Vault-LD
Brain spec
First committed by dfreytag
Published in The-Knowledge-Graph-Guys/vault-ld. Publisher page
246 GitHub stars
What it is
Vault-LD: an open spec for Markdown vaults as linked data. YAML-LD frontmatter + a shared `@context` = an RDF knowledge graph. Prose for humans and LLMs, triples for machines.
AutoGineer overview, from the brain’s own files
Vault-LD provides a standardized way to bridge human-readable Markdown notes with machine-readable RDF knowledge graphs. By utilizing YAML-LD in the frontmatter of Markdown files and a shared context, it allows for a seamless roundtrip between prose and structured data. This enables AI agents and other systems to reason over a vault's contents as a graph while maintaining a format that remains easy for humans to edit and version control in Git. The specification includes reference tools for exporting vaults to RDF and ingesting RDF into vault structures, ensuring full fidelity in both directions.
How it works
Memory model: LLM wiki
AutoGineer overview, from the brain’s own files
Vault-LD organizes information in a folder-based structure of Markdown files. Each file uses YAML-LD frontmatter to define its properties and relationships, which are resolved against a shared context file. The system uses reference scripts to convert these Markdown files into RDF triples (schema and data layers) and vice versa, allowing the vault to function as both a human-editable wiki and a structured knowledge graph.
| Folder | Role | Files |
|---|---|---|
| .github | agent-config | 11 |
| docs | docs | 39 |
| images | attachments | 3 |
| scripts | scripts | 7 |
| Vault-LD Example | folder | 14 |
The agent writes
- .github/ evidence: AGENTS.md
Requirements
Works with: OpenAI Codex, GitHub Copilot, Cursor, Kiro, OpenCode, Amp, Cline, JetBrains Junie, Devin (ex-Windsurf)
Set it up
Clone the repository at the commit AutoGineer scanned:
git clone https://github.com/The-Knowledge-Graph-Guys/vault-ld.git && cd vault-ld && git checkout 025e71be8d810e387dc451c920e05472d1c47170Point Claude Code at AGENTS.md: it does not read that file on its own.
cd vault-ld && claude
AutoGineer scanned these files at commit 025e71b.
First committed by dfreytag. Published in The-Knowledge-Graph-Guys/vault-ld. Licence: Apache License 2.0.
Usage
AutoGineer overview, from the brain’s own files
- Defining business semantics and ontologies within a Markdown-based wiki.
- Enabling AI agents to perform graph-based reasoning over local note collections.
- Synchronizing external RDF data sources with a human-friendly Markdown vault.
- Maintaining a version-controlled knowledge base that is simultaneously readable by humans and machines.
- “List all recipes in the vault that require chickpeas.”
- The agent queries the RDF graph derived from the Markdown frontmatter to identify all notes with type 'Recipe' and 'requiresIngredient' set to 'Chickpeas'.
- “Update the prep time for the Hummus recipe to 30 minutes.”
- The agent modifies the 'prepTimeMinutes' field in the YAML frontmatter of the Hummus.md file, ensuring the change is reflected in both the prose and the underlying knowledge graph.
Documentation by dfreytag
<div align="center">
<picture> <source media="(prefers-color-scheme: dark)" srcset="images/logo-dark.svg"> <img src="images/logo-light.svg" alt="Vault-LD logo" width="140"> </picture>
Vault-LD
An open format for knowledge that two very different readers can share at once:<br>a person editing notes, and a machine reasoning over a graph.
Image: CI Image: Release Image: Docs Image: License Image: GitHub stars Image: Issues Image: Contributions welcome
Specification · Docs site · Example vault · Contributing
</div>
RDF in the Vault
Karpathy's "LLM wiki" idea points at something real: a directory of plain Markdown notes is one of the most powerful ways to work with LLMs. It is readable by you, chunkable by a model, and diffable in git, with no database required. The YAML frontmatter at the centre of this approach carries a hidden pattern: it can map onto YAML-LD (JSON-LD with a YAML serialization). Resolve that frontmatter through one shared context and your notes stop being tagged text. They become linked data.
This matters for anyone already invested in RDF-based ontologies. Your business semantics (your classes, properties, and controlled vocabularies) drop straight into the wiki your team already uses, much as schema.org gave web pages a shared vocabulary without asking authors to leave HTML. The benefit runs both ways: business semantics arrive inside the wiki, and the ontology gains a human-friendly surface, where classes and properties can be read and edited as notes rather than as raw Turtle.
