@oimlsmart/primmel-packages 0.3.0 → 0.5.0

package/iso-iec-17065/evaluation/functional-approach.prl

@@ -0,0 +1,437 @@
+# ISO/IEC 17065 REFERENCE PACKAGE — THE FUNCTIONAL APPROACH AS ABSTRACT
+# PROCESSES (ISO/IEC 17065:2012, clause 7; TODO.roadmap/39, sub-task 39b)
+# -----------------------------------------------------------------------------
+# The ISO/IEC 17065:2012 certification process (clause 7) as ABSTRACT
+# processes (the abstract form per TODO.roadmap/02 — signature +
+# invariants, no steps), the IA-competence reference model the OIML-CS
+# delegates to (B 18:2025 §5.2): application (7.2) → application_review
+# (7.3) → evaluation (7.4) → review (7.5) → decision (7.6) → attestation
+# (7.7 + the 7.8 directory) → surveillance (7.9), with the off-sequence
+# lifecycle processes changes (7.10), termination (7.11), records (7.12)
+# and complaints (7.13).
+#
+# Fields follow the oiml-cs abstract process model
+# (data/oiml-cs/evaluation/abstract-processes.yaml) with three deliberate
+# differences:
+#   roles      the ISO/IEC 17065 functional actors — `client` (3.1) and
+#              `certification_body` (3.12) — NOT the OIML-CS scheme roles;
+#              the functional PERSONNEL sets the segregation constraints
+#              quantify over (evaluation/review/decision/complaint-
+#              resolution personnel, 6.1.2 d)) are identified by the
+#              processes themselves (see segregation below).
+#   signature  CONCEPTUAL record stores of the functional approach
+#              (certification_applications, evaluation_results, …) — this
+#              package declares no entity classes; the stores name the
+#              information flow, nothing resolves against them (bare
+#              untyped store references — the kernel's abstract-form
+#              signature grammar).
+#   realized_by / approved_by — empty: the platform's concrete Core
+#              processes realize the OIML-CS's OWN abstract model; the
+#              OIML-CS↔17065 mapping lands in tasks 40–43. The
+#              documentary halves here are the provisions bindings
+#              (every /req/iso-17065/process/* provision binds to exactly
+#              one abstract process — the R2 targeting exemption; C5
+#              counts a validate_provision'd requirement as covered).
+#
+# activity_kind — the ISO/IEC 17000 activity-archetype register ids
+# (the iso-iec-17000 package's evaluation/activity-archetypes.prl; C58
+# resolves every id when the register is in scope — this package uses
+# iso-iec-17000). Multi-kind per the standard's own definitions:
+# evaluation = selection + determination (17065 3.3). Per-process tagging
+# rationales (folded up from the YAML draft's body comments):
+#   application / application_review → [selection] — A.2 selection: the
+#     client (resp. the body) collects/produces all information and input
+#     needed for the subsequent determination function; the review is NOT
+#     17000 7.1 review — no determination results exist yet to consider.
+#   evaluation → [selection, determination] — the canonical multi-kind
+#     case (17065 3.3).
+#   review → [review]; decision → [decision] (NOTE the deliberate
+#     NON-constraint below); attestation → [certification] (7.6 — the
+#     formal certification documentation is third-party attestation
+#     related to the product); surveillance → [surveillance] (8.1).
+#   changes → [decision, certification] — a change re-decides and may
+#     re-issue documentation; the evaluation/review legs are the
+#     delegated 7.4/7.5 processes (7.10.3).
+#   termination → [suspension, withdrawal] (8.2/8.3) — termination by
+#     client request and scope reduction have no dedicated archetype.
+#   complaints → [complaint, appeal] (8.7/8.6).
+# One deliberate non-tag: records (7.12) — the record-keeping obligation
+# has no functional-approach activity kind (it produces no
+# selection/determination/review/decision/attestation/surveillance
+# outcome).
+#
+# ═══ ROLE SEGREGATION (the `segregation` facet — TODO.roadmap/39b) ═══
+# The clause-7 non-involvement constraints are FIRST-CLASS structured
+# declarations, machine-checked package-side by the kernel's C59
+# segregation-members-resolve (the consumer's linker R24 mirrors it).
+# They are NOT stated as `invariants` because that mechanism cannot check
+# them: the linker never parses invariant strings (they are opaque
+# documentation over one process's own signature records), while
+# segregation is a CROSS-process relation over PERSONNEL SETS, per case.
+# Members are abstract-process ids — a member names that process's
+# personnel set for the case at hand — with ONE reserved token:
+#   case_personnel — the personnel involved in the certification
+#     activities of the case the complaint relates to (7.13.5's
+#     case-relative set; no static process pair can name it).
