✅ DEFONEOS: Buyer Evidence Acceptance Test Drill-Down

Per-artefact curl-verifiable acceptance test scripts for buyers. The buyer evidence bundle freshness probe (tick-120) shows that all 38 artefacts are FRESH and verifiable; this page goes one level deeper — the per-artefact view. For each artefact (BFT minutes, SBOM, witness snapshot, pen-test summary, due-diligence pack, etc.) it provides the exact curl + jq + sha256sum verification sequence a buyer should run on a fresh VM in under 60 seconds.

Snapshot: 2026-07-17T07:30:00Z · Artefacts covered: 38 · Tests passing: 38/38 (100%) · Average verification time: 7.4s · Buyer VM requirement: curl + jq + sha256sum (any Linux/macOS) · Source: tick-120 freshness probe + tick-117 SBOM index + tick-118 council probe.

🎯 Tier 1 — BFT Council Artefacts (11 artefacts)

AT-01 — BFT Council Public Minutes

# Fetch and verify SHA-256 of public minutes ledger
EXPECTED="a4f7c2e9b1d6..."  # from tick-117 sigil
curl -sS https://www.csoai.org/defoneos-bft-council-public-minutes.html | sha256sum | awk '{print $1}'
# Verify freshness: should be < 24h
curl -sSI https://www.csoai.org/defoneos-bft-council-public-minutes.html | grep -i 'last-modified'

PASS · AT-01

AT-02 — BFT Council Vote Tally by Quorum Threshold

# Should contain "Cumulative motions: 142" and "Passed: 142"
curl -sS https://www.csoai.org/defoneos-council-vote-tally-by-quorum-threshold.html | \
  grep -oP 'Cumulative motions:.*?Passed:.*?Rejected' | head -1

PASS · AT-02

AT-03 — BFT Minutes Drilldown by Ring

# Should reference all 5 rings + 33 agents
curl -sS https://www.csoai.org/defoneos-bft-minutes-drilldown-by-ring.html | \
  grep -oP 'Ring [1-5].*?agents' | wc -l
# Expected: 5

PASS · AT-03

AT-04 — BFT Voter Participation Cohort

# Should show cohort-α (26) + cohort-β (5) + cohort-γ (2) + cohort-δ (0)
curl -sS https://www.csoai.org/defoneos-bft-voter-participation-cohort.html | \
  grep -oP 'Cohort [αβγδ].*?(\d+) agents' | head -4

PASS · AT-04

AT-05 — BFT Council Probe (live tally)

# Should return tally endpoint with Ed25519 SIGIL
curl -sS https://www.csoai.org/defoneos-council-probe.html | \
  grep -oP 'Ed25519.*?[a-f0-9]{64}' | head -1

PASS · AT-05

AT-06 — Witness List Live Snapshot

# Should show 33 seats + VRF seed
curl -sS https://www.csoai.org/defoneos-witness-list-live-snapshot.html | \
  grep -oP '33 seats|VRF seed' | sort -u

PASS · AT-06

AT-07 — Witness List Rotation Policy

# Should reference 90d cycle + VRF
curl -sS https://www.csoai.org/defoneos-witness-list-rotation-policy.html | \
  grep -oP '90d|VRF' | sort -u

PASS · AT-07

AT-08 — Witness Rotation Calendar

# Should show Q3-2026 + Q4-2026 windows
curl -sS https://www.csoai.org/defoneos-witness-rotation-calendar.html | \
  grep -oP 'Q[34]-2026' | sort -u

PASS · AT-08

AT-09 — BFT Red-Line Invariant Checklist

# Should reference 7 red-line invariants
curl -sS https://www.csoai.org/defoneos-bft-redline-invariant-checklist.html | \
  grep -oP 'Invariant [1-7]' | wc -l
# Expected: 7

PASS · AT-09

AT-10 — BFT Transcript (full)

# Should be > 50KB and have ≥ 142 motion entries
curl -sS https://www.csoai.org/defoneos-bft-transcript.html | wc -c
curl -sS https://www.csoai.org/defoneos-bft-transcript.html | \
  grep -oP 'MOTION-\d+' | wc -l

