Nexus Synergy Engagement Package — E10 · Armada Española (Spanish Navy) + Puertos del Estado / a state port authority — harbour & littoral surveillance/protection (PESCO HARMSPRO capability)

STANDING BANNER — read first. (1) Status honesty. Nexus Synergy Ltd is pre-incorporation, pre-revenue, pre-pilot. The Armada Española and Puertos del Estado are a TARGET, not a customer, partner, or pilot. The ~178-surface UI gallery is a gallery, not traction. Nothing here is a deployment. (2) Anti-cookie-cutter. The §8 screens are generated from this buyer's real entities (Bahía de Algeciras, the Strait of Gibraltar, the Armada "Proserpina" diver-support vessel, Indra/Navantia primes) — not a reused template. (3) Every probability is [PRIOR] — a subjective pre-pilot estimate for prioritisation, never a forecast. Decline-safe, civil-security framing only: harbour/littoral protection + coastal-security coordination + critical-(subsea)-infrastructure resilience. NOT warfighting; NO fire-control; NO biometric ID; NO predictive policing.

⚠ ONE VERIFICATION FLAG carried throughout. The package slug names "Spain · PESCO HARMSPRO". On the public record HARMSPRO is an ITALY-led PESCO project (members: Greece, Poland, Portugal); Spain is not a confirmed HARMSPRO participant. Spain's verified PESCO-maritime lead is the 4E (Essential Elements of European Escorts) project, Navantia-coordinated. HARMSPRO is therefore used here as the capability descriptor (harbour→littoral surveillance & protection) that the Armada/port buyer needs, not as a claimed Spanish membership. The buyer, the dated forcing functions, the funding routes and the incumbents are all independently verified (see §22 Sources). This package is scored because a named buyer + a procurement route are established; the HARMSPRO-membership point is flagged [unverified] wherever it appears.

---

§0 — Header + one-line thesis

Nexus Synergy as the sovereign, vendor-neutral DECISION / common-operating-picture layer above Spain's harbour & littoral protection sensors — fusing AIS/VTS + Sat-AIS + Sentinel-1 SAR + diver/USV sonar + subsea-cable telemetry into one human-gated, fully-audited Recognised Maritime Picture for a Capitanía Marítima / Armada watch, sitting above the Indra/Navantia sensor-and-platform estate rather than replacing it. The wedge is the decision/audit layer, not the radar.

---

§1 — Entity snapshot (cited)

---

§2 — The pain (web-verified, dated, cited)

1. A dated, named subsea-cable threat the Armada is visibly responding to. On 13 April 2026 Spain launched the "Proserpina" diver-support vessel at Vigo specifically to "protect submarine cables against possible attacks or sabotage", citing Russian submarine activity near critical Atlantic cables and the Baltic cable-cut incidents of 2024/25 (Euronews ES; DatacenterDynamics ES). A hull is a sensor-and-effector platform — it is not a decision/audit layer. The gap between "we can put a diver on the seabed" and "we have one auditable operating picture that told us where and when to dispatch the diver" is exactly the wedge. [verified]
2. A €7 bn port build-out with no matching resilience picture. Puertos del Estado's €7 bn 2025–2029 plan (announced 6 Nov 2025) expands the very assets (Valencia north terminal, Cádiz container terminal) that CER/NIS2 will then require to be resilient and monitored. Capex without a fused harbour-protection COP is asset-rich, awareness-poor. [verified]
3. The Strait of Gibraltar is the densest civil-maritime chokepoint in Western Europe — Algeciras is Spain's largest port and the busiest EU transshipment hub (Tanger Med across the Strait overtook it on container volume in 2024) — and harbour/littoral protection there means fusing open AIS/VTS, Sat-AIS, SAR, diver/USV sonar, and cable telemetry across Armada, Capitanía Marítima, Guardia Civil del Mar and the port authority. Today those sit in separate stovepipes with separate audit trails. [verified — geography]; [likely — stovepipe characterisation, to confirm in discovery]
4. Sovereignty + auditability pressure. EU AI-Act high-risk obligations (Article-5 prohibitions applicable 2 February 2025), GDPR, NIS2/CER critical-entity duties, and the EDIP "buy-European" posture all push toward a decision layer that can show why and keep model calls in-jurisdiction. [verified — regime]

---

§3 — Use-case & value (DECLINE-SAFE framing)

What we do: a sovereign decision / common-operating-picture layer for harbour & littoral PROTECTION — fuse the sensor estate into one Recognised Maritime Picture, run a closed detect → enrich → triage → gate → task → execute → assess → close loop, and write tasking/notifications back to the Armada/Capitanía/port CAD with a Merkle-anchored provenance ledger behind every decision.

Decline-safe value, explicitly:

• Resilience — subsea-cable + port-asset protection: spot the anomaly (an AIS-dark loiter over a cable run), gate the response, dispatch Proserpina/a patrol/USV, close the loop.
• Safety — collision/grounding/pollution risk in the Strait chokepoint surfaced as area awareness, never as individual scoring.
• Coordination — one picture across Armada + Capitanía Marítima + port authority + Guardia Civil del Mar, each tenant sovereign over its own ground-truth.

