@oimlsmart/primmel-packages 0.1.0

package/oiml-twin-cert/specification/conformance/twin-fidelity.prl

@@ -0,0 +1,176 @@
+conformance_class /conf/twin-fidelity {
+  title "Twin-fidelity conformance tests"
+  name "Twin-fidelity conformance determination"
+  target /req/twin-fidelity
+  subject "digital twin fidelity evaluation"
+  description "The twin-fidelity program's determination half (the ISO/IEC 17065 determination activities of the scheme): the static-conformance admission check and the probe schedule — paired reference-vs-served readings across the measuring range, the operational envelope and the operational transitions, each pair timestamped within the pairing window. The physical-side channel is the three-source provenance facet (TCD-2): reference_instrument (a traceable reference, cited by equipment-register id — PREFERRED) | observer_attestation (a verification officer reads the physical display into the probe form — admitted with the DECLARED 'twin ≡ display, not twin ≡ mass' traceability limitation) | sim_ground_truth (the acceptance environment only, never a production channel). Every probe test is gated on the static-conformance admission (dependencies) and carries the pairing-window INVALID precondition; the D2 probe form (result_forms { probe }) records one probe execution — served value and timestamp, reference value and observation timestamp, the channel and its register citation, and the pairing skew. Surveillance (the scheme's type-5 continuous half) reuses the same fidelity requirements through the monitor runtime (TCD-4)."
+}
+
+conformance_test /conf/twin-fidelity/static-conformance-admission {
+  name "Static conformance admission"
+  purpose "Verify that the twin serves exactly the interface its certified product package declares — endpoint identifier, operations, payload schemas and quantity kinds, access scopes — before any value-fidelity probing: a twin that mis-serves its contract never reaches value probes."
+  method "Read the twin's served schema, operations, access scopes and payload semantics and compare them against the pinned product package's endpoint declaration (the C84-class startup check, already enforced against the sim's own schema in the acceptance environment). Any mismatch is an admission failure."
+  type Inspection
+  kind software-examination
+  reference { doc "urn:oiml:pub:cs:twin-1:2027" clause "6.1" }
+  targets { /req/twin-fidelity/static-conformance }
+  result_forms { static-conformance }
+}
+
+conformance_test /conf/twin-fidelity/probe-range {
+  name "Twin-fidelity probe — the measuring range"
+  purpose "Close the two-channel fidelity relation across the measuring range: paired reference-vs-served readings at the declared load points, each pair timestamped and paired within the pairing window, judging value fidelity per /req/twin-fidelity/indication-band."
+  method "At each load point, record the reference reading from the declared probe channel (the pilot's traceable deadweight force standard — reference_instrument, PREFERRED; observer attestation admitted with the declared traceability limits; sim ground truth in the acceptance environment only) and the served reading fetched through the gateway at probe time, each timestamped; pair the readings within the pairing window (at most the indication register's fresh_within — a pair whose skew exceeds it is INVALID, never a fail)."
+  type Testing
+  kind performance
+  reference { doc "urn:oiml:pub:cs:twin-1:2027" clause "6.2" }
+  targets { /req/twin-fidelity/indication-band }
+  binds_to { sample.test_context.indication sample.test_context.reference_indication sample.test_context.served_at sample.test_context.observed_at model.parameters.twin_tolerance_indication }
+  dependencies { /conf/twin-fidelity/static-conformance-admission }
+  variables {
+    variable reference_indication { type number unit "kg" source measured description "The physical-side reading paired with the served value at this load point — the pilot lab's deadweight force standard (equipment register id + calibration trace; observer attestation or sim ground truth where the execution records them — the channel actually used is evidence in the probe form)." provenance { channel reference_instrument ref "mtl_f_001" observed_at observed_at } }
+    variable served_indication { type number unit "kg" source measured description "The served indication fetched through the gateway at probe time." }
+    variable served_at { type number unit "s" source measured description "The twin's own served timestamp for the served reading (timestamp_fields), epoch seconds." }
+    variable observed_at { type number unit "s" source measured description "The reference observation timestamp captured at evidence-capture time, epoch seconds." }
+    variable observed_at_t0 { type number unit "s" source measured description "The t0 anchor's reference observation timestamp, epoch seconds." }
+    variable observed_at_end { type number unit "s" source measured description "The end anchor's reference observation timestamp, epoch seconds." }
+    variable served_at_t0 { type number unit "s" source measured description "The twin's own served timestamp at dwell start (timestamp_fields), epoch seconds — the series' first served_at." }
+    variable served_at_end { type number unit "s" source measured description "The twin's own served timestamp at dwell end (timestamp_fields), epoch seconds — the series' last served_at." }
+    variable pair_skew_t0 { type number unit "s" source derived derivation "ocl{abs(served_at_t0 - observed_at_t0)}" description "The t0 anchor's pairing skew — a skew beyond the pairing window is INVALID, never a fail." }
+    variable pair_skew_end { type number unit "s" source derived derivation "ocl{abs(served_at_end - observed_at_end)}" description "The end anchor's pairing skew — a skew beyond the pairing window is INVALID, never a fail." }
+    variable pair_skew { type number unit "s" source derived derivation "ocl{abs(served_at - observed_at)}" description "The pairing skew |served timestamp − reference observation timestamp| — a pair whose skew exceeds the pairing window is INVALID, never a fail." }
+  }
+  preconditions {
