@memoarchitect/ontology 0.6.5 → 0.8.22

package/src/rules/ontology/ontology_invariants.sysml

@@ -11,17 +11,26 @@ package memo_rules_ontology {
 
     // ─── Structure ───────────────────────────────────────────────────────
 
-    constraint def containmentAcyclicRule {
+    constraint def ContainmentAcyclicRule :> MemoConsistencyRule {
         attribute id = "CR-ONT-001";
-        attribute appliesTo = "MemoPart";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "Model";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Containment/composition relations (Composes) must form no cycles.";
         attribute predicateExpression = "acyclic(composes)";
         constraint { true }
     }
-    constraint def nestedPartConnectedRule {
+    constraint def NestedPartConnectedRule :> MemoConsistencyRule {
         attribute id = "AR-IBD-001";
-        attribute appliesTo = "MemoPart";
+        attribute tailoring = RuleTailoringKind::invariant;
+        // Internal-block connectivity is a structural-architecture concern, so
+        // the subject is the structural component — not every MemoPart. UI
+        // elements, captured evidence, and review comments nest in compositions
+        // without ever bearing a connector, and judging them produced warnings
+        // no modeller could act on. The engine reads this value; narrowing or
+        // widening the rule happens here, not in TypeScript.
+        attribute appliesTo = "LogicalComponent";
+        attribute evaluator = "architecture";
         attribute severity = RuleSeverityKind::warning;
         attribute rationaleText = "A structural part nested inside another part should expose at least one modeled interface connector. Passive or intentionally isolated parts may retain this warning with an explicit modelling rationale.";
         attribute predicateExpression = "hasConnectorInComposition";
@@ -32,115 +41,275 @@ package memo_rules_ontology {
         // represent that transitive containment query.
         constraint { true }
     }
-    constraint def connectorEndpointsExistRule {
-        attribute id = "CR-ONT-002";
-        attribute appliesTo = "ComponentExchange";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "Connector endpoints must resolve to model elements via the typed refs sourceEndpoint/targetEndpoint; port-path strings are descriptive labels only.";
-        attribute predicateExpression = "sourceEndpoint->size() = 1 and targetEndpoint->size() = 1";
-        constraint { true }
-    }
-    constraint def portCompatibilityRule {
-        attribute id = "CR-ONT-003";
-        attribute appliesTo = "LogicalConnector";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "Connected ports must agree on content kind; a fluid port cannot connect to an information port.";
-        attribute predicateExpression = "sourceComponent.ports.contentKind->intersect(targetComponent.ports.contentKind)->size() >= 1";
-        constraint { true }
-    }
-    constraint def directionAgreesWithFlowRule {
-        attribute id = "CR-ONT-004";
-        attribute appliesTo = "LogicalExchange";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "Exchange direction must agree with the direction of its source and target ports.";
-        attribute predicateExpression = "sourcePort.direction != DirectionKind::input and targetPort.direction != DirectionKind::output";
-        constraint { true }
-    }
-    constraint def exchangedItemTypeRule {
-        attribute id = "CR-ONT-005";
-        attribute appliesTo = "LogicalExchange";
-        attribute severity = RuleSeverityKind::warning;
-        attribute rationaleText = "Exchanged items must be type-compatible with the exchange content kind.";
-        attribute predicateExpression = "exchangedItem->isEmpty() or exchangedItem.contentKind = contentKind";
-        constraint { true }
-    }
-
     // ─── Deployment and realization ──────────────────────────────────────
 
-    constraint def deployToCapableNodeRule {
-        attribute id = "CR-ONT-010";
-        attribute appliesTo = "DeploysTo";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "Software deploys only to capable execution nodes (e.g. containerized units require supportsContainerization).";
-        attribute predicateExpression = "deploymentKind != DeploymentKind::containerized or node.supportsContainerization = true";
-        constraint { true }
-    }
-    constraint def runtimeTracesToModuleRule {
+    constraint def RuntimeTracesToModuleRule :> MemoConsistencyRule {
         attribute id = "CR-ONT-011";
+        attribute tailoring = RuleTailoringKind::invariant;
         attribute appliesTo = "SoftwareComponent";
         attribute severity = RuleSeverityKind::warning;
         attribute rationaleText = "Every runtime component must trace to a module-view definition (Realizes).";
         attribute predicateExpression = "realizes->size() >= 1";
         constraint { true }
     }
-    constraint def logicalRealizationTypedRule {
-        attribute id = "CR-ONT-012";
-        attribute appliesTo = "Realizes";
-        attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "Realization relations must resolve both ends to model elements, not name strings.";
-        attribute predicateExpression = "realizing->size() = 1 and realized->size() = 1";
-        constraint { true }
-    }
-
-    constraint def patientContactCharacterizedRule {
+    constraint def PatientContactCharacterizedRule :> MemoConsistencyRule {
         attribute id = "CR-ONT-032";
+        attribute tailoring = RuleTailoringKind::invariant;
         attribute appliesTo = "PhysicalComponent";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Patient-contact components must identify contact nature and duration (ISO 10993-1).";
-        attribute predicateExpression = "patientContact = false or (contactNature != '' and contactDuration != '')";
+        attribute predicateExpression = "patientContact == false or (contactNature != '' and contactDuration != '')";
         constraint { true }
     }
 
