Arcadia Studio

Arcadia Studio is a native Rust/Iced modeling workbench for system engineers. V2 covers Operational Analysis (OA) and System Analysis (SA), with graphical and textual editing of one typed model and a deployable Rust REST service. It is an independent implementation inspired by Arcadia and Eclipse Capella, not a complete Capella or SysML implementation.

The normative language and editing contract defines supported semantics, both representations, validation and migration. Scope states the boundaries. The acceptance and validation records document the earlier V2 baseline. Current state and the 2026-09-06 coverage audit track subsequent implementation and outstanding release gates; the current first release is not yet accepted.

Build and run

Install stable Rust and your platform's native compiler. The workspace declares Rust 1.90; the recorded development builds use Rust 1.98.1. The standard Windows MSVC path uses Visual Studio Build Tools with Desktop development with C++. Ubuntu/Debian development dependencies are:

sudo apt-get install build-essential pkg-config libxkbcommon-dev libxkbcommon-x11-0 libwayland-dev libvulkan-dev libx11-dev libxrandr-dev libxi-dev

From the repository root:

cargo run --locked -p oa-desktop --bin arcadia-studio

Build both desktop and server release executables:

cargo build --release --workspace --locked

Run target/release/arcadia-studio.exe on Windows or ./target/release/arcadia-studio on Linux. No task-specific cache directory is required. A graphical desktop and compatible graphics driver are required; the application uses Iced 0.14 with WGPU and X11/Wayland support. It does not require Java, Eclipse, a browser, an account or a running server.

An optional Windows path uses the stable-x86_64-pc-windows-gnullvm Rust toolchain with LLVM-MinGW. Put LLVM-MinGW's bin directory on PATH, including clang.exe and llvm-windres.exe, then run:

rustup toolchain install stable-x86_64-pc-windows-gnullvm
$env:CARGO_TARGET_X86_64_PC_WINDOWS_GNULLVM_LINKER = 'clang.exe'
cargo +stable-x86_64-pc-windows-gnullvm build --release --workspace --locked

GNU/gnullvm builds require a resource compiler to embed the normal-user (asInvoker) manifest in executables and tests. The build selects llvm-windres for gnullvm or windres for GNU; set RC to its executable path if it is not on PATH. This avoids Windows treating installer-like test filenames as elevation requests. The current machine uses user-local Rust 1.98.1 and LLVM-MinGW 20260826 UCRT; compilation and test progress are recorded in current state. That evidence is separate from native workflow and release-package acceptance.

On the tested Ubuntu 24.04/WSLg environment, Mesa's Vulkan software adapter is required:

sudo apt-get install mesa-vulkan-drivers
WGPU_BACKEND=vulkan VK_DRIVER_FILES=/usr/share/vulkan/icd.d/lvp_icd.x86_64.json ./target/release/arcadia-studio

A compatible native Linux graphics adapter can use the ordinary command. This software-adapter workaround requires the indicated driver file. See the platform verification record for tested environments.

The earlier V2 package record describes dist/ArcadiaStudio-Windows.zip and dist/ArcadiaStudio-Linux.tar.gz, with archive checksums in dist/SHA256SUMS.txt. Extract a verified bundle and run its arcadia-studio.exe or ./arcadia-studio; Rust is not needed to run a packaged executable. Those bundles include the headless server, examples, specifications and deployment instructions; Linux targets the documented Ubuntu 24.04 runtime. Package verification applies to that recorded revision. Current changes still require fresh packages, checksums and acceptance.

The current Windows packaging instructions stage both executables, verify their runtime DLL dependencies, and produce an archive with checksums and provenance. Native acceptance fixtures and independent expected results are retained in the release fixture directory.

Model operational needs and system responsibilities

The desktop starts at Home, where you can create a model, open a local project, continue recent files or recover retained work. Missing recent files stay visible with Locate; Remove only forgets their history entry. Choose Explore rescue example for a model combining people, an organization, a System of Interest, information and physical exchange items, normal/degraded behavior and code/CAD evidence.

The example opens in an architecture view with work nested inside its performers. Each layer also has dedicated functional dataflow and mission/capability views. Regenerate both example formats with matching identities using cargo run --locked -p oa-core --example generate_demo; the command verifies both saved models. Historical migration fixtures remain separate.

