traceability graph

from pathlib import Path
import opensysml
from toaster.report import format_diagnostics

conn = opensysml.connect(version="v0.9.0")
source = Path("../../models/ch10-cumulative.sysml").read_text()
model = conn.load_from_content(source, strict=False)
assert model.ok, f"Model failed: {format_diagnostics(model.diagnostics)}"

# An allocate naming an undeclared feature fails to load; it can never silently
# stand in for a real allocation link this chapter's own traceability graph follows.
bad_source = """
package Bad {
    action def A;
    part def W { perform action a : A; }
    part w : W;
    allocation badAlloc allocate A::missing to w;
}
"""
bad = conn.load_from_content(bad_source, strict=False)
assert not bad.ok, "Expected failure for an allocation naming an undeclared feature"
print(f"Negative control ok: bad.ok={bad.ok}")

from toaster.render import model_to_dot, render_dot
from IPython.display import SVG

dot = model_to_dot(model, title="Ch10")
out_path = Path("../../figures/ch10-structure.svg")
out_path.parent.mkdir(exist_ok=True)
render_dot(dot, out_path)
SVG(filename=str(out_path))

from toaster.query import ApiIndex, find_requirements

idx = ApiIndex(model)


# Workaround for DEFERRED.md D-038: no structural subjectParameter key on RequirementDefinition.
def requirement_subject(idx, req_def_qn):
    """The (name, type) of req_def_qn's own declared `subject` feature, found by
    reading each of its owned ReferenceUsage features for the literal `subject`
    keyword in its own sysx:sourceText, not assumed from the requirement's name."""
    for e in idx.of_type("ReferenceUsage"):
        qn = e.get("qualifiedName", "")
        if qn.startswith(req_def_qn + "::") and e.get("sysx:sourceText", "").strip().startswith("subject "):
            return e["declaredName"], idx.type_names(qn)[0]
    return None, None


requirements = sorted(r.id for r in find_requirements(model))
for r in requirements:
    req_def = idx.type_names(r)[0]
    subject_name, subject_type = requirement_subject(idx, req_def)
    print(f"{r}: def={req_def}  subject={subject_name} : {subject_type}")

from toaster.query import allocations_for, supertypes_transitively

heatgen_allocations = allocations_for(model, "ToasterDemo::HeatingAssembly::heatGen", inherit=True, index=idx)
heatgen_realizers = supertypes_transitively(model, "ToasterDemo::ResistanceCoil")
print("heatGenerationReq's subject is allocated from:")
for a in heatgen_allocations:
    print(f"  {a}")
print(f"ResistanceCoil (the realizer chosen for HeatGenerator) itself specializes: {heatgen_realizers}")

from toaster.query import specializes_transitively

toaster_allocations = allocations_for(model, "ToasterDemo::Toaster::heating", inherit=True, index=idx)
toaster_candidates_raw = specializes_transitively(model, "ToasterDemo::Toaster")
toaster_candidates = sorted(
    qn for qn in toaster_candidates_raw if idx.by_qn[qn].get("owner", {}).get("@id") == "ToasterDemo"
)
print("timely's subject is allocated from:")
for a in toaster_allocations:
    print(f"  {a}")
print(f"specializes_transitively(Toaster), raw: {sorted(toaster_candidates_raw)}")
print(f"filtered to real, top-level candidates: {toaster_candidates}")

from toaster.query import requirement_coverage

coverage = {c["requirement"]: c for c in requirement_coverage(model, idx)}
for r in requirements:
    print(coverage[r])

def format_allocation(alloc):
    """Render an allocations_for() entry ({id, type, ends}, per find_allocations's
    own docstring) as "name: source.chain -> target (nested in Owner)" -- generated
    from the real query result, not a fresh literal."""
    name = alloc["id"].rsplit("::", 1)[-1]
    source_chain = ".".join(qn.rsplit("::", 1)[-1] for qn in alloc["ends"][0])
    target_qn = alloc["ends"][1][-1]
    target_name = target_qn.rsplit("::", 1)[-1]
    nested_in = target_qn.rsplit("::", 2)[-2]
    return f"{name}: {source_chain} -> {target_name} (nested in {nested_in})"


