[rules score] link root causes directly to failure modes

- `safety_analysis` exports `TrlcProviderInfo` (fta_events + failure
  modes); AoU files with `root_causes` go to `assumptions_of_use` deps
  and to `safety_analysis(safetymeasures=...)` for coverage

Author: hoe-jo

.github/skills/score-requirements/SKILL.md

@@ -159,7 +159,7 @@ Requirement          → description (Markup_String), version (Integer),
   RequirementSafety   → + safety (Asil)
     AssumedSystemReq  → + rationale (String)
     FeatReq           → + derived_from (AssumedSystemReqId[1..*])
-    CompReq           → + derived_from (CompReqSourceId[1..*])   # FeatReq or AssumedSystemReq
+    CompReq           → + derived_from (CompReqSourceId[1..*])   # FeatReq, AssumedSystemReq, received AoU, or RootCause (control measure)
 ```
 
 - `description` is a `Markup_String` — it may contain `:term:` references and embedded

.github/skills/score-safety-analysis/SKILL.md

@@ -159,7 +159,7 @@ $RootCause("<Root cause label 2>", "<RootCauseAlias2>", "OG1")
 | `$TransferInGate(name, alias, connection)` | Link to sub-tree | parent alias |
 
 **Rules:**
-- `$RootCause` alias is a plain identifier; the `puml_cli` FTA parser auto-generates a `fta_events.trlc` stub (imported as `<name>_fta`) containing a `RootCause` record named after that alias — `Mitigation`/`CompReq`/`AoU` records reference it explicitly (e.g. `root_causes = [sample_safety_analysis_fta.JustBadLuck]`); there is no implicit name-matching.
+- `$RootCause` alias is a plain identifier; the `puml_cli` FTA parser auto-generates a `fta_events.trlc` stub (imported as `<name>_fta`) containing a `RootCause` record named after that alias (its `failure_modes` lists the `FailureMode`s of the tree's `$FailureMode` root) — `Mitigation`/`CompReq`/`AoU` records reference it explicitly (e.g. `root_causes = [sample_safety_analysis_fta.JustBadLuck]`); there is no implicit name-matching.
 - Build top-down in the file: `$FailureMode` first, then gates, then `$RootCause` leaves.
 - The same `$RootCause` alias may appear in multiple FTAs (shared root cause).
 - `$OrGate` is the default for independent root causes; use `$AndGate` only when all causes must co-occur.
@@ -181,10 +181,15 @@ ScoreReq.Mitigation <RecordName> {
 ```
 
 Other ways to close a root cause:
-- `ScoreReq.CompReq` — closes it via `derived_from`, referencing the `RootCause` stub alongside any `FeatReq`/`AssumedSystemReq`/`AoU` it also derives from
-- `ScoreReq.AoU` — assumption the caller must satisfy; does **not** extend `SafetyMeasure` and has its own independent, optional `root_causes` field (no `justification` required)
+- `ScoreReq.CompReq` — closes it via `derived_from`, referencing the `RootCause` stub alongside any `FeatReq`/`AssumedSystemReq` it also derives from. An `AoU` in `derived_from` is only for an AoU **received** from another dependable element; the element's own AoUs are never a `derived_from` source
+- `ScoreReq.AoU` — own assumption the caller must satisfy; does **not** extend `SafetyMeasure` and has its own independent, optional `root_causes` field (no `justification` required)
 
-**Rule:** every `$RootCause` alias must be referenced by at least one `Mitigation.root_causes`, `CompReq.derived_from`, or `AoU.root_causes` — this is validated by `bazel test` on the owning `dependability_analysis` target.
+**Rule:** every `$RootCause` alias must be referenced by at least one `Mitigation.root_causes`, `CompReq.derived_from`, or `AoU.root_causes`. This is checked by lobster in the traceability report of the enclosing `dependable_element` (Root Causes are covered via the Safety Measures level **or** the Component Requirements level; uncovered ones are reported as `missing reference to Component Requirements or Safety Measures`, and fail `bazel test <dependable_element>` with `maturity = "release"`). Only files passed as `safety_analysis.safetymeasures` form the Safety Measures level, so an AoU file with `root_causes` must be listed there **and** the `assumptions_of_use` target must list the `safety_analysis` target in `deps` (the generated `<fta_package>` package resolves only through it). Every AoU in a `safetymeasures` file must reference a root cause, otherwise it is reported as `missing up reference`; keep AoUs without `root_causes` in a separate file passed only to `assumptions_of_use`:
+
+```python
+safety_analysis(name = "sa", safetymeasures = ["aou.trlc"], ...)
+assumptions_of_use(name = "aous", srcs = ["aou.trlc"], deps = [":sa"])
+```
 
