🔍 DEFONEOS: Buyer Evidence Bundle — 24h Freshness Probe

Real-time freshness audit. Every buyer-evidence artefact on www.csoai.org carries a SIGIL anchor — a BLAKE3 digest + Ed25519 signature + timestamp + freshness probe URL. This page is the live freshness probe: a buyer can run a single curl loop and verify that every artefact is FRESH (within 24h), STALE (24h-7d), or TAMPERED (signature mismatch).

📊 Freshness Snapshot — 38 Artefacts

🔬 Probe Methodology

For each artefact, the freshness probe executes 4 steps:

1. HEAD request. Confirm artefact is served at the canonical URL and returns HTTP 200.
2. SIGIL receipt fetch. Fetch the SIGIL receipt (BLAKE3 digest + Ed25519 signature + timestamp) from the witness-list endpoint.
3. Digest recompute. Recompute the BLAKE3 digest of the artefact body and compare to the SIGIL receipt.
4. Signature verify. Verify the Ed25519 signature on the SIGIL receipt using the pinned DEFONEOS verification key.

Result: FRESH if all 4 pass AND timestamp < 24h. STALE if all 4 pass but timestamp ≥ 24h. TAMPERED if any of steps 2-4 fails.

📋 Artefact Inventory (38)

Tier 1: BFT Council Evidence

Tier 2: Buyer Due-Diligence Evidence

Tier 3: Compliance & Procurement

🔗 6-Step Buyer Curl Verification

# Step 1: verify this page is reachable
curl -s -o /tmp/verify.html https://www.csoai.org/defoneos-buyer-evidence-bundle-freshness-probe.html
wc -c /tmp/verify.html
# Expected: 22000 bytes (±100)

# Step 2: verify the freshness probe itself (this page)
curl -s https://www.csoai.org/defoneos-buyer-evidence-bundle-freshness-probe.html | grep -c "FRESH"
# Expected: ≥30 (every artefact row counts)

# Step 3: verify SIGIL receipts endpoint
curl -s https://www.csoai.org/witness-list-endpoint.html | head -50
# Expected: 33-seat witness snapshot with timestamps

# Step 4: verify the BFT minutes
curl -s https://www.csoai.org/defoneos-bft-council-public-minutes.html | grep -c "vote tally"
# Expected: ≥10

# Step 5: verify the SBOM index
curl -s https://www.csoai.org/defoneos-sbom-index.html | grep -c "FRESH"
# Expected: ≥30

# Step 6: full curl loop (run on a fresh VM, expected < 60s)
for url in \
  /defoneos-bft-council-public-minutes.html \
  /defoneos-sbom-index.html \
  /defoneos-witness-list-rotation-policy.html \
  /defoneos-council-vote-tally-probe.html \
  /defoneos-witness-list-live-snapshot.html \
  /defoneos-sbom-type-breakdown.html \
  /defoneos-council-vote-tally-by-ring.html \
  /defoneos-redline-motions-history.html \
  /defoneos-sbom-quarterly-trend.html \
  /defoneos-council-vote-tally-by-quorum-threshold.html \
  /defoneos-mcp-seal-eligibility-tracker.html \
  /defoneos-buyer-evidence-bundle-freshness-probe.html; do
  curl -s -o /dev/null -w "%{http_code}  %{size_download}b  $url\n" "https://www.csoai.org$url"
done

🔗 Cross-Reference

• SBOM Index — 30 MCPs with SPDX 2.3 + Ed25519-signed SBOM bundle + freshness probe 24h SLA
• BFT Council Public Minutes — 33-agent council composition + 142 cumulative motions
• Witness List Live Snapshot — current 2026-Q3 snapshot (33 seats) + freshness probe
• Witness Rotation Policy — quarterly R2/R3 + monthly R4 + semi-annual R5
• Buyer Acceptance Test Plan — T1-T16 mapped to evidence domains D1-D11
• Buyer Due-Diligence Pack — 11 evidence domains × 38 verification artefacts
• Pen Test Summary — 12 test classes × 7 red-team scenarios
• Disclosure Policy — coordinated vulnerability disclosure + 90-day window
• Vote Tally by Ring — per-ring drill-down
• Vote Tally by Quorum Threshold — drill-down by motion class
• MCP SEAL Eligibility Tracker — 30 MCPs × 7 SEAL criteria