IOU Architecture Documentation

Welcome to the comprehensive documentation for the IOU Architecture Framework and the RONL ecosystem.

---

What is this?

What is IOU Architecture?

The Information Architecture Framework for IOU integrates semantic web technologies, decision models, and Dutch government standards into a unified system for managing regulatory compliance and spatial planning.

IOU Architecture — interactive overview of the ecosystem components and their relationships

---

Architecture Overview

graph TB
    subgraph "IOU Architecture Ecosystem"
        A[Municipality Portal<br/>React] -->|OIDC/JWT| B[Keycloak IAM]
        B -->|Validated Token| C[Business API<br/>Node.js]
        C -->|REST| D[Operaton BPMN<br/>Business Rules]

        E[CPSV Editor<br/>React] -->|TTL| F[TriplyDB<br/>Knowledge Graph]
        E -->|DMN Files| D

        F -->|SPARQL| G[Orchestration Service<br/>Node.js]
        G -->|Deploy BPMN+DMN| D
        G -->|asset storage| K[PostgreSQL<br/>lde_assets]

        H[Linked Data Explorer<br/>React] -->|API Calls| G
        H -->|Direct SPARQL| F

        I[CPRMV API<br/>Python/FastAPI] -->|XML download| J[BWB / CVDR / CELLAR]
        I -->|cprmv-json / RDF| F
        I -->|cprmv-json / RDF| H
    end

---

Ecosystem Components

⚙️ RONL Business API

The core business API layer that provides secure authentication and process orchestration for Dutch government services.

Live App: mijn.open-regels.nl

View Documentation →

🖍️ Norm Editor

Vue/Quasar application for creating FLINT interpretations of legal sources: load a normative text, annotate fragments, and build Fact, Act, and Claim-duty frames that export to RDF in TriplyDB. Backed by NLP, unwrap, and wrap-up services.

View Documentation →

✏️ CPSV Editor

React-based application for creating CPSV-AP 3.2.0 compliant RDF/Turtle files for Dutch government services.

Live App: cpsv-editor.open-regels.nl

View Documentation →

🔍 Linked Data Explorer

Web application for SPARQL queries and BPMN & DMN orchestration with TriplyDB integration.

Live App: linkeddata.open-regels.nl

View Documentation →

📜 CPRMV API

Python/FastAPI service that fetches individual rules from Dutch and European legal publications on the fly, transforming them to CPRMV-structured RDF. Implements the Core Public Rule Management Vocabulary standard and hosts the CPRMV specification.

Live App: cprmv.open-regels.nl/docs

View Documentation →

---

Technology Stack

The IOU Architecture ecosystem is - apart from TriplyDB and eDOCS - built entirely on open source technologies:

Component	Technology	License
IAM	Keycloak	Apache 2.0
BPMN Engine	Operaton	Apache 2.0
Backend	Node.js + Express	MIT
Frontend	React	MIT
Database	PostgreSQL	PostgreSQL License
Cache	Redis	BSD 3-Clause
Reverse Proxy	Caddy	Apache 2.0
Knowledge Graph	TriplyDB	-
Document Mngmnt	eDOCS	-
Rule API	Python / FastAPI	EUPL-1.2

---

Standards Compliance

• CPSV-AP 3.2.0 - EU Public Service Vocabulary
• CPRMV - Core Public Rule Management Vocabulary
• RONL - Dutch Rules Vocabulary
• BIO - Baseline Informatiebeveiliging Overheid
• NEN 7510 - Healthcare information security
• AVG/GDPR - Data protection

---

What is the state of it?

Documentation Status

Loading documentation status…

---

🆕 What's New

• ⚙️ RONL Business API — v2026.08.33 · August 2026

  ---

  A public cockpit, the fork deleted, and a pipeline that can no longer float

  The Public Affairs cockpit now runs publicly on demonstration data with no sign-in and no backend — enforced by a Content-Security-Policy and a build-time bundle gate, because a negative guarantee is exactly the kind that passes vacuously when wrong. Built first as a deliberate vendored copy so the seam could be found by construction, it then became @ronl/pa-cockpit and the 44-file fork was deleted. Meanwhile the pipeline went from 49 supply-chain findings to zero: every action pinned to a digest, the token scoped to least privilege, and a blocking audit gate that a pull request cannot get past — on acc, not yet on main.

