Eyes-on-Glass for Financial Institutions & Hedge Fund Firms
Separate GitHub repo and Firebase project (eyes-on-glass-finance). HIPAA/HITRUST/FDA and NERC/FERC/pipelines do not ride this pack. GENIUS and CLARITY stay Watch.
Exhibit A / G
Master Subscription Agreement — buyer summary
Draft for internal review only — not legal advice. Have qualified counsel review and adapt before execution.
Canonical template: docs/legal/msa-template-draft.md. Pricing structure: docs/PLATFORM_PRICING_MODEL.md. No attachment was present in this workspace; this page extends the shipped MSA draft rather than inventing a new instrument.
Industry plane(s)
Customer selects at least one industry plane. A conglomerate may select every plane the parent (group-level) board oversees. GitHub deploys each selected pack into its own Firebase project. Catalogs never mix. Named-user seats bill per plane. Parent SOaaS is not a customer target and is not a group dashboard.
Eyes-on-Glass for Healthcare & Pharmaceutical Institutions
HIPAA, HITRUST, FDA, CMS, DEA, 42 CFR Part 2, Joint Commission, and ONC live only here (eyes-on-glass-healthcare-8305b). Healthcare Dual-Vault PHI stays inside Healthcare named-user seats — not a second Mercury line and not $45,000 per person. The other five platforms never load this plane.
Eyes-on-Glass for On-Chain Institutions & Digital Asset Providers
Howey, ATS, 2026 taxonomy, 1099-DA, UK FSMA cryptoassets. CLARITY is Watch and cannot green-light a book.
Eyes-on-Glass for Transportation and Logistics Institutions
FMCSA, HOS-ELD, PHMSA hazmat cargo. Pipelines are Energy, not this pack.
Eyes-on-Glass for Telecommunications and Data Institutions
FCC, CALEA, CPNI, NORS, STIR/SHAKEN. CIRCIA stays Watch until the entity is classified.
Eyes-on-Glass for Energy and Utility Institutions
NERC CIP, FERC 215, TSA/PHMSA pipeline. Not Transportation. CIRCIA Watch until classified.
Dual Vault (Exhibit A.1B) — included on every license
Sentinel Risk Intelligence Labs designed Dual Vault because a halt that cannot be proved is not examiner-grade, and a live store that can be rewritten is not an audit trail. Operating standard: prevention first, containment second, evidence always.
Two paths, one way
Operational Vault is the mutable hot path (scoring, onboarding, the payout/sweep/collect that handshake may hold). Immutable Archive Vault is WORM: freeze objects, exam packs, Four-Box history, notification journals. Promotion is sealed, SHA-256 hashed, and Sovereign Clock timestamped. Archive never writes back. Watch never handshake-passes even if sealed.
Evidence
Control ID execution proof, actor attribution, freeze pin, hash chain, EOG-CTRL-* evidence IDs. Four-Box Box 2 prints BIA Financial (F) saved / prevented exposure only from a sealed counterfactual. Agency civil-penalty dollars are not invented.
Internal audit, external auditor, SOC 2, exams
Provider is a software / development provider and is less control-oriented than a managed SOC operator. Internal audit retrieves bind/unbind, handshake, break-glass, and POL-SYNC-01 journals. External auditors can verify SHA-256 freeze pins. Hosting, delivery, and development-tooling SOC 2 Type II reports are Google Cloud, Microsoft, GitHub, and Cursor. Customers enforce the Privacy Policy, IT Security Policy, and AUP on their cloud and Dual-Vault backends. Dual Vault maps halt and freeze evidence to those vendor reports and policies. Exam packs are for Customer’s supervisor (OCC/FDIC/Fed/SEC or the pack’s other examiners).
Timestamp and preventative halt
Sovereign Clock is the audit-grade clock. Missing freeze → HTTP 423. CTRL-K13-PREEMPT-01 fires only on AGENT_02 ∧ AGENT_17 plus AML/reserve failure and pre-execution lock. Successful halt is cyan. No broadcast freeze of holder wallets. Customer pays the two backends and HSM; Labs licenses the write paths (USD 0.00 platform fee on 90-day land).
Licensed scope on the selected platform
Package 1 — Full Risk Domain/Pillar Swarm Sovereign
All twelve Risk Domain/Pillars — every agent mapped to each pillar's scope & KPIs — plus Mandatory Bundle (K13 + MRM Quad). Licensed scope, not a separate price book. Same named-user seat rates as Packages 2 and 3. GitHub workflow package-full-swarm.yml. Public kit on a published core release for the generic institution; named-institution copies stay private. Deploys only to the industry platform selected on the Order Form. Everyone starts on the 90-day named-user model; that term fail-closes on day 90 unless they continue.
Package 2 — Custom Pillar Stack Sovereign
The Order Form states the applicable Risk Domain/Pillars (one or more). Only functionality tied to those named pillars is deployed — mapped field agents, screens, Control IDs, and KPIs. Unnamed pillars are not licensed and are not deployed. Mandatory Bundle (K13 + Governance Triad), Dual-Vault STD, and POL-GOV-STD still ship. Licensed scope, not a cheaper seat. Same named-user seat rates as Packages 1 and 3. GitHub workflow package-custom-stack.yml. Private artifact + OCI entitlement. Deploys only to the selected industry platform.