Both directions work because of the roundtrip. Since the frontmatter is YAML-LD, a note and an ontology definition are the same kind of object, and either can be projected losslessly to RDF and back. An ontology can enter as Turtle, be edited as Markdown, and leave as Turtle again, or the reverse, with no canonical "real" form privileged over the other.
What's here
SPEC.md: the normative reference. It defines how frontmatter becomes a knowledge graph (§4) and how any RDF graph round-trips through the vault format with full fidelity (§5), along with terminology, directory structure, conformance criteria, and a compatibility profile for lifting OKF-style Markdown bundles into linked data (Appendix B).
Vault-LD Example/: a complete, copyable vault that demonstrates every rule in the spec. It holds one ontology (Culinary), one controlled vocabulary (Difficulty Levels), and one instance (hummus). Its rootcontext.jsonldcomposes the Culinary ontology's own context, showing how multiple contexts compose (SPEC §4.2).scripts/vault_to_rdf.py: a reference exporter that projects a vault to RDF — see Exporting to RDF below.scripts/rdf_to_vault.py: the reference ingester running the other way, RDF → vault — see Ingesting RDF below. Together the two tools close the roundtrip.
Exporting to RDF
The repo ships scripts/vault_to_rdf.py, a small Python tool that reads a vault and emits Turtle, split by layer into two files:
schema.ttl— the schema layer (classes, properties, concepts), each ontology in its own namespace (cul:,diff:, …),data.ttl— the instance layer (typed notes) under the vault base, each IRI minted from the note's vault-relative path.
It classifies each note by its folder, mints each subject under the @base of its governing context (schema notes from their file name, instances from their vault-relative path — SPEC §4.5), resolves frontmatter through the vault's composed @context, and flags anything it can't map rather than dropping it. Export the example vault to build/ in one line:
pip install rdflib pyyaml && python scripts/vault_to_rdf.py "Vault-LD Example" --out-dir buildSee EXPORT.md for the full usage guide, flags, and how layer classification and context composition work.
Ingesting RDF
The reverse direction, scripts/rdf_to_vault.py, projects any RDF graph into the vault format (SPEC §5.5) — one note per subject, hierarchy in frontmatter, IRI objects as wiki links. Point it at an existing vault and it updates notes in place, preserving bodies, tags:, and folder structure, and leaving unchanged notes untouched; point it at an empty directory and it builds the whole vault, synthesizing a composed context.jsonld when none exists. Predicates the context doesn't map get a short name coined and added to the right context document; anything the format can't express (blank nodes, language tags) is flagged, never dropped (SPEC §5.6). Import a foreign ontology in one line:
python scripts/rdf_to_vault.py MyVault foreign-ontology.ttlSee INGEST.md for the full usage guide and the fidelity rules. Because the two tools are inverses, vault → RDF → vault is a no-op and RDF → vault → RDF is graph-isomorphic.
A taste
Read this note:
---
type: "[[Recipe]]"
requiresIngredient: "[[Chickpeas]]"
prepTimeMinutes: 25
---
# Hummus
A smooth purée of chickpeas, tahini, lemon, and garlic.You have just read these triples:
@prefix : <https://example.org/> .
:Hummus a :Recipe ;
:requiresIngredient :Chickpeas ;
:prepTimeMinutes 25 .The frontmatter is the graph; the body is prose for human and machine readers. One shared context.jsonld supplies the IRIs, datatypes, and prefixes, so authors write short, clean names while the semantics are supplied for them. See the Vault-LD Specification for the full rules.
Contributing
Vault-LD is an open standard and contributions are welcome: see CONTRIBUTING.md. Spec changes start life as an issue using the Spec change proposal template; fixes to the reference tools, example vault, and docs can go straight to a pull request.
License
<div align="center">
If Vault-LD is useful to you, a ⭐ on GitHub helps others find it.
</div>
docs/versioned_docs/version-0.3.0/SECURITY.md
Security Policy
Reporting a vulnerability
Please report suspected vulnerabilities privately via GitHub Security Advisories rather than opening a public issue. We will acknowledge reports as quickly as we can and coordinate a fix and disclosure with you.
