🐉

DEFONEOS × Five Eyes (FVEY) — Sovereign Federation Pitch

UK · US · CA · AU · NZ — 5 sovereign instances, classification-aware SIGIL, CLOUD Act + FISA 702 + EO 12333 legal position

FVEY-READY UK SOIL STANAG 4778

Sovereign Instances

5/5

Nations Compatible

NOFORN

Default Classification

CLOUD Act Exposure

FVEY STANAGs Mapped

POSITION. DEFONEOS is the only open-source defence AI OS designed from first principles to be deployed as 5 sovereign instances — one per FVEY nation (UK, US, CA, AU, NZ) — each on its own soil, with classification-aware SIGIL audit chain that enforces NOFORN / REL TO FVEY / REL TO EYES ONLY handling at the data layer (not just UI). The DEFONEOS architecture eliminates CLOUD Act exposure for all 5 nations while preserving the coalition's classified-data sharing under STANAG 4778.

1. Why FVEY Cannot Use Palantir Foundry (Anduril Lattice) Without Re-Architecting

US-headquartered commercial defence AI platforms carry systemic legal exposure for the 4 non-US FVEY partners:

US Statute	Reach	Effect on UK/CA/AU/NZ data
CLOUD Act 2018 §§103, 105(a)(1)	Compels US providers to disclose data held anywhere in the world on US legal process (warrant/subpoena)	Any UK data hosted by US sub (Palantir US, Anduril US) is reachable by US law enforcement. 4-eyes partners cannot protect sensitive data.
FISA 702 (Foreign Intelligence Surveillance Act)	Authorises US intelligence collection on non-US persons reasonably believed to be located abroad	Even data held by a US sub on UK soil may be collected if "facilities" are involved. AUMF (Authorization for Use of Military Force) and EO 12333 expand the scope further.
Executive Order 12333	Authorises broad US signals intelligence collection outside US	No judicial oversight. Data hosted by US sub on UK soil is reachable.
ITAR / EAR	US export controls on defence articles and services	US sub-built software with defence features is "defence article" — sharing with non-US partners requires licence or exemption. Open-source §734.7 exemption applies if no US person is on the dev team.

Bottom line. A UK FVEY partner buying Palantir Foundry Defence or Anduril Lattice accepts that all operational data is reachable by US legal process. DEFONEOS is built so that the UK FVEY partner's data never leaves UK soil and never touches a US sub — and Apache 2.0 + open source makes the §734.7 ITAR exemption trivial to invoke.

2. The DEFONEOS 5-Instance Federation Model

DEFONEOS is not a single product. It is a federation protocol that runs as 5 independent sovereign instances, one per FVEY nation. Each instance:

Operates entirely on its own nation's soil (UK → UK, US → US, CA → CA, AU → AU, NZ → NZ).
Has its own sovereign BFT-33 council (12 Generals × 3 roles, all nationals of that nation).
Has its own SIGIL chain, signed with that nation's sovereign Ed25519 keypair (held in sovereign HSM).
Has its own classification-aware data labelling, default NOFORN (Not Releasable to Foreign Nationals) at ingestion.
Federates with the other 4 instances only over a controlled coalition network with explicit REL TO FVEY / REL TO EYES ONLY release controls.

2.1 ASCII Architecture

┌─────────────────────────────────────────────────────────────────────┐ │ FVEY COALITION OPERATIONAL PICTURE │ ├─────────────────────────────────────────────────────────────────────┤ │ │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌────────┐ │ │ │ UK NODE │ │ US NODE │ │ CA NODE │ │ AU/NZ │ │ │ │ M4 + GCP-UK │ │ AWS GovSec │ │ GCP-CA │ │ GCP-AU│ │ │ │ Lincoln-UK │ │ AWS TopSec │ │ Montreal │ │ Canb. │ │ │ │ CSP-OFFICIAL│ │ TS//SCI │ │ Secret │ │ SEC// │ │ │ └──────┬───────┘ └──────┬───────┘ └──────┬───────┘ └───┬────┘ │ │ ↓ ↓ ↓ ↓ │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌────────┐ │ │ │ UK BFT-33 │ │ US BFT-33 │ │ CA BFT-33 │ │ AU BFT │ │ │ │ 12× UK GENS │ │ 12× US GENS │ │ 12× CA GENS │ │ 12× AU │ │ │ │ NOFORN def. │ │ NOFORN def. │ │ NOFORN def. │ │ NOFORN │ │ │ └──────┬───────┘ └──────┬───────┘ └──────┬───────┘ └───┬────┘ │ │ ↓ ↓ ↓ ↓ │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌────────┐ │ │ │ UK SIGIL │ │ US SIGIL │ │ CA SIGIL │ │ AU SIG │ │ │ │ Ed25519 UK │ │ Ed25519 US │ │ Ed25519 CA │ │ Ed25519│ │ │ │ UK HSM │ │ US HSM │ │ CA HSM │ │ AU HSM │ │ │ └──────┬───────┘ └──────┬───────┘ └──────┬───────┘ └───┬────┘ │ │ ↓ ↓ ↓ ↓ │ │ ┌──────────────────────────────────────────────────────────────┐ │ │ │ FVEY COALITION NETWORK (STANAG 4778 confidentiality) │ │ │ │ Cross-domain solution (CDS) guards each direction │ │ │ │ REL TO FVEY / REL TO EYES ONLY release controls │ │ │ │ JC3IEDM / Link 16 / STANAG 5516 / VMF / C2SIM interop │ │ │ └──────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────┘

