@memoarchitect/ontology 0.7.0 → 0.8.22

package/extensions/README.md

@@ -0,0 +1,94 @@
+# Extensions
+
+An extension is a **way to model**, not a sample. It is a reusable ontology
+package that specializes the base and is selected by a methodology or a project
+binding — so extensions live here, beside `src/`, and not under `examples/`.
+Examples *use* extensions; `examples/ros-mobile-robot` demonstrates one.
+
+MEMO defines no extension metaclass. An extension is a plain SysML package:
+
+- outside `src/` and outside the `memo::` namespace;
+- with a `memo.package.yaml` carrying identity and `sysmlDir` only (the semantic
+  fields `type` / `extends` / `usage` / `ontologies` / `methodology` / `modules`
+  are rejected);
+- whose SysML **specializes** base types;
+- plus a `MethodologyDefinition` naming `baseMethodology`, `scopeMode`, and its
+  own `includedModule`.
+
+`template/` is the skeleton. The build round-trips every extension into its own
+KPAR and resolves it with `syside check`, exactly as it does the base.
+
+## Composition happens at the project binding
+
+`MethodologyDefinition.baseMethodology` is `[0..1]` — single inheritance, and
+deliberate. Extensions therefore **do not chain**. Both
+`MethodologyDefinition.includedModule` and `ProjectMethodBinding.includedModule`
+are `String[0..*]`, so a project combines any number of independent extensions
+by listing their modules in its own binding. That is *the* composition
+mechanism; nothing else is supported.
+
+## Rule 1 — use native mechanisms first; extension relations specialize base ones
+
+An extension **may** declare `connection def`s and `allocation def`s when the
+domain adds a relationship SysML does not already express. It must first use
+native ports, interfaces, flows, messages, allocations, and dependencies. ROS
+is the worked example: publisher/subscriber roles are directional ports, the
+message is an item definition, the named topic is an item usage, and native
+interfaces/flows connect them. No ROS publish/subscribe relation exists.
+The OMG's own `Domain Libraries/Requirement Derivation` ships a `connection def`
+next to a `metadata def :> SemanticMetadata` — domain relations are the
+sanctioned extension mechanism in SysML v2 too.
+
+The constraint is on where they root:
+
+> **A relation declared by an extension specializes a base MEMO relation. It
+> never roots independently.**
+
+For a genuinely new relation, `connection def DomainRelation :> MemoLink` is
+correct; `connection def DomainRelation { … }` is not. Rooting independently would give
+the relation no identification core, no place in the relationship registry, and
+no ends the base can reason about — a conforming tool would read it as opaque,
+which is the same defect §2 of the plan names in the base itself. Give each one
+a `metadata def <keyword> … :> SemanticMetadata` as well, for the same reason
+every base relation has one.
+
+The previous guard here was `assert.doesNotMatch(clinical, /connection def/)` —
+a regression check on one example that had grown into an apparent rule. The
+test now enforces the rule written above instead of the accident it was
+guarding.
+
+## Rule 2 — every definition carries the extension's prefix
+
+> **An extension's definition names all begin with the PascalCase form of its
+> directory name.**
+
+`clinical/` gives `ClinicalProcedureWorkflow`, `ros/` gives `RosNode`, `aadl/`
+gives `AadlThread`. Definition names share one flat namespace with the base and
+with every other extension, so without a prefix two independent extensions could
+both declare `Node` and a project could not include both. The uniqueness check
+compares each extension against the base *and* against every other extension;
+the prefix is what makes that check something an author can satisfy by
+construction rather than by luck.
+
+Enumeration literals are not definitions and are not prefixed —
+`RosReliabilityKind::reliable`, not `RosReliabilityKind::rosReliable`.
+
+## What an extension must not do
+
+- Redefine or restate what the base already expresses — specialize it.
+- Declare a definition name the base or another extension declares.
+- Carry semantic YAML. Identity and `sysmlDir` are the whole descriptor.
+
+## The extensions that ship
+
+| Directory | Prefix | What it adds |
+| --- | --- | --- |
+| `template/` | `Template` | The skeleton to copy. |
+| `clinical/` | `Clinical` | Clinical-procedure data on the base operational workflow. |
+| `aadl/` | `Aadl` | The AADL (SAE AS5506) correspondence profile: MEMO names mapped to AADL categories, plus the process / thread / virtual-processor component families. |
+| `cloud/` | `Cloud` | Networked services and managed data stores. |
+| `ros/` | `Ros` | ROS 2: nodes, messages, directional ports, topic/service/action interfaces, QoS, and containerized deployment. |
+
+`aadl`, `cloud`, and `ros` between them are where the twelve runtime-technology
+attributes that used to sit on `SoftwareComponent` now live — see
+`plans/reference/memo-r1-arcadia-residue.md`.

