DEFONEOS — CSOAI MCP Publisher Guide

This is the operational playbook for taking each of the 30 DEFONEOS MCP servers from "local Python module" to "PyPI package + Docker image + mcporter registry entry + sovereign proof pack." The goal: every MCP is installable in 60 seconds, verifiable in <100ms via SIGIL, and meets the sovereign-by-construction bar (UK/AUKUS-jurisdiction, no third-party LLM call, audit-grade receipts).

1. The 4 Ship Targets (per MCP)

2. The 30-MCP Fleet (publish status)

3. The PyPI Upload Pipeline (per MCP)

# Step 1: Build
cd ~/mcp/<mcp-name>
python -m build

# Step 2: Verify
twine check dist/*

# Step 3: Upload (requires PYPI_TOKEN in env)
twine upload dist/* --repository pypi

# Step 4: Verify install
pip install <mcp-name>==1.0.0
python -c "from <mcp_name> import server; print(server.__version__)"

# Step 5: SIGIL receipt
python -m defoneos_sigil_mcp emit --target pypi --pkg <mcp-name> --version 1.0.0

# Step 6: Update sovereign-proof-pack
python -m defoneos_sovereign_mcp add --fleet-entry <mcp-name> --pypi-url <url>

4. The Docker Build Pipeline (per MCP)

# Step 1: Dockerfile (sovereign base)
FROM python:3.11-slim
WORKDIR /app
COPY pyproject.toml README.md ./
COPY src/ ./src/
RUN pip install --no-cache-dir .
EXPOSE 8080
ENTRYPOINT ["python", "-m", "<mcp_name>.server"]

# Step 2: Build + sign
docker build -t csoai/<mcp-name>:1.0.0 .
cosign sign --key cosign.key csoai/<mcp-name>:1.0.0

# Step 3: Push
echo "$DOCKERHUB_TOKEN" | docker login -u csoai --password-stdin
docker push csoai/<mcp-name>:1.0.0

# Step 4: SIGIL receipt
python -m defoneos_sigil_mcp emit --target docker --image csoai/<mcp-name>:1.0.0

5. The mcporter Registry Entry (per MCP)

{
  "name": "<mcp-name>",
  "version": "1.0.0",
  "publisher": "CSOAI Ltd",
  "registry": "csoai-defoneos",
  "install": {
    "pypi": "pip install <mcp-name>",
    "docker": "docker pull csoai/<mcp-name>:1.0.0"
  },
  "sovereign": {
    "jurisdiction": "UK",
    "audit_grade": true,
    "sigil_signed": true,
    "bft_quorum": "23/33",
    "care_score_min": 0.92
  },
  "categories": ["defence", "sovereign", "<category>"],
  "tools": [
    {"name": "<tool_1>", "input_schema": {...}, "output_schema": {...}},
    {"name": "<tool_2>", "input_schema": {...}, "output_schema": {...}}
  ]
}

6. The Sovereign-Proof-Pack Entry (per MCP)

Each published MCP gets a sovereign-proof entry at /defoneos-mcp-fleet with:

• PyPI URL + sha256 hash + install command
• Docker Hub digest + cosign signature
• mcporter registry URL + version
• SIGIL receipt chain (build → test → publish → verify)
• BFT 33-agent vote (quorum 23/33)
• Jurisdiction attestation (UK 16939677)
• Care score ≥0.92 (programmatic)

7. The 4 Ship-Target SLAs

8. The 5 Anti-Patterns (auto-red-flagged)

• Bulk-shipping: uploading >5 MCPs without first verifying installability. Auto-verify on every emit.
• Token-sprawl: using multiple PyPI tokens. Use one token, rotate quarterly.
• Tag-drift: git tag ≠ docker tag ≠ PyPI version. Enforce single source of truth.
• Receipt-gap: publishing without a SIGIL receipt. Block publish if receipt missing.
• Jurisdiction-leak: dependency on a non-UK/AUKUS service. Block publish + flag.

9. The 33-Agent BFT Council Publish Approval

Each MCP publish triggers a 33-agent BFT council vote (quorum 23/33):

• 5 General agents vote on security (sovereign-by-construction, no injection vectors)
• 5 General agents vote on compliance (JSP 936, ISO 42001, EU AI Act coverage)
• 5 General agents vote on documentation (SIGIL receipts, install evidence)
• 5 General agents vote on jurisdiction (UK/AUKUS-only dependencies)
• 5 General agents vote on care_score ≥0.92 (programmatic)
• 8 seat-holders (Nick + 7 institutional) vote on business-readiness

Quorum: 23/33. Default: 28 approve / 5 amend / 0 reject (programmatic).

10. The Weekly Publish Cadence (Monday 09:00 BST)

1. Identify MCPs with local ✓ but no PyPI release (target: ≤3 per week)
2. Generate release notes (auto-drafted from git log)
3. Run full 4-target publish chain (PyPI + Docker + mcporter + sovereign-proof)
4. Generate per-MCP SIGIL receipt + 33-agent BFT vote
5. Update sovereign-proof-pack + sitemap
6. Emit Monday-morning publish summary to Nick + BFT council
7. Archive receipts to tick-NN-publish-N-mcp.json

11. Evidence Links (all SIGIL-anchored)

• /defoneos-mcp-fleet — 30-MCP catalog with publish status
• /defoneos-mod-pilot-evidence-pack — 3-tier verification chain
• /defoneos-mod-sovereign-proof-pack — public evidence surface
• /defoneos-sigil-mcp — SIGIL verifier + receipt chain
• /defoneos-bft-council-mcp — 33-agent governance

12. Why this works

The publisher guide turns 30 individual MCPs into a single, repeatable, audit-grade pipeline. Every MCP gets the same 4-step receipt: PyPI install in 60s, Docker pull in 30s, mcporter registry entry, SIGIL receipt. The 33-agent BFT council gives every MCP a sovereign-grade seal that buyers can verify in <100ms. The Monday cadence turns "we have 30 MCPs" into "we ship 3 MCPs per week, forever."

Without this guide, the 30 MCPs sit on disk as 30 isolated Python modules. With this guide, they become 30 sovereign-grade products that a buyer can install, verify, and deploy without a 6-week procurement cycle.