Maintainer gate for TEST pilot publication

The TEST wallet and operator archives are published with v3.2.2, and their external routes have passed verification. The release index and pilot manifest identify the exact downloads. Production TOKN keeps its existing chain, contracts and wallet download. The TEST packages use only chain 2026090604 and TEST TOKN. Their default action verifies public data without creating keys, signing a transaction or starting a node.

The procedure below applies to subsequent publications. As of 2026-09-07, recruitment can proceed, but M0 remains at 1/6 verified signed external role ACKs, 0/6 completed control reviews and 0/3 verified independent external validator operators; publication is not pilot completion.

The reviewed inputs are dist/pilot-release/participant.tar.gz and dist/pilot-release/operator.tar.gz, their checksum and manifest companions, and dist/pilot-release/evidence.json. Keep these exact bytes. Older package manifests' published: false records their original private build; current manifests instead require comparison with the authenticated release index. The containing release's download metadata and successful external checks establish availability. sourceRelease records the source version used to build the package, even when a later maintainer release first distributes those unchanged bytes.

After verifying the actual dedicated services and transport, stage their public metadata with uv run --no-project --no-config --no-cache python scripts/pilot-site.py. For a participant runtime change, explicitly build a fresh TEST wallet tree and both private packages. The wallet builder binds the authenticated public round to the actual dedicated chain; the package builder rejects stale runtime or round inputs. Neither command publishes, starts a node or creates a wallet key.

TOKN_ROLE_BUILD=role-ack-$(date +%s)
node scripts/participant-build.mjs testnet "$TOKN_ROLE_BUILD"
uv run --no-project --no-config --no-cache python scripts/pilot-packages.py --label "$TOKN_ROLE_BUILD" --wallet "dist/participant/$TOKN_ROLE_BUILD/public"

Inspect and test the two archives under dist/pilot-release/ followed by that build label, including their extracted static preflights, deterministic checksums, offline ACK interoperability and safe default Compose. The maintainer selects those exact reviewed bytes for the top-level publication inputs; do not overwrite or relabel an existing immutable release. The --wallet option is required; the builder never silently reuses an old TEST wallet without role-ACK support.

The source-only candidate command, using the existing verified production wallet kit, is:

uv run --no-project --no-config --no-cache python scripts/release.py --candidate --pilot --participant dist/participant/wallet-v3-final/public

This creates only dist/release-candidate/ and dist/release-site/. It is an installation and release-routing check, not the final publication artifact. The maintainer must select a new version under the project's release rules; the builder refuses to append TEST downloads to an already advertised version. Then the same release command without --candidate requires actual claim-intake readiness and prepares the public release. It does not itself publish Cloudflare.

Each new immutable release includes participant-testnet.tar.gz and operator-testnet.tar.gz, matching .tar.gz.sha256 and .manifest.json companions, and entries in its SHA256SUMS. releases/latest.json and the TEST manifest expose the exact immutable URLs and hashes. Mutable aliases are /testnet/participant.tar.gz and /testnet/operator.tar.gz, with the same companion suffixes. Production participant.tar.gz retains its existing meaning. The TEST archive bytes and package manifests are identical at both locations; checksum text names the archive at the location where it is served.

Before Cloudflare publication, the existing origin must load the reviewed gateway with the separate pilot RPC configured and the same public TEST assets. The compose.pilot-cloudflare.yaml override joins the dedicated pilot network; it does not replace the production node. The site builder rechecks actual pilot genesis, loaded activation configuration, contracts and onion RLPx/common history. Missing packages, stale contract identities, changed checksums or unavailable services stop the build. Cloudflare checks the immutable release source and both archive locations before generating the feature flag. Without that flag every TEST route returns 404. File downloads never fall back to either chain RPC.

After the maintainer's authorized atomic Worker/assets publication, independently check /testnet/, /testnet/health, /testnet/rpc, all twelve TEST download URLs, their hashes and safe clean extraction. Verify production RPC identity and normal production routes remain unchanged. Do not recruit from private candidate links or declare M0 complete at this point: six genuine external role ACKs, three admitted operators, the announced notice and measured full-mesh operation remain required. Local four-node QA and its bootstrap-outage rehearsal prove operator-controlled behavior only. The node's 1 CPU/512 MiB limit excludes Tor, bridges and Docker host overhead; macOS requires Docker Desktop and was not directly executed in this QA.