package/extensions/aadl/memo.package.yaml

@@ -0,0 +1,18 @@
+# Application/distribution descriptor for this MEMO package.
+#
+# Identity and location only. It records what this package is called, what
+# version it is, and where its SysML source sits so a resolver can find it.
+# It does not select model content: the project's native SysML imports and its
+# ProjectMethodBinding decide what is in the model. Semantic fields
+# (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
+# removed at the native semantic flip and are now rejected if present.
+name: '@memoarchitect/extension-aadl'
+version: 0.8.22
+description: AADL (SAE AS5506) correspondence profile and runtime component families
+license: MIT
+tags:
+- memo
+- methodology
+- extension
+- aadl
+sysmlDir: ./src

package/extensions/aadl/src/aadl_extension.sysml

@@ -0,0 +1,6 @@
+// The AADL extension's public facade. A project includes the module
+// `memo_extension_aadl` in its binding and imports this package.
+package memo_extension_aadl {
+    public import memo_extension_aadl_runtime::*;
+    public import memo_extension_aadl_correspondence::*;
+}

package/extensions/aadl/src/correspondence/memo_aadl_correspondence.sysml

@@ -0,0 +1,147 @@
+// The AADL correspondence profile (plan §C5).
+//
+// `memo_software_runtime.sysml` pointed at `examples/aadl-mapping` for a long
+// time, and that directory never existed. A dangling pointer to a profile is
+// worse than no profile, so this is the profile.
+//
+// It is written as model content, not prose: each correspondence is a
+// `CorrespondenceRule` — MEMO's own ISO/IEC/IEEE 42010 element for relating
+// elements across architecture descriptions — carrying the MEMO name, the AADL
+// name, and the direction. That makes the mapping greppable, exportable, and
+// checkable, which a comment block is not.
+//
+// Scope: the correspondence records what MEMO already means in AADL terms. It
+// does not claim MEMO is AADL. Where AADL has no MEMO counterpart (subprogram,
+// device, abstract) or MEMO has no AADL counterpart (every assurance
+// discipline), there is simply no rule.
+package memo_extension_aadl_correspondence {
+    private import ScalarValues::*;
+
+    private import memo_architecture_operational_context_stakeholders::*;
+
+    // ── Component categories ────────────────────────────────────────────
+    part aadlCorrProcess : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-001";
+        attribute :>> name = "ProcessCorrespondence";
+        attribute :>> ruleExpression = "memo_extension_aadl_runtime::AadlProcess <-> AADL component category `process`";
+        attribute :>> description = "A MEMO SoftwareComponent with runtimeKind = process, carrying addressSpaceIsolated.";
+    }
+    part aadlCorrThread : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-002";
+        attribute :>> name = "ThreadCorrespondence";
+        attribute :>> ruleExpression = "memo_extension_aadl_runtime::AadlThread <-> AADL component category `thread`";
+        attribute :>> description = "Schedulable unit inside one process; owningProcessName names the containing process.";
+    }
+    part aadlCorrVirtualProcessor : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-003";
+        attribute :>> name = "VirtualProcessorCorrespondence";
+        attribute :>> ruleExpression = "memo_extension_aadl_runtime::AadlVirtualProcessor <-> AADL component category `virtual processor`";
