[bss-opensof] 02 Architecture

• Start Here
• Foundational Architecture
• Architecture Overview
• OpenBus
• OpenKnowledge and Semantic Layer
• Operational Architecture
• Operational Data Flows
• Timing, Positioning and OpenPNT
• Deployment & Security
• Deployment Topology
• Security Architecture
• Interface Boundaries

Start Here

Start Here

Field	Value
Distribution	BSS — OpenSOF
Product	OpenSOF
Release	0.15.1
Deployment	opensof.bss.dev
Source	/srv/bss/releases/OpenSOF-v0.15.0-20app
Evidence	Documentation structure and release scan
Source fingerprint	cda583b42f2a0d296b268ab5b174932a378c8be6fb52ffa1af14af896e990f6e
Status	Generated baseline — human review required

Verification boundary: This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.

Purpose

This book defines the architectural model used to understand and integrate the distribution. It separates stable platform intent from topology observed in the inspected release.

Contents

Section	What it contains
Foundational Architecture	OpenBus, OpenKnowledge and the semantic/timing foundation.
Operational Architecture	Data flows, component interaction and human-machine workflows.
Deployment & Security	Observed topology, trust boundaries and security verification.

How to maintain this book

Generated sections are replaced from release evidence on each run. Put reviewed corrections, deployment-specific facts, links and decisions in the Maintainer Notes area below the generated block. Mark pages as reviewed only after testing them against the named distribution and release.

---

Maintainer Notes

Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.

Foundational Architecture

Architecture Overview

Architecture Overview

Field	Value
Distribution	BSS — OpenSOF
Product	OpenSOF
Release	0.15.1
Deployment	opensof.bss.dev
Source	/srv/bss/releases/OpenSOF-v0.15.0-20app
Evidence	Static release scan
Source fingerprint	cda583b42f2a0d296b268ab5b174932a378c8be6fb52ffa1af14af896e990f6e
Status	Generated baseline — human review required

Verification boundary: This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.

Layered model

Layer	Representative capabilities	Responsibility
Experience	OpenCOP, OpenEyes, OpenTask, OpenChat, OpenIIA	Operator views, collaboration, investigation and tasking.
Domain services	OpenTrack, OpenRF, OpenSSA, OpenLVC, OpenAnalytics	Mission functions, sensor exploitation, simulation and analysis.
Knowledge & automation	OpenKnowledge, OpenLLM, OpenDAA	Semantic types, queries, models, pipelines and decisions.
Exchange & data	OpenBus, OpenData, OpenFiles, OpenMail	Events, APIs, storage, artifacts and governed dissemination.
Edge & infrastructure	OpenPNT, OpenNetworks, sensors, SDRs, robots, UAS	Time, position, transport, compute and physical interfaces.

Architectural principles

• Modular deployment: components can be deployed, replaced and integrated independently.
• Explicit contracts: APIs, messages, semantic types, time and provenance should be defined rather than implied.
• Edge-first exploitation: process raw streams near the source when practical, then exchange compact operational products.
• Human-machine teaming: automation proposes, correlates and acts through governed workflows with visible status and audit.
• Open integration: customers can combine platform modules with existing C5ISR, analytic, collaboration and enterprise systems.

Observed implementation indicators

Indicator	Observed
Languages	PHP, JavaScript, Python, C, Shell, C++
Frameworks	—
Container definitions	0
Service definitions	9
Nginx configurations	0

---

Maintainer Notes

Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.

OpenBus

OpenBus

Field	Value
Distribution	BSS — OpenSOF
Product	OpenSOF
Release	0.15.1
Deployment	opensof.bss.dev
Source	/srv/bss/releases/OpenSOF-v0.15.0-20app
Evidence	Catalog architecture plus release evidence
Source fingerprint	cda583b42f2a0d296b268ab5b174932a378c8be6fb52ffa1af14af896e990f6e
Status	Generated baseline — human review required

Verification boundary: This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.

