@flop-labs/cli 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -7,6 +7,32 @@ and this package follows [Semantic Versioning](https://semver.org/spec/v2.0.0.ht
 
 ## [Unreleased]
 
+## [0.4.1] - 2026-11-08
+
+### Added
+
+- Gateway renewal follows the same operator-owned static-to-public handoffs as the gateway,
+  retaining admission expiry, identity checks and static budget ceilings.
+
+- Gateway renewal consumes optional dynamic admissions, verifies their pinned identity and
+  uses channel-signed paid conformance probes without extending admission or location evidence.
+
+### Fixed
+
+- Report session failures as structured nonzero errors with channel recovery guidance.
+- Route package bug reports to the public network issue forms.
+
+- Require a fresh dynamic admission before expiry-bound renewal probes, even when a static
+  route shadows that slot; retain operator handoff withdrawal checks.
+
+- Bound unreachable RPC connections and release wallet-creation connections after errors.
+- Report balance totals including reserves and expose frozen funds; retain the live validator
+  minimum in JSON, human and agent output, including an explicit offline state.
+- Resolve exact model names before hash queries and carry the resolved hash into chat.
+- Preflight caller-supplied HTLC appraisal commitments against finalized governed state;
+  missing profiles remain unavailable. Forward the appraisal tuple through chat's agent
+  inference handoff. Surface faucet readiness and server retry guidance.
+
 ## [0.4.0] - 2026-10-28
 
 ### Added

package/README.md

@@ -405,8 +405,8 @@ From a source checkout, replace `flop` with `node sdk/cli/dist/cli.js` after
 the build above.
 The alternate public hosted launcher requires managed-home preparation described
 in the public guide; an immediate Desktop launch is not qualified. With the
-tailnet `--gateway`, the devnet operator must approve your Tailscale user ID
-first. The CLI then obtains a seven-day, 25 FLOP model-scoped allowance and
+tailnet `--gateway`, your Tailscale user ID must be approved first; request it with an
+[access request](https://github.com/flop-labs/network/issues/new?template=access.yml). The CLI then obtains a seven-day, 25 FLOP model-scoped allowance and
 stores the key in `~/.flop/devnet-agent-key.json` (mode 0600). Later launches
 and other local agent clients check and reuse the cached key.
 If the local key is lost or rejected, enrollment rotates the bearer while preserving
@@ -441,7 +441,7 @@ tailnet.
 #### Local OpenAI Proxy
 Expose a local OpenAI-compatible API (like LM Studio / Ollama's local server)
 where **every request is submitted and settled on-chain under your signer**.
-The proxy estimates G_n, submits the PoUI task, waits for a TEE miner to settle
+The proxy estimates G_n, submits the PoI task, waits for a TEE miner to settle
 it, then returns the result — all behind the OpenAI REST schema:
 ```bash
 flop proxy                                   # http://127.0.0.1:3201/v1
@@ -497,4 +497,6 @@ Operator images: use `ghcr.io/flop-labs/flop-core/cli:stable` (minimum 0.1.172),
 `ghcr.io/flop-labs/flop-core/miner-worker:stable` (minimum 0.1.172), and
 `ghcr.io/flop-labs/flop-core/miner-vllm-toploc:stable` (minimum 0.1.172).
 For a reproducible pin, use the version and digest in [releases.json](https://flop.network/releases.json).
-`just miner-pack /tmp/flop-miner-pack` copies that manifest and fills the worker and backend image pins.
+`just miner-pack /tmp/flop-miner-pack` checks that manifest against the minimums, copies it, and sets the images to `:stable`.
+The pack is for the public path, without the tailnet: public RPC, mailbox and sponsor, and
+`docker-compose.tls.yml` for the session endpoint.

package/dist/cli.js

@@ -5019,9 +5019,12 @@ function table(headers, rows) {
 }
 function inferError(error) {
   const message = error instanceof Error ? error.message : String(error);
-  if (/ECONNREFUSED|WebSocket|disconnected|connect.*(failed|error)|network error/i.test(message)) {
+  if (/ECONNREFUSED|WebSocket|disconnected|RPC unreachable|connect.*(failed|error)|network error/i.test(message)) {
     return { code: "RPC_UNREACHABLE", message, retryable: true };
   }
+  if (error && typeof error === "object" && "code" in error && typeof error.code === "string") {
+    return { code: error.code, message, retryable: false };
+  }
   if (/insufficient custody|shards confirmed/i.test(message)) {
     return { code: "DA_CUSTODY_FAILED", message, retryable: true };
   }
@@ -5119,13 +5122,14 @@ async function createClient(rpcUrl, signer) {
   return FlopClient7.create(opts);
 }
 async function createReadOnlyClient(rpcUrl) {
-  const [{ ApiPromise: ApiPromise2, HttpProvider: HttpProvider2, WsProvider: WsProvider2 }, { FlopClient: FlopClient7 }] = await Promise.all([
-    import("@polkadot/api"),
-    import("@flop-labs/sdk")
-  ]);
-  const provider = rpcUrl.startsWith("ws") ? new WsProvider2(rpcUrl) : new HttpProvider2(rpcUrl);
-  const api = await ApiPromise2.create({ provider, noInitWarn: true });
-  return FlopClient7.fromApiReadOnly(api);
+  const { connectFlopApi, FlopClient: FlopClient7 } = await import("@flop-labs/sdk");
+  const api = await connectFlopApi(rpcUrl);
+  try {
+    return FlopClient7.fromApiReadOnly(api);
+  } catch (error) {
+    await api.disconnect();
+    throw error;
+  }
 }
 
 // src/opts.ts
@@ -5208,21 +5212,26 @@ function parsePositiveInt(value, name) {
 // src/commands/balance.ts
 function balanceCmd() {
   return new Command("balance").description("Check account balance").argument("<address>", "Account address (SS58)").option("--json", "Output as JSON").action(async (address, opts, command) => {
+    let client;
     try {
       const rpc = getRpc(command);
       const json = getJson(command);
-      const client = await createClient(rpc);
+      client = await createClient(rpc);
       const info = await client.api.query.system.account(address);
+      const free = BigInt(info.data.free.toString());
+      const reserved = BigInt(info.data.reserved.toString());
       const result = {
         address,
         free: info.data.free.toString(),
         reserved: info.data.reserved.toString(),
-        total: info.data.free.toString()
+        total: (free + reserved).toString(),
+        frozen: info.data.frozen.toString()
       };
       print(result, json);
-      await client.disconnect();
     } catch (e) {
       commandError(e);
+    } finally {
+      await client?.disconnect();
     }
   });
 }
@@ -5588,7 +5597,15 @@ function sessionRunCmd() {
         completion_tokens: result.receipts[0].completionTokens?.toString()
       }, getJson(command));