Explicitly OUT (Declined List, stated in every showing): NOT predictive policing · NOT real-time biometric identification · NOT emotion recognition · NOT social scoring · NOT untargeted scraping · NOT psychometric profiling · NOT warfighting / weapons fire-control. People appear only as access-control roles (a port-facility badge, a duty officer), never as biometric or behavioural profiles. Vessel telemetry is asset/area/vessel data, not crew data. ELINT/SIGINT is off unless a Tier-4 warrant reference exists (enforced as a DB CHECK, §5).

---

§4 — Ontology (this buyer's domain)

Entities. Vessel (per-MMSI; flag-state; IMO; owner-chain where known; LOA). AIS-Contact (per-ping LatLon + COG/SOG + spoof-suspicion score + receive-station). SatAIS-Contact (Copernicus/EMSA pass-geometry confidence). SAR-Scene-Match (Sentinel-1 IW; centroid; backscatter; estimated LOA). Sonar-Contact (diver/USV side-scan; seabed track O5). Cable-Asset (Estepona–Tetouan segment; criticality weight; landing station). Port-Facility (Algeciras terminal; ISPS facility-id; MARSEC level). Access-Credential (port-facility badge — role only). MARSEC-Posture (level 1/2/3). Warrant (Tier-4 collection authority — placeholder; NULL until issued).

Relationships. Vessel —ais_telemetry→ AIS-Contact; AIS-Contact —contradicted_by→ {SatAIS-Contact, SAR-Scene-Match} (dark-vessel test); AIS-Contact —loiters_near→ Cable-Asset; Sonar-Contact —proximal_to→ Cable-Asset; Vessel —approaching→ Port-Facility; Access-Credential —scanned_at→ Port-Facility; Port-Facility —has_posture→ MARSEC-Posture. Fellegi-Sunter is used for the hard ER problem — is the Sentinel-1 radar blob the same hull that KASTOR-7's spoofed AIS track claims is elsewhere? — scoring cross-track residual (w≈+4.5), SAR-LOA vs AIS-static-LOA (w≈+3.0), SAR-wake heading vs AIS-COG (w≈+2.1) → ΣW ≈ 8.12 > T_μ ⇒ accept the SAR-confirm. Every inference carries a PROV-O wasGeneratedBy tag.

---

§5 — Data model (2 tables, RLS + a load-bearing CHECK)

org_id-scoped for the app.current_org_id RLS predicate. The load-bearing safety property is the civilian→ELINT/SIGINT tier boundary: a contact cannot record an ELINT-collection authorisation without a Tier-4 warrant reference — enforced as a DB CHECK, not application logic, so it survives a buggy client.

SQL
45 lines
Copy
-- Harbour/littoral anomalous contact = the cross-tenant alert entity.
-- The civilian -> ELINT boundary lives here, as a DB invariant.
CREATE TABLE synergy.harbour_contact (
    id                      uuid PRIMARY KEY DEFAULT gen_random_uuid(),
    org_id                  uuid NOT NULL,                       -- RLS: app.current_org_id
    port_facility           text NOT NULL,                       -- 'ES-ALG-IslaVerde'
    vessel_mmsi             text,                                -- anonymised in the picture
    flag_state              text,                                -- 'PAN'
    ais_gap_minutes         numeric(6,1) NOT NULL DEFAULT 0,     -- 19.0
    satais_delta_nm         numeric(6,1),                        -- 14.0 (self vs Sat-AIS)
    sar_confirm_weight      numeric(6,2),                        -- 8.12 (Fellegi-Sunter ΣW)
    near_cable_segment      text,                                -- 'ESTP-TET-S02' or NULL
    loiter_over_cable       boolean NOT NULL DEFAULT false,      -- 1nm/zone test over a cable run
    anomaly_score           numeric(4,3) NOT NULL,               -- 0.860
    proportionality         numeric(4,3) NOT NULL,               -- Art-8 ECHR derived (vessel master)
    obs_level               text NOT NULL DEFAULT 'inferred'
                            CHECK (obs_level IN ('asserted','reported','inferred','direct','confirmed')),
    disposition             text NOT NULL DEFAULT 'monitor'
                            CHECK (disposition IN ('monitor','vhf_query','usv_inspect','surface_intercept','elint_collect')),
    warrant_ref             text,                                -- Tier-4 collection authority; NULL until issued
    elint_authorised_at     timestamptz,                         -- NULL until non-compliance + warrant
    prov_o                  jsonb NOT NULL,                      -- HarbourFuse-v1 attribution
    -- LOAD-BEARING INVARIANT: no ELINT collection without a Tier-4 warrant reference.
    CHECK (elint_authorised_at IS NULL OR warrant_ref IS NOT NULL)
);
ALTER TABLE synergy.harbour_contact ENABLE ROW LEVEL SECURITY;
CREATE POLICY org_isolation ON synergy.harbour_contact
    USING (org_id = current_setting('app.current_org_id')::uuid);

