@sigloch/contracts 3.3.0 → 4.1.0

package/dist/se/evaluate-all.js

@@ -10,21 +10,18 @@ import { ND_RULES, evaluateNDRules } from './near-duplicate-rules.js';
 import { AO_RULES, evaluateAORules } from './ao-rules.js';
 import { BQ_RULES, evaluateBQRules } from './quality-rules.js';
 import { AF_RULES, evaluateAFRules } from './analysis-freshness-rules.js';
-/** All prescribed rule definitions (single source of truth for the catalog). */
+/**
+ * All prescribed rule definitions (single source of truth for the catalog).
+ *
+ * CR-SM-235: `domain` reicht mit durch — die Grundgesamtheit, ueber die eine Regel feuert.
+ * Konsumenten, die einen Anteil bilden (`se-steering`s `computeApplicable`), lesen den Nenner
+ * hier statt eine eigene Tabelle zu fuehren. Eine zweite Tabelle kann nicht hinterherhinken,
+ * wenn es keine zweite gibt.
+ */
 export const ALL_RULE_DEFS = [
-    ...V3_RULES.map(r => ({ id: r.id, name: r.name, severity: r.severity })),
-    ...UC_RULES.map(r => ({ id: r.id, name: r.name, severity: r.severity })),
-    ...FC_RULES.map(r => ({ id: r.id, name: r.name, severity: r.severity })),
-    ...SC_RULES.map(r => ({ id: r.id, name: r.name, severity: r.severity })),
-    ...MT_RULES.map(r => ({ id: r.id, name: r.name, severity: r.severity })),
-    ...BQ_RULES.map(r => ({ id: r.id, name: r.name, severity: r.severity })),
-    ...ND_RULES.map(r => ({ id: r.id, name: r.name, severity: r.severity })),
-    ...CR_RULES.map(r => ({ id: r.id, name: r.name, severity: r.severity })),
-    ...AO_RULES.map(r => ({ id: r.id, name: r.name, severity: r.severity })),
-    ...FM_RULES.map(r => ({ id: r.id, name: r.name, severity: r.severity })),
-    ...VIEW_RULES.map(r => ({ id: r.id, name: r.name, severity: r.severity })),
-    ...AF_RULES.map(r => ({ id: r.id, name: r.name, severity: r.severity })),
-];
+    ...V3_RULES, ...UC_RULES, ...FC_RULES, ...SC_RULES, ...MT_RULES, ...BQ_RULES,
+    ...ND_RULES, ...CR_RULES, ...AO_RULES, ...FM_RULES, ...VIEW_RULES, ...AF_RULES,
+].map(r => ({ id: r.id, name: r.name, severity: r.severity, domain: r.domain }));
 // CR-SM-221: 'RD-' was missing — 'RD-01'.startsWith('R-') is false, so the
 // decomposition rules ran in `default` only and never in the `se` profile.
 const SE_PREFIXES = ['R-', 'RD-', 'UC-', 'FC-', 'SC-', 'MT-', 'CR-', 'AO-', 'FM-', 'NFR-', 'RT-', 'PH-', 'CA-', 'IO-', 'VR-', 'CL-', 'AF-'];
@@ -36,20 +33,26 @@ export function getRuleDefsForProfile(profile) {
         return ALL_RULE_DEFS.filter(r => CODING_PREFIXES.some(p => r.id.startsWith(p)));
     return ALL_RULE_DEFS;
 }
-/** Evaluate all rules against a graph. Single call replaces the individual evaluator calls. */
-export function evaluateAllRules(graph) {
+/**
+ * Evaluate all rules against a graph. Single call replaces the individual evaluator calls.
+ *
+ * CR-SM-233: `policy` ist **Pflicht und ohne Fallback** — ein Aufruf ohne Policy ist ein
+ * Typfehler, keine stille 0.7. Wer keine eigene Quelle hat (Konfiguration, Host), nimmt
+ * `DEFAULT_METRIC_POLICY` sichtbar an der Aufrufstelle.
+ */
+export function evaluateAllRules(graph, policy) {
     return [
-        ...evaluateRules(graph),
-        ...evaluateBQRules(graph),
-        ...evaluateUCRules(graph),
-        ...evaluateFCRules(graph),
-        ...evaluateSCRules(graph),
+        ...evaluateRules(graph, policy),
+        ...evaluateBQRules(graph, policy),
+        ...evaluateUCRules(graph, policy),
+        ...evaluateFCRules(graph, policy),
+        ...evaluateSCRules(graph, policy),
         ...evaluateNDRules(graph),
-        ...evaluateMTRules(graph),
-        ...evaluateCRRules(graph),
-        ...evaluateAORules(graph),
-        ...evaluateFMRules(graph),
-        ...evaluateViewRules(graph),
+        ...evaluateMTRules(graph, policy),
+        ...evaluateCRRules(graph, policy),
+        ...evaluateAORules(graph, policy),
+        ...evaluateFMRules(graph, policy),
+        ...evaluateViewRules(graph, policy),
         ...evaluateAFRules(graph),
     ];
 }

package/dist/se/fchain-quality-rules.d.ts

@@ -3,9 +3,10 @@
  */
 import type { OntologyGraph } from './ontology.js';
 import type { RuleDefinition, RuleViolation } from './rules.js';
+import type { MetricPolicy } from './policy.js';
 export declare function fc01ActorBoundary(graph: OntologyGraph): RuleViolation[];
 export declare function fc02LeafUcHasFchain(graph: OntologyGraph): RuleViolation[];
 export declare function fc03FchainFlat(graph: OntologyGraph): RuleViolation[];
 export declare function fc04ActorBounded(graph: OntologyGraph): RuleViolation[];
 export declare const FC_RULES: RuleDefinition[];
-export declare function evaluateFCRules(graph: OntologyGraph): RuleViolation[];
+export declare function evaluateFCRules(graph: OntologyGraph, policy: MetricPolicy): RuleViolation[];