     // ─── Assurance coverage ──────────────────────────────────────────────
 
-    constraint def safetyCriticalFunctionVerifiedRule {
+    constraint def SafetyCriticalFunctionVerifiedRule :> MemoConsistencyRule {
         attribute id = "CR-ONT-040";
-        attribute appliesTo = "SystemFunction";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "MemoFunction";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Safety-critical functions (criticality high or catastrophic) must trace to at least one verification case.";
-        attribute predicateExpression = "criticality < CriticalityKind::high or verifiedBy->size() >= 1";
+        attribute predicateExpression = "not(criticality == 'high' or criticality == 'catastrophic') or verifiedBy->size() >= 1";
         constraint { true }
     }
-    constraint def criticalTaskValidatedRule {
+    constraint def CriticalTaskValidatedRule :> MemoConsistencyRule {
         attribute id = "CR-ONT-041";
+        attribute tailoring = RuleTailoringKind::invariant;
         attribute appliesTo = "UserTask[criticality=high]";
         attribute severity = RuleSeverityKind::error;
         attribute rationaleText = "Critical tasks (criticality high or catastrophic) must trace to usability validation (FDA HF guidance; IEC 62366-1 summative evaluation).";
-        attribute predicateExpression = "criticality < CriticalityKind::high or validates->size() >= 1";
+        attribute predicateExpression = "not(criticality == 'high' or criticality == 'catastrophic') or validates->size() >= 1";
         constraint { true }
     }
-    constraint def useErrorTracesToHazardRule {
+    constraint def UseErrorTracesToHazardRule :> MemoConsistencyRule {
         attribute id = "CR-ONT-042";
+        attribute tailoring = RuleTailoringKind::invariant;
         attribute appliesTo = "UseError";
         attribute severity = RuleSeverityKind::warning;
         attribute rationaleText = "Safety-relevant use errors (severity serious or worse) must trace to a hazard.";
-        attribute predicateExpression = "severity < SeverityKind::serious or causes->size() >= 1";
+        attribute predicateExpression = "not(severity == 'serious' or severity == 'critical' or severity == 'catastrophic') or causes->size() >= 1 or tracesRisk->size() >= 1";
         constraint { true }
     }
-    constraint def alternateScenarioHasBaseRule {
-        attribute id = "CR-ONT-043";
-        attribute appliesTo = "MemoScenario";
+    // ─── Relation end conformance (Track A0) ─────────────────────────────
+    //
+    // These rules carry the constraints that `connection def` end TYPES used to
+    // carry in memo_core_relationships. The types had to go: KerML forbids a
+    // port or a behaviour from specializing a part-based type, so a
+    // `MemoPart`-typed end forced every endpoint to be a part — which is why
+    // ports are part defs, why a function is a part with its behaviour stapled
+    // on, and why `allocate <function> to <actor>` is rejected. See the Track A0
+    // note at the top of memo_core_relationships.
+    //
+    // Each rule states what its end stated, in the one vocabulary that survives
+    // the metaclass split:
+    //
+    //   * `conformsTo(Base)` — SysML specialization against a MEMO base. This is
+    //     the part the end type expressed, and it still works within a metaclass.
+    //   * `construct == 'action' | 'port' | 'state' | …` — the SysML METACLASS.
+    //     No MEMO base can say this, because the bases are per-metaclass by
+    //     construction; a type-based end could only ever admit one of them.
+    //
+    // Several of these are WIDER than the end they replace, and deliberately so:
+    // the ends were being violated by content that already shipped. `composes`
+    // was typed MemoPart/MemoPart and links StateMachine (a state def) to
+    // WorkflowStep (an action def); `verifiedBy`'s source was typed MemoPart and
+    // most of its sources are requirement defs; `precedes` was typed
+    // ArchitectureElement and joins OperationalActivity to OperationalActivity.
+    // A rule that reproduced the old type exactly would have failed on the
+    // flagship example on the day it landed. What each rule asserts is the
+    // constraint the end MEANT, stated so it can be checked.
+    //
+    // Subject scope is `Model`, following CR-ONT-001: a statement about the ends
+    // of a relation quantifies over its LINKS, not over elements of one kind, so
+    // no per-element subject can reach it. The cost is that a violation names
+    // the rule and not the offending link; the rationale text names the relation
+    // and the admissible types so the report is still actionable.
+
+    constraint def SatisfiedBySourceKindRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-060";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "Model";
         attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "Alternate, exception, and recovery scenarios must identify their base scenario or variation point — never duplicate the workflow.";
-        attribute predicateExpression = "variantKind = ScenarioVariantKind::nominal or baseScenario->size() = 1 or variationPoint != ''";
+        attribute rationaleText = "Only a requirement or a need is satisfied by something. The source end of SatisfiedBy must conform to MemoRequirementElement.";
+        attribute predicateExpression = "sourcesOf(satisfiedBy)->forAll(conformsTo(MemoRequirementElement))";
+        constraint { true }
+    }
+    constraint def SatisfiedByTargetKindRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-061";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "Model";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "A requirement is satisfied by a designed thing: an architecture element, an actor, a behaviour, or a port. Never by another requirement or by a document.";