Role

OpenBus is the event and message fabric that decouples producers from consumers. A sensor, application or analytic publishes an operational event once; authorized subscribers can consume, enrich, correlate, persist or act on it without forcing a direct integration with every producer.

Recommended event envelope

Field	Purpose
id	Globally unique event identifier.
type	Semantic event/entity type, preferably linked to OpenKnowledge.
source	Producer identity and originating sensor/application.
time	Observation, creation and receipt times with clock-quality metadata.
correlation	Mission, track, task, case, release group or workflow context.
provenance	Processing lineage, transformations and custody.
payload	Domain data or reference to a larger product in OpenFiles/OpenData.
policy	Handling, releasability, retention and access controls.

Integration rule

Use OpenBus for asynchronous operational state and workflow events; use REST for request/response management operations; use WebSockets for low-latency browser or device sessions; use OpenFiles for larger artifacts. Avoid turning the bus into an untyped dump of arbitrary JSON.

Release evidence

Status	Score	Evidence items
detected	105	12

Evidence type	Source	Match
path	OPENBUS.md	openbus
path	drivers/openbus_agent.py	openbus
path	edge/openlvc/rti_openbus_gateway.py	openbus
path	examples/opencybersec/openbus-security-event.json	openbus
path	lib/open-networks/openbus.js	openbus
content	API.md	openbus
content	CHANGELOG.md	openbus
content	DEPLOY-GODADDY.md	openbus
content	MERGE-v0.13.1.md	openbus
content	OPENBUS.md	openbus
path	open-bus/app.js	open-bus
path	open-bus/index.html	open-bus

---

Maintainer Notes

Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.

OpenKnowledge and Semantic Layer

OpenKnowledge and Semantic Layer

Field	Value
Distribution	BSS — OpenSOF
Product	OpenSOF
Release	0.15.1
Deployment	opensof.bss.dev
Source	/srv/bss/releases/OpenSOF-v0.15.0-20app
Evidence	Catalog architecture and semantic file scan
Source fingerprint	cda583b42f2a0d296b268ab5b174932a378c8be6fb52ffa1af14af896e990f6e
Status	Generated baseline — human review required

Verification boundary: This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.

Role

OpenKnowledge provides the shared semantic representation for entities, relationships, observations, tasks, capabilities, effects and evidence. RDF/OWL/SHACL assets and SPARQL endpoints can make that representation queryable and governable across applications.

Why semantics belong in the core

Without a shared meaning layer, integration stops at syntax: two systems may exchange JSON yet disagree on what an entity, position, confidence, task or observation means. Semantic identifiers and constraints let automation select valid actions, let analytics combine compatible data, and give AI a bounded operational vocabulary.

Observed semantic evidence

Measure	Observed
Semantic files	22
Files	.opennetworks-backup-20260827T210646Z/ontology/openaar-mr.ttl .opennetworks-backup-20260827T210646Z/ontology/opencybersec.ttl .opennetworks-backup-20260827T210646Z/ontology/opendaa-openanalytics.ttl .opennetworks-backup-20260827T210646Z/ontology/opendaa-opendata.ttl .opennetworks-backup-20260827T210646Z/ontology/openiia.ttl .opennetworks-backup-20260827T210646Z/ontology/opensof-applications.ttl .opennetworks-backup-20260827T210646Z/ontology/opensof-core.ttl .opennetworks-backup-20260827T210646Z/ontology/opensof-ontology.ttl ontology/openaar-mr.ttl ontology/opencybersec.ttl ontology/opendaa-openanalytics.ttl ontology/opendaa-opendata.ttl ontology/openiia.ttl ontology/opennetworks.ttl ontology/opensof-applications.ttl ontology/opensof-core.ttl ontology/opensof-ontology.ttl third_party/ontowiki/application/config/SysBase.rdf third_party/ontowiki/extensions/community/insert.sparql third_party/ontowiki/extensions/datagathering/SyncSchema.rdf third_party/ontowiki/extensions/exconf/resources/Examples.rdf third_party/ontowiki/extensions/exconf/resources/PluginRepository.rdf
Term indicators	RDF: 4239, OWL: 2287, ontology: 2031, provenance: 271, SPARQL: 258, SHACL: 143, JSON-LD: 18

Governance checklist

• Assign stable URIs to core entity, relationship, observation, task and effect types.
• Version ontologies and record compatibility/migration rules.
• Validate critical payloads with SHACL or equivalent constraints.
• Record provenance and source confidence separately from asserted facts.
• Protect write access to production knowledge while allowing broad governed query access.