1. In Operational Analysis, create entities, actors, activities and capabilities. Use In selected for semantic decomposition and Allocated for new leaf work performed by a participant. Activities can decompose independently of their performer; roles capture shared operational responsibility. Communication means connects operational Entities or Actors directly, with direction and carried items; Exchange allocation associates the Interactions it carries. Operational communication requires no system ports.
2. Switch to System Analysis. Define one System of Interest and external Actors, then functions, missions, capabilities and functional chains. The system boundary has no internal LA/PA components in this version.
3. Select a System or System Actor and choose Add port in the browser or Properties. Choose Standard or Flow, then Create port. Use Boundary exchange in the diagram palette, or Draw boundary exchange on a selected visible source port, to connect compatible component ports directly. Create the other participant's matching port first if none exists. Functions expose separate input/output port actions; the Functional exchange palette tool connects them. Actions exposes other engineering relationships and off-diagram configuration; Data & interfaces holds reusable payloads and contracts.
4. Create focused views. Containment nests semantic children; Architecture · allocated work nests work within performers; Functional dataflow shows work decomposition and exchanges; Missions & capabilities shows objectives and participation. Dashed, italic parent work denotes an allocation summary inferred from its leaves. Ports appear on their owner's boundary. View properties stages saved line-kind, category, behavior-coverage, context, label and individual-hide choices. Right-click empty diagram space for Duplicate view, retaining the same semantic records in an independent presentation. Placement Hide removes a placement; line hiding retains its relationship; Delete from model removes semantics and dependent references.
5. In Behavior & scenarios, author processes/chains, scenario lifelines and ordered occurrences, including repeated uses of the same exchange and explicit fragments/branches. Select a State machine and choose Create diagram to place its existing regions and states/modes in a saved view. State machines also support availability and state-action links. Conditions are descriptive, not executable simulation code. Behavior and Data authoring preserve your other diagram layouts.
6. Select an OA or SA element and choose Create / update counterpart. Review dependency scope and counterpart choices, then apply one undoable transaction. For an existing trace, Review semantics… compares typed content and prior observations, with explicit keep, take or final-value decisions for supported structural, scalar, constructor, individual-row and ordered-collection changes. Open additional trace rows and choose Include this row to combine reviewed source contributions into one validated Apply/Undo transaction; conflicting decisions require resolution. Review does not automatically synchronize the perspectives. Attachments reviews an existing child’s parent or a relationship endpoint. Artifact links reviews metadata, owner moves, explicit source-absence deletion and creation of a reserved counterpart after all introduced metadata is reviewed. These controls have automated coverage; their native acceptance remains pending. Manual traces link other engineering correspondences. Traceability also edits artifact URI, revision and fragment metadata.
7. Review Model checks, then save .arcadia source or .json. Warnings allow incomplete authoring; structural errors preserve the committed model and rejected draft.

Model explorer groups roots by engineering purpose and opens one container's direct children. Breadcrumbs navigate ownership; Allocated work is listed separately. Search names, kinds or @aliases to find elements with ancestor context. Results are paged in groups of 100. Collapse all folds the outline; Locate clears the filter and reveals the selected element's ancestry.

Data & interfaces separates exchange nature from mechanism, supports bounded reusable types and typed defaults, and gives each interface item allocation its own protocol and artifact identity. Operation parameters have provider-side directions; qualified message paths distinguish repeated Record uses. Record/item/interface specialization preserves inherited identities. See the data contract for exact semantics and compatibility.

The inspector exposes typed properties, references, ordered lists, aliases and UUID identity. Applying or navigating away attempts to commit the draft; invalid values remain editable. Escaped strings (advanced) uses quoted JSON escapes for exact tabs, line breaks and carriage returns, for example "First\nSecond". UUID changes atomically update dependent references. Accepted model/source history retains up to 100 edits within an estimated 32 MiB history budget.

Choose Interaction, Communication means, Functional exchange or Boundary exchange in the diagram palette, then click the source and a highlighted compatible target, or drag between them. Communication means use OA participants directly. Functional exchanges use output/input ports; function cards create or reuse real ports atomically. Boundary exchanges use compatible component ports. Middle-button drag pans without losing the chosen source; arrow keys also pan while drawing with the canvas focused. Click empty space to restart, or Escape to cancel. Each completed connection is one model/source history operation; edit its name and carried items in Properties.

Create named Exchange categories at the perspective root to group Work exchanges or Participant exchanges. In View properties, each family defaults to All, including uncategorized exchanges. Selected categories combine by union; an explicit empty selection shows none of that family. Coverage and selected process/chain/scenario contexts intersect with category choices. Explicit hides survive changes to categories and labels. These settings change the saved presentation, not model relationships or node geometry. The native record covers the source-6 batch crash-recovery/Apply/Undo/Redo flow and a scoped forty-exchange view, including filtering, duplication, hiding and reopening. Communication authoring, remaining view combinations and latest attachment/artifact native acceptance remain pending.

In Select / move, drag cards on a 10-unit grid, drag empty space to pan, and scroll to zoom. Drag ports along their owner's border or onto any of its four sides. Automatic sides account for direction and visible connections. Manual positions are per diagram and remain relative to the owner through movement or resize; right-click Reset automatic position restores automatic placement. Arrange changes the current view layout; Fit frames its projected bounds. SVG exports the current architecture diagram as a view, not an editable model file.

