Kolibri

1. Overview

Offline-first learning platform that serves educational content from a local server.

Category: Research & Education.

2. Version and scope assessed

Version assessed: Pinned evidence 303e3baea3e0df85b797111af8ca4d89e7fbbe92.

4. Principle profile

5. Fundamental requirements

6. Evidence and verification

• E1: Kolibri documents export of channels and content to a local drive, providing a direct retrieval path. (source), confidence medium
• E2: Content export and import support moving educational resources between Kolibri installations, but complete user-progress migration was not tested. (source), confidence medium
• E3: The dbrestore command explicitly limits its intended use to restoring the same device, not cross-device replication; --latest selects the current major/minor version's backup and the command refuses a running Kolibri instance. This answers the scope of that recovery route without claiming a restore succeeded. (source), confidence medium
• E4: Kolibri is designed for local and offline learning deployments and can exchange content through local media. (source), confidence medium
• E5: Bulk import excludes retained users, facility administrators and the specified acting user from --delete, then calls hard_delete=True for remaining selected users. Database mutation is inside the not-dryrun branch, including clearing memberships of omitted classes. A CSV omission can therefore be consequential, not merely an update. (source), confidence medium
• sovereignty: A positive Sovereignty finding requires established E1, E2 and E4 in the declared scope. The existing access/exit/custody record for Kolibri does not establish all three minimums. The prior positive finding is withdrawn; recorded storage and portability strengths remain facts, not a verified failure. (source), confidence medium
• longevity: E3 is not established for Kolibri's existing essential-record scope. The previous Longevity finding is replaced by Not assessed, not a verified failure or a positive placeholder. (source), confidence medium
• locality: Offline and local delivery are core use cases, with synchronization treated as optional infrastructure. (source), confidence medium
• transparency: The positive control observations above do not yet establish whole-scope E5. The methodology requires that minimum before a positive Transparency and Control finding; the previous positive finding is therefore withdrawn to Not assessed, not changed to Does not meet. (source), confidence medium
• E3: The inspected dbrestore route is for the same device, selects version-bounded backups and refuses a running instance. It does not demonstrate cross-device restoration of content, user/progress/log data or complete backup coverage for the existing learning profile. (source), confidence medium
• E5: Bulk import has dry-run mutation guards and exclusions for administrators/acting users, but can hard-delete omitted selected users and clear memberships. Effective role authorization, content/progress deletion visibility and recovery are not comprehensively established by that command alone. (source), confidence medium
• E2: The former E2 Pass covers a content-transfer lead, not preservation of essential learner identity, progress and logs in a replacement workflow. Complete cross-device/user-data migration remains unestablished. (source), confidence medium

7. Migration and recovery

Native storage format: SQLite database and content channels in a home directory.

Synchronization or runtime model: Local server for offline networks; optional sync between devices.

Example export or inspection command (not verified against any particular version or data set): sqlite3 ~/.kolibri/db.sqlite3 ".tables"

8. Architectural strengths

Established strengths and their scope are recorded in the evidence and assessment findings on this page.

9. Architectural limitations

• Source/retained-input inspection only; no installation or application restore performed.
• Actual backup restoration/content coverage, cross-device migration, user/log export completeness, downgrade behavior and runtime deletion/traffic observations remain untested.

10. Assessment findings and remaining work

Evidence update: 23 October 2026

• Resolved: The dbrestore command explicitly limits its intended use to restoring the same device, not cross-device replication; –latest selects the current major/minor version’s backup and the command refuses a running Kolibri instance. This answers the scope of that recovery route without claiming a restore succeeded. Source.
• Resolved: Bulk import excludes retained users, facility administrators and the specified acting user from –delete, then calls hard_delete=True for remaining selected users. Database mutation is inside the not-dryrun branch, including clearing memberships of omitted classes. A CSV omission can therefore be consequential, not merely an update. Source.
• Open: Actual backup restoration/content coverage, cross-device migration, user/log export completeness, downgrade behavior and runtime deletion/traffic observations remain untested. E5 needs effective importer/role settings, omission-driven deletion and progress/content recourse beyond one dry-run guard.

Assessment follow-up: These bounded findings are incorporated into the evidence above. Eligibility and principle ratings are deliberately unchanged; their reconciliation and any blank-status fixes are deferred to the next pass. Reproduction details and retained inputs are in evidence/third-pass/batch-10/.

Human-readable criteria: Can a user preserve records, structure, media, and provenance, restore them independently, and move to another tool without losing meaning?

Rating reconciliation: 24 October 2026

E3 and E5 remain Not Verified for the existing declared scope. Longevity and Transparency and Control are Not assessed pending their required minimums. Sovereignty is also Not assessed because the required access/exit/custody minimums are not all established. The prior E2 Pass is withdrawn; its essential-record migration comparison remains incomplete. This is a targeted evidence decision, not a finding that the product fails. Existing E1, E4 and Locality findings were not re-certified.

Remaining: Actual backup restoration/content coverage, cross-device migration, user/log export completeness, downgrade behavior and runtime deletion/traffic observations remain untested. E5 needs effective importer/role settings, omission-driven deletion and progress/content recourse beyond one dry-run guard.

Next without installing locally: Use a synthetic content/channel/user-progress/device backup packet with expected identities/logs and version boundaries; inspect exports and obtain same-version external restore/bulk-import/deletion records.

The individual decision and provenance are retained in evidence/rating-reconciliation/batch-10/. Overall: Insufficient evidence.

Individually reconciled in rating batch 10 on 24 October 2026. E3/E5 remain Not Verified for explicit missing coverage; dependent unsupported findings corrected. Previously resolved questions are retained, not counted again. E1/E4/Locality were not re-certified by this targeted review. The assessment procedure is described in the methodology.