I’m building an open-source project called Dependency Risk Graph and would appreciate feedback on the RDF model from people with more semantic-web experience.

The project imports CycloneDX SBOMs, models application dependency trees in Apache Jena/TDB2, enriches package versions with OSV vulnerability data, and uses SPARQL to answer questions such as:

• Is an application affected by a particular CVE?
• Is the vulnerable dependency direct or transitive?
• What dependency path introduces it?
• Which applications share the affected package?
• Which fixed versions are reported?

A simplified view of the model is:

Application
  → activeImport
Import

Import
  → rootOccurrence
DependencyOccurrence

DependencyOccurrence
  → belongsToImport
Import

DependencyOccurrence
  → instanceOf
PackageVersion

DependencyOccurrence
  → dependsOn
DependencyOccurrence

PackageVersion
  → affectedBy
Vulnerability

Vulnerability
  → affectedPackage
AffectedPackage
    → versionRange
VersionRange
    → event
introduced / fixed / lastAffected

I deliberately distinguish a package-version identity from its occurrence inside a particular imported SBOM. This allows the same Maven package version to be shared as an identity while preserving different dependency paths across applications and imports.

I also currently use a single/default Jena graph. Application and import boundaries are represented explicitly through resources and properties rather than RDF named graphs.

Some areas where I would value criticism:

1. Package identity versus occurrence Is separating PackageVersion from DependencyOccurrence a reasonable way to preserve both global package identity and application-specific dependency paths?
2. Import provenance Would modelling imports with a lightweight custom vocabulary be sufficient, or would aligning parts of this with PROV-O provide meaningful benefits?
3. OSV version ranges I currently represent affected packages, ranges and range events as first-class resources. Is there an established RDF vocabulary that would be better to reuse for introduced, fixed and last-affected version events?
4. SHACL boundaries Which invariants would you validate first? Current candidates include:
   • every occurrence belongs to exactly one import;
   • every occurrence resolves to exactly one package version;
   • dependency edges remain within the same import;
   • every active import has one root occurrence;
   • vulnerability range events contain a recognised event type and version.
5. Natural-language access The next step is intentionally limited: route a few predefined security questions to deterministic SPARQL/path operations, rather than allowing an LLM to generate arbitrary SPARQL.

I’m not trying to create a complete software-supply-chain ontology yet. The immediate goal is a small, explainable model that preserves dependency paths and produces evidence-backed security answers.

Repository: Github

Any feedback/suggestion on the modelling choices, existing vocabularies I may have missed, or problematic assumptions would be genuinely useful.

Current result: the RDF graph preserves application-specific transitive dependency paths while allowing vulnerable packages and vulnerability resources to be shared across imported SBOMs. This view shows three applications reaching CVE-2024-6763 through different Jetty dependency paths, together with the affected package versions, advisory details, and a reported fixed version.

So far, separating dependency occurrences from package-version identity has been useful. The same package can appear in different application paths without merging those paths, while vulnerability and remediation information remains attached to the shared package identity.

I've noticed that discussions around AI protocols are becoming fragmented.

Every announcement seems to solve one concern:

discovery,

semantic representation,

context,

execution.

I sketched an architecture- curious whether this separation makes sense or where you'd place things differently. see https://donhaji.github.io/opengeo/

I personally like using UML diagrams to depict my ontology work, so I made an easy to use OWL to UML service OWL → UML

Hi,

For anyone working with trying to get their legacy data into AI agents/LLMs, it's become clear that legacy data (mostly relational) is set up to be computer conforming (i.e., non-semantic UIDs/GUId, attributes, Primary Keys, Foreign Keys, etc.). For example, a UID might be "00125564" or a table attribute might be "CTR" and it's not clear to AI if this means Customer, Center, Counter, etc. AI, on the other hand, works much better from Natural Language, which begs the problem of: "How do we make non-semantic legacy data more semantic for better AI consumption and use.