Connections start with orthogonal routes that avoid cards and container headers. In Select mode, select a connection and drag a segment to add a bend, or right-click for Add bend here. Drag its circles to adjust the route; the menu offers Remove bend and Reset routing. With the canvas focused, Insert adds a bend and Delete removes the selected bend. Shift+F10 opens the selected item's menu; Actions in Properties provides the same commands. Drag the connection label independently. Each completed gesture is one undoable edit; Escape cancels a drag. Routes belong to the current diagram and persist in source, JSON, REST and SVG export. Folding an endpoint container temporarily uses an automatic route; expanding it restores your authored route. Dense diagrams can still need manual adjustment; automatic routing is bounded and does not guarantee an overlap-free result.

For state diagrams, use + Region inside a highlighted machine or State/Mode, then choose + State / symbol and click its owning region. Transition supports dragging between compatible vertices or clicking the source and then the target. Select a drawn transition and drag its endpoint handle, or right-click Reconnect source/target. Right-click a state or the background for New transition with details… to create Local, Internal or timed transitions; an existing transition's Edit transition form edits its kind, triggers, guard and effects. EntryPoint outgoing transitions use Local.

In the state view, Select / move drags vertices and containers without reparenting; container movement includes its descendants. Middle-button drag pans, scroll or −/+ zooms, and Fit frames the view. Right-click for Fold contents, Unfold contents, Placement properties, or Hide from this diagram. The Show an element not yet in this view… selector restores missing placements. Escape cancels a gesture; Undo restores a completed edit. + View creates an independent layout. The persisted diagram's machine reference and placements are the same records in source, JSON and REST; opening the page alone creates no diagram.

Edit the same model as text

Textual model has a source-file folder tree, per-file drafts, syntax highlighting, live linting and explicit Apply all. Collapse/Locate navigate the hierarchy; collapsed folders retain draft and diagnostic indicators. Right-click a file for contextual actions. Projects can use relative includes to organize source into files. For example:

arcadia 7;
project harbor "Harbor assistance" {
    oa_entity control "Harbor control" {}
    oa_activity respond "Respond to requests" {
        oa_activity assess "Assess assistance" {}
    }
    allocation performs "Performs" { source @control; target @assess; }
    sa_system service "Harbor assistance system" {}
    sa_actor operator "Harbor operator" {
        sa_port radio "Radio" {
            contract { Component { kind Standard; orientation Unset; }; };
        }
    }
    sa_function evaluate "Evaluate assistance request" {}
    trace assessment_trace "Operational realization" {
        oa @assess; sa @evaluate; kind Refinement;
    }
}

New declarations may omit IDs; Apply inserts assigned UUIDs into their source. Keep existing identity clauses to preserve objects. Stable @aliases survive display-name changes and support forward references. The normative specification covers every supported declaration, typed constructor, relationship and persisted diagram field.

Nested elements inherit their enclosing element as semantic parent. Allocation remains an explicit relationship: nesting a function inside a System would confuse containment with responsibility and is rejected. An explicit parent on a nested declaration must agree with its enclosing owner. Flat declarations with parent @alias remain supported. Open the six-file source project for a complete OA/SA example with typed ports, matching functional and boundary exchanges, allocations and saved views.

Applying valid source commits the reachable source bundle as one model transaction. Graphical edits update the owning declarations while preserving unaffected formatting and comments. Invalid source remains in its file buffer with located diagnostics, including while another file is open. Undo text and Undo model are distinct: model Undo/Redo restores the accepted model and its exact source documents together. JSON export carries model semantics; comments and source-file organization belong to the source project. Version 1 source/JSON is migrated explicitly without inventing SA content.

Reparenting a nested element through Properties moves its declaration, descendants and attached comments to the new owner's body, including across files. Existing flat declarations retain their file organization. New children appear inside their owner's source body. Separate general file or group notes from the next declaration with a blank line to keep those notes in place when it moves.

Save and reopen

Ctrl+S saves to the current local or hosted destination, Ctrl+Shift+S opens Save as, and Ctrl+O opens a local file. An .arcadia suffix selects text; other suffixes select JSON. Opening detects content rather than relying on the filename. Windows uses native dialogs; Linux uses a path-entry dialog with overwrite confirmation and no portal requirement.

Save all validates a snapshot and saves the source bundle, comparing previously read dependency bytes to reject detected external changes. Each file is replaced atomically; a staged transaction journal allows explicit recovery of interrupted multi-file saves. This is not an atomic multi-file filesystem operation or distributed locking. If recovery is needed, Recover interrupted save appears in Textual model. Dirty New/Open/Close operations offer save/discard/cancel. Share or commit the entry file and all included source files together.

