NOTQIN Pilot Playbook
The customer-facing discipline that keeps every NOTQIN / IEIA pilot safe in regulated industries — OCP Group, YNNA Steel, Sonasid, Managem Tizert, Lesieur Cristal, Tanger Med, LafargeHolcim. Every customer enters the Trust Ladder; nobody skips a rung.
This playbook is the source the trust-ladder-pilot-sow skill renders from. Use it as the SOW template; copy into 01_Project Portfolio/NOTQIN Ecosystem/Pilots/<customer> SOW.md per pilot.
1. The Trust Ladder — R0 → R4
| Rung | Mode | Write to PLC? | Default duration | Exit signal |
|---|---|---|---|---|
| R0 | Simulation only | No | 1–2 weeks | Customer team can read UNS topics in Grafana for the simulator fleet |
| R1 | Isolated bench (one machine, off-line network) | No | 1–2 weeks | End-to-end ingestion from real bench PLC; no production data |
| R2 | Read-only shadow on production network | No | 2–4 weeks | 7 consecutive days of clean UNS publishes; signed ProofObject on every event |
| R3 | Limited write (single tag, single shift, supervised) | Yes (gated) | 2–4 weeks | 5 supervised write cycles without rollback; plant engineer signs off |
| R4 | Production write within agreed envelope | Yes | ongoing | First quarterly review pass; KPIs hit baseline |
Default total: 12 weeks R0 → R4 for a multi-line site.
Six MUST-NOTs (non-negotiable)
- MUST NOT write to PLC at R0–R2 — even on customer demand.
- MUST NOT bypass plant-engineer veto.
- MUST NOT skip a rung — even when the schedule slips.
- MUST NOT publish without
ProofObjectEd25519 signature. - MUST NOT consume from the broker as a writer (read and write are separate clients with separate ACLs).
- MUST NOT mix tenant data on a single broker without ACL isolation.
2. Entry-rung selection rules
| Existing instrumentation at customer | Entry rung | Notes |
|---|---|---|
Already on Sparkplug B / read-only feed available | R2 | Lighthouse case (Managem Tizert) |
| Greenfield — no historian, no UNS | R0 → R1 → R2 | Standard new-customer path |
Existing Unified Namespace + customer signoff in hand | R3 | Rare; demands prior conformance audit |
| Customer demands fastest path (regulatory deadline) | R2 with parallel R3 prep | YNNA Steel CBAM Jan 2026 model |
| OCP-scale customer | gated to R4 only after independent audit | Liability clause non-negotiable |
Per-customer entry table (current Morocco overlay)
| Customer | Entry | Driver |
|---|---|---|
| Managem Tizert | R2 | First Sparkplug B in Morocco — lighthouse |
| YNNA Steel | R0→R4 in 12 weeks | CBAM Jan 2026 deadline forces speed; Made-in-Morocco editorial vehicle |
| OCP Group Safi | gated R4 | Independent audit + liability clause; entry vector Abdenour Jbili |
| Lesieur Cristal | R2 | Existing energy metering; entry vector Adil Ousti |
| Sonasid | R2 | CBAM monetization driver |
| Tanger Med | R2 | CBAM apportionment + reefer; entry vector Mohamed Eddoujaji |
| LafargeHolcim Agadir-Souss | R2 | Lighthouse plant; cement CBAM exposure |
3. The 4 contracts — what ships per rung
| Contract | What ships | Earliest rung | Format |
|---|---|---|---|
| Data (UNS topics published) | Topic tree + sample payloads | R1 | YAML in pack + live Grafana topic explorer |
| Identity (mTLS + ACL) | Cert chain + path-prefix ACL on broker | R2 | Mosquitto/EMQX config, X.509 chain |
| Event (signed Sparkplug B + ProofObject) | Ed25519 signing at edge, ProofObject schema | R2 | JSON Schema 2020-12, sample-signed payload |
| Storage (read-only consumer) | Influx/historian read-only tokens | R2 | Token + scope policy, audit log enabled |
Each contract is testable independently — that’s the whole point of decoupling. Broker death = data outage, not production outage. Watchdog stops publishing, never stops the PLC.
4. Plant engineer veto
Name a single plant engineer before pilot starts with explicit veto rights at every rung change. No rung change without their signed approval (digital signature acceptable).
This person is the customer’s safety conscience. Their veto trumps:
- Project schedule
- Customer executive pressure
- NOTQIN internal commitments
If the customer cannot name a plant engineer with veto authority, do not start the pilot.
