DEFONEOS · Live Evidence Freshness Probe · Tick 112

Live evidence freshness probe — automated SLOs across every sovereign artefact.

This probe verifies, on every tick, that the live sovereign surfaces remain fresh, intact, and unrotated. It checks: SIGIL ledger entries, sovereign CA certificates, repo commits, MCP federations, sitemap coverage, byte receipts, and BFT care-score. Each artefact carries an SLO. Drift triggers SIGIL records for human review.

The 7 freshness probes

F1 — SIGIL ledger

Source: SIGIL SoT (Merkle root published weekly).

SLO: most-recent SIGIL ≤2h old at probe time; weekly SoT root within 7 days.

Drift: SIGIL_GAP_DETECTED (see operator troubleshooting).

F2 — Sovereign CA root

Source: sovereign-only CA, 1 offline Root + 3 online BFT-gated Intermediates.

SLO: Root CA not older than 730 days; intermediate within 90 days; pin set current within 30 days.

Drift: TLS_PINNING_MISMATCH.

Spec: TLS pinning spec.

F3 — Repository commits

Source: 15 cloned P0 repos.

SLO: all 15 repos reachable via git ls-remote within 60 seconds.

Drift: SUPPLY_CHAIN_INTEGRITY_FLAG (consult supply-chain scan).

F4 — MCP federation

Source: 30 MCP servers (count preserved from sprint).

SLO: 30/30 listed at federation architecture; admission probe p99 < 250 ms; idempotency-key 100% pass.

Drift: MCP_ADMISSION_BLOCKED.

F5 — Sitemap coverage

Source: published sitemap on csoai.org.

SLO: sitemap serves 200; URL count ≥ 134; last-modified ≤15 min.

Drift: SITEMAP_STALE.

F6 — Byte receipts

Source: disk byte count = curl byte count.

SLO: 100% pass on ship-grade pages (tick-100 onward); zero byte drift.

Drift: BYTE_DRIFT on any ship-grade page.

F7 — BFT care-score

Source: 33-agent BFT council; recent motions + vote tally.

SLO: care_score ≥ 0.90; red_line_violations = 0; quorum ≥23/33 standard motion; red-line 27/33 supermajority held.

Drift: BFT_QUORUM_LOST or RED_LINE_ATTEMPT.

Probe schedule

ProbeCadenceOwner
F1 SIGILEvery tick (2h)JEEVES / SIGIL ops
F2 CA rootDaily + per-publishSovereign CA ops
F3 RepoDaily + per-tickRepo integration
F4 MCPPer-tick + admissionFederation ops
F5 SitemapPer-tickJEEVES
F6 Byte receiptsPer-tickJEEVES
F7 BFTPer-vote + per-tickCouncil ops

Probe output schema

Each probe emits a JSON record on every run. Schema is published at defoneos-probe-schema.json. Key fields:

FieldDescription
probe_idStable identifier (F1..F7 + run index)
tsISO-8601 UTC timestamp
verdictPASS · WARN · FAIL
artifactWhat was probed
observedWhat was measured
slo_floorThreshold
drift_actionIf WARN/FAIL — which scenario to invoke
sigilEd25519 signature of this record