+        attribute predicateExpression = "targetsOf(satisfiedBy)->forAll(conformsTo(ArchitectureElement) or conformsTo(Actor) or construct == 'action' or construct == 'port')";
+        constraint { true }
+    }
+    constraint def VerifiedByTargetKindRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-062";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "Model";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "A verification case verifies a requirement, a risk control, an architecture element, a behaviour, or a port — something a test can be run against. Not a view, not an evidence record.";
+        attribute predicateExpression = "sourcesOf(verifiedBy)->forAll(conformsTo(MemoPart) or construct == 'requirement' or construct == 'action' or construct == 'port')";
+        constraint { true }
+    }
+    constraint def AllocatedToSourceKindRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-063";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "Model";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "Allocation runs from a function or a behaviour to where it runs. The source end of AllocatedTo is an architecture element or an action.";
+        attribute predicateExpression = "sourcesOf(allocatedTo)->forAll(conformsTo(ArchitectureElement) or construct == 'action')";
+        constraint { true }
+    }
+    constraint def AllocatedToTargetKindRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-064";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "Model";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "A function is allocated to an architecture element or to an actor — ARCADIA System Analysis allocates to the system OR to an actor, which the former ArchitectureElement-typed end made impossible.";
+        attribute predicateExpression = "targetsOf(allocatedTo)->forAll(conformsTo(ArchitectureElement) or conformsTo(Actor))";
+        constraint { true }
+    }
+    constraint def ComposesParentKindRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-065";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "Model";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "A whole in a decomposition is a part, a behaviour, or a state machine. A requirement does not compose anything.";
+        attribute predicateExpression = "sourcesOf(composes)->forAll(conformsTo(MemoPart) or construct == 'action' or construct == 'state')";
+        constraint { true }
+    }
+    constraint def ComposesChildKindRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-066";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "Model";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "A part in a decomposition is a part, a behaviour, a state, or a port — a component owns its ports, and a workflow owns its steps.";
+        attribute predicateExpression = "targetsOf(composes)->forAll(conformsTo(MemoPart) or construct == 'action' or construct == 'state' or construct == 'port')";
+        constraint { true }
+    }
+    constraint def PrecedesEndKindRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-067";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "Model";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "Precedence orders things that happen: architecture elements or behaviours, at both ends.";
+        attribute predicateExpression = "sourcesOf(precedes)->forAll(conformsTo(ArchitectureElement) or construct == 'action') and targetsOf(precedes)->forAll(conformsTo(ArchitectureElement) or construct == 'action')";
+        constraint { true }
+    }
+    constraint def PerformsPerformerKindRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-068";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "Model";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "A performer is an operational entity, an actor, or a system action — a part or a behaviour. The end's own documentation said 'or system action' while its MemoPart type forbade one.";
+        attribute predicateExpression = "sourcesOf(performs)->forAll(conformsTo(MemoPart) or construct == 'action')";
+        constraint { true }
+    }
+    constraint def EnablesEnablerKindRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-069";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "Model";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "An enabling system or function enables a workflow: the enabling end is a part or a behaviour.";
+        attribute predicateExpression = "sourcesOf(enables)->forAll(conformsTo(MemoPart) or construct == 'action')";
+        constraint { true }
+    }
+    constraint def BindsToInterfaceEndKindRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-070";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "Model";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "A port binds to an interface. The bound end is an interface definition, which the former InterfaceElement-typed end could not hold at all — Interface specializes MemoInterface, an interface def, not a part.";
+        attribute predicateExpression = "sourcesOf(bindsToInterface)->forAll(conformsTo(InterfaceElement) or construct == 'port') and targetsOf(bindsToInterface)->forAll(conformsTo(InterfaceElement) or construct == 'interface' or construct == 'port')";
+        constraint { true }
+    }
+    constraint def CrossesTrustBoundaryEndKindRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-071";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "Model";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "A boundary is a boundary element or a port; what crosses it is an asset or an exchange item.";
+        attribute predicateExpression = "sourcesOf(crossesTrustBoundary)->forAll(conformsTo(InterfaceElement) or construct == 'port') and targetsOf(crossesTrustBoundary)->forAll(conformsTo(ArchitectureElement) or construct == 'item')";
+        constraint { true }
+    }
+
+    // CR-ONT-002's replacement. ComponentExchange's endpoints are `ref`
