─── IEC 62304: Software Lifecycle ───────────────────────────────────
-
-    constraint def iec62304SwArchCoverage {
-        attribute id = "COV-62304-001";
-        attribute appliesTo = "SoftwareModule";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "IEC 62304 clause 5.3 requires software architecture.";
-        attribute standardReference = "IEC 62304";
-        attribute clause = "5.3";
-        attribute coverageTarget = "SoftwareModule";
-    }
-
-    constraint def iec62304SwReqCoverage {
-        attribute id = "COV-62304-002";
-        attribute appliesTo = "Requirement[requirementKind=software]";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "IEC 62304 clause 5.2 requires software requirements specification.";
-        attribute standardReference = "IEC 62304";
-        attribute clause = "5.2";
-        attribute coverageTarget = "Requirement[requirementKind=software]";
-    }
-
-    // ─── FDA 21 CFR 820: Quality System ──────────────────────────────────
-
-    constraint def fda820DesignInputCoverage {
-        attribute id = "COV-820-001";
-        attribute appliesTo = "Requirement[requirementKind=system]";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "21 CFR 820.30(c) requires design inputs including requirements.";
-        attribute standardReference = "FDA 21 CFR 820";
-        attribute clause = "820.30(c)";
-        attribute coverageTarget = "Requirement[requirementKind=system]";
-    }
-
-    constraint def fda820DesignVerificationCoverage {
-        attribute id = "COV-820-002";
-        attribute appliesTo = "VerificationCase";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "21 CFR 820.30(f) requires design verification.";
-        attribute standardReference = "FDA 21 CFR 820";
-        attribute clause = "820.30(f)";
-        attribute coverageTarget = "VerificationCase";
-    }
-
-    // ─── ISO 13485: Quality Management ───────────────────────────────────
-
-    constraint def iso13485StakeholderNeedCoverage {
-        attribute id = "COV-13485-001";
-        attribute appliesTo = "Need[needKind=stakeholder]";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "ISO 13485 clause 7.2 requires determination of customer requirements.";
-        attribute standardReference = "ISO 13485";
-        attribute clause = "7.2";
-        attribute coverageTarget = "Need[needKind=stakeholder]";
-    }
-
-    // ─── ISO 14155: Clinical Investigations ──────────────────────────────
-
-    constraint def iso14155UseContextCoverage {
-        attribute id = "COV-14155-001";
-        attribute appliesTo = "UseContext";
-        attribute severity = RuleSeverityKind::warning;
-        attribute rationaleText = "ISO 14155 requires definition of clinical investigation context.";
-        attribute standardReference = "ISO 14155";
-        attribute clause = "6";
-        attribute coverageTarget = "UseContext";
-    }
-
-    // ─── FDA Cybersecurity Guidance ──────────────────────────────────────
-
-    constraint def fdaCyberThreatCoverage {
-        attribute id = "COV-CYBER-001";
-        attribute appliesTo = "Threat";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "FDA cybersecurity guidance requires threat modeling.";
-        attribute standardReference = "FDA Cybersecurity";
-        attribute clause = "V.A";
-        attribute coverageTarget = "Threat";
-    }
-
-    constraint def fdaCyberAssetCoverage {
-        attribute id = "COV-CYBER-002";
-        attribute appliesTo = "CybersecurityAsset";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "FDA cybersecurity guidance requires asset identification.";
-        attribute standardReference = "FDA Cybersecurity";
-        attribute clause = "V.A";
-        attribute coverageTarget = "CybersecurityAsset";
-    }
-
-    constraint def fdaCyberVulnerabilityCoverage {
-        attribute id = "COV-CYBER-003";
-        attribute appliesTo = "Vulnerability";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "FDA cybersecurity guidance requires vulnerability analysis.";
-        attribute standardReference = "FDA Cybersecurity";
-        attribute clause = "V.B";
-        attribute coverageTarget = "Vulnerability";
-    }
-
-    constraint def fdaCyberTrustBoundaryCoverage {
-        attribute id = "COV-CYBER-004";