 ## Step 4 — Update BUILD
 
@@ -223,5 +228,7 @@ $RootCause alias      →  Mitigation.root_causes / CompReq.derived_from / AoU.r
 | `$FailureMode` fm1..fm8 argument does not match any TRLC record | Ensure `<Pkg>.<RecordName>` is spelled identically in both places |
 | A root cause (`$RootCause`) is not referenced by any `Mitigation`/`CompReq`/`AoU` | Add an explicit reference to the generated `<fta_package>.<Alias>` `RootCause` stub |
 | New `.puml` not in BUILD `fta_files` | Add the file path to the `srcs` list |
-| AoU added to `safetymeasures.trlc` | AoUs belong in `aous.trlc`; `AoU` does not extend `SafetyMeasure`, it has its own independent `root_causes` field |
+| AoU added to `safetymeasures.trlc` | AoUs belong in `aous.trlc`; `AoU` does not extend `SafetyMeasure`, it has its own independent `root_causes` field. If the AoU closes a root cause, pass `aous.trlc` as `safety_analysis.safetymeasures` (coverage) and add the `safety_analysis` target to `assumptions_of_use.deps` |
+| `CompReq.derived_from` references an own `AoU` | Only AoUs received from another dependable element belong there; own AoUs close root causes via `AoU.root_causes` |
+| Unknown symbol `<fta_package>` when parsing `aous.trlc` | Add the `safety_analysis` target to the `assumptions_of_use` `deps` |
 | Wrong RSL used for trlc validation   | Always pass the tooling RSL as the first directory argument |