traceability_graph = [
    {
        "requirement": "ToasterDemo::heatGenerationReq",
        "functional_intent": "heatGen : HeatGenerator (a heat generator rated for at least 600 W)",
        "allocation": format_allocation(heatgen_allocations[0]),
        "realization": "ResistanceCoil (:> HeatGenerator); candidates rated, weak",
        "verification_evidence": (
            f"satisfied_by={coverage['ToasterDemo::heatGenerationReq']['satisfied_by']}, "
            f"failed_by={coverage['ToasterDemo::heatGenerationReq']['failed_by']} "
            "(bidirectional: a real positive claim AND a real negative claim)"
        ),
    },
    {
        "requirement": "ToasterDemo::timely",
        "functional_intent": "toaster : Toaster (a toasting cycle completing in at most 180 s)",
        "allocation": format_allocation(toaster_allocations[0]),
        "realization": "Toaster itself; candidates nominal, slow",
        "verification_evidence": (
            f"satisfied_by={coverage['ToasterDemo::timely']['satisfied_by']} (none), "
            f"failed_by={coverage['ToasterDemo::timely']['failed_by']} "
            "(one-sided: only a negative claim, plus an unbound verify objective)"
        ),
    },
]
for row in traceability_graph:
    print(row["requirement"] + ":")
    for key, value in row.items():
        if key != "requirement":
            print(f"  {key}: {value}")

from toaster.query import requirement_ties, tied_to_any_requirement

delivered_energy_bounded = idx.by_qn["ToasterDemo::deliveredEnergyBoundedBySupply"]

# models/ch10-cumulative.sysml (https://github.com/Open-MBEE/toaster/blob/main/models/ch10-cumulative.sysml) -- the exact file `model` above was loaded from --
# already carries this chapter's own remediation forward (see below): a genuine
# committed fixture, not assembled at runtime. To show honestly what this search
# found BEFORE that remediation, reconstruct that earlier state from `source`
# itself, the same way Ch8-03's own `source.replace(...)` reconstructs a different
# state for its own demonstration, rather than checking a second committed file.
before_marker = "\n    requirement def EnergyConservationReq {"
source_before_remediation = source[:source.index(before_marker)] + "\n}\n"
model_before = conn.load_from_content(source_before_remediation, strict=False)
assert model_before.ok, f"Model failed: {format_diagnostics(model_before.diagnostics)}"
idx_before = ApiIndex(model_before)

ties = requirement_ties(model_before, "ToasterDemo::deliveredEnergyBoundedBySupply", idx_before)
tied_to_a_requirement = tied_to_any_requirement(model_before, "ToasterDemo::deliveredEnergyBoundedBySupply", idx_before)

print(f"deliveredEnergyBoundedBySupply @type: {delivered_energy_bounded['@type']}")
print(f"Satisfy-by-subject or direct-reference-from-a-requirement-body hits, before remediation: {ties}")
print(f"deliveredEnergyBoundedBySupply tied to any requirement, before remediation (by these two narrow checks): {tied_to_a_requirement}")
assert not tied_to_a_requirement

from toaster.tools import resolve_library

requirements_lib_path = resolve_library() / "Systems Library" / "Requirements.sysml"
requirements_lib_text = requirements_lib_path.read_text()
assert "subject subj : Anything[1]" in requirements_lib_text, (
    "expected the base requirement def RequirementCheck to still declare "
    "subject subj : Anything[1] as its own default -- confirm directly, not assumed"
)
print("Confirmed: the base `requirement def RequirementCheck` (Systems Library/Requirements.sysml) "
      "declares `subject subj : Anything[1];` as its own default subject.")

ENERGY_CONSERVATION_REQ_DEF = """\
requirement def EnergyConservationReq {
    doc /* A heat generator shall never deliver more energy than it is supplied:
         * energy conservation, a physical law any real heat generator design
         * must obey, independent of any one proof of it. No subject type is
         * declared here: this requirement's own required constraint never
         * references any subject at all -- it is a closed, already-proved
         * proposition over its own free-standing elements -- so declaring
         * one would commit to an arbitrary, unused type, not state anything
         * real; the subject is left to inherit RequirementCheck's own
         * default, `subject subj : Anything[1]` (Systems
         * Library/Requirements.sysml). Deliberately no `assert satisfy`
         * line either. Confirmed directly, not merely argued: attempting
         * `assert satisfy energyConservationReq by
         * deliveredEnergyBoundedBySupply;` makes model.verify_satisfaction()
         * error identically no matter what is bound as the satisfying
         * feature ("require condition evaluation failed: no value for
         * feature heatGenCheck.efficiency"), not pass -- demonstrated
         * directly as a negative control in notebook 01, and recorded in
         * full in
         * docs/case-studies/2026-09-30-energy-conservation-requirement-tie.md.
         * See AC-C10 (this chapter's own judgment record, notebook 01) for
         * how this requirement's own need was actually identified, and for
         * the honest distinction between a tie and a solver-level proof. */
    require constraint c :> deliveredEnergyBoundedBySupply;
}
requirement energyConservationReq : EnergyConservationReq;"""
print(ENERGY_CONSERVATION_REQ_DEF)