  Full changelog

• 🖍️ Norm Editor — v2026.07.0 · July 2026

  ---

  First tagged release: SSR removed, SPA routing

  The Norm Editor now cuts version-tagged releases with a generated changelog. This first tag removes the Quasar SSR server in favour of a plain SPA with client-side routing across six pages, restyles the in-app changelog viewer, and backports graph-processing internals, wrap-up-api updates, and UI styling from the TNO mirror.

  Full changelog

• ✏️ CPSV Editor — v2026.08.3 · August 2026

  ---

  The supply-chain gate gets teeth

  Every action a pipeline runs is now pinned to a commit digest, GITHUB_TOKEN is scoped down, and a blocking supply-chain audit took the repository from 16 findings to zero. A branch ruleset turns that from reporting into enforcement: acc requires a pull request and a passing audit, with no bypass actors — so releases now land through a pull request too, and a postcss advisory became the first end-to-end proof that the no-cooldown security lane bypasses the 14-day cooldown exactly where it should. This repository is the pilot; ronl-business-api has since followed.

  Full changelog

• 🔍 Linked Data Explorer — v2026.08.9 · August 2026

  ---

  The R2.2 bundle, and a Renovate that had quietly stopped

  The R2.2 VO bundle lands — four lanes, nine user tasks, nine forms and five document templates — with one deliberate deviation from its source drawing, because two hand-offs leave the pool and never return, which as control flow deadlocks at the join. A new parity test locks each bundle's authored and mirrored copies together after they had already drifted. Meanwhile the supply-chain gate took the pipeline from 40 findings to zero — and immediately exposed that Renovate had been raising nothing at all: five "//" keys used as JSON comments were read as invalid settings, so the half of the policy that keeps pins current had been inert since the day it landed.

  Full changelog

• 📜 CPRMV API — v0.4.1 · June 2026

  ---

  CPRMV 0.4.1 conformance & reference resolution

  RuleSets are now FRBR Works (frbroo:F1_Work); /ref auto-detects Juriconnect, ELI (to EU CELLAR), and CPRMV-API references; new /cellar-by-celex and /cellar-by-eli redirects; unformat works across all output formats; and the API now exposes a basic MCP server at /mcp.

  Full changelog

---

📘 How this documentation is maintained

Components differ in how fast they change, so they are documented to different depths.

Component	Cadence	User Guides
RONL Business API	Short-cycle, co-designed with users	Landing page and a brief page per board on ACC; full guides when a board reaches PROD
CPSV Editor	Release-tagged	Full
Linked Data Explorer	Release-tagged	Full
Norm Editor	Release-tagged	Full
CPRMV API	Spec-driven	Full

Features, Developer Docs and References follow the same pattern for every component.

---

How do I work on it?

Development Workflow

• Design — for features where the UX is substantial, work starts in Claude Design; small changes skip straight to implementation.
• Handoff — a finished design leaves as a briefing package for the next stage, not as code.
• Implementation — happens in Claude Code, following red/green TDD: a failing test first, then the minimum code needed to pass it.
• Release — each of the application repositories cuts its own release with a versioning command tailored to its changelog.
• Documentation — once a component ships, these docs are brought back into sync with it.

Development Workflow →

Not part of the core team? Start from the Contributing Guide instead.

---

Contributing

We welcome contributions! See the Contributing Guide for details.

---

Quick Links

Resource	Link
CPSV Editor	cpsv-editor.open-regels.nl
Linked Data Explorer	linkeddata.open-regels.nl
Backend API	backend.linkeddata.open-regels.nl
Keycloak IAM	keycloak.open-regels.nl
Custom Business API	api.open-regels.nl
Operaton	operaton.open-regels.nl
CPRMV API	cprmv.open-regels.nl/docs

---

Documentation Version: 1.0
Last Updated: February 2026
License: EUPL v1.2