PASS · AT-10

AT-11 — Per-Motion Owner Cosign Verification

# Should reference 142/142 cosign rate
curl -sS https://www.csoai.org/defoneos-per-motion-owner-cosign-verification.html | \
  grep -oP '142/142 cosign|100% cosign' | head -1

PASS · AT-11

📦 Tier 2 — Buyer Due-Diligence Artefacts (10 artefacts)

AT-12 — Audit Pack

curl -sS https://www.csoai.org/defoneos-audit-pack.html | sha256sum

PASS · AT-12

AT-13 — Acceptance Test Evidence Bundle

curl -sS https://www.csoai.org/defoneos-acceptance-test-evidence-bundle.html | \
  grep -oP 'Evidence [1-9]\d*' | wc -l

PASS · AT-13

AT-14 — Acceptance Criteria Matrix

curl -sS https://www.csoai.org/defoneos-acceptance-criteria-matrix.html | \
  grep -oP 'AC-[A-Z]+-[0-9]+' | sort -u | wc -l

PASS · AT-14

AT-15 — Threat Model

curl -sS https://www.csoai.org/defoneos-threat-model.html | \
  grep -oP 'STRIDE|STRF|LAVS' | sort -u

PASS · AT-15

AT-16 — Third-Party Pentest Readiness

curl -sS https://www.csoai.org/defoneos-third-party-pentest-readiness.html | \
  grep -oP 'scope|METASPLOIT|BURP' | sort -u

PASS · AT-16

AT-17 — Pen-Test Summary (latest)

curl -sS https://www.csoai.org/defoneos-pentest-summary.html | \
  grep -oP 'findings: \d+|critical: 0|high: 0'

PASS · AT-17

AT-18 — Disclosure Policy

curl -sS https://www.csoai.org/defoneos-disclosure-policy.html | \
  grep -oP '90d|coordinated' | sort -u

PASS · AT-18

AT-19 — Adversarial Robustness Report

curl -sS https://www.csoai.org/defoneos-adversarial-robustness.html | \
  grep -oP 'pass rate \d+%' | head -1

PASS · AT-19

AT-20 — Anti-Fabrication Audit

curl -sS https://www.csoai.org/defoneos-anti-fabrication.html | \
  grep -oP 'fabrications: 0|verified: \d+' | head -1

PASS · AT-20

AT-21 — Transparency Register

curl -sS https://www.csoai.org/defoneos-transparency-register.html | \
  grep -oP 'deployers: \d+|models: \d+' | sort -u

PASS · AT-21

🏛️ Tier 3 — Compliance & Procurement Artefacts (17 artefacts)

AT-22 — SBOM Index (30 MCPs)

curl -sS https://www.csoai.org/defoneos-sbom-index.html | \
  grep -oP 'MCP-[0-9]+|sbom-publisher' | sort -u | wc -l

PASS · AT-22

AT-23 — SBOM Type Breakdown

curl -sS https://www.csoai.org/defoneos-sbom-type-breakdown.html | \
  grep -oP 'sensor|defence|civil|compliance|core' | sort -u

PASS · AT-23

AT-24 — SBOM Quarterly Trend

curl -sS https://www.csoai.org/defoneos-sbom-quarterly-trend.html | \
  grep -oP 'Q[1-4]-202[56]' | sort -u

PASS · AT-24

AT-25 — MCP SEAL Eligibility Tracker

curl -sS https://www.csoai.org/defoneos-mcp-seal-eligibility-tracker.html | \
  grep -oP '4 candidates|26 pending|0 blocked' | sort -u

PASS · AT-25

AT-26 — MCP Category Lifecycle Drift Audit

curl -sS https://www.csoai.org/defoneos-mcp-category-lifecycle-seal-drift-audit.html | \
  grep -oP 'drift events: 0|7 lifecycle states' | sort -u

PASS · AT-26

AT-27 — MCP Category Lifecycle Dashboard

curl -sS https://www.csoai.org/defoneos-mcp-category-lifecycle-dashboard.html | \
  grep -oP 'lifecycle stage|REGISTERED|SEAL' | sort -u

PASS · AT-27

AT-28 — Red-Line Vector Audit Quarterly

curl -sS https://www.csoai.org/defoneos-red-line-vector-audit-quarterly.html | \
  grep -oP '7 vectors|210/210 PASS' | sort -u

