@flop-labs/cli 0.4.0 → 0.4.2

package/dist/cli.js

@@ -724,14 +724,14 @@ var init_task_runner = __esm({
         }
       }
       withTimeout(promise, timeoutMs) {
-        return new Promise((resolve9, reject) => {
+        return new Promise((resolve10, reject) => {
           const timer = setTimeout(
             () => reject(new AgentError("T002" /* TASK_TIMEOUT */, `Task timed out after ${timeoutMs}ms`, true)),
             timeoutMs
           );
           promise.then((result) => {
             clearTimeout(timer);
-            resolve9(result);
+            resolve10(result);
           }).catch((err) => {
             clearTimeout(timer);
             reject(err);
@@ -739,7 +739,7 @@ var init_task_runner = __esm({
         });
       }
       sleep(ms) {
-        return new Promise((resolve9) => setTimeout(resolve9, ms));
+        return new Promise((resolve10) => setTimeout(resolve10, ms));
       }
     };
   }
@@ -904,7 +904,7 @@ var init_worker = __esm({
         return this.identity;
       }
       sleep(ms) {
-        return new Promise((resolve9) => setTimeout(resolve9, ms));
+        return new Promise((resolve10) => setTimeout(resolve10, ms));
       }
     };
   }
@@ -912,10 +912,10 @@ var init_worker = __esm({
 
 // ../agent/src/chain-apis.ts
 async function submitTx(tx, signer) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     tx.signAndSend(signer, ({ status, dispatchError }) => {
       if (dispatchError) reject(new Error(`Tx failed: ${dispatchError.toString()}`));
-      else if (status.isInBlock || status.isFinalized) resolve9(status.asFinalized.toString());
+      else if (status.isInBlock || status.isFinalized) resolve10(status.asFinalized.toString());
     }).catch(reject);
   });
 }
@@ -1219,7 +1219,7 @@ async function waitForTaskCompletion(api, taskId, timeoutMs = DEFAULT_TIMEOUT, p
         return receipt;
       }
     }
-    await new Promise((resolve9) => setTimeout(resolve9, pollIntervalMs));
+    await new Promise((resolve10) => setTimeout(resolve10, pollIntervalMs));
   }
   throw new AgentError(
     "T002" /* TASK_TIMEOUT */,
@@ -1878,7 +1878,7 @@ async function waitForBalance(api, address, minBalance, timeoutMs = 6e4) {
       }
     } catch {
     }
-    await new Promise((resolve9) => setTimeout(resolve9, pollInterval));
+    await new Promise((resolve10) => setTimeout(resolve10, pollInterval));
   }
   return false;
 }
@@ -4941,9 +4941,9 @@ var init_src = __esm({
 });
 
 // src/cli.ts
-import { Command as Command48, Option as Option7 } from "commander";
+import { Command as Command49, Option as Option8 } from "commander";
 import { readFileSync as readFileSync2 } from "node:fs";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 
 // src/output.ts
 var activeOutputMode = "human";
@@ -5019,9 +5019,12 @@ function table(headers, rows) {
 }
 function inferError(error) {
   const message = error instanceof Error ? error.message : String(error);
-  if (/ECONNREFUSED|WebSocket|disconnected|connect.*(failed|error)|network error/i.test(message)) {
+  if (/ECONNREFUSED|WebSocket|disconnected|RPC unreachable|connect.*(failed|error)|network error/i.test(message)) {
     return { code: "RPC_UNREACHABLE", message, retryable: true };
   }
+  if (error && typeof error === "object" && "code" in error && typeof error.code === "string") {
+    return { code: error.code, message, retryable: false };
+  }
   if (/insufficient custody|shards confirmed/i.test(message)) {
     return { code: "DA_CUSTODY_FAILED", message, retryable: true };
   }
@@ -5119,13 +5122,14 @@ async function createClient(rpcUrl, signer) {
   return FlopClient7.create(opts);
 }
 async function createReadOnlyClient(rpcUrl) {
-  const [{ ApiPromise: ApiPromise2, HttpProvider: HttpProvider2, WsProvider: WsProvider2 }, { FlopClient: FlopClient7 }] = await Promise.all([
-    import("@polkadot/api"),
-    import("@flop-labs/sdk")
-  ]);
-  const provider = rpcUrl.startsWith("ws") ? new WsProvider2(rpcUrl) : new HttpProvider2(rpcUrl);
-  const api = await ApiPromise2.create({ provider, noInitWarn: true });
-  return FlopClient7.fromApiReadOnly(api);
+  const { connectFlopApi, FlopClient: FlopClient7 } = await import("@flop-labs/sdk");
+  const api = await connectFlopApi(rpcUrl);
+  try {
+    return FlopClient7.fromApiReadOnly(api);
+  } catch (error) {
+    await api.disconnect();
+    throw error;
+  }
 }
 
 // src/opts.ts
@@ -5208,21 +5212,26 @@ function parsePositiveInt(value, name) {
 // src/commands/balance.ts
 function balanceCmd() {
   return new Command("balance").description("Check account balance").argument("<address>", "Account address (SS58)").option("--json", "Output as JSON").action(async (address, opts, command) => {
+    let client;
     try {
       const rpc = getRpc(command);
       const json = getJson(command);
-      const client = await createClient(rpc);
+      client = await createClient(rpc);
       const info = await client.api.query.system.account(address);
+      const free = BigInt(info.data.free.toString());
+      const reserved = BigInt(info.data.reserved.toString());
       const result = {
         address,
         free: info.data.free.toString(),
         reserved: info.data.reserved.toString(),
-        total: info.data.free.toString()
+        total: (free + reserved).toString(),
+        frozen: info.data.frozen.toString()
       };
       print(result, json);
-      await client.disconnect();
     } catch (e) {
       commandError(e);
+    } finally {
+      await client?.disconnect();
     }
   });
 }
@@ -5588,7 +5597,15 @@ function sessionRunCmd() {
         completion_tokens: result.receipts[0].completionTokens?.toString()
       }, getJson(command));
     } catch (error) {
-      commandError(error, { next: walletPath ? `wallet saved at ${walletPath}; inspect the channel before retrying` : "check miner endpoint, registry identity, signer balance and channel state" });