+        attribute :>> description = "An ARINC 653 partition. partitionBudget is the guaranteed time and memory; isolationMechanism is what enforces it.";
+    }
+    part aadlCorrProcessor : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-004";
+        attribute :>> name = "ProcessorCorrespondence";
+        attribute :>> ruleExpression = "memo_architecture_realization_physical::ProcessingNode <-> AADL component category `processor`";
+    }
+    part aadlCorrMemory : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-005";
+        attribute :>> name = "MemoryCorrespondence";
+        attribute :>> ruleExpression = "memo_architecture_realization_physical::MemoryDevice <-> AADL component category `memory`";
+    }
+    part aadlCorrBus : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-006";
+        attribute :>> name = "BusCorrespondence";
+        attribute :>> ruleExpression = "memo_architecture_implementation_hardware_electrical::NetworkMedium <-> AADL component category `bus`";
+    }
+    part aadlCorrSystem : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-007";
+        attribute :>> name = "SystemCorrespondence";
+        attribute :>> ruleExpression = "memo_architecture_logical_structure::System <-> AADL component category `system`";
+        attribute :>> description = "AADL's system is the composition unit, which is MEMO's logical System rather than any runtime element.";
+    }
+
+    // ── Bindings. AADL's analytic power is that everything is bound to
+    // something, and the binding is where latency, bandwidth, and fault
+    // propagation accrue. MEMO has all three (plan C1). ────────────────────
+    part aadlCorrProcessorBinding : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-010";
+        attribute :>> name = "ActualProcessorBindingCorrespondence";
+        attribute :>> ruleExpression = "memo_architecture_realization_deployment::DeploysTo <-> AADL property `Actual_Processor_Binding`";
+    }
+    part aadlCorrMemoryBinding : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-011";
+        attribute :>> name = "ActualMemoryBindingCorrespondence";
+        attribute :>> ruleExpression = "memo_architecture_realization_deployment::MemoryBinding <-> AADL property `Actual_Memory_Binding`";
+    }
+    part aadlCorrConnectionBinding : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-012";
+        attribute :>> name = "ActualConnectionBindingCorrespondence";
+        attribute :>> ruleExpression = "memo_architecture_realization_deployment::ConnectionBinding <-> AADL property `Actual_Connection_Binding`";
+        attribute :>> description = "The bound element is the ComponentExchange, because the exchange is what owns the budget the medium spends.";
+    }
+
+    // ── Ports and flows ─────────────────────────────────────────────────
+    part aadlCorrPortCategory : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-020";
+        attribute :>> name = "PortCategoryCorrespondence";
+        attribute :>> ruleExpression = "memo_core_enumerations::PortCategoryKind (data | 'event' | eventData) <-> AADL `data port` | `event port` | `event data port`";
+        attribute :>> description = "Determines whether a missed deadline loses a sample or grows a queue — two failure modes with two mitigations.";
+    }