bazel/rules/rules_score/README.md

@@ -149,9 +149,10 @@ safety_analysis(
 )
 ```
 
-**`bazel build`** — generates `safety_analysis.rst` (merged FM / Safety Measures / FTA sections),
+**`bazel build`** — generates `safety_analysis.rst` (failure modes with their root causes and measures, fault trees, safety measures),
 runs `lobster-trlc` on TRLC inputs, and extracts FTA events from `.puml`
-diagrams into `fta_events.trlc`. Build-only; traceability validation is done
+diagrams into `fta_events.trlc` (generated `RootCause` records, usable via the
+target's `TrlcProviderInfo`). Build-only; traceability validation is done
 by the wrapping `dependability_analysis` test.
 
 ---

bazel/rules/rules_score/docs/_assets/safety_analysis_doc_pipeline.puml

@@ -57,31 +57,33 @@ package "Tooling defaults (rules_score / ScoreReq)" {
 package "safety_analysis rule actions" {
     component "puml_cli  (FTA mode)\n--fta-output-dir\n[crate: puml_fta]" <<tool>> as puml
     component "safety_analysis_assembler\n[lib: TRLCRST]"                            <<tool>> as asm
-    component "lobster-trlc  x4"                                          <<tool>> as ltrlc
+    component "lobster-trlc  x3"                                          <<tool>> as ltrlc
 }
 
 ' ── Generated files ──────────────────────────────────────────────────────────
 package "Generated files" {
     rectangle "fta_*.puml\n(authored, symlinked)"   <<gen>> as puml_inl
-    rectangle "fta_events.trlc\n(FtaFailureMode/RootCause stubs)" <<gen>> as fta_events
+    rectangle "fta_events.trlc\n(RootCause stubs)" <<gen>> as fta_events
     rectangle "safety_analysis.rst"               <<gen>> as safety_analysis_rst
-    rectangle "failuremodes.lobster\nsafetymeasures.lobster\nfta_failure_modes.lobster\nfta_root_causes.lobster" <<gen>> as fmcm_lob
+    rectangle "failuremodes.lobster\nsafetymeasures.lobster\nfta_root_causes.lobster" <<gen>> as fmcm_lob
 }
 
 ' ── Providers ────────────────────────────────────────────────────────────────
 rectangle "SphinxSourcesInfo\n────────────────\nsrcs:     safety_analysis.rst\ndeps:     safety_analysis.rst\naux_srcs: fta_*.puml" <<prov>> as ssi
-rectangle "AnalysisInfo.lobster_files\n────────────────\nfailuremodes.lobster\nsafetymeasures.lobster\nfta_failure_modes.lobster\nfta_root_causes.lobster" <<prov>> as ai
-rectangle "SafetyAnalysisProviderInfo\n────────────────\nfailuremodes, safetymeasures,\nfta_events, spec" <<prov>> as tpi
+rectangle "AnalysisInfo.lobster_files\n────────────────\nfailuremodes.lobster\nsafetymeasures.lobster\nfta_root_causes.lobster" <<prov>> as ai
+rectangle "TrlcProviderInfo\n────────────────\nreqs: fta_events.trlc, failuremodes\n(safetymeasures excluded: they\nreference fta_events)" <<prov>> as trlcpi
 
 ' ── Downstream rules + staging ───────────────────────────────────────────────
-component "dependability_analysis\n(+ root-cause coverage check)" <<tool>> as da
+component "dependability_analysis" <<tool>> as da
 component "dependable_element"     <<tool>> as de
+component "assumptions_of_use\n(deps = [safety_analysis])" <<tool>> as aou
 rectangle "dependability_analysis/\n  dfa.rst    <- toctree\n  safety_analysis.rst   <- toctree\n  fta_*.puml (.. uml::)" <<stage>> as stage
 
 ' ── Edges: inputs -> tools ───────────────────────────────────────────────────
 fta_puml --> puml : parse macro calls
 
 fta_events --> asm
+fta_puml --> asm : diagram names\n(one .. uml:: each)
 fm_trlc  --> asm
 sm_trlc  --> asm
 rsl      --> asm : import resolution
@@ -104,14 +106,13 @@ ltrlc --> fmcm_lob
 safety_analysis_rst --> ssi
 puml_inl --> ssi
 fmcm_lob --> ai
-fm_trlc    --> tpi
-sm_trlc    --> tpi
-fta_events --> tpi
+fta_events --> trlcpi
+fm_trlc    --> trlcpi
 
 ' ── Edges: providers -> downstream -> staging ────────────────────────────────
 ssi --> da : merge SphinxSourcesInfo
 ai  --> da : merge lobster_files
-tpi --> da : merge for root-cause\ncoverage check
+trlcpi --> aou : resolve AoU.root_causes\n(<fta_package>.<RootCause>)
 da  --> de
 de  --> stage : symlink srcs + aux_srcs\n(aux not indexed in toctree)
 

