Overview

Modern enterprise IT infrastructure is highly distributed and dynamic. During production outages, service degradations, or alert storms, AI agents and engineers cannot rely on fuzzy text search or fragmented configuration snippets to comprehend complex architectures. Teams require an ontology-driven knowledge graph capable of piercing down from top-level business applications to microservices, database clusters, physical hosts, network devices, and storage volumes.

The Mopheus IT Asset Ontology & Topology subsystem replaces traditional, siloed CMDB tables with a formal metamodel schema (TBox) and a directed relationship graph (ABox), empowering agents and technical teams with deterministic architectural visibility and causal reasoning capabilities.

Why IT Asset Ontology?Copy Anchor Link

Traditional CMDBs suffer from three critical pain points in modern operations:

1. Rigid Wide Tables vs. Chaos — Legacy CMDBs either force every asset into massive tables with hundreds of redundant columns (leaving most fields permanently empty) or degrade into untyped key-value stores lacking semantic constraints.
2. Absence of Causal Topology — Assets are recorded as isolated records. When a physical server or switch fails, teams cannot immediately compute the upstream business blast radius or trace the causal chain between microservice timeouts and underlying storage degradation.
3. Operational Coupling & Drift — Traditional CMDBs routinely mix remediation scripts, SOP runbooks, and asset records into single rows, inevitably leading to configuration drift and stale documentation.

Mopheus resolves these challenges through three architectural pillars:

• Strongly Typed Metamodels (TBox): Built-in 17 standard ontology concepts with JSONSchema validation for technical attributes, strictly enforcing valid topological axioms.
• Minimal Envelope Graph Storage (ABox): Asset instances and directed relations are stored in high-performance PostgreSQL tables, leveraging recursive CTEs for millisecond-level downstream traversal, upstream blast radius calculation, and shortest causal path search.
• Clean Separation of Concerns: Objective technical facts (attributes) and governance tags (labels) are strictly decoupled from operational remediation logic, which resides entirely within Agent Skills (such as mopheus-assets).

Web UI Asset Center & Interactive Architecture TopologyCopy Anchor Link

Mopheus provides a native Asset Center in the Web interface, offering three integrated views: Application Panorama (L1), Architecture Topology Canvas (L2), and the Inventory Table:

1. Hierarchical Architecture NavigationCopy Anchor Link

• Application Panorama (L1): Displays cards for all registered business systems (Application) in the workspace, highlighting microservice counts, database footprint, cross-app cascading dependencies, and environment distribution.
• Architecture Topology Canvas (L2): Clicking any application card or top-level selector opens a deep multi-tier topology showing granular microservice and infrastructure relationships.

2. Logical vs. Physical Asset LayeringCopy Anchor Link

• Logical Architecture on the Canvas: To maintain visual clarity and architectural readability, the L1/L2 topology canvas focuses on logical architecture nodes (microservices Service, database clusters Database, load balancers LoadBalancer, DNS records DNSRecord, compute hosts Host).
• Physical Instances in the Inventory: Physical runtime entities (containers Container, single-process database instances DatabaseInstance, shards DatabaseShard) do not clutter the main canvas. Users can inspect them seamlessly in the Inventory Table or via asset detail drawers.
• Legend Guidance & Disabled Actions:
  • The canvas legend displays: "The topology canvas visualizes logical assets only. For physical assets (containers, DB instances), view the Inventory Table."
  • In the Inventory Table and detail drawer, the "Locate on Topology" button is cleanly disabled with a descriptive tooltip for non-projected physical entities.

3. Advanced Canvas InteractionsCopy Anchor Link

• Node Focus & Detail Drawer: Clicking any node slides out a full inspection drawer detailing technical attributes, governance tags, and complete upstream/downstream relations, synced with URL anchors for easy sharing.
• Non-Destructive Blast Radius Highlighting: One-click blast radius analysis spreads out along dependency chains while dimming unrelated nodes.
• Multi-Environment Clustering: Production (PROD), Staging, and Development clusters are laid out using intelligent responsive bounding boxes to clarify cross-environment traffic.
• Theme Sync & Presentation Mode: Automatically synchronizes with workspace dark/light themes, with one-click full-screen presentation mode and image export.

Domain Model & Core Ontology SystemCopy Anchor Link

Mopheus structures IT infrastructure into 7 core domains, abstracted into 17 standard ontology concepts and 7 canonical predicates:

7 Core DomainsCopy Anchor Link

1. Business: Top-level enterprise systems Application and microservices Service.
2. Platform: Control planes Cluster and container workloads Container.
3. Compute: Bare-metal servers, VMs, and cloud instances Host.
4. Database: Logical clusters Database, engine instances DatabaseInstance, shards DatabaseShard, and coordinators DatabaseComponent.
5. Middleware: Message brokers and event streaming clusters MessageQueue.
6. Network: DNS records DNSRecord, virtual IPs VirtualIP, load balancers LoadBalancer, network devices NetworkDevice, and physical interfaces IPAddress.
7. Storage: Centralized/distributed storage pools StoragePool and persistent volumes StorageVolume.