+# Roles are NOT used as members: the consuming scheme binds ONE role
+# (issuing_authority) to evaluation, review AND decision, so role-level
+# disjointness is both unsatisfiable and unfaithful — the norms quantify
+# over process INVOLVEMENT (7.5.1 "not been involved in the evaluation
+# process"; 7.6.2 "not been involved in the process for evaluation";
+# 7.13.5 "not involved in the certification activities related to the
+# complaint or appeal"). The verbatim norms behind the constraints:
+#   7.5.1: "The review shall be carried out by person(s) who have not
+#     been involved in the evaluation process."
+#   7.6.2: "The certification decision shall be carried out by a person
+#     or group of persons … that has not been involved in the process
+#     for evaluation (see 7.4)."
+#   7.13.5: "The decision resolving the complaint or appeal shall be
+#     made by, or reviewed and approved by, person(s) not involved in
+#     the certification activities related to the complaint or appeal."
+#   7.13.6: "personnel (including those acting in a managerial capacity)
+#     who have provided consultancy for a client, or been employed by a
+#     client, shall not be used … to review or approve the resolution of
+#     a complaint or appeal for that client within two years following
+#     the end of the consultancy or employment." (the fixed P2Y period)
+#   4.2.10: the general consultancy bar on review/decision personnel —
+#     the period is body-specified here (the standard's NOTE records
+#     that two years is often used), so those constraints carry none.
+# Kinds (the C59 kind-conditional shapes):
+#   case_personnel_disjoint — within one certification case, the two
+#     processes' personnel sets are disjoint (pair of exactly two
+#     distinct members; the constrained process owns its constraints —
+#     one pair member is the declaring process).
+#   consultancy_bar — personnel barred from a process for a period after
+#     a consultancy/employment relation with the client (barred list
+#     required; period ISO-8601 only when the standard fixes it).
+# NOTE the deliberate NON-constraint: review and decision personnel need
+# NOT be disjoint from each other — 7.5.2 and 7.6.2 (Note) allow the
+# review and the certification decision to be completed concurrently by
+# the same person or group. No segregation entry separates review from
+# decision.
+# Runtime (per-assignment) enforcement is platform task 44 — this file is
+# the declarative model + static checks.
+#
+# The sequence: application → application review → evaluation → review →
+# decision → attestation, with surveillance where the scheme (or
+# continued mark use) requires it. The lifecycle processes (changes,
+# termination, records, complaints) are off-sequence — they may be
+# initiated any time after attestation (mirroring the oiml-cs model's
+# revision convention).
+#
+# Provenance: ISO/IEC 17065:2012 (see layer.yaml editions.source);
+# subclause numbering per the corpus audit (analysis/
+# oiml-cs-corpus-audit-2026-07.md, Corpus D §1.2) verified against the
+# in-source cross-references. Each process's `source` block carries its
+# clause-7 anchor as free-text doc + empty clause (the consumer's YAML
+# twin restores it as the `reference:` citation verbatim).
+#
+# This file is the single source of truth; the consumer's
+# data/iso-iec-17065/evaluation/functional-approach.yaml is its GENERATED
+# YAML twin (cd browser && npm run gen:data; schema
+# data/schemas/abstract-processes.yaml).
+process application {
+  name "Application"
+  summary "The certification body obtains all the information needed to complete the certification process in accordance with the relevant certification scheme: the product(s) to be certified, the normative documents sought, the client's features, outsourced processes affecting conformity, and the information needed for initial evaluation and surveillance."
+  validate_provision {
+    /req/iso-17065/process/application-information
+  }
+  signature {
+    out { certification_applications }
+  }
+  invariants {
+    "[certification_application].product_identification is not null"
+    "[certification_application].normative_documents.count >= 1"
+  }
+  activity_kind { selection }
+  roles { client }
+  evidence {
+    application_record { description "The application record: product(s) to be certified, standards and/or other normative documents sought (7.1.2), client features (name, locations, significant process/operation aspects where the scheme requires, legal obligations), outsourced processes affecting conformity, and the information needed for initial evaluation and surveillance (7.2 Note 1)." required true }
+  }
+  executor actor
+  source { doc "ISO/IEC 17065:2012, 7.2" clause "" }
+}
+
+process application_review {
+  name "Application review"
+  summary "The certification body reviews the application information for sufficiency, resolves differences in understanding, defines the scope of certification sought, and confirms the means, competence and capability to perform the certification activity — declining the certification when any competence or capability is lacking (7.3.4), and recording the justification for undertaking no-prior-experience certifications (7.3.3)."
