@oimlsmart/primmel-packages 0.1.0

package/oiml-twin-cert/execution/forms/probe.prl

@@ -0,0 +1,99 @@
+form twin-1/probe {
+  name "Twin-Fidelity Probe Record"
+  description "The D2 evidence record of one twin-fidelity probe execution: the served value fetched through the gateway and the reference reading from the declared probe channel, each timestamped, paired within the pairing window — with the channel provenance (channel, register citation, the DECLARED traceability limitation when the channel is observer attestation) and the pairing skew. One record per probe point of the schedule (range, envelope, transitions). Facts only — the fidelity judgment is the verdict chain's (D3), never the form's; the deviation |served − reference| derives ONCE in the twin_deviation_indication characteristic (the one-home doctrine — consumers compute it from the recorded served/reference pair through the characteristic registry, never from a second derivation recorded here)."
+  data_class FormInstance#data
+  conformance_process { /conf/twin-fidelity/probe-range /conf/twin-fidelity/probe-envelope /conf/twin-fidelity/probe-transitions }
+  section "TW-1, 6.2"
+  requirements { /req/twin-fidelity/indication-band /req/twin-fidelity/state-fidelity }
+  ref requirement "urn:oiml:pub:cs:twin-1:2027#clause-5.2"
+  ref requirement "urn:oiml:pub:cs:twin-1:2027#clause-5.5"
+  ref test-procedure "urn:oiml:pub:cs:twin-1:2027#clause-6.2"
+  ref test-procedure "urn:oiml:pub:cs:twin-1:2027#clause-6.3"
+  ref test-procedure "urn:oiml:pub:cs:twin-1:2027#clause-6.4"
+  ref report-format "urn:oiml:pub:cs:twin-1:2027#clause-6.2"
+  field probe_point : string {
+    label "Probe point"
+    description "The schedule point this execution probes (e.g. 'range 50% E_max increasing', 'envelope t_max corner', 'transition fault-annunciation')."
+    required true
+    targets { /req/twin-fidelity/indication-band /req/twin-fidelity/state-fidelity }
+  }
+  field channel : enum {
+    label "Probe channel"
+    description "The physical-side channel the reference reading arrived by — the three-source vocabulary (reference_instrument PREFERRED; observer_attestation admitted with the declared traceability limitation; sim_ground_truth in the acceptance environment only, never a production channel)."
+    required true
+    targets { /req/twin-fidelity/indication-band /req/twin-fidelity/state-fidelity }
+    values { reference_instrument { label "Reference instrument" } observer_attestation { label "Observer attestation" } sim_ground_truth { label "Sim ground truth (acceptance only)" } }
+  }
+  field channel_ref : string {
+    label "Channel register citation"
+    description "The citation of the channel actually used: the equipment-register id with its calibration trace (reference_instrument), the personnel/participant id of the verification officer (observer_attestation), or the sim deployment id (sim_ground_truth)."
+    required true
+    targets { /req/twin-fidelity/indication-band /req/twin-fidelity/state-fidelity }
+  }
+  field traceability_limitation : text {
+    label "Declared traceability limitation"
+    description "The DECLARED limitation the evidence carries when the channel is observer_attestation — attestation-only evidence proves twin ≡ display, not twin ≡ mass (the reference IS the EUT's own indication, never an independent physical standard; controller decision 3). Declared data, never a comment; empty only on the instrument and sim channels."
+    measurement_method declared
+    targets { /req/twin-fidelity/indication-band /req/twin-fidelity/state-fidelity }
+  }
+  field pairing_window : number {
+    label "Pairing window"
+    description "The declared pairing window for the probed register — at most the register's fresh_within (5 s indication, 1 s state on the certified product's serves; controller decision 5). A pair whose skew exceeds it is INVALID, never a fail."
+    unit "s"
+    required true
+    measurement_method declared
+    targets { /req/twin-fidelity/indication-band /req/twin-fidelity/state-fidelity }
+    default 5
+  }
+  field served_indication : number {
+    label "Served indication"
+    description "The served indication fetched through the gateway at probe time (indication probes)."
+    unit "kg"
+    bind sample.test_context.indication
+    targets { /req/twin-fidelity/indication-band }
+  }
+  field reference_indication : number {
+    label "Reference indication"
+    description "The physical-side reference reading paired with the served value (indication probes)."
+    unit "kg"
+    bind sample.test_context.reference_indication
+    targets { /req/twin-fidelity/indication-band }
+  }
+  field served_op_state : string {
+    label "Served operational state"
+    description "The served operational state at the transition (state probes — the twin's state channel)."
+    bind sample.test_context.op_state
+    targets { /req/twin-fidelity/state-fidelity }
+  }
+  field reference_state : string {
+    label "Reference operational state"
+    description "The physical operational state observed at the transition (state probes)."
+    bind sample.test_context.reference_state
+    targets { /req/twin-fidelity/state-fidelity }
+  }
+  field served_at : number {
+    label "Served timestamp"
+    description "The twin's OWN served timestamp for the served reading (timestamp_fields — never the platform's receipt clock), epoch seconds."
+    unit "s"
+    required true
+    bind sample.test_context.served_at
+    targets { /req/twin-fidelity/indication-band /req/twin-fidelity/state-fidelity }
+  }
+  field observed_at : number {
+    label "Observation timestamp"
+    description "The reference observation timestamp captured at evidence-capture time, epoch seconds."
+    unit "s"
+    required true
+    bind sample.test_context.observed_at
+    targets { /req/twin-fidelity/indication-band /req/twin-fidelity/state-fidelity }
+  }
+  field pair_skew : number {
+    label "Pairing skew"
+    description "The pairing skew |served timestamp − reference observation timestamp| — a skew beyond the pairing window INVALIDATES the execution (the setup was wrong), never a fail."
+    unit "s"
+    targets { /req/twin-fidelity/indication-band /req/twin-fidelity/state-fidelity }
+    calculation "ocl{abs(served_at - observed_at)}"
+  }
+  pass_fail { criteria "The execution is admissible: the pair was taken within the declared pairing window (a violating pair is INVALID, never a fail) — the fidelity judgment itself is the verdict chain's (the canonical deviation verdict and the state-equality criterion)." pass_if "ocl{pair_skew <= pairing_window}" }
+}
+