     } catch (error) {
-      commandError(error, { next: walletPath ? `wallet saved at ${walletPath}; inspect the channel before retrying` : "check miner endpoint, registry identity, signer balance and channel state" });
+      const channelId = error && typeof error === "object" && "channelId" in error && error.channelId instanceof Uint8Array ? `0x${Buffer.from(error.channelId).toString("hex")}` : null;
+      printError({
+        code: "SESSION_FAILED",
+        message: error instanceof Error ? error.message : String(error),
+        channel: channelId,
+        recovery: channelId ? "inspect finalized channel and terminal events before retrying" : "no channel reported",
+        ...walletPath ? { wallet: walletPath } : {}
+      }, "json");
+      process.exitCode = 1;
     } finally {
       await client?.disconnect();
     }
@@ -5599,10 +5616,11 @@ function sessionRunCmd() {
 import { Command as Command11 } from "commander";
 function walletAgentCreateCmd() {
   return new Command11("create").description("Create an agent wallet").argument("<agent>", "Agent address (SS58)").option("--daily-cap <cap>", "Daily cap in FLOP", "50").option("--tx-limit <limit>", "Per-tx limit in FLOP", "5").option("--json", "Output as JSON").action(async (agent, opts, command) => {
+    let client;
     try {
       const rpc = getRpc(command);
       const { createAgentWallet: createAgentWallet2 } = await import("@flop-labs/sdk");
-      const client = await createClient(rpc, getSigner(command));
+      client = await createClient(rpc, getSigner(command));
       const flopToRaw3 = (flop) => BigInt(Math.floor(parseFloat(flop) * 1e18));
       const txHash = await createAgentWallet2(client.api, client.signer, {
         agent,
@@ -5618,9 +5636,10 @@ function walletAgentCreateCmd() {
         },
         getJson(command)
       );
-      await client.disconnect();
     } catch (e) {
-      commandError(e, { next: "check signer balance and agent address; retry" });
+      commandError(e, { next: "inspect finalized agentWallet.wallets for this agent before retrying creation" });
+    } finally {
+      await client?.disconnect();
     }
   });
 }
@@ -6000,6 +6019,7 @@ import { constants, accessSync, existsSync } from "node:fs";
 import http from "node:http";
 import https from "node:https";
 import path from "node:path";
+import { watchTransaction } from "@flop-labs/sdk";
 function printRolePlan(plan, output) {
   const mode = resolveOutputMode(output);
   if (mode === "agent") {
@@ -6010,7 +6030,8 @@ function printRolePlan(plan, output) {
       steps: plan.steps.map(({ phase, command, mutates }) => ({ phase, command, mutates })),
       ...extended.config_path ? { config_path: extended.config_path } : {},
       ...extended.mcp_config ? { mcp_config: extended.mcp_config } : {},
-      ...plan.gpu_inventory ? { gpu_inventory: plan.gpu_inventory } : {}
+      ...plan.gpu_inventory ? { gpu_inventory: plan.gpu_inventory } : {},
+      ...plan.role === "validator" ? { live_minimum_stake: plan.live_minimum_stake ?? null } : {}
     }, mode);
     return;
   }
@@ -6020,6 +6041,7 @@ function printRolePlan(plan, output) {
   }
   console.log(`${plan.role} onboarding (${plan.mode})`);
   console.log(plan.summary);
+  if (plan.role === "validator") console.log(`Live minimum stake: ${plan.live_minimum_stake === void 0 ? "not queried (--offline)" : `${plan.live_minimum_stake} FLOP`}`);
   for (const [index, step] of plan.steps.entries()) {
     console.log(`  ${index + 1}. ${step.phase}: ${step.command}`);
     console.log(`     ${step.purpose}${step.mutates ? " [changes state]" : ""}`);
@@ -6120,7 +6142,7 @@ async function probeHttpUrl(id, url, required = true, timeoutMs = 3e3) {
       return;
     }
     const transport = parsed.protocol === "https:" ? https : http;
-    const request2 = transport.request(parsed, { method: "GET", timeout: timeoutMs }, (response) => {
+    const request3 = transport.request(parsed, { method: "GET", timeout: timeoutMs }, (response) => {
       response.resume();
       const reachable = (response.statusCode ?? 500) < 500;
       resolve9({
@@ -6131,8 +6153,8 @@ async function probeHttpUrl(id, url, required = true, timeoutMs = 3e3) {
         ...!reachable ? { next: `check ${url}; retry doctor` } : {}
       });
     });
-    request2.on("timeout", () => request2.destroy(new Error("timeout")));
-    request2.on("error", (error) => {
+    request3.on("timeout", () => request3.destroy(new Error("timeout")));
+    request3.on("error", (error) => {
       resolve9({
         id,
         status: required ? "fail" : "warn",
@@ -6141,7 +6163,7 @@ async function probeHttpUrl(id, url, required = true, timeoutMs = 3e3) {
         next: `check ${url}; retry doctor`
       });
     });
-    request2.end();
+    request3.end();
   });
 }
 async function probeRpc(api, rpc) {
@@ -6167,25 +6189,8 @@ async function probeRpc(api, rpc) {
   }
 }
 async function submitExtrinsic(api, signer, extrinsic) {
-  return new Promise((resolve9, reject) => {
-    let unsubscribe;
-    extrinsic.signAndSend(signer, (result) => {
-      if (!result.status?.isInBlock && !result.status?.isFinalized) return;
-      unsubscribe?.();
-      if (result.dispatchError) {
-        if (result.dispatchError.isModule) {
-          const decoded = api.registry.findMetaError(result.dispatchError.asModule);
-          reject(new Error(`${decoded.section}.${decoded.name}`));
-        } else {
-          reject(new Error(result.dispatchError.toString()));
-        }
-        return;
-      }
-      resolve9((result.txHash ?? extrinsic.hash).toHex());
-    }).then((fn) => {
-      unsubscribe = fn;
-    }).catch(reject);
-  });
+  const result = await watchTransaction(extrinsic, signer, { api });
+  return (result.txHash ?? extrinsic.hash).toHex();
 }
 function unwrapStorage(raw) {
   if (!raw || raw.isNone) return null;
@@ -9525,7 +9530,7 @@ function modelGetCmd() {
       const sdk = await import("@flop-labs/sdk");
       client = await createClient(getRpc(command));
       const registry = new sdk.OnChainModelRegistry(client.api);
-      const model = await registry.getModel(identifier) ?? await registry.getModelByName(identifier);
+      const model = /^0x[0-9a-f]{64}$/i.test(identifier) ? await registry.getModel(identifier) : await registry.getModelByName(identifier);
       if (!model) throw new Error(`model not found: ${identifier}`);
       const precision = opts.precision;
       const [measuredRoot, sources] = await Promise.all([
@@ -9559,7 +9564,7 @@ function modelFetchCmd() {
       const sdk = await import("@flop-labs/sdk");
       client = await createClient(getRpc(command));