+    part aadlCorrFlowSpec : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-021";
+        attribute :>> name = "FlowSpecificationCorrespondence";
+        attribute :>> ruleExpression = "memo_architecture_realization_deployment::FlowSpecification (FlowSpecKind source | sink | path) <-> AADL `flow source` | `flow sink` | `flow path`";
+    }
+    part aadlCorrEndToEndFlow : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-022";
+        attribute :>> name = "EndToEndFlowCorrespondence";
+        attribute :>> ruleExpression = "memo_architecture_realization_deployment::EndToEndFlow <-> AADL `end to end flow`";
+    }
+
+    // ── Properties. AADL's property sets are the technology-specific half of
+    // the language; these are the ones MEMO already carries by another name.
+    part aadlCorrPeriod : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-030";
+        attribute :>> name = "PeriodCorrespondence";
+        attribute :>> ruleExpression = "SoftwareComponent.periodMs <-> AADL `Timing_Properties::Period` (ms)";
+    }
+    part aadlCorrDeadline : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-031";
+        attribute :>> name = "DeadlineCorrespondence";
+        attribute :>> ruleExpression = "SoftwareComponent.deadlineMs <-> AADL `Timing_Properties::Deadline` (ms)";
+    }
+    part aadlCorrComputeExecutionTime : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-032";
+        attribute :>> name = "ComputeExecutionTimeCorrespondence";
+        attribute :>> ruleExpression = "SoftwareComponent.wcetMs <-> upper bound of AADL `Timing_Properties::Compute_Execution_Time` (ms)";
+        attribute :>> description = "AADL records a range; MEMO records the worst case, which is the bound a schedulability argument uses.";
+    }
+    part aadlCorrPriority : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-033";
+        attribute :>> name = "PriorityCorrespondence";
+        attribute :>> ruleExpression = "SoftwareComponent.priority <-> AADL `Thread_Properties::Priority`";
+    }
+    part aadlCorrSchedulingProtocol : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-034";
+        attribute :>> name = "SchedulingProtocolCorrespondence";
+        attribute :>> ruleExpression = "SoftwareComponent.schedulingPolicy <-> AADL `Deployment_Properties::Scheduling_Protocol`";
+    }
+    part aadlCorrLatency : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-035";
+        attribute :>> name = "LatencyCorrespondence";
+        attribute :>> ruleExpression = "EndToEndFlow.latencyBudgetMs <-> AADL `Communication_Properties::Latency` upper bound (ms)";
+    }
+    part aadlCorrBandwidth : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-036";
+        attribute :>> name = "BandwidthCorrespondence";
+        attribute :>> ruleExpression = "ConnectionBinding.allocatedBandwidth <-> AADL `Communication_Properties::Bandwidth_Budget`";
+    }
+
+    // ── Where the correspondence stops ──────────────────────────────────
+    part aadlCorrNoCounterpart : CorrespondenceRule {
+        attribute :>> id = "EXT-AADL-C-090";
+        attribute :>> name = "NoCounterpartNote";
+        attribute :>> ruleExpression = "no correspondence: AADL `subprogram`, `device`, `abstract`; MEMO's five assurance disciplines";
+        attribute :>> description = "Recorded so the gap is a stated boundary of the profile rather than an omission a reader has to discover.";
+    }
+}