So, for example:

• Non-semantic UIDs/GUIDs like "00533455" need to be turned into something meaningful like "Person: Jane Doe; Tax ID: 1234567"
• Table attributes (i.e., column names) like "CTR" need to be made clear so that AI knows if CTR means Customer, Center, Counter, Country.
• Foreign keys that are numeric (e.g., "12323492834799") need to be semantically mapped to data objects/instances like "Person: Jane Doe; Tax ID: 1234567", above.
• And all the above (and more) needs to be wrapped in meaningful contexts like Ontologies and Instance Document Objects that can be read by AI in a manner that is similar to natural language documents.
• Then there's managing change and drift.

It's been VERY difficult to find actual details on how to do this. What you'll find is a lot of discussion about "there needs to be a semantic layer" over your legacy data but very few sources dig in and tell you exactly what this means or exactly what you need to do to help establish such a layer.

As part of my research, I've been digging for details, collecting them, testing them, and trying to document and them publicly for vetting and reuse. The table I've created below tries to highlight key steps for doing such work. — Some are planning & design steps, some are implementation & validation steps, and some are governance and operating steps.

I'd love productive feedback to help improve all this.

Thanks to anyone willing to help.

I did it: I built a formal language for relations, effects, drift, and correction

So here is the thing, I have been focusing on the scraping, crawling, checking RSS feeds for new articles, etc., etc.

I am finally done with the Data Ingestion part. Hurrah? no.

The classification of data is even MORE difficult than scraping.

I want to be able to produce the Knowledge Graph of the Data to help me with the deduplication and classification.
Please help me out with this.

I have tried REBEL by hugging face but its failing badly, I am losing precious information (more than 80% of it.), I feel these machine learning models are too general, which makes it difficult to make the knowledge graph of these press releases.

Please help me out, tell me a path, name a framework, idk just guide me please. Ik I can do it if I have a path. I am trying and constantly brainstorming with my peers, Hopefully you guys could help me out as well.

Hi everyone,

I'm a PhD researcher working on dialogue systems for extending knowledge graphs and ontological schemas, and I'm currently running a short survey as part of my research.
 I'm looking for input from people with hands-on experience in ontologies, knowledge graphs, or ontology engineering (your perspective would be incredibly valuable).
 

A few quick facts:

• ⏱️ Takes about 15 minutes
• 🕶️ Fully anonymous
• 🌍 Survey is in English
• 🎯 Focus: assistant/dialogue systems and their use in ontology management processes  

If this sounds relevant to you (or someone you know), I'd really appreciate your participation and feel free to share it with colleagues who might be interested too!

link to survey:
https://websites.fraunhofer.de/intelligent-surveys/index.php?r=survey/index&sid=347997&lang=en
 

Thanks so much in advance 🙏

You need your own AI agent, but it works really well across many domains. It's based on BFO. Check it out: https://axiomreason.com/

Body: Working on KG-backed retrieval and keep hitting the same thing: an edge is structurally present so a traversal follows it, but it is the wrong kind of edge for the question. A code graph follows a CO_CHANGES edge as if it were IMPORTS and the answer is confidently wrong. An agent graph lets a CritiqueAgent delegate back to a ResearchAgent, which should never happen.

SHACL / SPARQL constraints validate the graph as a whole, after the fact. What I wanted was a check at traversal time: before each hop, is this edge type valid between these two node types, per a declared ontology? Basically a linter for graph walks.

I built a small layer that does exactly this (declare the ontology in YAML, is_valid_edge(domain, src_type, relation, dst_type) raises before the bad hop) and an offline notebook demo. Before I over-build it:

• Is per-hop validation the right layer, or should this live in the query engine?
• How are you handling this today, manually, with SHACL post-hoc, or just eating the bad answers?

(Link to the repo + the ontology notebook in a comment.)

I have just started learning about Palantir Ontology. Please give me some suggestions on how to learn it.

Hello, what is the standard/preferred way of converting TTL files to websites. We are storing our TTL files in a git repository and would like to share them inside our organization a human readable way. I tried to experiment with pylode and widoco, but while both of them can render a single TTL file into a HTML, I did not find a solution how we could handle also references across ontology files, also how to embed those HTML files inside a proper website. What are the preferred solutions to share ontologies in a bigger organization? Our devs suggest the integration into backstage. We can develop our own solution but I would like to avoid it if there is something already in place. Thank you so much in advance.

Weekend project that turned into a proper one. Sharing the method because the "correct-by-construction data" trick generalises well beyond my niche.