package/dist/se/fchain-quality-rules.js

@@ -138,11 +138,13 @@ export function fc04ActorBounded(graph) {
 // Aggregated
 // ---------------------------------------------------------------------------
 export const FC_RULES = [
-    { id: 'FC-01', name: 'FCHAIN has actor boundary', severity: 'warning', evaluate: fc01ActorBoundary },
-    { id: 'FC-02', name: 'Leaf UC has FCHAIN', severity: 'warning', evaluate: fc02LeafUcHasFchain },
-    { id: 'FC-03', name: 'FCHAIN is flat', severity: 'warning', evaluate: fc03FchainFlat },
-    { id: 'FC-04', name: 'FCHAIN actor-bounded (trigger+consumer)', severity: 'warning', evaluate: fc04ActorBounded },
+    { id: 'FC-01', name: 'FCHAIN has actor boundary', severity: 'warning', evaluate: fc01ActorBoundary, domain: ['FCHAIN'] },
+    { id: 'FC-02', name: 'Leaf UC has FCHAIN', severity: 'warning', evaluate: fc02LeafUcHasFchain, domain: ['UC'] },
+    { id: 'FC-03', name: 'FCHAIN is flat', severity: 'warning', evaluate: fc03FchainFlat, domain: ['FCHAIN'] },
+    { id: 'FC-04', name: 'FCHAIN actor-bounded (trigger+consumer)', severity: 'warning', evaluate: fc04ActorBounded, domain: ['FCHAIN'] },
 ];
-export function evaluateFCRules(graph) {
-    return FC_RULES.flatMap(rule => rule.evaluate(graph));
+// CR-SM-236: `policy` wird durchgereicht, auch wo diese Familie heute keine Schwelle hat —
+// ein Sonderweg je Familie waere genau der zweite Pfad, den der Regelsatz verbietet.
+export function evaluateFCRules(graph, policy) {
+    return FC_RULES.flatMap(rule => rule.evaluate(graph, policy));
 }

package/dist/se/fmea-rules.d.ts

@@ -1,17 +1,9 @@
-/**
- * CR-182: FMEA/FTA Risk Rules + NFR Budget Overshoot Detection.
- * FM-01: Risk-REQ missing FMEA attributes (severity, occurrence, detection).
- * FM-02: Risk-REQ without mitigation (compose→REQ(kinds∋mitigation)).
- * FM-03: High-risk REQ (RPN>100) without passed verification.
- * NFR-01: measured exceeds budget for an NFR dimension. CR-228 splits the target
- *   by dimension nature: physical budgets (weight/power/cost) live on the part
- *   (MOD); behavioral budgets (timing/memory-throughput) on the FCHAIN/FUNC.
- */
 import type { OntologyGraph } from './ontology.js';
 import type { RuleViolation, RuleDefinition } from './rules.js';
+import type { MetricPolicy } from './policy.js';
 export declare function fm01MissingFmeaAttributes(graph: OntologyGraph): RuleViolation[];
 export declare function fm02MissingMitigation(graph: OntologyGraph): RuleViolation[];
-export declare function fm03HighRiskUnverified(graph: OntologyGraph): RuleViolation[];
+export declare function fm03HighRiskUnverified(graph: OntologyGraph, policy: MetricPolicy): RuleViolation[];
 export declare function nfr01BudgetOvershoot(graph: OntologyGraph): RuleViolation[];
 export declare const FM_RULES: RuleDefinition[];
-export declare function evaluateFMRules(graph: OntologyGraph): RuleViolation[];
+export declare function evaluateFMRules(graph: OntologyGraph, policy: MetricPolicy): RuleViolation[];

