U.S. Provisional Patent Application No. 64/041,821, filed April 16, 2026. Non-provisional due April 16, 2027. Eight worked-example anchors are readable in the public repo today — the file paths are listed below. No competitor publishes their substrate boundary in source. Ours is open.
Most "private" apps promise not to share your data. Cognielo proves it cannot — and the proofs live in named source files anyone can open. Eight of the 23 claims have public-repo file paths anchoring them. The patent isn't a marketing vibe; it's a construction.
| Claim | Worked example | Source anchor |
|---|---|---|
| 1 | Life-management substrate · per-app HKDF AES-256-GCM eKAP keys, dot-terminated namespace invariant, MirroredCoachSnapshot Int-only enforcement | Packages/EloShared/Sources/EloShared/Models/AppIdentity.swift |
| 1.13 | Passelo zero-knowledge AutoFill · matched-subset-only return type; no full-vault leak on empty / unknown-host queries | Packages/PasseloKit/Sources/PasseloKit/PasseloStore.swiftTest: PasseloStoreTests::testClaim1_13_AutoFillReturnsMatchedSubsetOnly |
| 1.14 | Chatelo operator-blind WebRTC P2P · STUN-only, no Cognielo-controlled hosts in defaultStunServers; CI gates the build against regression |
Packages/ChateloKit/Sources/ChateloKit/Services/RatchetEngine.swift (header lines 5–62)Test: STUNOperatorBlindnessTests |
| 1.15 | Cryptelo always-free Elocoin wallet UI · ML-DSA-Dilithium signing tree distinct from per-app HKDF tree; substrate-boundary invariant | Packages/CrypteloKit/Sources/CrypteloKit/CrypteloStore.swiftelo-core/src/pq_signatures.rs (16/16 tests passing) |
| 1.22 | Muselo cross-service playback resume · catalog supportsResume: Bool drives routing; most-recent-position-wins invariant |
Packages/MuseloKit/Sources/MuseloKit/MuseloStore.swiftTest: testResumePositionMostRecentWins |
| 4.5 | CrossAppRouter primitive · IntegrationCatalogRouter consumer + JourneysImporter worked example | Packages/EloShared/Sources/EloShared/Routing/CrossAppRouter.swift |
| 7 | InsightDepthDial transparency mechanism · sample-redaction + budget-free upgrade preview | Packages/CognieloHubKit/Sources/CognieloHubKit/Views/InsightDepthDial.swift |
| 8 | Compelo .elo portable document format · signed archive with multi-recipient grants |
Packages/CompeloKit/Tests/CompeloKitTests/EloDocumentFormatTests.swift (6 unit tests) |
Canonical app roster source-of-truth: Packages/EloShared/Sources/EloShared/Models/AppIdentity.swift — 21 enum cases including eloShared utility module; 20 user-visible surfaces.
| Claim | What it covers |
|---|---|
| 1 | Life-management substrate (HKDF-AES-256-GCM per-app key separation across 20 surfaces) |
| 1.7 | Substrate-rebinding for non-destructive profile switching |
| 1.12 | Walletelo unified vault — PassItem + CredentialItem same eKAP namespace |
| 1.13 | Passelo zero-knowledge AutoFill — matched-subset-only return |
| 1.14 | Chatelo operator-blind WebRTC P2P — STUN-only, no Cognielo host |
| 1.15 | Cryptelo always-free wallet UI + ML-DSA-Dilithium signing tree |
| 1.16 | Shopelo shopping-graph-without-surveillance + Muselo extension |
| 1.17 | Shopelo geofenced local-first ranking primitive |
| 1.22 | Muselo cross-service playback resume — most-recent-wins |
| 1.25 | Multi-profile cryptographic isolation via per-profile HKDF info-binding |
| 1.26 | Hybrid post-quantum complement (NIST FIPS 203 ML-KEM-Kyber) |
| 1.27 | ML-DSA-Dilithium signing primitives bound to LLM-derived entropy |
| 1.28 | SPHINCS+ hash-based signature hybrid for long-tail forgery resistance |
| 1.30 | Profile-slot architecture — Demo + Live profiles coexist on-device, cryptographically isolated |
| 4.5 | CrossAppRouter primitive · multi-consumer fanout |
| 4.6 | 2-tier symmetric pill bar — compile-time cross-tier enforcement |
| 7 | InsightDepthDial transparency mechanism — sample redaction + upgrade preview |
| 7.5 | Datelo Pro overlay — per-dial budget transparency |
| 7.6 | Datelo unlimited-preview-render at Pro tier |
| 7.7 | Methodology-as-product — Polish > Harden > Exec Review cycle generates dependent claims as side-effect |
| 8 | Compelo .elo portable document format with multi-recipient grants |
| 9.4 | Tenant Server operator-blind across SaaS boundary |
| 10 | Type-boundary AI lane guards — CoachSnapshot structurally cannot carry PII |
| 10.4 / 10.5 / 10.6 | Type-boundary lane-guard dependents — Mirror reflection enforcement |
An encrypted blob and a politely-worded letter saying we cannot decrypt it. The bytes on our servers are encrypted under per-device keys we do not hold. Same energy as Apple's San Bernardino response, made permanent by patent claim 1.14 (WebRTC operator-blindness) and the per-app HKDF substrate of claim 1. Bankruptcy-court asset value of the encrypted store is zero — see the 23andMe contrast in the founder letter.
Claim 7.7 names the methodology itself as patentable: the iterative double-lens audit (per-app deep-dive plus holistic synthesis) over 9 CXO lenses (CEO + COO + CIO + CTO + CFO + CMO + CRO + CISO + CLO) produces dependent claim candidates per pass. Each new domain instantiation produces additional worked examples. The cycle runs until Exec Review surfaces zero findings.