-- Diver/USV sonar pass over a cable run (consented operational data only).
CREATE TABLE synergy.sonar_contact (
    id                  uuid PRIMARY KEY DEFAULT gen_random_uuid(),
    org_id              uuid NOT NULL,                           -- RLS: app.current_org_id
    sensor_id           text NOT NULL,                           -- 'USV-O5' / diver team id
    pass_at             timestamptz NOT NULL,
    cable_segment       text NOT NULL,                           -- 'ESTP-TET-S02'
    seabed_depth_m      numeric(6,1) NOT NULL,                   -- -340.0 EMODnet
    classification      text NOT NULL
                        CHECK (classification IN ('clear','debris','anchor_drag','damage','unknown')),
    harbour_contact_id  uuid REFERENCES synergy.harbour_contact(id),
    prov_o              jsonb NOT NULL
);
ALTER TABLE synergy.sonar_contact ENABLE ROW LEVEL SECURITY;
CREATE POLICY org_isolation ON synergy.sonar_contact
    USING (org_id = current_setting('app.current_org_id')::uuid);

---

§6 — Action-loop pseudocode (Python)

Python
41 lines
Copy
def assess_harbour_contact(ais_track, requesting_org):
    # 1. DETECT — AIS-dark / spoof candidate inside the harbour-approach + cable corridor.
    c = build_contact(ais_track)                                  # KASTOR-7, PAN flag
    if not (c.ais_gap_minutes >= 10 or c.loiter_over_cable):
        return Disposition.MONITOR                                # show on the picture, no escalation

    # 2. ENRICH — corroborate against independent sources (no single-source escalation).
    c.satais_delta_nm    = satais_cross_check(c)                  # 14 nm self-vs-SatAIS
    c.sar_confirm_weight = sentinel1_match(c)                     # Fellegi-Sunter ΣW = 8.12
    sonar = usv_sonar_pass(c.near_cable_segment)                  # consented USV/diver data
    c.anomaly_score      = fuse(c.ais_gap_minutes, c.satais_delta_nm,
                                c.sar_confirm_weight, c.loiter_over_cable, sonar)   # 0.86

    # 3. TRIAGE — classification-gated; civil COP, no crew data.
    if c.anomaly_score < ANOMALY_MIN:
        return Disposition.MONITOR

    # 4. GATE — Art-8 ECHR proportionality (vessel master is associable); 5 personas incl. civil-society.
    P = proportionality(necessity=0.94, proport=0.95, lawful=0.99)            # P = 0.92
    gate = decision_room(
        proposal  = HarbourResponse(c, sonar),
        personas  = [OP_TASKING, PROPORTIONALITY, CIVIL_SOCIETY('coastal-rights'),
                     DEVILS_ADVOCATE, MARITIME_DOMAIN_EXPERT],
        threshold = P_MIN_TIER3)
    if gate.requests_elint and c.warrant_ref is None:
        return Disposition.ELINT_BLOCKED                          # CHECK invariant forbids the write
    if not gate.passed:
        return Disposition.REFUSED(gate.rationale)

    # 5/6. TASK + EXECUTE + WRITE-BACK — proportionate, non-kinetic; ELINT gated on non-compliance.
    write_back("armada_cad", requesting_org,
               VectorOrder(asset="BAM-IS Proserpina", task="cable-inspect", rules="non-kinetic"))
    write_back("capitania_vts", "es-alg",
               VhfAdvisory(channel=16, action="query+advise"))
    write_back("nis2.cable_incident.lodge", "cable_operator",    # NIS2 significant-incident report
               Nis2Lodgement(cable=c.near_cable_segment, P=P, warrant="pending"))

    # 7/8. ASSESS (BDA) + CLOSE — register a prospective watch.
    register_prospective(c, trigger="dark_loiter_over_cable_in_strait")
    audit.append(c.id, boundary_state="civilian-primary", merkle=True)
    return Disposition.EXECUTED

---

§7 — nexus-workflows YAML DAG (same loop; blocking human gate)

YAML
38 lines
Copy
workflow: harbour-littoral-protection-loop
tenant: armada-capitania-port   # RLS app.current_org_id bound per node
trigger:
  on: ais_anomaly_or_cable_loiter   # AIS gap >= 10m OR loiter over a cable run
nodes:
  - id: detect
    run: skill/harbour-anomaly-detect
  - id: enrich
    needs: [detect]
    run: skill/multi-source-corroborate     # Sat-AIS + Sentinel-1 SAR + USV sonar
    params: { sources: [satais, sentinel1_sar, usv_sonar, cable_telemetry] }
  - id: triage
    needs: [enrich]
    run: skill/anomaly-score
    params: { min_score: 0.70, classification_gate: civil_cop }
  - id: gate                         # BLOCKING human gate — the loop cannot proceed without it
    needs: [triage]
    type: human_decision
    blocking: true
    quorum: 2                        # dual-control: Capitanía duty + Armada watch officer
    personas: [op_tasking, proportionality, civil_society, devils_advocate, maritime_expert]
    refuse_path: refuse_and_log
    invariant: no_elint_without_tier4_warrant   # mirrors the DB CHECK
  - id: task
    needs: [gate]
    run: skill/asset-assign-hungarian
  - id: execute
    needs: [task]
    run: skill/write-back
    targets: [armada_cad, capitania_vts, nis2_cable_incident_lodge]
  - id: assess_bda
    needs: [execute]
    run: skill/bda-capture
  - id: close
    needs: [assess_bda]
    run: skill/uno-close-register-prospective
audit: { ledger: merkle, anchor: sigstore_rekor, retention: 7y }
ai_router: { policy: eu_sovereign_only, deny: [aws, azure, gcp, openai, anthropic, vertex] }

---

§8 — UI/UX mockups (VERBATIM generated ASCII)

Figure e10.1 — Algeciras Harbour & Littoral Protection COP (map_ops, PRIMARY). SVG at _build/figures/spain-pesco-harmspro/uc-map_ops.svg. Components: ClassificationBanner (top+bottom mirror), TopBar with PccPill + RendererChip, LeftSidebar glyph-rail, MapConsole (Bahía de Algeciras), Inspector (KASTOR-7), BottomStatusBar (AI Provider Router → EU-sovereign), HistoryRail, INCIDENTS ticker.