+      const channelId = error && typeof error === "object" && "channelId" in error && error.channelId instanceof Uint8Array ? `0x${Buffer.from(error.channelId).toString("hex")}` : null;
+      printError({
+        code: "SESSION_FAILED",
+        message: error instanceof Error ? error.message : String(error),
+        channel: channelId,
+        recovery: channelId ? "inspect finalized channel and terminal events before retrying" : "no channel reported",
+        ...walletPath ? { wallet: walletPath } : {}
+      }, "json");
+      process.exitCode = 1;
     } finally {
       await client?.disconnect();
     }
@@ -5599,10 +5616,11 @@ function sessionRunCmd() {
 import { Command as Command11 } from "commander";
 function walletAgentCreateCmd() {
   return new Command11("create").description("Create an agent wallet").argument("<agent>", "Agent address (SS58)").option("--daily-cap <cap>", "Daily cap in FLOP", "50").option("--tx-limit <limit>", "Per-tx limit in FLOP", "5").option("--json", "Output as JSON").action(async (agent, opts, command) => {
+    let client;
     try {
       const rpc = getRpc(command);
       const { createAgentWallet: createAgentWallet2 } = await import("@flop-labs/sdk");
-      const client = await createClient(rpc, getSigner(command));
+      client = await createClient(rpc, getSigner(command));
       const flopToRaw3 = (flop) => BigInt(Math.floor(parseFloat(flop) * 1e18));
       const txHash = await createAgentWallet2(client.api, client.signer, {
         agent,
@@ -5618,9 +5636,10 @@ function walletAgentCreateCmd() {
         },
         getJson(command)
       );
-      await client.disconnect();
     } catch (e) {
-      commandError(e, { next: "check signer balance and agent address; retry" });
+      commandError(e, { next: "inspect finalized agentWallet.wallets for this agent before retrying creation" });
+    } finally {
+      await client?.disconnect();
     }
   });
 }
@@ -6000,6 +6019,7 @@ import { constants, accessSync, existsSync } from "node:fs";
 import http from "node:http";
 import https from "node:https";
 import path from "node:path";
+import { watchTransaction } from "@flop-labs/sdk";
 function printRolePlan(plan, output) {
   const mode = resolveOutputMode(output);
   if (mode === "agent") {
@@ -6010,7 +6030,8 @@ function printRolePlan(plan, output) {
       steps: plan.steps.map(({ phase, command, mutates }) => ({ phase, command, mutates })),
       ...extended.config_path ? { config_path: extended.config_path } : {},
       ...extended.mcp_config ? { mcp_config: extended.mcp_config } : {},
-      ...plan.gpu_inventory ? { gpu_inventory: plan.gpu_inventory } : {}
+      ...plan.gpu_inventory ? { gpu_inventory: plan.gpu_inventory } : {},
+      ...plan.role === "validator" ? { live_minimum_stake: plan.live_minimum_stake ?? null } : {}
     }, mode);
     return;
   }
@@ -6020,6 +6041,7 @@ function printRolePlan(plan, output) {
   }
   console.log(`${plan.role} onboarding (${plan.mode})`);
   console.log(plan.summary);
+  if (plan.role === "validator") console.log(`Live minimum stake: ${plan.live_minimum_stake === void 0 ? "not queried (--offline)" : `${plan.live_minimum_stake} FLOP`}`);
   for (const [index, step] of plan.steps.entries()) {
     console.log(`  ${index + 1}. ${step.phase}: ${step.command}`);
     console.log(`     ${step.purpose}${step.mutates ? " [changes state]" : ""}`);
@@ -6105,12 +6127,12 @@ function pathCheck(id, target, required = true) {
   };
 }
 async function probeHttpUrl(id, url, required = true, timeoutMs = 3e3) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     let parsed;
     try {
       parsed = new URL(url);
     } catch {
-      resolve9({
+      resolve10({
         id,
         status: "fail",
         required,
@@ -6120,10 +6142,10 @@ async function probeHttpUrl(id, url, required = true, timeoutMs = 3e3) {
       return;
     }
     const transport = parsed.protocol === "https:" ? https : http;
-    const request2 = transport.request(parsed, { method: "GET", timeout: timeoutMs }, (response) => {
+    const request3 = transport.request(parsed, { method: "GET", timeout: timeoutMs }, (response) => {
       response.resume();
       const reachable = (response.statusCode ?? 500) < 500;
-      resolve9({
+      resolve10({
         id,
         status: reachable ? "pass" : required ? "fail" : "warn",
         required,
@@ -6131,9 +6153,9 @@ async function probeHttpUrl(id, url, required = true, timeoutMs = 3e3) {
         ...!reachable ? { next: `check ${url}; retry doctor` } : {}
       });
     });
-    request2.on("timeout", () => request2.destroy(new Error("timeout")));
-    request2.on("error", (error) => {
-      resolve9({
+    request3.on("timeout", () => request3.destroy(new Error("timeout")));
+    request3.on("error", (error) => {
+      resolve10({
         id,
         status: required ? "fail" : "warn",
         required,
@@ -6141,7 +6163,7 @@ async function probeHttpUrl(id, url, required = true, timeoutMs = 3e3) {
         next: `check ${url}; retry doctor`
       });
     });
-    request2.end();
+    request3.end();
   });
 }
 async function probeRpc(api, rpc) {
@@ -6167,25 +6189,8 @@ async function probeRpc(api, rpc) {
   }
 }
 async function submitExtrinsic(api, signer, extrinsic) {
-  return new Promise((resolve9, reject) => {
-    let unsubscribe;
-    extrinsic.signAndSend(signer, (result) => {
-      if (!result.status?.isInBlock && !result.status?.isFinalized) return;
-      unsubscribe?.();
-      if (result.dispatchError) {
-        if (result.dispatchError.isModule) {
-          const decoded = api.registry.findMetaError(result.dispatchError.asModule);
-          reject(new Error(`${decoded.section}.${decoded.name}`));
-        } else {
-          reject(new Error(result.dispatchError.toString()));
-        }
-        return;
-      }
-      resolve9((result.txHash ?? extrinsic.hash).toHex());
-    }).then((fn) => {
-      unsubscribe = fn;
-    }).catch(reject);