package/oiml-twin-cert/execution/forms/static-conformance.prl

@@ -0,0 +1,50 @@
+form twin-1/static-conformance {
+  name "Static Conformance Admission Record"
+  description "The D2 evidence record of the static-conformance admission check: the twin's served interface — endpoint identifier, operations, payload schemas and quantity kinds, access scopes — read and compared against the pinned product package's endpoint declaration before any value-fidelity probing. A twin that mis-serves its declared contract never reaches value probes (the C84-class startup check surfaced as the schedule's admission test)."
+  data_class FormInstance#data
+  conformance_process /conf/twin-fidelity/static-conformance-admission
+  section "TW-1, 6.1"
+  requirements { /req/twin-fidelity/static-conformance }
+  ref requirement "urn:oiml:pub:cs:twin-1:2027#clause-5.1"
+  ref test-procedure "urn:oiml:pub:cs:twin-1:2027#clause-6.1"
+  ref report-format "urn:oiml:pub:cs:twin-1:2027#clause-6.1"
+  field endpoint_id : string {
+    label "Served endpoint identifier"
+    description "The endpoint identifier the twin actually serves, read at admission."
+    required true
+    targets { /req/twin-fidelity/static-conformance }
+  }
+  field declared_endpoint_id : string {
+    label "Declared endpoint identifier"
+    description "The endpoint identifier of the pinned product package's endpoint declaration (the abstract import acme-lc500@2021 — C83's edition-pin discipline)."
+    required true
+    measurement_method declared
+    targets { /req/twin-fidelity/static-conformance }
+  }
+  field operations_match : boolean {
+    label "Operations equal the declaration"
+    description "The served operations equal the declared operations, names and kinds."
+    required true
+    targets { /req/twin-fidelity/static-conformance }
+    true_label "Equal"
+    false_label "Mismatch"
+  }
+  field payload_schemas_match : boolean {
+    label "Payload schemas equal the declaration"
+    description "The served payload schemas and quantity kinds equal the declaration."
+    required true
+    targets { /req/twin-fidelity/static-conformance }
+    true_label "Equal"
+    false_label "Mismatch"
+  }
+  field access_scopes_match : boolean {
+    label "Access scopes equal the declaration"
+    description "The served access scopes equal the declared scopes."
+    required true
+    targets { /req/twin-fidelity/static-conformance }
+    true_label "Equal"
+    false_label "Mismatch"
+  }
+  pass_fail { criteria "The twin serves exactly the interface its certified product package declares — endpoint identifier, operations, payload schemas and quantity kinds, access scopes. Any mismatch is an admission failure: the twin never reaches value probes." pass_if "ocl{endpoint_id = declared_endpoint_id and operations_match and payload_schemas_match and access_scopes_match}" }
+}
+