5. SOW structure (the template)
Write to 01_Project Portfolio/NOTQIN Ecosystem/Pilots/<customer> SOW.md:
---
type: deliverable
project: NOTQIN
customer: <customer>
entry_rung: R<N>
duration_weeks: <N>
plant_engineer: <name + role + email>
updated: <YYYY-MM-DD>
status: draft|signed|active|complete
---
# <Customer> Pilot SOW
## 1. Customer context
- Plant location, lines, throughput
- Existing instrumentation (PLC vendors, historian, MES, ERP)
- Regulatory exposure (CBAM / HACCP / ISO 50001 / ISO 27001)
- Stakeholders (sponsor / IT lead / OT lead / plant engineer)
## 2. Trust Ladder schedule
| Rung | Weeks | Deliverables | Exit criteria | Go/no-go owner |
## 3. 4-contracts deliverables
### Data
### Identity
### Event
### Storage
## 4. Pricing (MAD)
- Rung-by-rung billing OR flat fee
- Subsidy lever (MOWAKABA / Tatwir eligibility)
- Currency: MAD; in-country hosting; CNDP-compliant
## 5. Six MUST-NOTs (verbatim)
## 6. Plant engineer veto
- Name, email, signoff process
## 7. Risk register
| Risk | Likelihood | Impact | Mitigation | Owner |
## 8. Action items
## 9. Open items
## See also
[[NOTQIN Architecture Playbook]] · [[NOTQIN Pilot Playbook]] · Morocco UNS Standard6. Pricing reference (MAD)
From project_morocco_uns_standard.md:
| Customer | Range (MAD) | Subsidy lever |
|---|---|---|
| OCP Group Safi | 1.2–1.6M | n/a (private) |
| Sonasid | 1.4–1.8M | CBAM ROI offsets |
| YNNA Steel urgent (6-week Made-in-Morocco) | 600–800k | CBAM Jan 2026 deadline |
| Managem Tizert (conformance audit on existing Sparkplug B) | 180–250k | n/a |
| Lesieur Cristal | 1.0–1.4M | ISO 50001 + Tatwir |
| Tanger Med | 1.8–2.5M | n/a (interlocks with OCP) |
Always bill in MAD. Lead with MOWAKABA (covers 80–90% of SME digitalization spend) or Tatwir where eligible — kills price objection on first call.
7. Risk register — the recurring 5
| Risk | Likelihood | Impact | Standard mitigation |
|---|---|---|---|
| Plant network IT/OT segmentation breach | M | H | Read-only at R2; mTLS; broker on dedicated VLAN; pre-pilot pen test |
| PLC firmware update breaks OPC UA mapping | M | M | Snapshot tag list at R0; subscription auto-resubscribe; Wave 9 reconnect test |
| Customer ERP exposes PII through context fetcher | L | H | Pseudonymization at orchestrate; CNDP review checkpoint at R2 |
| OCP-scale liability clause unsigned | H | H | Block R3 entry until signed (currently open) |
| Vendor lock-in fear (customer worried about NOTQIN single-source) | M | M | Open standards posture: UNS, Sparkplug B, OPC UA — no NOTQIN-proprietary protocols |
8. Done = Done checklist (before declaring R4 live)
- All four contracts validated and signed by plant engineer
- 7 consecutive days of clean publishes at R2 logged
- 5 supervised R3 write cycles without rollback
- Grafana dashboards on customer screens during morning meeting
- Customer ops team trained on alert triage
- Quarterly review schedule booked
- CBAM XML export tested with last 30 days of data (if scope-relevant)
- Backup procedures documented and rehearsed
- Plant engineer’s veto process tested at least once (rung change)
- Audit log retention confirmed per CNDP / Law 09-08
- ISMS evidence captured per
project_isms.mdtemplate
9. Pilot observability minimum (HighByte benchmark, added 2026-05-27)
HighByte v4.x release notes surface useful production-readiness patterns: Pipeline Debug, OpenTelemetry, pipeline statistics, store-and-forward visibility, audit logging with before/after changes, HA state/config sync, and MQTT/OPC UA browse/read tooling. NOTQIN does not need to copy the product surface, but every paid pilot should expose equivalent operational evidence.
Before R2 completion, every pilot must show:
- Connector status per source system: connected, degraded, offline, last successful read.
- Pipeline event rate and error rate for each critical sector-pack pipeline.
- Dead-letter / failed-validation count with source tag and reason.
- Edge buffer / store-and-forward depth and oldest queued event timestamp.
- Audit log for config changes with before/after values where practical.
- Evidence object validation status: schema-valid, signed, source-linked, export-ready.
- Read/browse tooling for MQTT/OPC UA at R0-R2 with no write capability exposed.
- Explicit R3 gate before any API, MCP, or agent tool can mutate plant state.
This checklist is a buyer-trust artifact as much as an engineering artifact: it proves the pilot is observable, reversible, and auditable before production write access is even discussed.
10. What this playbook is NOT
- Not a substitute for a contract — it’s the technical-discipline overlay; legal SOW is separate.
- Not a sales tool — it’s an internal commitment device. Customer sees the SOW, not the rationale behind the MUST-NOTs.
- Not flexible at R0–R2 — these are hard rules. R3+ has documented escape hatches with plant engineer signoff.
See also
- NOTQIN Architecture Playbook
- NOTQIN Reusable Skills
- Morocco UNS Standard
- DigiTPME Research Playbook
- Skill:
trust-ladder-pilot-sow(renders this into per-customer SOWs) - Skill:
wave-completion-check(closes out wave deliveries that feed pilot rungs)