-  });
+  const result = await watchTransaction(extrinsic, signer, { api });
+  return (result.txHash ?? extrinsic.hash).toHex();
 }
 function unwrapStorage(raw) {
   if (!raw || raw.isNone) return null;
@@ -6194,7 +6199,7 @@ function unwrapStorage(raw) {
 
 // src/commands/launch.ts
 function checkGateway(url) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     try {
       const parsedUrl = new URL(url);
       const req = http2.request(
@@ -6206,17 +6211,17 @@ function checkGateway(url) {
           timeout: 1e3
         },
         (res) => {
-          resolve9(res.statusCode === 200);
+          resolve10(res.statusCode === 200);
         }
       );
-      req.on("error", () => resolve9(false));
+      req.on("error", () => resolve10(false));
       req.on("timeout", () => {
         req.destroy();
-        resolve9(false);
+        resolve10(false);
       });
       req.end();
     } catch {
-      resolve9(false);
+      resolve10(false);
     }
   });
 }
@@ -6524,7 +6529,7 @@ async function withCredentialLock(path5, action) {
         continue;
       }
       if (Date.now() >= deadline) throw new Error(`FLOP credential lock is busy at ${lock}`);
-      await new Promise((resolve9) => setTimeout(resolve9, 100));
+      await new Promise((resolve10) => setTimeout(resolve10, 100));
     }
   }
   try {
@@ -6584,6 +6589,8 @@ function validateWalletEnrollmentChallenge(message, address, gateway, genesis, n
   const issued = Date.parse(issuedText), expires = Date.parse(expiresText);
   if (!Number.isFinite(issued) || !Number.isFinite(expires) || lines[6] !== `Issued At: ${new Date(issued).toISOString()}` || lines[7] !== `Expiration Time: ${new Date(expires).toISOString()}` || issued > now || expires <= now || expires <= issued || expires - issued > 5 * 6e4) throw invalid();
 }
+var ENROLLMENT_CHALLENGE_TIMEOUT_MS = 3e4;
+var ENROLLMENT_SUBMIT_TIMEOUT_MS = 12e4;
 function walletEnrollment(options) {
   return async () => {
     if (options.purpose) await hermesEnrollmentOffer(options.gateway);
@@ -6600,12 +6607,12 @@ function walletEnrollment(options) {
       const deadline = Date.now() + (options.fundTimeoutMs ?? 12e4);
       while (await options.balance(pair.address) < minBalance) {
         if (Date.now() >= deadline) throw new Error("devnet faucet grant did not finalize in time; retry later");
-        await new Promise((resolve9) => setTimeout(resolve9, options.pollMs ?? 3e3));
+        await new Promise((resolve10) => setTimeout(resolve10, options.pollMs ?? 3e3));
       }
     }
     const challenge = await fetch(
       `${options.gateway}/v1/enroll/wallet/challenge?address=${encodeURIComponent(pair.address)}${options.purpose ? `&purpose=${options.purpose}` : ""}`,
-      { redirect: "error", signal: AbortSignal.timeout(options.purpose ? 3e4 : 1e4) }
+      { redirect: "error", signal: AbortSignal.timeout(ENROLLMENT_CHALLENGE_TIMEOUT_MS) }
     );
     if (!challenge.ok) throw await failure(challenge, "devnet enrollment challenge");
     const { message } = await challenge.json();
@@ -6616,7 +6623,7 @@ function walletEnrollment(options) {
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ address: pair.address, message, signature }),
       redirect: "error",
-      signal: AbortSignal.timeout(options.purpose ? 3e4 : 1e4)
+      signal: AbortSignal.timeout(ENROLLMENT_SUBMIT_TIMEOUT_MS)
     });
   };
 }
@@ -7007,14 +7014,14 @@ var CORS_HEADERS = {
   "Access-Control-Allow-Headers": "Authorization, Content-Type"
 };
 function readBody(req) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     let data = "";
     req.on("data", (c) => data += c);
     req.on("end", () => {
       try {
-        resolve9(data ? JSON.parse(data) : {});
+        resolve10(data ? JSON.parse(data) : {});
       } catch {
-        resolve9({});
+        resolve10({});
       }
     });
   });
@@ -7251,7 +7258,7 @@ async function startProxyServer(o) {
     embeddingModel: o.embeddingModel,
     embed: createLocalEmbedder(o.embeddingModel)
   });
-  await new Promise((resolve9) => server.listen(o.port, o.host, () => resolve9()));
+  await new Promise((resolve10) => server.listen(o.port, o.host, () => resolve10()));
   const addr = server.address();
   const url = `http://${o.host}:${addr.port}`;
   const models = await listModels();
@@ -7388,9 +7395,9 @@ function launchExternal2(command, args, envOverrides) {
 function runHermesConfig(launcher, commands) {
   return commands.reduce(
     (p, args) => p.then(
-      () => new Promise((resolve9, reject) => {
+      () => new Promise((resolve10, reject) => {
         const c = spawnLauncher(launcher, args, { stdio: "inherit" });
-        c.on("exit", (code) => code === 0 ? resolve9() : reject(new Error(`hermes ${args.join(" ")} exited ${code}`)));
+        c.on("exit", (code) => code === 0 ? resolve10() : reject(new Error(`hermes ${args.join(" ")} exited ${code}`)));
         c.on("error", reject);
       })
     ),
@@ -7625,6 +7632,7 @@ import { basename as basename2, join as join6, resolve as resolve8 } from "node:
 import { resolve as resolve5, relative, sep } from "node:path";
 import { mkdir as mkdir7, readFile as readFile4, readdir, lstat as lstat3, writeFile as writeFile7 } from "node:fs/promises";
 import { execFile as execFile3, spawn as spawn4 } from "node:child_process";
+import { pipeline } from "node:stream/promises";
 import { promisify as promisify3 } from "node:util";
 function modelToOutput(model) {
   return {
@@ -7747,6 +7755,9 @@ async function daCommit(executable, blobFile) {
   const { stdout: stdout2 } = await run2(executable, ["commit", "--blob-file", blobFile, "--json"], {
     maxBuffer: 1024 * 1024
   });
+  return parseDaLayout(stdout2);
+}
+function parseDaLayout(stdout2) {
   const line = lastJsonLine(stdout2);
   if (!line) throw new Error("da-validator commit returned no JSON result");
   const result = JSON.parse(line);
@@ -7760,6 +7771,62 @@ async function daCommit(executable, blobFile) {