package/oiml-twin-cert/model/attributes.prl

@@ -0,0 +1,243 @@
+attribute_definition indication {
+  symbol "I"
+  name "Served indication register"
+  definition "The twin's SERVED indication — the live output reading in units of mass served by the twin interface and bound at deployment through the program's gateway (the served channel of the two-channel fidelity relation). The metrological definition of the underlying indication lives in the Recommendation the program maps to (maps_to oiml-r60); this register declares only the binding slot the program reads."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.2"
+  quantity_kind mass
+  unit "kg"
+  value_type QuantityValue
+  origin test-dependent
+  scope sample
+  category metrological
+  is_dimension false
+}
+
+attribute_definition op_state {
+  name "Served operational-state register"
+  definition "The twin's SERVED operational state (the instrument's off/warming/ready/measuring/fault state as served by the twin's state channel) and bound at deployment from the twin's state serve. The state model of the underlying instrument lives in the Recommendation the program maps to; this register declares only the binding slot the program reads."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.2"
+  value_type string
+  origin test-dependent
+  scope sample
+  category metrological
+  is_dimension false
+}
+
+attribute_definition reference_indication {
+  symbol "I_ref"
+  name "Reference indication register"
+  definition "The physical-side reference indication paired with the served indication at a probe point — the reference channel of the two-channel fidelity relation (the NEW reference_* evidence register family): a traceable reference instrument (preferred), an observer attestation (a verification officer reads the physical display into the probe form — admitted with recorded traceability limits), or sim ground truth (the acceptance environment only, never a production channel)."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.3"
+  quantity_kind mass
+  unit "kg"
+  value_type QuantityValue
+  origin test-dependent
+  scope sample
+  category metrological
+  is_dimension false
+}
+
+attribute_definition reference_state {
+  name "Reference operational-state register"
+  definition "The physical instrument's operational state observed at a probe transition and paired with the served op_state — the reference channel for state fidelity (the NEW reference_* evidence register family)."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.3"
+  value_type string
+  origin test-dependent
+  scope sample
+  category metrological
+  is_dimension false
+}
+
+attribute_definition served_at {
+  symbol "t_srv"
+  name "Served-timestamp register"
+  definition "The twin's OWN served timestamp for the served reading paired at a probe point (TCD-2 — the served side of the pairing skew, resolving the probe schedule's pair_skew derivation input): the served-timestamp source declared per operation (timestamp_fields), never the platform's receipt clock — freshness is judged against the twin's own timestamp. Epoch seconds at evidence capture."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.3"
+  quantity_kind time
+  unit "s"
+  value_type QuantityValue
+  origin test-dependent
+  scope sample
+  category metrological
+  is_dimension false
+}
+
+attribute_definition observed_at {
+  symbol "t_obs"
+  name "Observation-timestamp register"
+  definition "The reference observation timestamp captured at D2 evidence-capture time for the reference reading paired at a probe point (TCD-2 — the reference side of the pairing skew, resolving the probe schedule's pair_skew derivation input): the reference channel's provenance facet binds its observed_at facet here. Epoch seconds at evidence capture."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.3"
+  quantity_kind time
+  unit "s"
+  value_type QuantityValue
+  origin test-dependent
+  scope sample
+  category metrological
+  is_dimension false
+}
+
+attribute_definition pair_skew {
+  symbol "Δt_pair"
+  name "Pairing-skew register"
+  definition "The pairing skew |served timestamp − reference observation timestamp| of one probe pair (TCD-2): derived once at evidence capture from the served_at/observed_at registers (the probe tests' pair_skew variable derivation) and recorded as D2 evidence — the operand of the pairing-window INVALID precondition (a skew beyond the declared window voids the run, never a fail)."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.3"
+  quantity_kind time
+  unit "s"
+  value_type QuantityValue
+  origin test-dependent
+  scope sample
+  category metrological
+  is_dimension false
+}
+
+attribute_definition twin_tolerance_indication {
+  symbol "δ_ind"
+  name "Twin tolerance — indication"
+  definition "The program's declared indication tolerance δ_indication — the maximum permitted absolute deviation between the served and the reference indication at any probe point. The metrologically honest anchor: a declared fraction of the underlying instrument's maximum permissible error per register, declared by the scheme, never a platform constant (controller decision 1: δ = 0.1 kg for the LC-500-class pilot register — 25× the good cell's noise σ, so the faithful twin passes cleanly and a 0.25 kg lie is unmistakable)."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.4"
+  quantity_kind mass
+  unit "kg"
+  value_type QuantityValue
+  origin declared