-        attribute appliesTo = "TrustBoundary";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "FDA cybersecurity guidance requires trust boundary identification.";
-        attribute standardReference = "FDA Cybersecurity";
-        attribute clause = "V.A";
-        attribute coverageTarget = "TrustBoundary";
-    }
-
-    constraint def fdaCyberThreatScenarioCoverage {
-        attribute id = "COV-CYBER-005";
-        attribute appliesTo = "ThreatScenario";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "FDA cybersecurity guidance requires threat scenario analysis.";
-        attribute standardReference = "FDA Cybersecurity";
-        attribute clause = "V.A";
-        attribute coverageTarget = "ThreatScenario";
-    }
-
-    constraint def fdaCyberMitigationCoverage {
-        attribute id = "COV-CYBER-006";
-        attribute appliesTo = "CyberMitigation";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "FDA cybersecurity guidance requires risk mitigation.";
-        attribute standardReference = "FDA Cybersecurity";
-        attribute clause = "V.C";
-        attribute coverageTarget = "CyberMitigation";
-    }
-
-    constraint def fdaCyberRiskCoverage {
-        attribute id = "COV-CYBER-007";
-        attribute appliesTo = "CyberRisk";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "FDA cybersecurity guidance requires cyber risk assessment.";
-        attribute standardReference = "FDA Cybersecurity";
-        attribute clause = "V.B";
-        attribute coverageTarget = "CyberRisk";
-    }
-
-    constraint def fdaCyberHazardCoverage {
-        attribute id = "COV-CYBER-008";
-        attribute appliesTo = "CyberHazard";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "FDA cybersecurity guidance requires cyber-safety hazard mapping.";
-        attribute standardReference = "FDA Cybersecurity";
-        attribute clause = "V.B";
-        attribute coverageTarget = "CyberHazard";
-    }
-
-    constraint def fdaCyberSecurityReqCoverage {
-        attribute id = "COV-CYBER-009";
-        attribute appliesTo = "SecurityRequirement";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "FDA cybersecurity guidance requires security requirements derivation.";
-        attribute standardReference = "FDA Cybersecurity";
-        attribute clause = "V.C";
-        attribute coverageTarget = "SecurityRequirement";
-    }
-
-    constraint def fdaCyberVerificationCoverage {
-        attribute id = "COV-CYBER-010";
-        attribute appliesTo = "VerificationCase";
-        attribute severity = RuleSeverityKind::warning;
-        attribute rationaleText = "FDA cybersecurity guidance requires security testing and verification.";
-        attribute standardReference = "FDA Cybersecurity";
-        attribute clause = "V.D";
-        attribute coverageTarget = "VerificationCase";
-    }
-
-    // ─── IEC 62366: Usability Engineering ────────────────────────────────
-
-    constraint def iec62366ActorCoverage {
-        attribute id = "COV-62366-001";
-        attribute appliesTo = "Actor";
-        attribute severity = RuleSeverityKind::warning;
-        attribute rationaleText = "IEC 62366 clause 5.1 requires user profile specification.";
-        attribute standardReference = "IEC 62366";
-        attribute clause = "5.1";
-        attribute coverageTarget = "Actor";
-    }
-
-    // ─── IEC 60601-1: General Safety ─────────────────────────────────────
-
-    constraint def iec60601HarmCoverage {
-        attribute id = "COV-60601-001";
-        attribute appliesTo = "Harm";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "IEC 60601-1 clause 4.2 requires identification of hazards and harms.";
-        attribute standardReference = "IEC 60601-1";
-        attribute clause = "4.2";
-        attribute coverageTarget = "Harm";
-    }
-
-    // ─── IEC 82304-1: Health Software ────────────────────────────────────
-
-    constraint def iec82304SwSystemCoverage {
-        attribute id = "COV-82304-001";
-        attribute appliesTo = "SoftwareSystem";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "IEC 82304-1 requires health software product definition.";
-        attribute standardReference = "IEC 82304-1";
-        attribute clause = "6.1";
-        attribute coverageTarget = "SoftwareSystem";
-    }
 }