+    precondition pairing-window { check "ocl{pair_skew <= 5}" description "The pairing window: the paired readings are taken within the register's fresh_within of each other (5 s for the indication register) — the window is declared per register with fresh_within as the ceiling, never a fixed platform constant (controller decision 5). A pair violating the window is INVALID — the test's setup was wrong, never a fail." }
+  }
+  procedure {
+    1 "Probe the measuring range: minimum load, then ≈25 %, 50 %, 75 % and 100 % of E_max, increasing and (where the physics demands) decreasing — the load-point discipline of the Recommendation's MPE test; each point a timestamped reference-vs-served pair" outputs { reference_indication served_indication observed_at served_at }
+  }
+  acceptance_criteria {
+    type composite
+    pass_if "ocl{indication_band_criterion}"
+    criterion indication_band_criterion { target /req/twin-fidelity/indication-band description "|served − reference| ≤ δ_indication at every range point (canonical verdict — never restated here)" accepts { verdict twin_deviation_indication op lte limit "ocl{twin_tolerance_indication}" } }
+  }
+  result_forms { probe }
+}
+
+conformance_test /conf/twin-fidelity/probe-envelope {
+  name "Twin-fidelity probe — the operational envelope"
+  purpose "Close the two-channel fidelity relation across the operational envelope: paired reference-vs-served readings at the declared envelope corners, each pair timestamped and paired within the pairing window, judging value fidelity per /req/twin-fidelity/indication-band at the envelope extremes, not only at reference conditions."
+  method "Condition the instrument at each declared envelope corner and probe the paired reading per the range test's channel discipline (the pilot's traceable deadweight force standard — reference_instrument, PREFERRED; observer attestation admitted with the declared traceability limits; sim ground truth in the acceptance environment only), each pair timestamped within the pairing window. The envelope declaration: the rated temperature corners of the certified product's declared envelope (t_min … t_max — −10 … +40 °C for the pilot LC-500, the pinned product import's temp_envelope promise) and return; the humidity corner applies where the certified product declares a humidity class (the pilot declares none — the corner is the scheme's declaration, never an assumption)."
+  type Testing
+  kind performance
+  reference { doc "urn:oiml:pub:cs:twin-1:2027" clause "6.3" }
+  targets { /req/twin-fidelity/indication-band }
+  binds_to { sample.test_context.indication sample.test_context.reference_indication sample.test_context.served_at sample.test_context.observed_at model.parameters.twin_tolerance_indication }
+  dependencies { /conf/twin-fidelity/static-conformance-admission }
+  variables {
+    variable reference_indication { type number unit "kg" source measured description "The physical-side reading paired with the served value at this envelope corner — the pilot lab's deadweight force standard (the channel actually used is evidence in the probe form)." provenance { channel reference_instrument ref "mtl_f_001" observed_at observed_at } }
+    variable served_indication { type number unit "kg" source measured description "The served indication fetched through the gateway at the corner." }
+    variable served_at { type number unit "s" source measured description "The twin's own served timestamp for the served reading (timestamp_fields), epoch seconds." }
+    variable observed_at { type number unit "s" source measured description "The reference observation timestamp captured at evidence-capture time, epoch seconds." }
+    variable observed_at_t0 { type number unit "s" source measured description "The t0 anchor's reference observation timestamp, epoch seconds." }
+    variable observed_at_end { type number unit "s" source measured description "The end anchor's reference observation timestamp, epoch seconds." }
+    variable served_at_t0 { type number unit "s" source measured description "The twin's own served timestamp at dwell start (timestamp_fields), epoch seconds — the series' first served_at." }
+    variable served_at_end { type number unit "s" source measured description "The twin's own served timestamp at dwell end (timestamp_fields), epoch seconds — the series' last served_at." }
+    variable pair_skew_t0 { type number unit "s" source derived derivation "ocl{abs(served_at_t0 - observed_at_t0)}" description "The t0 anchor's pairing skew — a skew beyond the pairing window is INVALID, never a fail." }
+    variable pair_skew_end { type number unit "s" source derived derivation "ocl{abs(served_at_end - observed_at_end)}" description "The end anchor's pairing skew — a skew beyond the pairing window is INVALID, never a fail." }
+    variable pair_skew { type number unit "s" source derived derivation "ocl{abs(served_at - observed_at)}" description "The pairing skew |served timestamp − reference observation timestamp| — a pair whose skew exceeds the pairing window is INVALID, never a fail." }
+    variable envelope_temperature_min { type number unit "degC" source declared description "The low temperature corner of the certified product's declared envelope (t_min — −10 °C for the pilot LC-500)." }
+    variable envelope_temperature_max { type number unit "degC" source declared description "The high temperature corner of the certified product's declared envelope (t_max — +40 °C for the pilot LC-500)." }
+  }
+  preconditions {
+    precondition pairing-window { check "ocl{pair_skew <= 5}" description "The pairing window: the paired readings are taken within the register's fresh_within of each other (5 s for the indication register) — the window is declared per register with fresh_within as the ceiling, never a fixed platform constant (controller decision 5). A pair violating the window is INVALID — the test's setup was wrong, never a fail." }
+  }
+  procedure {
+    1 "Condition at the low temperature corner (t_min of the declared envelope) and probe the paired reading at the probe load" outputs { reference_indication served_indication observed_at served_at }
+    2 "Condition at the high temperature corner (t_max of the declared envelope) and probe the paired reading at the probe load" outputs { reference_indication served_indication observed_at served_at }
+    3 "Return to reference conditions and probe the closing pair; where the certified product declares a humidity class, condition at the declared humidity corner and probe" outputs { reference_indication served_indication observed_at served_at }