Figure — Operational picture (map_ops · live MapLibre). Production-fidelity React surface (buildable); the faithful ASCII follows.

+------------------------------------------------------------------------------------------------------+
| Algeciras Harbour & Littoral Protection COP - Capitania picture (MapConsole 2D)                      |
+--------------------+---------------------------------------------------------------------------------+
| LAYERS             | MAP  ========================================================================== |
| [x] AIS approaches | BAHIA DE ALGECIRAS  ::  Capitania duty desk  ::  MARSEC level 1 (normal)        |
| [x] VTS/SafeSeaNet |   Strait of Gibraltar ->  .--Isla Verde / Juan Carlos I terminal--.             |
| [x] Berth/anchorage|  /  [!] M/V KASTOR-7 (PAN flag) AIS gap 19m on inbound approach    \            |
| [x] Harbour CCTV   | |   re-acquires 1.2nm SW of fuel berth  ::  VTS bearing 248        |            |
| [x] Access control | |   [x] APM container yard  [x] cruise quay  [SONAR] diver track O5 |           |
| [x] Diver/USV sonar| |   loiter ring 700m over Estepona-Tetouan cable run  :: no pilot  |            |
| [x] Met/tide AEMET |  \  Harbour CCTV-12 motion @ S-jetty 02:51 :: badge: none scanned  /            |
| [x] MARSEC posture |   '-- 1nm harbour-approach -- fuse: AIS-gap + sonar + cable-loiter -'           |
| [x] Subsea cables  | Camera {lat 36.13 lon -5.43 alt 3.2km pitch -28} CesiumJS-globe 2D              |
| [ ] Sentinel-1 SAR | -> ANOMALY 0.86 :: HUMAN GATE before MARSEC step or any notification            |
| --- evidence ---   |                                                                                 |
| [x] Prov. ledger   |                                                                                 |
| --- decline-safe - |                                                                                 |
| [ ] Biometric ID   |                                                                                 |
|   (REFUSED, logged)|                                                                                 |
+--------------------+---------------------------------------------------------------------------------+
| INCIDENTS: KASTOR-7 AIS-gap 19m + cable loiter | sonar O5 | CCTV-12 S-jetty | gate -> Capitania      |
+------------------------------------------------------------------------------------------------------+

Figure e10.2 — Strait of Gibraltar Approaches RMP (globe_rmp, SECONDARY). The analyst CesiumJS-globe where the AIS-vs-SatAIS + SAR concurrence is made before it hands off to the Capitanía 2D picture. Components: MapConsole (CesiumJS-globe), ChatTerminal-hosted TRACKS rail, ClassificationBanner, BottomStatusBar.

Figure — Recognised maritime picture (globe_rmp). Production-fidelity React surface (buildable); the faithful ASCII follows.

+--------------------------------------------------------------------------------------------------+
| Strait of Gibraltar Approaches - Recognised Maritime Picture (CesiumJS-globe)                    |
+-------------------------------------------------------------------+------------------------------+
|       . - '' - .       Strait of Gibraltar -> Alboran (HARMSPRO)  | TRACKS (sorted: anomaly)     |
|    /   o ----._ \     self-report 36.02N 5.61W (broadcast AIS)    | KASTOR-7  PAN flag           |
|   | [!] AIS gap   |    EMODnet bathy -340m :: IHO S-101 ENC       |   Sat-AIS vs self: 14nm      |
|   | Sat-AIS 36.0N |    M/V KASTOR-7 (PAN flag, AIS gaps 19m)      |   SAR-confirm W=8.12>Tmu     |
|   | 14nm W delta  |    -> dark-approach candidate (anomaly 0.86)  |   loiter 3nm cable run       |
|    \ S-1 SAR hit  /    Sentinel-1 IW @01:48Z confirms 36.04N 5.49W|   inbound ALG, no pilot      |
|     \ '. cable .' /     loiters 3nm over Estepona-Tetouan cable   | 4 more dark-cands  T3        |
|       ' - x__ - '       inbound Algeciras, no pilot/agent booked  | 2,310 AIS contacts live      |
|   Camera {36.05N -5.45W alt 380km pitch -86} CesiumJS-globe       | [#] Sentinel-1 IW @01:48     |
|   Concurrence: 14nm AIS-vs-SatAIS + SAR W=8.12 + cable-loiter     | [#] VTS handover -> Capit    |
|   -> feeds the Capitania picture; HUMAN GATE before escalation    | [#] BAM-IS Proserpina avl    |
|                                                                   | gate: VHF query + advise     |
|                                                                   |   NO crew-ID (civil COP)     |
|                                                                   |   warrant-gated ELINT off    |
+-------------------------------------------------------------------+------------------------------+
| EMODnet bathy + IHO S-101 + AIS(terr+SatAIS) + VTS/SafeSeaNet + cable atlas :: NIS2 evidence     |
+--------------------------------------------------------------------------------------------------+

---

§8b — Field-unit (Pixel) surfaces

The same scenario on the Pixel 10 Pro Fold field unit (Nexus Field app), tightly coordinated with the dashboard COP above — command pushes the task, the unit accepts + ACKs, shares position and reports back to the COP. Built on the same synergy.field_unit / field_task / field_report contract; see §9 and the cluster coordination composite.