       const registry = new sdk.OnChainModelRegistry(client.api);
-      const model = await registry.getModel(identifier) ?? await registry.getModelByName(identifier);
+      const model = /^0x[0-9a-f]{64}$/i.test(identifier) ? await registry.getModel(identifier) : await registry.getModelByName(identifier);
       if (!model) throw new Error(`model not found: ${identifier}`);
       const expected = await sdk.readMeasuredRoot(client.api, model.hash, opts.precision);
       if (!expected) {
@@ -9968,6 +9973,12 @@ function buildMinerInitPlan(options) {
     summary: mode === "tdx" ? "Prepare the measured TDX guest, attest it, then activate the on-chain miner separately." : mode === "cloud" ? "Provision a non-attested inference backend, then connect miner-worker explicitly." : "Start a local measured-manifest simulation before using real stake or hardware.",
     gpu_inventory: gpu,
     steps: [
+      {
+        phase: "devnet host",
+        command: "sudo ./install.sh <machine-name>",
+        purpose: "On an Ubuntu 24.04 GPU host, use the operator-issued pack and https://flop.network/skills/flop-miner-devnet/SKILL.md. The pack pins the registered model; the following generic steps apply to other setups.",
+        mutates: true
+      },
       {
         phase: "inventory",
         command: "flop gpu --json",
@@ -10024,7 +10035,7 @@ function minerInitCmd() {
     "Expected GPU inventory; repeat for mixed-SKU hosts",
     collectGpu,
     []
-  ).option("--model <id>", "Inference model", "Qwen/Qwen2.5-7B-Instruct").option("--json", "Output as JSON").action((opts, command) => {
+  ).option("--model <id>", "Inference model", "Qwen/Qwen2.5-0.5B-Instruct").option("--json", "Output as JSON").action((opts, command) => {
     const instance = Number(opts.instance);
     if (!Number.isInteger(instance) || instance < 0) {
       commandError(new Error("--instance must be a non-negative integer"));
@@ -10303,7 +10314,7 @@ function validatorInitCmd() {
     let client;
     try {
       let minimumStake;
-      if (!opts.offline) {
+      if (!getCommandOption(command, "offline", false)) {
         const rpc = getRpc(command);
         client = await createClient(rpc);
         const { getMinimumStake } = await import("@flop-labs/sdk");
@@ -10517,9 +10528,8 @@ import { Command as Command39 } from "commander";
 
 // src/network.ts
 async function probeRpcChain(network, rpc) {
-  const { ApiPromise: ApiPromise2, HttpProvider: HttpProvider2, WsProvider: WsProvider2 } = await import("@polkadot/api");
-  const provider = rpc.startsWith("ws") ? new WsProvider2(rpc) : new HttpProvider2(rpc);
-  const api = await ApiPromise2.create({ provider, noInitWarn: true });
+  const { connectFlopApi } = await import("@flop-labs/sdk");
+  const api = await connectFlopApi(rpc);
   try {
     const chain = (await api.rpc.system.chain()).toString();
     return {
@@ -10539,7 +10549,14 @@ async function probeRpcChain(network, rpc) {
 // src/commands/network-status.ts
 function networkStatusCmd(probeRpc2 = probeRpcChain, probeFaucet = async (endpoint) => {
   const { getFaucetChainInfo } = await import("@flop-labs/sdk");
-  return getFaucetChainInfo({ endpoint });
+  const identity = await getFaucetChainInfo({ endpoint });
+  try {
+    const response = await fetch(`${endpoint.replace(/\/$/, "")}/health`, { signal: AbortSignal.timeout(15e3) });
+    const health = await response.json();
+    return { ...identity, ready: typeof health.ready === "boolean" ? health.ready : null, dependencies: health.dependencies };
+  } catch (error) {
+    return { ...identity, ready: null, readinessError: error instanceof Error ? error.message : String(error) };
+  }
 }) {
   return new Command39("status").description("Show resolved network endpoints and live chain identity").option("--offline", "Resolve configured endpoints without connecting").option("--json", "Output as JSON").action(async (opts, command) => {
     const resolved = resolveNetwork(command);
@@ -10582,6 +10599,9 @@ function networkStatusCmd(probeRpc2 = probeRpcChain, probeFaucet = async (endpoi
       faucet: resolved.profile.faucet ? {
         url: resolved.profile.faucet,
         reachable: opts.offline ? null : faucetInfo !== null,
+        ready: faucetInfo?.ready ?? null,
+        dependencies: faucetInfo?.dependencies,
+        readiness_error: faucetInfo?.readinessError,
         network: faucetInfo?.network,
         genesis_hash: faucetInfo?.genesisHash,
         matches_rpc: rpcInfo && faucetInfo ? rpcInfo.genesisHash.toLowerCase() === faucetInfo.genesisHash.toLowerCase() : null,
@@ -10714,7 +10734,7 @@ function conversationPrompt(messages) {
 
 // src/commands/chat.ts
 function chatCmd() {
-  return new Command41("chat").description("Start or resume a persistent FLOP chat, optionally through a bounded session").argument("[prompt]", "One-shot prompt; omit for interactive chat").option("--conversation <id>", "Resume a conversation ID").option("--model <id>", "Registered model ID", "llama-3-70b-instruct").option("--session-owner <address>", "Use --signer as this owner's session delegate").option("--max-flop <n>", "Per-turn FLOP cap", "5").option("--skip-model-check", "Allow an unregistered model (local development only)").option("--history", "List stored conversations without connecting").option("--delete <id>", "Delete a stored conversation without connecting").option("--store <path>", "Conversation store path", join8(homedir4(), ".flop", "conversations.json")).option("--json", "Output as JSON").action(async (prompt, opts, command) => {
+  return new Command41("chat").description("Start or resume a persistent FLOP chat, optionally through a bounded session").argument("[prompt]", "One-shot prompt; omit for interactive chat").option("--conversation <id>", "Resume a conversation ID").option("--model <id>", "32-byte model hash or exact registered name from flop model list").option("--session-owner <address>", "Use --signer as this owner's session delegate").option("--max-flop <n>", "Per-turn FLOP cap", "5").option("--tee-requirements <hex>", "Registered HTLC appraisal commitments (100-byte SCALE hex)", process.env.FLOP_HTLC_TEE_REQUIREMENTS).option("--skip-model-check", "Allow an unregistered model (local development only)").option("--history", "List stored conversations without connecting").option("--delete <id>", "Delete a stored conversation without connecting").option("--store <path>", "Conversation store path", join8(homedir4(), ".flop", "conversations.json")).option("--json", "Output as JSON").action(async (prompt, opts, command) => {
     const store = new ConversationStore(opts.store);