Trust model
Vault-LD is a format for sharing knowledge, so the reference tooling treats both sides of the roundtrip as untrusted input:
A vault may be cloned from anywhere. Its notes, frontmatter, and
context.jsonlddocuments are attacker-controllable content.An RDF file to be ingested may come from a foreign ontology. Every triple in it — including
vld:pathplacement hints — is attacker-controllable content.
The reference scripts (scripts/vault_to_rdf.py, scripts/rdf_to_vault.py)
therefore guarantee:
No network I/O. Export refuses to fetch remote
@contextdocuments; ingest disables outbound requests for the whole process before parsing, so hostile RDF cannot trigger remote fetches (SSRF). Ingest accepts an explicit opt-out,--unsafe-allow-network, for RDF that references public contexts you have verified as trustworthy (e.g. schema.org's) — a fetched document shapes how every triple is interpreted, so the flag prints a warning banner and pauses for five seconds before proceeding, giving you a window to cancel with Ctrl-C. Never use it on RDF from a source you do not trust.Reads and writes stay inside the vault. Context references,
vld:pathplacement hints, and copied context files are rejected if they are absolute, contain.., or resolve outside the tree they belong to. Notes reached through symlinks are skipped.Bounded parsing. Frontmatter is parsed with a YAML SafeLoader variant that additionally refuses aliases (no "billion laughs" expansion) and is capped at 1 MiB per note — the cap binds before the file is read into memory, so an oversized note cannot exhaust it either.
context.jsonlddocuments are capped at 4 MiB, and malformed frontmatter, undecodable notes, or unparseable context JSON skip the input instead of aborting the sweep (an unusable root context is a hard error — it decides where subjects mint — and is never overwritten).No frontmatter injection. Every generated YAML key and value is either verified to re-parse to exactly itself or emitted quoted, so a hostile IRI localname (a newline, a
:) becomes inert data, never an extra frontmatter line. File stems derived from IRI localnames additionally strip path separators, control characters, and leading dots (..is a path step, not a name), and every note write is re-checked against the vault root before it happens.No code execution surface. The tools never invoke
eval,exec,pickle, or a shell on vault or RDF content.
Anything rejected under these rules is reported as a warning — refused input fails closed, never silently clamped to a different location.
Regression testing
Each guarantee above is pinned as an executable test in
scripts/test_security.py (run with make test), and CI runs the suite on
every push and pull request — a change that weakens a patch fails CI before
it reaches review. New security fixes must land with their exploit added to
that suite. The CI workflow itself runs with a read-only token and pins its
actions to full commit SHAs.
Dependencies
scripts/requirements.txt pins exact versions. When bumping, review the
rdflib and PyYAML changelogs/advisories — in particular, ingest relies on
network access staying disabled regardless of rdflib's own remote-fetch
defaults.
Supported versions
Security fixes land on main. Use the latest release of the spec and
tooling.
85 files · 5 not served here
- .github/.release-please-manifest.json
- .github/CHANGELOG.md
- .github/CODEOWNERS
- .github/ISSUE_TEMPLATE/bug-report.md
- .github/ISSUE_TEMPLATE/spec-change.md
- .github/PULL_REQUEST_TEMPLATE.md
- .github/release-please-config.json
- .github/workflows/ci.yml
- .github/workflows/pages.yml
- .github/workflows/pr-check.yml
- .github/workflows/release.yml
- .gitignore
- AGENTS.md
- ATTRIBUTION.md
- CODE_OF_CONDUCT.md
- CONTRIBUTING.md
- HISTORY.md
- LICENSE
- Makefile
- README.md
- SECURITY.md
- SPEC.md
- Vault-LD Example/Ingredients/Chickpeas.md
- Vault-LD Example/Ontologies/Culinary/Classes/CreativeWork.md
- Vault-LD Example/Ontologies/Culinary/Classes/Ingredient.md
- Vault-LD Example/Ontologies/Culinary/Classes/Recipe.md
- Vault-LD Example/Ontologies/Culinary/Culinary.md
- Vault-LD Example/Ontologies/Culinary/Properties/prepTimeMinutes.md