+  }
+  acceptance_criteria {
+    type composite
+    pass_if "ocl{indication_band_criterion}"
+    criterion indication_band_criterion { target /req/twin-fidelity/indication-band description "|served − reference| ≤ δ_indication at every envelope corner (canonical verdict — never restated here)" accepts { verdict twin_deviation_indication op lte limit "ocl{twin_tolerance_indication}" } }
+  }
+  result_forms { probe }
+}
+
+conformance_test /conf/twin-fidelity/probe-transitions {
+  name "Twin-fidelity probe — the operational transitions"
+  purpose "Close the two-channel fidelity relation across the operational transitions: the served op_state paired with the physical state at each transition, warm-up, measurement, fault annunciation and clear, judging state fidelity per /req/twin-fidelity/state-fidelity — a served fault faithfully reporting the instrument's fault is not infidelity."
+  method "At each declared transition, record the physical state from the declared probe channel (observer attestation — the verification officer reads the instrument's own state annunciation into the probe form, admitted with the DECLARED traceability limitation: the reference IS the EUT's own display, twin ≡ display semantics; sim ground truth in the acceptance environment only) and the served op_state delivered on the twin's state channel, each timestamped; pair within the pairing window (at most the state register's fresh_within — 1 s on the certified product's state serve; a violating pair is INVALID, never a fail)."
+  type Testing
+  kind performance
+  reference { doc "urn:oiml:pub:cs:twin-1:2027" clause "6.4" }
+  targets { /req/twin-fidelity/state-fidelity }
+  binds_to { sample.test_context.op_state sample.test_context.reference_state sample.test_context.served_at sample.test_context.observed_at }
+  dependencies { /conf/twin-fidelity/static-conformance-admission }
+  variables {
+    variable reference_state { type string source measured description "The physical operational state observed at the transition — the verification officer reads the instrument's state annunciation (the declared channel of the state-fidelity leg; the channel actually used is evidence in the probe form)." provenance { channel observer_attestation ref "p_weber" observed_at observed_at limitation "Attestation-only evidence proves the twin serves what the instrument's own display annunciates — twin ≡ display, not twin ≡ mass: the reference IS the EUT's own indication, never an independent physical standard." } }
+    variable served_op_state { type string source measured description "The served operational state at the same transition (the twin's state channel)." }
+    variable served_at { type number unit "s" source measured description "The twin's own served timestamp for the state reading (timestamp_fields), epoch seconds." }
+    variable observed_at { type number unit "s" source measured description "The state observation timestamp captured at evidence-capture time, epoch seconds." }
+    variable pair_skew { type number unit "s" source derived derivation "ocl{abs(served_at - observed_at)}" description "The pairing skew |served timestamp − state observation timestamp| — a pair whose skew exceeds the pairing window is INVALID, never a fail." }
+  }
+  preconditions {
+    precondition pairing-window { check "ocl{pair_skew <= 1}" description "The pairing window: the paired state readings are taken within the register's fresh_within of each other (1 s for the state register — the certified product serves its state channel at fresh_within 1 s, the ceiling; controller decision 5). A pair violating the window is INVALID — the test's setup was wrong, never a fail." }
+  }
+  procedure {
+    1 "Probe the warm-up leg: off→warming→ready — the served op_state is paired with the physical state at each step of the power-on sequence" outputs { reference_state served_op_state observed_at served_at }
+    2 "Probe the measurement leg: ready→measuring — the served op_state is paired with the physical state at measurement start" outputs { reference_state served_op_state observed_at served_at }
+    3 "Probe the fault-annunciation leg and clear: drive the instrument to fault, pair the annunciation, then clear and pair the recovery — a served fault faithfully reporting the instrument's fault passes fidelity and triggers service, never a fidelity fail" outputs { reference_state served_op_state observed_at served_at }
+  }
+  acceptance_criteria {
+    type composite
+    pass_if "ocl{state_fidelity_criterion}"
+    criterion state_fidelity_criterion { target /req/twin-fidelity/state-fidelity pass_if "ocl{served_op_state = reference_state}" description "served op_state ≡ reference state at every transition, fault annunciation included" }
+  }
+  result_forms { probe }
+}
+
+conformance_test /conf/twin-fidelity/probe-creep {
+  name "Twin-fidelity behavioral probe — the creep dwell"
+  purpose "Close the behavioral fidelity relation (TODO.v3/02): under a CONSTANT reference load held for the declared dwell, the twin's served indication must drift no more than the instrument's accuracy-class creep allowance — the twin's dynamics track the physical instrument's, parameterized per accuracy class through the Recommendation's own apportioned MPE (the same lookupMPE computation the mapped Recommendation's creep test uses). A twin whose creep response exceeds the class envelope is unfaithful however cleanly its point probes pass."
+  method "Apply the declared dwell load (≈90 % of E_max) and hold it CONSTANT for the declared dwell. Record the reference reading at dwell start and dwell end from the declared probe channel (the pilot lab's deadweight force standard — reference_instrument, PREFERRED; observer attestation admitted with the declared traceability limits; sim ground truth in the acceptance environment only) and sample the served indication through the gateway at the declared instants over the dwell (each anchor a timestamped reference-vs-served pair within the pairing window of 4.3). The served drift is derived ONCE at evidence capture as the maximum |sample − served at dwell start| over the recorded series (facts only — auditable against the recorded series), and the creep allowance is computed from the class tables as lookupMPE(dwell_load, accuracy_class, p_lc). A reference that itself drifts beyond one third of the allowance (the U:MPE ≤ 1:3 discipline) voids the setup — INVALID, never a fail."
