ufo-types

UFO-grounded domain types for the b00t ecosystem.

This crate provides a domain-generic ontological foundation — grounded in Guizzardi's Unified Foundational Ontology (UFO) — for any project that wants ontologically-grounded types with deterministic, audit-ready constraint evaluation. It defines:

• UFO stereotypes (stereotype): UfoStereotype enum grounding every domain type in Guizzardi's Unified Foundational Ontology. Domain-generic — nothing here is specific to any one consumer.
• Satisfies<C> trait (satisfies): The core constraint evaluation pattern — any domain type can implement Satisfies<Constraint> with deterministic, audit-ready results. Domain-generic.
• Graph IR (iso_ir): Node / Edge — the free-form graph vocabulary a domain uses to describe connectivity before anything lays it out or renders it. The transport floor of the semantic-graph layer. Domain-generic; promoted from systhread-core.
• Canonical UFO semantic graph (ontology): the ontological middle layer between iso_ir and sysml_model. UfoRelation — a closed (#[non_exhaustive]), 25-variant vocabulary that normalizes overloaded domain verbs (Kubernetes especially) via a lenient from_synonym; OntologicalEdge — a typed, category-checked edge carrying TemporalExtent and deterministic SourceAnchor provenance. Pure data, no traits, not feature-gated. Domain-neutral — verb-classification tables live downstream (kr0ki), never here.
• SysML v2 model types (sysml_model, view): ElementKind, Relation, ElementId (opaque, never numeric), SysmlViewKind — closed, data-level KerML/SysML-v2 abstract syntax + the standard ViewDefinition kinds. The SysML v2 replacement for the rejected SysML 1.x DiagramKind / UmlRelation taxonomy. Pure data, not feature-gated. Domain-generic.
• MBSE / statechart export (mbse, statechart): render Stereotyped types as SysML v2 part usages; bridge OODA state machines to W3C SCXML (feature-gated). Domain-generic.
• Capability types (capability): Task, Attempt, ActionRecord, Episode, ReviewVerdict, Solution, TrainingCorpus, EnergyBudget, etc. — generic agent-capability/OODA types. Domain-generic.
• DARED proposal types (dare): Decision, Alternative, Risk, ExecutiveDecision, OodaStateMachine — a generic OODA state-change proposal framework codified as Rust generics. Domain-generic.
• ISO standard wrappers (iso): Lei (ISO 17442 Legal Entity Identifier), Iso4217 currency codes, and Ifrs9Classification financial-instrument types. These ARE domain-specific — they encode financial/legal-entity accounting standards and are only meaningful to consumers working in that space (e.g. Tax-Lawyer platforms). Not intended as a generic building block for unrelated domains.

Any project needing UFO-grounded domain types and the Satisfies<T> pattern (e.g. stereotype, satisfies, capability, dare) can depend on this crate directly. Only iso carries genuinely finance/tax-domain-specific types.

Versioning & stability

ufo-types is pre-1.0. Under Cargo's SemVer rules a 0.MINOR.PATCH bump gives no compatibility guarantee: a 0.MINOR release MAY remove, rename, narrow, or otherwise reverse capability. CHANGELOG.md entries that say "additive, non-breaking" state intent — a courtesy, not a contract — until 1.0.0.

Consume it accordingly:

• Pin exact. ufo-types = "=0.14.0" (crates.io, once published) or ufo-types = { git = "https://github.com/PromptExecution/ufo-types", tag = "v0.14.0" }.
• Read CHANGELOG.md before every bump. It is the compatibility contract until 1.0.
• The closed #[non_exhaustive] enums (UfoRelation, ElementKind, Relation, SysmlViewKind) may gain variants in a 0.MINOR (match with a _ => arm). The lenient mappings (UfoRelation::from_synonym, case-insensitive FromStr) may be re-tuned between 0.MINORs — do not treat a specific synonym→variant mapping as stable; the strict canonical FromStr is the stable surface.
• The "IDs are never numeric" rule (ElementId, OntologicalEdge.id) is a hard invariant and will not change.

1.0.0 will be cut once the semantic-graph layer has a downstream consumer in production (currently kr0ki's model-ingestion path, planned).

Downstream consumers

Projects cleared to depend on ufo-types directly (retire any vendored copy):

project	crates	modules used	pin
b00t (elasticdotventures/b00t)	b00t-c0re-lib, b00t-lib-chat, b00t-cli	stereotype, satisfies, capability, dare	=0.14.0
ledgrrr (PromptExecution/ledgrrr)	ledger-core, ledgerr-mcp	stereotype, satisfies, iso	=0.14.0 (vendored copy retired)
kr0ki (PromptExecution/kr0ki)	kr0ki-core	iso_ir, ontology, sysml_model, view — the model-ingestion path; mbse::requirements — the ReqIF/Flexo requirements semantic model, re-exported as kr0ki_core::requirements	tag = "v0.15.0"
m0ltis (elasticdotventures/moltis-b00t)	(planned) provider→ufo-types lowering	iso_ir, stereotype, sysml_model	tag = "v0.14.0"
critter-keeper (app4dog)	—	stereotype	=0.14.0
cim-gridy mission-engine	—	stereotype, satisfies	=0.14.0

Rule for consumers: ufo-types stays domain-neutral. Domain vocabularies (the Kubernetes verb table, tax/finance rules beyond iso, per-lab extraction) live in the consumer, not here. If you need a new canonical UfoRelation variant or ElementKind, open an issue — do not fork the enum.