+    // features, not links, and the builder projects them as element-ID STRINGS
+    // in the attribute map (a §13.3 string pseudo-reference) — so they cannot be
+    // reached with sourcesOf/targetsOf. They are resolved here by looking the id
+    // up in the kind extent, which is the same statement made the long way.
+    constraint def ComponentExchangeSourceEndpointKindRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-072";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "ComponentExchange";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "An exchange starts at a component or at a boundary port. Stating it as a rule is what let the endpoint refs stop being MemoPart-typed, which is what lets PhysicalPort and SoftwarePort become port defs.";
+        attribute predicateExpression = "attributes.sourceEndpoint == '' or allOfKind('ArchitectureElement')->exists(id == subject.attributes.sourceEndpoint) or allOfKind('InterfaceElement')->exists(id == subject.attributes.sourceEndpoint) or allOfKind('MemoPort')->exists(id == subject.attributes.sourceEndpoint)";
         constraint { true }
     }
-    constraint def singleAxisOwnershipRule {
-        attribute id = "CR-ONT-045";
-        attribute appliesTo = "MemoPart";
+    constraint def ComponentExchangeTargetEndpointKindRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-073";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "ComponentExchange";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "An exchange ends at a component or at a boundary port, on the same grounds as CR-ONT-072.";
+        attribute predicateExpression = "attributes.targetEndpoint == '' or allOfKind('ArchitectureElement')->exists(id == subject.attributes.targetEndpoint) or allOfKind('InterfaceElement')->exists(id == subject.attributes.targetEndpoint) or allOfKind('MemoPort')->exists(id == subject.attributes.targetEndpoint)";
+        constraint { true }
+    }
+
+    // ─── The functional chain ────────────────────────────────────────────
+    //
+    // What makes ComponentFunction a definition of its own rather than an enum
+    // member on SystemFunction. An enum value cannot change a multiplicity, and
+    // "answerable to exactly one component" is the whole content of the concept.
+
+    constraint def ComponentFunctionAllocatedRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-074";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "ComponentFunction";
         attribute severity = RuleSeverityKind::error;
-        attribute rationaleText = "Every element is owned by exactly one axis, encoded by its owning package: a horizontal architecture layer (memo_architecture_*) XOR a vertical assurance discipline (memo_assurance_*) — never both. Cross-axis participation is expressed by typed relationships, not by dual membership.";
-        attribute predicateExpression = "owningPackage.startsWith('memo_architecture_') xor owningPackage.startsWith('memo_assurance_')";
+        attribute rationaleText = "A component function is the responsibility of exactly one component, and AllocatedTo is what names it. A component function allocated nowhere is a responsibility nobody has accepted; one allocated twice is a responsibility nobody owns. A system-level responsibility with no single owner is a SystemFunction, which allows that.";
+        attribute predicateExpression = "allocatedTo->size() == 1";
+        constraint { true }
+    }
+    constraint def FunctionDecomposesIntoFunctionsRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-075";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "MemoFunction";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "The functional chain decomposes functions into functions. A function composed of a component, or owned by one, is confusing allocation with decomposition — the component is named by AllocatedTo, never by Composes.";
+        attribute predicateExpression = "composes->forAll(conformsTo(MemoFunction))";
+        constraint { true }
+    }
+
+    // Track A3. The flow is the edge; the exchange part carries the budget and
+    // assurance attributes. The two halves are bound by a SHARED NAME — the flow
+    // usage is named with its exchange — and this is what makes that binding a
+    // checked fact rather than a convention someone can quietly break.
+    //
+    // It needs `linksOf`, because the question is about a link's IDENTITY, not
+    // about what sits at its ends: `sourcesOf`/`targetsOf` yield the elements at
+    // the ends and can never answer it. Naming the flow is what the grammar's
+    // restored FlowDeclaration name makes possible at all.
+    constraint def ExchangeHasFlowRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-076";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "ComponentExchange";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "An exchange states that something crosses a boundary, which is an EDGE, and the edge is a native flow. The part def exists for the budget and assurance attributes a reader has to find from the edge, so the two are named alike and this rule holds them together. An exchange with no flow is a budget attached to nothing.";
+        attribute predicateExpression = "linksOf(flow)->exists(id == subject.id)";
+        constraint { true }
+    }
+
+    constraint def AlternateScenarioHasBaseRule :> MemoConsistencyRule {
+        attribute id = "CR-ONT-043";
+        attribute tailoring = RuleTailoringKind::invariant;
+        attribute appliesTo = "MemoScenario";
+        attribute severity = RuleSeverityKind::error;
+        attribute rationaleText = "Alternate, exception, and recovery scenarios must identify their base scenario or variation point — never duplicate the workflow.";
+        attribute predicateExpression = "not(variantKind == 'alternate' or variantKind == 'exception' or variantKind == 'recovery') or baseScenario->size() == 1 or variationPoint != ''";
         constraint { true }
     }
 }

