Kognita 0.7 'Trust and Resilience': governance that survives a bad day

Context

Up to 0.6, Kognita assumed its own store, keys and providers were healthy. The roadmap's resilient pillar asks for more: governance that survives outages, key compromise and supplier failure. 0.7.0 is released on PyPI and is still alpha.

Decision: evidence you can trust without trusting the host

• Optional Ed25519 signing, with kognita keys generate and evidence verify --public-key. Configured signing refuses writes without its extra. Legacy hashes are unchanged.
• Key rotation, revocation and escrow are evidenced, and signatures at or after a revocation cutoff fail closed.
• External file anchors detect a rewritten or truncated prefix. Keep anchor files in separately controlled storage.
• Evidence events carry a schema version, and kognita db migrate upgrades legacy SQLite tables in one transaction while preserving hashes.

Decision: recovery is tested, not promised

kognita backup create, verify and restore produce recovery bundles with the chain, retained bodies, holds, key registry and anchors. Restore needs a new SQLite destination and verifies before publication, and CI runs a restore drill. An optional Postgres backend adds evidence writer locking, append-only guards and forced row-level security.

Decision: suppliers are registered, and failure is governed

• A provider register holds contract details, incident history and regulatory cooperation. The gateway denies unregistered or incomplete providers with R3-UNREGISTERED before forwarding.
• A served model that differs from the card chosen at admission is refused with R7-MODEL-CHANGED.
• Failover defaults to stopping. An approved fallback card on the same registered provider gets one retry through full admission. Cross-provider targets stop for now.
• kognita deps map, check and concentration compare declared dependencies with what evidence shows, and report concentration per provider, cloud, framework, vector platform and orchestration layer.

Decision: incidents and drills leave evidence

Chain breaks, gateway outages, degraded periods and provider failures get incident timelines and verified reports, with a redacted form that shows only fixed labels and counts. kognita drill simulate runs eight offline faults against a use case and restores live state afterwards. An external review API lets a reviewer annotate and sign a fixed period of evidence.

Decision: retention follows the record class

Client communications, advice, recommendations, approvals, transactions and compliance records each carry their own retention period. Content is erased only when every class and use-case period has elapsed, and a live or unconfigured hold refuses with R11-RECORD-LIVE.

Known limits

• Store outages queue detection times in memory, so process termination can lose pending incident records.
• Network anchor sinks are future extras. Replication and Postgres role provisioning are the operator's job.

Take this with you

A control that only works on a good day is not a control. Test the restore, the failover and the key revocation before a supervisor asks.

Sources

Kognita is an open-source alpha. This note comes from Kognita PR #159, Kognita v0.7.0 release notes, Kognita CHANGELOG: 0.7.0, kognita 0.7.0 on PyPI, Kognita ROADMAP: 0.7 'Trust and Resilience' in the Kognita repository.