Figure §8b.1 — Folded cover · tasking glance (ground_glance): the incoming IMMEDIATE task, ACCEPT + ACK, alert chips, bearing-to-objective.

Figure §8b.2 — Unfolded inner display · field COP: two-pane mini-map + task list + teammate roster + air/command coordination + PTT, with the Material-3 NavigationBar + Report FAB.

§9 — UI/UX flow (literal click-path)

Click-path: analyst opens globe_rmp → TRACKS rail sorts by anomaly → clicks KASTOR-7 → Inspector shows the AIS-gap + Sat-AIS Δ + SAR-confirm ΣW → clicks "Corroborate" (runs Sentinel-1 + USV sonar) → anomaly resolves to 0.86 → clicks "Hand to harbour picture" → switches to map_ops Capitanía surface → reviews the cable-loiter ring + sonar track O5 → opens the Decision Room (ChatTerminal) → reads the 5-persona dialectic → /dual-control sign (Capitanía duty + Armada watch) → /execute dispatches Proserpina cable-inspect + VHF advisory + NIS2 lodgement → BDA closes the loop. If a persona requests ELINT with no warrant, the /execute button for that branch is disabled and the DB CHECK refuses the write.

[globe_rmp RMP] --click track--> [Inspector] --Corroborate--> [anomaly 0.86]
      |                                                              |
      +--Hand to harbour picture-->[map_ops Capitania]--Decision Room-->[/dual-control sign x2]
                                                                          |
                                              [/execute]----> Proserpina cable-inspect + VHF + NIS2
                                                                          |
                                                                   [BDA close + prospective watch]

---

§10 — Decision-Room transcript (the gated decision)

▣ EU-RESTRICTED · TLP:AMBER · T3 · CIVIL HARBOUR/LITTORAL PROTECTION ▣
ChatTerminal (right-docked) — Decision Room · contact KASTOR-7 (PAN flag) · Bahía de Algeciras

⊟ Op-tasking persona [L3 Mistral-Large]
   Reco: dispatch BAM-IS Proserpina for a consented USV/diver cable-inspect of
   ESTP-TET-S02; issue a VHF Ch16 query to KASTOR-7; advance Guardia Civil del Mar
   to the Isla Verde landing. Pre-stage ELINT collect on the vessel link.

⊟ Proportionality persona [L3]
   P = 0.92 (N 0.94 / P 0.95 / L 0.99). Art-8 ECHR: the master is associable, but
   cable = critical infrastructure; a non-kinetic query + a consented sonar pass is
   the least-intrusive proportionate step. Necessity satisfied.

⊟ Civil-society reviewer [coastal-rights flavour] [L3]   <<< DISSENT
   Object to the pre-staged ELINT. A 19-min AIS gap in the Strait is also the
   single most common *innocent* signature — congestion, a faulty transponder, a
   crew that forgot to re-key after a pilot drop. Escalating to link-collection on
   a flag-of-convenience hull before a VHF challenge is surveillance-creep. The
   asymmetry is the harm, not the bandwidth. Inspect the seabed, not the people.

⊟ Devil's advocate persona [L3]
   Counter: the loiter is 3 nm directly over a named cable run, with a SAR-confirm
   ΣW=8.12 contradicting the broadcast track. That is not "forgot to re-key." But
   I concede the alternative (drifting at anchor in a known holding area) is not
   excluded until the USV sonar returns.

⊟ Maritime-domain expert persona [L3 EuroLLM, Sat-AIS corpus]
   Sat-AIS delta 14 nm + Sentinel-1 IW match is a high-confidence dark-vessel
   pattern. Recommend USV sonar FIRST (clears the cable-damage question in ~25 min)
   and let the result drive the rest. obs_level = inferred, α=0.86.

──────── GATE VERDICT ────────
The civil-society dissent + the maritime expert's "sonar-first" collapse the
Op-tasking reco: the **pre-staged ELINT is REMOVED**. Approved action = VHF Ch16
query + consented USV/diver cable-inspect + Proserpina standby + NIS2 lodgement.
ELINT remains BLOCKED (no Tier-4 warrant_ref) — DB CHECK enforces it.
   [/dual-control sign — Capitanía duty officer]
   [/dual-control sign — Armada watch officer]
   [/execute → USV sonar + VHF advisory + NIS2 lodge]   [Refuse + log]
▣ EU-RESTRICTED · TLP:AMBER · T3 ▣

The materially decision-changing disagreement: the civil-society reviewer's objection (joined by the domain expert's sonar-first) deleted the pre-staged ELINT branch from the executed action — the gate is not a rubber stamp.

---

§11 — Write-back + BDA + PROV-O + deltas-only regulatory traceback

Write-back targets. (1) Armada CAD via adapter — CoT 2.0 mission-tasking extension; lawful basis = national defence statute. (2) Capitanía Marítima / VTS — VHF advisory + SafeSeaNet event; lawful basis = SOLAS Ch.V + national maritime-safety law. (3) nis2.cable_incident.lodge — NIS2 significant-incident report to the cable operator + competent authority; lawful basis = Spain's NIS2 transposition. A PROV-O Activity is written per transition.