package/src/rules/quantitative/quantitative_rules.sysml

@@ -1,28 +1,28 @@
-// C5 quantitative rule pack — native KerML constraints (Epic EE-3).
-// Numeric cardinality bounds migrated from cardinalityCheck predicate parts to
-// native `constraint def` bodies. The aggregate ratio rule (QT-003) is a
-// model-level metric, not a single-subject predicate, and is omitted (see note).
+// Quantitative per-subject cardinality constraints. Aggregate ratios belong to
+// model-level coverage reporting rather than this evaluator.
 package memo_rules_quantitative {
     private import ScalarValues::*;
 
     private import memo_core_consistency_rules::*;
     private import memo_core_enumerations::*;
 
-    constraint def hazardMaxControlsRule {
+    constraint def HazardMaxControlsRule :> MemoConsistencyRule {
         attribute id = "QT-001";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "Hazard";
         attribute severity = RuleSeverityKind::info;
         attribute rationaleText = "Excessive controls per hazard suggests the hazard is too broad and should be decomposed.";
-        attribute predicateExpression = "mitigates->size() >= 0 and mitigates->size() <= 10";
+        attribute predicateExpression = "mitigates->size() <= 10";
         constraint { true }
     }
 
-    constraint def swComponentMaxInterfacesRule {
+    constraint def SwComponentMaxInterfacesRule :> MemoConsistencyRule {
         attribute id = "QT-002";
+        attribute tailoring = RuleTailoringKind::assurance;
         attribute appliesTo = "SoftwareModule";
         attribute severity = RuleSeverityKind::info;
         attribute rationaleText = "High interface count indicates excessive coupling; consider decomposition.";
-        attribute predicateExpression = "threatenedBy->size() >= 0 and threatenedBy->size() <= 8";
+        attribute predicateExpression = "threatenedBy->size() <= 8";
         constraint { true }
     }
 