- Vault-LD Example/Ontologies/Culinary/Properties/requiresIngredient.md
- Vault-LD Example/Ontologies/Culinary/context.jsonld
- Vault-LD Example/Recipes/hummus.md
- Vault-LD Example/Vocabularies/DifficultyLevels/Beginner.md
- Vault-LD Example/Vocabularies/DifficultyLevels/DifficultyLevels.md
- Vault-LD Example/Vocabularies/DifficultyLevels/NoCook.md
- Vault-LD Example/Vocabularies/DifficultyLevels/context.jsonld
- Vault-LD Example/context.jsonld
- docs/assemble.mjs
- docs/docusaurus.config.js
- docs/package-lock.json
- docs/package.json
- docs/sidebars.js
- docs/src/css/custom.css
- docs/src/theme/NotFound/Content/index.js
- docs/static/CNAME
- docs/static/img/favicon.svg
- docs/static/img/social-card.png (not served here)
- docs/static/robots.txt
- docs/versioned_docs/version-0.3.0/CONTRIBUTING.md
- docs/versioned_docs/version-0.3.0/HISTORY.md
- docs/versioned_docs/version-0.3.0/SECURITY.md
- docs/versioned_docs/version-0.3.0/SPEC.md
- docs/versioned_docs/version-0.3.0/images/Vault-LD.png (not served here)
- docs/versioned_docs/version-0.3.0/images/logo-dark.svg
- docs/versioned_docs/version-0.3.0/images/logo-light.svg
- docs/versioned_docs/version-0.3.0/index.md
- docs/versioned_docs/version-0.4.0/CONTRIBUTING.md
- docs/versioned_docs/version-0.4.0/HISTORY.md
- docs/versioned_docs/version-0.4.0/SECURITY.md
- docs/versioned_docs/version-0.4.0/SPEC.md
- docs/versioned_docs/version-0.4.0/images/Vault-LD.png (not served here)
- docs/versioned_docs/version-0.4.0/images/logo-dark.svg
- docs/versioned_docs/version-0.4.0/images/logo-light.svg
- docs/versioned_docs/version-0.4.0/index.md
- docs/versioned_docs/version-0.5.0/CONTRIBUTING.md
- docs/versioned_docs/version-0.5.0/HISTORY.md
- docs/versioned_docs/version-0.5.0/SECURITY.md
- docs/versioned_docs/version-0.5.0/SPEC.md
- docs/versioned_docs/version-0.5.0/images/Vault-LD.png (not served here)
- docs/versioned_docs/version-0.5.0/images/logo-dark.svg
- docs/versioned_docs/version-0.5.0/images/logo-light.svg
- docs/versioned_docs/version-0.5.0/index.md
- docs/versioned_sidebars/version-0.3.0-sidebars.json
- docs/versioned_sidebars/version-0.4.0-sidebars.json
- docs/versioned_sidebars/version-0.5.0-sidebars.json
- docs/versions.json
- images/Vault-LD.png (not served here)
- images/logo-dark.svg
- images/logo-light.svg
- scripts/EXPORT.md
- scripts/INGEST.md
- scripts/compare_builds.py
- scripts/rdf_to_vault.py
- scripts/requirements.txt
- scripts/test_security.py
- scripts/vault_to_rdf.py
Advantages
- Enables lossless roundtripping between Markdown notes and RDF graphs. evidence: README.md
- Allows business semantics to be edited as human-friendly Markdown rather than raw Turtle. evidence: README.md
- Supports composition of multiple contexts for complex knowledge modeling. evidence: README.md
Limitations
- Requires adherence to specific YAML-LD frontmatter and context structures. evidence: README.md
- Certain RDF features like blank nodes or language tags may require specific handling or flagging. evidence: README.md
Security
Risk level: Low risk
This brain runs
Agent instructions that run or fetch something (3)
AGENTS.md:This is the repo's institutional memory, and it is load-bearing: contributors are expected to point their own agent at HISTORY.md (plus `git log`) to produce commits and PRs that match this repo's standards.AGENTS.md:**Security guarantees are pinned as tests** (`scripts/test_security.py`, run via `make test` in CI).AGENTS.md:**`make test` and `make roundtrip` must be green** before proposing a change.
- Low risk: network-instructions (Makefile:38)
Attribution and licence
- First committed by
dfreytag
- Publisher
- The Knowledge Graph Guys (Community)
- Source
- The-Knowledge-Graph-Guys/vault-ld · commit 025e71b
- Licence
- Apache License 2.0 (files served here)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
- Contributors
- C-HORNB, dfreytag, roelofsmn, tonyseale
AutoGineer is not affiliated with or endorsed by dfreytag or The Knowledge Graph Guys.
Install from source
5 of its files are not served here, so there is no ZIP. The-Knowledge-Graph-Guys/vault-ld at 025e71b