ENERGY_CONSERVATION_SATISFY_ATTEMPTS = {
    "the lemma itself": "deliveredEnergyBoundedBySupply",
    "the lemma's own free-standing usage": "heatGenCheck",
    "an unrelated real candidate": "rated",
}

# Three short inline strings, the same way every other negative control in this
# tutorial is built, each loaded as its own one-off model (not the committed
# fixture, which deliberately omits this line) so the real, current model
# loaded above stays exactly what models/ch10-cumulative.sysml (https://github.com/Open-MBEE/toaster/blob/main/models/ch10-cumulative.sysml) commits.
attempt_models = {}
for label, binding in ENERGY_CONSERVATION_SATISFY_ATTEMPTS.items():
    attempt_line = f"assert satisfy energyConservationReq by {binding};"
    attempt_source = source.rstrip()[:-1] + f"\n    {attempt_line}\n}}\n"
    attempt_model = conn.load_from_content(attempt_source, strict=False)
    assert attempt_model.ok, f"Model failed ({label}): {format_diagnostics(attempt_model.diagnostics)}"
    attempt_models[label] = (binding, attempt_model)
    print(f"{label} ({binding}): {attempt_line}")

for label, (binding, attempt_model) in attempt_models.items():
    attempt_verdicts = attempt_model.verify_satisfaction()
    attempt_verdict = next(
        v for v in attempt_verdicts
        if v.element == f"satisfy energyConservationReq by {binding}"
    )
    status = "holds" if attempt_verdict.holds else "FAILS"
    print(f"  [{status}] {label} ({binding}): {attempt_verdict.element}  ({attempt_verdict.error})")
    assert attempt_verdict.holds is False
    assert "require condition evaluation failed: no value for feature heatGenCheck.efficiency" in attempt_verdict.error

ties_after = requirement_ties(model, "ToasterDemo::deliveredEnergyBoundedBySupply", idx)
tied_after_remediation = tied_to_any_requirement(model, "ToasterDemo::deliveredEnergyBoundedBySupply", idx)

print(f"Satisfy-by-subject or direct-reference-from-a-requirement-body hits, after remediation: {ties_after}")
print(f"deliveredEnergyBoundedBySupply tied to any requirement, after remediation: {tied_after_remediation}")
assert tied_after_remediation
assert len(ties_after) == 1
assert ties_after[0]["requirement"] == "ToasterDemo::EnergyConservationReq"
assert ties_after[0]["field"] == "subsets"

# what is being claimed, and what, specifically, it is about
ac_c10_subject_ref = "ToasterDemo::EnergyConservationReq"
AC_C10_TAG = """\
metadata acC10Tag : ReviewRecordRef about EnergyConservationReq {
    identifier = "AC-C10";
}
"""
TOASTER_INCREMENT = f"{ENERGY_CONSERVATION_REQ_DEF}\n{AC_C10_TAG}"
print(AC_C10_TAG)

from toaster.evidence import ReviewRecord, validate_record, hash_content

ac_c10_claim = (
    "EnergyConservationReq/energyConservationReq's own tie to "
    "deliveredEnergyBoundedBySupply is a spec-legitimate use of SysML v2's own "
    "require-constraint-subsetting idiom (SS7.21.2), and its own general "
    "motivation -- energy conservation, a physical law any real heat generator "
    "design must obey -- is genuine and independent of any one proof of it. But "
    "this requirement's own NEED did not predate Chapter 8's proof: it was "
    "identified retroactively, specifically to close the gap this chapter's own "
    "traceability analysis found, and the tie itself (requirement_ties()'s own "
    "Check-B hit on the DEFINITION) is a structural fact about the model, not a "
    "solver-level proof that this requirement's own formal condition holds for "
    "every value -- that proof is AS-C08's own, cited and not repeated here. "
    "Deliberately absent is any assert-satisfy claim: this requirement's own "
    "required constraint never references its subject, confirmed directly by "
    "the negative control above, so requirement_coverage() correctly reports "
    "covered=False for it -- by design, not as a residual gap of the same kind "
    "as timely's."
)
ac_c10_model_ref = "ToasterDemo::EnergyConservationReq"
print(ac_c10_claim)

