Reference

The Mopheus IT Asset system is built on a formal ontology metamodel (TBox). All imported instances (ABox) are rigorously validated against their respective JSONSchema technical contracts, and all directed topology edges (asset_relations) must satisfy topological axiom whitelists.

This reference document is intended for SRE engineers, platform developers, and AI agent skill authors who require exact schema definitions and architectural constraints.

Metamodel Architecture Contract (TBox Contract)Copy Anchor Link

In the Mopheus knowledge graph, every asset entity belongs to exactly one Concept metamodel. The ingestion pipeline enforces the following validation guarantees:

1. Strict Technical Attribute Schema (attributes):
   • Each Concept binds to a dedicated attributes_schema (JSONSchema specification).
   • No Undeclared Fields: additionalProperties: false is enforced by default; mistyped or unrecognized properties are rejected.
   • Mandatory Field Enforcement: Key operational properties (such as management_ip for Host, engine and db_mode for Database) are strictly required.
   • Strict Enumerations: Roles, cluster types, and engine types must match predefined enum values.
2. Topological Axiom Validation (allowed_relations):
   • Graph edges are not only constrained to 7 canonical predicates, but also strictly validate Subject Concept to Object Concept combinations. For example, Service can emit runs_on to Host or Container, but cannot directly runs_on to Database.
3. Causal Cycle & DAG Loop Detection:
   • For hierarchical and causal relations such as contains and depends_on, mop asset apply automatically conducts cycle detection to prevent infinite dependency loops.

Standard Concept Metamodels (17 Authoritative Concepts)Copy Anchor Link

Enterprise IT infrastructure is structured into 7 core domains comprising 17 authoritative concept metamodels:

Canonical Predicates & Axiom Validity MatrixCopy Anchor Link

All directed graph edges (Subject $\to$ Predicate $\to$ Object) utilize 7 immutable canonical predicates, strictly governed by the following axiom whitelist (allowed_relations):

Declarative Manifest Specification (AssetManifest YAML)Copy Anchor Link

Mopheus uses declarative YAML manifests for bulk synchronization, versioning, and backup:

version: v1                       # Immutable version identifier, must be v1
kind: AssetManifest               # Immutable type, must be AssetManifest
metadata:
  workspace: ecommerce-prod       # Target workspace slug
  environment: prod               # Default environment: prod | staging | test | dev
assets:
  - id: string                    # [Required] Globally unique asset ID (e.g. svc:order-gw)
    concept: string               # [Required] One of the 17 standard ontology concepts
    name: string                  # [Required] Human-readable standard name
    aliases:                      # [Optional] List of search aliases for fuzzy entity resolution
      - string
    status: active                # [Required] Lifecycle state: active | draining | offline | unhealthy
    environment: prod             # [Required] Environment: prod | staging | test | dev
    attributes:                   # [Optional] Technical attributes strictly validated by Concept schema
      key: value
    labels:                       # [Optional] Governance tags (freeform key-value pairs)
      owner_team: string          # Responsible team (e.g. order-dev, billing-dba)
      tier: string                # Criticality tier (P0 | P1 | P2 | P3)
      oncall: string              # On-call contact
relations:
  - subject: string               # [Required] Source asset ID
    predicate: string             # [Required] One of the 7 canonical predicates
    object: string                # [Required] Target asset ID
    attributes:                   # [Optional] Edge attributes (e.g. port, protocol)
      port: 8080

Asset ID Character SetCopy Anchor Link

Asset IDs must match ^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$: the first character must be a letter or digit, followed only by letters, digits, :, _, -, or .. Slashes (/), spaces, ?, #, %, and non-ASCII characters are rejected with HTTP 400 at every entry point (REST API, manifest YAML, and CLI). Use a colon instead of a slash, for example svc:order-gw rather than svc/order-gw; the CLI rejects slash IDs locally and suggests the colon form. Colon-form IDs are valid URL path segments and require no escaping.

Redis CLI Through an AssetCopy Anchor Link

mopheus tool redis-cli <asset-id-or-name> [--user <username>] -- <redis-cli arguments...> resolves the asset in the current workspace, reads its password credential through the encrypted credential API, and invokes the local redis-cli. The asset must be a Database with attributes.engine: redis (or have concept Redis), and its selected password credential must include a connection host and port. When exactly one password credential exists, --user is optional; otherwise specify the credential username with --user. Connection options and password come from the asset, so do not pass host, port, or authentication options after --.

Example: mopheus tool redis-cli cache-prod -- PING. The local client must be redis-cli 6.0 or newer so the password can be passed through REDISCLI_AUTH instead of process arguments. Redis server 5.x uses the default account; named ACL users require Redis server 6.0 or newer. See redis-cli --help for native client arguments.

MongoDB Shell Through an AssetCopy Anchor Link

mopheus tool mongosh <asset-id-or-name> [--user <username>] -- <mongosh arguments...> resolves a MongoDB asset, reads its connection details and password through the encrypted credential API, and starts the local mongosh. Set attributes.engine: mongodb (or mongo) and configure a password credential. Omit --user when exactly one password credential exists; otherwise use --user <username> to select an account. The authentication database defaults to admin.

Fill in username: <username> and secret.password: <password> in a restricted-permission credential file, set its mode to 0600, then save it with mopheus asset credential add <asset-id> --file <credentials.yaml>. The connection URI is passed through the child process environment and is not exposed in process arguments. Arguments after -- cannot override the host, port, username, password, authentication database, or connection URI. See mongosh --help for native client arguments.

Example: mopheus tool mongosh mongo-prod --user <username> -- --eval 'db.adminCommand({ping: 1})'.

CLI Concept Probing CommandsCopy Anchor Link

Engineers and autonomous agents can inspect metamodels directly via the CLI:

# 1. List all registered concepts and categories in current workspace
mop asset concept list

# 2. Inspect JSONSchema and allowed relations for a specific concept
mop asset concept get Host
mop asset concept get Database

# 3. Validate and apply declarative manifest
mop asset apply -f production-topology.yaml

# 4. Export current workspace topology
mop asset export > backup-topology.yaml