package/src/viewpoints/catalog/memo_viewpoint_catalog.sysml

@@ -34,8 +34,8 @@ package memo_viewpoints_catalog {
         attribute :>> purpose = "Workflow steps, decisions, parallel work, handoffs, and roles.";
         attribute :>> defaultViewKind = DiagramViewKind::actionflow;
     }
-    part vpOperativeScenario : Viewpoint {
-        attribute :>> id = "VP-CAT-005"; attribute :>> name = "OperativeScenarioViewpoint";
+    part vpScenario : Viewpoint {
+        attribute :>> id = "VP-CAT-005"; attribute :>> name = "ScenarioViewpoint";
         attribute :>> purpose = "Selected paths through workflows: variants, conditions, variation points.";
         attribute :>> defaultViewKind = DiagramViewKind::actionflow;
     }
@@ -151,13 +151,20 @@ package memo_viewpoints_catalog {
     }
     // A software sequence diagram is a VIEW conforming to this viewpoint
     // (ISO/IEC/IEEE 42010): it frames the runtime message ordering between
-    // SoftwareComponents realizing a FunctionalScenario. The viewpoint is the
+    // SoftwareComponents realizing a functional MemoScenario. The viewpoint is the
     // reusable spec; the diagram of a specific model is the view.
     part vpSoftwareSequence : Viewpoint {
         attribute :>> id = "VP-CAT-027"; attribute :>> name = "SoftwareSequenceViewpoint";
         attribute :>> purpose = "Runtime message ordering between software components along a functional scenario.";
         attribute :>> defaultViewKind = DiagramViewKind::sequence;
     }
+    // The first cataloged viewpoint to resolve to `geometry`: screen regions
+    // carry authored RegionBounds, so a geometry view draws modelled facts.
+    part vpUILayout : Viewpoint {
+        attribute :>> id = "VP-CAT-028"; attribute :>> name = "UILayoutViewpoint";
+        attribute :>> purpose = "Captured screens with their marked regions and the UI elements those regions present.";
+        attribute :>> defaultViewKind = DiagramViewKind::geometry;
+    }
 
     // ── Compatibility mappings (§22): legacy diagram intents resolve to
     //     standard view kinds; C4 and AADL stay in examples/ mappings. ──

package/src/viewpoints/clinical/clinical_viewpoint.sysml

@@ -9,7 +9,7 @@ package memo_viewpoints_clinical_clinical_viewpoint {
         attribute :>> name = "ClinicalViewpoint";
         attribute :>> title = "Clinical Viewpoint";
         attribute :>> shortDescription = "Shows clinical context, users, use environment, and clinical evidence.";
-        attribute :>> longDescription = "Default viewpoint derived from the context and assurance layers for clinical stakeholders — intended use, patient/clinician interaction, clinical evidence, and clinical safety claims.";
+        attribute :>> description = "Default viewpoint derived from the context and assurance layers for clinical stakeholders — intended use, patient/clinician interaction, clinical evidence, and clinical safety claims.";
         attribute :>> purpose = "Communicate clinical use context and clinical evidence for the device.";
         attribute :>> audience = (AudienceKind::clinicalEngineer, AudienceKind::regulatoryEngineer);
         attribute :>> stage = WorkflowStageKind::context;
@@ -18,7 +18,9 @@ package memo_viewpoints_clinical_clinical_viewpoint {
         attribute :>> presentationKind = (PresentationKind::narrativeSection);
         attribute :>> concernKinds = (ConcernKind::safety, ConcernKind::clinical);
         attribute :>> includedLayers = ("context", "assurance");
-        attribute :>> allowedElementKinds = ("Actor", "UseContext", "Evidence");
+        attribute :>> explorerLane = "assurance";
+        attribute :>> explorerOrder = 4;
+        attribute :>> allowedElementKinds = ("Actor", "UseContext", "MemoEvidence");
         attribute :>> userExtensible = true;
     }
 }

package/src/viewpoints/clinical/{clinical_evidence_view → views/clinical_evidence_view}/clinical_evidence_view.sysml

@@ -1,11 +1,11 @@
-package memo_viewpoints_clinical_clinical_evidence_view {
+package memo_viewpoints_clinical_views_clinical_evidence_view {
     private import ScalarValues::*;
 
                 private import memo_viewpoints_definitions::*;
                 private import memo_core_enumerations::*;
 
                 view def MemoClinicalEvidenceView :> MemoDocumentView {
-    attribute :>> viewKind = DocumentViewKind::Clinical;
+    attribute :>> viewKind = DocumentViewKind::clinical;
     attribute :>> generationRule = "Include use contexts, actors, and clinical evidence supporting the device's intended use, filtered to clinical concern.";
     attribute :>> outputKind = (ViewOutputKind::documentSection);
     attribute :>> presentationKind = (PresentationKind::narrativeSection);