package/dist/se/fmea-rules.js

@@ -1,3 +1,14 @@
+/**
+ * CR-182: FMEA/FTA Risk Rules + NFR Budget Overshoot Detection.
+ * FM-01: Risk-REQ missing FMEA attributes (severity, occurrence, detection).
+ * FM-02: Risk-REQ without mitigation (compose→REQ(kinds∋mitigation)).
+ * FM-03: risk REQ with Action Priority High and no passed verification.
+ * NFR-01: measured exceeds budget for an NFR dimension. CR-228 splits the target
+ *   by dimension nature: physical budgets (weight/power/cost) live on the part
+ *   (MOD); behavioral budgets (timing/memory-throughput) on the FCHAIN/FUNC.
+ */
+import { TestRefsSchema } from './ontology.js';
+import { actionPriority, apMethod } from './action-priority.js';
 const PHYSICAL_BUDGET_PAIRS = [
     ['costBudget', 'measuredCost', 'cost'],
     ['weightBudgetKg', 'measuredWeightKg', 'weight (kg)'],
@@ -58,9 +69,17 @@ export function fm02MissingMitigation(graph) {
     }));
 }
 // ---------------------------------------------------------------------------
-// FM-03: High-risk REQ (RPN > 100) without passed verification
+// FM-03: risk REQ with Action Priority High and no passed verification
+//
+// CR-SM-229: die Einstufung kommt aus `actionPriority()` — mit lizenzierter Tabelle die echte
+// AIAG-VDA-Zuordnung, ohne sie der markierte Uebergang (bestaetigte Invarianten, sonst
+// RPN-Baender). CR-SM-236: `policy.riskRpn` ist die RPN-Grenze dieses Uebergangs;
+// `null` → messen, nicht urteilen, die Regel schweigt.
 // ---------------------------------------------------------------------------
-export function fm03HighRiskUnverified(graph) {
+export function fm03HighRiskUnverified(graph, policy) {
+    const threshold = policy.riskRpn;
+    if (threshold === null)
+        return [];
     const riskReqs = graph.elements.filter(e => e.type === 'REQ' && e.kinds?.includes('risk'));
     return riskReqs
         .filter(riskReq => {
@@ -69,25 +88,43 @@ export function fm03HighRiskUnverified(graph) {
         const o = Number(a['occurrence']);
         const d = Number(a['detection']);
         if (isNaN(s) || isNaN(o) || isNaN(d))
-            return false; // can't compute RPN → skip
-        const rpn = s * o * d;
-        if (rpn <= 100)
+            return false; // no ratings → nothing to classify
+        // CR-SM-229: Action Priority statt RPN. RPN irrt gerichtet — S 10 / O 2 / D 2 ergibt
+        // RPN 40 („niedrig"), waehrend AP dort immer `High` sagt: ein gutes Detection-Rating
+        // rechnet eine sicherheitskritische Schwere weg. Genau dafuer hat AIAG-VDA 2019 RPN
+        // ersetzt, nicht ergaenzt.
+        if (actionPriority(s, o, d, threshold, policy.apTable ?? undefined) !== 'High')
             return false;
-        // Check: TEST→verify→riskReq with testResult=passed
+        // Check: TEST→verify→riskReq, and that TEST fully passed.
+        //
+        // CR-SM-231b: „bestanden" heisst **jeder** testRefs-Eintrag ist `passed`. Bei n Laeufen
+        // waere „irgendeiner gruen" die gefaehrliche Lesart: ein gruener Unit-Lauf wuerde einen
+        // roten Visual-Lauf verdecken und ein Risiko-REQ als verifiziert ausweisen. Ein Eintrag
+        // ohne Ergebnis ist nicht bestanden — nicht gelaufen ist nicht gruen.
         const hasPassedTest = graph.traces.some(t => t.type === 'verify' &&
             t.target === riskReq.id &&
-            graph.elements.some(el => el.id === t.source && el.type === 'TEST' && el.attributes?.['testResult'] === 'passed'));
+            graph.elements.some(el => {
+                if (el.id !== t.source || el.type !== 'TEST')
+                    return false;
+                const parsed = TestRefsSchema.safeParse(el.attributes?.testRefs);
+                if (!parsed.success)
+                    return false; // keine Bindung → keine Evidenz
+                return parsed.data.every(ref => ref.result === 'passed');
+            }));
         return !hasPassedTest;
     })
         .map(e => {
         const a = e.attributes ?? {};
-        const rpn = Number(a['severity']) * Number(a['occurrence']) * Number(a['detection']);
+        const s = Number(a['severity']), o = Number(a['occurrence']), d = Number(a['detection']);
+        const method = apMethod(policy.apTable ?? undefined);
+        // Der Hinweis auf das Verfahren kann nicht von der Berechnung abweichen: beide lesen
+        // dieselbe Quelle. `rpn-interim` heisst „bestaetigtes AP, wo bekannt; RPN, wo nicht".
         return {
             rule_id: 'FM-03',
             severity: 'error',
             element_id: e.id,
-            message: `${e.id} has RPN ${rpn} (>100) without passed test verification`,
-            fix_hint: 'Add a TEST with testResult=passed and verify trace to this risk REQ',
+            message: `${e.id} has Action Priority High (S${s}/O${o}/D${d}, ${method}) without passed test verification`,
+            fix_hint: 'Add a TEST whose every testRefs entry has result=passed, and a verify trace to this risk REQ',
         };
     });
 }
@@ -127,11 +164,11 @@ export function nfr01BudgetOvershoot(graph) {
 // Aggregated array & convenience runner
 // ---------------------------------------------------------------------------
 export const FM_RULES = [
-    { id: 'FM-01', name: 'RiskReqFmeaAttributes', severity: 'warning', evaluate: fm01MissingFmeaAttributes },
-    { id: 'FM-02', name: 'RiskReqMitigation', severity: 'warning', evaluate: fm02MissingMitigation },
-    { id: 'FM-03', name: 'HighRiskVerification', severity: 'error', evaluate: fm03HighRiskUnverified },
-    { id: 'NFR-01', name: 'BudgetOvershoot', severity: 'warning', evaluate: nfr01BudgetOvershoot },
+    { id: 'FM-01', name: 'RiskReqFmeaAttributes', severity: 'warning', evaluate: fm01MissingFmeaAttributes, domain: ['REQ'] },
+    { id: 'FM-02', name: 'RiskReqMitigation', severity: 'warning', evaluate: fm02MissingMitigation, domain: ['REQ'] },
+    { id: 'FM-03', name: 'HighRiskVerification', severity: 'error', evaluate: fm03HighRiskUnverified, domain: ['REQ'] },
+    { id: 'NFR-01', name: 'BudgetOvershoot', severity: 'warning', evaluate: nfr01BudgetOvershoot, domain: ['FUNC'] },
 ];
-export function evaluateFMRules(graph) {
-    return FM_RULES.flatMap(rule => rule.evaluate(graph));
+export function evaluateFMRules(graph, policy) {
+    return FM_RULES.flatMap(rule => rule.evaluate(graph, policy));
 }

package/dist/se/format-e-parser.d.ts

@@ -24,7 +24,7 @@ export interface FormatEOperation {
     /**
      * CR-147: Parsed @key value attributes from lines below the node entry.
      * Values are strings, EXCEPT JSON object/array literals which are hydrated
-     * (BOK-CR-026) — object-valued bindings like `realRef`/`testRef` must reach
+     * (BOK-CR-026) — object- and array-valued bindings like `realRef`/`testRefs` must reach
      * `attributes` as objects or R-26/R-19 reject them as invalid.
      */
     attributes?: Record<string, unknown>;
@@ -38,6 +38,19 @@ export interface FormatEDiff {
 }
 /** Extract a ```format-e block from LLM output. Returns null if not found. */
 export declare function extractFormatE(llmOutput: string): string | null;
+/**
+ * BOK-CR-026: hydrate a JSON object/array attribute value. The ontology's bindings
+ * (`realRef {file,symbol?,lang?}`, `testRefs [{file,tool,…}]`) are objects/arrays; kept as raw
+ * strings they fail RealRefSchema/TestRefSchema and the element reads as unbound.
+ * Only `{…}`/`[…]` are attempted — every other value stays the string it is, and a
+ * malformed literal falls back to the string rather than failing the whole parse.
+ *
+ * CR-GC-334: exported, because `FormatECodec` (graph-api-core) parses the SAME `@key value`
+ * lines and did NOT hydrate — the identical defect this function was written for, one
+ * package over. Two hydration rules would drift; there is one, and it lives here with the
+ * schemas it feeds.
+ */
+export declare function hydrateAttrValue(raw: string): unknown;
 export interface ParseFormatEOptions {
     /**
      * CR-SM-216: resolve the type of a uid that this text does not declare. A mutation