ac_c10_scope = (
    "EnergyConservationReq/energyConservationReq and its own require-constraint "
    "subsetting tie to deliveredEnergyBoundedBySupply, as added by this notebook. "
    "Not a claim about deliveredEnergyBoundedBySupply's own proof (AS-C08 already "
    "states that proof's real limits) or about any other requirement in this "
    "model."
)
ac_c10_criteria = (
    "Per SysML v2 formal/2026-03-02 SS7.21.1/SS7.21.2: (a) does the requirement's "
    "own choice to leave its subject undeclared honestly reflect that its "
    "required constraint never references a subject at all, rather than hiding "
    "an arbitrary, unjustified type choice? (b) is the requirement's own need "
    "independently motivated -- a real, antecedent stakeholder concern "
    "(Douglas's own need/rationale/verification anatomy) -- or does its content "
    "trace back only to the evidence it was built to accommodate? (c) does "
    "requirement_coverage()'s own covered=False result for this requirement "
    "honestly reflect a deliberate design choice -- tied by subsetting an "
    "already-proved universal lemma, not by a point check -- rather than "
    "reading as an undiscovered gap of the same kind as timely's?"
)
print(ac_c10_scope)
print(ac_c10_criteria)

ac_c10_premises = [
    "SysML v2.0 formal/2026-03-02 SS7.21.2 explicitly supports "
    "reference-subsetting an existing constraint as a requirement's own "
    "required constraint (`require <name>;` / `require constraint c :> "
    "<name>;`) -- the spec's own intended idiom for reusing an "
    "already-declared constraint, confirmed by reading the spec directly.",
    "SS7.21.1: 'A requirement usage can only be satisfied by an entity that "
    "conforms to the definition of its subject.' The base `requirement def "
    "RequirementCheck` (Systems Library/Requirements.sysml) declares "
    "`subject subj : Anything[1];`, confirmed directly above; "
    "EnergyConservationReq leaves its own subject undeclared, inheriting that "
    "default, since its own required constraint never references a subject "
    "at all. Two different earlier drafts hit two different problems: the "
    "reverted Approach A typed the subject `heatGen : HeatGenerator` but "
    "never added an assert-satisfy line at all, so its own defect (a "
    "declared, unused subject with nothing live bound to it) was found by "
    "direct spec reading, not by any tool diagnostic. A real pilot warning "
    "('Bound features should have conforming types') did fire, but "
    "against a different, separately-built draft's own first commit: "
    "Approach B's own earliest version paired a typed subject with a real "
    "assert-satisfy line binding the lemma against it; that draft's own "
    "author fixed it by dropping the subject two commits later, before "
    "this reconciliation began. This design has no assert-satisfy at all, "
    "so that specific mechanical trigger does not even apply here either "
    "way, but the deeper reason for leaving the subject undeclared stands "
    "regardless -- recorded in full in "
    "docs/case-studies/2026-09-30-energy-conservation-requirement-tie.md.",
    "Direct test, not argument alone (the negative control above): "
    "`assert satisfy energyConservationReq by "
    "deliveredEnergyBoundedBySupply;` makes model.verify_satisfaction() error "
    "identically regardless of its own binding, because this requirement's "
    "own required constraint never references its subject at all -- the "
    "register `satisfy` is built for (a candidate's own values substituted "
    "into a formula that depends on them) is not what this construct offers, "
    "so no `assert satisfy` is given for it.",
    "Douglas's own requirement anatomy (AGENTS.md SS1, Part 4): a need, a "
    "rationale, and a means of verification. This requirement supplies a "
    "real, general rationale (energy conservation) and a real means (the "
    "subsetted, Z3-proved lemma itself), but its own need was identified "
    "only after Chapter 8's proof already existed, in response to this "
    "chapter's own traceability search -- not before it.",
]
ac_c10_assumption_refs = [
    "AS-C08's own residual_uncertainties (Chapter 8): deliveredEnergyBoundedBySupply "
    "is a hand-restated companion lemma, not a solver-checked reference to "
    "HeatGenerator's own efficiencyBounded/deliveredEnergy (D-030, D-031); this "
    "record does not strengthen that proof, only frames how its tie to a "
    "requirement should be read.",
]
print(ac_c10_premises)
print(ac_c10_assumption_refs)

