Knowledge sources map

Knowledge sources

Bootstrap discovery ran on 2026-07-13, and the first steady-state refresh ran on 2026-07-13 too. Steady-state refresh runs re-verify these sources instead of discovering them again. Update this map whenever the repository’s knowledge geography changes.

Source	Yields	Re-check by
pyproject.toml, root README.md, docs/architecture.md	project identity, bundle metadata	diff manifest name and description. The README is a doorway since 2026-10-14 (#62): the architecture page carries the rationale and docs/install.md the install steps, rows below
ai, ai-risk-ontology-linkmo/src/ai_linkmo/cli.py	services/cli	confirm the command tree is still built from the exposure file; the two modes, api the default through AI_LINKMO_MODE in ai, unchanged
ai-risk-ontology-linkmo/ (exposure.yaml, src/ai_linkmo/atlas.py, src/ai_linkmo/hand.py) and .copier-answers.linkmo.yml, lib/api/ (server.py, handlers.py, library.py, README.md), docs/openapi.json	services/fastapi-backend	re-count the classes under expose.classes in exposure.yaml (22 on 2026-10-27) and the overlay operations; confirm AI_LINKMO_BACKEND and its three values
lib/frontend/ (package.json, vite.config.ts, src/lib/entities.json, src/lib/constants.ts, README), ai-risk-ontology-linkmo/scripts/gen_ui_config.py	services/web-ui	confirm Svelte 5 + Vite SPA, port 5173 proxy to :8000; entities.json still written by just gen-ui-config; the record form still generated by @sjsf
graph/ (ai-risk-ontology.yaml, cypher/README.md), docs/neo4j.md, scripts/fetch_cypher.py, graph() in lib/api/handlers.py	services/graph-db, datasets/knowledge-graph-export	confirm the Cypher is still fetched from ai-atlas-nexus at the installed tag and --byod still refused on it; re-read the upstream defects list
graph/crosswalk_*.csv	datasets/nist-ai-rmf-crosswalks	re-list graph/*.csv; header row = fields
byo/data/*.yaml (9 files)	one datasets/ concept each	re-list the directory; each file’s 3-line AUTOGENERATED header carries format + upstream source
byo/data file headers + in-file url: fields	the 11 references/ concepts and their canonical URLs	grep url: in each data file; URLs must match the Reference’s resource
byo/olddata/	mentioned in crosswalks concept only (inactive demo taxonomies)	consciously excluded; promote it to a Dataset if it is reactivated
byo/notes/EXAMPLES.md	four-access-patterns framing used in service descriptions	re-read on refresh
docs/install.md, docs/install-notes.md, docs/neo4j.md, docs/working-with-the-data.md, lib/test/README.md, scripts/tests.sh	playbooks/install-and-run	walk the commands against those pages; the concept’s sources lists them
docs/working-with-the-data.md §Bring your own data + upstream ai-atlas-nexus util README	playbooks/bring-your-own-data	re-read the section; confirm the linkml validate incantation and the schema path under ai_risk_ontology/schema/
docs/key-concepts.md (moved out of the README 2026-09-25; grounded in the entity classes the exposure file exposes and its byod parameter)	the eight glossary/ terms	re-read the table; confirm each term still has a backing class or flag and its example id still exists in the packaged data
docs/architecture.md §Why governance needs a catalogue + §One model, four ways in (rationale, not mechanics)	explanations/why-linked-ai-governance	re-read both sections; the concept carries the why, so re-check the argument, not the feature list
docs/architecture.md §Where this sits + docs/for-the-curious.md §Where this sits and §What it does not add yet	explanations/what-ai-linkmo-adds	re-read both; confirm the ontology still has no reviewer field and each byo/data file still carries one generator dateCreated
docs/cli-examples.md, lib/test/test_cli_examples.py	test facts in services/cli	recount the test cases; the page, not the README, now lists the commands
lib/store/, scripts/load_store.py, index_store.py, dump_store.py, validate_store.py, docs/working-with-the-data.md §Search and dumps	datasets/record-store	confirm the recipes in the justfile and the --allow ceiling in cli-tests.yml
ai-risk-ontology-linkmo/src/ai_linkmo/browse.py, ai-risk-ontology-linkmo/scripts/build_browse.py, docs/working-with-the-data.md §Browse the data	services/datasette-browse	confirm the two databases, the port and the browse extra
https://ibm.github.io/ai-atlas-nexus/	references/ai-risk-ontology, org/ibm	external authority; cite it when it changes
https://air-governance-framework.finos.org/	references/finos-aigf, org/finos	external authority; cite it when it changes
.github/workflows/ (cli-tests, ui-tests)	test facts inside service concepts, the store’s validation ceiling	re-list workflow files
https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm	the supersession note on references/sr-11-7	re-read until the curator settles its open question