---

Maintainer Notes

Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.

Operational Architecture

Operational Data Flows

Operational Data Flows

Field	Value
Distribution	BSS — OpenSOF
Product	OpenSOF
Release	0.15.1
Deployment	opensof.bss.dev
Source	/srv/bss/releases/OpenSOF-v0.15.0-20app
Evidence	Reference architecture
Source fingerprint	cda583b42f2a0d296b268ab5b174932a378c8be6fb52ffa1af14af896e990f6e
Status	Generated baseline — human review required

Verification boundary: This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.

Reference flow

Producer	Information product	Primary consumer/store
Sensor/device	Raw signal, frame, telemetry or observation	Edge adapter / domain module
Domain module	Typed observation, track, product or alert	OpenBus / OpenData / OpenFiles
OpenKnowledge	Type, relationship and policy context	Analytics, automation and operator applications
Operator/analytic	Decision, annotation, correlation or recommendation	OpenTask / OpenCOP / OpenIIA
OpenTask	Assigned action and state transition	Human, robot, service or external system
All stages	Provenance, timestamps, audit and retained artifacts	OpenFiles / OpenData / OpenAAR-MR

Control points

• Validate schema and semantic type at ingestion.
• Preserve source time separately from processing and receipt time.
• Carry handling and release policy with the object, not only in the user interface.
• Reference large imagery/video/files rather than embedding them in high-rate event messages.
• Make task and effect transitions explicit, acknowledged and auditable.

---

Maintainer Notes

Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.

Timing, Positioning and OpenPNT

Timing, Positioning and OpenPNT

Field	Value
Distribution	BSS — OpenSOF
Product	OpenSOF
Release	0.15.1
Deployment	opensof.bss.dev
Source	/srv/bss/releases/OpenSOF-v0.15.0-20app
Evidence	Reference architecture and timing term scan
Source fingerprint	cda583b42f2a0d296b268ab5b174932a378c8be6fb52ffa1af14af896e990f6e
Status	Generated baseline — human review required

Verification boundary: This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.

Timing and positioning role

OpenPNT should register and monitor the clocks, coordinate frames and position sources used by sensors, radios, tracks, simulations and analytic products. Accurate correlation requires knowing not only a timestamp and coordinate, but also their source, reference frame, uncertainty and quality.

Required metadata

Area	Minimum context
Time	UTC timestamp, clock source, synchronization method, offset/error estimate and leap/time-scale handling.
Position	Coordinate reference system, datum, origin, axes, units, uncertainty and update time.
Sensor geometry	Platform pose, antenna/camera offsets, orientation and calibration profile.
Simulation	Scenario clock, time acceleration, federation epoch and mapping to wall-clock time.

Observed timing indicators

Indicator	Count/evidence
PTP/PPS	1064
camera/video	362
UHD/USRP	324
AIS	154
FlightGear	121
DIS	85
PlutoSDR	56
HackRF	55
SoapySDR	54
ADS-B	46

Verification tests

• Confirm NTP/PTP/White Rabbit service state and measured offset on every participating host.
• Verify sensor products carry source timestamp and clock-quality metadata end to end.
• Validate coordinate transforms against known control points and record calibration versions.
• Alert when time or position quality falls below mission thresholds instead of silently accepting degraded data.

---

Maintainer Notes

Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.

Deployment & Security

Deployment Topology

Deployment Topology

Field	Value
Distribution	BSS — OpenSOF
Product	OpenSOF
Release	0.15.1
Deployment	opensof.bss.dev
Source	/srv/bss/releases/OpenSOF-v0.15.0-20app
Evidence	Release and readable host configuration
Source fingerprint	cda583b42f2a0d296b268ab5b174932a378c8be6fb52ffa1af14af896e990f6e
Status	Generated baseline — human review required

Verification boundary: This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.