package/extensions/aadl/src/methodology/aadl_methodology.sysml

@@ -0,0 +1,17 @@
+package memo_extension_aadl_methodology {
+    private import ScalarValues::*;
+    private import memo_methodology_core::*;
+    private import memo_methodology_profiles::*;
+    private import memo_core_enumerations::*;
+
+    part aadlExtensionMethod : MethodologyDefinition {
+        attribute :>> id = "EXT-AADL-001";
+        attribute :>> name = "AadlCorrespondenceExtension";
+        attribute :>> version = "0.7.0";
+        attribute :>> domain = "AADL (SAE AS5506) software runtime";
+        attribute :>> description = "Adds the AADL correspondence profile and the process / thread / virtual-processor runtime families.";
+        ref :>> baseMethodology = mdDefaultDefinition;
+        attribute :>> scopeMode = ScopeModeKind::explicit;
+        attribute :>> includedModule = "memo_extension_aadl";
+    }
+}

package/extensions/aadl/src/runtime/memo_aadl_runtime.sysml

@@ -0,0 +1,56 @@
+// AADL (SAE AS5506) runtime component families.
+//
+// `SoftwareComponent.runtimeKind` says WHICH family a component belongs to and
+// the base stops there, deliberately: the timing and assurance properties
+// (period, deadline, WCET, scheduling policy, priority, health monitoring,
+// restart policy, fault containment) are true of every runtime component in
+// every regulated project, so they stay on the base.
+//
+// What the base used to carry as well was a set of attributes documented "set
+// only for the relevant runtimeKind" — a subtype family in disguise, and one
+// with a specific technology behind it. `addressSpaceIsolated` and
+// `owningProcessName` are AADL's process/thread distinction; `partitionBudget`
+// and `isolationMechanism` are AADL's virtual processor, which is what an
+// ARINC 653 partition is modelled as. Each is unconditional on the type that
+// owns it here, which is the whole point: an optional attribute that is only
+// meaningful for one enum value cannot be checked, and a required attribute on
+// a type can.
+package memo_extension_aadl_runtime {
+    private import ScalarValues::*;
+
+    private import memo_core_enumerations::*;
+    private import memo_architecture_implementation_software_runtime::*;
+
+    // AADL `process`: a protected address space. Threads execute inside it;
+    // the process itself is the fault-containment and memory-protection
+    // boundary, which is why safety arguments quote it.
+    part def AadlProcess specializes SoftwareComponent {
+        attribute :>> runtimeKind = RuntimeKind::process;
+        // Whether the runtime enforces memory protection at this boundary.
+        // A process without address-space isolation is a scheduling unit, not
+        // a containment boundary, and no partitioning claim may rest on it.
+        attribute addressSpaceIsolated : Boolean;
+    }
+
+    // AADL `thread`: a schedulable unit of concurrency, always executing
+    // within exactly one process. The base's period / deadline / WCET /
+    // priority are AADL thread properties already; what was missing was the
+    // containing process.
+    part def AadlThread specializes SoftwareComponent {
+        attribute :>> runtimeKind = RuntimeKind::thread;
+        attribute owningProcessName : String;
+    }
+
+    // AADL `virtual processor`: a partition scheduled on a processor with a
+    // guaranteed budget. This is how an ARINC 653 partition is modelled, and
+    // the budget is what a temporal-partitioning argument is made of.
+    part def AadlVirtualProcessor specializes SoftwareComponent {
+        attribute :>> runtimeKind = RuntimeKind::partition;
+        // Time and memory guaranteed to the partition, e.g. "2 ms window per
+        // 10 ms major frame; 4 MB".
+        attribute partitionBudget : String;
+        // What enforces the partition — MMU, MPU, hypervisor, ARINC 653 module
+        // OS. A budget nothing enforces is a plan, not a control.
+        attribute isolationMechanism : String;
+    }
+}

package/extensions/cloud/memo.package.yaml

@@ -0,0 +1,18 @@
+# Application/distribution descriptor for this MEMO package.
+#
+# Identity and location only. It records what this package is called, what
+# version it is, and where its SysML source sits so a resolver can find it.
+# It does not select model content: the project's native SysML imports and its
+# ProjectMethodBinding decide what is in the model. Semantic fields
+# (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
+# removed at the native semantic flip and are now rejected if present.
+name: '@memoarchitect/extension-cloud'
+version: 0.8.22
+description: Networked services and managed data stores
+license: MIT
+tags:
+- memo
+- methodology
+- extension
+- cloud
+sysmlDir: ./src