+  scope model
+  category metrological
+  is_dimension false
+}
+
+attribute_definition served_t0 {
+  symbol "I_t0"
+  name "Served indication at dwell start"
+  definition "The twin's SERVED indication at the start of the behavioral probe's creep dwell (TODO.v3/02) — the drift baseline, fetched through the gateway at dwell start (the served channel of the behavioral fidelity relation)."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.5"
+  quantity_kind mass
+  unit "kg"
+  value_type QuantityValue
+  origin test-dependent
+  scope sample
+  category metrological
+  is_dimension false
+}
+
+attribute_definition served_end {
+  symbol "I_end"
+  name "Served indication at dwell end"
+  definition "The twin's SERVED indication at the end of the behavioral probe's creep dwell, fetched through the gateway at dwell end."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.5"
+  quantity_kind mass
+  unit "kg"
+  value_type QuantityValue
+  origin test-dependent
+  scope sample
+  category metrological
+  is_dimension false
+}
+
+attribute_definition reference_indication_t0 {
+  symbol "I_ref,t0"
+  name "Reference indication at dwell start"
+  definition "The physical-side reference reading at the start of the creep dwell — the constant-load anchor from the declared probe channel (reference_instrument PREFERRED; observer attestation admitted with the declared traceability limitation; sim ground truth in the acceptance environment only)."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.5"
+  quantity_kind mass
+  unit "kg"
+  value_type QuantityValue
+  origin test-dependent
+  scope sample
+  category metrological
+  is_dimension false
+}
+
+attribute_definition reference_indication_end {
+  symbol "I_ref,end"
+  name "Reference indication at dwell end"
+  definition "The physical-side reference reading at the end of the creep dwell — the constant-load confirmation. A reference that drifts beyond one third of the class creep allowance voids the setup (INVALID, never a fail — the U:MPE ≤ 1:3 discipline)."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.5"
+  quantity_kind mass
+  unit "kg"
+  value_type QuantityValue
+  origin test-dependent
+  scope sample
+  category metrological
+  is_dimension false
+}
+
+attribute_definition max_drift {
+  symbol "Δ_max"
+  name "Maximum served drift over the dwell"
+  definition "The maximum |served sample − served_t0| over the behavioral probe's recorded dwell series — derived ONCE at evidence capture from the recorded series (facts only, auditable against the probe-creep form's series; the same derived-once-at-capture discipline as pair_skew). The operand of the creep-envelope criterion (TODO.v3/02)."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.5"
+  quantity_kind mass
+  unit "kg"
+  value_type QuantityValue
+  origin test-dependent
+  scope sample
+  category metrological
+  is_dimension false
+}
+
+attribute_definition dwell_s {
+  symbol "T_dw"
+  name "Dwell duration"
+  definition "The declared dwell duration of the behavioral creep probe — the scheme's declaration per register (the pilot's 900 s; the Recommendation's own type-test program runs 30 min, the scheme declares its practical dwell), never a platform constant."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.5"
+  quantity_kind time
+  unit "s"
+  value_type QuantityValue
+  origin declared
+  scope model
+  category metrological
+  is_dimension false
+}
+
+attribute_definition dwell_load {
+  symbol "L_dw"
+  name "Dwell load"
+  definition "The behavioral probe's applied dwell load (≈90 % of E_max — 450 kg for the LC-500-class pilot) — the lookupMPE load input of the creep-allowance computation."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.5"
+  quantity_kind mass
+  unit "kg"
+  value_type QuantityValue
+  origin declared
+  scope model
+  category metrological
+  is_dimension false
+}
+
+attribute_definition accuracy_class {
+  name "Accuracy class"
+  definition "The certified type's accuracy class per the mapped Recommendation (C for the LC-500-class pilot, per R 60) — the lookupMPE class input. The creep allowance is class-parameterized: it resolves from the same class tables the Recommendation's tests use (TODO.v3/02)."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.5"
+  value_type string
+  origin declared
+  scope model
+  category metrological
+  is_dimension false
+}
+
+attribute_definition p_lc {
+  symbol "p_lc"
+  name "Apportionment factor"
+  definition "The apportionment factor of the creep-allowance computation (0.7 by default for load cells per R 60) — the lookupMPE apportionment input."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.5"
+  quantity_kind dimensionless
+  unit "1"
+  value_type QuantityValue
+  origin declared
+  scope model
+  category metrological
+  is_dimension false
+}
+
+attribute_definition creep_allowance {
+  symbol "δ_cr"
+  name "Creep allowance (class-parameterized)"
+  definition "The accuracy-class creep allowance for the behavioral probe — the mapped Recommendation's own apportioned MPE at the dwell load, computed as lookupMPE(dwell_load, accuracy_class, p_lc) from the class tables (never a platform constant). The threshold of the creep-envelope criterion (TODO.v3/02)."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.5"
+  quantity_kind mass
+  unit "kg"
+  value_type QuantityValue
+  origin derived
+  scope sample
+  category metrological
+  is_dimension false
+}
+