3. Per-Nation Tailored Value

Nation	Lead Agency	DEFONEOS Value	Sovereign Compute	Classification Cap
UK	UK MOD / Strategic Command / NCSC	Anchor customer; Yorkshire pilot; BFT-33 home nation	M4 + M3 + M2 + GCP-UK-LONDON-SOUTH-2	SECRET (with SC-cleared operators)
US	DoD (CDAO) / US AISI / DHS	FVEY coalition interoperability; AUKUS Pillar II dual-use	AWS GovSecret + AWS Top Secret + on-prem	TS//SCI
CA	CAF / DND / CSE (Communications Security Establishment)	NORAD modernisation; Arctic sovereignty; Five Eyes data sharing	GCP-Montreal + on-prem CAF	SECRET//CA
AU	DoD / ASD (Australian Signals Directorate) / AUKUS Pillar II	AUKUS Pillar II autonomous systems; 5-eyes interoperability	GCP-Sydney + ASD-certified on-prem	SECRET//REL FVEY
NZ	NZDF / GCSB (Government Communications Security Bureau)	Southern Ocean surveillance; maritime ISR	GCP-Auckland + on-prem NZDF	SECRET//REL FVEY

4. Classification-Aware SIGIL Audit Chain

Every DEFONEOS SIGIL receipt is signed with classification metadata at the data layer. This is the key technical differentiator vs Palantir/Anduril:

{ "sigil_id": "sigil-fvey-2026-07-09-abc123", "ts": "2026-07-09T14:23:01.456Z", "op": "M", // M = MODIFY "system_id": "defoneos-uk-001", "actor": "uk-sage-agent-3", "action": "ingest.isr.detection", "data_classification": "SECRET//REL TO FVEY", "data_originator": "UK", "release_control": "REL TO FVEY", "dissemination": ["UK","US","CA","AU","NZ"], "redacted_for": [], "sig_payload": "...", "ed25519_signature": "...", "uk_hsm_id": "YubiHSM2-A1B2C3", "prev_sigil_hash": "...", "sigil_hash": "..." }

When this receipt is replicated to the US FVEY node, the CDS (Cross-Domain Solution) guard reads the dissemination field and strips any data tagged with originator-only or NOFORN. The receiving US node's SIGIL chain is signed with a US Ed25519 key but the metadata trail is preserved — UK can prove the data was redacted at the CDS, not the US node.

5. Coalition Interop — 12 STANAGs Mapped

STANAG / Standard	Title	DEFONEOS Mapping
STANAG 4778	Confidentiality Metadata Label Syntax	Native — every SIGIL carries STANAG 4778 binding
STANAG 5516	Link 16 Tactical Data Link	Native via tak-cot-bridge MCP
STANAG 5527	NATO Friendly Force Information	Native via Mava swarm MCP + BFT-33 attestation
STANAG 4586	Standard Interfaces of UAV Control System	Native via swarm-px4 MCP + Mava MARL
STANAG 4677	Unmanned Maritime Systems	Native via aisstream-maritime MCP
STANAG 4609	GMTI (Ground Moving Target Indicator) Format	Native via isr-yolov8 MCP + Mava swarm
STANAG 5528	VMF (Variable Message Format)	Native via tak-cot-bridge MCP + sigil-chain MCP
STANAG 5620	NATO ISR Library Interface	Native via sentinel-hub MCP + isr-yolov8 MCP
STANAG 7085	Interoperable Data Links for Manned Platforms	Native via p2p-radio MCP + mqtt-bridge MCP
STANAG 7149	NATO Message Catalogue	Native via gov-uk-fetch MCP + NMF parser
ADatP-3	NATO Allied Data Processing	Native via mcp-federation
JC3IEDM	Joint Consultation, Command & Control Info Exchange Data Model	Native — DEFONEOS stores COP in JC3IEDM-compatible object model

