Plan a rollout
Select exact inventory hosts and an approved playbook.
Target hosts
Discovery connects to hosts. Check mode executes trusted playbooks; tasks can override check mode. Review playbooks before enabling runs.
CONTROL / OBSERVE / VERIFY
Facilities
DEMO INVENTORY · Example addresses and declared dependencies. No network scan or remote deployment has occurred.
Available facilities
Controller executables and host observations, kept separate.
Host evidence
Review and deploy
A successful check binds the playbook project, resolved inventory and exact target set for 15 minutes. Deploy runs one job at a time.
No automatic undo is implied. Define a recovery playbook and backups before production work.
Run history
From evidence to execution
The process model and recorded jobs. Pending steps are never presented as completed.
Validate
Playbook syntax
Discover
OS · services · packages
Check
Review expected changes
Deploy
Confirm exact targets
Observed execution
Discovery is an independent optional observation. A matching successful check is mandatory for deployment.
Inventory relationships
Group membership and declared dependencies—not a measured physical topology.
○ Inventory group▢ Inventory host── Group membership┄ Declared dependency
Select a graph node
Inspect host observations and provenance.
TrustGraph bridge
Export this evidence graph as RDF Turtle, then publish it to your configured TrustGraph workspace using the included bridge. No infrastructure data is sent automatically. Graph export includes job states and observed services.
python trustgraph_bridge.py graph.ttl --url YOUR_TRUSTGRAPH_URLVersioned digital space maps
Immutable graph revisions · verified releases · reversible activation
Connect to the PostgreSQL topology service.
Application subscriptions
Auto-update is an application opt-in for signed data maps within its configured scope. Scope changes and executable changes require separate review.
Ontology contract
RDF 1.1 · OWL vocabulary · SHACL validation · PROV-O model. ISO/IEC 21838 alignment is a documented assessment target, not certification. FHIR R5 Basic/Provenance adapter is separate from the infrastructure ontology.
GET /api/maps/current · /api/maps/graph.ttl · /api/maps/graph.jsonld · /api/maps/fhirApplications use separate tokens, a pinned Ed25519 public key and the included polling SDK. A map update never executes an Ansible playbook.
MAPE-K · Evidence to knowledge
Bounded data-model improvement from authorized local-host observations.
Monitor
Read-only host evidence
Analyze
Freshness · scope · repetition
Plan
Validate ontology and deltas
Execute
Publish signed map data only
Knowledge
PostgreSQL revisions and audit
Consolidated topology
Published evidence only. Relationships outside the authorized discovery scope remain unknown.