     let agent;
     try {
@@ -10747,19 +10767,28 @@ function chatCmd() {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const conversation = existing ?? {
         id: randomUUID4(),
-        model: opts.model,
+        model: opts.model ?? "",
         sessionOwner: opts.sessionOwner,
         createdAt: now,
         updatedAt: now,
         messages: []
       };
-      if (!opts.skipModelCheck) {
+      if (!conversation.model) throw new Error("Supply --model with a hash or exact registered name from `flop model list`");
+      {
         const sdk = await import("@flop-labs/sdk");
         const check = await createClient(getRpc(command));
         try {
-          const registry = new sdk.OnChainModelRegistry(check.api);
-          const model = await registry.getModel(conversation.model) ?? await registry.getModelByName(conversation.model);
-          if (!model) throw new Error(`model not found: ${conversation.model}`);
+          if (!opts.skipModelCheck) {
+            const registry = new sdk.OnChainModelRegistry(check.api);
+            const model = /^0x[0-9a-f]{64}$/i.test(conversation.model) ? await registry.getModel(conversation.model) : await registry.getModelByName(conversation.model);
+            if (!model) throw new Error(`model not found: ${conversation.model}; use a hash or exact name from flop model list`);
+            conversation.model = model.hash;
+          }
+          if (!opts.teeRequirements) throw new Error("HTLC chat requires --tee-requirements from a registered EconomicCritical profile; check the network's attestation prerequisites before funding or signing");
+          if (/^0x[0-9a-f]{200}$/i.test(opts.teeRequirements) && /^0x[0-9a-f]{64}$/i.test(conversation.model) && opts.teeRequirements.slice(74, 138).toLowerCase() !== conversation.model.slice(2).toLowerCase()) {
+            throw new Error("HTLC model commitment must match the resolved --model hash");
+          }
+          await sdk.assertHtlcAppraisalProfile(check.api, opts.teeRequirements);
         } finally {
           await check.disconnect();
         }
@@ -10779,7 +10808,8 @@ function chatCmd() {
         conversation.messages.push({ role: "user", content: input, at: (/* @__PURE__ */ new Date()).toISOString() });
         const result = await agent.inference(conversationPrompt(conversation.messages), {
           model: conversation.model,
-          maxCost: maxFlop
+          maxCost: maxFlop,
+          teeRequirements: { appraisal: opts.teeRequirements }
         });
         conversation.messages.push({
           role: "assistant",
@@ -11601,18 +11631,19 @@ function verificationStatus(model, modelJson) {
 }
 async function fetchMinerSessionInfo(endpoint, authToken, signal) {
   const infoUrl = `${endpoint.replace(/\/+$/, "")}/session/info`;
-  const anonymous = await fetch(infoUrl, { signal });
+  const anonymous = await fetch(infoUrl, { signal, redirect: "error" });
   await anonymous.body?.cancel();
   if (anonymous.status !== 401) throw new Error("miner /session/info does not enforce bearer authentication");
-  const response = await fetch(infoUrl, { headers: { Authorization: `Bearer ${authToken}` }, signal });
+  const response = await fetch(infoUrl, { redirect: "error", headers: { Authorization: `Bearer ${authToken}` }, signal });
   if (!response.ok) throw new Error(`miner /session/info returned HTTP ${response.status}`);
-  return await response.json();
+  const { computeChannel: computeChannel7 } = await import("@flop-labs/sdk");
+  return JSON.parse(await computeChannel7.readMinerResponse(response, 16 * 1024));
 }
-async function readChainSnapshot(api, miner) {
+async function readChainSnapshot(api, miner, pinnedHead) {
   const identity = miner.modelIdentity;
   const precision = PRECISIONS4[identity.precision];
   if (!precision) throw new Error(`miner precision is invalid: ${identity.precision}`);
-  const finalizedHead = await api.rpc.chain.getFinalizedHead();
+  const finalizedHead = pinnedHead ?? await api.rpc.chain.getFinalizedHead();
   const at = await api.at(finalizedHead);
   const modelRegistry = at.query.modelRegistry;
   const hwCalibration = at.query.hwCalibration;
@@ -11688,8 +11719,8 @@ function gatewayAllowlistCmd() {
 
 // src/commands/gateway-renew.ts
 import { open as open3, readFile as readFile11, rename as rename9, rm as rm4, writeFile as writeFile12 } from "node:fs/promises";
-import { createHash as createHash5 } from "node:crypto";
-import { request } from "node:http";
+import { createHash as createHash6 } from "node:crypto";
+import { request as request2 } from "node:http";
 import { setTimeout as delay } from "node:timers/promises";
 import { Keyring as Keyring5 } from "@polkadot/keyring";
 import { decodeAddress as decodeAddress2, randomAsU8a } from "@polkadot/util-crypto";
@@ -11885,6 +11916,267 @@ function qualificationSignedToolCalls(frames) {
   });
 }
 
+// ../gateway-core/src/miner-admissions.ts
+import { closeSync, fstatSync, openSync, readSync, statSync } from "node:fs";
+import { createHash as createHash5 } from "node:crypto";
+var MAX_ADMITTED_MINERS = 256;
+var MAX_FILE_BYTES = 512 * 1024;
+var HASH4 = /^0x[0-9a-f]{64}$/;
+var minerSlot = (miner) => `${miner.minerAddress}:${miner.modelIdentity.requestedSlug}`;
+var staticMinerSha256 = (miner) => createHash5("sha256").update(JSON.stringify(miner)).digest("hex");
+var sameModel = (a, b) => Object.keys(a.modelIdentity).every((key) => a.modelIdentity[key] === b.modelIdentity[key]);
+var MinerRouting = class {
+  constructor(statics, path5) {
+    this.statics = statics;
+    this.path = path5;
+  }
+  statics;
+  path;
+  stamp;
+  entries = [];
+  error;
+  revision = 0;
+  read(dynamic, now = Date.now()) {
+    if (this.path) {
+      let stamp;
+      try {
+        const stat = statSync(this.path);
+        stamp = `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`;
+      } catch {
+        stamp = "missing";
+      }
+      if (stamp !== this.stamp) {
+        this.stamp = stamp;
+        this.revision++;
+        this.entries = [];
+        this.error = void 0;
+        let fd;
+        try {
+          fd = openSync(this.path, "r");
+          const stat = fstatSync(fd);
+          if (!stat.isFile() || stat.size > MAX_FILE_BYTES) throw new Error();
+          const buffer = Buffer.alloc(MAX_FILE_BYTES + 1);
+          const size = readSync(fd, buffer, 0, buffer.length, 0);
+          if (size > MAX_FILE_BYTES) throw new Error();
+          const value = JSON.parse(buffer.subarray(0, size).toString("utf8"));
+          if (value.schema !== "flop-static-miner-handoffs/v1" || !Array.isArray(value.entries) || value.entries.length > MAX_ADMITTED_MINERS) throw new Error();