The problem. IES4 is the UK government's Information Exchange Standard, a 4D RDF ontology used for defence/security data. Writing valid IES Turtle by hand is slow and needs real ontology expertise. So I tried the obvious thing: ask a strong code model to do it. Qwen3-Coder-30B-A3B, asked to emit IES Turtle, invents terms that do not exist in the ontology 94% of the time (0% "term conformance" on my eval). It produces confident, fluent, completely fake RDF. In a standards context that is worse than failing outright, because plausible-looking garbage is hard to catch.

The fix that actually mattered: never let the model invent structure. Instead of hoping the LLM guesses valid graphs, I generated the graphs programmatically with telicent's ies-tool (a schema-aware builder that emits valid IES by construction), across 14 scenario patterns (employment, events, identifiers, communications, composites). Then I reversed them into (natural-language description -> Turtle) training pairs. Every single graph was validated twice before training: once by the builder's own check, and once by an independent term-membership + domain/range validator I built from the published dstl/IES4 ontology (510 classes, 204 properties). Nothing hand-written was trusted blind.

Then a small QLoRA on the 8-bit MLX model, on-device on an M3 Max. ~1000 iters, val loss 0.15, no NaNs (MoE + 8-bit was fine on current mlx-lm; earlier versions apparently weren't).

Model: https://huggingface.co/fabsssss/qwen3-coder-30b-a3b-ies4

Article: https://gov.tesseract.academy/research/ies4-turtle-language-model

Instead of node --edge--> node, every relationship is a first-class document with its own vector, called a BaryEdge. Stack pairs of BaryEdges recursively and you get "MetaBary" triads that surface structural bridges between concepts that live nowhere near each other in embedding space. Running locally on MongoDB Community + mongot + nomic-embed-text over the full English Wiktionary (6.6M docs). MCP server is live if you want to poke at it. Preprint + benchmark CSVs: https://zenodo.org/records/20186500

The problem I was chasing

Flat vector search treats a relationship as a byproduct of two points being close. That throws away information. Two papers can describe the same underlying phenomenon (a flyby anomaly in orbital mechanics, an anomalous residual in stellar dynamics) without ever citing each other and without their embeddings landing anywhere near each other. Nothing in standard RAG surfaces that connection.

What I did instead

Every relationship gets embedded too:

bary_vector = normalize(q·v(CM1) + q·v(CM2) + (1−q)·v(type))

q is connection quality, v(type) is a contextual embedding of what kind of relationship it is. This BaryEdge is now a retrievable document in its own right — not metadata on an edge.

Then it recurses: two BaryEdges at the same level get bridged by a third one level below, forming a MetaBary triad. Do that repeatedly and you climb an abstraction triads hierarchy built entirely from algebra — zero additional embedding calls above the base level. It's a forest (every node has at most one parent), so traversal to root is a single $graphLookup, no cycle handling.

Does it actually do anything useful?

Ran it against SimLex-999 and WordSim-353 as a sanity check (not the main claim, just "is the substrate coherent"). Raw cosine similarity barely correlates with human similarity judgments (ρ ≈ −0.04 on SimLex). Structural metrics — how many BaryEdges two words share, how much their relational neighborhoods overlap — correlate at ρ ≈ 0.32–0.53, p < 10⁻¹⁵. So the graph is encoding something cosine alone doesn't.

The part I actually care about is cross-domain bridging. Some probe traces from the live graph:

• octopus neuroscience ↔ distributed sensor networks, bridged by shared structural-motif vocabulary (neuroarchitecture, smartdust)

• collagen folding ↔ linguistic syntax, bridged by etymological + structural motif overlap (plicature / hypotaxis-parataxis)

• grief ↔ depression, not bridged and this is a correctness demonstration, not a missing capability. The DSM-5 added a much-debated "bereavement exclusion" precisely because grief and depression share surface symptoms but are different kinds of state, with different prognosis and treatment

• radioactive decay ↔ obsolete words falling out of use, bridged at a high abstraction level by register-varied decay verbs (collapsed, decayed, declined, disintegrated) — naming a Poisson-process state-loss pattern that both physics and historical linguistics instantiate, with no single word doing the work

That last one is the case flat retrieval structurally cannot produce — there's no embedding axis for "verbs co-occurring with reduction-of-state across unrelated domains."