package/src/rules/crosslayer/cross_layer_rules.sysml

@@ -1,14 +1,14 @@
-// Cross-layer rule pack — native KerML constraints.
-// Traceability between architecture layers, migrated from ConsistencyRule
-// predicate-attribute parts to native `constraint def` bodies.
+// Cross-layer traceability constraints evaluated from their ontology-owned
+// predicate expressions.
 package memo_rules_crosslayer {
     private import ScalarValues::*;
 
     private import memo_core_consistency_rules::*;
     private import memo_core_enumerations::*;
 
-    constraint def riskToReqTraceRule {
+    constraint def RiskToReqTraceRule :> MemoConsistencyRule {
         attribute id = "XL-001";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "Hazard";
         attribute severity = RuleSeverityKind::warning;
         attribute rationaleText = "Risk-requirement traceability required for regulatory submissions.";
@@ -16,8 +16,9 @@ package memo_rules_crosslayer {
         constraint { true }
     }
 
-    constraint def reqToArchTraceRule {
+    constraint def ReqToArchTraceRule :> MemoConsistencyRule {
         attribute id = "XL-002";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "Requirement[requirementKind=system]";
         attribute severity = RuleSeverityKind::warning;
         attribute rationaleText = "Requirements-to-architecture traceability per IEC 62304.";
@@ -25,14 +26,4 @@ package memo_rules_crosslayer {
         constraint { true }
     }
 
-    // XL-003 had minCount=0 (advisory only), so the native form is vacuously true
-    // (size >= 0). Retained for metadata/rationale parity; flags nothing.
-    constraint def cyberToSafetyTraceRule {
-        attribute id = "XL-003";
-        attribute appliesTo = "CyberHazard";
-        attribute severity = RuleSeverityKind::warning;
-        attribute rationaleText = "FDA cybersecurity guidance requires linking cybersecurity to patient safety.";
-        attribute predicateExpression = "impactsSafety->size() >= 0";
-        constraint { true }
-    }
 }

package/src/rules/lifecycle/lifecycle_rules.sysml

@@ -1,41 +1,6 @@
-// C3 lifecycle rule pack — Epic EE-3.
-// These rules express lifecycle-stage *ordering* (requirements before architecture,
-// risk before verification, evidence after verification). Ordering across the whole
-// model is not a single-subject boolean predicate, so it has no `require constraint`
-// body — and the legacy parts never enforced anything either (they carried
-// predicate=requireRelationship with no relationshipType, so they matched nothing).
-//
-// They are retained here as metadata-only constraint defs (id, subject, rationale)
-// so the catalog and traceability stay intact; the constraint loader skips defs that
-// have no require/assert body, so they evaluate to nothing — exactly as before.
-// The proprietary `predicate="…"` attribute pattern is removed per EE-3.
+// Lifecycle ordering requires modeled execution timestamps or revision events.
+// MEMO currently carries neither on the affected architecture elements, so this
+// package declares no consistency constraint: stage guidance is reported by the
+// methodology workflow instead of presenting an unevaluable rule as assurance.
 package memo_rules_lifecycle {
-    private import ScalarValues::*;
-
-    private import memo_core_consistency_rules::*;
-    private import memo_core_enumerations::*;
-
-    constraint def reqBeforeArchRule {
-        attribute id = "LC-001";
-        attribute appliesTo = "SoftwareModule";
-        attribute severity = RuleSeverityKind::warning;
-        attribute rationaleText = "IEC 62304 requires requirements to precede architecture decomposition.";
-        // Lifecycle ordering — model-level, no single-subject predicate.
-    }
-
-    constraint def riskBeforeVerificationRule {
-        attribute id = "LC-002";
-        attribute appliesTo = "VerificationCase";
-        attribute severity = RuleSeverityKind::warning;
-        attribute rationaleText = "Risk controls drive verification scope per ISO 14971.";
-        // Lifecycle ordering — model-level, no single-subject predicate.
-    }
-
-    constraint def evidenceAfterVerificationRule {
-        attribute id = "LC-003";
-        attribute appliesTo = "Evidence";
-        attribute severity = RuleSeverityKind::info;
-        attribute rationaleText = "Evidence is produced by executing verification — ordering matters for DHF assembly.";
-        // Lifecycle ordering — model-level, no single-subject predicate.
-    }
 }