§ 01 / DefinitionWhat KBIQ is
A knowledge base is usually treated as a bucket: text goes in, similar text comes out. That model breaks the moment more than one kind of writer can reach it. A vendor manual, an engineer's verified runbook, and a note an agent wrote after reading something on a host are not the same kind of object — but a bucket ranks them identically.
KBIQ is the corrective. It is a standalone service, reached over MCP, that stores documents alongside a structured account of where each one came from and how far it has earned the right to be believed. The runtime consults it; it is not embedded in the runtime. That separation is deliberate: knowledge storage is a large amount of machinery, and a smaller kernel is a more auditable kernel.
§ 02 / ModelFour independent facets
Every document carries four orthogonal classifications. They are independent on purpose — a document can be highly authoritative and highly perishable, or informal and permanent, and collapsing those into one "quality" score loses the distinction that matters at retrieval time.
| Facet | What it records |
|---|---|
| authority | How much this should be believed — vendor-authoritative, internal-curated, field-verified, unverified-draft, unknown. Rises only via evidence or human confirmation; never self-declared. |
| provenance | Where it came from — vendor-delivered, internal-authored, auto-generated, session-captured. Assigned by the write gate from the writer's identity, never read from the document. |
| form | What kind of knowledge it is — declarative, procedural, diagnostic, experiential, structured data, source. |
| durability | How it ages — version-independent, version-tied, time-decaying, living. A fact with a shelf life is marked as one. |
The axes are domain-neutral. Only a given corpus's defaults are domain-specific, and those live in that corpus's collection map — not in the core.
§ 03 / GovernanceReads go direct. Writes cross the gate.
The two operations carry completely different risk, so they are governed differently rather than uniformly.
- A stale or irrelevant search hit is a quality problem, not a security one. Forcing every lookup through the governance kernel would couple each read to it for no safety benefit.
- Retrieval stays cheap, so agents consult memory freely — which is the behaviour you want.
- Poisoning a shared corpus is a genuine attack. A corpus is only as trustworthy as its dirtiest writer, so the dangerous operation gets the strong gate.
- Remote write capability is disabled outright. External callers receive read scopes only; there is exactly one privileged writer, and it is the governance kernel's handler.
- Every write is capability-checked, injection-scanned, and recorded on the tamper-evident audit chain before it is committed.
The invariant that makes this hold is structural rather than procedural: if a second write path exists, the guarantee collapses. So there is one, and it crosses the gate.
§ 04 / TrustTrust is assigned, and it only ratchets up
This is the part that does the real work. Two rules, both enforced at the gate:
An agent therefore cannot label its own note vendor-delivered to skip
scrutiny. Correspondingly, a document enters at the authority floor for
its lane — an agent-written note enters as unverified-draft — and can
only rise: to field-verified when evidence attests it worked
in the real environment, to internal-curated when a human confirms it.
The consequence is worth stating plainly. If an agent is compromised by something it read on a machine it was inspecting, its worst case is a quarantined draft that never gets confirmed — not a trusted lie sitting beside the vendor documentation. Field knowledge still gets captured; it just has to earn its standing.
§ 05 / RetrievalHybrid search, reranked, behind a swappable seam
Retrieval combines a dense vector signal with a lexical one and fuses the two rankings, then applies a cross-encoder reranker as a precision stage over the fused candidates. Governance is not a post-filter bolted on afterwards — a document's facets participate in ranking, so an unverified draft does not outrank a vendor manual merely by being lexically closer to the query.
Underneath, the storage engine sits behind a narrow Store interface:
search, fetch, ingest. The engine is genuinely swappable — a full-text index for a
small local corpus, a vector store for a large one — without touching the
governance layer or the retrieval policy above it. That boundary is the
point. If a storage detail ever surfaces in a governance decision, the seam has
leaked.
§ 06 / DefenseHostile content is assumed, not hoped against
Anything an agent read on a host it was inspecting may be adversarial. KBIQ therefore scans at the write path rather than trusting the reader, using the same shared pattern set the runtime uses on its own read path — one contract, so the two cannot drift and route poison through the weaker side.
Content that trips the scanner is quarantined rather than flagged. A flag is advice; a quarantine is a state. Quarantined content is not retrievable above draft standing, and the detection is re-emitted onto the runtime's tamper-evident audit chain as a first-class event — so an ingest attempt is forensically visible even though it never became readable knowledge.
§ 07 / ShapeA neutral core, with packs on top
KBIQ ships no curated content and makes no domain assumptions. Three layers, with the boundary enforced rather than encouraged:
- Core — search, documents, collections, the governance and social layer, auth, facets, chunking. Knows nothing about any specific corpus.
- Store — the engine behind the
Storeinterface (§05). - Packs — domain-specific tools and collections that register through the core's seam. A pack cannot bypass the core's auth, audit, or facet model; it registers through them.
The first pack covers an IBM i / ICOMS corpus — error lookup, deliveries, catalog, source. Any other domain layers on the same way, which is the test that the core is actually neutral rather than merely described that way.
§ 08 / BoundariesWhat KBIQ is not
- Not a vector database. The vector store is an implementation detail behind a seam. The product is the governance model on top of it.
- Not a general document store. Everything written carries provenance and an authority floor. If you want a bucket, this will feel like friction — that friction is the feature.
- Not the authority. KBIQ owns storage mechanism; the runtime owns authorization. It enforces its own read scopes, but the decision to permit a write is made at the gate, not here.
- Not a truth oracle. Facets record how a document earned its standing, not whether it is correct. Trust is traceable, not guaranteed.