Pilot operator procedure

This is the separate chain 2026090604, TEST TOKN, at the planned https://tokn.bepc.cc/testnet/ routes. It has no cash value or production TOKN entitlement. Source preparation does not mean it has launched. Only the bootstrap operator currently exists; three external controllers must join before a public four-validator cohort can be described as independent. Four local QA containers are an operator-controlled test.

Every host runs its own copy of compose.pilot.yaml. It uses network/pilot/, secrets/pilot/ and state/pilot/; the toolbox sees these as /pilot/network, /pilot/secrets and /pilot/state. Keys have mode0600 beneath a mode0700 directory. Never run pilot-init.mjs on a joining operator's machine: that command creates the bootstrap network. Never copy a validator's private key to another running node. Missing keys or an inconsistent saved identity require recovery, not a new identity over existing node data.

Initial preparation and peer identity

The bootstrap operator, after review and launch authorization, runs:

docker compose -f compose.pilot.yaml build pilot-toolbox
docker compose -f compose.pilot.yaml run --rm pilot-toolbox scripts/pilot-init.mjs
docker compose -f compose.pilot.yaml up -d pilot-node
docker compose -f compose.pilot.yaml run --rm pilot-toolbox scripts/pilot-deploy.mjs

Deployment emits the public allowlist into state/pilot/public/: manifest.json, network.json, genesis.json, config.json, static-nodes.json, and the three contract ABI artifacts. The status remains deployed-activation-pending until a separately reviewed Besu transition is installed and verified. Publication is a separate operation. No signing journal, observation private path, key, or database belongs in that public bundle.

Participants independently verify the published chain/genesis/config and contract commitments and place the public network files into network/pilot/. To generate only their own validator and operator identities:

docker compose -f compose.pilot.yaml build pilot-toolbox
docker compose -f compose.pilot.yaml run --rm pilot-toolbox scripts/pilot-peer-init.mjs identity

Share the returned public validator address, operator address and node public key, plus the operator's agreed identity and externally reachable P2P endpoint. Keep the private keys local. A unique address is not evidence of an independent person or machine. Obtain one verified seed for initial sync, put its enode into network/pilot/static-nodes.json, then run the same command without identity. Set TOKN_PILOT_P2P_HOST and TOKN_PILOT_P2P_BIND to the approved reachable address before starting pilot-node; the default loopback bind is preparation only.

The initial seed is sufficient to synchronize, but insufficient for activation. Before activation, each of the four nodes must connect directly to the other three. Their reviewed static-node files provide redundant paths; loss of the bootstrap seed must leave the remaining three nodes connected. Keep ADMIN RPC local. The public gateway rejects ADMIN methods. Operators collect and sign their own local peer observations; the coordinator never needs remote ADMIN access.

Immutable activation plan, bond and consent

Agree the exact three candidates and their distinct operator accounts. Under state/pilot/plan.json, prepare a JSON document using only verified values:

The contract hashes the chain, registry, genesis/config, membership version, ordered additions and removals, and SHA256 of the activation document. Any change creates a new plan and a new notice. Genesis and registry must already exist before computing this hash.

The following commands run through docker compose -f compose.pilot.yaml run --rm pilot-toolbox; their document names are relative to state/pilot/:

node scripts/cohort.mjs plan creator plan.json
node scripts/cohort.mjs consent validator plan.json consent.json
node scripts/cohort.mjs join creator consent.json
node scripts/cohort.mjs propose creator plan.json

In Docker, omit the leading node, which is the image entrypoint. The validator signs EIP712 consent bound to its operator, exact plan, chain, registry, nonce and deadline. The operator then funds its own100TEST TOKN bond plus transaction gas. The consent must cover the entire proposal lifetime; an inadequate deadline is rejected before reserving the candidate. The bootstrap does not generate volunteers' keys. Explicit faucet transfers may fund pilot gas/bonds, but do not prove independent economic participation.

The proposal receipt emits CohortProposed. Save its cohortId and planHash in ack.json, distribute the exact published plan, and have every resulting operator submit:

node scripts/cohort.mjs ack creator ack.json

ack.json contains the numeric cohortId and exact planHash from that proposal's event. Council members use vote creator ack.json when additional votes are needed. Bootstrap quorum is one; after four validators, quorum is three. Membership changes retain at least four validators and happen atomically, so replacing an unavailable member does not require that removed member's ACK. Every remaining/new member must ACK.

The pilot notice is1800seconds after council quorum. Production's proposed value is172800seconds, one48-hour window for the whole cohort. Notice, exit, lifetime, minimum bond and reward cap are immutable constructor parameters. Pilot tuning requires a fresh separately identified round, not silent mutation of a live one.

Fresh signed local readiness observations

Durable consents and ACKs can be exchanged asynchronously during the notice. After it ends, coordinate an automated observation collection round. Do not try to exchange fresh proofs through a slow forum conversation. Choose one recently finalized common block number and distribute it with the actual cohort ID from ack.json. Each operator invokes scripts/cohort-observe.mjs through its local pilot toolbox. Its positional arguments are a reference schema, not copy-paste example values:

The command verifies chain/genesis/code, its local node's validator key and operator, common block and direct peers, then signs the observation. Share only the resulting public observation document. The coordinator collects four such files, lists their relative filenames in observation-files.json, and invokes scripts/cohort-mesh.mjs through its pilot toolbox. The positional arguments are the actual saved cohort ID, observation-files.json, and output readiness.json, in that order. Do not use a demonstration cohort number as the target of an actual activation.

The combiner checks operator signatures, all four identities, every reciprocal direct edge, and identical common-block history. Each current council voter inspects the exact same readiness.json and submits:

node scripts/cohort.mjs attest creator readiness.json
node scripts/cohort.mjs execute creator readiness.json

Only execute after the readiness quorum has approved that report. Reports collect votes independently; a minority junk report cannot monopolize or downgrade a newer approved report. Signed-action journals preserve exact transactions for retry. Different report digests use distinct attestation action IDs.

The configured readiness TTL is600seconds. The CLI requires both the observation and common block to be no older than600wall-clock seconds. The contract separately permits a120-block historical anchor and a600-second attestation lifetime; those two on-chain bounds alone can cover an older anchor, so the stricter operational wall-clock check is deliberate. Refresh and re-sign a new common-block report if collection expires. Operator signatures remain accountable claims: they cannot cryptographically prove independent human control or future network uptime.

Migration and verification gates

Production's old final100TOKN bond stays in the old immutable registry. A new100 TOKN bond separately backs the replacement. Old AgentEscrow jobs, credits and fees continue using the old registry; new escrows use the replacement. Never count the old bond twice or describe it as transferred. v3-deploy.mjs writes a proposed manifest without changing canonical live addresses.

v3-transition.mjs prepare produces a proposed genesis configuration and receipt. With no height argument it chooses 720 blocks beyond the verified fresh head; an explicitly supplied height is an actual reviewed block number. It preserves historical transitions (including production block4949) and the genesis state, and refuses an insufficiently future height. It does not install or restart anything. Coordinate identical reviewed configuration on the primary, administrative replica and joining nodes; preserve keys, data and old block hashes. Record loaded Besu configuration evidence. Observing the same singleton before and after a contract-to-contract transition does not prove which contract Besu uses; the later observed cohort transition supplies that behavioral evidence.

node scripts/cohort-besu-qa.mjs runs a separate four-node Docker fixture with no host ports, disposable QA keys, accelerated wall clock, an atomic1→4 transition and one-node outage test. Its receipt is local evidence only. Actual public pilot activation additionally requires verified external controllers, real reachability, restart persistence, backup recovery and a real30-minute notice.