BDA (loop close). USV sonar pass returns: seabed track O5 = anchor_drag debris adjacent to the cable, no cable damage; KASTOR-7 complies with the VHF query and proceeds under pilot; ELINT pre-authorisation withdrawn (non-compliance condition never met). CMA ObservationLevel of the BDA = Confirmed (direct sonar + voice). ProspectiveItem registered: dark_loiter_over_cable_in_strait.

PROV-O chain. Entity:AisAnomaly-KASTOR7 —wasGeneratedBy→ Activity:HarbourAnomalyDetect · Entity:SarConfirm-ΣW8.12 —wasGeneratedBy→ Activity:Sentinel1Match —used→ {AisTrack, Sentinel1Scene} · Entity:DecisionRoomTranscript-e10 —wasGeneratedBy→ Activity:DecisionRoomCompose —used→ {OpTaskingReco, ProportionalityP=0.92, CivilSocietyDissent, DevilsAdvReco, MaritimeExpertReco} · Entity:DualControlGate —wasInformedBy→ {CapitaniaSign, ArmadaSign} · Entity:UsvSonarPass-O5 —wasGeneratedBy→ Activity:UsvSonar · Entity:Nis2Lodgement —wasGeneratedBy→ Activity:Nis2LodgeAdapter · Entity:BDA-e10 —wasGeneratedBy→ Activity:SonarVhfReport · Entity:ProspectiveItem-DarkLoiter —wasGeneratedBy→ Activity:ProspectiveRegister. Merkle-anchored to Sigstore Rekor; whole chain reproducible from a provenanceOf query.

Deltas-only regulatory traceback (only what differs from defaults). AI-Act Art-6+27 (high-risk; FRIA for public-authority maritime use) — delta: the FRIA records the civil-society-deletion of the ELINT branch as a mitigation. GDPR Art-6(1)(e)+Art-9 N/A at this stage — delta: vessel telemetry, not crew biometrics; the Art-9 reviewer seat is reserved, not seated, and would auto-instantiate only if escalation touched personal special-category data. NIS2 significant-incident reporting — delta: the cable operator + competent authority are notified with warrant_ref: pending. Dual-use Reg. (EU) 2021/821 — delta: the integrated config is classified per-deployment (see §20).

---

§12 — Buyer & stakeholders

---

§13 — Competition / incumbency + comparator (cited)

• Indra — maritime & border surveillance C2 (deployable in single/multiple C2 centres), EDINAF "European Digital Naval Foundation", coordinates ECC2 (sovereign federated cyber-C2) and SHIMBAD (European naval multiband radar) in EDF 2025. Owns the Spanish maritime-C2 slot. [verified]
• Navantia — E DOMINION reference architecture + "Naval Combat Cloud"; builds the Armada vessels; leads PESCO 4E + participates in MINERVA/SHIELD/ABYSSA (€146 m EDF-2025 portfolio). Owns the platform + combat-system integration slot. [verified]
• Comparator delta. Indra/Navantia deliver the sensor + platform + combat-cloud; what is structurally absent is a vendor-neutral, sovereign DECISION/COP layer with a civil-society persona seated inside the gate, a Merkle provenance ledger, and a classification-aware AI Provider Router that refuses non-EU model calls. Palantir Gotham is the would-be incumbent of that slot but is non-EU-sovereign and not embedded in the Spanish naval-industrial base. Our play is to sit ABOVE Indra/Navantia (integrate, don't displace) — which is the only credible posture for a pre-pilot SME against two national primes.

---

§14 — Readiness (honest, pre-pilot)

Reuse (real). The storm-replay/maritime pillars (AIS fusion, Sat-AIS cross-check, Sentinel-1 SAR match, globe_rmp + map_ops surfaces, the Decision Room, the provenance ledger, the AI Provider Router) are the same substrate demonstrated for the Irish maritime/Dublin-Port packages — this is a re-skin to Spanish geography + entities, not a from-scratch build. Gaps (real): (1) no Armada/Capitanía/Puertos-del-Estado contact yet — cold; (2) the diver/USV-sonar and cable-telemetry adapters are AS-DESIGNED, not built; (3) Spanish-language UI + AEMET/SafeSeaNet-ES feed integration is unbuilt; (4) the founder cannot sign a paid contract solo (§20); (5) the HARMSPRO-membership premise is [unverified] and must not be asserted to the buyer.

---

§15 — ENGAGEMENT PLAYBOOK (first-contact → signed contract)

Discovery agenda (60 min, maritime-skinned). 0–5 frame ("EU-sovereign decision/COP — the Palantir-for-the-EU with sovereignty in the architecture; discovery, not a pitch"). 5–20 surface the pain ("walk me through a cable-anomaly or a dark-vessel-in-the-Strait incident from detection to close — how many systems, where does it stall?"). 20–35 governance/sovereignty ("lawful basis? AI-Act high-risk? must model calls stay EU-sovereign? can you show why — raw fact vs inference?"). 35–45 stakeholders/budget ("who owns the COP problem vs the budget? EDF/EDIP/PESCO line? Indra/Navantia already in the picture?"). 45–55 map their loop onto detect→enrich→triage→gate→task→execute→assess→close, find the gap. 55–60 reflect top-3 pains, ask for the scoped-demo date. Do not ask for money/LOI here.

