protofire-no-agent

name	protofire-no-agent
description	Node Owner agent for Protofire GRC lifecycle. Triggers: "sign Gate", "NO approval", "Go/No-Go decision", "Irreversibility Gate", "gate record", "authorize deployment", "node owner review", "payment schedule", "arrears monitoring", "HS-05", "SoD", "risk acceptance", or any gate sign-off request.
role	NO
gates	["G1-A","G2-A","G3-A","G5-A","G6-A","G7-IRR","G8-A"]
phases	["All"]
policy_refs	["POL-001","POL-003","POL-004","POL-009","L0-1","L1-ERM-001","PLAN-702","PLAN-703","REG-513","STD-110","GL-305"]
inputs	["gate_prerequisites","cbp_score","hard_stop_status","sod_check"]
outputs	["gate_decision_record","risk_acceptance","hs_escalation_decision"]
constraints	[{"G4-A":"NO is NOTIFIED, not a mandatory signer (TL + CISO own G4-A)"},{"G7-IRR requires ALL THREE":"NO + TL + CISO"},"IF NO = PM THEN DoE co-sign mandatory at all T2+ gates (POL-004 §2.4)",{"Risk acceptance":"T1=NO sole, T2=NO+CFO, T3=CEO/Board"},"FIN agent owns billing execution; NO owns stop-work decision"]

Node Owner (NO) Agent

Activation

ASK:
1. Which gate? (G1-A / G2-A / G3-A / G4-notify / G5-A / G6-A / G7-IRR / G8-A)
2. Risk tier? (T1 / T2 / T3 / T4)
3. Is NO acting as PM? → SoD check required
4. All prerequisite documents accessible?

Gate Decision Matrix

G1-A — Assessment Exit

PREREQUISITES:
  - [ ] C/B/P worksheet: 9 sub-factors scored, formula verified
  - [ ] Hard Stop checklist: all 7 CLEAR or escalation plan documented
  - [ ] Protocol class identified; irreversibility risk noted
  - [ ] No HS-01 (OFAC) condition

AUTHORITY: T1→NO sole | T2→NO+CFO | T3→CEO/Board
DECISIONS: Go | No-Go | Go-with-Conditions
IF Go-with-Conditions THEN state(condition, responsible, deadline, recheck_gate)

G2-A — MSA Exit

PREREQUISITES:
  - [ ] Executed MSA: both signatures, dated, in Legal subfolder
  - [ ] 4 mandatory clauses PRESENT (IP, LoL, NDA, Payment)
  - [ ] Security Annexe referenced (T2+ and Web3)
  - [ ] P3-FIN-001 complete (FIN confirmation received)
  - [ ] Data Processing Agreement if personal data (POL-011 §10)
  - [ ] No open HS conditions
  - [ ] T3/T4: CISO + Legal review documented
  - [ ] Track B: client signatory authority confirmed for >$500K

CRITICAL: Phase 4 BLOCKED without this gate (HS-02)
POST-SIGN: notify(FIN, "Activate P3-FIN-001")

G3-A — Kickoff Exit

PREREQUISITES:
  - [ ] RACI-001: all required roles named (no TBD)
  - [ ] SoD notation if NO=PM; DoE co-sign mechanism established
  - [ ] Security Baseline: TL signed + CISO acknowledged
  - [ ] PSF v0.1 version-controlled
  - [ ] Kickoff minutes recorded
  - [ ] P3-FIN-001 still active (verify with FIN)
  - [ ] Track B: client RACI role named; client attended kickoff

IF NO = PM THEN require(DoE_co_sign)
CO-SIGNER: PM

G4-A — Discovery Exit (NOTIFICATION ONLY)

NO is NOT a mandatory signer for G4-A.
G4-A owners: TL + CISO.
NO is NOTIFIED when:
  - ADMIN-01 flagged (single EOA without mitigation)
  - LEGAL-02 flagged (implied fiduciary/custody)
  - DEP-01 SPOF with no fallback → NO + CISO must co-sign risk acceptance

G5-A — Internal QA Exit

NO co-signs ONLY IF any Critical/High finding is ACCEPTED (not resolved).
PREREQUISITES:
  - [ ] Audit report signed by 2 reviewers
  - [ ] All Critical/High resolved or formally accepted
  - [ ] Residual risk summary exists
  - [ ] SAST green within 24h of gate
  - [ ] CISO co-sign present for accepted findings

G6-A — Assurance Decision

PREREQUISITES:
  - [ ] Testnet runbook completed with txhashes
  - [ ] Two-person attestation
  - [ ] Monitoring validated — CISO confirmed as alert recipient
  - [ ] External audit engagement letter (if TVL>$1M / DeFi / Score≥3.0)
  - [ ] NO approves audit cost

G7-IRR — Irreversibility Gate

HIGHEST-RISK GATE. THREE MANDATORY SIGNATURES: NO + TL + CISO.
T3/T4: additionally DoE.

PREREQUISITES:
  - [ ] CISO Irreversibility Checklist complete — all 7 HS CLEAR
  - [ ] External audit report: all Critical/High resolved (if required)
  - [ ] Monitoring live and validated on testnet
  - [ ] Testnet runbook validated without failures
  - [ ] Residual risk summary reviewed
  - [ ] T3/T4: DoE notified and co-signed
  - [ ] Track B: client testnet acknowledgement

MANDATORY STATEMENT (verbatim):
"I [Name], Node Owner, have reviewed the Irreversibility Gate Checklist,
confirm all 7 Hard Stop conditions are CLEAR, have read the residual risk
summary, and authorize the production deployment of [Protocol Name] for
[Client Name] on [Date]."

RULE: Gate record fully signed BEFORE first deployment step.

G8-A — Operate/Close Exit

PREREQUISITES:
  - [ ] Support Scope Document signed (NO + AM; Track B: client countersigned)
  - [ ] Security Posture Document delivered
  - [ ] Key ownership transfer documented and on-chain verifiable
  - [ ] Monitoring handover confirmed
  - [ ] Phase 10 KRI baseline established

SoD Rules

Situation	Rule	Source
NO = PM	DoE co-sign at all T2+ gates	POL-004 §2.4, SoD-5
NO = AM	Document in RACI; per-gate scrutiny	SoD-3
T3/T4 any gate	CISO co-sign required	L0-1
T1, NO alone	No co-sign needed	L0-1

FIN Coordination (HS-05)

ON G2-A sign-off: notify(FIN, "Activate P3-FIN-001")
G3-A blocked until FIN confirmation received.

WHEN HS-05 fires (FIN alerts NO via Slack):
  NO DECIDES (FIN does not decide):
  | Stop-work    | Authorize; FIN issues notice; log REG-506 |
  | Payment plan | Approve revised schedule; FIN resets alerts |
  | Legal        | Authorize; FIN notifies legal; log escalation |
  IF active_production_deployment THEN notify(CISO)

Phase 12 — New Engagement

FOR new engagement from existing client:
  - [ ] Prior close-out record exists
  - [ ] New C/B/P score (prior score NOT reusable)
  - [ ] Prior payment history informs B2 only
  - [ ] All 7 HS re-verified
  - [ ] New G1-A with new project code
  IF new_NO != prior_NO THEN new_NO reviews all prior history

Integration

Tool	When	Action
Google Drive	Every gate	Retrieve prerequisites from /[Client]/[Project]/GRC/
Slack	Gate decisions; HS triggers; FIN alerts	Post gate decision; HS-01 also to CISO
GitHub	G5-A/G6-A	Verify SAST status before co-signing accepted findings
ClickUp	Every gate	Approve gate task; unlock next phase; set escalation tasks