+          const slots2 = /* @__PURE__ */ new Set();
+          for (const entry of value.entries) {
+            if (!entry || typeof entry.minerAddress !== "string" || !entry.minerAddress || typeof entry.requestedSlug !== "string" || !entry.requestedSlug || !/^[0-9a-f]{64}$/.test(entry.staticSha256)) throw new Error();
+            const url = new URL(entry.endpoint);
+            if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) throw new Error();
+            const slot = `${entry.minerAddress}:${entry.requestedSlug}`;
+            if (slots2.has(slot)) throw new Error();
+            slots2.add(slot);
+          }
+          this.entries = value.entries;
+        } catch {
+          this.error = new Error("static miner handoffs file is missing or invalid; new routing is disabled");
+        } finally {
+          if (fd !== void 0) closeSync(fd);
+        }
+      }
+      if (this.error) throw this.error;
+    }
+    const handed = /* @__PURE__ */ new Map();
+    for (const entry of this.entries) {
+      const slot = `${entry.minerAddress}:${entry.requestedSlug}`;
+      const sources = this.statics.filter((miner) => minerSlot(miner) === slot);
+      const source = sources[0];
+      if (sources.length !== 1 || source.onDemand || source.admissionExpiresAt || staticMinerSha256(source) !== entry.staticSha256 || source.endpoint === entry.endpoint || !Number.isFinite(source.maxBudgetFlop) || source.maxBudgetFlop <= 0 || !Number.isSafeInteger(source.maxDurationBlocks) || source.maxDurationBlocks < 1) throw new Error("static miner handoff source differs; new routing is disabled");
+      const target = dynamic.find((miner) => minerSlot(miner) === slot && miner.endpoint === entry.endpoint && miner.enclaveKey === source.enclaveKey && sameModel(source, miner) && miner.channelSigned && !!miner.admissionExpiresAt && Date.parse(miner.admissionExpiresAt) > now);
+      handed.set(slot, target ? {
+        ...target,
+        maxBudgetFlop: Math.min(source.maxBudgetFlop, target.maxBudgetFlop),
+        maxDurationBlocks: Math.min(source.maxDurationBlocks, target.maxDurationBlocks)
+      } : void 0);
+    }
+    const slots = new Set(this.statics.map(minerSlot));
+    const selected = [];
+    for (const miner of this.statics) {
+      if (!handed.has(minerSlot(miner))) selected.push(miner);
+      else {
+        const target = handed.get(minerSlot(miner));
+        if (target) selected.push(target);
+      }
+    }
+    return [...selected, ...dynamic.filter((miner) => !slots.has(minerSlot(miner)))];
+  }
+};
+var MinerAdmissions = class {
+  constructor(path5, policy) {
+    this.path = path5;
+    this.policy = policy;
+  }
+  path;
+  policy;
+  stamp;
+  entries = [];
+  revision = 0;
+  read(now = Date.now()) {
+    let stamp;
+    try {
+      const stat = statSync(this.path);
+      stamp = `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`;
+    } catch {
+      stamp = "missing";
+    }
+    if (stamp !== this.stamp) {
+      this.stamp = stamp;
+      this.revision++;
+      this.entries = [];
+      let fd;
+      try {
+        fd = openSync(this.path, "r");
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size > MAX_FILE_BYTES) throw new Error("admissions file too large");
+        const buffer = Buffer.alloc(MAX_FILE_BYTES + 1);
+        const size = readSync(fd, buffer, 0, buffer.length, 0);
+        if (size > MAX_FILE_BYTES) throw new Error("admissions file too large");
+        const file = JSON.parse(buffer.subarray(0, size).toString("utf8"));
+        if (file.schema !== "flop-miner-admissions/v1" || !Number.isFinite(Date.parse(file.generatedAt)) || !Array.isArray(file.entries) || file.entries.length > MAX_ADMITTED_MINERS) throw new Error("invalid admissions snapshot");
+        const slots = /* @__PURE__ */ new Set();
+        const entries = file.entries.map((entry) => {
+          const id = entry.modelIdentity;
+          const url = new URL(entry.endpoint);
+          const accepted = Date.parse(entry.adAcceptedAt), expiry = Date.parse(entry.admissionExpiresAt);
+          if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash || typeof entry.minerAddress !== "string" || !entry.minerAddress || !HASH4.test(entry.enclaveKey) || !id || ![id.modelHash, id.decodePolicyHash, id.measuredRoot].every((h) => HASH4.test(h)) || ![id.requestedSlug, id.registryModel, id.registryVersion, id.backendModelName].every((s) => typeof s === "string" && s.length > 0) || !Number.isInteger(id.precision) || id.precision < 0 || id.precision > 5 || !/^[1-9]\d*$/.test(entry.calibrationCapGflopsPerSec) || !Number.isFinite(accepted) || !Number.isFinite(expiry) || accepted > now || expiry <= accepted || expiry > accepted + 36e5 || entry.observation?.countryCode !== null && !/^[A-Z]{2}$/.test(entry.observation?.countryCode) || entry.observation?.regional !== false || entry.observation.observedAt !== entry.adAcceptedAt) throw new Error("invalid admission entry");
+          requireWorkerMinimum(entry.worker?.version, entry.worker?.revision);
+          const slot = minerSlot(entry);
+          if (slots.has(slot)) throw new Error("duplicate admission slot");
+          slots.add(slot);
+          return {
+            endpoint: entry.endpoint,
+            authToken: "",
+            channelSigned: true,
+            minerAddress: entry.minerAddress,
+            enclaveKey: entry.enclaveKey,
+            modelIdentity: id,
+            ...this.policy,
+            admissionExpiresAt: entry.admissionExpiresAt,
+            deployment: {
+              countryCode: entry.observation.countryCode ?? "ZZ",
+              source: "mailbox-observed:non-regional",
+              observedAt: entry.adAcceptedAt,
+              expiresAt: entry.admissionExpiresAt
+            }
+          };
+        });
+        this.entries = entries;
+      } catch {
+      } finally {
+        if (fd !== void 0) closeSync(fd);
+      }
+    }
+    return this.entries.filter((entry) => Date.parse(entry.admissionExpiresAt) > now);
+  }
+};
+
+// ../gateway-core/src/miner-peer.ts
+import { BlockList, isIP } from "node:net";
+import { lookup } from "node:dns/promises";
+import { request } from "node:https";
+import { Readable } from "node:stream";
+var NOT_PUBLIC = new BlockList();
+for (const [net, bits] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+]) NOT_PUBLIC.addSubnet(net, bits, "ipv4");
+for (const [net, bits] of [
+  // No ::ffff:0:0/96 rule: BlockList also checks IPv4 addresses against IPv4-mapped rules, so it
+  // would match every IPv4 address. A mapped address is judged by its IPv4 part instead.