package/dist/se/format-e-parser.js

@@ -44,12 +44,17 @@ const NODE_RE = /^([+\-~!])?\s*(\S+?)(?:\|(.*))?$/;
 const ATTR_RE = /^\s*@(\w+)\s+(.+)$/;
 /**
  * BOK-CR-026: hydrate a JSON object/array attribute value. The ontology's bindings
- * (`realRef {file,symbol?,lang?}`, `testRef {file,tool,…}`) are objects; kept as raw
+ * (`realRef {file,symbol?,lang?}`, `testRefs [{file,tool,…}]`) are objects/arrays; kept as raw
  * strings they fail RealRefSchema/TestRefSchema and the element reads as unbound.
  * Only `{…}`/`[…]` are attempted — every other value stays the string it is, and a
  * malformed literal falls back to the string rather than failing the whole parse.
+ *
+ * CR-GC-334: exported, because `FormatECodec` (graph-api-core) parses the SAME `@key value`
+ * lines and did NOT hydrate — the identical defect this function was written for, one
+ * package over. Two hydration rules would drift; there is one, and it lives here with the
+ * schemas it feeds.
  */
-function hydrateAttrValue(raw) {
+export function hydrateAttrValue(raw) {
     if (!/^[{[]/.test(raw))
         return raw;
     try {
@@ -267,7 +272,7 @@ export function serializeToFormatE(graph) {
                     for (const [k, v] of Object.entries(el.attributes)) {
                         if (v == null)
                             continue;
-                        // BOK-CR-026: objects/arrays as JSON — String({}) collapses a realRef/testRef
+                        // BOK-CR-026: objects/arrays as JSON — String({}) collapses a realRef/testRefs
                         // binding to "[object Object]" and loses it on the next parse.
                         const text = typeof v === 'object' ? JSON.stringify(v) : String(v);
                         if (text.length > 0)

package/dist/se/index.d.ts

@@ -3,9 +3,9 @@
  * Single source of truth for SE ontology schemas across all projects.
  */
 /** Ontology schema version (element types + trace types). */
-export declare const ONTOLOGY_VERSION = "4.0.0";
+export declare const ONTOLOGY_VERSION = "6.0.0";
 /** Rules engine version (validation rules incl. RC conformance). */
-export declare const RULES_VERSION = "2.24.0";
+export declare const RULES_VERSION = "2.27.0";
 /** Meta-model version (trace pattern constraints + format-e parser). */
 export declare const META_MODEL_VERSION = "1.4.0";
 export * from './ontology.js';
@@ -15,6 +15,8 @@ export * from './schema-quality-rules.js';
 export * from './uc-quality-rules.js';
 export * from './fchain-quality-rules.js';
 export * from './metric-rules.js';
+export * from './policy.js';
+export * from './action-priority.js';
 export * from './fmea-rules.js';
 export * from './view-rules.js';
 export * from './cr-quality-rules.js';

