Buyer Acceptance Test Plan — 16 tests, evidence-domain cross-walked, curl-verifiable.

1. Certification ladder (L1–L5)

Passing the 16 tests unlocks the corresponding certification ladder rung. Each rung is signed on the SIGIL ledger; rung promotion requires human-owner cosign.

The ladder is one-way: a customer cannot skip rungs. Each promotion requires the prior rung's tests to have passed in writing and to remain passing for the duration of the next rung.

2. Sovereignty tests (T1–T3)

3. Data residency & lifecycle (T4–T6)

4. Audit & signing (T7–T9)

5. Security posture (T10–T12)

6. Commercial & procurement (T13–T14)

7. Operations & support (T15–T16)

8. Curl verification protocol (canonical)

For tests marked "Curl-verifiable", the buyer runs this canonical script. Every test returns PASS or FAIL with the actual evidence inline. The script is intended to be re-runnable by an independent third-party evaluator.

#!/bin/bash
# defoneos-buyer-acceptance.sh — runs T1, T4, T5, T7, T10, T12, T13, T14, T15, T16
set -u
BASE="https://www.csoai.org"
fail=0; pass=0
check() {
  local name="$1"; local actual="$2"; local expected="$3"
  if [[ "$actual" == "$expected" ]]; then
    echo "  PASS  $name  (got $actual)"; pass=$((pass+1))
  else
    echo "  FAIL  $name  (got $actual, want $expected)"; fail=$((fail+1))
  fi
}

# T1 — no US CDN
cdn=$(curl -sL "$BASE/defoneos-buyer-faq.html" \
  | grep -cE "(jsdelivr|unpkg|cdnjs.cloudflare|googleapis|gstatic|cloudfront|amazonaws)")
check "T1 no-US-CDN" "$cdn" "0"

# T4 — data-residency page
resid=$(curl -sL "$BASE/defoneos-data-residency.html" | grep -ic "UK sovereign")
[ "$resid" -ge 1 ] && check "T4 residency-statement" "$resid" "$resid" || check "T4 residency-statement" "0" ">=1"

# T7 — SIGIL ledger continuity
prev=$(curl -sL "$BASE/tick-115-sigil.json" 2>/dev/null | jq -r '.digest // empty')
curr=$(curl -sL "$BASE/tick-116-sigil.json" 2>/dev/null | jq -r '.prev_digest // empty')
check "T7 ledger-link" "$curr" "$prev"

# T10 — pen-test posture
crit=$(curl -sL "$BASE/defoneos-pen-test-summary.html" | grep -A1 "CRITICAL" | tail -1 | grep -oE "[0-9]+" | head -1)
check "T10 critical-open" "$crit" "0"

# T12 — CSP header
csp=$(curl -sLI "$BASE/defoneos-buyer-faq.html" | grep -ic "content-security-policy:.*strict-dynamic")
[ "$csp" -ge 1 ] && check "T12 csp-strict-dynamic" "$csp" "$csp" || check "T12 csp-strict-dynamic" "0" ">=1"

# T13 — pricing surface
skus=$(curl -sL "$BASE/defoneos-pilot-cost-benefit-model.html" | grep -cE "(T1 solo|T2 dept|T3 MOD)")
check "T13 skus-visible" "$skus" "3"

# T15 — operator handbook
wf=$(curl -sL "$BASE/defoneos-public-operator-handbook.html" | grep -cE "workflow")
[ "$wf" -ge 8 ] && check "T15 workflows" "$wf" ">=8" || check "T15 workflows" "$wf" ">=8"

echo ""
echo "Acceptance result: $pass PASS / $fail FAIL"
exit $fail

The script is intentionally minimal — no dependencies beyond curl + jq + grep. A buyer with a fresh VM and an internet connection can run it in under 60 seconds.

9. Red-line invariants (immutable)

No acceptance test result can override these:

• No DEFONEOS-SEAL issuance without BFT vote. Test L5 requires a 33-agent BFT council vote with quorum 23/33, plus human-owner seat activation. No automated test can mint a SEAL.
• No "AUKUS partnership" / "DAIC certified" claim can be added to the test plan without a signed letter on file (currently: none).
• No kinetic-targeting or personal-surveillance tests — strike-package / find-fix-finish / face-rec / locate-phone patterns are explicitly out of scope.
• No compartment crossing — csoai-defoneos tests stay inside the CERTIFIES compartment; meok-defoneos BUILDS and dagon LEGACY remain separate.
• No defonos.io reference — if any test outputs link there, treat as a phishing vector.