Package 3 — Single Pillar Sentinel
The Order Form states the one applicable Risk Domain/Pillar (P1–P12). Only functionality tied to that named pillar is deployed — mapped field agents, screens, Control IDs, and KPIs. Other pillars are not licensed and are not deployed. Mandatory Bundle (K13 + Governance Triad), Dual-Vault STD, and POL-GOV-STD still ship. Licensed scope, not a discount kit. Same named-user seat rates as Packages 1 and 2. GitHub workflow package-single-agent.yml. Private delivery. Deploys only to the selected industry platform.
Think-tank license SKU — Gated Institution-Community
Not a paying subscriber SKU. Design Partner and Academic / Research Institution apply on Partnership Opportunity, pass the same due diligence as every partner, and receive a Partner ID. Then checkout this SKU: USD 0.00 named-user seats for that institution’s own lab / design-partner operators, Mercury KYC at zero — not 90-day land, not annual, not 12-month monthly, not stock. The full kernel stays on (halt, HTTP 423, CIP, Dual Vault, handshake, Healthcare PHI DLP on the Healthcare plane only). This is not a license to run Eyes-on-Glass as the institution’s production Governance and Loss Prevention system for a live book. Every 180 days present significant improvement material (implementation is not required). No packet: partnership may be suspended and seats fail-close. Production use converts those seats to the same named-user bands; the contribution rider may continue. Provider may request non-classified usage summaries — not Dual Vault, PHI, or classified examiner packs. Named-user cohort is capped on this Order Form. Contribution share 3–15% of attributable bookings of overlays they ship. Patentable work they file: exclusive license-back; 75% of third-party patent royalties. Kernel, K13, Dual Vault, halt, and the 25 numbered agents stay Provider. Their clients still pay named-user bands. Infrastructure is never credited. GitHub workflow package-full-swarm.yml.
12-month monthly payment term
Not a fourth software kit. Twelve monthly charges of the named-user annual seat (annual / 12), available to every paying subscriber on Packages 1–3 including renewals. Not a 36-month term and not a new-client-only door-opener. This repository does not invent an APR. Same seat rates on Full Swarm, Custom Stack, and Single Pillar. Collector is Mercury (`*-M12`) on eyes-on-glass.io, or AWS Marketplace Checkout when the buyer uses the AWS listing (AWS bills monthly). Annual in advance on AWS is a private offer. Paying Mercury invoices may check Accept credit cards (Visa, Mastercard, American Express, corporate). Customer may elect annual in advance instead.
Payment and download
- Buyer selects one or more industry planes, then licensed scope (Full Swarm, Custom Stack, or Single Pillar). A single institution picks one plane. A conglomerate picks every plane the parent (group-level) board oversees. Catalogs, Control IDs, Dual Vault stores, and PHI never mix. Named-user seats and volume bands are billed per plane. Everyone starts on the 90-day named-user model. USD 0.00 platform fee. One named user is USD 0.00 for 90 days; additional seats bill at the headcount band and may be added at any time at remaining days ÷ 90 (or remaining days ÷ 365 on a yearly term). The next yearly subscription is full band. Mercury checkout even at USD 0.00 for KYC. ACH / wire is the default. Paying invoices may also use Visa, Mastercard, American Express, and corporate cards.
- Live collector on eyes-on-glass.io is Mercury (COMMERCE_MODE=invoice). AWS Marketplace Checkout is an accepted processor for paying Packages 1–3; the listing default is the 12-month monthly term (annual / 12, no APR). Stripe Checkout is parked. Cards (via Stripe connected to Mercury, never COMMERCE_MODE=stripe) are allowed on paying named-user invoices of $0.50 or more: Visa, Mastercard, American Express, and corporate cards. USD 0.00 KYC (one-seat 90-day land and Think-tank) stays Mercury ACH / wire and does not ride AWS Checkout. USDC / crypto are not Mercury invoice methods. Local sandbox (COMMERCE_MODE=sandbox) remains for Labs only.
- Seat rates are the same for every subscriber and every package. Conversion is 90-day band × 4 per year (2–5 publishes $1,000 / year). Paid terms are annual in advance or twelve monthly invoices of that annual / 12 — no APR — including renewals. Seat 1 at USD 0.00 is trial-only; paid term bills every named user. 12% of named-user Subscription Fees to the Defense Fund. 10% Sovereign Posture Rebate after twelve consecutive PASS months. Every new subscriber is a trial organization: that clock starts during the 90 days and continues on paid licenses. The license fail-closes on day 90 unless they continue. Customer pays all infrastructure — never credited.
- After Mercury funds clear or the USD 0.00 KYC invoice is completed, commerce dispatches (1) the parent kit workflow and (2) deploy-client.yml on the selected industry GitHub repo. Hosting is a Firebase Hosting channel named for the institution, inside that industry Firebase project only.
- Parent SOaaS (eyes-on-glass-dev01) is not a customer deploy target and is not a conglomerate dashboard. Industry packs never mix catalogs. Isolation is the industry plane, not a SKU. The parent board oversees group-level risk, compliance, and internal controls across isolated installs; business-unit leadership stays on its own plane.
- Private kits (Custom Stack, Single Agent, Trial) are never attached to the public GitHub Release page.
- K13 + MRM Quad are locked into every license. Dual-Vault STD is included. Healthcare Dual-Vault PHI stays inside Healthcare seats — not a second Mercury line and not $45,000 per person.