+  validate_provision {
+    /req/iso-17065/process/application-review
+    /req/iso-17065/process/decline-without-competence
+  }
+  signature {
+    in { certification_applications }
+    out { certification_applications }
+  }
+  invariants {
+    "[certification_application].scope_of_certification is not null"
+    "[certification_application].declined = true implies [certification_application].decline_reason is not null"
+  }
+  activity_kind { selection }
+  roles { certification_body }
+  evidence {
+    application_review_record { description "The review record: sufficiency of information (7.3.1 a), resolved differences (b), the defined scope of certification (c), means/competence/capability confirmation (d/e), and — for no-prior-experience requests — the justification record (7.3.3) or the decline decision (7.3.4)." required true }
+  }
+  executor actor
+  source { doc "ISO/IEC 17065:2012, 7.3" clause "" }
+}
+
+process evaluation {
+  name "Evaluation"
+  summary "The certification body plans the evaluation activities, assigns personnel to each evaluation task it undertakes with internal resources (outsourced tasks per 6.2.2), provides the necessary information and documentation, and carries out the evaluation against the requirements covered by the scope of certification — informing the client of all nonconformities and documenting all results prior to review (7.4.9)."
+  validate_provision {
+    /req/iso-17065/process/evaluation-plan
+    /req/iso-17065/process/evaluation-results
+  }
+  signature {
+    in { certification_applications }
+    out { evaluation_plans evaluation_results }
+  }
+  invariants {
+    "[evaluation_results].documented_prior_to_review = true"
+    "[evaluation_task].assigned_personnel.count >= 1"
+  }
+  activity_kind { selection determination }
+  roles { certification_body }
+  evidence {
+    evaluation_plan { description "The plan for the evaluation activities (7.4.1) with the per-task personnel assignments (7.4.2)." required true }
+    evaluation_results_record { description "The documented results of all evaluation activities (7.4.9), produced prior to review, with the record of nonconformities communicated to the client (7.4.6) and any additional-task cycle (7.4.7/7.4.8)." required true }
+  }
+  executor actor
+  source { doc "ISO/IEC 17065:2012, 7.4" clause "" }
+}
+
+process review {
+  name "Review"
+  summary "The certification body assigns at least one person to review all information and results related to the evaluation — carried out by person(s) who have NOT been involved in the evaluation process (7.5.1) — and documents the recommendations for the certification decision (unless review and decision are completed concurrently by the same person, 7.5.2)."
+  validate_provision {
+    /req/iso-17065/process/review-independence
+  }
+  signature {
+    in { evaluation_results }
+    out { review_records }
+  }
+  invariants {
+    "[review_record].reviewer_ids.count >= 1"
+    "[review_record].recommendation is not null"
+  }
+  activity_kind { review }
+  roles { certification_body }
+  evidence {
+    review_record { description "The review record over all evaluation information and results, with the assigned reviewer(s) and the documented recommendation for the certification decision (7.5.2)." required true }
+  }
+  segregation {
+    constraint review_not_evaluation {
+      kind case_personnel_disjoint
+      clause "7.5.1"
+      pair { review evaluation }
+      statement "Within one certification case, the personnel assigned to the review shall not have been involved in the evaluation process for that case (ISO/IEC 17065:2012, 7.5.1)."
+    }
+    constraint review_consultancy_bar {
+      kind consultancy_bar
+      clause "4.2.10"
+      barred { consultancy }
+      statement "Within a period specified by the certification body, personnel shall not be used to review a product for which they have provided consultancy (ISO/IEC 17065:2012, 4.2.10; a specified period of two years is often used)."
+    }
+  }
+  executor actor
+  source { doc "ISO/IEC 17065:2012, 7.5" clause "" }
+}
+
+process decision {
+  name "Certification decision"
+  summary "The certification body — retaining responsibility and authority for its certification decisions (7.6.1) — assigns at least one person to make the certification decision based on all information related to the evaluation, its review, and any other relevant information, by person(s) who have NOT been involved in the evaluation (7.6.2), and notifies the client of a decision not to grant certification with the reasons (7.6.6)."