import os
import subprocess

from toaster.tools import resolve_library, resolve_sysmlv2, tool_env

# Shelling out directly rather than toaster.modelcheck's own wrapper: that
# wrapper's own line parser cannot read a verdict line for a constraint that is
# also the subject of an assert satisfy/assert not satisfy declaration at all
# (DEFERRED.md D-029) -- this model already has two such declarations
# (timely, heatGenerationReq), so the wrapper would fail before ever reaching
# this chapter's own construct.
SYSMLV2_BINARY = resolve_sysmlv2()
SYSMLV2_LIB = resolve_library()
os.environ["PATH"] = tool_env()["PATH"]  # the next cell shells out to the CLI too; it finds z3 on PATH

solve_result = subprocess.run(
    [str(SYSMLV2_BINARY), "verify", "../../models/ch10-cumulative.sysml",
     "--lib", str(SYSMLV2_LIB), "--solve"],
    capture_output=True, text=True, timeout=30, env=tool_env(),
)
solve_lines = solve_result.stdout.splitlines()

energy_conservation_lines = [
    line for line in solve_lines
    if "EnergyConservationReq" in line or "energyConservationReq" in line
]
lemma_line = next(line for line in solve_lines if "deliveredEnergyBoundedBySupply (AssertConstraintUsage)" in line)

print(f"Lines mentioning EnergyConservationReq/energyConservationReq: {energy_conservation_lines}")
print(lemma_line)
assert energy_conservation_lines == []
assert "satisfied" in lemma_line

SCRATCH_DIR = Path("companion-check-scratch")
SCRATCH_DIR.mkdir(exist_ok=True)
with_satisfy_source = source.rstrip()[:-1] + (
    "\n    assert satisfy energyConservationReq by deliveredEnergyBoundedBySupply;\n}\n"
)
with_satisfy_path = SCRATCH_DIR / "ch10_with_satisfy.sysml"
with_satisfy_path.write_text(with_satisfy_source)

with_satisfy_result = subprocess.run(
    [str(SYSMLV2_BINARY), "verify", str(with_satisfy_path),
     "--lib", str(SYSMLV2_LIB), "--solve"],
    capture_output=True, text=True, timeout=30,
)
with_satisfy_lines = with_satisfy_result.stdout.splitlines()
with_satisfy_energy_line = next(
    line for line in with_satisfy_lines
    if "EnergyConservationReq" in line or "energyConservationReq" in line
)
print(with_satisfy_energy_line)
assert "undecided" in with_satisfy_energy_line

with_satisfy_path.unlink(missing_ok=True)

ac_c10_evidence_refs = [
    "Systems Library/Requirements.sysml, confirmed directly above: "
    "`subject subj : Anything[1];` is RequirementCheck's own default subject.",
    "model.verify_satisfaction() against assert satisfy energyConservationReq by "
    "<candidate> (the negative control above, three real bindings tested -- the "
    "lemma itself, its own free-standing usage, and an unrelated real "
    "candidate): holds=False, error='require condition evaluation failed: no "
    "value for feature heatGenCheck.efficiency' in every case.",
    f"sysmlv2 verify --solve, real output captured live above: no line at all "
    f"for EnergyConservationReq/energyConservationReq in the current, "
    f"satisfy-less model ({energy_conservation_lines}), only the lemma's own "
    f"already-cited result ({lemma_line.strip()}); confirmed by contrast, also "
    f"run live above, that adding assert satisfy back in makes the solver emit "
    f"a real verdict after all ({with_satisfy_energy_line.strip()}) -- just an "
    f"undecided one, not a satisfied one.",
    "requirement_ties(model, LEMMA, idx)'s own Check-B hit, reproduced above: "
    "exactly one entry, attributed to the DEFINITION (EnergyConservationReq).",
]
ac_c10_rationale = (
    "Three things are true at once here, and none should be softened into the "
    "others. First, energy conservation really is a general physical constraint "
    "on any heat generator, independent of whether Chapter 8 happened to prove "
    "one instance of it, so once stated this way EnergyConservationReq is a "
    "legitimate requirement, and SS7.21.2's own subsetting idiom is a "
    "spec-sanctioned way to state it against an existing constraint. Second, "
    "that legitimacy does not by itself make this requirement's own NEED "
    "independently motivated: it is honest to say the need was not antecedent "
    "-- it exists because this chapter's own traceability analysis found "
    "deliveredEnergyBoundedBySupply tied to nothing, and EnergyConservationReq "
    "was built specifically to close that gap. Third, the tie this requirement "
    "actually has is purely structural -- the subsetting relationship itself, "
    "detected by Check B -- and deliberately NOT reinforced by an assert-satisfy "
    "claim: two separate, direct tests confirm that register would not do real "
    "evaluative work here, run above for real rather than merely argued -- "
    "model.verify_satisfaction() errors outright on all three bindings tested, "
    "and sysmlv2 verify --solve, while it DOES emit a real verdict once "
    "assert satisfy is added back (undecided, not nothing), never resolves it "
    "to satisfied either. requirement_coverage()'s own covered=False for "
    "energyConservationReq is therefore correct and expected, not a residual "
    "gap: there is no assert-satisfy declaration for it to find, by design."
)
print(ac_c10_evidence_refs)
print(ac_c10_rationale)