     chunks: result.chunks
   };
 }
+async function runWithBlobOnStdin(executable, args, env, body) {
+  const child = spawn4(executable, args, { stdio: ["pipe", "pipe", "inherit"], env });
+  let stdout2 = "";
+  child.stdout.setEncoding("utf8");
+  child.stdout.on("data", (part) => {
+    stdout2 += part;
+  });
+  let streamError;
+  const fed = pipeline(body, child.stdin).catch((error) => {
+    if (error.code === "EPIPE") return;
+    streamError = error;
+    child.kill("SIGKILL");
+  });
+  const code = await new Promise((resolveExit, rejectExit) => {
+    child.on("error", rejectExit);
+    child.on("close", resolveExit);
+  });
+  await fed;
+  if (streamError) throw streamError;
+  return { code, stdout: stdout2 };
+}
+async function daCommitStream(executable, blob) {
+  const { code, stdout: stdout2 } = await runWithBlobOnStdin(
+    executable,
+    ["commit", "--blob-stdin", "--size", String(blob.sizeBytes), "--manifest-out", blob.manifestFile, "--json"],
+    process.env,
+    blob.open()
+  );
+  if (code !== 0) throw new Error(`da-validator commit failed (exit ${code}); see its log above`);
+  return parseDaLayout(stdout2);
+}
+async function submitDaBlobStream(executable, rpc, blob, publisherKey) {
+  const env = { ...process.env };
+  if (publisherKey) env.DA_PUBLISHER_KEY = publisherKey;
+  else delete env.DA_PUBLISHER_KEY;
+  const { code, stdout: stdout2 } = await runWithBlobOnStdin(
+    executable,
+    [
+      "submit",
+      "--chain-rpc",
+      rpc,
+      "--blob-stdin",
+      "--size",
+      String(blob.sizeBytes),
+      "--manifest-file",
+      blob.manifestFile,
+      "--json"
+    ],
+    env,
+    blob.open()
+  );
+  if (code !== 0 && !lastJsonLine(stdout2)) {
+    throw new Error(`da-validator submit failed (exit ${code}); see its log above`);
+  }
+  return parseCustodyResult(stdout2);
+}
 function parseCustodyResult(stdout2) {
   const line = lastJsonLine(stdout2);
   if (!line) throw new Error("da-validator returned no JSON custody result");
@@ -9284,7 +9351,9 @@ function modelOnboardCmd() {
       if (opts.approve && !state.approved) throw new Error("approval is not present in finalized registry state");
       if (metadataOnly && !state.weightsRef) {
         process.stderr.write(
-          `next: approval needs the DA backup of ${identity.modelHash} (packed image + file table, ${measured.imageSize} bytes in ${Math.max(1, Math.ceil(measured.imageSize / sdk.DA_CHUNK_SIZE))} chunk(s)); upload it with --download from a box with the disk
+          `next: approval needs the DA backup of ${identity.modelHash} (packed image + file table, ${measured.imageSize} bytes in ${Math.max(1, Math.ceil(measured.imageSize / sdk.DA_CHUNK_SIZE))} chunk(s)). On a box with room for the checkpoint, run
+  flop model backup ${identity.modelHash} --model-dir <path>${preflight ? ` --revision ${preflight.revision}` : ""}
+then bind the DataRef it prints. Rerunning this command with --download packs the image from disk instead, which needs about twice the checkpoint's size.
 `
         );
       }
@@ -9484,10 +9553,167 @@ function modelPreflightCmd() {
   });
 }
 
+// src/commands/model-backup.ts
+import { Command as Command33, Option as Option3 } from "commander";
+import { mkdir as mkdir12, rm as rm4, writeFile as writeFile10 } from "node:fs/promises";
+import { join as join8, resolve as resolve9 } from "node:path";
+var PRECISIONS3 = ["FP32", "FP16", "BF16", "INT8", "INT4", "Mixed"];
+async function finalizedLeasedRef2(api, commitment, size) {
+  const hash2 = await api.rpc.chain.getFinalizedHead();
+  const [at, header] = await Promise.all([api.at(hash2), api.rpc.chain.getHeader(hash2)]);
+  return existingLeasedRef({ query: at.query, rpc: { chain: { getHeader: async () => header } } }, commitment, size);
+}
+var REGISTRATION_WAIT_POLLS = 30;
+var REGISTRATION_POLL_MS = 2e3;
+async function awaitFinalizedLeasedRef(api, commitment, size) {
+  for (let poll = 0; ; poll++) {
+    const ref = await finalizedLeasedRef2(api, commitment, size);
+    if (ref || poll >= REGISTRATION_WAIT_POLLS) return ref;
+    await new Promise((wake) => setTimeout(wake, REGISTRATION_POLL_MS));
+  }
+}
+function registeredHubRepo(mirrors) {
+  const repos = [...new Set(mirrors.filter((m) => m.kind === "huggingface").map((m) => m.repo))];
+  if (repos.length > 1) {
+    throw new Error(
+      `model advertises ${repos.length} Hugging Face mirrors (${repos.join(", ")}); name the one to back up with --source`
+    );
+  }
+  return repos[0];
+}
+function modelBackupCmd() {
+  return new Command33("backup").description(
+    "Stream a registered content-v1 checkpoint from Hugging Face into validator DA under this box's DA key, without ever writing the packed image out, and print the DataRefs its publisher then binds"
+  ).argument("<model_hash>", "Registered model hash (0x-hex)").requiredOption("--model-dir <path>", "Directory the checkpoint streams into (needs room for it)").option("--source <hf-id>", "Hugging Face id (owner/model or hf:owner/model); the model's registered mirror when omitted").option("--revision <sha>", "Immutable 40-hex commit; main is resolved to one when omitted").addOption(new Option3("--precision <precision>", "Measured-root precision").choices(PRECISIONS3).default("FP16")).option("--da-validator <path>", "da-validator executable", "da-validator").option("--token <token>", "Hugging Face bearer token (prefer HF_TOKEN)").option("--state-dir <path>", "Download resume receipts (outside the checkpoint tree)").option("--dry-run", "Print the plan and the DA deposit it would lock, and stop before any transfer").option("--json", "Output as JSON").action(async (modelHash, opts, command) => {
+    let client;
+    let workDir;
+    try {
+      if (opts.revision && !/^[0-9a-f]{40}$/.test(opts.revision)) throw new Error("--revision must be an immutable 40-hex commit");
+      const sdk = await import("@flop-labs/sdk");