Observed services

Service	Working directory	ExecStart	Evidence
opencybersec-agent.service	—	/opt/opencybersec-agent/opencybersec_agent.py --config /etc/opencybersec-agent.json	edge/opencybersec/systemd/opencybersec-agent.service
openlvc-ais-bridge.service	/opt/opensof/edge/openlvc	/usr/bin/python3 /opt/opensof/edge/openlvc/ais_nmea_bridge.py --opensof ${OPENSOF_URL} --token [REDACTED] --bind 0.0.0.0 --port 10110	edge/openlvc/systemd/openlvc-ais-bridge.service
openlvc-dis-bridge.service	/opt/opensof/edge/openlvc	/usr/bin/python3 /opt/opensof/edge/openlvc/dis_udp_bridge.py --opensof ${OPENSOF_URL} --token [REDACTED] --bind 0.0.0.0 --port 3000	edge/openlvc/systemd/openlvc-dis-bridge.service
openlvc-flightgear-bridge.service	/opt/opensof/edge/openlvc	/usr/bin/python3 /opt/opensof/edge/openlvc/flightgear_bridge.py --opensof ${OPENSOF_URL} --token [REDACTED] --bind 0.0.0.0 --port 5505	edge/openlvc/systemd/openlvc-flightgear-bridge.service
openlvc-rti-gateway.service	/opt/opensof/edge/openlvc	/usr/bin/python3 /opt/opensof/edge/openlvc/rti_openbus_gateway.py --opensof ${OPENSOF_URL} --token [REDACTED] --federation ${OPENLVC_FEDERATION} --federate ${OPENLVC_FEDERATE} --sidecar-command ${OPENLVC_RTI_SIDECAR_COMMAND}	edge/openlvc/systemd/openlvc-rti-gateway.service
openpnt-phc2sys@.service	—	/opt/openpnt/bin/openpnt-linuxptp run phc2sys --instance /etc/openpnt/linuxptp/instances/%i.json --bin-dir /opt/openpnt/linuxptp/bin	edge/openpnt-linuxptp/systemd/openpnt-phc2sys@.service
openpnt-ptp4l@.service	—	/opt/openpnt/bin/openpnt-linuxptp run ptp4l --instance /etc/openpnt/linuxptp/instances/%i.json --bin-dir /opt/openpnt/linuxptp/bin	edge/openpnt-linuxptp/systemd/openpnt-ptp4l@.service
openpnt-ts2phc@.service	—	/opt/openpnt/bin/openpnt-linuxptp run ts2phc --instance /etc/openpnt/linuxptp/instances/%i.json --bin-dir /opt/openpnt/linuxptp/bin	edge/openpnt-linuxptp/systemd/openpnt-ts2phc@.service
openrf-agent.service	/opt/openrf-agent	/usr/local/bin/openrf-agent --config /etc/openrf/openrf-agent.json	openrf/agent/systemd/openrf-agent.service
openc5isr-bss-opensof.service	/srv/bss/instances/opensof/current	/usr/local/bin/npm start	/etc/systemd/system/openc5isr-bss-opensof.service

Observed reverse-proxy topology

Source	Server names	Locations	proxy_pass
/etc/nginx/sites-available/opensof.bss.dev	opensof.bss.dev opensof.bss.dev	/	http://127.0.0.1:3201/

Topology verification

• Confirm which directory or symlink is the authoritative current release.
• Confirm each public hostname terminates TLS and routes to the intended instance/port.
• Document shared backends separately from edition-specific application instances.
• Record network zones and firewall policy for public, management, data and sensor interfaces.

---

Maintainer Notes

Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.

Security Architecture

Security Architecture

Field	Value
Distribution	BSS — OpenSOF
Product	OpenSOF
Release	0.15.1
Deployment	opensof.bss.dev
Source	/srv/bss/releases/OpenSOF-v0.15.0-20app
Evidence	Reference controls and static security indicators
Source fingerprint	cda583b42f2a0d296b268ab5b174932a378c8be6fb52ffa1af14af896e990f6e
Status	Generated baseline — human review required

Verification boundary: This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.

