---
type: Playbook
genre: reference
id: https://noelmcloughlin.github.io/ai-linkmo/knowledge/playbooks/knowledge-sources
title: Knowledge sources map
description: "The librarian's scrape map: every repository location and external URL this bundle derives concepts from, and how to re-verify each on a refresh run."
resource: https://github.com/noelmcloughlin/ai-linkmo
generated:
  by: process:ktl-librarian
  at: "2026-10-27T17:57:49Z"
verified:
  - by: process:ktl-librarian
    at: "2026-10-18T00:17:24Z"
---

# Knowledge sources

Bootstrap discovery ran on 2026-07-13, and the first steady-state refresh ran on 2026-07-13 too. Steady-state refresh runs re-verify these sources instead of discovering them again. Update this map whenever the repository's knowledge geography changes.

| Source | Yields | Re-check by |
|--------|--------|-------------|
| `pyproject.toml`, root `README.md`, `docs/architecture.md` | project identity, bundle metadata | diff manifest name and description. The README is a doorway since 2026-10-14 (#62): the architecture page carries the rationale and `docs/install.md` the install steps, rows below |
| `ai`, `ai-risk-ontology-linkmo/src/ai_linkmo/cli.py` | `services/cli` | confirm the command tree is still built from the exposure file; the two modes, `api` the default through `AI_LINKMO_MODE` in `ai`, unchanged |
| `ai-risk-ontology-linkmo/` (`exposure.yaml`, `src/ai_linkmo/atlas.py`, `src/ai_linkmo/hand.py`) and `.copier-answers.linkmo.yml`, `lib/api/` (`server.py`, `handlers.py`, `library.py`, `README.md`), `docs/openapi.json` | `services/fastapi-backend` | re-count the classes under `expose.classes` in `exposure.yaml` (22 on 2026-10-27) and the overlay operations; confirm `AI_LINKMO_BACKEND` and its three values |
| `lib/frontend/` (`package.json`, `vite.config.ts`, `src/lib/entities.json`, `src/lib/constants.ts`, README), `ai-risk-ontology-linkmo/scripts/gen_ui_config.py` | `services/web-ui` | confirm Svelte 5 + Vite SPA, port 5173 proxy to :8000; `entities.json` still written by `just gen-ui-config`; the record form still generated by @sjsf |
| `graph/` (`ai-risk-ontology.yaml`, `cypher/README.md`), `docs/neo4j.md`, `scripts/fetch_cypher.py`, `graph()` in `lib/api/handlers.py` | `services/graph-db`, `datasets/knowledge-graph-export` | confirm the Cypher is still fetched from ai-atlas-nexus at the installed tag and `--byod` still refused on it; re-read the upstream defects list |
| `graph/crosswalk_*.csv` | `datasets/nist-ai-rmf-crosswalks` | re-list `graph/*.csv`; header row = `fields` |
| `byo/data/*.yaml` (9 files) | one `datasets/` concept each | re-list the directory; each file's 3-line AUTOGENERATED header carries format + upstream source |
| `byo/data` file headers + in-file `url:` fields | the 11 `references/` concepts and their canonical URLs | grep `url:` in each data file; URLs must match the Reference's `resource` |
| `byo/olddata/` | mentioned in crosswalks concept only (inactive demo taxonomies) | consciously excluded; promote it to a Dataset if it is reactivated |
| `byo/notes/EXAMPLES.md` | four-access-patterns framing used in service descriptions | re-read on refresh |
| `docs/install.md`, `docs/install-notes.md`, `docs/neo4j.md`, `docs/working-with-the-data.md`, `lib/test/README.md`, `scripts/tests.sh` | `playbooks/install-and-run` | walk the commands against those pages; the concept's `sources` lists them |
| `docs/working-with-the-data.md` §Bring your own data + upstream ai-atlas-nexus util README | `playbooks/bring-your-own-data` | re-read the section; confirm the linkml validate incantation and the schema path under `ai_risk_ontology/schema/` |
| `docs/key-concepts.md` (moved out of the README 2026-09-25; grounded in the entity classes the exposure file exposes and its `byod` parameter) | the eight `glossary/` terms | re-read the table; confirm each term still has a backing class or flag and its example id still exists in the packaged data |
| `docs/architecture.md` §Why governance needs a catalogue + §One model, four ways in (rationale, not mechanics) | `explanations/why-linked-ai-governance` | re-read both sections; the concept carries the *why*, so re-check the argument, not the feature list |
| `docs/architecture.md` §Where this sits + `docs/for-the-curious.md` §Where this sits and §What it does not add yet | `explanations/what-ai-linkmo-adds` | re-read both; confirm the ontology still has no reviewer field and each `byo/data` file still carries one generator `dateCreated` |
| `docs/cli-examples.md`, `lib/test/test_cli_examples.py` | test facts in `services/cli` | recount the test cases; the page, not the README, now lists the commands |
| `lib/store/`, `scripts/load_store.py`, `index_store.py`, `dump_store.py`, `validate_store.py`, `docs/working-with-the-data.md` §Search and dumps | `datasets/record-store` | confirm the recipes in the justfile and the `--allow` ceiling in `cli-tests.yml` |
| `ai-risk-ontology-linkmo/src/ai_linkmo/browse.py`, `ai-risk-ontology-linkmo/scripts/build_browse.py`, `docs/working-with-the-data.md` §Browse the data | `services/datasette-browse` | confirm the two databases, the port and the `browse` extra |
| `https://ibm.github.io/ai-atlas-nexus/` | `references/ai-risk-ontology`, `org/ibm` | external authority; cite it when it changes |
| `https://air-governance-framework.finos.org/` | `references/finos-aigf`, `org/finos` | external authority; cite it when it changes |
| `.github/workflows/` (cli-tests, ui-tests) | test facts inside service concepts, the store's validation ceiling | re-list workflow files |
| `https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm` | the supersession note on `references/sr-11-7` | re-read until the curator settles its open question |