Stack (all local, all free)

GitHub: https://github.com/oleksiy-perepelytsya/bary-vector

• MongoDB Community Edition + mongot for storage/vector search

• nomic-embed-text, 768-dim

• Python 3.11+

• Full build: ~6.66M documents, 8–14 hrs on a single workstation (8–16GB VRAM)

Try it

MCP server is public on request (SSE transport) — read-only tools for searching the live graph: find_word, semantic_search, edge_info, leaf_nodes, traverse_up, sample_metabary. If you've got an MCP-capable client you can point it at the graph and run your own probe queries in a few minutes.

What I'd actually want feedback on

• Whether the cross-domain bridges hold up to someone who isn't me poking at them — try a probe query on a domain pair you know well and tell me if the bridge is real or if I'm pattern-matching myself into seeing structure that isn't there. Some bridges can be not obvious on the first look but they are actually the most intriguing ones and worth to be dug for the reason they built, so treat them as points of investigation

• Whether this is worth comparing directly against GraphRAG/RAPTOR-style hierarchical retrieval (I haven't done that benchmark yet, and I know that's the first thing this sub will ask)

• Whether anyone's tried something structurally similar and it fell apart at scale for reasons I haven't hit yet

Preprint, architecture spec, and the raw SimLex/WordSim CSVs are all here: https://zenodo.org/records/20186500

Happy to drop the MCP endpoint on request if there's interest.

Got tired of waiting for RDF1.2 to finalize as a spec, got fed up with the Java tools, needed something higher-performance in Rust that I could also use from Python and WASM.

PurrRDF was born. It's not quite a full rdflib replacement for Python, but it has built-in ShACL and ShEx for validation and speaks all the common variants. I'm spinning this out of a larger project that's building a full RDF1.2 Rust tool stack - it runs, it's fast and probably useful to anyone building high-performance RDF1.2/RDF* knowledge graphs (if you are, you'll know the pain!)

Comments, feedback, test cases, etc. welcome: https://github.com/Blackcat-Informatics/purrdf/

I kept running into the fact that the UK has two open 4D upper ontologies in active government use, from the same BORO / ISO 15926 lineage, with no published mapping between them:

• IES (Information Exchange Standard): the RDF ontology used for UK national-security and defence data exchange. Open Government Licence, now stewarded by a cross-government working group.
• HQDM: Matthew West's 4D model (the one behind the National Digital Twin's Foundation Data Model). Apache-2.0, published by GCHQ.

So I built an open crosswalk and released it. What might interest this sub is less the backbone matches and more where the two disagree, because that is where anyone reasoning across both silently gets it wrong:

• ies:Event is not hqdm:event. In IES an Event is a happening with participants, so its real counterpart is hqdm:activity. hqdm:event is an instantaneous boundary point. A label-matcher aligns them and maps a durative occurrence onto a zero-duration point.
• Temporal boundaries are a State in IES (ies:BoundingState) but a point event in HQDM (hqdm:event via beginning/ending). Same job, different category.
• ies:State sits as a top-level root; hqdm:state is under spatio_temporal_extent. Reasoning that relies on state ⊑ spatio_temporal_extent breaks on the IES side.
• Participation is the clean convergence: both model it as a state (ies:EventParticipant ⊑ State, hqdm:participant as a state_of), inherited from the shared BORO commitment.

The correspondences are in SSSOM and RDF with PROV-O provenance, validated with SHACL (the pipeline uses embedding candidate generation then fuzzy-logic adjudication, in the LLMs4OM / FLORA line). Every IRI resolves against the live published ontologies. There is also a worked example grounding an autonomous sensor node (SAPIENT / BSI Flex 335) in an IES-typed world model, which is the practical reason I care: you cannot assure an agent against a world model you have not agreed on.

Repo: https://github.com/fabio-rovai/ies-hqdm-crosswalk

It is v0.1. The most useful thing anyone here could do is tell me a correspondence I got wrong, or a divergence I missed. Disclosure: this is my own work (Tesseract Academy), released open under CC-BY.

Has anyone tried aligning two 4D / perdurantist upper ontologies before? Curious whether the Event/activity trap shows up between other BORO-derived models.