33-Agent Byzantine Fault Tolerant governance council for sovereign defence AI decisions. JSP 936 auditable, CSOAI certified, NATO STANAG aligned. Every kill-chain decision: human-authorised, AI-advised, BFT-verified.
33 sovereign AI agents voting. 23 required for consensus (2f+1 where f=11). No single agent can dominate.
Up to 11 agents can be compromised/byzantine without breaking consensus. PBFT-style 3-phase commit.
Full JSP 936 Part 1-7 audit trail. Every vote logged, signed, timestamped. Immutable.
Human operator submits decision request (e.g., "engage target Alpha-7"). Request is hashed, signed, broadcast to all 33 agents.
One agent designated leader (rotated per round). Leader validates request against ROE, JSP 936, mission parameters. Broadcasts PRE-PREPARE with sequence number.
Each agent independently validates leader's proposal. Checks: ROE compliance, PID confirmation, proportionality, necessity. Broadcasts PREPARE vote.
Once 23 agents agree (2×11+1), each broadcasts COMMIT. Decision locked. Cannot be reversed by minority.
Decision executed (human presses final button). Full 3-phase audit trail written to immutable log. JSP 936 Part 7 compliant.
| Parameter | Value | Rationale |
|---|---|---|
| Total Agents (n) | 33 | Prime number — no even splits possible |
| Fault Tolerance (f) | 11 | 33 = 3f → f=11. Up to 33% compromised tolerated. |
| Consensus Threshold | 23 (2f+1) | Any 23 agents form a supermajority |
| Leader Rotation | Every round (30s) | No permanent leader — prevents capture |
| View Change Timeout | 10s | If leader unresponsive, trigger view change |
| Agent Diversity | 6 LLM families × 5+ instances | Heterogeneous — no single-model vulnerability |
| Audit Trail | SHA-256 + Ed25519 signed | JSP 936 Part 7, ISO 27001 compatible |
The 33 agents are drawn from 6 distinct model families across 5 sovereign inference nodes. No single provider controls more than 30% of the council.
| Family | Agents | Model | Node | Specialty |
|---|---|---|---|---|
| LLaMA 3.3 | 8 agents | 70B-Instruct | M2/M3/M4 MacBooks | General reasoning, ROE interpretation |
| Qwen 3 | 6 agents | 30B-A3B (MoE) | ORION Mac Studio | Multi-perspective analysis |
| Mistral | 5 agents | Large 2 (123B) | GCP VM meok-backend | Legal/LOAC compliance check |
| DeepSeek | 5 agents | V3/R1 | M2/M3 MacBooks | Technical validation, sensor fusion |
| Gemma 3 | 5 agents | 27B | M4 MacBook Pro | Ethics, proportionality, collateral damage |
| Command R+ | 4 agents | 104B | ORION Mac Studio | Tactical feasibility, fire support |
| Vote | Meaning | Effect |
|---|---|---|
| APPROVE | Decision complies with all ROE, LOAC, JSP 936 | Counts toward 23-vote threshold |
| REJECT | Decision violates ROE/LOAC/JSP 936 | Blocks if 12+ agents reject |
| ABSTAIN | Insufficient information to decide | Counts toward quorum, not approval |
| RECUSE | Agent has conflict (model family, training data) | Excluded from quorum calculation |
Every BFT council decision generates a full JSP 936 Part 1-7 compliant audit trail. Immutable, cryptographically signed, exportable to MOD auditors.
Who requested, when, what target, what ROE context. SHA-256 hash of all inputs.
Leader's validation: sensor fusion, PID confidence, ROE check, collateral damage estimate. Signed Ed25519.
Every agent's independent analysis. Full reasoning trace. Model version, temperature, seed. Vote + signature.
23+ COMMIT votes. Byzantine fault tally. Any rejected agents' reasoning preserved for audit.
Human authorisation. Final command sent. Effect confirmation (BDA). All logged, signed.
Full timeline. All sensor data. All agent reasoning. Exportable as signed PDF + JSON for MOD DSA audit.
| Attack Vector | BFT Mitigation | Residual Risk |
|---|---|---|
| Model Poisoning | 6 model families — poisoning 1 family doesn't break consensus (max 8/33 votes) | LOW |
| Sybil Attack | Each agent has hardware-rooted DID (Ed25519 keypair). Cannot spawn fake agents. | LOW |
| Leader Capture | Leader rotated every round. Captured leader can only delay (10s timeout → view change). | LOW |
| Replay Attack | Every vote has unique sequence number + timestamp + nonce. Replay rejected by all agents. | NONE |
| Network Partition | Each agent on separate node. 4 physical locations (M2, M3, M4, ORION, GCP). | MEDIUM |
| Supply Chain | All models run locally (Mac inference). No cloud API dependency. Offline-capable. | LOW |
| Prompt Injection | Each agent processes structured JSON only. No free-text input from external sources. | LOW |
| 51% Attack | Would need to compromise 23/33 agents across 5 nodes + 6 model families. Physically infeasible. | LOW |
| Tool | Function | Input | Status |
|---|---|---|---|
bft_council_status | List all 33 agents, health, node | — | LIVE |
bft_submit_decision | Submit kill-chain decision for vote | target_id, roe_context, sensor_data | LIVE |
bft_get_consensus | Get vote tally for decision | decision_id | LIVE |
bft_get_audit_trail | Export JSP 936 audit for decision | decision_id, format (pdf/json) | LIVE |
bft_list_decisions | List recent council decisions | limit, status_filter | LIVE |
bft_simulate_attack | Red-team: test BFT resilience | attack_vector, compromised_agents | LIVE |
bft_rotate_leader | Force leader rotation | — | LIVE |
bft_agent_did_verify | Verify agent hardware-rooted DID | agent_id | LIVE |