package/src/viewpoints/context/context_viewpoint.sysml

@@ -9,7 +9,7 @@ package memo_viewpoints_context_context_viewpoint {
         attribute :>> name = "ContextViewpoint";
         attribute :>> title = "System Context Viewpoint";
         attribute :>> shortDescription = "Shows actors, use context, and system boundary.";
-        attribute :>> longDescription = "Default viewpoint derived from the context layer to communicate who interacts with the device, under which use conditions, and where trust or safety boundaries exist.";
+        attribute :>> description = "Default viewpoint derived from the context layer to communicate who interacts with the device, under which use conditions, and where trust or safety boundaries exist.";
         attribute :>> purpose = "Communicate operational context and boundaries.";
         attribute :>> audience = (AudienceKind::systemArchitect);
         attribute :>> stage = WorkflowStageKind::context;
@@ -18,6 +18,8 @@ package memo_viewpoints_context_context_viewpoint {
         attribute :>> presentationKind = (PresentationKind::blockDiagram);
         attribute :>> concernKinds = (ConcernKind::safety, ConcernKind::interoperability);
         attribute :>> includedLayers = ("context");
+        attribute :>> explorerLane = "architecture";
+        attribute :>> explorerOrder = 0;
         // UseEnvironment (IEC 62366-1 3.20) is what the device sits inside —
         // facility, procedure area, ambient conditions. A context view that
         // cannot show it is missing half of "where is this used".
@@ -27,7 +29,7 @@ package memo_viewpoints_context_context_viewpoint {
         // boundary picture. Projects derive their own verbs from it and are
         // picked up through the specialization closure. The three older
         // relations remain for models authored before it existed.
-        attribute :>> allowedRelationshipKinds = ("InteractsInContext", "InteractsWith", "ExchangesWith", "ConnectsPhysically");
+        attribute :>> allowedRelationshipKinds = ("InteractsInContext", "InteractsWith", "flow", "bind", "connect");
         attribute :>> userExtensible = true;
     }
 }

package/src/viewpoints/context/{system_context_view → views/system_context_view}/system_context_view.sysml

@@ -1,4 +1,4 @@
-package memo_viewpoints_context_system_context_view {
+package memo_viewpoints_context_views_system_context_view {
     private import ScalarValues::*;
 
                 private import memo_viewpoints_definitions::*;
@@ -6,7 +6,7 @@ package memo_viewpoints_context_system_context_view {
     private import memo_viewpoints_context_context_viewpoint::*;
 
                 view systemContextView : MemoDiagramView {
-                    expose memo_viewpoints_context_system_context_view::*;
+                    expose memo_viewpoints_context_views_system_context_view::*;
                     attribute depth = 2;
     attribute :>> id = "VIEW-CTX-001";
     attribute :>> name = "SystemContextView";

package/src/viewpoints/cybersecurity/cybersecurity_viewpoint.sysml

@@ -9,7 +9,7 @@ package memo_viewpoints_cybersecurity_cybersecurity_viewpoint {
         attribute :>> name = "CybersecurityViewpoint";
         attribute :>> title = "Cybersecurity Viewpoint";
         attribute :>> shortDescription = "Shows assets, trust boundaries, threats, vulnerabilities, cyber hazards, cyber risks, and mitigations.";
-        attribute :>> longDescription = "Default viewpoint derived from the cybersecurity layer, using STRIDE-style threat categories by default while allowing safety and privacy impacts to be traced into the broader model.";
+        attribute :>> description = "Default viewpoint derived from the cybersecurity layer, using STRIDE-style threat categories by default while allowing safety and privacy impacts to be traced into the broader model.";
         attribute :>> purpose = "Communicate cybersecurity design, threat analysis, and cyber risk posture.";
         attribute :>> audience = (AudienceKind::securityEngineer);
         attribute :>> stage = WorkflowStageKind::risk;
@@ -18,7 +18,9 @@ package memo_viewpoints_cybersecurity_cybersecurity_viewpoint {
         attribute :>> presentationKind = (PresentationKind::custom);
         attribute :>> concernKinds = (ConcernKind::cybersecurity, ConcernKind::privacy, ConcernKind::safety);
         attribute :>> includedLayers = ("cybersecurity", "software_structure", "hardware_structure", "interfaces", "risk", "assurance");
-        attribute :>> allowedElementKinds = ("CybersecurityAsset", "Threat", "Vulnerability", "CyberHazard", "CyberRisk", "CyberMitigation", "SecurityRequirement", "TrustBoundary", "ThreatScenario");
+        attribute :>> explorerLane = "assurance";
+        attribute :>> explorerOrder = 3;
+        attribute :>> allowedElementKinds = ("CybersecurityAsset", "Threat", "Vulnerability", "CyberHazard", "CyberRisk", "CyberMitigation", "SecurityRequirement", "TrustBoundary", "MemoScenario[scenarioKind=threat]");
         attribute :>> allowedRelationshipKinds = ("ThreatenedBy", "Exploits", "RealizedByScenario", "Mitigates", "DerivesCyberRequirement", "ImpactsSafety", "CrossesTrustBoundary");
         attribute :>> documentUsage = ("Secure Product Development", "Threat Model", "Cybersecurity Risk Assessment", "QMSR");
         attribute :>> userExtensible = true;

package/src/viewpoints/cybersecurity/{cybersecurity_assessment_view → views/cybersecurity_assessment_view}/cybersecurity_assessment_view.sysml