+  type Testing
+  kind performance
+  reference { doc "urn:oiml:pub:cs:twin-1:2027" clause "6.5" }
+  targets { /req/twin-fidelity/creep-envelope }
+  binds_to { sample.test_context.max_drift sample.test_context.creep_allowance sample.test_context.reference_indication_t0 sample.test_context.reference_indication_end }
+  dependencies { /conf/twin-fidelity/static-conformance-admission }
+  variables {
+    variable reference_indication_t0 { type number unit "kg" source measured description "The reference reading at dwell start — the constant-load anchor (equipment register id + calibration trace; observer attestation or sim ground truth where the execution records them)." provenance { channel reference_instrument ref "mtl_f_001" observed_at observed_at } }
+    variable reference_indication_end { type number unit "kg" source measured description "The reference reading at dwell end — the constant-load confirmation. A reference that drifts beyond one third of the allowance voids the setup (INVALID, never a fail)." provenance { channel reference_instrument ref "mtl_f_001" observed_at observed_at } }
+    variable served_t0 { type number unit "kg" source measured description "The served indication at dwell start (the drift baseline), fetched through the gateway at dwell start." }
+    variable served_end { type number unit "kg" source measured description "The served indication at dwell end, fetched through the gateway at dwell end." }
+    variable observed_at { type number unit "s" source measured description "The reference observation timestamp captured at evidence-capture time, epoch seconds." }
+    variable observed_at_t0 { type number unit "s" source measured description "The t0 anchor's reference observation timestamp, epoch seconds." }
+    variable observed_at_end { type number unit "s" source measured description "The end anchor's reference observation timestamp, epoch seconds." }
+    variable served_at_t0 { type number unit "s" source measured description "The twin's own served timestamp at dwell start (timestamp_fields), epoch seconds — the series' first served_at." }
+    variable served_at_end { type number unit "s" source measured description "The twin's own served timestamp at dwell end (timestamp_fields), epoch seconds — the series' last served_at." }
+    variable pair_skew_t0 { type number unit "s" source derived derivation "ocl{abs(served_at_t0 - observed_at_t0)}" description "The t0 anchor's pairing skew — a skew beyond the pairing window is INVALID, never a fail." }
+    variable pair_skew_end { type number unit "s" source derived derivation "ocl{abs(served_at_end - observed_at_end)}" description "The end anchor's pairing skew — a skew beyond the pairing window is INVALID, never a fail." }
+    variable max_drift { type number unit "kg" source measured description "The maximum |served sample − served_t0| over the recorded dwell series — derived ONCE at evidence capture from the recorded series (facts only, auditable against the probe-creep form's series), the operand of the creep-envelope criterion." }
+    variable dwell_s { type number unit "s" source declared description "The declared dwell duration (the scheme's declaration per register — the pilot's 900 s dwell; the type test's 30 min is the Recommendation's own program, the scheme declares its practical dwell)." }
+    variable dwell_load { type number unit "kg" source declared description "The dwell's applied load (≈90 % E_max — 450 kg for the LC-500-class pilot), the lookupMPE load input." }
+    variable accuracy_class { type string source declared description "The certified type's accuracy class (C for the LC-500-class pilot) — the lookupMPE class input. Class-parameterized: the allowance resolves from the same class tables the Recommendation's tests use." }
+    variable p_lc { type number unit "dimensionless" source declared description "The apportionment factor (0.7 by default for load cells per R 60) — the lookupMPE apportionment input." }
+    variable creep_allowance { type number unit "kg" source computed derivation "ocl{lookupMPE(dwell_load, accuracy_class, p_lc)}" description "The accuracy-class creep allowance — the Recommendation's own apportioned MPE at the dwell load, computed from the class tables (never a platform constant)." }
+  }
+  preconditions {
+    precondition pairing-window { check "ocl{pair_skew_t0 <= 5 and pair_skew_end <= 5}" description "The pairing window: BOTH anchors' reference-vs-served readings are taken within the register's fresh_within of each other (5 s for the indication register — TW-1, 6: every probe test carries the pairing-window INVALID precondition of 4.3). A pair violating the window is INVALID — the setup was wrong, never a fail." }
+    precondition reference-constant { check "ocl{abs(reference_indication_end - reference_indication_t0) <= creep_allowance / 3}" description "The reference must be constant within one third of the allowance (the U:MPE ≤ 1:3 discipline): a drifting reference invalidates the setup — INVALID, never a fail." }
+  }
+  procedure {
+    1 "Apply the declared dwell load and hold it constant; record the reference and served readings at dwell start, each timestamped (the pairing pair)" outputs { reference_indication_t0 served_t0 observed_at_t0 served_at_t0 }
+    2 "Sample the served indication at the declared instants over the dwell (the series is recorded in the probe-creep form; the maximum drift derives at capture)" outputs { max_drift }
+    3 "Record the reference and served readings at dwell end, each timestamped (the pairing pair); compute the creep allowance from the class tables" outputs { reference_indication_end served_end observed_at_end served_at_end creep_allowance }
+  }
+  acceptance_criteria {
+    type composite
+    pass_if "ocl{creep_drift_criterion}"
+    criterion creep_drift_criterion { target /req/twin-fidelity/creep-envelope description "max served drift over the dwell ≤ the class creep allowance (canonical verdict — never restated here)" accepts { verdict twin_creep_drift_indication op lte limit "ocl{creep_allowance}" } }
+  }
+  result_forms { probe-creep }
+}
+

