csoai.wiki DNS Wire Pack

1 · Why sovereign.wiki matters

sovereign.wiki is the public-facing surface for the DEFONEOS sovereign AI substrate. Once pointed at the VM, it becomes:

• A public-readable encyclopedia of the sovereign AI stack (478 HTML pages, 81 defoneos-mod-* ship-grade artefacts)
• A live benchmark leaderboard (auto-updated by nightly cron, see /SOV33_OWEM_HONEST_FRONTIER.html)
• A public verification endpoint for the 33-agent BFT council + Ed25519 SIGIL chain
• A public advisory feed for security / compliance / PMS disclosures

Today, sovereign.wiki has DNS configured but is not pointing at any live server. This 5-step pack fixes that in 10 minutes.

2 · Prerequisites (before starting)

• Domain ownership — sovereign.wiki must be registered (it is, via Namecheap or Cloudflare)
• Vercel access — logged into Vercel dashboard with the csoai-static-deploy2 project
• GCP VM access — 35.242.143.249 must be reachable (it is, per substrate topology)
• Cloudflare DNS — most likely the current DNS provider; if different, substitute commands accordingly

3 · The 5 steps (copy-paste, ~10 min total)

Step 1 — Add A-record at DNS provider (3 min)

At Cloudflare (or your current DNS provider for sovereign.wiki):

Type: A
Name: @ (or sovereign.wiki root)
Content: 35.242.143.249
TTL: Auto (or 300 seconds)
Proxy: DNS-only (grey cloud) — DO NOT proxy through Cloudflare; we want direct IP

If using Cloudflare, ensure the proxy is OFF (grey cloud icon) so the IP is exposed directly. This is required for SSL provisioning on Vercel.

Step 2 — Add www CNAME pointing to apex (1 min)

Type: CNAME
Name: www
Content: sovereign.wiki
TTL: Auto

This ensures www.sovereign.wiki redirects to sovereign.wiki.

Step 3 — Wait for DNS propagation (2-7 min)

dig +short sovereign.wiki A
# Expected: 35.242.143.249
dig +short www.sovereign.wiki CNAME
# Expected: sovereign.wiki.

Typical propagation: 2-5 min with low TTL, up to 30 min with high TTL. Most DNS providers honor low TTL within minutes.

Step 4 — Add sovereign.wiki as Vercel domain (2 min)

In Vercel dashboard:

1. Go to csoai-static-deploy2 project → Settings → Domains
2. Add domain: sovereign.wiki
3. Vercel auto-detects the A-record and provisions Let's Encrypt SSL
4. Add redirect: www.sovereign.wiki → sovereign.wiki (301 permanent)

Vercel will show "Valid Configuration" once the A-record is detected and SSL is provisioned (~1-2 min).

Step 5 — SIGIL-anchored wire attestation (1 min)

Run the verification command and append the SIGIL receipt:

curl -sI https://sovereign.wiki | head -5
# Expected: HTTP/2 200 · server: Vercel · x-vercel-id: ...

# Generate SIGIL receipt
python3 -c "
import hashlib, json, time
receipt = {
    'event': 'sovereign.wiki wire complete',
    'timestamp': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()),
    'domain': 'sovereign.wiki',
    'points_to': '35.242.143.249',
    'vercel_project': 'csoai-static-deploy2',
    'ssl': 'Let\\'s Encrypt (auto-provisioned by Vercel)',
    'content_sha256': hashlib.sha256(open('/Users/nicholas/clawd/csoai-static-deploy2/index.html','rb').read()).hexdigest(),
}
print(json.dumps(receipt, indent=2))
" > /Users/nicholas/clawd/csoai-static-deploy2/wire-attestation.json

Append to the nightly cron log + add to the DEFONEOS_SPRINT_STATE.json human_gates list (mark as resolved).

4 · Post-wire verification (3 quick checks)

1. SSL test: curl -vI https://sovereign.wiki 2>&1 | grep -E "subject|issuer|expire" — should show valid Let's Encrypt cert, expiry > 60 days
2. Content test: curl -sL https://sovereign.wiki | head -20 — should show the DEFONEOS home page
3. WWW redirect: curl -sI https://www.sovereign.wiki | head -3 — should show 301 → sovereign.wiki

5 · What this unblocks

6 · Risks and mitigations

7 · Rollback plan (if anything goes wrong)

1. Remove A-record at DNS provider → sovereign.wiki returns to "no such host"
2. Remove domain at Vercel dashboard → SSL cert auto-revoked within 24h
3. No data loss — sovereign.wiki was empty before, will be empty after rollback
4. Re-attempt after 24h SSL cleanup

8 · Cross-walk to other DEFONEOS artefacts

9 · The 5 Anti-Patterns (DNS Wire Disasters We Refuse)

1. No "skip the SIGIL attestation." Step 5 is mandatory for audit trail.
2. No "proxy through Cloudflare without testing." Breaks SSL auto-provisioning.
3. No "high TTL on A-record." Propagation delays become a problem if rollback needed.
4. No "skip the verification checks." 3 quick checks are the difference between "working" and "looks-working-but-redirects-to-404".
5. No "deploy content first, then DNS." Always DNS first, then content; otherwise content lives at an un-resolvable domain for the propagation window.

10 · Estimated time breakdown

Wall-clock total: 7-13 minutes. The single largest time sink is DNS propagation; using low TTL (300s) minimises this.

11 · Next Steps

1. Verify this pack: curl https://csoai.org/defoneos-mod-csoai-wiki-wire-pack.html | shasum -a 256
2. Open Cloudflare DNS: cloudflare.com → sovereign.wiki → DNS
3. Add A-record (Step 1)
4. Wait 2-5 min for propagation
5. Add to Vercel (Step 4)
6. Run SIGIL attestation (Step 5)
7. Append wire-attestation.json to nightly log
8. Mark human-gate "sovereign.wiki DNS" as resolved in DEFONEOS_SPRINT_STATE.json