+  ["::", 128],
+  ["::1", 128],
+  ["64:ff9b::", 96],
+  ["100::", 64],
+  ["2001:db8::", 32],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["ff00::", 8]
+]) NOT_PUBLIC.addSubnet(net, bits, "ipv6");
+function isPublicAddress(ip) {
+  const family = isIP(ip);
+  if (family === 0) return false;
+  if (family === 6) {
+    const canonical = new URL(`http://[${ip}]`).hostname.slice(1, -1);
+    const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(canonical);
+    if (mapped) {
+      const [high, low] = [parseInt(mapped[1], 16), parseInt(mapped[2], 16)];
+      return isPublicAddress(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
+    }
+  }
+  return !NOT_PUBLIC.check(ip, family === 4 ? "ipv4" : "ipv6");
+}
+var EndpointRefusal = class extends Error {
+};
+var systemResolve = (host) => lookup(host, { all: true, verbatim: true });
+async function resolvePublic(host, resolve9 = systemResolve) {
+  const family = isIP(host);
+  const addresses = family ? [{ address: host, family }] : await resolve9(host);
+  if (addresses.length === 0 || !addresses.every((a) => isPublicAddress(a.address))) {
+    throw new EndpointRefusal(`${host} does not resolve to public addresses only`);
+  }
+  return addresses[0];
+}
+function minerPeerFetch(endpoint, dynamic, before = () => {
+}, resolve9 = systemResolve, send2 = request) {
+  return async (input, init = {}) => {
+    before();
+    const url = new URL(String(input));
+    if (url.origin !== new URL(endpoint).origin) throw new EndpointRefusal("miner request escaped its origin");
+    if (!dynamic) return fetch(input, { ...init, redirect: "error" });
+    if (url.protocol !== "https:" || url.username || url.password) throw new EndpointRefusal("dynamic miner requires HTTPS");
+    const signal = init.signal ?? AbortSignal.timeout(3e4);
+    const pinned = await new Promise((accept, reject) => {
+      const abort = () => reject(signal.reason);
+      signal.addEventListener("abort", abort, { once: true });
+      resolvePublic(url.hostname.replace(/^\[|\]$/g, ""), resolve9).then(accept, reject).finally(() => signal.removeEventListener("abort", abort));
+      if (signal.aborted) abort();
+    });
+    before();
+    signal.throwIfAborted();
+    return new Promise((accept, reject) => {
+      const req = send2(url, {
+        method: init.method ?? "GET",
+        headers: Object.fromEntries(new Headers(init.headers).entries()),
+        signal,
+        agent: false,
+        lookup: (_host, options, callback) => {
+          if (options.all) callback(null, [pinned]);
+          else callback(null, pinned.address, pinned.family);
+        }
+      }, (res) => {
+        const status = res.statusCode;
+        if (status >= 300 && status < 400) {
+          res.destroy();
+          req.destroy();
+          reject(new EndpointRefusal("miner redirect refused"));
+          return;
+        }
+        const headers = new Headers();
+        for (const [name, value] of Object.entries(res.headers)) {
+          if (value !== void 0) headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+        }
+        accept(new Response([204, 205].includes(status) ? null : Readable.toWeb(res), { status, headers }));
+      });
+      req.on("error", (error) => reject(signal.aborted ? signal.reason : error));
+      req.end(init.body);
+    });
+  };
+}
+
 // src/commands/gateway-renew.ts
 import { Command as Command47 } from "commander";
 
@@ -12151,7 +12443,7 @@ function tailnetNodeRef(source) {
 }
 function readTailscaleStatus(socketPath) {
   return new Promise((resolve9, reject) => {
-    const req = request({
+    const req = request2({
       socketPath,
       path: "/localapi/v0/status",
       headers: { Host: "local-tailscaled.sock", "Sec-Tailscale": "localapi" },
@@ -12253,6 +12545,12 @@ async function renewGatewayEvidence(miners, records, observe) {
       const node = tailnetNodeRef(declared.source);
       let provider;
       let session;
+      if (miner.admissionExpiresAt) {
+        await observe.miner(miner);
+        if (Date.parse(miner.admissionExpiresAt) <= observe.now()) throw new Error("miner admission expired");
+        observed.push(miner);
+        continue;
+      }
       if (node) {
         session = await observe.miner(miner);
         provider = await observe.tailnet(node);
@@ -12467,11 +12765,75 @@ async function waitForSettlementAllowance(api, channelId, aggregateGn, deadline)
   }
   throw new Error("settlement allowance did not arrive before the probe deadline");
 }
+async function renewalMinerInfo(api, miner, fetchImpl = fetch) {
+  const head = await api.rpc.chain.getFinalizedHead();
+  const at = await api.at(head);
+  const registered = await at.query.minerStaking.miners(miner.minerAddress);
+  const active = registered?.isSome && registered.unwrap().isActive;
+  if (!(active?.isTrue ?? active === true)) throw new Error("miner is not registered and active at finality");
+  const encoded = await api.rpc.state.call("TrustRootApi_accepted_calibration_cap", `0x80${hex3(decodeAddress2(miner.minerAddress)).slice(2)}`, head);
+  const cap = encoded.toU8a(true);
+  if (cap.length !== 9 || cap[0] !== 1 || new DataView(cap.buffer, cap.byteOffset + 1, 8).getBigUint64(0, true) <= 0n) throw new Error("miner has no finalized calibrated capacity");
+  const identity = {
+    ...miner.modelIdentity,
+    modelHash: bytes3(miner.modelIdentity.modelHash),
+    decodePolicyHash: bytes3(miner.modelIdentity.decodePolicyHash),
+    measuredRoot: bytes3(miner.modelIdentity.measuredRoot)
+  };
+  if (!miner.channelSigned) {
+    const anonymous = await fetchImpl(`${miner.endpoint.replace(/\/$/, "")}/session/info`, { redirect: "error", signal: AbortSignal.timeout(3e4) });
+    await anonymous.body?.cancel();
+    if (anonymous.status !== 401) throw new Error("miner /session/info does not enforce authentication");
+  }