ac_c10_counterevidence = (
    "This record's own framing could be read as too generous: a requirement "
    "invented after the fact to absorb existing evidence is exactly the shape "
    "Douglas's own traceability concern warns against in reverse -- a "
    "requirement manufactured FROM the evidence rather than one that "
    "independently motivates it. That reading is not wrong; it is why this "
    "record exists rather than a cleaner doc comment alone. What keeps this "
    "from being circular in the way Douglas warns against is narrow: the "
    "underlying physical law (conservation of energy) would be a real "
    "constraint on any heat generator design whether or not Chapter 8 had ever "
    "proved deliveredEnergyBoundedBySupply -- the requirement's own general "
    "content is not invented, only the TIMING of its discovery is retroactive. "
    "A reader who judges retroactive discovery disqualifying regardless of the "
    "underlying law's own independence would reasonably disagree with this "
    "record's own engineering_conclusion. Separately: this tie rests entirely "
    "on a structural check (Check B's subsetting hit), with no solver-level "
    "re-verification of the requirement's own required constraint at all -- "
    "the solver simply does not generate one for a bare subsetting reference "
    "(confirmed above). A reader could reasonably want more than structural "
    "detection before treating a requirement as genuinely tied; this record "
    "does not manufacture an assert-satisfy claim to supply that, because the "
    "one tested above does not hold up (it errors, not passes)."
)
ac_c10_residual_uncertainties = (
    "Whether a future chapter would accept a requirement whose own need was "
    "identified after its own evidence, or whether this tutorial should adopt "
    "a stricter rule requiring every requirement's need to predate its own "
    "evidence, is not settled here -- an open question this record surfaces "
    "rather than resolves. Whether this tie should ever be strengthened beyond "
    "structural subsetting -- a genuinely parametrized, per-candidate check, "
    "rather than a closed, already-proved universal lemma -- is also open, and "
    "would require re-authoring deliveredEnergyBoundedBySupply as an open "
    "template (SS7.21.1's own massLimit idiom) rather than the closed "
    "proposition Chapter 8 deliberately built."
)
print(ac_c10_counterevidence)
print(ac_c10_residual_uncertainties)

from toaster.query import get_review_record_refs

ac_c10 = ReviewRecord(
    identifier="AC-C10",
    kind="asserted_context",
    claim=ac_c10_claim,
    subject_ref=ac_c10_subject_ref,
    model_ref=ac_c10_model_ref,
    content_hash=hash_content(source),
    scope=ac_c10_scope,
    criteria=ac_c10_criteria,
    premises=ac_c10_premises,
    assumption_refs=ac_c10_assumption_refs,
    evidence_refs=ac_c10_evidence_refs,
    rationale=ac_c10_rationale,
    counterevidence=ac_c10_counterevidence,
    residual_uncertainties=ac_c10_residual_uncertainties,
    disposition="pending",
    dependency_freshness="current",
    engineering_conclusion="undetermined",
    record_kind="worked_example",
)

errors = validate_record(ac_c10, model=model)
tag = next((t for t in get_review_record_refs(model) if t["identifier"] == ac_c10.identifier), None)
print(f"Model tag: {tag}")
print(f"Validation errors: {errors}")
assert errors == []