package/dist/se/index.js

@@ -3,9 +3,9 @@
  * Single source of truth for SE ontology schemas across all projects.
  */
 /** Ontology schema version (element types + trace types). */
-export const ONTOLOGY_VERSION = '4.0.0'; // BREAKING: `SemanticId` (`Name.TypeAbbr.Counter`) deleted, `ElementUid` (`<TYPE>-<slug>`) is the family canon — the old canon was used by no production graph of the family while 626 of 1145 elements already carried TYPE-slug (CR-SM-217); realRef unifies codeRef+schemaRef (+physical-MOD CAD ref), symbol optional; testRef stays separate (CR-228 C); +RepoRelativePathSchema on testRef/realRef .file — no absolute/`..` paths (CR-GC-255)
+export const ONTOLOGY_VERSION = '6.0.0'; // BREAKING (CR-SM-231b): das knotenweite `testResult` entfaellt — das Ergebnis haengt PRO `testRefs`-Eintrag (`result`, `ranAt`, `evidence`), aus demselben Grund wie `tool`. Ein einzelnes Ergebnis am Knoten konnte bei n Laeufen nicht sagen, welcher gemeint ist, und "einer rot, einer gruen" war gar nicht darstellbar — genau der Zustand, den ein Gate wissen muss. FM-03 liest jetzt "jeder Eintrag passed": "irgendeiner gruen" haette einen gruenen Unit-Lauf einen roten Visual-Lauf verdecken lassen. Ein Eintrag ohne Ergebnis ist nicht bestanden. VR-01 meldet die Dateien ohne Ergebnis statt nur den Knoten. Prior: BREAKING (CR-SM-231): `testRef` (Objekt) entfaellt ersatzlos zugunsten von `testRefs` (Array, min 1) — eine Abnahme, n Testdateien. Kein Union, kein Alias: ein Graph mit dem alten Attribut faellt R-19 zur Last und muss migriert werden. Anlass war ein Zaehl-Audit (537 laufende Tests in 67 Dateien, 14 TEST-Knoten mit je genau einer Datei, 53 Dateien an keine Abnahme gebunden) plus ein belegter Ausweichweg: dieselbe Spec-Datei stand im testRef ZWEIER TEST-Knoten, womit die Relation faktisch n:m war — ein roter Lauf keiner Abnahme mehr eindeutig zuordenbar, der TRR-Gate zaehlte dieselbe Evidenz doppelt. `tool` bleibt PRO EINTRAG: eine Abnahme mischt real die Runner (vitest + playwright). +AttributeSpec.type 'array' (testRefs ist das erste Listen-Attribut). Prior: BREAKING: `SemanticId` (`Name.TypeAbbr.Counter`) deleted, `ElementUid` (`<TYPE>-<slug>`) is the family canon — the old canon was used by no production graph of the family while 626 of 1145 elements already carried TYPE-slug (CR-SM-217); realRef unifies codeRef+schemaRef (+physical-MOD CAD ref), symbol optional; testRef stays separate (CR-228 C); +RepoRelativePathSchema on testRef/realRef .file — no absolute/`..` paths (CR-GC-255)
 /** Rules engine version (validation rules incl. RC conformance). */
-export const RULES_VERSION = '2.24.0'; // CR-GC-315: R-12 + R-21 no longer tax FLOW reuse. R-12 restricted to dependency-carrying traces (compose/allocate/relation) — on `io` the only reachable shape was FUNC ─io→ FLOW ─io→ the SAME FUNC, i.e. read-modify-write on a shared FLOW, so the check was pure false-positive there (real io-cycles span ≥2 FUNCs and a 2-cycle test cannot see them); satisfy/verify/produces 2-cycles are pattern-illegal and belong to R-18. Its dedup key is now direction-independent (`type|sorted pair`) — keying on the message never collapsed anything, so every cycle was reported twice. R-21 no longer derives FUNC↔FUNC connections from FLOW co-adjacency alone: a producer/consumer pair with NO shared FCHAIN is silent. One hub FLOW with P producers and C consumers manufactured P·C findings, each demanding its own FCHAIN+integration test including pairs that never interact — reuse was penalised quadratically. The FCHAIN is the declared integration scope; the test is owed on that declared claim only. Rule intent (CR-GC-240 gap: unit/UC tests do not cover FUNC↔FUNC wiring) unchanged. Prior: CR-SM-227: +AF-01..05 Analysis-Freshness-Legs (analysis-freshness-rules.ts) — the third leg-kind a review gate checks (rule legs, layer-presence legs [R-28], now analysis-freshness legs, docs/articles/07-the-scoring-landscape.md); presence-only rules (Presence/Resolution-Split like R-19/R-20/R-26/R-27 vs. RC-01..05) checking a `graphVersion` freshness stamp exists under SYS.attributes.analysisFreshness.<AnalysisArtifactId> for each of the 5 CR-GC-221 judgment artifacts (conops/trade/assumption-review/fmea/implplan) — staleness (stamp vs live graphVersion) stays a consumer/I-O concern (`CreationCurrencyProvider`, @sigloch/graphcode-client), NOT evaluated here; Familie-Review 2026-08-05 gate assignment → RULE_TO_PHASE: ConOps/Trade/Assumption-Review → PDR, FMEA → CDR, Implementation Plan → TRR (SRR gets none); +AnalysisArtifactId enum + AnalysisFreshnessStampSchema (ontology.ts) as the SSOT graphcode-client's ARTIFACT_CATALOG analysis ids must match; grober Graph-Versions-Stempel only, no scope-hash in this first cut (conscious CR-SM-227 limitation).
+export const RULES_VERSION = '2.27.0'; // CR-SM-239: AF-01..05 und R-28 deklarieren `domain: ['graph']` statt `['SYS']` — sie pruefen EINMAL den Graphen, nicht die SYS-Elemente. Als Ein-Element-Gruppe waren sie ein Nenner-Beitrag mit fast sicherem Verstoss und zogen jede sonst leere Dimension auf 0 %: ein Graph ohne eine einzige REQ las `req` = 0 % (1 - 2/2 aus AF-01/AF-03) statt „nichts zu messen", und die Fokuswahl schickte den Executor dorthin. Kein Regelverhalten geaendert — nur die deklarierte Grundgesamtheit. Prior: CR-SM-231: +R-29 Testdatei-Exklusivitaet (severity **error**) — jede Testdatei erscheint in hoechstens einem `testRefs`. Das ist die Haelfte, die 1:n ERZWINGT statt es nur zu erlauben; ohne sie driftet das Attribut zurueck nach n:m. Bewusst schaerfer als R-19/R-20 (beide warning): eine doppelt beanspruchte Datei macht Gate-Zahlen nachweislich falsch, das ist eine Fehlmessung und kein Vollstaendigkeits-Signal. Rein graph-strukturell, kein I/O. R-19 und RC-02 lesen `testRefs`; RC-02 iteriert die Eintraege und nennt den konkreten Pfad statt nur der Knoten-ID. Prior: CR-SM-236: die letzten drei Urteilsschwellen sind Policy-Parameter statt Literal — CR-01 (`crossingFlows`, erstmals mit Aus-Zustand: `null` unterdrueckt auch die info je Modulpaar, die bisher die arch-Dimension verduennte), FM-03 (`riskRpn`, vorher inline 100) und R-04 (`moduleSize.{large,coupled,crossings}`, vorher inline 12/8/2 — drei Urteile, nicht eins). R-04 heisst jetzt 'Module size relative to crossing flows': die Regel waegt Groesse GEGEN Kreuzungen ab, der alte Name 'Max module size' verschwieg die zweite Haelfte der Bedingung. `RuleDefinition.evaluate` nimmt die Policy als zweiten Parameter, damit keine Familie einen Sonderweg braucht; einstellige Regelfunktionen bleiben zuweisbar. Bewertung unter DEFAULT_METRIC_POLICY unveraendert. Prior: CR-GC-315: R-12 + R-21 no longer tax FLOW reuse. R-12 restricted to dependency-carrying traces (compose/allocate/relation) — on `io` the only reachable shape was FUNC ─io→ FLOW ─io→ the SAME FUNC, i.e. read-modify-write on a shared FLOW, so the check was pure false-positive there (real io-cycles span ≥2 FUNCs and a 2-cycle test cannot see them); satisfy/verify/produces 2-cycles are pattern-illegal and belong to R-18. Its dedup key is now direction-independent (`type|sorted pair`) — keying on the message never collapsed anything, so every cycle was reported twice. R-21 no longer derives FUNC↔FUNC connections from FLOW co-adjacency alone: a producer/consumer pair with NO shared FCHAIN is silent. One hub FLOW with P producers and C consumers manufactured P·C findings, each demanding its own FCHAIN+integration test including pairs that never interact — reuse was penalised quadratically. The FCHAIN is the declared integration scope; the test is owed on that declared claim only. Rule intent (CR-GC-240 gap: unit/UC tests do not cover FUNC↔FUNC wiring) unchanged. Prior: CR-SM-227: +AF-01..05 Analysis-Freshness-Legs (analysis-freshness-rules.ts) — the third leg-kind a review gate checks (rule legs, layer-presence legs [R-28], now analysis-freshness legs, docs/articles/07-the-scoring-landscape.md); presence-only rules (Presence/Resolution-Split like R-19/R-20/R-26/R-27 vs. RC-01..05) checking a `graphVersion` freshness stamp exists under SYS.attributes.analysisFreshness.<AnalysisArtifactId> for each of the 5 CR-GC-221 judgment artifacts (conops/trade/assumption-review/fmea/implplan) — staleness (stamp vs live graphVersion) stays a consumer/I-O concern (`CreationCurrencyProvider`, @sigloch/graphcode-client), NOT evaluated here; Familie-Review 2026-08-05 gate assignment → RULE_TO_PHASE: ConOps/Trade/Assumption-Review → PDR, FMEA → CDR, Implementation Plan → TRR (SRR gets none); +AnalysisArtifactId enum + AnalysisFreshnessStampSchema (ontology.ts) as the SSOT graphcode-client's ARTIFACT_CATALOG analysis ids must match; grober Graph-Versions-Stempel only, no scope-hash in this first cut (conscious CR-SM-227 limitation).
 /** Meta-model version (trace pattern constraints + format-e parser). */
 export const META_MODEL_VERSION = '1.4.0'; // -REQ→MOD allocate pattern removed (CR-228 A); +FUNC→FUNC compose (blackbox function decomposition)
 export * from './ontology.js';
@@ -15,6 +15,8 @@ export * from './schema-quality-rules.js';
 export * from './uc-quality-rules.js';
 export * from './fchain-quality-rules.js';
 export * from './metric-rules.js';
+export * from './policy.js';
+export * from './action-priority.js';
 export * from './fmea-rules.js';
 export * from './view-rules.js';
 export * from './cr-quality-rules.js';