package/oiml-twin-cert/model/behaviors.prl

@@ -0,0 +1,8 @@
+behavior twin-indication-serving {
+  kind static
+  stimulus force
+  response "The twin's served indication in response to the physical instrument's applied load — the two-channel serving behavior whose deviation from the physical-side reference the twin_deviation_indication characteristic quantifies."
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.1"
+  verified_by { /conf/twin-fidelity/probe-range /conf/twin-fidelity/probe-envelope }
+}
+

package/oiml-twin-cert/model/characteristics.prl

@@ -0,0 +1,18 @@
+verdict twin_deviation_indication {
+  symbol "Δ_ind"
+  behavior twin-indication-serving
+  quantity { kind mass unit "kg" }
+  derive "ocl{abs(indication - reference_indication)}"
+  inputs { indication reference_indication }
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.1"
+}
+
+verdict twin_creep_drift_indication {
+  symbol "Δ_cr"
+  behavior twin-indication-serving
+  quantity { kind mass unit "kg" }
+  derive "ocl{max_drift}"
+  inputs { max_drift }
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.5"
+}
+

package/oiml-twin-cert/model/monitors.prl

@@ -0,0 +1,16 @@
+# The fault-state service-case rule rides the deployment BINDING, never this declaration — the kernel's escalate grammar admits verdict outcomes only (C69).
+# Pointers: browser/src/monitor/twin-cert-deployment.ts (the binding header), data/oiml-twin-cert/layer.yaml, AGENTS.d/12-twin-integration.md.
+subject CertifiedTwin {
+  is {
+    metadata { name "Certified digital twin unit" designation "A digital twin unit holding a valid twin certificate — the fleet the program's type-5 surveillance runs over (the certificate register's watch subject)" }
+  }
+}
+
+monitor twin-fidelity-fleet {
+  over { CertifiedTwin }
+  triggers { every 1h on signal certificate_registered on change sample.test_context.op_state }
+  evaluate { requirements { /req/twin-fidelity/static-conformance /req/twin-fidelity/indication-band /req/twin-fidelity/freshness-declaration /req/twin-fidelity/timestamp-provenance /req/twin-fidelity/state-fidelity } promises all }
+  emit { evidence -> workspace verdicts -> verdict_log }
+  escalate { on fail { flag_certificate open_service_case notify scheme_operator } on invalid { open_service_case } }
+}
+

package/oiml-twin-cert/package.primmel

@@ -0,0 +1,16 @@
+package {
+  id oiml-twin-cert
+  kind certification_program
+  maps_to { oiml-r60 }
+  scheme_type type_5
+  title "OIML SMART oiml-twin-cert certification program package"
+  version "2027"
+  editions { 2027 }
+  baseUrn "urn:oiml:pub:cs:twin-1:2027"
+  uses { iso-iec-17000 iso-iec-17065 iso-iec-17025 iso-iec-17067 acme-lc500@2021 }
+  requires { iso-iec-17000 iso-iec-17065 iso-iec-17025 iso-iec-17067 }
+  validity { from 2027-01-01 }
+  status current
+  default_spelling eng-Latn
+  description "Digital-twin fidelity certification program (TODO.v2/01) — the scheme operator's program confirming that a measuring instrument's digital twin faithfully reflects the physical instrument's status: the served value ≡ the physical state, within declared bounds and freshness, continuously. A first-class publisher of kind certification_program, related to the Recommendations (maps_to oiml-r60), the product twin declarations it certifies (pinned abstract import acme-lc500@2021), and the CASCO foundations (requires iso-iec-17000/17065/17025/17067) by mapping and pinned imports only — composed into nothing. Self-classified scheme type 5 against the ISO/IEC 17067 register (per-unit certification with surveillance). The twin certificate stands alone from type evaluation but prerequisites a valid type certificate of the underlying instrument; the OIML-CS is the long-term home."
+}