DEFONEOS MCP Federation Architecture

1 · The 3 Trust Rings

The federation is not flat. MCPs are assigned to one of three concentric trust rings based on data sensitivity, required sovereignty level, and failure tolerance. A tool invocation can cascade across rings, but data flows inward only — Ring 2 cannot write to Ring 0.

Ring 0 — Core Sovereign (7 MCPs)

Ring 1 — Defence Sensors (11 MCPs)

Ring 2 — Civil Open-Data (12 MCPs)

2 · Federation Topology

                    ┌──────────────────────────────────────────────┐
                    │            DEFONEOS MCP FEDERATION            │
                    │                                              │
                    │   ┌────────────────────────────────────┐     │
                    │   │          RING 0 (Core)             │     │
                    │   │  sigil · bft · compliance · seal   │     │
                    │   │  redteam · escrow · audit          │     │
                    │   │  [UK-sovereign inference only]     │     │
                    │   └──────────┬─────────────────────────┘     │
                    │              │ SIGIL-verified proxy          │
                    │   ┌──────────┴─────────────────────────┐     │
                    │   │       RING 1 (Defence)             │     │
                    │   │  freetak · sentinel · ais · gdelt  │     │
                    │   │  rtsp · yolo · athena · mava       │     │
                    │   │  cesium · mqtt · openaq            │     │
                    │   │  [AUKUS-compatible inference]      │     │
                    │   └──────────┬─────────────────────────┘     │
                    │              │ Read-only enrichment          │
                    │   ┌──────────┴─────────────────────────┐     │
                    │   │        RING 2 (Civil)              │     │
                    │   │  os · govuk · companies · ons      │     │
                    │   │  met · nhs · env · transport       │     │
                    │   │  planning · parliament · ofcom     │     │
                    │   │  landreg                           │     │
                    │   │  [Unconstrained inference]         │     │
                    │   └────────────────────────────────────┘     │
                    └──────────────────────────────────────────────┘

Data Flow Rules

• Inward cascade allowed: Ring 2 → Ring 1 → Ring 0 (data can flow inward for enrichment)
• Outward write FORBIDDEN: Ring 0 data never writes to Ring 1 or Ring 2
• Lateral within ring: Allowed but SIGIL-logged
• Cross-ring tool calls: Ring 0 can CALL Ring 1/2 tools (read-only). Ring 1/2 CANNOT call Ring 0 tools.

3 · SIGIL Attestation Flow

Every tool invocation across the federation generates a SIGIL attestation. The flow is:

1. Agent requests tool call: "call sentinel-hub-mcp.get_image(bbox=[...], date=...)"
2. Federation router checks: Is sentinel-hub-mcp in an allowed ring for this agent?
3. SIGIL-mcp generates attestation:
   {
     "sigil": "C|defoneos|tool-call|2026-07-14T17:30:00|",
     "caller": "agent:operational-cop",
     "ring": 1,
     "mcp": "sentinel-hub-mcp",
     "tool": "get_image",
     "args_hash": "blake3:a7f3...c2e9",
     "timestamp": "RFC3161://tsa.csoai.org",
     "ed25519_sig": "f3a7...c8d1"
   }
4. Sentinel-hub-mcp verifies the SIGIL before executing the tool
5. Result returned with response_hash appended to the SIGIL chain
6. Audit-mcp records the complete event in the append-only custody log

4 · BFT Council Admission Control

When a new MCP server applies to join the federation, it must pass BFT council admission control:

Revocation & Quarantine

• Revocation: If a BFT quorum (23/33) votes to revoke an MCP, its SIGIL key is revoked immediately. All future tool calls are rejected. The MCP is marked QUARANTINED in the registry.
• Emergency Quarantine: Any single BFT General can trigger an emergency quarantine with a signed declaration. This immediately blocks the MCP pending full council review (48h SLA). Designed for supply-chain compromise, prompt-injection discovery, or data-exfiltration suspicion.
• Automatic Quarantine: If the adversarial red-team harness detects a T4 or T5 finding on any live MCP, the federation router automatically quarantines the MCP and triggers a BFT emergency session.

5 · The 9-Point Admission Checklist

6 · Inference Routing Matrix

7 · Failover & Degradation

8 · Federation Discovery Protocol

New agents joining the DEFONEOS ecosystem discover the federation via a signed manifest:

GET /.well-known/defoneos-federation-manifest.json

{
  "federation": "DEFONEOS",
  "version": "1.0",
  "rings": {
    "ring0": {
      "mcps": ["sigil", "bft-council", "compliance", "seal", "redteam", "escrow", "audit"],
      "endpoint": "mcp://sovereign.csoai.org/ring0",
      "auth": "ed25519-challenge",
      "inference": "uk-sovereign-only"
    },
    "ring1": {
      "mcps": ["freetakserver", "sentinel-hub", "aisstream", ...],
      "endpoint": "mcp://sovereign.csoai.org/ring1",
      "auth": "ed25519-challenge",
      "inference": "aukus-compatible"
    },
    "ring2": {
      "mcps": ["os-opendata", "data-gov-uk", "companies-house", ...],
      "endpoint": "mcp://sovereign.csoai.org/ring2",
      "auth": "ed25519-challenge",
      "inference": "unrestricted"
    }
  },
  "bft_council": {
    "seats": 33,
    "quorum": 25,
    "minutes_url": "https://www.csoai.org/bft-minutes"
  },
  "sigil_chain_root": "blake3:0000...root",
  "manifest_signature": "ed25519:csoai-federation...sig"
}

9 · SIGIL Chain