+      const rpc = getRpc(command);
+      const precision = opts.precision;
+      client = await createClient(rpc, getSigner(command));
+      const api = client.api;
+      const registered = await new sdk.OnChainModelRegistry(api).getModel(modelHash);
+      if (!registered) throw new Error(`model not found: ${modelHash}`);
+      const expected = await sdk.readMeasuredRoot(api, modelHash, precision);
+      if (!expected) throw new Error(`no measured root for ${modelHash} at ${opts.precision}`);
+      const hub = { revision: opts.revision, token: opts.token ?? process.env.HF_TOKEN };
+      const repo = opts.source ? opts.source.startsWith("hf:") ? opts.source.slice(3) : opts.source : registeredHubRepo(await sdk.readModelMirrors(api, modelHash));
+      if (!repo) {
+        throw new Error(
+          `model ${modelHash} advertises no Hugging Face mirror; pass --source <owner/model>, or back it up from disk with \`flop model upload --model-hash <hash> --path <dir>\``
+        );
+      }
+      const preflight = await sdk.preflightHuggingFace(repo, hub);
+      if (sdk.normalizeRoot(preflight.contentRoot) !== sdk.normalizeRoot(expected)) {
+        throw new Error(
+          `${repo} at ${preflight.revision} has content_root 0x${preflight.contentRoot}, not the registered root ${expected}. A verity-v1 model's root cannot be checked from hub metadata, and a repo that moved needs the registered --revision; back such a model up from disk with \`flop model upload --model-hash ${modelHash} --path <dir>\``
+        );
+      }
+      const imageSize = sdk.packedImageSize(preflight.files);
+      if (imageSize !== preflight.imageSize) throw new Error("packed image size disagrees with the preflight table");
+      const tableBytes = sdk.encodeModelFileTable("0".repeat(64), preflight.files).length;
+      const deposit = await sdk.da.leaseDeposit(api, imageSize + tableBytes);
+      const plan = {
+        model_hash: modelHash,
+        precision: opts.precision,
+        repo,
+        revision: preflight.revision,
+        content_root: `0x${preflight.contentRoot}`,
+        scheme: "content-v1",
+        files: preflight.files.length,
+        image_size: imageSize,
+        da_chunks: preflight.daChunks,
+        da_deposit_plancks: deposit.toString(),
+        publisher: client.signer.address
+      };
+      if (opts.dryRun) {
+        print({ ...plan, dry_run: true, next: "rerun without --dry-run to transfer and register" }, getJson(command));
+        return;
+      }
+      const publisherKey = await sr25519KeyHex(getSigner(command));
+      const modelDir = resolve9(opts.modelDir);
+      workDir = join8(resolve9(modelDir, ".."), `.flop-backup-${modelHash.replace(/^0x/, "").slice(0, 16)}`);
+      await mkdir12(workDir, { recursive: true, mode: 448 });
+      await mkdir12(modelDir, { recursive: true });
+      const resumeState = opts.stateDir ? join8(resolve9(opts.stateDir), "download.json") : void 0;
+      if (resumeState) await mkdir12(resolve9(opts.stateDir), { recursive: true, mode: 448 });
+      process.stderr.write(
+        `backing up ${repo}@${preflight.revision} (${preflight.files.length} files, image ${imageSize} bytes, ${preflight.daChunks} DA chunk(s)) as ${modelHash}
+`
+      );
+      await sdk.fetchHuggingFaceToDir(repo, modelDir, {
+        ...hub,
+        revision: preflight.revision,
+        files: preflight.files,
+        resumeState
+      });
+      const manifestFile = join8(workDir, "layout.bin");
+      const image = {
+        sizeBytes: imageSize,
+        manifestFile,
+        open: () => sdk.packedImageStream(modelDir, preflight.files)
+      };
+      const imageLayout = await daCommitStream(opts.daValidator, image);
+      if (imageLayout.sizeBytes !== imageSize) throw new Error("streamed DA commitment covers the wrong image size");
+      const tablePath = join8(workDir, "files.json");
+      await writeFile10(tablePath, sdk.encodeModelFileTable(imageLayout.commitment, preflight.files), { mode: 384 });
+      const tableLayout = await daCommit(opts.daValidator, tablePath);
+      const refs = [];
+      for (const blob of [
+        { commitment: imageLayout.commitment, sizeBytes: imageLayout.sizeBytes, stream: image },
+        { commitment: tableLayout.commitment, sizeBytes: tableLayout.sizeBytes, stream: void 0 }
+      ]) {
+        let ref = await finalizedLeasedRef2(api, blob.commitment, blob.sizeBytes);
+        let registerTx;
+        if (!ref) {
+          const reg = await sdk.da.registerBlob(api, client.signer, {
+            commitment: blob.commitment,
+            sizeBytes: blob.sizeBytes
+          });
+          registerTx = reg.txHash;
+          ref = await awaitFinalizedLeasedRef(api, blob.commitment, blob.sizeBytes);
+        }
+        if (!ref) {
+          throw new Error(
+            `DA registration for ${blob.commitment} did not finalize within ${REGISTRATION_WAIT_POLLS * REGISTRATION_POLL_MS / 1e3}s; rerun the same command once it has`
+          );
+        }
+        const mine = sameAccount(ref.publisher, client.signer.address);
+        const custody = blob.stream ? await submitDaBlobStream(opts.daValidator, rpc, blob.stream, mine ? publisherKey : void 0) : await submitDaBlob(opts.daValidator, rpc, tablePath, mine ? publisherKey : void 0);
+        process.stderr.write(`${custodySummary(custody)}
+`);
+        refs.push({ ref, custody, registerTx });
+      }
+      const [weights, table2] = refs;
+      print({
+        ...plan,
+        weights_ref: weights.ref.commitment,
+        weights_register_tx: weights.registerTx,
+        weights_custody_shards: weights.custody.confirmedShards,
+        table_ref: table2.ref.commitment,
+        table_register_tx: table2.registerTx,
+        // The binding is the model publisher's own transaction: this box holds no
+        // model-registry authority, and `set_model_weights_ref` takes any Leased ref from it.