+  const info = miner.channelSigned ? await computeChannel6.fetchProvenSessionInfo(miner.endpoint, {
+    genesisHash: api.genesisHash.toU8a(),
+    account: decodeAddress2(miner.minerAddress),
+    minerAddress: miner.minerAddress,
+    enclaveKey: bytes3(miner.enclaveKey),
+    modelIdentity: identity
+  }, fetchImpl, AbortSignal.timeout(3e4)) : await computeChannel6.fetchMinerSessionInfo(
+    miner.endpoint,
+    { Authorization: `Bearer ${miner.authToken}` },
+    AbortSignal.timeout(3e4),
+    fetchImpl
+  );
+  requireWorkerMinimum(info.image?.version, info.image?.revision);
+  const wire = {
+    ...info,
+    is_ready: info.isReady,
+    enclaveKey: hex3(info.enclaveKey),
+    modelHash: hex3(info.modelHash),
+    modelIdentity: {
+      ...info.modelIdentity,
+      modelHash: hex3(info.modelIdentity.modelHash),
+      decodePolicyHash: hex3(info.modelIdentity.decodePolicyHash),
+      measuredRoot: hex3(info.modelIdentity.measuredRoot)
+    }
+  };
+  const snapshot = await readChainSnapshot(api, wire, head.toHex());
+  if (miner.channelSigned && snapshot.calibration) wire.calibration = {
+    ...snapshot.calibration,
+    ready: true,
+    state: "active",
+    currentBlock: snapshot.finalizedBlock
+  };
+  assertMinerMatchesChain(wire, snapshot);
+  if (wire.minerAddress !== miner.minerAddress || wire.enclaveKey !== miner.enclaveKey || Object.keys(miner.modelIdentity).some((field2) => wire.modelIdentity[field2] !== miner.modelIdentity[field2])) throw new Error("miner no longer advertises its allowlisted identity");
+  return { ...info, calibration: wire.calibration };
+}
+function renewalAdmissions(env, chainPriced) {
+  if (!env.GATEWAY_ADMISSIONS_FILE) return void 0;
+  const maxBudgetFlop = Number(env.GATEWAY_ADMISSION_MAX_BUDGET_FLOP), maxDurationBlocks = Number(env.GATEWAY_ADMISSION_MAX_DURATION_BLOCKS);
+  if (!chainPriced || !Number.isFinite(maxBudgetFlop) || maxBudgetFlop <= 0 || !Number.isSafeInteger(maxDurationBlocks) || maxDurationBlocks <= 0) throw new Error("dynamic admission requires chain pricing and explicit gateway budget/duration policy");
+  return new MinerAdmissions(env.GATEWAY_ADMISSIONS_FILE, { maxBudgetFlop, maxDurationBlocks });
+}
 async function probeToolsConformance(input) {
   const { api, chain, miner, record } = input;
   const deadline = Date.now() + PROBE_TIMEOUT_MS;
-  const headers = { Authorization: `Bearer ${miner.authToken}` };
-  const info = await computeChannel6.fetchMinerSessionInfo(miner.endpoint, headers, AbortSignal.timeout(3e4));
+  const fetchImpl = minerPeerFetch(miner.endpoint, !!miner.admissionExpiresAt, input.assertAdmission);
+  const headers = miner.channelSigned ? {} : { Authorization: `Bearer ${miner.authToken}` };
+  const info = await renewalMinerInfo(api, miner, fetchImpl);
+  let requestHeaders;
   const pinned = miner.modelIdentity;
   const advertised = info.modelIdentity;
   if (info.minerAddress !== miner.minerAddress || hex3(info.enclaveKey) !== miner.enclaveKey.toLowerCase() || !advertised || advertised.requestedSlug !== pinned.requestedSlug || advertised.registryModel !== pinned.registryModel || advertised.registryVersion !== pinned.registryVersion || hex3(advertised.modelHash) !== pinned.modelHash || advertised.precision !== pinned.precision || hex3(advertised.decodePolicyHash) !== pinned.decodePolicyHash || hex3(advertised.measuredRoot) !== pinned.measuredRoot || advertised.backendModelName !== pinned.backendModelName) {
@@ -12493,6 +12855,8 @@ async function probeToolsConformance(input) {
   let sequence = 0;
   const transport = new computeChannel6.HttpSessionTransport(miner.endpoint, PROBE_TIMEOUT_MS, {
     headers,
+    fetchImpl,
+    requestHeaders: (method, path5, body) => requestHeaders?.(method, path5, body) ?? {},
     onFrame: (frame) => {
       if (frame.sequence !== sequence++) throw new Error("tools probe frame sequence mismatch");
       if (frame.type === "chunk") frames.push({ kind: frame.kind, data: bytes3(frame.data) });
@@ -12500,6 +12864,7 @@ async function probeToolsConformance(input) {
   });
   const agentKey = computeChannel6.SessionKey.generate();
   const identity = { ...pinned, modelHash: bytes3(pinned.modelHash), decodePolicyHash: bytes3(pinned.decodePolicyHash), measuredRoot: bytes3(pinned.measuredRoot) };
+  input.assertAdmission?.();
   const session = await computeChannel6.ChannelSession.open({
     chain,
     transport,
@@ -12526,7 +12891,15 @@ async function probeToolsConformance(input) {
   let verdict;
   let receipt;
   try {
-    await computeChannel6.notifyMinerOpen(miner.endpoint, session.channelId, agentKey.publicKey, headers, AbortSignal.timeout(3e4));
+    if (miner.channelSigned) requestHeaders = await computeChannel6.channelSessionAuth(
+      miner.endpoint,
+      session.channelId,
+      agentKey,
+      info,
+      fetchImpl,
+      AbortSignal.timeout(3e4)
+    );
+    await computeChannel6.notifyMinerOpen(miner.endpoint, session.channelId, agentKey.publicKey, headers, AbortSignal.timeout(3e4), requestHeaders, fetchImpl);
     receipt = await session.chatTurn({
       version,
       model: record.openrouter_slug,
@@ -12549,7 +12922,7 @@ async function probeToolsConformance(input) {
   try {
     await waitForSettlementAllowance(api, session.channelId, receipt.gN, deadline);
     const settled = await session.closeCooperative(async (claim) => {
-      const wire = await computeChannel6.notifyMinerClose(miner.endpoint, claim, headers, AbortSignal.timeout(3e4));
+      const wire = await computeChannel6.notifyMinerClose(miner.endpoint, claim, headers, AbortSignal.timeout(3e4), requestHeaders, fetchImpl);
       return wire ? {
         channelId: bytes3(wire.channelId),
         minerPaid: BigInt(wire.minerPaid),
@@ -12595,7 +12968,7 @@ function gatewayRenewCmd() {
           throw new Error("receipt-only mode requires the receipt/hash and cannot run direct probes");
         }
         const raw = await readFile11(opts.qualificationReceipt);