package/oiml-twin-cert/specification/requirements/twin-fidelity.prl

@@ -0,0 +1,137 @@
+requirement_class /req/twin-fidelity {
+  title "Twin-fidelity program requirements"
+  name "Twin-fidelity requirements"
+  description "The digital-twin fidelity certification program's requirement set (TODO.v2/01 TCD-1; analysis/twin-certification-design.md Q1). A twin-fidelity requirement is, per twin register (served aspect), the conjunction of three claims landing on machinery that already exists: value fidelity (|served − reference| ≤ δ, quantity-typed, over the served register and the reference_* evidence register), freshness (the serve's fresh_within plus the verdict service's gate — inherited, never re-declared), and provenance (endpoint id bound to the certified unit, served-timestamp source, fact provenance) — plus state fidelity (the twin truthfully serves fault states). Every requirement cites the program's own governing document (urn:oiml:pub:cs:twin-1:2027)."
+  subject "digital twin of a measuring instrument"
+}
+
+requirement /req/twin-fidelity/static-conformance {
+  name "Static conformance of the served twin interface (admission)"
+  statement "A certified twin shall serve exactly the interface its certified product package declares: the endpoint identifier, the served operations with their payload schemas and quantity kinds, and the access scopes shall equal the package's endpoint declaration. A twin that mis-serves its declared contract shall not enter value-fidelity probing."
+  obligation shall
+  acceptance_criteria {
+    type: "qualitative"
+    items:
+      - description: "Endpoint identifier equals the pinned product package's endpoint declaration"
+      - description: "Served operations, payload schemas and quantity kinds equal the declaration"
+      - description: "Access scopes equal the declaration"
+      - description: "A twin that mis-serves its contract is excluded from value-fidelity probing"
+  }
+  verification { method inspection description "Admission-time contract check against the pinned product package's endpoint declaration (the abstract import acme-lc500@2021 — C83's edition-pin discipline); the C84-class startup check, re-verified at every surveillance cycle start." }
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-5.1"
+}
+
+requirement /req/twin-fidelity/indication-band {
+  name "Served indication within the declared twin tolerance"
+  statement "The twin's served indication shall match the physical instrument's indication within the declared tolerance δ_indication at every probe point: |served − reference| ≤ δ_indication, the reference reading taken from a declared probe channel and paired with the served reading within the pairing window."
+  binds_to { sample.test_context.indication sample.test_context.reference_indication }
+  limit {
+    quantity { kind mass unit "kg" }
+    accepts {
+      verdict twin_deviation_indication
+      op lte
+      limit "ocl{twin_tolerance_indication}"
+    }
+    uses { sample.test_context.indication sample.test_context.reference_indication model.parameters.twin_tolerance_indication }
+  }
+  parameters {
+    param twin_tolerance_indication: number { description "The declared indication tolerance δ_indication in kg — the metrologically honest anchor: a declared fraction of the underlying instrument's maximum permissible error, declared by the scheme per register, never a platform constant." unit "kg" default 0.1 }
+  }
+  obligation shall
+  acceptance_criteria {
+    type: "threshold"
+    description: "|served − reference| ≤ δ_indication at every probe point"
+    limit:
+      expression: "|served − reference|"
+      operator: "lte"
+      threshold_expression: "δ_indication"
+      unit: "kg"
+    per_condition: "per probe point, per fidelity register"
+  }
+  verification { method testing description "The probe schedule's range and envelope tests (/conf/twin-fidelity/probe-range, /conf/twin-fidelity/probe-envelope): paired reference-vs-served readings at the declared load points and envelope corners, each pair timestamped within the pairing window." }
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-5.2"
+}
+
+requirement /req/twin-fidelity/freshness-declaration {
+  name "Declared freshness on every fidelity register"
+  statement "Every fidelity register shall be served under a declared freshness window: the serve binding carries fresh_within, and a served value older than its window degrades the fidelity verdict to indeterminate — never a fail, never a silent pass. The program inherits the window from the serve declaration and never re-declares it on the binding."
+  binds_to { sample.test_context.indication sample.test_context.op_state }
+  obligation shall
+  acceptance_criteria {
+    type: "qualitative"
+    items:
+      - description: "Every fidelity register's serve binding declares fresh_within"
+      - description: "A stale served value degrades the verdict to indeterminate — never a fail, never a silent pass"
+      - description: "The window is inherited from the serve declaration, never re-declared on the binding"
+  }
+  verification { method definitional description "Satisfied by the serve declaration the program reuses (fresh_within is mandatory on a live serve binding) and enforced continuously by the verdict service's freshness gate; no separate window is declared (§14.12 forbids re-declaring it on the binding)." }
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-5.3"
+}
+
+requirement /req/twin-fidelity/timestamp-provenance {
+  name "Served-timestamp provenance on every fidelity register"
+  statement "A certified twin shall serve a parseable timestamp on every fidelity register, and the deployment shall declare the served-timestamp field per operation (timestamp_fields) so freshness is judged against the twin's own served timestamp — a declared-but-absent timestamp is unavailable, never invented. Every fidelity fact shall carry provenance: the endpoint identifier bound to the certified unit's serial, the serving operation, and the definition version pin."
+  obligation shall
+  acceptance_criteria {
+    type: "qualitative"
+    items:
+      - description: "A parseable served timestamp on every fidelity register"
+      - description: "timestamp_fields declared per operation at deployment"
+      - description: "Endpoint identifier bound to the certified unit's serial"
+      - description: "Fidelity facts carry provenance (integration, operation) and the definition version pin"
+  }
+  verification { method definitional description "A declaration requirement gated at admission (the deployment's timestamp_fields declaration) and enforced continuously by the freshness gate — an absent served timestamp is unavailable, so the verdict degrades to indeterminate." }
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-5.4"
+}
+
+requirement /req/twin-fidelity/state-fidelity {
+  name "Served operational state equals the physical state"
+  statement "The twin's served operational state shall equal the physical instrument's state at every state transition, including fault annunciation: a served fault state faithfully reporting the instrument's fault is not infidelity — it passes fidelity and triggers service. A twin that serves a healthy state over a faulted instrument, or a fault state over a healthy one, fails state fidelity."
+  binds_to { sample.test_context.op_state sample.test_context.reference_state }
+  limit {
+    expression "ocl{sample.test_context.op_state = sample.test_context.reference_state}"
+    uses { sample.test_context.op_state sample.test_context.reference_state }
+  }
+  obligation shall
+  acceptance_criteria {
+    type: "threshold"
+    description: "served op_state ≡ physical state at every transition, fault annunciation included"
+    limit:
+      expression: "served op_state"
+      operator: "eq"
+      threshold_expression: "reference state"
+      unit: "state code"
+    per_condition: "per operational transition, fault annunciation included"
+  }
+  verification { method testing description "The probe schedule's transition test (/conf/twin-fidelity/probe-transitions): off→warming→ready, ready→measuring, and the fault-annunciation leg and clear — the served op_state is compared with the reference state at each transition." }
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-5.5"
+}
+
+requirement /req/twin-fidelity/creep-envelope {
+  name "Creep-envelope fidelity (behavioral)"
+  statement "Under a CONSTANT reference load held for the declared dwell, the twin's served indication shall drift no more than the instrument's accuracy-class creep allowance — the behavioral fidelity class (TODO.v3/02): the twin's dynamics track the physical instrument's, not merely its single points. The allowance is parameterized per accuracy class through the Recommendation's own apportioned MPE — creep_allowance = lookupMPE(dwell_load, accuracy_class, p_lc), the same computation the mapped Recommendation's creep test uses (for R 60 the apportionment factor p_lc = 0.7 by default). A twin whose creep response exceeds the class envelope is unfaithful however cleanly its point probes pass; a reference that itself drifts beyond one third of the allowance (the U:MPE ≤ 1:3 discipline) voids the setup — INVALID, never a fail."
+  binds_to { sample.test_context.max_drift sample.test_context.creep_allowance sample.test_context.reference_indication_t0 sample.test_context.reference_indication_end }
+  limit {
+    quantity { kind mass unit "kg" }
+    accepts {
+      verdict twin_creep_drift_indication
+      op lte
+      limit "ocl{creep_allowance}"
+    }
+    uses { sample.test_context.max_drift sample.test_context.creep_allowance }
+  }
+  obligation shall
+  acceptance_criteria {
+    type: "threshold"
+    description: "max served drift over the dwell ≤ the class creep allowance (lookupMPE apportioned); reference constant within allowance/3"
+    limit:
+      expression: "max drift over the dwell"
+      operator: "lte"
+      threshold_expression: "creep allowance (class-parameterized)"
+      unit: "kg"
+    per_condition: "per declared dwell, per accuracy class"
+  }
+  verification { method testing description "The behavioral probe program (/conf/twin-fidelity/probe-creep): a dwell at ≈90 % E_max with served samples over the dwell and constant-reference anchors at both ends, judged per the class tables." }
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-5.6"
+}
+