+        next: `the model publisher binds the backup with \`flop model upload --model-hash ${modelHash} --commitment ${weights.ref.commitment} --size ${imageSize}\`, then advertises the file table as a da:${table2.ref.commitment} mirror with \`modelRegistry.setModelMirrors\``,
+        recovery: `flop da withdraw --commitment ${weights.ref.commitment} (and ${table2.ref.commitment}) refunds both deposits while nothing pins them`
+      }, getJson(command));
+    } catch (error) {
+      commandError(error, {
+        next: "rerun the same command to resume the download and the DA push; to abandon a registered blob, run the printed `flop da withdraw` recovery"
+      });
+    } finally {
+      if (workDir) await rm4(workDir, { recursive: true, force: true });
+      await client?.disconnect();
+    }
+  });
+}
+
 // src/commands/model-list.ts
-import { Command as Command33 } from "commander";
+import { Command as Command34 } from "commander";
 function modelListCmd() {
-  return new Command33("list").description("List models registered on the selected FLOP chain").option("--name <text>", "Filter model names").option("--limit <n>", "Maximum rows returned", "100").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command34("list").description("List models registered on the selected FLOP chain").option("--name <text>", "Filter model names").option("--limit <n>", "Maximum rows returned", "100").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       const sdk = await import("@flop-labs/sdk");
@@ -9517,15 +9743,15 @@ function modelListCmd() {
 }
 
 // src/commands/model-get.ts
-import { Command as Command34 } from "commander";
+import { Command as Command35 } from "commander";
 function modelGetCmd() {
-  return new Command34("get").description("Get a registered model by hash or exact name").argument("<identifier>", "Model hash or name").option("--precision <precision>", "Measured-root precision", "FP16").option("--json", "Output as JSON").action(async (identifier, opts, command) => {
+  return new Command35("get").description("Get a registered model by hash or exact name").argument("<identifier>", "Model hash or name").option("--precision <precision>", "Measured-root precision", "FP16").option("--json", "Output as JSON").action(async (identifier, opts, command) => {
     let client;
     try {
       const sdk = await import("@flop-labs/sdk");
       client = await createClient(getRpc(command));
       const registry = new sdk.OnChainModelRegistry(client.api);
-      const model = await registry.getModel(identifier) ?? await registry.getModelByName(identifier);
+      const model = /^0x[0-9a-f]{64}$/i.test(identifier) ? await registry.getModel(identifier) : await registry.getModelByName(identifier);
       if (!model) throw new Error(`model not found: ${identifier}`);
       const precision = opts.precision;
       const [measuredRoot, sources] = await Promise.all([
@@ -9550,16 +9776,16 @@ function modelGetCmd() {
 }
 
 // src/commands/model-fetch.ts
-import { Command as Command35, Option as Option3 } from "commander";
-var PRECISIONS3 = ["FP32", "FP16", "BF16", "INT8", "INT4", "Mixed"];
+import { Command as Command36, Option as Option4 } from "commander";
+var PRECISIONS4 = ["FP32", "FP16", "BF16", "INT8", "INT4", "Mixed"];
 function modelFetchCmd() {
-  return new Command35("fetch").description("Fetch model weights and accept only a registered dm-verity root").argument("<identifier>", "Registered model hash or exact name").addOption(new Option3("--precision <precision>", "Weights precision").choices(PRECISIONS3).default("FP16")).option("--source <source...>", "Override mirrors: hf:<repo>, modelscope:<repo>, https://..., da:<commitment>").option("--da-endpoint <url>", "DA blob gateway exposing GET /blob/<commitment>").option("--output-dir <path>", "Destination directory", "./flop-model").option("--token <token>", "HF/ModelScope bearer token (prefer HF_TOKEN)").option("--json", "Output as JSON").action(async (identifier, opts, command) => {
+  return new Command36("fetch").description("Fetch model weights and accept only a registered dm-verity root").argument("<identifier>", "Registered model hash or exact name").addOption(new Option4("--precision <precision>", "Weights precision").choices(PRECISIONS4).default("FP16")).option("--source <source...>", "Override mirrors: hf:<repo>, modelscope:<repo>, https://..., da:<commitment>").option("--da-endpoint <url>", "DA blob gateway exposing GET /blob/<commitment>").option("--output-dir <path>", "Destination directory", "./flop-model").option("--token <token>", "HF/ModelScope bearer token (prefer HF_TOKEN)").option("--json", "Output as JSON").action(async (identifier, opts, command) => {
     let client;
     try {
       const sdk = await import("@flop-labs/sdk");
       client = await createClient(getRpc(command));
       const registry = new sdk.OnChainModelRegistry(client.api);
-      const model = await registry.getModel(identifier) ?? await registry.getModelByName(identifier);
+      const model = /^0x[0-9a-f]{64}$/i.test(identifier) ? await registry.getModel(identifier) : await registry.getModelByName(identifier);
       if (!model) throw new Error(`model not found: ${identifier}`);
       const expected = await sdk.readMeasuredRoot(client.api, model.hash, opts.precision);
       if (!expected) {
@@ -9616,7 +9842,7 @@ function modelFetchCmd() {
 
 // src/commands/agent.ts
 import path2 from "node:path";
-import { Command as Command36, Option as Option4 } from "commander";
+import { Command as Command37, Option as Option5 } from "commander";
 import { getFlopNetworkProfile as getFlopNetworkProfile3 } from "@flop-labs/sdk";
 var DEFAULT_MCP_URL = "https://mcp.flop.network/mcp";
 var DEVNET_MCP_URL = "https://mcp.flop.network/mcp";
@@ -9704,14 +9930,14 @@ function buildAgentInitPlan(client, mode, mcpUrl2 = DEFAULT_MCP_URL) {
   };
 }
 function agentInitCmd() {
-  return new Command36("init").description("Print a safe agent onboarding plan and MCP configuration").addOption(new Option4("--client <client>", "Agent client").choices([
+  return new Command37("init").description("Print a safe agent onboarding plan and MCP configuration").addOption(new Option5("--client <client>", "Agent client").choices([
     "claude-code",
     "codex",
     "cursor",
     "windsurf",
     "zed",
     "generic"
-  ]).default("generic")).addOption(new Option4("--mode <mode>", "MCP mode").choices(["remote", "local"]).default("remote")).option("--mcp-url <url>", "Hosted MCP URL").option("--json", "Output as JSON").action((opts, command) => {
+  ]).default("generic")).addOption(new Option5("--mode <mode>", "MCP mode").choices(["remote", "local"]).default("remote")).option("--mcp-url <url>", "Hosted MCP URL").option("--json", "Output as JSON").action((opts, command) => {
     const plan = buildAgentInitPlan(opts.client, opts.mode, mcpUrl(command, opts.mcpUrl));
     const output = getOutputMode(command);
     printRolePlan(plan, output);
@@ -9722,7 +9948,7 @@ function agentInitCmd() {
   });
 }
 function agentDoctorCmd() {