package/extensions/cloud/src/cloud_extension.sysml

@@ -0,0 +1,44 @@
+// Networked services and managed data stores — the runtime families a
+// software-only medical device (SaMD) deploys onto infrastructure the
+// manufacturer does not control.
+//
+// This is where `serviceContract`, `discoveryMechanism`, `storageKind`, and
+// `retentionPolicy` live now. All four were optional attributes on
+// `SoftwareComponent` documented "set only for the relevant runtimeKind";
+// here each is unconditional on the type that owns it.
+package memo_extension_cloud {
+    private import ScalarValues::*;
+
+    private import memo_core_enumerations::*;
+    private import memo_architecture_implementation_software_runtime::*;
+
+    // How a store keeps what it is given. A String said nothing a query could
+    // group by, and the retention argument in a records-retention assessment
+    // turns on which of these it is.
+    enum def CloudStorageKind {
+        enum relational;
+        enum document;
+        enum keyValue;
+        enum objectStore;
+        enum timeSeries;
+        enum blockVolume;
+    }
+
+    part def CloudService specializes SoftwareComponent {
+        attribute :>> runtimeKind = RuntimeKind::service;
+        // The externally visible contract: protocol, endpoint, request and
+        // response. This is the boundary a verification case exercises.
+        attribute serviceContract : String;
+        // How callers find it — DNS, service registry, mesh, static endpoint.
+        attribute discoveryMechanism : String;
+    }
+
+    part def CloudDataStore specializes SoftwareComponent {
+        attribute :>> runtimeKind = RuntimeKind::dataStore;
+        attribute storageKind : CloudStorageKind;
+        // How long records are kept and what ends them. Regulated content:
+        // a device record has a retention obligation, and the store is where
+        // that obligation is either met or not.
+        attribute retentionPolicy : String;
+    }
+}

package/extensions/cloud/src/methodology/cloud_methodology.sysml

@@ -0,0 +1,17 @@
+package memo_extension_cloud_methodology {
+    private import ScalarValues::*;
+    private import memo_methodology_core::*;
+    private import memo_methodology_profiles::*;
+    private import memo_core_enumerations::*;
+
+    part cloudExtensionMethod : MethodologyDefinition {
+        attribute :>> id = "EXT-CLOUD-001";
+        attribute :>> name = "CloudRuntimeExtension";
+        attribute :>> version = "0.7.0";
+        attribute :>> domain = "networked services and managed data stores";
+        attribute :>> description = "Adds service and data-store runtime families with their contracts, discovery, and retention.";
+        ref :>> baseMethodology = mdDefaultDefinition;
+        attribute :>> scopeMode = ScopeModeKind::explicit;
+        attribute :>> includedModule = "memo_extension_cloud";
+    }
+}

package/extensions/container/memo.package.yaml

@@ -0,0 +1,18 @@
+# Application/distribution descriptor for this MEMO package.
+#
+# Identity and location only. It records what this package is called, what
+# version it is, and where its SysML source sits so a resolver can find it.
+# It does not select model content: the project's native SysML imports and its
+# ProjectMethodBinding decide what is in the model. Semantic fields
+# (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
+# removed at the native semantic flip and are now rejected if present.
+name: '@memoarchitect/extension-container'
+version: 0.8.22
+description: OCI container images and container runtimes as deployment content
+license: MIT
+tags:
+- memo
+- methodology
+- extension
+- container
+sysmlDir: ./src

package/extensions/container/src/container_extension.sysml

@@ -0,0 +1,37 @@
+// Containerized deployment (OCI). Technology-neutral across orchestrators, so
+// a project that containerizes anything can include this module on its own;
+// `memo_extension_ros` specializes both types rather than restating them.
+//
+// This is where `imageReference` and `orchestrationPlatform` live now. They
+// were optional attributes on `SoftwareComponent` documented "set only when
+// runtimeKind = container" — a subtype family in disguise, and a technology
+// choice the base ontology had no business asserting. On the types below they
+// are unconditional, which is what makes them checkable.
+package memo_extension_container {
+    private import ScalarValues::*;
+
+    private import memo_architecture_realization_deployment::*;
+
+    // The built artifact. `BuildsInto` (SoftwareModule -> DeploymentUnit)
+    // reaches it unchanged, which is the test that the base is factored
+    // correctly: a whole packaging technology lands without touching a base
+    // relation.
+    part def ContainerImage specializes DeploymentUnit {
+        // The pullable reference, e.g. "registry.example.com/screening:1.4.0".
+        attribute imageReference : String;
+        attribute registry : String;
+        // The content digest. A tag can be re-pointed; a digest is what a
+        // design history file can argue reproducibility from.
+        attribute digest : String;
+        attribute baseImage : String;
+    }
+
+    // The environment a node provides. `ProvidesEnvironment` (ProcessingNode
+    // -> RuntimeEnvironment) reaches it unchanged.
+    part def ContainerRuntime specializes RuntimeEnvironment {
+        // Kubernetes, Nomad, Docker Compose, systemd-nspawn, none.
+        attribute orchestrationPlatform : String;
+        // The engine below the orchestrator — containerd, CRI-O, Docker.
+        attribute runtimeEngine : String;
+    }
+}