package/oiml-twin-cert/specification/symbols.prl

@@ -0,0 +1,36 @@
+symbol indication {
+  name "Served indication"
+  definition "The twin's SERVED indication — the live output reading in units of mass served by the twin interface (the served channel of the two-channel fidelity relation); the register is declared in model/attributes.prl."
+  type number
+  unit "kg"
+  latex "I"
+  kind observable
+  quantity_kind mass
+  origin measured
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.2"
+}
+
+symbol reference_indication {
+  name "Reference indication"
+  definition "The physical-side reference indication paired with the served indication at a probe point (the reference channel of the two-channel fidelity relation); the register is declared in model/attributes.prl."
+  type number
+  unit "kg"
+  latex "I_{ref}"
+  kind observable
+  quantity_kind mass
+  origin measured
+  ref derives-from "urn:oiml:pub:cs:twin-1:2027#clause-4.3"
+}
+
+symbol max_drift {
+  name "Maximum served drift over the dwell"
+  definition "The maximum |served sample − served_t0| over the behavioral probe's recorded dwell series, derived ONCE at evidence capture (the operand of the creep-envelope criterion — the behavioral fidelity class, TODO.v3/02); the register is declared in model/attributes.prl."
+  type number
+}
+
+symbol creep_allowance {
+  name "Creep allowance (class-parameterized)"
+  definition "The accuracy-class creep allowance — the mapped Recommendation's own apportioned MPE at the dwell load, lookupMPE(dwell_load, accuracy_class, p_lc) from the class tables; the register is declared in model/attributes.prl."
+  type number
+}
+

