DEFONEOS · Sovereign Inference Routing Specification

1. Overview

Every inference request in DEFONEOS passes through the Sovereign Inference Router — a decision engine that determines which model, which compute, and which jurisdiction processes the request. The router ensures that data sovereignty is enforced at the inference layer, not just the storage layer.

Core principle: The sensitivity of the data determines the sovereignty of the inference. Ring 0 data (governance, escrow, compliance) always uses UK-sovereign MLX models. Never external APIs.

2. The 3 Routing Tiers

Incoming Request
│
▼
┌──────────────────┐
│ Data Classification │ ──→ What ring is the data from?
│ (automatic) │ ──→ What classification level?
└────────┬─────────┘
│
┌────┼────┐
▼ ▼ ▼
RING 0 RING 1 RING 2
│ │ │
▼ ▼ ▼
MLX MLX+ Any
(UK) Bridge Model

Tier 1 — Ring 0 (Core Sovereign)

Model: SOV3 sovereign models running on MLX (Apple Silicon, UK hardware).
External API: NONE. Zero external API calls. Under any circumstances.
Models available: SOV3small (governance), SOV3large (complex reasoning), BFT deliberation models.
Latency: <100ms (local inference).
Cost: £0 (self-hosted compute).

Tier 2 — Ring 1 (Defence Sensors)

Model: MLX (UK-sovereign) by default. Frontier bridge available (BFT-gated) for complex reasoning on non-sensitive sensor data.
External API: AUKUS-partner models only, BFT 23/33 approved per call.
Models available: SOV3 + frontier models (GPT-4o, Claude, Gemini) via bridge.
Latency: <100ms (sovereign) / 500ms-2s (frontier bridge).
Cost: £0 (sovereign) / API cost (frontier bridge, tracked).

Tier 3 — Ring 2 (Civil Open-Data)

Model: Any model. Data is publicly available, so sovereignty constraints are relaxed.
External API: Any (OpenAI, Anthropic, Google, local MLX, cloud GPU).
Models available: All models.
Latency: Model-dependent.
Cost: Model-dependent.

3. The 8 Decision Factors

The router evaluates 8 factors for every request before selecting a model and compute target:

#	Factor	Description	Ring 0 Rule	Ring 1 Rule	Ring 2 Rule
F1	Data Ring	Which trust ring the data belongs to	Force Ring 0 model	Default Ring 1 model	Any model
F2	Classification	OFFICIAL / OFFICIAL-SENSITIVE / SECRET	FORCE UK-only (any class)	SENSITIVE → MLX only	OFFICIAL → any
F3	PII Present	Does the data contain personal data?	FORCE UK-only	PII → MLX only	No PII in Ring 2
F4	Red-Line Proximity	Does the request approach red-line boundary?	FORCE UK-only + BFT check	BFT check	N/A
F5	BFT Governance Flag	Has BFT council flagged this request type?	FORCE UK-only + BFT vote	BFT vote	N/A
F6	Model Capability Needed	Does the task need frontier capability?	NO external models	BFT-gated bridge	Any model
F7	Latency Requirement	Is this real-time (<500ms)?	MLX only	MLX preferred	Any
F8	Cost Budget	Is there an API cost budget constraint?	£0 always	MLX free / bridge tracked	Any

4. Ring 0 Invariant: Zero External API

Ring 0 has an architectural invariant: zero external API calls. This is not a policy — it is enforced in code:

inference_router.route() checks data.ring == 0 and forces model = "sov3-local".
No external API client is instantiated for Ring 0 requests.
If a Ring 0 request somehow reaches an external API path, the firewall_bft gate blocks it and triggers T1 emergency session.
The allowlist for Ring 0 contains exactly one entry: ["mlx://local/*"].

Testing: The adversarial red-team framework continuously probes Ring 0 for external API leakage (V5 — Model Extraction). 0 findings to date.

5. Frontier Bridge (Ring 1 Only)

For Ring 1 requests that need frontier model capability (complex reasoning, large-context analysis), DEFONEOS provides a frontier bridge:

Step	Action
1	Request classified as Ring 1 + frontier capability needed (F6 = true)
2	Router checks BFT governance flag (F5). If flagged → BFT vote (23/33).
3	Router checks classification (F2). If OFFICIAL-SENSITIVE or higher → MLX only (no bridge).
4	Router strips PII from the request (F3 check). Only non-personal data sent to frontier model.
5	Router selects frontier model from BFT-approved allowlist.
6	Request sent. Response received. SIGIL receipt generated.
7	Response merged with sovereign inference context. Final output delivered.

Models in BFT-approved allowlist: GPT-4o (OpenAI), Claude 3.5 Sonnet (Anthropic), Gemini 1.5 Pro (Google). All accessed via API keys stored in UK-sovereign secrets manager.

6. SOV3 Sovereign Model Stack

The UK-sovereign models that serve Ring 0 and default Ring 1:

Model	Size	Use Case	Hardware
SOV3small	7B-13B	Governance decisions, BFT voting, compliance checks	MLX on M2/M3/M4 (local)
SOV3large	30B-70B	Complex reasoning, multi-step analysis	MLX on M4 16GB (fleet)
SOV3 OWEM	7B (fine-tuned)	Domain-specific (defence, compliance, sovereignty)	MLX on any node
BFT Deliberation	SOV3small × 33	33-agent parallel deliberation for governance votes	MLX fleet (distributed)

7. Inference Cost Tracking

Tier	Cost Model	Tracking
Ring 0 (SOV3)	£0 (self-hosted compute)	SIGIL receipt records compute time, no monetary cost
Ring 1 Sovereign (MLX)	£0 (self-hosted compute)	SIGIL receipt records compute time
Ring 1 Frontier Bridge	API cost per call	SIGIL receipt records API cost + model + token count
Ring 2 (Any model)	Model-dependent	SIGIL receipt records full cost breakdown

8. Failover: Sovereign-Only Mode

If the frontier bridge becomes unavailable (API outage, network partition, BFT emergency freeze), DEFONEOS automatically degrades to sovereign-only mode:

All Ring 1 requests that would have used the frontier bridge are routed to SOV3large instead.
Capability is reduced (SOV3large < GPT-4o for complex reasoning), but sovereignty is maintained.
BFT council is notified. Care-score may temporarily drop.
Frontier bridge auto-retries every 5 minutes.

Key property: DEFONEOS is fully operational in sovereign-only mode. The frontier bridge is an enhancement, not a dependency.