While work is unsaved, the desktop attempts a private recovery checkpoint every 10 seconds. It retains the accepted source bundle, raw source buffers, supported pending property/behavior forms and workflow drafts, including rejected input and semantic-review choices. Home → Recover opens an unsaved copy with no local or hosted save destination; use Save as to choose one. Undo/redo history is not restored. Checkpoints never write model files or save to the server, and credentials are excluded. A failed checkpoint is reported on Home; recent edits since the last completed checkpoint may be unavailable after a crash. Local history and checkpoints live under %LOCALAPPDATA%/ArcadiaStudio on Windows or $XDG_DATA_HOME/arcadia-studio (otherwise ~/.local/share/arcadia-studio) on Linux. Explicit saves and version control remain the durable record.

The current Windows native record verifies scoped Home/recents workflows and forced-stop recovery of raw invalid source, invalid UUID properties, a pending timed transition, keyed semantic choices and a retained rejected order draft. Accepted repairs were saved and compared with independent source oracles, including exact Undo/Redo cases. It also records the older binary's transient journal-publication failure; the bounded fix has automated evidence in the journal review and awaits new-binary native verification. Subsequent source-6 batch recovery and exact Apply/Save/Undo/Redo comparisons are recorded there too. These results do not accept all recovery variants, latest attachment/artifact workflows, Linux or the complete release.

REST service and external tools

Run the server without GUI dependencies:

cargo run --locked -p oa-server --bin arcadia-server

The default is 127.0.0.1:8787, with a platform-local data directory. --data-dir PATH, --bind IP:PORT and --token-file PATH configure deployment; binding outside loopback requires a bearer token. See server setup, the REST contract, OpenAPI and deployment examples.

The API queries and edits complete models, canonical source, multi-file source projects, elements, relationships, artifacts and traces. Transactions and transition previews use the same core validation and source writer as the desktop. Writes require the returned ETag in If-Match. One revision protects the accepted model and source bundle together, including comment-only edits. The server retains the current revision only.

Use Hosted models... in the desktop top bar to connect, Publish as new to upload the current authored source project, or select a catalog entry and choose Open selected. Diagrams, properties and text share the same local editing history. Save to server / Ctrl+S explicitly sends valid changes; invalid drafts and failed writes retain your work. A revision conflict preserves local work and checks the server for review, with read-only source files and an explicit, undoable Reload server version. Save as local... switches back to a local destination after successfully saving an .arcadia source project; JSON export keeps the hosted destination. See the hosted desktop walkthrough for conflict recovery and connection setup.

The desktop keeps bearer credentials in memory and accepts HTTPS, with HTTP allowed only on localhost/loopback. Hosted editing does not require a cloud account and does not provide automatic synchronization or merges.

Scripts can also import a complete JSON model or standalone canonical source through the model interchange endpoint:

curl --fail-with-body -X POST http://127.0.0.1:8787/api/v1/projects/import \
  -H 'Content-Type: application/json' --data-binary @system.json

The response supplies the service resource_id and ETag. Refresh the desktop catalog to open that resource; after API changes to an open model, use Check server to review them. Alternatively, export /api/v1/projects/<resource-id>/source to a new .arcadia file for local interchange. This preserves model UUIDs, aliases, diagrams, traces and artifact metadata. Importing creates a separate hosted resource. Artifact URIs and revisions are opaque references for code, CAD, schematics, documents and other evidence; the application does not fetch or execute them.

To preserve authored files and comments, use POST /api/v1/projects/import-source-project with a JSON bundle containing entry and a files map of relative paths to source strings. GET and conditional PUT /api/v1/projects/<resource-id>/source-project exchange that complete accepted bundle. Include resolution uses only the submitted files; the server never opens the client's disk paths. See the REST contract for payloads, located diagnostics and admission limits.

Development

Source7 integration adds caller-qualified reusable-process links and explicit interface-operation identity. Its contract decision and current state distinguish prepared code from tested behavior. Current OpenAPI validation passes72structural fixtures across204schemas; source7 core, desktop, HTTP, recovery and native acceptance remain separate gates. Earlier source6 Windows and Linux results retain their exact recorded revision scope. Final full suites, strict checks, optimized/MSRV builds and current release packages are still required.

cargo fmt --all -- --check
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo test --workspace --locked
cargo build --release --workspace --locked

• crates/oa-core: typed model, semantics, commands/history, references, projections, transition planner, language and persistence.
• crates/oa-desktop: Iced state/drafts, typed forms, architecture/behavior views, source highlighting and file workflows.
• crates/oa-server: REST transport, conditional writes, bounded queries and atomic local store.

The architecture guide explains extension boundaries. Windows/Linux CI is configured; remote CI was not run in this environment. LA/PA, simulation, native Capella interchange, complete SysML/Capella conformance, semantic merge tooling and production-scale collaboration remain outside this prototype.