# Status and caveats

[The architecture page](https://noelmcloughlin.github.io/ai-linkmo/docs/architecture/#status-and-caveats) gives the short version. This is the full list.

- **This is a demo.** The API, the web UI and the CLI will all be reworked. Treat their shapes as illustrative, not as a contract. The API's current contract is the server's `/openapi.json`, generated from the ontology schema.
- **Keep it on localhost.** The write endpoints are unauthenticated, the web UI's login is a persona picker, and `graph/` is regenerable output that the export commands rewrite in place (the YAML and crosswalk CSVs are committed, the fetched Cypher is not). [The threat model](https://noelmcloughlin.github.io/ai-linkmo/docs/threat-model/#known-limitations-accepted-for-now) lists each limitation and what is planned.
- **Your own data is not in the Cypher export.** The project generates no Cypher. `just fetch-cypher` downloads the artefact ai-atlas-nexus publishes for the installed version, built upstream from the packaged data alone. `--byod` with the Cypher export is refused with a 400, and the [Neo4j walkthrough](https://noelmcloughlin.github.io/ai-linkmo/docs/neo4j/) lists the artefact's known upstream defects.
- **Two encodings are thinner than their type suggests.** `byo/data/eu_ai_act.yaml` is a `RiskTaxonomy` of 308 requirement rows and no risks, so query it as `rule`, not `risk`. `ffiec_it_handbook.yaml` is a `RiskControlGroupTaxonomy` with groups and no controls.
- **No encoding has been checked by a named person against its framework's text.** Each header says which script produced it. The ontology has no field for a reviewer, and there has been none ([what it does not add yet](https://noelmcloughlin.github.io/ai-linkmo/docs/for-the-curious/#what-it-does-not-add-yet-provenance)).
- **Nobody has confirmed a bundle concept yet.** All 44 are *Checked by automation only*, and `ktl-curator` is how a person changes that. The bundle's `base_iri` is also a placeholder. Moving it to a namespace the project controls rewrites every `id`, and has waited for a decision since 2026-08-05.
- **Upstream's data carries 30 known validation findings per database.** `just validate-store` checks every row of the store against the schema and every single-valued reference against the collections, through linkml-store. CI runs the same step and allows exactly those 30, which must only go down. They are two URL-typed fields that hold a name rather than a URI, 24 references to risk-group, model-family and stakeholder-group ids that exist nowhere, and 4 capability references whose target is a different class from the one the slot expects. The `byo/data` files add none of their own. List-valued references, such as `hasRelatedAction`, are not checked by anything yet.
- **Slow paths.** `--mode local` reads the DuckDB store when `just load-store` has built it, about two seconds a call. Without the store it loads the ontology in-process on every call. The local-mode test sweep takes about six minutes either way, because each case starts an interpreter. LLM inferencing needs a vLLM host you run, and ARES needs an upstream pull request ([llm-inferencing.md](https://noelmcloughlin.github.io/ai-linkmo/docs/llm-inferencing/)).