7 Canonical Topological PredicatesCopy Anchor Link

• contains — Compositional containment (Application contains Service, Database contains DatabaseInstance).
• runs_on — Physical or logical hosting (Container runs_on Host, DatabaseInstance runs_on Host).
• routes_to — Network traffic routing (DNSRecord routes_to VirtualIP, LoadBalancer routes_to Service).
• depends_on — Runtime functional/causal dependency (Service depends_on Database).
• replicates_to — Stateful data replication (Primary replicates_to Standby).
• clustered_with — Symmetric high-availability peer clustering (Host clustered_with Host).
• manages — Control plane governance and supervision (Cluster manages Service).

[!TIP] For the complete JSONSchema specifications, required fields, enum constraints, and the full topological axiom validity matrix, refer to the dedicated Ontology & Schema Reference.

Technical Attributes vs. Governance LabelsCopy Anchor Link

Mopheus strictly separates technical facts from governance metadata:

Graph Operations & CLI CommandsCopy Anchor Link

Autonomous agents and operators manage the knowledge graph through the mop asset CLI command family:

1. Entity Resolution & InspectionCopy Anchor Link

Rapidly map aliases, IPs, or service names to unique Asset IDs:

# Resolve standard Asset ID from alias
mop asset resolve "order-gateway"

# Inspect attributes, labels, and concept schema
mop asset inspect "svc:order-gateway"

2. Multi-Hop Topology TraversalCopy Anchor Link

Expand upstream or downstream dependencies to arbitrary depth:

# Downstream dependencies: what components does this service depend on?
mop asset topology "svc:order-gateway" --depth 3 --direction downstream

# Upstream blast radius: what services are affected if this host fails?
mop asset topology "host:db-node-01" --depth 3 --direction upstream

# Bidirectional neighborhood analysis:
mop asset topology "db:settle-oracle-rac" --depth 2 --direction both

3. Shortest Causal Path TracingCopy Anchor Link

During incidents, compute the shortest causal dependency path from symptoms to suspected root causes in seconds:

mop asset path --from "svc:order-gateway" --to "host:db-node-01"

Example Output:

Causal Path: svc:order-gateway -> host:db-node-01 (length: 3 hops)

  [1] svc:order-gateway (Service) -[depends_on]-> db:settle-oracle-rac (Database)
  [2] db:settle-oracle-rac (Database) -[contains]-> db_instance:rac-node1 (DatabaseInstance)
  [3] db_instance:rac-node1 (DatabaseInstance) -[runs_on]-> host:db-node-01 (Host)

4. Architecture Diagram Projection (mop asset diagram)Copy Anchor Link

mop asset diagram projects workspace assets or offline manifests into Archify-compliant architecture diagrams, rendering standalone interactive HTML pages:

# Project L2 microservice diagram for target app as JSON
mop asset diagram --app "app:mopheus" -o json

# Render standalone interactive single-page HTML
mop asset diagram --app "app:mopheus" --locale en --render -f mopheus-arch.html

# Pure offline projection from local YAML manifest
mop asset diagram --input ./offline-manifest.yaml --render -f offline-arch.html

Agent Integration & Built-in SkillsCopy Anchor Link

Mopheus includes the built-in mopheus-assets skill. When triaging alerts or answering architecture questions, agents execute a standard operating procedure (SOP):

1. Entity Resolution: Map keywords and alert targets to canonical asset IDs.
2. Dependency Traversal: Unfold the complete downstream dependency chain.
3. Causal Demarcation: Search causal paths to determine if infrastructure alerts explain application errors.
4. Blast Radius Calculation: Assess affected business applications and owner teams before executing remediations.

Feature GatingCopy Anchor Link

The asset subsystem is gated by the asset workspace feature flag. Disabled by default (system_state = 1), administrators enable it per workspace:

# Enable asset capability for a specific workspace
mop workspace feature enable <workspace-id> asset

SSH Credential Integration & Governed Remote ExecutionCopy Anchor Link

Mopheus IT Asset Center deeply integrates with the built-in SSH remote execution tool, adopting a Zero-Trust security architecture with strict decoupling between metadata and private keys:

• Assets Declare Only Connection Metadata (credential_ref): The physical host asset (Host) configures credential_ref: ssh://user@host:22?key=keyname in its attributes. The asset database never stores plaintext private keys.
• Logical-to-Physical Drill-Down: When a logical asset (such as a microservice or database cluster) triggers an alert, the agent automatically traverses mop asset topology to locate the underlying physical host before initiating an authorized connection.
• Encrypted Custody & Ephemeral Injection: User private keys are stored with envelope encryption and injected into runtime task sandboxes only on demand, destroyed immediately upon task completion.

For complete key generation workflows, CLI operations (mop ssh exec, upload, download), and autonomous diagnostic SOPs, refer to SSH Remote Execution.