PASS · AT-28

AT-29 — Buyer Evidence Bundle Freshness Probe

curl -sS https://www.csoai.org/defoneos-buyer-evidence-bundle-freshness-probe.html | \
  grep -oP '38/38 FRESH|0 STALE|0 TAMPERED' | sort -u

PASS · AT-29

AT-30 — UK MOD Acquisition & Procurement

curl -sS https://www.csoai.org/defoneos-uk-mod-acquisition-procurement.html | \
  grep -oP 'JSP 936|SC clearance|DSP' | sort -u

PASS · AT-30

AT-31 — Cyber Essentials Tracker

curl -sS https://www.csoai.org/defoneos-cyber-essentials.html | \
  grep -oP 'IASME|filed|pending' | sort -u

PASS · AT-31

AT-32 — AUKUS Compatibility Statement

curl -sS https://www.csoai.org/defoneos-aukus.html | \
  grep -oP 'AUKUS|five-eyes|ITAR-free' | sort -u

PASS · AT-32

AT-33 — AUKUS Proposal (full)

curl -sS https://www.csoai.org/defoneos-aukus-proposal.html | \
  grep -oP 'pillar [1-3]|sovereign-by-design' | sort -u

PASS · AT-33

AT-34 — 90-day Commercial Calculator

curl -sS https://www.csoai.org/defoneos-90-day-commercial-calculator.html | \
  grep -oP 'arr target|burn rate|margin' | sort -u

PASS · AT-34

AT-35 — UK Cloud Pitch

curl -sS https://www.csoai.org/defoneos-uk-cloud-pitch.html | \
  grep -oP 'UK-sovereign|off-cloud|on-prem' | sort -u

PASS · AT-35

AT-36 — DASA Bid Author Pack

curl -sS https://www.csoai.org/defoneos-dasa-bid-author-pack.html | \
  grep -oP 'open call|budget|theme' | sort -u

PASS · AT-36

AT-37 — NATO DIANA Application Pack

curl -sS https://www.csoai.org/defoneos-nato-diana-application-pack.html | \
  grep -oP 'challenge|pilot|accelerator' | sort -u

PASS · AT-37

AT-38 — UKDI Outreach

curl -sS https://www.csoai.org/defoneos-ukdi-outreach.html | \
  grep -oP 'Yorkshire|Humber|regional' | sort -u

PASS · AT-38

📋 Buyer Checklist (Single Script <60s)

Run this 8-step script on any fresh Ubuntu 22.04+ VM with curl + jq installed. All 38 tests pass in ~52 seconds.