package/extensions/container/src/methodology/container_methodology.sysml

@@ -0,0 +1,17 @@
+package memo_extension_container_methodology {
+    private import ScalarValues::*;
+    private import memo_methodology_core::*;
+    private import memo_methodology_profiles::*;
+    private import memo_core_enumerations::*;
+
+    part containerExtensionMethod : MethodologyDefinition {
+        attribute :>> id = "EXT-CONTAINER-001";
+        attribute :>> name = "ContainerDeploymentExtension";
+        attribute :>> version = "0.7.0";
+        attribute :>> domain = "containerized deployment";
+        attribute :>> description = "Adds OCI container images and container runtimes as deployment content.";
+        ref :>> baseMethodology = mdDefaultDefinition;
+        attribute :>> scopeMode = ScopeModeKind::explicit;
+        attribute :>> includedModule = "memo_extension_container";
+    }
+}

package/extensions/messaging/memo.package.yaml

@@ -0,0 +1,18 @@
+# Application/distribution descriptor for this MEMO package.
+#
+# Identity and location only. It records what this package is called, what
+# version it is, and where its SysML source sits so a resolver can find it.
+# It does not select model content: the project's native SysML imports and its
+# ProjectMethodBinding decide what is in the model. Semantic fields
+# (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
+# removed at the native semantic flip and are now rejected if present.
+name: '@memoarchitect/extension-messaging'
+version: 0.8.22
+description: Publish/subscribe messaging — topics, brokers, and delivery semantics
+license: MIT
+tags:
+- memo
+- methodology
+- extension
+- messaging
+sysmlDir: ./src

package/extensions/messaging/src/messaging_extension.sysml

@@ -0,0 +1,64 @@
+// Messaging vocabulary, technology-neutral across DDS, MQTT, AMQP and Kafka.
+// It specializes native item, port, and interface families; publication and
+// subscription are expressed by port direction plus native flows/messages.
+//
+// This is where `deliverySemantics` and `topicStructure` live now, and moving
+// them fixed a metaclass error as well as a layering one. Both were attributes
+// on `SoftwareComponent`, and neither is a property of a component: a
+// component does not have a topic, a publication does; a component does not
+// have delivery semantics, the channel it publishes over does.
+package memo_extension_messaging {
+    private import ScalarValues::*;
+
+    private import memo_core_common::*;
+    private import memo_core_enumerations::*;
+    private import memo_architecture_logical_interfaces::*;
+    private import memo_architecture_implementation_software_structure::*;
+    private import memo_architecture_implementation_software_runtime::*;
+
+    // What a broker guarantees about each message. Safety-relevant: an alarm
+    // published at-most-once can be silently dropped, and an at-least-once
+    // command can be applied twice.
+    enum def MessagingDeliveryKind {
+        enum atMostOnce;
+        enum atLeastOnce;
+        enum exactlyOnce;
+    }
+
+    // Message/payload definition. A named topic is an item usage of a concrete
+    // message definition; the definition states the schema, while the usage
+    // supplies the deployed topic identity.
+    item def MessagingMessage specializes SoftwareItem {
+        attribute messageSchema : String;
+    }
+
+    // Endpoint roles. Direction is native on both the port's payload feature
+    // and the port usage placed on a component. The shared `topic` reference
+    // points every endpoint at the same named item usage.
+    port def MessagingPublisher specializes SoftwarePort {
+        out item payload : MessagingMessage;
+        ref item topic : MessagingMessage;
+        attribute deliverySemantics : MessagingDeliveryKind;
+        attribute publishRateHz : Real;
+    }
+
+    port def MessagingSubscriber specializes SoftwarePort {
+        in item payload : MessagingMessage;
+        ref item topic : MessagingMessage;
+        attribute deliverySemantics : MessagingDeliveryKind;
+        attribute lossBehaviour : String;
+    }
+
+    interface def MessagingTopicInterface specializes SoftwareInterface {
+        end publisher : MessagingPublisher :>> source;
+        end subscriber : MessagingSubscriber :>> target;
+        flow of MessagingMessage from publisher.payload to subscriber.payload;
+    }
+
+    part def MessagingBroker specializes SoftwareComponent {
+        attribute :>> runtimeKind = RuntimeKind::messageBroker;
+        attribute brokerProduct : String;
+        attribute persistenceEnabled : Boolean;
+    }
+
+}

