Skip to content
AI-LinkMO

Status and caveats

The architecture page gives the short version. This is the full list.

  • This is a demo. The API, the web UI and the CLI will all be reworked. Treat their shapes as illustrative, not as a contract. The API’s current contract is the server’s /openapi.json, generated from the ontology schema.
  • Keep it on localhost. The write endpoints are unauthenticated, the web UI’s login is a persona picker, and graph/ is regenerable output that the export commands rewrite in place (the YAML and crosswalk CSVs are committed, the fetched Cypher is not). The threat model lists each limitation and what is planned.
  • Your own data is not in the Cypher export. The project generates no Cypher. just fetch-cypher downloads the artefact ai-atlas-nexus publishes for the installed version, built upstream from the packaged data alone. --byod with the Cypher export is refused with a 400, and the Neo4j walkthrough lists the artefact’s known upstream defects.
  • Two encodings are thinner than their type suggests. byo/data/eu_ai_act.yaml is a RiskTaxonomy of 308 requirement rows and no risks, so query it as rule, not risk. ffiec_it_handbook.yaml is a RiskControlGroupTaxonomy with groups and no controls.
  • No encoding has been checked by a named person against its framework’s text. Each header says which script produced it. The ontology has no field for a reviewer, and there has been none (what it does not add yet).
  • Nobody has confirmed a bundle concept yet. All 44 are Checked by automation only, and ktl-curator is how a person changes that. The bundle’s base_iri is also a placeholder. Moving it to a namespace the project controls rewrites every id, and has waited for a decision since 2026-08-05.
  • Upstream’s data carries 30 known validation findings per database. just validate-store checks every row of the store against the schema and every single-valued reference against the collections, through linkml-store. CI runs the same step and allows exactly those 30, which must only go down. They are two URL-typed fields that hold a name rather than a URI, 24 references to risk-group, model-family and stakeholder-group ids that exist nowhere, and 4 capability references whose target is a different class from the one the slot expects. The byo/data files add none of their own. List-valued references, such as hasRelatedAction, are not checked by anything yet.
  • Slow paths. --mode local reads the DuckDB store when just load-store has built it, about two seconds a call. Without the store it loads the ontology in-process on every call. The local-mode test sweep takes about six minutes either way, because each case starts an interpreter. LLM inferencing needs a vLLM host you run, and ARES needs an upstream pull request (llm-inferencing.md).