package/oiml-twin-cert/terminology.prl

@@ -0,0 +1,8 @@
+term twin-fidelity-evaluation {
+  label "twin-fidelity evaluation"
+  definition "determination activity, and its attestation, confirming that a digital twin provided by a measuring instrument faithfully reflects the physical instrument's status — the served value equivalent to the physical state, within declared bounds and freshness, continuously"
+  section "3.1"
+  note "VIML names no twin-verification kind: VIML 2.09 and 2.12–2.14 are verifications of the instrument itself (initial, subsequent, in-service), so the twin-fidelity discipline is this program's to define (TODO.roadmap/63:57–62). DECISION (controller, 2026-07-28 — analysis/twin-certification-design.md question 2, ACCEPTED): the new verification kind is named twin-fidelity evaluation — a determination activity per ISO/IEC 17000:2020, A.3.2 with attestation per A.4.3, a new VerificationProcess kind alongside initial/subsequent/in-service (the metamodel v0.6.1 D1 hook). This entry is the naming decision record (TCD-1 work item 4)."
+  source "urn:oiml:pub:cs:twin-1:2027, 3.1"
+}
+

package/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "@oimlsmart/primmel-packages",
+  "version": "0.1.0",
+  "description": "The OIML SMART platform's authoritative model content: every Recommendation, the OIML-CS scheme, the CASCO foundations, the shared modules, and the product/program reference packages as Primmel (.prl) packages — the single source of truth the platform's data trees regenerate from. Consumed by the smart monorepo (oimlsmart/smart) at a pinned version (TODO.repos/02).",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/oimlsmart/primmel-packages.git"
+  },
+  "scripts": {
+    "test": "node scripts/check-all.mjs && node scripts/round-trip.mjs"
+  },
+  "license": "MIT",
+  "devDependencies": {
+    "@primmel/primmel": "^1.9.1"
+  }
+}

package/qms-ref/model/qms.prl

@@ -0,0 +1,31 @@
+# ─────────────────────────────────────────────────────────────────────
+# qms-ref — the toy QMS process tree (TODO.v2/02 VL-3;
+# view-lens-design.md Q4).
+#
+# *** FICTIONAL TEACHING MODEL — NO ISO 9001 CONTENT. *** These are
+# invented processes, not clauses of any real standard.
+#
+# The tree is deliberately the smallest shape that exercises every
+# calculus rule when ims-demo maps into it:
+#
+#   PlanQms    — a SERIAL parent (child_composition all, the default):
+#                both children mapped-full ⇒ the parent aggregates to
+#                full and a CLOSURE proposal fires.
+#   ImproveQms — a GATEWAY parent (exclusive branches, the minimum is
+#                "at least one branch fulfilled"): one child mapped-full,
+#                the other untouched ⇒ the parent aggregates to MINIMAL
+#                and the untouched child stays NONE (the visible gap).
+# ─────────────────────────────────────────────────────────────────────
+
+process PlanQms {
+  name "Plan the QMS"
+  process QualityPolicy { name "Quality policy" }
+  process QualityObjectives { name "Quality objectives" }
+}
+
+process ImproveQms {
+  name "Improve the QMS"
+  child_composition gateway
+  process CorrectiveAction { name "Corrective action" }
+  process ContinualImprovement { name "Continual improvement" }
+}

package/qms-ref/package.primmel

@@ -0,0 +1,38 @@
+# ─────────────────────────────────────────────────────────────────────
+# qms-ref — a FICTIONAL toy quality-management-system reference model
+# (TODO.v2/02 VL-3; the analysis view-lens-design.md Q4 worked example).
+#
+# *** FICTIONAL TEACHING MODEL — NO ISO 9001 CONTENT. ***
+# This package is a tiny invented process tree that merely EXERCISES the
+# coverage calculus (aggregation, gateway minimum, inheritance, closure
+# discovery). It is not, and does not derive from, ISO 9001 or any other
+# real management-system standard (controller decision 2: toy references
+# — licensing and maintenance both avoided; the calculus mechanics are
+# what's being proven). Any resemblance to a real standard's clause
+# structure is coincidental and unintentional.
+#
+# Package kind: NONE declared (absent = the ordinary default). Per the
+# design (view-lens-design.md Q4), "reference" and "implementation" are
+# ROLES at the ends of a mapping chain, not manifest kinds — the
+# quarry-belt-scale precedent. None of the enumerated kinds applies:
+# not the shared kernel (core), not a capability module consumed by ≥2
+# recs (module), not a publishable OIML Recommendation (rec — this is
+# fictional teaching content), not a manufacturer's product model
+# (product_reference), not a scheme operator's program
+# (certification_program).
+#
+# Authored-native: PRL is the only source form. The SSOT guard excludes
+# the package by name (browser/scripts/ssot-guard.ts AUTHORED_NATIVE);
+# its drift guard is `primmel check` (the from-packages proof lints every
+# package under primmel-packages/ dynamically). It is never generated
+# into the data trees (regenerate-data discovers trees from data/, and
+# no data tree references this package).
+# ─────────────────────────────────────────────────────────────────────
+package {
+  id qms-ref
+  title "Toy QMS reference model (fictional — teaching model for the view/lens calculus)"
+  version "2026"
+  editions { 2026 }
+  default_spelling eng-Latn
+  description "A tiny FICTIONAL quality-management-system reference tree (no ISO 9001 content): one serial parent and one gateway parent with two children each — just enough structure for the coverage calculus to aggregate, apply the gateway minimum, and propose closure. The reference end of the ims-demo ⇒ qms-ref lens (TODO.v2/02, view-lens-design.md Q4)."
+}