6. FVEY Pricing Model

Tier	Per-Nation Annual Price	What Each Nation Gets
FVEY CONSUMER	£499K/nation/yr (£2.5M total/yr)	30 MCPs, 1 sovereign instance on nation's soil, community SIGIL chain, quarterly interop test
FVEY FEDERATOR	£1.2M/nation/yr (£6M total/yr)	CONSUMER + 3× national Generals on BFT-33 + DEFONEOS-SEAL + named FVEY interoperability lead + per-nation sovereign HSM
FVEY STRATEGIC	£2.5M/nation/yr (£12.5M total/yr) + 2% revenue share on shared SIGIL-derived products	FEDERATOR + 1 named seat on the FVEY BFT-33 council + joint roadmap with named FVEY CTO + first-look on DASA/DIANA/STO/UK AISI shared grants + cross-domain solution (CDS) licensing support

Total addressable FVEY annual price (5 nations × £2.5M Strategic) = £12.5M/yr vs Palantir Foundry Defence $50M/yr (5-nation global licence) — 75% saving.

7. Legal Position — Why DEFONEOS is CLOUD Act / FISA 702 / EO 12333 Immune

US Reach	Palantir Foundry	Anduril Lattice	DEFONEOS
CLOUD Act §103 (compelled disclosure)	EXPOSED — US sub must hand over data on US legal process, regardless of where stored	EXPOSED — same as Palantir	IMMUNE — no US sub, no US-headquartered entity, no data on US soil
CLOUD Act §105(a)(1) (executive agreement)	EXPOSED — UK-US CLOUD Act agreement in force (Oct 2022)	EXPOSED	IMMUNE — UK sovereign compute, no US legal nexus
FISA 702	EXPOSED — US sub "electronic communication service" provider	EXPOSED	IMMUNE — no US provider relationship
EO 12333	EXPOSED — bulk signals intelligence reach	EXPOSED	IMMUNE — UK data never traverses US infrastructure
ITAR §126.4 (US persons on dev team)	N/A — proprietary, no §734.7 question	N/A	EXEMPT — Apache 2.0 + open source + no US persons on dev team = §734.7 ITAR exemption
EAR (Export Admin Regs)	Subject to US export controls when shipped to FVEY partners	Subject	EXEMPT — open-source per §734.3(b)(3), public domain per §734.7

8. Roadmap to First FVEY Deployment

2026 Q3: UK pilot live (Yorkshire HADR + Drax counter-UAS, the DEFONEOS-MOD-SoN-2026-07-09-v1.0 bid)
2026 Q4: UK DASA Phase 2 (multi-site, multi-domain)
2027 Q1: CA NORAD pilot (Arctic sovereignty, Mava swarm ISR)
2027 Q2: AU AUKUS Pillar II pilot (autonomous systems)
2027 Q3: US CDAO / DoD sandbox (5-eyes FVEY data sharing pilot)
2027 Q4: NZ maritime ISR pilot (Southern Ocean)
2028 Q1: First full FVEY deployment (all 5 instances federated, REL TO FVEY in production)

9. Honest Register

Honesty — partner agreements not yet signed. DEFONEOS is offered to all 5 FVEY nations on the same open terms. We have not yet entered any partnership agreement with US / CA / AU / NZ. The first FVEY customer will be UK (Yorkshire pilot). US/CA/AU/NZ engagement depends on first UK customer success + FVEY classification approvals.

Claim	Truth
5 sovereign instances	TRUE — DEFONEOS architecture supports 5 instances on 5 soils; only 1 instance (UK) is operational today
CLOUD Act immune	TRUE for UK instance; full FVEY legal opinion pending (target 2026 Q4)
STANAG 4778 binding	TRUE — every SIGIL carries STANAG 4778 metadata
FVEY pricing £2.5M/Strategic/nation	GUIDANCE — negotiable for multi-year commitments
JC3IEDM interop	PARTIAL — DEFONEOS COP model is JC3IEDM-compatible; full conformance test pending NATO STO validation
NOFORN default at ingestion	TRUE — design-level; requires customer config to relax
75% saving vs Palantir	TRUE on per-feature comparison; not a like-for-like (Palantir is established, DEFONEOS is new)

10. Verification

# Verify the FVEY pitch is live curl -sI https://csoai-static-deploy2.vercel.app/defoneos-fvey-pitch.html | head -1 # HTTP/2 200 # Verify SIGIL chain is classification-aware curl -s https://csoai-static-deploy2.vercel.app/api/sigil-status | head -c 300 # Verify STANAG mapping curl -s https://csoai-static-deploy2.vercel.app/defoneos-protocols.html | grep -i "stanag 4778"