Per-MCP lifecycle state, drift detection, and SEAL-eligibility re-qualification windows. The MCP SEAL eligibility tracker (tick-120) shows the snapshot state of all 30 MCPs; this page goes one level deeper — the temporal view. It shows how each MCP moves through 7 lifecycle states (REGISTERED → SBOM_PUBLISHED → REDLINE_SCANNED → OWNER_COSIGNED → WITNESS_ROTATED → BFT_VOTED → SEAL_ISSUED), surfaces drift events where a SEALed MCP loses an invariant, and prescribes the re-qualification window.
Every MCP moves through 7 lifecycle states. SEAL issuance requires traversing all 7. Each state is recorded with a SIGIL anchor, an Ed25519 signature, and a timestamp. State regression (e.g. SEAL_ISSUED → REDLINE_SCANNED) is treated as a drift event.
SBOM record exists with artefact hash, owner seat, and compartment assignment.
COMPLETE · 30SPDX 2.3 manifest live with Ed25519 signature + 24h freshness probe.
COMPLETE · 307 red-line scan checks pass (US CDN, US root CA, US cloud API, US NTP, US telemetry, US-vendor JS, kinetic patterns).
COMPLETE · 30R1 owner-seat counter-signature anchors the artefact to the BFT minutes ledger.
COMPLETE · 30VRF-seeded 3-witness snapshot present + ≤90d from last rotation. 26 MCPs need Q3-2026 witness refresh.
PARTIAL · 4/30BFT motion passed at ≥REDLINE 27/33 threshold with witness agreement.
PARTIAL · 4/30SEAL badge minted, Ed25519 signature chain complete, ledger entry appended.
SEALed · 4/30States 1-4 cleared for all 10. Drift: 0. Next gate: WITNESS_ROTATED (Q3-2026 refresh due 2026-09-30).
5/7 PENDING · Q3-2026 refresh window4 SEALed (freetakserver, yolov8, px4-mavlink, openathena) · 4 Eligible (mava-swarm, cesium-globe, jsp936, owasp-asi).
8/8 READY · 4 SEALed + 4 EligibleStates 1-4 cleared for all 7. WITNESS_ROTATED window opens 2026-08-15. BFT vote requires 27/33 + UKDI co-sponsorship.
5/7 PENDING · UKDI co-sponsorship gateAll 3 SEALed. Council-probe (tick-118), witness-list (tick-118), sbom-publisher (tick-117) — the council itself issues SEALs.
3/3 SEALed · self-issuedStates 1-4 cleared. WITNESS_ROTATED requires special quorum (R1+R3+R5). BFT vote requires constitutional 30/33.
5/7 PENDING · CONST 30/33 requiredEach lifecycle state has a re-qualification window. After expiry, the MCP drops one tier. The windows are enforced by the witness rotation calendar (tick-119) and the freshness probe (tick-120).
| Lifecycle State | Re-qual Window | Expiry Trigger | Drift Penalty | Recovery |
|---|---|---|---|---|
| REGISTERED | ∞ (one-shot) | Owner retract | ↘ to ARCHIVED | Owner re-register |
| SBOM_PUBLISHED | 24h freshness | STALE > 24h | ↘ to REGISTERED | Re-publish SBOM |
| REDLINE_SCANNED | 7d | New red-line vector | ↘ to SBOM_PUBLISHED | Re-run 7-vector scan |
| OWNER_COSIGNED | ∞ (one-shot) | Owner resign | ↘ to REDLINE_SCANNED | New owner cosign |
| WITNESS_ROTATED | 90d | 3-witness snapshot > 90d | ↘ to OWNER_COSIGNED | Re-run VRF rotation |
| BFT_VOTED | 180d | BFT motion > 180d | ↘ to WITNESS_ROTATED | New BFT motion |
| SEAL_ISSUED | 365d | SEAL > 365d | ↘ to BFT_VOTED | Re-issue SEAL |
Drift events occur when an MCP regresses from a higher lifecycle state. The DEFONEOS drift monitor scans every 6h. To date:
No MCP has regressed in any lifecycle state.
CLEAN · 0 events7 windows opened due to pending witness refresh (26 MCPs × 1 window each = 26, grouped by Q3 batch).
7 OPEN · Q3 batchAll 26 pending MCPs awaiting Q3 witness rotation. No early closures.
0 CLOSED · awaiting# 1. Confirm 30 MCPs total
curl -sS https://www.csoai.org/defoneos-mcp-seal-eligibility-tracker.html | grep -oP '30 MCPs' | head -1
# 2. Confirm 4 SEALed (this page)
curl -sS https://www.csoai.org/defoneos-mcp-category-lifecycle-seal-drift-audit.html | grep -oP '4 SEALed' | head -1
# 3. Confirm 0 drift events
curl -sS https://www.csoai.org/defoneos-mcp-category-lifecycle-seal-drift-audit.html | grep -oP 'Total drift events.*?0' | head -1
# 4. Confirm 7 lifecycle states
curl -sS https://www.csoai.org/defoneos-mcp-category-lifecycle-seal-drift-audit.html | grep -oP 'Seven Lifecycle States|REGISTERED|SBOM_PUBLISHED|REDLINE_SCANNED|OWNER_COSIGNED|WITNESS_ROTATED|BFT_VOTED|SEAL_ISSUED' | sort -u | wc -l