-  return new Command36("doctor").description("Check agent MCP, gateway, and optional chain connectivity").addOption(new Option4("--mode <mode>", "MCP mode").choices(["remote", "local"]).default("remote")).option("--mcp-url <url>", "MCP URL").option("--gateway <url>", "Optional OpenAI-compatible gateway URL").option("--repo <path>", "flop-core checkout for local mode", process.cwd()).option("--check-rpc", "Also require the configured chain RPC").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command37("doctor").description("Check agent MCP, gateway, and optional chain connectivity").addOption(new Option5("--mode <mode>", "MCP mode").choices(["remote", "local"]).default("remote")).option("--mcp-url <url>", "MCP URL").option("--gateway <url>", "Optional OpenAI-compatible gateway URL").option("--repo <path>", "flop-core checkout for local mode", process.cwd()).option("--check-rpc", "Also require the configured chain RPC").option("--json", "Output as JSON").action(async (opts, command) => {
     try {
       const checks = [executableCheck("node")];
       if (opts.mode === "remote") {
@@ -9749,7 +9975,7 @@ function agentDoctorCmd() {
   });
 }
 function agentCredentialCmd() {
-  return new Command36("credential").description("Provision or reuse a devnet gateway key for agent clients (wallet-signed by default)").option("--print-key", "Print only the bearer key for a local client auth helper").option("--tailnet", "Enroll through the private tailnet lane (approved Tailscale users only)").option("--json", "Output non-secret credential metadata as JSON").action(async (opts, command) => {
+  return new Command37("credential").description("Provision or reuse a devnet gateway key for agent clients (wallet-signed by default)").option("--print-key", "Print only the bearer key for a local client auth helper").option("--tailnet", "Enroll through the private tailnet lane (approved Tailscale users only)").option("--json", "Output non-secret credential metadata as JSON").action(async (opts, command) => {
     try {
       if (getNetwork(command) !== "devnet") {
         throw new Error("agent credential requires --network devnet");
@@ -9782,20 +10008,20 @@ function agentCredentialCmd() {
   });
 }
 function agentCmd() {
-  const command = new Command36("agent").description("Onboard and operate FLOP-backed agents");
+  const command = new Command37("agent").description("Onboard and operate FLOP-backed agents");
   command.addCommand(agentInitCmd());
   command.addCommand(agentDoctorCmd());
   command.addCommand(agentCredentialCmd());
   command.addCommand(launchCmd());
   command.addCommand(proxyCmd());
   command.addCommand(hermesCmd());
-  const keys = new Command36("keys").description("Manage agent keys");
+  const keys = new Command37("keys").description("Manage agent keys");
   keys.addCommand(keysGenerateCmd());
   command.addCommand(keys);
-  const wallet = new Command36("wallet").description("Manage agent wallets");
+  const wallet = new Command37("wallet").description("Manage agent wallets");
   wallet.addCommand(walletAgentCreateCmd());
   command.addCommand(wallet);
-  const session = new Command36("session").description("Manage agent session keys");
+  const session = new Command37("session").description("Manage agent session keys");
   session.addCommand(sessionCreateCmd());
   session.addCommand(sessionInfoCmd());
   session.addCommand(sessionRevokeCmd());
@@ -9807,7 +10033,7 @@ function agentCmd() {
 // src/commands/miner.ts
 import { readFileSync } from "node:fs";
 import path3 from "node:path";
-import { Command as Command37, Option as Option5 } from "commander";
+import { Command as Command38, Option as Option6 } from "commander";
 import { formatFlop as formatFlop2 } from "@flop-labs/sdk";
 
 // src/gpu-inventory-remark.ts
@@ -9968,6 +10194,12 @@ function buildMinerInitPlan(options) {
     summary: mode === "tdx" ? "Prepare the measured TDX guest, attest it, then activate the on-chain miner separately." : mode === "cloud" ? "Provision a non-attested inference backend, then connect miner-worker explicitly." : "Start a local measured-manifest simulation before using real stake or hardware.",
     gpu_inventory: gpu,
     steps: [
+      {
+        phase: "devnet host",
+        command: "sudo ./install.sh <machine-name>",
+        purpose: "On an Ubuntu 24.04 GPU host, use the operator-issued pack and https://flop.network/skills/flop-miner-devnet/SKILL.md. The pack pins the registered model; the following generic steps apply to other setups.",
+        mutates: true
+      },
       {
         phase: "inventory",
         command: "flop gpu --json",
@@ -10019,12 +10251,12 @@ function buildMinerInitPlan(options) {
   };
 }
 function minerInitCmd() {
-  return new Command37("init").description("Print a phased miner onboarding plan").addOption(new Option5("--mode <mode>", "Miner mode").choices(["sim", "tdx", "cloud"]).default("sim")).option("--instance <number>", "Local guest instance number", "0").option("--provider <name>", "Cloud provider", "runpod").option(
+  return new Command38("init").description("Print a phased miner onboarding plan").addOption(new Option6("--mode <mode>", "Miner mode").choices(["sim", "tdx", "cloud"]).default("sim")).option("--instance <number>", "Local guest instance number", "0").option("--provider <name>", "Cloud provider", "runpod").option(
     "--gpu <SKU[:COUNT]>",
     "Expected GPU inventory; repeat for mixed-SKU hosts",
     collectGpu,
     []
-  ).option("--model <id>", "Inference model", "Qwen/Qwen2.5-7B-Instruct").option("--json", "Output as JSON").action((opts, command) => {
+  ).option("--model <id>", "Inference model", "Qwen/Qwen2.5-0.5B-Instruct").option("--json", "Output as JSON").action((opts, command) => {
     const instance = Number(opts.instance);
     if (!Number.isInteger(instance) || instance < 0) {
       commandError(new Error("--instance must be a non-negative integer"));
@@ -10062,7 +10294,7 @@ async function gpuCheck(mode) {
   }
 }
 function minerDoctorCmd() {
-  return new Command37("doctor").description("Check miner runtime, hardware, chain, and serving prerequisites").addOption(new Option5("--mode <mode>", "Miner mode").choices(["sim", "tdx", "cloud"]).default("sim")).option("--repo <path>", "flop-core checkout", process.cwd()).option("--session-url <url>", "Optional miner session info URL").option("--offline", "Skip chain RPC check").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command38("doctor").description("Check miner runtime, hardware, chain, and serving prerequisites").addOption(new Option6("--mode <mode>", "Miner mode").choices(["sim", "tdx", "cloud"]).default("sim")).option("--repo <path>", "flop-core checkout", process.cwd()).option("--session-url <url>", "Optional miner session info URL").option("--offline", "Skip chain RPC check").option("--json", "Output as JSON").action(async (opts, command) => {
     try {
       const checks = [];
       if (opts.mode === "cloud") {
@@ -10099,7 +10331,7 @@ function minerDoctorCmd() {
   });
 }
 function minerStatusCmd() {
-  return new Command37("status").description("Show miner registration, calibration, and optional session status").argument("[address]", "Miner SS58 address; defaults to the configured signer").option("--session-url <url>", "Optional miner session info URL").option(
+  return new Command38("status").description("Show miner registration, calibration, and optional session status").argument("[address]", "Miner SS58 address; defaults to the configured signer").option("--session-url <url>", "Optional miner session info URL").option(
     "--expect-gpu <SKU[:COUNT]>",
     "Expected inventory; repeat to check attested state",
     collectGpu,
@@ -10149,7 +10381,7 @@ function minerStatusCmd() {
   });
 }
 function minerSkusCmd() {
-  return new Command37("skus").description("List GPU SKUs with active governance calibration ceilings").option("--json", "Output as JSON").action(async (_opts, command) => {