package/quarry-belt-scale/model/ops.prl

@@ -0,0 +1,115 @@
+# ─────────────────────────────────────────────────────────────────────
+# Quarry belt scale — the operations model + the usage mapping
+# (TODO.roadmap/36; doctrine ch. 15 §15.3–§15.4).
+#
+# The user's own model: the belt-scale subject with its design
+# parameters (quantity literals as qualifier strings, the same
+# convention the product package declares — the design-time validation
+# vocabulary), the design-review requirement, the batch process, and the
+# compliance monitor. Then the `acme-lc500#…` aliases of the consumed
+# product aspects and the map_profile that makes the import a mapping:
+# the quarry's usage mapped to the product's promised aspects.
+#
+# Four aspects are consumed:
+#   mpe_within        — the certified accuracy envelope (chain-complete:
+#                       the product maps it to R 60 class C MPE);
+#   e_max             — the design-time integration (capacity within
+#                       E_max; chain-complete via measuring-range-max);
+#   fault_annunciation — the state gate (no batch while the cell reports
+#                       fault; chain-complete via no-significant-faults);
+#   indication        — the live register feed (operational data, NOT an
+#                       R 60 compliance claim: the product maps it to the
+#                       twin-fidelity program (Phase 1.1), so the chain
+#                       rule flows compliance to
+#                       twin-fidelity/indication-band through it).
+# ─────────────────────────────────────────────────────────────────────
+
+quantity_register si {
+  kind mass { dimensions { M 1 } si_unit kg description "Mass." }
+  unit kg { symbol "kg" label "kilogram" kind mass factor 1 }
+  kind dimensionless { si_unit "1" }
+  unit dimensionless { label "dimensionless" kind dimensionless }
+}
+
+subject QuarryBeltScale {
+  is {
+    metadata {
+      name "Quarry belt-scale installation no. 3"
+      integrator "Quarry Aggregates Ltd — plant engineering"
+    }
+    design_parameters {
+      capacity : "400 kg"
+    }
+    promises {
+      capacity_within_emax {
+        target capacity_hold
+        level range { min 0 max 500 unit kg }
+        statement "The installation's rated capacity stays within the cell's E_max envelope — designed against the as-certified reference content of the pinned abstract import (edition 2021)."
+        verified_by { /req/ops/design-review }
+      }
+    }
+  }
+  has {
+    attributes {
+      throughput : mass test_dependent
+      tare : mass test_dependent
+    }
+    characteristics {
+      capacity_hold c_cap = ocl{self.throughput - self.tare}
+    }
+  }
+}
+
+requirement /req/ops/design-review {
+  name "Design review against the product reference model"
+  statement "The installation is designed against the LC-500's promised envelope: the rated capacity lies within E_max, the batch process runs within the certified accuracy class, and no batch runs while the cell reports fault. Validated at design time over the pinned abstract import."
+  verification { method examination description "Design-time review of the installation model against the imported product reference content (doctrine ch. 15 §15.3 mode 1)." }
+}
+
+requirement /req/ops/batch-gate {
+  name "Batch gate on the twin's operational state"
+  statement "No batch runs while the cell reports fault — the twin's operational state (served via watch_state, the product's declared state channel) gates the batch process live (doctrine ch. 15 §15.3 mode 2: twin state gates user processes; the fault_annunciation mapping's runtime half)."
+  verification { method examination description "Runtime gate: the compliance monitor judges the served operational state — a batch attempted while the cell serves fault fails the gate (state = fault ⇒ the gate trips), never a silent skip." }
+}
+
+process batch_weighing {
+  name "Batch weighing"
+}
+
+# The consumed product aspects — local alias declarations of the
+# reference elements this model maps to (the C21 alias discipline),
+# cited at the pinned edition, never content-merged.
+process acme-lc500#mpe_within { name "alias: ACME class C6 error promise" }
+process acme-lc500#e_max { name "alias: ACME E_max design parameter (500 kg)" }
+process acme-lc500#fault_annunciation { name "alias: ACME significant-fault promise" }
+process acme-lc500#indication { name "alias: ACME served live indication (get_indication)" }
+
+map_profile acme-lc500 {
+  description "The quarry's usage mapped to the LC-500's promised aspects — the import is a mapping too, so coverage applies (doctrine ch. 15 §15.3): how much of the product's promised envelope does this installation actually use?"
+  mapping {
+    batch_weighing -> acme-lc500#mpe_within {
+      description "The batch process runs within the cell's certified MPE envelope."
+      justification "The operation consumes the as-certified accuracy promise (mode 1); the IA's engine monitors it live (mode 2)."
+    }
+    capacity_within_emax -> acme-lc500#e_max {
+      description "The scale's capacity is within the cell's E_max."
+      justification "Design-time integration against the promised envelope — the §15.3 example, validated numerically by the product-coverage gate."
+    }
+    batch_weighing -> acme-lc500#fault_annunciation {
+      description "No batch runs while the cell reports fault."
+      justification "The twin's operational state gates the user's process (mode 2 — watch_state drives the batch gate)."
+    }
+    batch_weighing -> acme-lc500#indication {
+      description "The batch throughput reads the cell's live indication from the endpoint."
+      justification "Served aspects feed user registers (mode 2 — get_indication per batch); operational data, not a compliance claim."
+    }
+  }
+}
+
+monitor batch_watch {
+  over { QuarryBeltScale }
+  triggers { every 1h on signal batch_complete }
+  evaluate { requirements { /req/ops/design-review } promises all }
+  emit { evidence -> workspace verdicts -> verdict_log }
+  escalate { on fail { flag_certificate open_service_case } on invalid { open_service_case } }
+}