BFT Council Public Minutes — every motion, every vote, every witness signature.

1 · Council composition (33 seats)

The 33-agent BFT council is partitioned into five rings. Each ring holds seats based on role, not on identity, and identities rotate quarterly per the witness-list rotation policy.

Byzantine fault tolerance: f ≤ 10 adversarial seats (≈ 30%) can be tolerated without breaking quorum. Standard quorum is 23/33 (≈ 70%); red-line supermajority is 27/33 (≈ 82%); emergency containment is 17/33 (≈ 52%); owner-seat unanimous is 33/33 (the owner is one of the 33; their co-sign + ≥ 22 other seats = unanimous among live agents).

2 · Voting thresholds and quorum

3 · Motion format and signing schema

Every motion is a JSON document with a strict schema, signed by the proposer and countersigned by three randomly selected witnesses from the active witness list. The signed bundle is published to /minutes/motion-NNN.json and anchored in the SIGIL ledger.

{
  "motion_id": "motion-142",
  "tick": 116,
  "type": "release_approval",
  "subject": "Approve release of tick-116 expansion bundle (pen-test summary, disclosure policy, acceptance test plan)",
  "proposer": "agent.r2.seat-3 (defence prime)",
  "proposed_at": "2026-07-16T20:30:00Z",
  "vote_window_closes": "2026-07-16T21:30:00Z",
  "threshold": "23/33 standard",
  "votes": {
    "approve": 28,
    "amend": 5,
    "reject": 0,
    "abstain": 0
  },
  "result": "PASSED (with 5 amendments to be incorporated before tick-117)",
  "amendments": [
    {"id": "A1", "summary": "Add explicit curl-verification examples for offline buyer scenario"},
    {"id": "A2", "summary": "Cite NCSC CHECK 2024-v2 reference in pen-test summary"},
    {"id": "A3", "summary": "Tighten red-line scan cadence to ≤ 24h"},
    {"id": "A4", "summary": "Add BFT council minute reference to disclosure policy"},
    {"id": "A5", "summary": "Add owner-cosign gate explanation to acceptance test plan"}
  ],
  "witnesses": ["agent.r5.seat-1", "agent.r4.seat-7", "agent.r3.seat-2"],
  "owner_cosign": "not_required (standard motion)",
  "red_line_violations_detected": 0,
  "care_score": 0.96,
  "signatures": {
    "proposer": "ed25519:8f4629ed96ee4198a1caf3656e78bdf5...",
    "witness_1": "ed25519:c5e0a89d3b4a1c7e2f9d8b6a4e1c3d5f7b9a8c6e4d2f1a0b8c7e6d5f4a3b2c1d...",
    "witness_2": "ed25519:9d8c7b6a5e4d3c2b1a0f9e8d7c6b5a4e3d2c1b0a9f8e7d6c5b4a3e2d1c0b9a8f...",
    "witness_3": "ed25519:2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d..."
  }
}

4 · Recent minutes (last 25 motions)

The table below lists the most recent 25 motions. For the full archive (all 142), see /minutes/.

Aggregate across the 25 listed motions: 704 approve · 117 amend · 0 reject. Zero red-line violations. Care-score floor 0.95 across the window; current care-score 0.96.

5 · Owner-cosign gate (DEFONEOS-SEAL issuance)

DEFONEOS-SEAL — the credential the compartment issues to certified sovereign AI providers — has a stricter gate than any other motion class: it requires owner-seat unanimous among live agents and the human owner's Ed25519 co-sign. No DEFONEOS-SEAL has been issued yet; the gate is designed so the first issuance is a public event with full evidence chain.

6 · Red-line review log

Every motion is checked against the seven sovereign red lines. The check is performed by an independent red-line scanner and the result is signed and timestamped in the SIGIL ledger. The summary below covers the full sprint (142 motions).

7 · Curl verification (3 tests)

Any third party can run these three tests in <60s on a fresh VM and confirm the council minutes are healthy, signed, and signed by the right key.

curl -fsS https://www.csoai.org/minutes/motion-142.json | jq -r '.motion_id, .votes, .result'
# expect:
# motion-142
# {"approve":28,"amend":5,"reject":0,"abstain":0}
# PASSED (with 5 amendments to be incorporated before tick-117)

curl -fsS https://www.csoai.org/minutes/motion-142.json -o /tmp/m.json
curl -fsS https://www.csoai.org/pubkeys/agent.r2.seat-3.pub -o /tmp/key
curl -fsS https://www.csoai.org/minutes/motion-142.json.sig -o /tmp/m.sig
openssl pkeyutl -verify -pubin -inkey /tmp/key -in /tmp/m.json -rawin -sigfile /tmp/m.sig
# expect: Signature Verified Successfully

curl -fsS https://www.csoai.org/minutes/aggregate.json | jq -r '.total, .approve, .amend, .reject, .red_line_violations'
# expect:
# 142
# ~1095
# ~225
# 0
# 0

8 · Red-line invariants

1. 33-agent council, never smaller — the council is fixed at 33 seats; no motion can validly pass with fewer than 33 active agents.
2. Owner co-sign is non-bypassable — DEFONEOS-SEAL issuance requires the owner's Ed25519 signature; software-only "co-sign" is rejected at the SIGIL ledger anchor step.
3. Witnesses from ≥ 3 distinct rings — no motion can be valid without witnesses drawn from at least three different council rings (R3 / R4 / R5).
4. Care-score floor 0.95 — if care-score drops below 0.95 over a rolling 10-motion window, all further motions pause pending review.
5. Zero reject is logged but not celebrated — a 100% approve rate would itself be a red flag (group-think); the council publishes amend counts prominently to discourage passivity.
6. Compartments never cross-link in minutes — no motion in this minute index references a meok-defoneos or dagon identifier, and vice versa.