bazel/rules/rules_score/docs/_assets/safety_analysis_linkage.puml

@@ -0,0 +1,84 @@
+' *******************************************************************************
+' Copyright (c) 2026 Contributors to the Eclipse Foundation
+'
+' See the NOTICE file(s) distributed with this work for additional
+' information regarding copyright ownership.
+'
+' This program and the accompanying materials are made available under the
+' terms of the Apache License Version 2.0 which is available at
+' https://www.apache.org/licenses/LICENSE-2.0
+'
+' SPDX-License-Identifier: Apache-2.0
+' *******************************************************************************
+
+@startuml safety_analysis_linkage
+
+' Record linkage of a dependable element's safety analysis.  Arrows point from
+' the referencing record to the referenced one; the label is the TRLC field.
+
+skinparam ArrowFontSize 10
+skinparam defaultTextAlignment center
+skinparam nodesep 60
+skinparam ranksep 70
+
+skinparam class {
+    BackgroundColor<<authored>> #EFF6FB
+    BorderColor<<authored>>     #0066B1
+    BackgroundColor<<generated>> #FFF3E0
+    BorderColor<<generated>>     #EF6C00
+    BackgroundColor<<received>>  #F3E5F5
+    BorderColor<<received>>      #7B1FA2
+}
+
+package "Other dependable_element (listed in deps)" {
+    class "AoU\n(received)" as RecvAoU <<received>>
+}
+
+package "This dependable_element" {
+    package "Safety analysis" {
+        class FailureMode <<authored>> {
+            interface
+        }
+        class RootCause <<generated>> {
+            title
+            diagram
+            line
+        }
+        class Mitigation <<authored>> {
+            justification
+        }
+        class "AoU\n(own)" as OwnAoU <<authored>>
+    }
+
+    package "Requirements" {
+        class CompReq <<authored>>
+        class FeatReq <<authored>>
+        class AssumedSystemReq <<authored>>
+    }
+}
+
+' ── Generated from the $RootCause macros of the FTA diagrams ────────────────
+RootCause "1..*" --> FailureMode : failure_modes
+
+' ── Safety measures: every RootCause needs at least one ─────────────────────
+Mitigation "1..*" --> RootCause : root_causes\n(+ justification)
+OwnAoU "0..*" --> RootCause : root_causes\n(preventive measure)
+CompReq "0..*" --> RootCause : derived_from\n(control measure)
+
+' ── Requirement chain ───────────────────────────────────────────────────────
+CompReq --> FeatReq : derived_from
+CompReq --> AssumedSystemReq : derived_from
+CompReq --> RecvAoU : derived_from\n(received AoU only)
+FeatReq --> AssumedSystemReq : derived_from
+
+note bottom of RootCause
+  Every RootCause needs at least one incoming
+  Mitigation, own AoU or CompReq.
+end note
+
+note bottom of OwnAoU
+  Own AoUs are never a CompReq
+  derived_from source.
+end note
+
+@enduml

bazel/rules/rules_score/docs/_assets/tooling_chain.puml

@@ -43,7 +43,7 @@ rectangle "sphinx_module" <<rule>> as sphinx
 rectangle "**TRLC**\ntrlc parser + trlc_rst\n(.trlc/.rsl -> .rst; TRLCRST lib)" <<tool>> as trlc
 rectangle "**rst_to_trlc**\n(.rst -> .trlc)" <<own>> as r2t
 rectangle "**PlantUML Parser**\npuml_cli (Rust)\n(.puml -> .fbs.bin + .lobster + .idmap.json)" <<tool>> as puml
-rectangle "**puml_cli** (FTA mode)\ninline metamodel + extract\n(.puml -> inlined .puml +\nfta_events.trlc)" <<own>> as fta
+rectangle "**puml_cli** (FTA mode)\nextract root causes\n(.puml -> fta_events.trlc)" <<own>> as fta
 rectangle "**safety_analysis_assembler**\nTRLCRST page build\n(.trlc + fta_events.trlc -> safety_analysis.rst)" <<own>> as asm
 rectangle "**Lobster**\nlobster-trlc / -report /\n-ci-report / gtest_report" <<tool>> as lob
 rectangle "**Architecture Verifier**\nvalidation_cli\n(arch.json + .fbs.bin)" <<tool>> as verifier
@@ -64,7 +64,7 @@ asm  ..> trlc : TRLCRST lib
 safety_analysis --> lob  : lobster-trlc
 unit --> lob  : gtest_report
 
-da  --> lob   : lobster-report (FM+CM+FTA)
+da  --> lob   : lobster-report (FM+RC)
 de  --> verifier : conformance check
 de  --> lob   : lobster-ci-report (gate)
 de  --> sphinx : assemble docs

bazel/rules/rules_score/docs/_assets/traceability_dataflow.puml