+  validate_provision {
+    /req/iso-17065/process/decision-independence
+    /req/iso-17065/process/decision-employment
+  }
+  signature {
+    in { evaluation_results review_records }
+    out { decision_records }
+  }
+  invariants {
+    "[decision_record].decider_ids.count >= 1"
+    "[decision_record].granted = false implies [decision_record].reasons is not null"
+  }
+  activity_kind { decision }
+  roles { certification_body }
+  evidence {
+    decision_record { description "The certification-decision record: the assigned decision person(s) or committee (5.1.4), the decision, and — on a decision not to grant — the reasons identified to the client (7.6.6)." required true }
+  }
+  segregation {
+    constraint decision_not_evaluation {
+      kind case_personnel_disjoint
+      clause "7.6.2"
+      pair { decision evaluation }
+      statement "Within one certification case, the personnel making the certification decision shall not have been involved in the process for evaluation for that case (ISO/IEC 17065:2012, 7.6.2)."
+    }
+    constraint decision_consultancy_bar {
+      kind consultancy_bar
+      clause "4.2.10"
+      barred { consultancy }
+      statement "Within a period specified by the certification body, personnel shall not be used to make a certification decision for a product for which they have provided consultancy (ISO/IEC 17065:2012, 4.2.10; a specified period of two years is often used)."
+    }
+  }
+  executor actor
+  source { doc "ISO/IEC 17065:2012, 7.6" clause "" }
+}
+
+process attestation {
+  name "Attestation (certification documentation + directory)"
+  summary "The certification body issues the formal certification documentation — only after, or concurrent with, the certification decision, fulfilled certification requirements, and the completed/signed certification agreement (7.7.3) — conveying the body, grant date (never preceding the decision date), client, scope of certification, term/expiry and scheme-required information (7.7.1), signed or otherwise authorized (7.7.2); and maintains the directory information on certified products (7.8)."
+  validate_provision {
+    /req/iso-17065/process/certification-documentation
+    /req/iso-17065/process/attestation-preconditions
+    /req/iso-17065/process/directory
+  }
+  signature {
+    in { decision_records }
+    out { certification_documents certified_product_directory }
+  }
+  invariants {
+    "[certification_document].date_granted >= [decision_record].decision_date"
+    "[certification_document].scope_of_certification is not null"
+  }
+  activity_kind { certification }
+  roles { certification_body }
+  evidence {
+    certification_document { description "The formal certification documentation with the 7.7.1 a–f content and the signature or defined authorization of the assigned person(s) (7.7.2)." required true }
+    issuance_preconditions_record { description "Evidence the 7.7.3 preconditions held at issuance: the grant/extension decision made, certification requirements fulfilled, the certification agreement completed/signed." required true }
+    directory_record { description "The maintained certified-product information (product, normative documents, client — 7.8.1) with validity information provided on request (7.8.2)." }
+  }
+  executor actor
+  source { doc "ISO/IEC 17065:2012, 7.7, 7.8" clause "" }
+}
+
+process surveillance {
+  name "Surveillance"
+  summary "Where the certification scheme requires surveillance (or 7.9.3 / 7.9.4 requires it), the certification body initiates surveillance of the certified product(s) in accordance with the scheme — mandatory periodic surveillance wherever a certification mark continues in use — fulfilling 7.4/7.5/7.6 whenever surveillance utilizes evaluation, review or a certification decision (7.9.2)."
+  validate_provision {
+    /req/iso-17065/process/surveillance
+    /req/iso-17065/process/surveillance-marked-products
+  }
+  signature {
+    in { certification_documents }
+    out { surveillance_records }
+  }
+  invariants {
+    "[certification_document].mark_in_continued_use = true implies [surveillance_record].periodic = true"
+  }
+  activity_kind { surveillance }
+  roles { certification_body }
+  evidence {
+    surveillance_record { description "The surveillance record per the scheme-defined criteria and process (7.9.1 Note 2), including the periodic surveillance of marked products where mark use continues (7.9.3/7.9.4)." required true }
+  }
+  executor actor
+  source { doc "ISO/IEC 17065:2012, 7.9" clause "" }
+}
+
+process changes {
+  name "Changes affecting certification"
+  summary "The certification body communicates new or revised scheme requirements to all clients and verifies their implementation (7.10.1), considers other changes affecting certification (including client-initiated ones, 7.10.2) and decides upon the appropriate action — re-entering evaluation, review, decision and re-issuance as required, with the rationale for exclusions recorded (7.10.3)."