@@ -1,11 +1,11 @@
-package memo_viewpoints_cybersecurity_cybersecurity_assessment_view {
+package memo_viewpoints_cybersecurity_views_cybersecurity_assessment_view {
     private import ScalarValues::*;
 
                 private import memo_viewpoints_definitions::*;
                 private import memo_core_enumerations::*;
 
                 view def MemoCybersecurityAssessmentView :> MemoDocumentView {
-    attribute :>> viewKind = DocumentViewKind::CybersecurityAssessment;
+    attribute :>> viewKind = DocumentViewKind::cybersecurityAssessment;
     attribute :>> generationRule = "Include cyber risks, exploitability, mitigations, security requirements, verification, residual risk, and postmarket evidence references.";
     attribute :>> outputKind = (ViewOutputKind::documentSection);
     attribute :>> presentationKind = (PresentationKind::riskTable);

package/src/viewpoints/cybersecurity/{threat_model_view → views/threat_model_view}/threat_model_view.sysml

@@ -1,11 +1,11 @@
-package memo_viewpoints_cybersecurity_threat_model_view {
+package memo_viewpoints_cybersecurity_views_threat_model_view {
     private import ScalarValues::*;
 
                 private import memo_viewpoints_definitions::*;
                 private import memo_core_enumerations::*;
 
                 view def MemoCybersecurityThreatModelView :> MemoDocumentView {
-    attribute :>> viewKind = DocumentViewKind::ThreatModel;
+    attribute :>> viewKind = DocumentViewKind::threatModel;
     attribute :>> generationRule = "Include assets, trust boundaries, threat scenarios, vulnerabilities, mitigations, and trace links to safety/privacy concerns.";
     attribute :>> outputKind = (ViewOutputKind::documentSection);
     attribute :>> presentationKind = (PresentationKind::narrativeSection);

package/src/viewpoints/definitions/memo_viewpoint_definitions.sysml

@@ -1,4 +1,5 @@
 package memo_viewpoints_definitions {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
 
     private import memo_core_common::*;
@@ -21,6 +22,10 @@ package memo_viewpoints_definitions {
         attribute userExtensible : Boolean;
         // Optional navigation grouping interpreted by Memo Architect.
         attribute group : String;
+        // Explorer placement follows the MEMO V-model: Architecture is read
+        // top-to-bottom; Assurance is read left-to-right.
+        attribute explorerLane : String;
+        attribute explorerOrder : Integer;
         // default diagram kind for a catalog viewpoint (optional)
         attribute defaultViewKind : DiagramViewKind[0..1];
     }

package/src/viewpoints/functional/functional_viewpoint.sysml

@@ -9,7 +9,7 @@ package memo_viewpoints_functional_functional_viewpoint {
         attribute :>> name = "FunctionalViewpoint";
         attribute :>> title = "Functional Viewpoint";
         attribute :>> shortDescription = "Shows system functions, their decomposition, and allocation.";
-        attribute :>> longDescription = "Default viewpoint derived from the functions layer for what the system does, independent of how it is structured — function trees, function allocation, and behavior triggers.";
+        attribute :>> description = "Default viewpoint derived from the functions layer for what the system does, independent of how it is structured — function trees, function allocation, and behavior triggers.";
         attribute :>> purpose = "Describe the system's functional decomposition and behavior.";
         attribute :>> audience = (AudienceKind::systemArchitect);
         attribute :>> stage = WorkflowStageKind::architecture;
@@ -18,7 +18,9 @@ package memo_viewpoints_functional_functional_viewpoint {
         attribute :>> presentationKind = (PresentationKind::activityDiagram);
         attribute :>> concernKinds = (ConcernKind::safety, ConcernKind::performance);
         attribute :>> includedLayers = ("functions");
-        attribute :>> allowedElementKinds = ("SystemFunction", "FunctionalFlow", "FunctionalFlowStep", "FunctionalScenario", "FunctionalExchange");
+        attribute :>> explorerLane = "architecture";
+        attribute :>> explorerOrder = 2;
+        attribute :>> allowedElementKinds = ("SystemFunction", "ComponentFunction", "FunctionalFlow", "FunctionalFlowStep", "MemoScenario[scenarioKind=functional]", "FunctionalExchange");
         attribute :>> userExtensible = true;
     }
 }