package/dist/se/metric-rules.d.ts

@@ -4,20 +4,26 @@
  */
 import type { OntologyGraph } from './ontology.js';
 import type { RuleViolation } from './rules.js';
+import type { MetricPolicy } from './policy.js';
 /**
  * MT-01: Module Instability (CR-165: indirect via allocate-path).
- * I = fan_out / (fan_in + fan_out) > 0.7 → warning.
+ * I = fan_out / (fan_in + fan_out) > `policy.instability` → warning.
  * fan_out = traces from FUNCs-in-module pointing to elements OUTSIDE the module.
  * fan_in = traces from OUTSIDE pointing to FUNCs-in-module.
  * Direct MOD→MOD io/compose traces also count.
+ *
+ * CR-SM-233: die Schwelle ist Eingabe, nicht Konstante — `policy.instability === null`
+ * heißt messen, nicht urteilen (`moduleMetrics` liefert den Wert unverändert weiter).
  */
-export declare function mt01Instability(graph: OntologyGraph): RuleViolation[];
+export declare function mt01Instability(graph: OntologyGraph, policy: MetricPolicy): RuleViolation[];
 /**
  * MT-02: LCOM4 (Lack of Cohesion — component count).
  * MOD with allocated FUNCs that share no common io/satisfy targets → cohesion problem.
- * Components > 1 → info.
+ * `policy.lcom4.info` ≤ LCOM4 < `policy.lcom4.warning` → info, darüber warning.
+ *
+ * CR-SM-233: die Stufen sind Eingabe, `null` heißt messen statt urteilen.
  */
-export declare function mt02Lcom4(graph: OntologyGraph): RuleViolation[];
+export declare function mt02Lcom4(graph: OntologyGraph, policy: MetricPolicy): RuleViolation[];
 /** One module's allocation-cohesion measurement (CR-SM-223). */
 export interface AllocationCohesion {
     moduleId: string;
@@ -92,10 +98,12 @@ export declare const MT_RULES: readonly [{
     readonly name: "Module instability";
     readonly severity: "warning";
     readonly evaluate: typeof mt01Instability;
+    readonly domain: readonly ["MOD"];
 }, {
     readonly id: "MT-02";
     readonly name: "Module cohesion (LCOM4)";
     readonly severity: "info";
     readonly evaluate: typeof mt02Lcom4;
+    readonly domain: readonly ["MOD"];
 }];
-export declare function evaluateMTRules(graph: OntologyGraph): RuleViolation[];
+export declare function evaluateMTRules(graph: OntologyGraph, policy: MetricPolicy): RuleViolation[];

