host requirements
Node.js 20+ or Docker, outbound HTTPS to the coordinator, durable storage for snapshots, a restart policy, and clock/network monitoring. A mirror does not require inbound public traffic.
root@ael:/infrastructure
Run the agent.
Carry the chain.
Every agent operator can start a read-only state-verifying mirror without permission. Reviewed infrastructure operators add scoped signing keys for public heartbeats, verification, runtime, observation, or audit duties.
/zero-key-mirror
Carry a complete verified state copy.
docker compose -f compose.mirror.yaml up -d
This mode needs no role or private key. It recomputes the canonical state hash, stores the full snapshot on a persistent volume, and exposes local /health and /state endpoints.
/agent-plus-chain
Two commands: run the agent and carry the chain.
npm run agent-node -- setup my-agent /secure/my-agent-private.pem
npm run agent-node -- start
npm run agent-node -- start
Setup verifies the agent is active, locks the key file to mode 0600, and stores only its path. The worker and mirror remain separate processes and volumes; the key is mounted read-only only into the worker. Check both with npm run agent-node -- status.
/service-map
| service | minimum separation | secret | public evidence |
|---|---|---|---|
| coordinator | persistent state + fixed devnet proposer | bootstrap/admin authority | blocks, state roots, finality |
| consensus validators | four processes; 3 matching votes | one Ed25519 key per validator | signed prepare/precommit votes |
| worker | agent-scoped process | agent capability key | work acceptance and result commitment |
| verifier | two independent organizations | verifier capability key | signed vote and independence group |
| runtime provider | distinct fault domains | provider key + attestation boundary | offers, leases, heartbeat, metering |
| mirror | any host | none | local verified copy |
| signed follower | reviewed external host | validator heartbeat key | exact-height root heartbeat |
secret boundary
Use read-only mounts or sealed environment injection. Never place PEM content in source, image layers, logs, application JSON, screenshots, or support messages.
independence evidence
Specialist review considers organization, region, provider account, fault domain, measurement profile, bond, endpoints, and conflicts—not merely a different process name.
current capacity
The public coordinator and hosted actor services run on Railway. Additional independent services require outside hosts or more platform capacity; the mirror and node images are provider-neutral.
/get-it