@@ -41,7 +41,7 @@ rectangle "Unit tests\n(cc_test / gtest)" <<src>> as test_in
 rectangle "requirements.lobster" <<lob>> as reqs_lob
 rectangle "public_api.lobster" <<lob>> as api_lob
 rectangle "failuremodes.lobster\nsafetymeasures.lobster" <<lob>> as fmcm_lob
-rectangle "fta_failure_modes.lobster\nfta_root_causes.lobster" <<lob>> as rc_lob
+rectangle "fta_root_causes.lobster" <<lob>> as rc_lob
 rectangle "<unit>.lobster\n(test results)" <<lob>> as test_lob
 
 ' ── Aggregation + gate ────────────────────────────────────────────────────────

bazel/rules/rules_score/docs/overview.rst

@@ -173,7 +173,7 @@ Traceability (test)
 ``bazel test`` runs ``lobster-ci-report`` over the merged requirement /
 architecture / test / safety-analysis graph — assumed-system and feature
 requirements, component requirements, architecture, public API, unit tests,
-failure modes, control measures, root causes, and AoUs — and fails if any item
+failure modes, safety measures, root causes, and AoUs — and fails if any item
 lacks full up/down traceability.
 
 .. graphviz::
@@ -197,12 +197,13 @@ lacks full up/down traceability.
       "Forwarded AoUs" -> "Received AoUs";
       "Component Requirements" -> "Feature Requirements";
       "Component Requirements" -> "Received AoUs";
+      "Component Requirements" -> "Root Causes";
       "Unit Test" -> "Component Requirements";
       "Test Case Coverage" -> "Component Requirements";
       "Architecture" -> "Component Requirements";
       "Failure Modes" -> "Public API";
       "Root Causes" -> "Failure Modes";
-      "Root Causes" -> "Safety Measures";
+      "Safety Measures" -> "Root Causes";
    }
 
 Execution Overview (Current Behavior)

bazel/rules/rules_score/docs/rule_reference.rst

@@ -275,9 +275,10 @@ testable within that component.
 **Generated targets:** ``<name>`` (documentation), ``<name>_test`` (TRLC validation)
 
 A ``CompReq`` record's ``derived_from`` field (``CompReqSourceId``) may also
-reference an AoU that this requirement implements, alongside its usual
+reference an AoU *received* from another dependable element, alongside its usual
 ``FeatReq``/``AssumedSystemReq`` references (e.g. ``[SampleType.SampleAoU@1]``).
-This requires importing the AoU's package and listing the
+The element's own AoUs are never a ``derived_from`` source. This requires
+importing the AoU's package and listing the
 ``assumptions_of_use`` target that defines it directly in this target's
 ``deps`` — see :doc:`user_guide/assumptions_of_use`.
 
@@ -314,7 +315,7 @@ Conditions that the *integrating project* must fulfil when using this SEooC.
    * - ``deps``
      - label list
      - no
-     - Other requirement targets (``TrlcProviderInfo``) needed for cross-reference parsing (default ``[]``)
+     - Other requirement targets (``TrlcProviderInfo``) needed for cross-reference parsing (default ``[]``). List the ``safety_analysis`` target when an ``AoU`` references its generated ``<fta_package>.<RootCause>`` records.
    * - ``ref_package``
      - string
      - no
@@ -574,7 +575,9 @@ documentation target.
      - string
      - no
      - TRLC package name for the generated ``fta_events.trlc`` stub (the
-       ``FtaFailureMode``/``RootCause`` records derived from ``root_causes``).
+       ``RootCause`` records derived from ``root_causes``). The target
+       exports it (plus ``failuremodes``) as ``TrlcProviderInfo``, so other
+       targets such as ``assumptions_of_use`` can list it in ``deps``.
        Defaults to a sanitized form of ``name`` with a ``_fta`` suffix.
    * - ``arch_design``
      - label
@@ -619,10 +622,6 @@ Running ``bazel test`` validates the full FMEA traceability chain.
      - label list
      - no
      - ``safety_analysis`` targets to include in this analysis (default ``[]``)
-   * - ``measures``
-     - label list
-     - no
-     - Additional ``Mitigation``/``AoU``/``CompReq`` ``.trlc`` files not scoped to a single ``safety_analysis`` target, considered for the root-cause-coverage completeness check (default ``[]``)
    * - ``arch_design``
      - label
      - no