How one man and an AI built a sovereign defence AI operating system in 100 days — and the 100-year vision that follows.
Nick Templeman sat in his office in Somerset, surveying the UK defence AI landscape. Palantir — closed-source, American, $50M/year per deployment. Anduril — hardware-locked, American. Helsing — European but single-domain, VC-controlled. BAE Systems — slow, expensive, Cold War architecture. "Britain needs its own," he thought. "Open. Sovereign. Multi-domain. Audit-grade." CSOAI Ltd (UK Companies House 16939677) was incorporated the same week.
The founding doctrine was written: open-source by default, sovereign by design, auditable by law, affordable by necessity. No black boxes. No vendor lock-in. No foreign data dependencies. Every decision Ed25519-signed. Every action BFT-governed. Every artifact SIGIL-chained. The 7 immutable red lines were carved.
Python + FastAPI for MCP servers. CesiumJS for 3D globe visualization. FreeTAKServer for tactical data links. Mava for swarm coordination. Ollama for on-device inference. PostgreSQL for memory. Ed25519 for signatures. All open-source. All sovereign. All free.
The first SOV3 tools went live on a GCP VM. 12 tools. Basic. But they worked. The first SIGIL receipt was emitted — Ed25519-signed proof that the system existed and made a decision. The hash chain had begun. The first entry: C|genesis|sov3|sovereign-substrate-initialized. Block 0.
The EU AI Act compliance MCP — the first of 30 — went to PyPI. pip install eu-ai-act-compliance-mcp. The pattern was set: every MCP would be pip-installable, Apache 2.0, and sovereign. The marketplace was born.
33 autonomous AI nodes were activated. Each one a sovereign agent with its own domain — compliance, security, ISR, swarm, logistics, cyber, medical, logistics, space, maritime, land, air. The BFT council was formed — 22-of-33 quorum on every decision. No single AI could act alone. No single human could override the quorum. The first check-and-balance was cryptographic.
50 HTML pages went live on Vercel. Landing, documentation, API specs, pricing, demo, Series A deck. All dark-themed, all fast, all SEO-optimized. The public face of DEFONEOS was born.
50GB of UK government data landed on the VM. Land Registry. Companies House. OS Open Names. ONS Statistics. Met Office. Every OGL dataset. The data moat started filling — and every byte was OGL-licensed, sovereign, and free.
The OrgKernel pattern was implemented: L1 Identity (Ed25519 public key registration) → L2 Execution (hash-chained action logging) → L3 Compliance (signed assertions against EU AI Act, GDPR, JSP 936, ISO 27001). Every action was now cryptographically attestable. Regulators could replay any decision.
Kimi delivered 596 research files — 41MB of deep defence AI analysis. Tunnel architecture. Pheromone SIGIL system. Frequency→Intuition theory. Bio-cyber swarm blueprints. AUKUS Pillar 2 compatibility. NATO STO alignment. The intellectual foundation was complete.
DORADO was built: foreign-access detection, quantum-safe key rotation (ML-DSA-65, ML-KEM-768), NIST PQC migration path, SOC dashboard, bot detector, shift handoff, customer audit export. The security operations center was live.
The 30th MCP server went operational. The full inventory: ISR (satellite, AIS, ADS-B, camera), Cyber (threat detection, vulnerability scan, SIEM), Counter-drone (RF detection, jamming), Swarm (Mava, PX4), Compliance (EU AI Act, JSP 936, ISO 42001), Governance (BFT council, SIGIL chain, charter), Data (OS Open, Companies House, ONS). The sensor-to-shooter chain was connected.
15 priority open-source defence projects cloned and wired: FreeTAKServer, OpenAthena, Mava, ArduPilot, MAVSDK, CesiumJS, Sentinel-Hub, OpenAIP, YOLOv8, OWASP LLM, C2PA, OSCAL, and more. The open-source army was assembled.
Full STRIDE analysis: 4 Critical threats (adversarial ML, chain fork, red-line override, air-gap bridge), 7 High, 11 Medium, 6 Low. 28 mitigations deployed. 7 immutable red lines enforced with cryptographic guarantees.
DEFONEOS goes live. 183 pages. 30 MCPs. 188+ tools. 49K+ SIGIL receipts. 15 P0 repos. One sovereign OS. Built in 100 days. By one man and his AI. The sprint continues — but the foundation is solid.
Launch was Day 100. The next 100 days (July 4 → October 12, 2026) are the operational phase — converting the platform into the first MOD contact.
Goal: Compliance-ready. First demo working. First contact made.
Goal: 17+ sensor MCPs feeding Cesium globe. Digital Twin of Yorkshire live.