These are not knowledge sources, and are left out on purpose:

- `lib/test/` internals and `.assets/`, the screenshots and logos.
- `.claude/`, `.agents/` and `skills-lock.json`: skill tooling, not project knowledge.
- `lib/frontend/STATUS.md`: transient dev notes.
- The `.lokf/` sidecar itself, including its automation workflows (`.github/workflows/knowledge-*.yaml`) and the sync's pull request template (`.github/PULL_REQUEST_TEMPLATE/knowledge-sync.md`).
- The bundle's website under `website/`, which ktl-website builds from this bundle and the docs.
- Repository plumbing with no claim of its own: `justfile`, whose recipes the rows above name, `uv.lock`, `LICENSE`, `.editorconfig`, `.gitignore`, `.markdownlint-cli2.jsonc`, `lychee.toml`, `.releaserc.json`, `.github/scripts/`, `.github/dependabot.yml`, `.github/ISSUE_TEMPLATE/`, `.github/pull_request_template.md` and `.github/workflows/lint-and-docs.yaml`. That workflow, added 2026-10-26 (#123), lints shell scripts, workflow files and prose rather than stating a fact.
- `llms.txt`, which tells an agent to read this bundle first.

Also excluded, decided 2026-10-14:

- the schema's pages that `just gen-doc` writes to `ai-risk-ontology-linkmo/docs/elements`, which are generated from the AI Risk Ontology, carried by `references/ai-risk-ontology` and never committed;
- the per-class examples from the data that `ai-risk-ontology-linkmo/scripts/gen_examples.py` writes there first;
- the `just gen-openapi` copy, `docs/openapi.json`, beyond its row above.

Also excluded, re-decided 2026-09-25 after the README moved its detail into `docs/`:

- `docs/llm-inferencing.md` and the `/ares` endpoint. They are real and code-backed in `lib/api/handlers.py` and the exposure file, but the OpenAPI-driven architecture in `services/cli` and `services/fastapi-backend` covers them generically, so no concept is made for a single endpoint.
- `docs/for-the-curious.md` §Curate your own open data, §Build Python applications on it and §Research: guidance that re-points to references already captured.
- Both roadmap sections, which name [asago-policy-mapper](https://github.com/asago-ai/asago-policy-mapper) and finos/fluxnova-ai#40 as possible future directions, not code-backed here. Promote them only once an integration is merged.
- `docs/status.md`: its caveats are already carried where they apply. The Cypher and BYOD scope is in the graph concepts, the unauthenticated writes in the install playbook, and the reviewer gap in `explanations/what-ai-linkmo-adds`.
- `docs/releasing.md`, `docs/repository-layout.md`, `CHANGELOG.md`, `CONTRIBUTING.md`, `SECURITY.md`, `docs/threat-model.md`, `AI_COVENANT.md` and `CODE_OF_CONDUCT.md`: the process and governance of the repository, not knowledge of the product. `docs/threat-model.md`, split from `SECURITY.md` on 2026-10-26 (#123), restates the unauthenticated-write-endpoint and persona-picker-login caveats that `playbooks/install-and-run.md` already carries, and adds repository-hardening detail with no product claim of its own.
- `NOTICE`: framework credits, already carried by the `references/` and `org/` concepts.
- The architecture page's §What it looks like examples, covered by `services/cli`.