docs: Cognitive Security manifesto and threat taxonomy v1

[BrianCLong]

Docs-only extraction from #23637. Skipped lockfile/workflow changes that conflicted.

Adds the foundational category documents for Summit Cognitive GTM positioning.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Added Cognitive Security Manifesto defining framework concepts including verification, epistemic integrity, and graph-based grounding approaches.
  • Added Cognitive Security Threat Taxonomy v1 with four canonical failure classes and example scenarios for cognitive security validation.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3803667a-049a-40bf-9b1e-92973f3762c4

📥 Commits

Reviewing files that changed from the base of the PR and between 891ad57 and fd5ddc0.

📒 Files selected for processing (2)

• docs/cognitive-security/manifesto.md
• docs/cognitive-security/threat-taxonomy-v1.md

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

---

Walkthrough

Two new documentation files introduce cognitive security concepts, including a manifesto reframing AI safety around structural integrity of machine reasoning and a threat taxonomy classifying four canonical failure modes. No functional code is modified.

Changes

Cohort / File(s)

Summary

Cognitive Security Documentation docs/cognitive-security/manifesto.md, docs/cognitive-security/threat-taxonomy-v1.md

Added two documentation files defining cognitive security paradigm: manifesto introducing "cognitive security" concept with emphasis on admissibility gates, epistemically sound provenance, and deterministic cognitive constraints; threat taxonomy classifying four canonical failure modes (Corrupted, Non-Compliant, Non-Reproducible, Non-Admissible Cognition) with definitions, sub-types, and practical examples.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 Hops with glee through cognitive gates,
Where reasoning finds firmer fates,
A manifesto crisp and clear,
Threat taxonomies sincere,
Security thoughts in docs we've penned,
On safer AI paths to wend! 🔐✨

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch pilot/cognitive-security-docs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request introduces the Cognitive Security Manifesto and the initial version of the Cognitive Security Threat Taxonomy. The review feedback suggests refining terminology for consistency: replacing 'intentionally hallucinated' with 'maliciously crafted' to better reflect malicious intent, and standardizing the terminology around 'quarantine' instead of 'rejection' to align with the framework's core pillars. Additionally, the review recommends updating internal references to 'Admissibility Gate' for better documentation cohesion.

[gemini-code-assist]

The phrase "intentionally hallucinated" is conceptually contradictory. Hallucinations in the context of AI are typically stochastic, unintentional errors in reasoning or grounding. If a third-party API is providing deceptive data specifically to exploit a system, it is more accurately described as "maliciously crafted" or "poisoned" data, which aligns better with the definition of "Corrupted Cognition" provided in this section.

Suggested change

	* A third-party API dependency returns intentionally hallucinated JSON that exploits the parser's loose schema, causing downstream logic errors in an autonomous agent.
	* A third-party API dependency returns maliciously crafted JSON that exploits the parser's loose schema, causing downstream logic errors in an autonomous agent.

[gemini-code-assist]

To maintain consistency with the "Quarantine and Subsumption" pillar defined in the Cognitive Security Manifesto (line 41), the result of an admissibility failure should be described as "quarantine" rather than "rejection". This reinforces the framework's emphasis on isolating and analyzing failures rather than simply dropping them.

Suggested change

	Occurs when the output fails structural, schema, or relational validation checks defined by the Cognitive Security Protocol (CSP), resulting in the rejection of the data packet by the Admissibility Gates.
	Occurs when the output fails structural, schema, or relational validation checks defined by the Cognitive Security Protocol (CSP), resulting in the quarantine of the data packet by the Admissibility Gates.

[gemini-code-assist]

The term "WriteSet firewall" is introduced here without being defined or mentioned in the Manifesto. For terminological consistency across the documentation, this should refer to the "Admissibility Gate". Additionally, using "quarantined" instead of "rejected" aligns with the core pillars of the Cognitive Security posture.

Suggested change

	* An agent outputs a JSON response missing a required evidence ID field, causing the data to be rejected by the WriteSet firewall.
	* An agent outputs a JSON response missing a required evidence ID field, causing the data to be quarantined by the Admissibility Gate.