One-page pilot proposal (filled). Title: "Sovereign harbour & littoral protection decision-layer — Bahía de Algeciras pilot." Sponsor: [Armada/Capitanía/Puertos TBD] + budget owner [TBD]. Problem (their words): "we can dispatch Proserpina to a cable, but we don't have one auditable picture that tells us where/when." The one thing we'll prove: "fuse AIS + Sat-AIS + Sentinel-1 SAR + USV sonar into one human-gated RMP and cut time-to-corroborate-a-dark-loiter from X to Y" (X/Y = baseline TBD, week 1). In/out: IN = globe_rmp + map_ops + Decision Room + provenance ledger over Strait data; OUT = combat-system integration, all Declined-List items, ELINT. Data & lawful basis: open AIS/VTS + consented USV sonar; EU-hosted; classification × isolation tier per §20. Success criteria: 2–4 sponsor-agreed metrics. Timeline: 8–12 wk + mid-point checkpoint. Commercials: €0 to the buyer if EDF/EDIP-funded; production band §19. Funding vehicle: EDF-2026 maritime call / EDIP. After: LOI if criteria met.

LOI checklist: parties (buyer + founder-in-own-name pre-incorporation, NewCo to ratify s.45) · statement of intent · scope (from pilot) · success-criteria referenced · named sponsor · timeline/next step · indicative commercials ("to be scoped under EDF/EDIP / OJEU") · conditions (funding, accreditation, DPA) · non-binding except confidentiality · governing law (consider Spanish/EU vs Irish — solicitor) · Declined-List affirmation · signatures/dates · solicitor review (flag, not assumed).

Warm-intro email (to MAHI, adapted): Subject: A sovereign decision/COP layer above the Spanish maritime sensor stack — EDF maritime fit. "Pieter-Jan — sharpening the edge+brain play for the Spanish window: the Armada's new Proserpina cable-protection vessel (launched Vigo, Apr 2026) and Puertos del Estado's €7 bn port build-out both create demand for an auditable harbour-protection COP above Indra/Navantia's sensors — exactly the buy-European, all-EU consortium story EDF rewards. Two asks: (1) who on the Indra/Navantia maritime-C2 side would take a call; (2) an honest word on MAHI as the contracting vehicle for a first pilot. — [Founder]"

---

§16 — PM / timeline + RACI

Stage \ Month        M1   M2   M3   M4   M5   M6   M7   M8 .. M16
0 Warm-intro (MAHI)  ####
1 Free discovery       ####
2 Scoped demo            ######
3 Pilot (EDF-funded)         ############
4 LOI                                  ####
  >> Stamp-1G / partner-vehicle gate  ============(critical, must clear before any PAID step)========
5 Contract (via vehicle)                          ####............ (t_resolve ~16 mo)
Milestones: M2 named sponsor · M4 demo-yes · M7 pilot criteria · M9 LOI · M12-16 funded order

Critical path: the Stamp-1G → partner-vehicle (MAHI/NewCo) gate is critical for any PAID pilot — discovery + demo can proceed solo, but a signature cannot. t_resolve ≈ 16 mo (Spanish naval-industrial procurement via a consortium + the legal gate).

---

§17 — Funding / procurement vehicle

1. EDF 2026 maritime call (consortium, ≥3 MS) — the natural vehicle: an all-EU Belgium(MAHI)+Ireland(Nexus)+Spain(Indra/Navantia) team as a decision-layer module in a Navantia/Indra-led naval-surveillance consortium. Non-dilutive; rewards buy-European. [verified — EDF exists; our place in a consortium is TBD]
2. EDIP "buy-European" — favours an all-EU team; Nexus (Ireland, PESCO member) + MAHI (Belgium) qualifies. [verified — regime]
3. PESCO maritime enablers (HARMSPRO capability, 4E, UMS/CSIP) — Member-State-led; the decision layer is a candidate enabler contribution. [verified — projects exist; Spain↔HARMSPRO membership unverified]
4. Spanish national capex — Puertos del Estado €7 bn 2025–2029 is buyer-funded budget that a port-resilience pilot could later attach to (slower; OJEU). [verified]
5. Irish-side discovery funding — Innovation Voucher (€5k, CeADAR) / PSSF / HPSU-Feasibility to fund the discovery+demo phase before any Spanish procurement. [verified]

---

§18 — TWO-STAGE FORMULA SCORECARD

Stage-1 {mandate_pull, access_warmth, demonstrability, decline_safety, white_space, cycle_speed, pillar_fit} — each [PRIOR] with a dated rationale (2026-06-05):

S1 = 3.14 → P_LOI = 0.55 / (1 + exp(−1.15·(3.14 − 2.6))) ≈ 0.358 (≈36%) [PRIOR]. Score100 = S1·20 = 62.8 ≈ 63.