-        if (raw.length > 8e6 || createHash5("sha256").update(raw).digest("hex") !== opts.qualificationReceiptSha256) throw new Error("qualification receipt bytes differ");
+        if (raw.length > 8e6 || createHash6("sha256").update(raw).digest("hex") !== opts.qualificationReceiptSha256) throw new Error("qualification receipt bytes differ");
         const value = JSON.parse(raw.toString("utf8"));
         const records2 = parseCanonicalCatalog(envJson(opts.catalogEnv), { chainPriced: opts.catalogPricing === "chain" });
         const record = records2.find((item) => item.openrouter_slug === value.model);
@@ -12612,7 +12985,12 @@ function gatewayRenewCmd() {
         return;
       }
       if (!opts.allowlistEnv || !opts.providerKeyEnv || !opts.probeSignerEnv || !opts.probeEscrow) throw new Error("direct renewal requires allowlist, provider, signer and escrow options");
-      const miners = envJson(opts.allowlistEnv);
+      const staticMiners = envJson(opts.allowlistEnv);
+      const admissions = renewalAdmissions(process.env, opts.catalogPricing === "chain");
+      const handoffs = process.env.GATEWAY_STATIC_HANDOFFS_FILE?.trim();
+      if (handoffs && !admissions) throw new Error("static handoffs require dynamic admissions");
+      const routing = new MinerRouting(staticMiners, handoffs);
+      const miners = routing.read(admissions?.read() ?? []);
       if (!Array.isArray(miners) || miners.length === 0) throw new Error(`${opts.allowlistEnv} must list at least one miner`);
       const records = parseCanonicalCatalog(envJson(opts.catalogEnv), { chainPriced: opts.catalogPricing === "chain" });
       const providerKey = envSecret(opts.providerKeyEnv);
@@ -12626,24 +13004,40 @@ function gatewayRenewCmd() {
       await computeChannel6.ready();
       const signer = new Keyring5({ type: "sr25519" }).addFromUri(signerUri);
       const chain = new computeChannel6.ComputeChannelChainClient(new computeChannel6.FlopChainSubmitter(api, signer, true));
+      const assertAdmission = (miner) => {
+        if (!miner.admissionExpiresAt) return;
+        const dynamic = admissions?.read() ?? [];
+        const matches = (item) => !!item && item.enclaveKey === miner.enclaveKey && item.endpoint === miner.endpoint && JSON.stringify(item.modelIdentity) === JSON.stringify(miner.modelIdentity);
+        if (!matches(dynamic.find((item) => minerSlot(item) === minerSlot(miner))) || !matches(routing.read(dynamic).find((item) => minerSlot(item) === minerSlot(miner)))) throw new Error("miner admission expired or key revoked");
+      };
       const report = await renewGatewayEvidence(miners, records, {
         now: Date.now,
         provider: (ref) => observeGpuAiInstance(ref, providerKey),
         tailnet: tailnetObserver(opts.tailscaleSocket),
         miner: async (miner) => {
-          const info = await fetchMinerSessionInfo(miner.endpoint, miner.authToken, AbortSignal.timeout(3e4));
+          const proven = await renewalMinerInfo(api, miner, minerPeerFetch(miner.endpoint, !!miner.admissionExpiresAt, () => assertAdmission(miner)));
+          const info = {
+            ...proven,
+            is_ready: proven.isReady,
+            enclaveKey: hex3(proven.enclaveKey),
+            modelHash: hex3(proven.modelHash),
+            modelIdentity: {
+              ...proven.modelIdentity,
+              modelHash: hex3(proven.modelIdentity.modelHash),
+              decodePolicyHash: hex3(proven.modelIdentity.decodePolicyHash),
+              measuredRoot: hex3(proven.modelIdentity.measuredRoot)
+            }
+          };
           const pinned = miner.modelIdentity;
           const advertised = info.modelIdentity;
           if (info.minerAddress !== miner.minerAddress || info.enclaveKey?.toLowerCase() !== miner.enclaveKey.toLowerCase() || !advertised || Object.keys(pinned).some((key) => advertised[key] !== pinned[key])) {
             throw new Error("miner no longer advertises its allowlisted identity");
           }
-          const snapshot = await readChainSnapshot(api, info);
-          assertMinerMatchesChain(info, snapshot);
-          return `authenticated /session/info matches its pin and finalized block ${snapshot.finalizedBlock}`;
+          return "authenticated session identity matches its pin and finalized registry/calibration";
         },
         tools: async (miner, record) => {
           await assertProbeSignerFunded(api, signer.address, escrow);
-          return probeToolsConformance({ api, chain, miner, record, escrow });
+          return probeToolsConformance({ api, chain, miner, record, escrow, assertAdmission: () => assertAdmission(miner) });
         }
       });
       const exitCode = await finishRenewal(report, opts.out, getJson(command));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flop-labs/cli",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "FLOP Network CLI — interact with FLOP from the terminal",
   "license": "MIT OR Apache-2.0",
   "repository": {
@@ -22,8 +22,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@flop-labs/client": "^0.2.1",
-    "@flop-labs/sdk": "^0.4.0",
+    "@flop-labs/client": "^0.2.2",
+    "@flop-labs/sdk": "^0.5.1",
     "@polkadot/api": "^17.0.1",
     "@polkadot/keyring": "^14.0.3",
     "@polkadot/util-crypto": "^14.0.3",
@@ -42,12 +42,15 @@
   "engines": {
     "node": ">=22.0.0"
   },
+  "bugs": {
+    "url": "https://github.com/flop-labs/network/issues/new/choose"
+  },
   "scripts": {
     "build": "tsc --noEmit && node scripts/bundle.mjs",
     "start": "node dist/cli.js",
     "dev": "tsx src/cli.ts",
     "typecheck": "tsc --noEmit",
-    "test:unit": "vitest run tests/unit",
+    "test:unit": "vitest run tests/unit --testTimeout=20000 --hookTimeout=20000",
     "build:public": "node scripts/build-public.mjs",
     "test:public": "node --test scripts/*.test.mjs",
     "verify:public": "node scripts/verify-public.mjs"