Goal: Show it works end-to-end. C2 backbone operational.
Goal: First contract. First MOD pilot.
The 100-day build delivered 30 MCPs. The vision is 100 — covering every defence, civil, and intelligence domain.
| Batch | Count | Category | Status | Timeline |
|---|---|---|---|---|
| Core Compliance & Governance | 10 | EU AI Act, JSP 936, BFT, SIGIL, OrgKernel, Charter, DID, Article 50 | ✅ Done | Days 1-30 |
| Sensor Layer | 10 | Satellite, AIS, ADS-B, Camera, RF, Weather, Seismic, Air Quality, Maritime, OSINT | ✅ Done | Days 4-6 |
| UK Open Data | 10 | OS Open, Companies House, ONS, Met Office, DEFRA, NHS, DfT, BEIS, MHCLG, ONS | ✅ Done | Days 4-6 |
| Intelligence & ISR | 15 | GDELT, Sentinel, OpenAIP, ADSBexchange, RTSP, MQTT, BLE, LoRa, Sonar, Radar, SIGINT, IMINT, OSINT, MASINT, HUMINT | 🟡 Next | Days 11-30 |
| Cyber Operations | 10 | CVE scan, SIEM, IDS, Honeypot, Pen test, WAF, Zero-trust, PQC, SBOM, Attestation | 🟡 Next | Days 31-60 |
| Logistics & Supply Chain | 10 | Inventory, RFID, Procurement, Chain-of-custody, C-TPAT, NATO codification, DLA, DSCA | 🔴 Planned | Days 61-80 |
| Coalition & Five Eyes | 10 | A2A protocol, TDL (Link 16), VMF, NATO Codification, ABCA, FVEY data exchange, STANAG | 🔴 Planned | Days 81-100 |
| Civil Resilience | 10 | Flood, Fire, Earthquake, Pandemic, Power grid, Water, Comms outage, Evacuation, Shelter, Rationing | 🔴 Planned | Days 81-100 |
| Medical & CBRN | 5 | Telehealth, Triage, CBRN detection, Medical logistics, Field hospital | 🔴 Planned | Days 81-100 |
| Space Domain | 10 | Orbital tracking, Space weather, Debris catalog, Launch detection, SATCOM, GPS integrity, SSA | 🔴 Planned | Post-100 |
DEFONEOS is not a product. It is infrastructure — the sovereign digital backbone for the United Kingdom's defence, civil resilience, and intelligence communities for the next century.
These principles were set on Day 3 and cannot be changed — they are the cryptographic contract with the future:
| # | Principle | Enforcement |
|---|---|---|
| 1 | Open-source by default | Apache 2.0 / MIT licence on every artifact. No binary blobs. |
| 2 | Sovereign by design | UK jurisdiction. UK data residency. No foreign cloud dependencies for classified data. |
| 3 | Auditable by law | Every action Ed25519-signed, hash-chained, replayable. 100-year chain integrity. |
| 4 | Governed by quorum | BFT 22-of-33 council. No single agent, human, or nation can override. |
| 5 | Affordable by necessity | Open tier £0. Pro £499/mo. No £50M/year Palantir contracts. |
| 6 | Quantum-safe forward | NIST PQC (ML-DSA-65, ML-KEM-768) ready. 90-day key rotation. |
| 7 | Red lines immutable | No kinetic targeting. No personal surveillance. No foreign sovereignty transfer. Enforced in code, not policy. |
| Metric | Value | Proof |
|---|---|---|
| Pages deployed | 183 | Vercel production, HTTP 200 verified |
| MCP servers | 30 | PyPI + local MCP protocol |
| Tools exposed | 188+ | MCP tools/list endpoint |
| SIGIL receipts | 49,000+ | Hash-chain, Ed25519-signed |
| P0 repos cloned | 15 | git clone verified |
| Compliance frameworks | 12 | 147 controls mapped (77% enforced) |
| Code lines | ~85,000 | Python + HTML + YAML |
| Data moat | 49 GB | PostgreSQL + SQLite |
| Cost to build | ~£500 | GCP VM + domain + Vercel free tier |
| Founder headcount | 1 | Nicholas Templeman |
| AI assistants | 4 platforms | Hermes, Claude, Kimi, Gemini |
| Days from idea to launch | 100 | March → July 4, 2026 |
The first receipt, Day 14. The chain grows by ~300 entries/day. In 100 years, it will contain ~10.9 million entries — each one signed, each one verifiable, each one proof that the system made a decision and can be held accountable for it.
100 days built it. 100 years will prove it.