package/extensions/messaging/src/methodology/messaging_methodology.sysml

@@ -0,0 +1,17 @@
+package memo_extension_messaging_methodology {
+    private import ScalarValues::*;
+    private import memo_methodology_core::*;
+    private import memo_methodology_profiles::*;
+    private import memo_core_enumerations::*;
+
+    part messagingExtensionMethod : MethodologyDefinition {
+        attribute :>> id = "EXT-MESSAGING-001";
+        attribute :>> name = "MessagingExtension";
+        attribute :>> version = "0.7.0";
+        attribute :>> domain = "publish/subscribe messaging";
+        attribute :>> description = "Adds message items, publisher/subscriber ports, topic interfaces, brokers, and delivery semantics.";
+        ref :>> baseMethodology = mdDefaultDefinition;
+        attribute :>> scopeMode = ScopeModeKind::explicit;
+        attribute :>> includedModule = "memo_extension_messaging";
+    }
+}

package/extensions/ros/memo.package.yaml

@@ -0,0 +1,18 @@
+# Application/distribution descriptor for this MEMO package.
+#
+# Identity and location only. It records what this package is called, what
+# version it is, and where its SysML source sits so a resolver can find it.
+# It does not select model content: the project's native SysML imports and its
+# ProjectMethodBinding decide what is in the model. Semantic fields
+# (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
+# removed at the native semantic flip and are now rejected if present.
+name: '@memoarchitect/extension-ros'
+version: 0.8.22
+description: ROS 2 nodes, messages, topic/service/action interfaces, QoS, and containerized deployment
+license: MIT
+tags:
+- memo
+- methodology
+- extension
+- ros
+sysmlDir: ./src

package/extensions/ros/src/methodology/ros_methodology.sysml

@@ -0,0 +1,25 @@
+package memo_extension_ros_methodology {
+    private import ScalarValues::*;
+    private import memo_methodology_core::*;
+    private import memo_methodology_profiles::*;
+    private import memo_core_enumerations::*;
+
+    // An extension that builds on other extensions names them all here.
+    // `baseMethodology` is [0..1] — single inheritance, deliberate — but
+    // `includedModule` is [0..*], so this is how a dependency between
+    // extensions is expressed. There is no chaining and no second base.
+    part rosExtensionMethod : MethodologyDefinition {
+        attribute :>> id = "EXT-ROS-001";
+        attribute :>> name = "Ros2Extension";
+        attribute :>> version = "0.7.0";
+        attribute :>> domain = "ROS 2 robotics middleware";
+        attribute :>> description = "Adds ROS 2 nodes, messages, directional ports, topic/service/action interfaces, QoS, and containerized deployment.";
+        ref :>> baseMethodology = mdDefaultDefinition;
+        attribute :>> scopeMode = ScopeModeKind::explicit;
+        attribute :>> includedModule = (
+            "memo_extension_messaging",
+            "memo_extension_container",
+            "memo_extension_ros"
+        );
+    }
+}