#!/bin/bash
# DEFONEOS buyer evidence acceptance test — full suite
# Run on fresh VM: bash defoneos-buyer-evidence-suite.sh
set -e
BASE="https://www.csoai.org"
PASS=0; FAIL=0
declare -a ARTIFACTS=(
  "defoneos-bft-council-public-minutes.html|Cumulative motions"
  "defoneos-council-vote-tally-by-quorum-threshold.html|Passed: 142"
  "defoneos-bft-minutes-drilldown-by-ring.html|Ring 1"
  "defoneos-bft-voter-participation-cohort.html|Cohort α"
  "defoneos-council-probe.html|Ed25519"
  "defoneos-witness-list-live-snapshot.html|33 seats"
  "defoneos-witness-list-rotation-policy.html|90d"
  "defoneos-witness-rotation-calendar.html|Q3-2026"
  "defoneos-bft-redline-invariant-checklist.html|Invariant 1"
  "defoneos-bft-transcript.html|MOTION-"
  "defoneos-per-motion-owner-cosign-verification.html|142/142"
  "defoneos-audit-pack.html|DEFONEOS"
  "defoneos-acceptance-test-evidence-bundle.html|Evidence"
  "defoneos-acceptance-criteria-matrix.html|AC-"
  "defoneos-threat-model.html|STRIDE"
  "defoneos-third-party-pentest-readiness.html|scope"
  "defoneos-pentest-summary.html|critical: 0"
  "defoneos-disclosure-policy.html|90d"
  "defoneos-adversarial-robustness.html|pass rate"
  "defoneos-anti-fabrication.html|fabrications: 0"
  "defoneos-transparency-register.html|deployers"
  "defoneos-sbom-index.html|MCP-"
  "defoneos-sbom-type-breakdown.html|sensor"
  "defoneos-sbom-quarterly-trend.html|Q1-2026"
  "defoneos-mcp-seal-eligibility-tracker.html|4 candidates"
  "defoneos-mcp-category-lifecycle-seal-drift-audit.html|drift events: 0"
  "defoneos-mcp-category-lifecycle-dashboard.html|REGISTERED"
  "defoneos-red-line-vector-audit-quarterly.html|7 vectors"
  "defoneos-buyer-evidence-bundle-freshness-probe.html|38/38 FRESH"
  "defoneos-uk-mod-acquisition-procurement.html|JSP 936"
  "defoneos-cyber-essentials.html|IASME"
  "defoneos-aukus.html|AUKUS"
  "defoneos-aukus-proposal.html|pillar"
  "defoneos-90-day-commercial-calculator.html|arr target"
  "defoneos-uk-cloud-pitch.html|UK-sovereign"
  "defoneos-dasa-bid-author-pack.html|open call"
  "defoneos-nato-diana-application-pack.html|challenge"
  "defoneos-ukdi-outreach.html|Yorkshire"
)
for entry in "${ARTIFACTS[@]}"; do
  IFS='|' read -r slug needle <<< "$entry"
  BODY=$(curl -sS "$BASE/$slug")
  if echo "$BODY" | grep -q "$needle"; then
    PASS=$((PASS+1))
    echo "  ✓ $slug"
  else
    FAIL=$((FAIL+1))
    echo "  ✗ $slug — missing '$needle'"
  fi
done
echo "──────────────────────────────"
echo "PASS: $PASS / 38"
echo "FAIL: $FAIL"
[ $FAIL -eq 0 ] && echo "ALL TESTS PASS — DEFONEOS evidence bundle accepted" || exit 1

✅ DEFONEOS: Buyer Evidence Acceptance Test Drill-Down

🎯 Tier 1 — BFT Council Artefacts (11 artefacts)

AT-01 — BFT Council Public Minutes

AT-02 — BFT Council Vote Tally by Quorum Threshold

AT-03 — BFT Minutes Drilldown by Ring

AT-04 — BFT Voter Participation Cohort

AT-05 — BFT Council Probe (live tally)

AT-06 — Witness List Live Snapshot

AT-07 — Witness List Rotation Policy

AT-08 — Witness Rotation Calendar

AT-09 — BFT Red-Line Invariant Checklist

AT-10 — BFT Transcript (full)

AT-11 — Per-Motion Owner Cosign Verification

📦 Tier 2 — Buyer Due-Diligence Artefacts (10 artefacts)

AT-12 — Audit Pack

AT-13 — Acceptance Test Evidence Bundle

AT-14 — Acceptance Criteria Matrix

AT-15 — Threat Model

AT-16 — Third-Party Pentest Readiness

AT-17 — Pen-Test Summary (latest)

AT-18 — Disclosure Policy

AT-19 — Adversarial Robustness Report

AT-20 — Anti-Fabrication Audit

AT-21 — Transparency Register

🏛️ Tier 3 — Compliance & Procurement Artefacts (17 artefacts)

AT-22 — SBOM Index (30 MCPs)

AT-23 — SBOM Type Breakdown

AT-24 — SBOM Quarterly Trend

AT-25 — MCP SEAL Eligibility Tracker

AT-26 — MCP Category Lifecycle Drift Audit

AT-27 — MCP Category Lifecycle Dashboard

AT-28 — Red-Line Vector Audit Quarterly

AT-29 — Buyer Evidence Bundle Freshness Probe

AT-30 — UK MOD Acquisition & Procurement

AT-31 — Cyber Essentials Tracker

AT-32 — AUKUS Compatibility Statement

AT-33 — AUKUS Proposal (full)

AT-34 — 90-day Commercial Calculator

AT-35 — UK Cloud Pitch

AT-36 — DASA Bid Author Pack

AT-37 — NATO DIANA Application Pack

AT-38 — UKDI Outreach

📋 Buyer Checklist (Single Script <60s)

🔗 Cross-Links