package/dist/se/metric-rules.js

@@ -1,25 +1,30 @@
-const INSTABILITY_THRESHOLD = 0.7;
 /**
  * MT-01: Module Instability (CR-165: indirect via allocate-path).
- * I = fan_out / (fan_in + fan_out) > 0.7 → warning.
+ * I = fan_out / (fan_in + fan_out) > `policy.instability` → warning.
  * fan_out = traces from FUNCs-in-module pointing to elements OUTSIDE the module.
  * fan_in = traces from OUTSIDE pointing to FUNCs-in-module.
  * Direct MOD→MOD io/compose traces also count.
+ *
+ * CR-SM-233: die Schwelle ist Eingabe, nicht Konstante — `policy.instability === null`
+ * heißt messen, nicht urteilen (`moduleMetrics` liefert den Wert unverändert weiter).
  */
-export function mt01Instability(graph) {
+export function mt01Instability(graph, policy) {
     const violations = [];
+    const threshold = policy.instability;
+    if (threshold === null)
+        return violations;
     // CR-SM-232: EINE Rechnung, zwei Ausgaben. Die fan_in/fan_out-Formel steht in
     // `measureModules` — hier wird nur noch geschwellt. Sonst stünde die Formel
     // doppelt im selben File und der Export wäre eine zweite Implementierung.
     for (const m of measureModules(graph)) {
         if (m.instability === null)
             continue;
-        if (m.instability > INSTABILITY_THRESHOLD) {
+        if (m.instability > threshold) {
             violations.push({
                 rule_id: 'MT-01',
                 severity: 'warning',
                 element_id: m.moduleId,
-                message: `${m.moduleName} has instability ${Math.round(m.instability * 100)}% (>${INSTABILITY_THRESHOLD * 100}%). fan_in=${m.fanIn}, fan_out=${m.fanOut}`,
+                message: `${m.moduleName} has instability ${Math.round(m.instability * 100)}% (>${threshold * 100}%). fan_in=${m.fanIn}, fan_out=${m.fanOut}`,
             });
         }
     }
@@ -28,19 +33,24 @@ export function mt01Instability(graph) {
 /**
  * MT-02: LCOM4 (Lack of Cohesion — component count).
  * MOD with allocated FUNCs that share no common io/satisfy targets → cohesion problem.
- * Components > 1 → info.
+ * `policy.lcom4.info` ≤ LCOM4 < `policy.lcom4.warning` → info, darüber warning.
+ *
+ * CR-SM-233: die Stufen sind Eingabe, `null` heißt messen statt urteilen.
  */
-export function mt02Lcom4(graph) {
+export function mt02Lcom4(graph, policy) {
     const violations = [];
+    const steps = policy.lcom4;
+    if (steps === null)
+        return violations;
     // CR-SM-232: die Union-Find-Rechnung steht in `measureModules`; hier nur die Stufen.
     for (const m of measureModules(graph)) {
         if (m.lcom4 === null)
             continue;
         const message = `${m.moduleName} has LCOM4=${m.lcom4} (${m.allocatedFuncs} FUNCs in ${m.lcom4} disconnected groups)`;
-        if (m.lcom4 >= 4 && m.lcom4 <= 5) {
+        if (m.lcom4 >= steps.info && m.lcom4 < steps.warning) {
             violations.push({ rule_id: 'MT-02', severity: 'info', element_id: m.moduleId, message });
         }
-        else if (m.lcom4 > 5) {
+        else if (m.lcom4 >= steps.warning) {
             violations.push({ rule_id: 'MT-02', severity: 'warning', element_id: m.moduleId, message });
         }
     }
@@ -277,10 +287,10 @@ export function allocationCohesion(graph) {
     }));
 }
 export const MT_RULES = [
-    { id: 'MT-01', name: 'Module instability', severity: 'warning', evaluate: mt01Instability },
-    { id: 'MT-02', name: 'Module cohesion (LCOM4)', severity: 'info', evaluate: mt02Lcom4 },
+    { id: 'MT-01', name: 'Module instability', severity: 'warning', evaluate: mt01Instability, domain: ['MOD'] },
+    { id: 'MT-02', name: 'Module cohesion (LCOM4)', severity: 'info', evaluate: mt02Lcom4, domain: ['MOD'] },
     // MT-03 retired as a rule (CR-SM-223) — see `allocationCohesion` above.
 ];
-export function evaluateMTRules(graph) {
-    return MT_RULES.flatMap(r => r.evaluate(graph));
+export function evaluateMTRules(graph, policy) {
+    return MT_RULES.flatMap(r => r.evaluate(graph, policy));
 }

package/dist/se/near-duplicate-rules.d.ts

@@ -34,11 +34,13 @@ export declare const ND_RULES: readonly [{
     readonly name: "FuncNearDuplicate";
     readonly severity: "error";
     readonly evaluate: typeof nd01FuncNearDuplicate;
+    readonly domain: readonly ["FUNC"];
 }, {
     readonly id: "ND-02";
     readonly name: "SchemaNearDuplicate";
     readonly severity: "error";
     readonly evaluate: typeof nd02SchemaNearDuplicate;
+    readonly domain: readonly ["SCHEMA"];
 }];
 /** Evaluate all near-duplicate rules. */
 export declare function evaluateNDRules(graph: OntologyGraph): RuleViolation[];

package/dist/se/near-duplicate-rules.js

@@ -97,8 +97,8 @@ export function nd02SchemaNearDuplicate(graph) {
 // Aggregate
 // ---------------------------------------------------------------------------
 export const ND_RULES = [
-    { id: 'ND-01', name: 'FuncNearDuplicate', severity: 'error', evaluate: nd01FuncNearDuplicate },
-    { id: 'ND-02', name: 'SchemaNearDuplicate', severity: 'error', evaluate: nd02SchemaNearDuplicate },
+    { id: 'ND-01', name: 'FuncNearDuplicate', severity: 'error', evaluate: nd01FuncNearDuplicate, domain: ['FUNC'] },
+    { id: 'ND-02', name: 'SchemaNearDuplicate', severity: 'error', evaluate: nd02SchemaNearDuplicate, domain: ['SCHEMA'] },
 ];
 /** Evaluate all near-duplicate rules. */
 export function evaluateNDRules(graph) {

