🐉 DEFONEOS — MOD 30/60/90 Day Onboarding Runbook

M1 — Day 20: Pilot Deployment Live

What it means: 3 MCPs running on the buyer's air-gapped VM. 33-agent BFT council instantiated and answering roll-call. First seal-candidate (an AI model the buyer wants credentialed) submitted into the queue.

How we know it worked:

• curl https://defoneos.{{buyer}}.mod.uk/healthz returns 200 with the 3 MCPs listed in the response body
• defoneos-council roll-call shows 33/33 agents responding
• A seal-candidate JSON document is committed to /var/lib/defoneos/seal-queue/

If M1 slips: escalate to Nick + buyer's Tech Lead within 24h. Slip >5 days = commercial credit (£10k per day, capped at platform fee).

M2 — Day 30: First DEFONEOS-SEAL Issued

What it means: The BFT council has voted (≥23/33 quorum), the buyer's first AI model has been credentialed, the Ed25519-signed JSON-LD credential has been issued, and the OpenTimestamps proof has been Bitcoin-anchored.

How we know it worked:

• DEFONEOS-SEAL credential JSON-LD file delivered to buyer's SRO + IA Lead
• OpenTimestamps receipt URL (e.g. https://ots.btc.cat/concierge/...) recorded in the audit log
• Council vote record committed to /var/lib/defoneos/council-votes/ with each agent's signature

If M2 slips: pause all further SEALs. The first one is the most important — re-convene the council with a fix-and-retry protocol.

M3 — Day 90: First Audit Signed Off

What it means: An external auditor (one of the 3 sovereign-tier firms — BABL UK / ForHumanity UK / Holistic AI UK) has reviewed the deployment, signed off on the audit report, and the customer-success retro has produced the Year-2 renewal terms.

How we know it worked:

• Audit report PDF delivered with auditor's signature + DEFONEOS-SEAL co-signature
• Customer-success retro minutes filed in /var/lib/defoneos/retros/
• Year-2 renewal order form drafted and queued for SRO signature

G1 — Day 25-30: SC Clearance Verified

Why this is a gate: A DEFONEOS-SEAL can only be issued to a buyer whose Information Assurance Lead is SC-cleared and has signed the IA attestation letter. Without this, the credential is technically valid but commercially worthless — the buyer can't reference it in their own classification chain.

What we need:

• Buyer's IA Lead's SC clearance reference number (visible on the SC certificate)
• Signed IA attestation letter (DEFONEOS template, signed and counter-signed)
• Counter-signature from buyer's Head of Information Assurance (above IA Lead)

If G1 fails: do not proceed to M2. Hold the BFT council vote results in escrow. The seal-candidate can be re-submitted once IA attestation is in place. No commercial workaround.

G2 — Day 90: First Audit Signed Off

Why this is a gate: The Year-2 renewal is contingent on a clean first audit. If the auditor flags critical findings, Year-2 terms are re-negotiated (lower platform fee, additional SEALs included, or 6-month probation).

What we need:

• External auditor's report (PDF, signed)
• Audit findings classified as Critical / Major / Minor / Observation
• Remediation plan for any Major or Critical findings

If G2 fails: trigger the remediation plan. Re-audit at Day 120. If Day 120 also fails, the contract enters a 6-month probation with reduced platform fee.

G3 — Day 30: SC Clearance Verified (Nick's Side)

Why this is a gate: Nick must hold an active UK SC clearance (Baseline Personnel Security Standard, or higher) before accessing the buyer's air-gapped VM in classified contexts. Without this, Nick can only deliver DEFONEOS via sovereign cloud (which some buyers won't accept for SECRET material).

What we need:

• Nick's UK SC clearance reference number
• Counter-signature from a UK Government Sponsor (the buyer's SRO can serve this role)

If G3 fails: DEFONEOS is delivered via sovereign cloud only. Some buyers will accept this; others (especially Navy / RAF) will not. Mitigation: partner with an SC-cleared delivery sub-contractor (e.g., a BAE / QinetiQ partner).

Failure Mode A — M1 Slip (Pilot Deployment)

Likely cause: Buyer's air-gapped VM environment is more constrained than expected (no internet, locked-down DNS, no pip access).

Recovery: Pre-bundle a sovereign-offline pip wheel pack + a sovereign DNS resolver. Add 1 week to M1. Notify SRO on Day 5 if this looks likely.

Failure Mode B — M2 Slip (First SEAL)

Likely cause: BFT council cannot achieve 23/33 quorum (some agents' underlying LLMs are unavailable in the buyer's air-gapped environment).

Recovery: Run a "starter council" of 12 agents (quorum 9/12) for the first SEAL. Document the deviation in the audit log. Scale to 33-agent council at Year-2 when more sovereign LLMs are available.

Failure Mode C — G2 Slip (First Audit)

Likely cause: External auditor flags a Major finding (e.g., insufficient IA attestation evidence).

Recovery: 30-day remediation plan + Day-120 re-audit. If Day-120 also fails, contract enters 6-month probation with 50% reduced platform fee.