Three products, one argument.

Confidence is not correctness, and a log is not a causal trace. Anything that controls physical infrastructure needs an execution record you can reproduce exactly and prove cryptographically.

Tejas is the answer to a problem that arrives the moment AI stops answering questions and starts operating things. A model that gives a different answer to the same input cannot be certified, cannot be replayed, and cannot be defended when someone asks why it did what it did. Tejas does not make the model deterministic — it wraps the execution in a layer that is, so the run can be reproduced, proven and explained afterwards.

• Bounded execution, not best-effort

  The pipeline is compiled into an execution graph with declared bounds. Structural, authority and execution determinism are enforced before and during the run, not asserted afterwards.

• Exact replay

  State, weights and environment are fingerprinted together, so a run from six months ago can be reproduced byte for byte rather than approximately re-created.

• Cryptographic attestation

  Every run produces a signed execution certificate anchored to a ledger entry. The claim 'this is what the system did' becomes something you can hand to an auditor.

• Modular, and it degrades honestly

  The layers work independently — each one improves the picture on its own, and the documentation says plainly what you lose by leaving one out. Runs offline, online or hybrid, from edge devices to enterprise clusters.

No implicit internal trust. Every request is authenticated, authorised, rate-limited, risk-scored, attested where applicable, observed and audited — including the ones that came from inside.

Kavacha exists because the systems this group builds do not fit the assumptions most IAM products make. A drone is not a laptop. A PLC is not a user. A satellite subsystem cannot re-authenticate through a browser. Kavacha treats humans, devices and services as three first-class identity classes with three appropriate mechanisms, and grants nothing on the basis of being inside the network.

• Three identity classes, three mechanisms

  Humans authenticate with OIDC, OAuth2 and WebAuthn. Devices carry X.509 certificates and use mTLS. Services hold SPIFFE identities. None of them inherits trust from network position.

• Policy-based authorisation

  Amazon Cedar policy sets, per-application and global, with explicit DENY overriding PERMIT. Just-in-time bindings and device attestation state are inputs to the policy decision, not side notes.

• Post-quantum hybrid cryptography

  Ed25519 with ML-DSA-65 for signatures, X25519 with ML-KEM-768 for key exchange, Argon2id for passwords, AES-256-GCM envelope encryption. Hybrid, so today's security does not depend on tomorrow's assumptions holding.

• Threshold signing for operational commands

  FROST-Ed25519 threshold signatures on commands that matter. An irreversible action requires a quorum by construction — the same principle as two-person approval on a spacecraft, enforced in cryptography rather than in process.

In a distributed system there is no single transaction to roll back. Either every step has a defined compensation, or your data eventually stops being true.

Most ERP failures are not crashes. They are half-completed transactions: stock reserved against an order that was never confirmed, a journal entry with no matching receipt, a payment made against a cancelled purchase. Samavāya is built so that a distributed business transaction which fails halfway unwinds itself deterministically, in reverse, with an audit trail of what it undid and why.

• 99 sagas, with compensation for every step

  Order cancellation releases the stock and reverses the receivable and the journal entry. Goods return reverses the payable and the payment. Roughly 900 step compensations, each specified rather than improvised.

• Crash recovery, not crash loss

  Saga state is persisted as it advances, so a service that dies mid-transaction resumes where it was rather than leaving a half-finished business process behind.

• Circuit breakers and bounded retry

  Exponential backoff prevents a thundering herd; circuit breakers stop a failing downstream service from cascading through the whole system.

• Honest about what cannot be undone

  Some things genuinely cannot be compensated — a filed statutory return, a completed bank transfer, stock already in transit. Those are documented as uncompensatable, escalated to a human, and never quietly retried.