Architecture

┌───────────┐     ┌───────────────┐     ┌────────────────┐
│ ufo-types │────→│ domain impls  │────→│  MCP actions   │
│ (traits)  │     │ (consumer)    │     │ (thin wrappers)│
└───────────┘     └───────────────┘     └────────────────┘

Consumers wire ufo-types into their own domain-impl layer — for example ledger-core (part of PromptExecution/ledgrrr) implements Stereotyped for its own artifact-classification types.

Integration with evidence layers

The Stereotyped trait (from stereotype) and IsoAuditable trait (from satisfies) are designed to bridge domain types to an audit-evidence layer:

• record_is_a(subject, ufo_stereotype) — uses Stereotyped::ufo_stereotype()
• record_audited_by(subject, iso_standard) — uses IsoAuditable::iso_standard_ids()

The EvidenceBridge::evaluate() method on SatisfiesResult produces all labels needed for both calls in one step.

Origin

This crate was extracted from elasticdotventures/b00t (crates/ufo-types), where it originated as part of the b00t governance platform, with git history preserved. It is consumed both inside _b00t_ (b00t-c0re-lib, b00t-lib-chat) and by external projects (e.g. critter-keeper in app4dog) that only need this small, dependency-light types crate without pulling in the full _b00t_ monorepo (34 git submodules).

ReqIFz source intake

The optional reqif-archive feature exposes reqif::archive::ReqIfArchive::from_bytes for bounded ReqIFz intake. It retains the original archive and non-directory entry bytes/order, with SHA-256 digest helpers. Limits are 8 MiB compressed, 16 MiB per entry, 32 MiB expanded, 1024 entries and 1024-byte portable paths. It rejects duplicate names, file/directory aliases, unsafe paths, symlinks and CRC failures. Nested archives remain opaque attachments. A .reqif filename classifies a document without claiming valid XML: schema validation, typed mapping and edited export are still required.

Revision wire schemas

Generate JSON Schema from the optional canonical revision contracts:

cargo run --quiet --features revision --example revision-schema -- bundle > bundle.schema.json
cargo run --quiet --features revision --example revision-schema -- receipt > receipt.schema.json

The selector defaults to bundle. Other selectors are model, changeset, conflict, merge, checkpoint, status, expected-head, fidelity and capabilities, query-request, query-response and graph-descriptor. Each document includes its referenced definitions and can be used by browser validators or JSON Schema to TypeScript generators. Unknown selectors and extra arguments fail without emitting a schema. Pin the producer commit alongside generated browser artifacts; do not maintain independent wire enum definitions. Schema validation describes JSON structure; hydration and service authorization still enforce semantic and project invariants.

Revision discovery uses RevisionQueryRequest and RevisionQueryResponse. Decode rejects unknown fields, duplicate keys and inconsistent response graph, project, revision, freshness or RDF term data. Call validate_for(&request) to check matching project/branch and exact-revision requirements. Exact never falls back. Minimum requires owner-proven accepted ancestry; allow_older permits an explicitly stale fallback below that minimum. Current permits a stale checkpoint only when requested. Fresh means the indexed revision equals the branch model revision sampled by the owner, so an exact historical answer can be Stale while meeting its selector. Unbound SELECT variables are omitted; empty literals, duplicate solutions, lexical values and row order survive. The evaluator adapter supplies actual projected variable names and the parsed query's result kind; column labels are opaque wire data, never SPARQL fragments.

Wire ceilings are 64 KiB query text, 60 seconds relative deadline, 256 projected variables, 10,000 rows and 4 MiB serialized results. Services may enforce lower limits and must bound parsing, staging, concurrency and cancellation themselves. Graph descriptors bind the accepted candidate, projection schema, checkpoint and exact graph bytes; constructing one is not publication evidence. These pure types do not supply storage, an evaluator, authorization or revision ancestry. Checkpoint dialect is the opaque model dialect, such as SysML-v2, rather than the portable bundle format's DIALECT URI. Wire validation checks its identity and 1 KiB ceiling; the owner checks support and its project binding.

References

• Guizzardi, G. (2005). Ontological Foundations for Structural Conceptual Models. PhD Thesis, University of Twente.
• ISO 17442:2012 — Legal Entity Identifier (LEI) (iso module only)
• ISO 4217:2015 — Codes for the representation of currencies (iso module only)
• IFRS 9 — Financial Instruments (IASB, 2014) (iso module only)

License

MIT — see LICENSE.