Security model

Security must be applied across identity, content, interfaces, transport, deployment and evidence—not bolted onto the user interface. Each module should authenticate subjects, authorize actions and data, protect transport, minimize secrets, emit audit events and preserve provenance.

Observed indicators

Indicator	Observed
Secret-designated environment variables	ANTHROPIC_API_KEY, OPENAAR_SIGNING_KEY, OPENAI_API_KEY, OPENBUS_API_TOKEN, OPENCYBERSEC_AGENT_TOKEN, OPENCYBERSEC_OPERATOR_TOKEN, OPENCYBERSEC_READ_TOKEN, OPENKNOWLEDGE_EDITOR_TOKEN, OPENLLM_ANTHROPIC_API_KEY, OPENLLM_OPENAI_API_KEY, OPENLLM_OPENWEBUI_API_KEY, OPENLLM_OPERATOR_TOKEN, OPENPNT_AGENT_TOKEN, OPENPNT_TOKEN, OPENRF_AGENT_TOKEN, OPENRF_OPERATOR_TOKEN, OPENRF_READ_TOKEN, OPENSSA_SENSOR_TOKEN, OPENWEBUI_API_KEY, ROCKETCHAT_AUTH_TOKEN, ROCKETCHAT_OUTGOING_TOKEN, TOKEN
Security term counts	TLS: 1960, authorization/RBAC: 172, audit: 101, authentication: 64, CORS: 19
Potential sensitive file names	—

Required controls

Boundary	Minimum control
User/API identity	Named accounts or service identities, least privilege, revocable tokens and MFA where supported.
Transport	TLS for public and management interfaces; authenticated/encrypted links for operational buses where threat requires.
Content	Handling/release labels, role/attribute policy, object-level authorization and protected exports.
Secrets	No secrets in source, documentation, URLs or logs; use protected environment/secret stores and rotation.
Audit/evidence	Record actor, action, target, result, source time and correlation identifiers with tamper-aware retention.
Supply chain	Pinned dependencies/images, vulnerability review, signed release artifacts and reproducible deployment records.

Immediate review actions

• Rotate any token or password exposed in chat, shell history, logs or documentation.
• Verify BookStack/API credentials are stored only in the protected generator configuration.
• Test authorization for each edition so documentation and operational data do not cross unintended boundaries.
• Document incident response, backup confidentiality and restore authorization.

---

Maintainer Notes

Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.

Interface Boundaries

Interface Boundaries

Field	Value
Distribution	BSS — OpenSOF
Product	OpenSOF
Release	0.15.1
Deployment	opensof.bss.dev
Source	/srv/bss/releases/OpenSOF-v0.15.0-20app
Evidence	Reference architecture
Source fingerprint	cda583b42f2a0d296b268ab5b174932a378c8be6fb52ffa1af14af896e990f6e
Status	Generated baseline — human review required

Verification boundary: This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.

Interface selection

Need	Preferred mechanism	Reason
Manage/query a resource	REST/HTTP	Clear request/response semantics, authorization and idempotency.
Publish asynchronous operational state	OpenBus	Decouples producer and consumers and supports event-driven automation.
Interactive browser/device stream	WebSocket/WebRTC	Low-latency bidirectional session or media delivery.
Large artifact/evidence	OpenFiles/object storage	Avoids overloading messages while preserving metadata and access control.
Semantic query/constraint	SPARQL/RDF/SHACL	Queries meaning and relationships independently of application schemas.
High-rate radio/sensor samples	Local/edge stream plus derived products	Keeps raw bandwidth near processing and shares actionable results.

Boundary rule

Every integration should define ownership, schema, semantic type, authentication, authorization, time basis, error behavior, retry/idempotency, rate/size limits, retention and observability. A working URL alone is not an integration contract.

---

Maintainer Notes

Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.