Edge → Fog → Cloud → Sovereign Mesh. Air-gapped capable. JSP 440 secure comms. DISN-connected for NATO interoperability. Deploy anywhere from Raspberry Pi to GCP VM.
Edge (RPi/Jetson) → Fog (Mac inference) → Cloud (GCP VM) → Sovereign (P2P mesh). Each tier independently operational.
All inter-tier comms encrypted at rest and in transit. JSP 440 compliant. Air-gapped mode supported.
Defence Information Systems Network compatible. STANAG 5525 CoT messages. BICES-capable.
Raspberry Pi 5 / Jetson Orin. Sensor ingestion, acoustic detection, camera feeds, drone telemetry. Runs MQTT bridge + TAK client. 4G/LTE or LoRa mesh. Solar + battery.
MacBook Pro M2/M3/M4. Local LLM inference (LLaMA 3.3 70B, Qwen 30B, Gemma 27B). FTS server. Sensor fusion. Offline-capable. 5-15ms latency to Edge nodes.
GCP VM (meok-backend). SOV3 sovereign substrate (:3101). King hive. 49 GB data moat. OLM corpus. Council (:3200). 24/7 autonomous ops.
5 nodes interconnected (M2, M3, M4, ORION, GCP VM). WireGuard tunnels. DID-authenticated. BFT consensus. Zero cloud dependency possible.
| Tier | Compute | Storage | Network | Power | Autonomy |
|---|---|---|---|---|---|
| L0 Edge | RPi 5 (8GB) / Jetson Orin | 128 GB NVMe | 4G/LTE / LoRa | Solar 20W | 48h no comms |
| L1 Fog | M2/M3/M4 MacBook | 512 GB - 2 TB SSD | WiFi / Ethernet | Mains / UPS | 72h offline |
| L2 Cloud | GCP e2-standard-8 | 200 GB SSD + 49 GB data | GCP VPC + WARP | Always-on | N/A (always on) |
| L3 Sovereign | 5-node mesh | Distributed (each node) | WireGuard P2P | Diverse | All offline → local fallback |
Standard DEFONEOS Edge Node — deployable in under 30 minutes from a single Raspberry Pi 5:
Raspberry Pi 5 (8GB) + 128GB NVMe SSD HAT + 4G/LTE HAT + GPS HAT. Solar panel 20W + 20,000mAh battery. Pelican case. Total: ~£200.
Ubuntu Server 24.04 ARM64. Docker: FTS client, MQTT bridge, Batear, rtsp-camera-mcp, MAVSDK listener. Systemd services for auto-recovery.
USB camera (RTSP stream), 4-mic array (Batear), GPS/GNSS, temperature/humidity, PIR motion. All streamed via MQTT → Fog tier.
Primary: 4G/LTE VPN to Fog. Secondary: LoRa mesh (868 MHz, 5 km range). Tertiary: WiFi ad-hoc. Fallback: store-and-forward on NVMe.
#!/bin/bash # DEFONEOS Edge Node — 30-min deploy curl -sL https://defoneos.com/deploy/edge.sh | bash -s -- \ --node-id EDGE-YORK-01 \ --fog-ip 10.42.0.1 \ --mesh-channel 868.1 \ --sensors camera,mic_array,gps,temp \ --auto-update # Installs: Docker + FTS client + MQTT bridge + Batear + RTSP camera # Registers DID on sovereign mesh # Starts health heartbeat every 30s to Fog tier
The strategic cloud tier runs on a single GCP e2-standard-8 VM. It hosts the SOV3 sovereign substrate, the 49 GB data moat, the King hive, and the 33-agent BFT council.
| Service | Port | Technology | Description |
|---|---|---|---|
| SOV3 Substrate | :3101/mcp | Python/FastAPI/uvicorn | 222 sovereign MCP tools. King hive + 28 hives + BFT council + striving |
| BFT Council | :3200 | Python PBFT | 33-agent Byzantine Fault Tolerant voting. JSP 936 auditable |
| SOV3 Map | :3300 | React + D3.js | Interactive 3D map of 429 sovereign nodes |
| OLM Corpus | Internal | PostgreSQL + pgvector | Organic Learning Model — 17+ MB Kimi research, 290+ files |
| Moat DB | Internal | PostgreSQL | 49 GB data moat — UK defence contracts, MOD suppliers, OSINT |
| Monitor | :9090 | Prometheus + Grafana | All 5 sovereign nodes monitored. Edge nodes heartbeat. |
| WARP | — | Cloudflare WARP | Zero-trust tunnel to Mac inference nodes. Encrypted mesh. |
GCP e2-standard-8. Intel Cascade Lake. 32 GB RAM. Handles concurrent 222-tool API + council votes.
Persistent SSD. OS + Docker + services. 49 GB data moat on attached volume.
Minimal install. Docker Compose for all services. systemd for auto-start. UFW firewall.
e2-standard-8 + 200 GB SSD + 49 GB data + network egress. MOD contract would fund upgrade to dedicated.
DEFONEOS is designed for JSP 440 (Secure Communications) and JSP 604 (Network Routing) compliance. Air-gapped operation is supported at all tiers.
Every node, agent, and operator has a hardware-rooted Decentralized Identifier (Ed25519). Mutual TLS between all tiers.
All inter-node traffic encrypted via WireGuard. P2P mesh — no central VPN server. Perfect forward secrecy.
All tiers independently operational. Edge → Fog works without internet. Cloud optional. Full BFT council available offline.
Every API call, CoT message, council vote, and deployment logged. SHA-256 + Ed25519 signed. Immutable append-only log.
PyRIT + Caldera continuous red-teaming. Automated prompt injection testing. BFT attack simulation every 24h.
Software Bill of Materials for every deployment. Every Python package, Docker image, system library tracked. Supply chain verified.
| Requirement | DEFONEOS Implementation | Status |
|---|---|---|
| Encryption at rest | LUKS full-disk encryption on all nodes. AES-256-XTS. | ✓ |
| Encryption in transit | WireGuard + mTLS on all inter-tier links. TLS 1.3 only. | ✓ |
| Key management | Hardware-rooted DIDs. Ed25519 keypair per node. TPM where available. | ✓ |
| Access control | RBAC via DIDs. Attribute-Based Access Control for CoT messages. | ✓ |
| Audit logging | Immutable append-only log. All actions signed + timestamped. | ✓ |
| Air-gap support | Offline mode tested. All critical functions work without internet. | ✓ |
| Cross-domain | DID-based trust between security domains. SECRET↔UNCLASS bridge planned. | Planned |
| Tool | Function | Input | Status |
|---|---|---|---|
deploy_node_status | Health check all deployed nodes | — | LIVE |
deploy_provision_edge | Provision new Edge node (RPi/Jetson) | node_id, config | LIVE |
deploy_get_telemetry | Get node CPU/RAM/disk/network | node_id | LIVE |
deploy_list_services | List running services per node | node_id | LIVE |
deploy_restart_service | Restart service on node | node_id, service_name | LIVE |
deploy_check_comms | Test inter-tier connectivity | from_tier, to_tier | LIVE |
deploy_airgap_mode | Toggle air-gap mode on tier | tier, enabled: bool | LIVE |
deploy_sbom_export | Export Software Bill of Materials | node_id, format | LIVE |
deploy_audit_export | Export JSP 440 audit trail | node_id, date_range | LIVE |
deploy_did_verify | Verify node hardware-rooted DID | node_id | LIVE |