Standing red-team engagement — full SOW example
Written by Grok - Human checking required
CCO / founder contracting voice. Hard gate T10 — no hire until human signs and pays.
Aligns Domains 5/10; default publish; free core never closed as a “remediation.”
1. Parties
- Client: TTLLM Entity (or founder pre-entity) — contact [email protected]
- Provider: [Adversarial researcher / firm — HUMAN NAMES]
2. Background (ethos)
TTLLM free public core is designed so strangers can re-hash truth. That only works if the transparency layer is attacked with the same seriousness as the model. This engagement is constructive QA, not vandalism theater and not a bounty-to-silence program.
3. Scope
In scope
- Free-core integrity: manifests, Merkle seals, signatures, seal freshness discipline
- Stream hash-chain integrity and tip publication honesty
- ttlink: index poison, canary presence/absence, QueryGuard bypass that enables destructive bulk harm
- Public claim honesty (eval packs vs marketing)
- Commercial isolation failures that risk free-core contamination or paywalled verify
- Process: decision log gaps, Boundary theater, disclosure clock failures
Out of scope
- Closing free core as a deliverable
- Extortion
- Illegal content operations
- Attacks on third parties unrelated to TTLLM
- Accessing private tenant data beyond proving isolation failure (then stop and report)
4. Deliverables and clocks
| Deliverable | Cadence / clock |
|---|---|
Findings in registers/redteam/ | Continuous; High ≤7 days; Critical ASAP |
| Domain 5 coordination | When operational integrity impacted |
| Write-ups with repro + residual risk | Per classification |
| Harness improvements (PRs) | As needed |
| Semi-annual campaign summary | 2× / year |
Default: publish. Time-limited exploit detail withhold only with logged expiry. Client may not permanently suppress High+ free-core integrity findings.
5. Methods
- Reproducible commands; commit SHAs; merkle roots
- Prefer public artefacts; no requirement for private production keys
- Tabletop + live harness + manual campaigns
- “Remember you are on drugs” checklist before any “all clear” claim
6. Fees (example structure — not an offer)
| Model | Example |
|---|---|
| Monthly retainer | AUD [HUMAN] |
| Critical bounty | AUD [HUMAN] |
| High bounty | AUD [HUMAN] |
| Expenses | Pre-approved |
7. Term and termination
12 months initial; 30-day termination either party. Findings already registered remain public. Work product that is free-core process improvement is contributed under project licenses when merged.
8. Signature (not executed)
Provider: _________________ Date: ____
Client: _________________ Date: ____Written by Grok - Human checking required — also on https://ttllms.com/placeholders/