These are not knowledge sources, and are left out on purpose:

• lib/test/ internals and .assets/, the screenshots and logos.
• .claude/, .agents/ and skills-lock.json: skill tooling, not project knowledge.
• lib/frontend/STATUS.md: transient dev notes.
• The .lokf/ sidecar itself, including its automation workflows (.github/workflows/knowledge-*.yaml) and the sync’s pull request template (.github/PULL_REQUEST_TEMPLATE/knowledge-sync.md).
• The bundle’s website under website/, which ktl-website builds from this bundle and the docs.
• Repository plumbing with no claim of its own: justfile, whose recipes the rows above name, uv.lock, LICENSE, .editorconfig, .gitignore, .markdownlint-cli2.jsonc, lychee.toml, .releaserc.json, .github/scripts/, .github/dependabot.yml, .github/ISSUE_TEMPLATE/, .github/pull_request_template.md and .github/workflows/lint-and-docs.yaml. That workflow, added 2026-10-26 (#123), lints shell scripts, workflow files and prose rather than stating a fact.
• llms.txt, which tells an agent to read this bundle first.

Also excluded, decided 2026-10-14:

• the schema’s pages that just gen-doc writes to ai-risk-ontology-linkmo/docs/elements, which are generated from the AI Risk Ontology, carried by references/ai-risk-ontology and never committed;
• the per-class examples from the data that ai-risk-ontology-linkmo/scripts/gen_examples.py writes there first;
• the just gen-openapi copy, docs/openapi.json, beyond its row above.

Also excluded, re-decided 2026-09-25 after the README moved its detail into docs/:

• docs/llm-inferencing.md and the /ares endpoint. They are real and code-backed in lib/api/handlers.py and the exposure file, but the OpenAPI-driven architecture in services/cli and services/fastapi-backend covers them generically, so no concept is made for a single endpoint.
• docs/for-the-curious.md §Curate your own open data, §Build Python applications on it and §Research: guidance that re-points to references already captured.
• Both roadmap sections, which name asago-policy-mapper and finos/fluxnova-ai#40 as possible future directions, not code-backed here. Promote them only once an integration is merged.
• docs/status.md: its caveats are already carried where they apply. The Cypher and BYOD scope is in the graph concepts, the unauthenticated writes in the install playbook, and the reviewer gap in explanations/what-ai-linkmo-adds.
• docs/releasing.md, docs/repository-layout.md, CHANGELOG.md, CONTRIBUTING.md, SECURITY.md, docs/threat-model.md, AI_COVENANT.md and CODE_OF_CONDUCT.md: the process and governance of the repository, not knowledge of the product. docs/threat-model.md, split from SECURITY.md on 2026-10-26 (#123), restates the unauthenticated-write-endpoint and persona-picker-login caveats that playbooks/install-and-run.md already carries, and adds repository-hardening detail with no product claim of its own.
• NOTICE: framework credits, already carried by the references/ and org/ concepts.
• The architecture page’s §What it looks like examples, covered by services/cli.