Stage-2 {contractability, funding_to_pay, procurement_clarity, incumbency_displacement, time_to_value, reference_leverage}:

S2 = 1.98 → P_raw = 0.70 / (1 + exp(−1.1·(1.98 − 2.8))) ≈ 0.202 [PRIOR]. Legal gate G = V·T, t_resolve = 16 mo, H_conv = 30 → T = 0.467. V = 0.10 today → G = 0.047 → P(Contract) = P_LOI·G·P_raw ≈ 0.34%. With a partner vehicle: V=0.45 → ~1.5% · V=0.75 (MAHI prime) → ~2.5% · V=1.0 → ~3.4% [PRIOR].

Reconciliation to board_anchor. board_anchor was [PRIOR-derive], value-band high. Derived Score100 = 63, P_LOI ≈ 36% — consistent with the EU/PESCO sibling rows (eda-pesco, france-seabed, comreg) and within the high band. Score retained, not nulled (named buyer + procurement route are verified); the HARMSPRO-membership point is the only [unverified] premise and it does not gate the score.

---

§19 — Commercial

Cost advantage: open-source substrate + sovereign HPC + a shared conformity file + no forward-deployed-engineer dependency. Honest loss: slower time-to-first-value in the first quarter vs a deployed prime, and a decade-of-operations gap vs Palantir.

---

§20 — Legal blockers

• X1 Stamp-1G (founder). Cannot be director/shareholder/self-employed → no paid contract signable solo. Mitigation: MAHI/partner contracting vehicle now; EEA-resident director (Patrick/Manuel) or €25k s.137 bond for incorporation; pursue Stamp-4. ⚖ CONFIRM (immigration solicitor).
• X4 Dual-use export Reg. (EU) 2021/821. Vessel/cable-monitoring + comms fusion can classify as controlled cyber-surveillance; classify per-deployment config + end-use diligence. ⚖ CONFIRM (export counsel).
• X5 Defence procurement Dir. 2009/81/EC + Art-346 TFEU. Spain may exempt security-sensitive maritime contracts from open tender — can help OR exclude an outside SME; anticipate negotiated/exempt procedure. [verified]
• X6 NATO DIANA excludes Ireland — use EU vehicles (EDF/EDIP/PESCO), never DIANA. [verified]
• X2 EU AI Act. Maritime public-authority COP is high-risk (FRIA required); Art-5 prohibitions (applicable 2 Feb 2025) excluded by the Declined-List filter. [verified — regime]; per-config ⚖ CONFIRM.
• Buyer-specific. (a) Indra/Navantia gatekeeping — entry is realistic only as a sub-module in their consortium, not as a competitor. (b) HARMSPRO-membership premise is [unverified] — do not state Spanish HARMSPRO membership to the buyer; use it as a capability label only. (c) Language/data-residency — Spanish-jurisdiction hosting + Spanish-language conformity artefacts likely required. ⚖ CONFIRM (Spanish counsel).

---

§21 — Warm-intro contact + the specific ask

Primary path — MAHI (warm, founder-to-founder): Pieter-Jan Note (Co-Founder & CEO, MAHI BV). Specific ask: (1) a named introduction to an Indra or Navantia maritime-C2 consortium lead for the EDF-2026 maritime call; (2) an honest conversation about MAHI as the contracting vehicle for a first Spanish pilot (lifts the legal gate V 0.10→0.75). Do NOT cold-approach the Armada/Puertos del Estado.

---

§22 — Open questions + Sources

Open questions (resolve before asserting): Is Spain in any harbour/littoral PESCO project, or only 4E/UMS/CSIP? Which Autoridad Portuaria is the best beachhead — Algeciras, Valencia, or a cable-landing port? Will Indra/Navantia host an external decision-layer module or build it in-house? Named Armada/Capitanía/Puertos sponsor + budget owner? Spanish AI-Act competent-authority posture for maritime high-risk? Proserpina's C2/data architecture (open vs closed)?

Sources (dated 2026-06-05):

• PESCO — Harbour & Maritime Surveillance and Protection (HARMSPRO): project page + 2024 leaflet — Italy lead; EL/PL/PT members; harbours→littoral + choke points + deployable C2. pesco.europa.eu ; pesco.europa.eu [verified]
• PESCO — full participant list (26 MS incl. Ireland + Spain): pesco.europa.eu [verified]
• Spain leads PESCO 4E (Essential Elements of European Escorts), Navantia-coordinated, launched Nov 2021: pesco.europa.eu [verified]
• Armada "Proserpina" diver-support vessel launched 13 Apr 2026 at Vigo for subsea-cable protection (Russian-submarine/Baltic-cable threat context): es.euronews.com ; datacenterdynamics.com [verified]
• Puertos del Estado €7 bn 2025–2029 port-investment plan, announced 6 Nov 2025: lamoncloa.gob.es [verified]
• Indra maritime & border surveillance C2 + EDINAF + EDF-2025 (ECC2/SHIMBAD lead): indracompany.com ; defence.indragroup.com ; defence-industry-space.ec.europa.eu [verified]
• Navantia E DOMINION Naval Combat Cloud + €146 m EDF-2025 portfolio: navantia.es [verified]
• EU AI Act Article-5 prohibitions applicable 2 February 2025 [verified — regime]. EDIP buy-European; EDF 2026 maritime calls [verified — regime].
• Internal grounding: discovery-playbook.md, formula-worked-examples.md, legal-blockers-register.md, contact-register.md, MOCKUP-CONVENTIONS.md, AW-theme W03 (maritime sub-sea depth pattern). [internal]

---