The cognitive ontology is the foundational data architecture of every Seithar instance. It provides the persistent, versioned, queryable state layer upon which all platform modules operate. Shield reads from it. Sword writes to it. The identity resolver populates it. The strategy engine queries it. No module owns state independently; the ontology is the single source of truth. This design principle, referred to internally as "the platform is the state," ensures that every component of the Seithar platform operates on a consistent, auditable representation of the information environment.
The ontology defines six primary entity types and one meta-entity type. All entities carry creation timestamps, modification histories, confidence scores, and provenance chains linking them to the observations from which they were derived.
Actors. Any entity capable of decision-making: a human individual, an organization, an autonomous agent, a bot network. Actors are the subjects and targets of cognitive operations. Each actor entity contains an Actor Behavioral Profile (ABP) constructed by the identity resolver. Actors exist on a spectrum of resolution confidence, from fully identified (government name, biometric data, complete network map) to partially resolved (behavioral signature only, no attribution).
Narratives. Coherent belief structures that propagate through information environments. A narrative entity captures the content of the belief, its provenance, its current reach, its mutation history, and its relationship to other narratives. Narratives are tracked as living objects; they evolve, merge, fragment, and die. The EvolutionTracker subsystem monitors narrative mutation rates and identifies adversarial narrative injection.
Networks. Graph structures representing relationships between actors. Networks encode trust edges, communication channels, influence hierarchies, and coordination patterns. The ontology stores both observed networks (empirically mapped from platform data) and inferred networks (projected from behavioral correlation). Network entities are the substrate for Sword's multi-agent attack topology calculations and Shield's coordinated inauthentic behavior detection.
Threats. Identified or suspected cognitive attacks against protected entities. A threat entity records the attacker (if known), the target, the classified SCT techniques, the estimated kill chain stage, the Shield signal scores that triggered detection, and the current status (active, mitigated, dormant). Threats link to the actors and narratives involved in the attack.
Operations. Planned or active Sword engagements. An operation entity defines objectives, target actors, selected techniques, resource allocations, timelines, and success metrics. Operations link to the threats they counter and the measurements that track their effects.
Observations. Raw data ingested from the information environment: social media posts, communications intercepts, platform API responses, sensor readings, analyst reports. Observations are the evidentiary foundation of the ontology. Every actor, narrative, network, and threat entity traces back to observations through provenance chains.
Measurements. Quantified outcomes of operations and threat mitigations. Measurements record what changed in the information environment as a result of Seithar activity: narrative reach shifts, actor behavioral changes, network topology alterations, threat score movements. The live measurement subsystem feeds measurements back into the strategy engine, closing the operational loop.
Every entity in the ontology is versioned. Modifications produce new versions rather than overwriting existing state. The ontology supports point-in-time queries: any module can request the state of any entity at any historical timestamp. Full rollback restores the entire ontology to a previous state. Versioning enables post-operation analysis (what did we know, and when), forensic investigation (how did a threat develop), and counterfactual reasoning (what would Shield have detected if configured differently). The version history is append-only and tamper-evident.
Inter-module communication in Seithar flows through the FeedbackBus, a publish/subscribe event system built on the ontology. When any entity is created, modified, or deleted, the FeedbackBus emits an event. Modules subscribe to entity types and event classes relevant to their function. Shield subscribes to threat events and actor modifications. Sword subscribes to operation measurements and threat escalations. The identity resolver subscribes to new observations. The FeedbackBus decouples modules from each other while maintaining coherent state: no module polls the database, and no module pushes data to another module directly. Events carry full entity snapshots, so subscribers receive the data they need without additional queries.
The ontology implements schema-per-tenant isolation. Each operational deployment of Seithar maintains its own complete ontology schema within a shared database infrastructure. Tenant schemas are cryptographically isolated; no query can cross tenant boundaries without explicit cross-tenant authorization. This architecture supports multiple simultaneous operations for different clients, each with independent state, independent access controls, and independent audit trails. The schema-per-tenant model also enables controlled data sharing between tenants through federation protocols when operational requirements demand it.
The persistent ontology stores in PostgreSQL. Latency-sensitive state lives in a Redis layer that mirrors active threats, live kill chain positions, and current operation parameters. The Redis layer provides sub-millisecond reads for Shield's continuous monitoring loop and Sword's real-time engagement decisions. Write-through caching ensures the Redis layer and the persistent store remain consistent. When a threat transitions from active to dormant, its Redis representation is evicted and subsequent queries hit the persistent store. The Redis layer also maintains the FeedbackBus message queues, ensuring event delivery even under high-throughput conditions during active operations.
The cognitive ontology is not a database with an API. It is the operational memory of a cognitive warfare platform. Every decision Seithar makes, every threat it detects, every operation it executes is grounded in ontology state. The design reflects a deliberate architectural choice: state management is not a supporting function but the central capability. The platform is the state.