package/dist/se/ontology.d.ts

@@ -95,26 +95,72 @@ export type RepoRelativePath = z.infer<typeof RepoRelativePathSchema>;
  * Runnable binding for a TEST element (CR-GC-134, ontology bump 3.4.0).
  * Resolves a TEST node to the concrete artefact a runner can execute, enabling
  * bottom-up selective test deduction (`graph_tests`): change → impacted TESTs →
- * `testRef` → minimal selective run command.
+ * `testRefs` → minimal selective run command.
  *   - `file`  : test file path, e.g. `tests/foo.test.ts` (the runner target).
  *   - `case`  : optional named case/`describe`/`it` block within the file.
  *   - `tool`  : the runner, e.g. `vitest`, `playwright`, `pytest`.
  *   - `level` : optional level, e.g. `unit`, `integration`, `validation`.
- * Stored under `OntologyElement.attributes.testRef` (additive, opt-in validation).
+ *
+ * `tool` steht bewusst **pro Eintrag**, nicht hochgezogen: eine Abnahme mischt real die
+ * Runner — ein TEST kann aus `tests/dashboard.test.mjs` (vitest) *und*
+ * `tests/visual/dashboard-render.spec.mjs` (playwright) bestehen. Ein Runner je TEST-Knoten
+ * wäre eine Lüge, die das alte 1:1-Schema nur deshalb nicht produzierte, weil es die zweite
+ * Datei gar nicht erst zuliess.
  */
 export declare const TestRefSchema: z.ZodObject<{
     file: z.ZodString;
     case: z.ZodOptional<z.ZodString>;
     tool: z.ZodString;
     level: z.ZodOptional<z.ZodString>;
+    result: z.ZodOptional<z.ZodEnum<{
+        passed: "passed";
+        failed: "failed";
+        skipped: "skipped";
+        pending: "pending";
+    }>>;
+    ranAt: z.ZodOptional<z.ZodISODateTime>;
+    evidence: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type TestRef = z.infer<typeof TestRefSchema>;
+/**
+ * CR-SM-231: eine Abnahme, **n** Testdateien — 1:n, nie n:m.
+ *
+ * Vorher war `testRef` ein einzelnes Objekt: ein TEST-Knoten war an genau eine Datei bindbar.
+ * Eine Abnahme aus Unit- *und* Visual-Lauf konnte ihre Evidenz damit nicht vollstaendig
+ * deklarieren, und der Ausweichweg war belegt — dieselbe Spec-Datei stand im `testRef` zweier
+ * TEST-Knoten. Damit war die Relation faktisch n:m: ein roter Lauf war keiner Abnahme mehr
+ * eindeutig zuordenbar, waehrend der TRR-Gate dieselbe Evidenz doppelt zaehlte.
+ *
+ * **Warum n:m hier falsch ist.** n:m zwischen Abnahme und Anforderung ist bereits korrekt
+ * modelliert und in Gebrauch (`TEST -[verify]-> REQ`) — dafuer ist eine Kante da. Die Bindung
+ * an die Laufdatei ist etwas anderes: sie ist **Evidenz-Adresse**, kein Traceability-Link. Sie
+ * gehoert ins Attribut und bleibt 1:n — ein TEST kennt n Dateien, eine Datei gehoert zu
+ * hoechstens einem TEST. Die zweite Haelfte erzwingt R-29.
+ *
+ * Gespeichert unter `OntologyElement.attributes.testRefs`. Das alte `testRef` entfaellt
+ * ersatzlos — kein Union, kein Alias, keine parallelen Pfade.
+ */
+export declare const TestRefsSchema: z.ZodArray<z.ZodObject<{
+    file: z.ZodString;
+    case: z.ZodOptional<z.ZodString>;
+    tool: z.ZodString;
+    level: z.ZodOptional<z.ZodString>;
+    result: z.ZodOptional<z.ZodEnum<{
+        passed: "passed";
+        failed: "failed";
+        skipped: "skipped";
+        pending: "pending";
+    }>>;
+    ranAt: z.ZodOptional<z.ZodISODateTime>;
+    evidence: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>;
+export type TestRefs = z.infer<typeof TestRefsSchema>;
 /**
  * Realization binding for an element (CR-228, ontology bump 3.9.0) — unifies the
  * byte-identical former `codeRef` (FUNC → code symbol) and `schemaRef` (SCHEMA →
  * Zod export), and extends to MOD (physical part → CAD/geometry artefact). The
  * *type* of the pointing element disambiguates what kind of realization it is:
- * FUNC→code, SCHEMA→Zod-def, physical MOD→CAD. TEST keeps its own `testRef`
+ * FUNC→code, SCHEMA→Zod-def, physical MOD→CAD. TEST keeps its own `testRefs`
  * (a TEST is not just located but *executed* — the runner is the extra value).
  *   - `file`   : realization file path, e.g. `src/harness.ts`, `part.step`.
  *   - `symbol` : the realizing symbol (function/class/Zod export). Optional — a
@@ -330,7 +376,12 @@ export declare const ELEMENT_DESCRIPTIONS: Record<ElementType, string>;
 export declare const MODELING_ELEMENT_TYPES: ElementType[];
 export interface AttributeSpec {
     key: string;
-    type: 'string' | 'number' | 'boolean' | 'enum' | 'object';
+    /**
+     * CR-SM-231: `array` kommt dazu — `testRefs` ist das erste Attribut, das eine Liste ist.
+     * Als `object` deklariert waere es fuer jeden Konsumenten, der diese Spezifikation liest
+     * (Format-E-Editor, Doku-Generator), formal falsch.
+     */
+    type: 'string' | 'number' | 'boolean' | 'enum' | 'object' | 'array';
     enumValues?: readonly string[];
     description: string;
 }