+  validate_provision {
+    /req/iso-17065/process/changes
+  }
+  signature {
+    in { certification_documents }
+    out { change_records certification_documents }
+  }
+  invariants {
+    "[change_record].decided_action is not null"
+  }
+  activity_kind { decision certification }
+  roles { certification_body }
+  evidence {
+    change_record { description "The change record: the scheme-change communication and implementation verification (7.10.1), the action decided (7.10.2), and the rationale for any excluded 7.4–7.8 activity (7.10.3)." required true }
+  }
+  executor actor
+  source { doc "ISO/IEC 17065:2012, 7.10" clause "" }
+}
+
+process termination {
+  name "Termination, reduction, suspension or withdrawal of certification"
+  summary "On a substantiated nonconformity with certification requirements, the certification body considers and decides the appropriate action — continuation under conditions, scope reduction, suspension or withdrawal (7.11.1) — applying 7.4/7.5/7.6 when the action re-enters them (7.11.2), and makes all necessary modifications to certification documents, public information and mark authorizations so nothing indicates continued certification (7.11.3), with suspension-restoration communication (7.11.4–7.11.6) and reinstatement modifications (7.11.7)."
+  validate_provision {
+    /req/iso-17065/process/termination
+  }
+  signature {
+    in { certification_documents surveillance_records }
+    out { termination_records certification_documents }
+  }
+  invariants {
+    "[termination_record].action is not null"
+    "[termination_record].action = 'SUSPENSION' implies [termination_record].restoration_actions is not null"
+  }
+  activity_kind { suspension withdrawal }
+  roles { certification_body }
+  evidence {
+    termination_record { description "The termination/reduction/suspension/withdrawal record: the substantiated nonconformity, the action decided, and the modifications to documents, public information and mark authorizations (7.11.3); for suspensions, the restoration actions communicated to the client (7.11.4)." required true }
+  }
+  executor actor
+  source { doc "ISO/IEC 17065:2012, 7.11" clause "" }
+}
+
+process records {
+  name "Records"
+  summary "The certification body retains records demonstrating that all certification process requirements (this International Standard and the scheme's) have been effectively fulfilled, keeps them confidential in transport, transmission and transfer, and retains them at least for the current and previous re-evaluation cycle where the scheme re-evaluates within a determined cycle."
+  validate_provision {
+    /req/iso-17065/process/records
+  }
+  signature {
+    in { certification_applications evaluation_results review_records decision_records certification_documents }
+    out { certification_records }
+  }
+  invariants {
+    "[certification_records].retention_period is not null"
+  }
+  roles { certification_body }
+  evidence {
+    records_register { description "The certification-process records with their retention period (at least current + previous cycle where 7.12.3 applies) and confidentiality handling (7.12.2)." required true }
+  }
+  executor actor
+  source { doc "ISO/IEC 17065:2012, 7.12" clause "" }
+}
+
+process complaints {
+  name "Complaints and appeals"
+  summary "The certification body receives, evaluates and decides complaints and appeals under a documented process — confirming relevance, acknowledging receipt, gathering and verifying the information — with the resolving decision made by, or reviewed and approved by, person(s) NOT involved in the related certification activities (7.13.5) and never by personnel within two years of consultancy for or employment by that client (7.13.6), and gives formal notice of the outcome (7.13.7/7.13.8)."
+  validate_provision {
+    /req/iso-17065/process/complaints-process
+    /req/iso-17065/process/complaint-resolution-independence
+    /req/iso-17065/process/complaint-consultancy-bar
+  }
+  signature {
+    in { certification_documents certification_records }
+    out { complaint_records }
+  }
+  invariants {
+    "[complaint_record].acknowledged = true"
+    "[complaint_record].resolution_decider_ids.count >= 1"
+  }
+  activity_kind { complaint appeal }
+  roles { certification_body }
+  evidence {
+    complaint_record { description "The complaint/appeal record: receipt acknowledgement (7.13.3), the gathered and verified information (7.13.4), the resolving decision with its maker/reviewer/approver (7.13.5), and the formal notice of outcome and process end (7.13.7/7.13.8)." required true }
+  }
+  segregation {
+    constraint complaint_resolution_not_case {
+      kind case_personnel_disjoint
+      clause "7.13.5"
+      pair { complaints case_personnel }
+      statement "Within one complaint or appeal case, the personnel making, reviewing or approving the resolving decision shall not have been involved in the certification activities related to that complaint or appeal (ISO/IEC 17065:2012, 7.13.5)."
+    }
+    constraint complaint_consultancy_two_year_bar {
+      kind consultancy_bar
+      clause "7.13.6"
+      period P2Y
+      barred { consultancy employment }
+      statement "Personnel (including those acting in a managerial capacity) who have provided consultancy for a client, or been employed by a client, shall not be used to review or approve the resolution of a complaint or appeal for that client within two years following the end of the consultancy or employment (ISO/IEC 17065:2012, 7.13.6)."
+    }
+  }
+  executor actor
+  source { doc "ISO/IEC 17065:2012, 7.13" clause "" }
+}
+
+process_model functional_approach {
+  sequence { application application_review evaluation review decision attestation surveillance }
+}