+  return new Command38("skus").description("List GPU SKUs with active governance calibration ceilings").option("--json", "Output as JSON").action(async (_opts, command) => {
     let client;
     try {
       const rpc = getRpc(command);
@@ -10173,7 +10405,7 @@ function minerSkusCmd() {
   });
 }
 function minerRegisterCmd() {
-  return new Command37("register").description("Register the signer as a miner and lock the runtime-defined self-stake").option("--commission <percent>", "Commission percent (0-20)", "10").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command38("register").description("Register the signer as a miner and lock the runtime-defined self-stake").option("--commission <percent>", "Commission percent (0-20)", "10").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       const commission = Number(opts.commission);
@@ -10200,7 +10432,7 @@ function minerRegisterCmd() {
   });
 }
 function minerDeclareGpuCmd() {
-  return new Command37("declare-gpu").description("Publish the signer's self-reported GPU inventory as a flop.gpu-inventory.v1 remark (display-only)").option("--nvidia-smi <path>", "Output of `nvidia-smi --query-gpu=name,memory.total --format=csv,noheader,nounits` (- for stdin)").option("--detect", "Run nvidia-smi here (on the GPU host)").option("--retract", "Publish an empty inventory, withdrawing an earlier declaration").option("--dry-run", "Print the remark without signing").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command38("declare-gpu").description("Publish the signer's self-reported GPU inventory as a flop.gpu-inventory.v1 remark (display-only)").option("--nvidia-smi <path>", "Output of `nvidia-smi --query-gpu=name,memory.total --format=csv,noheader,nounits` (- for stdin)").option("--detect", "Run nvidia-smi here (on the GPU host)").option("--retract", "Publish an empty inventory, withdrawing an earlier declaration").option("--dry-run", "Print the remark without signing").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       if ([opts.nvidiaSmi, opts.detect, opts.retract].filter(Boolean).length !== 1) {
@@ -10236,7 +10468,7 @@ function minerDeclareGpuCmd() {
   });
 }
 function minerCmd() {
-  const command = new Command37("miner").description("Onboard and operate inference miners");
+  const command = new Command38("miner").description("Onboard and operate inference miners");
   command.addCommand(minerInitCmd());
   command.addCommand(minerDoctorCmd());
   command.addCommand(minerStatusCmd());
@@ -10249,7 +10481,7 @@ function minerCmd() {
 
 // src/commands/validator.ts
 import path4 from "node:path";
-import { Command as Command38, Option as Option6 } from "commander";
+import { Command as Command39, Option as Option7 } from "commander";
 import { formatFlop as formatFlop3 } from "@flop-labs/sdk";
 function buildValidatorInitPlan(mode, minimumStake) {
   const bringUp = mode === "local" ? "just run-node" : "infra/vultr/create-vm.sh <args>; infra/vultr/deploy-core.sh --vm-ip <TAILSCALE-IP>";
@@ -10299,11 +10531,11 @@ function buildValidatorInitPlan(mode, minimumStake) {
   };
 }
 function validatorInitCmd() {
-  return new Command38("init").description("Print a validator onboarding plan with the live minimum stake").addOption(new Option6("--mode <mode>", "Validator deployment mode").choices(["local", "vultr"]).default("local")).option("--offline", "Do not query the configured chain").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command39("init").description("Print a validator onboarding plan with the live minimum stake").addOption(new Option7("--mode <mode>", "Validator deployment mode").choices(["local", "vultr"]).default("local")).option("--offline", "Do not query the configured chain").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       let minimumStake;
-      if (!opts.offline) {
+      if (!getCommandOption(command, "offline", false)) {
         const rpc = getRpc(command);
         client = await createClient(rpc);
         const { getMinimumStake } = await import("@flop-labs/sdk");
@@ -10318,7 +10550,7 @@ function validatorInitCmd() {
   });
 }
 function validatorDoctorCmd() {
-  return new Command38("doctor").description("Check validator node and on-chain eligibility prerequisites").addOption(new Option6("--mode <mode>", "Validator deployment mode").choices(["local", "vultr"]).default("local")).option("--repo <path>", "flop-core checkout", process.cwd()).option("--offline", "Skip chain and account checks").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command39("doctor").description("Check validator node and on-chain eligibility prerequisites").addOption(new Option7("--mode <mode>", "Validator deployment mode").choices(["local", "vultr"]).default("local")).option("--repo <path>", "flop-core checkout", process.cwd()).option("--offline", "Skip chain and account checks").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       const checks = [
@@ -10389,7 +10621,7 @@ function validatorDoctorCmd() {
   });
 }
 function validatorStatusCmd() {
-  return new Command38("status").description("Show validator stake, jail, performance, and verified-work state").argument("[address]", "Validator SS58 address; defaults to the configured signer").option("--json", "Output as JSON").action(async (address, opts, command) => {
+  return new Command39("status").description("Show validator stake, jail, performance, and verified-work state").argument("[address]", "Validator SS58 address; defaults to the configured signer").option("--json", "Output as JSON").action(async (address, opts, command) => {
     let client;
     try {
       const rpc = getRpc(command);
@@ -10434,7 +10666,7 @@ function validatorStatusCmd() {
   });
 }
 function validatorRegisterCmd() {
-  return new Command38("register").description("Register the signer as a validator, bonding the effective minimum").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command39("register").description("Register the signer as a validator, bonding the effective minimum").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       const rpc = getRpc(command);
@@ -10464,7 +10696,7 @@ function validatorRegisterCmd() {
   });
 }
 function validatorCommissionCmd() {
-  return new Command38("commission").description("Set validator commission").argument("<percent>", "Commission percent (0-100)").option("--json", "Output as JSON").action(async (percent, opts, command) => {
+  return new Command39("commission").description("Set validator commission").argument("<percent>", "Commission percent (0-100)").option("--json", "Output as JSON").action(async (percent, opts, command) => {
     let client;
     try {
       const value = Number(percent);
@@ -10484,7 +10716,7 @@ function validatorCommissionCmd() {
   });
 }
 function validatorLifecycleCmd(name, description, sdkMethod) {
-  return new Command38(name).description(description).option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command39(name).description(description).option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       const rpc = getRpc(command);
@@ -10500,7 +10732,7 @@ function validatorLifecycleCmd(name, description, sdkMethod) {
   });
 }
 function validatorCmd() {
-  const command = new Command38("validator").description("Onboard and operate validator nodes");
+  const command = new Command39("validator").description("Onboard and operate validator nodes");
   command.addCommand(validatorInitCmd());
   command.addCommand(validatorDoctorCmd());
   command.addCommand(validatorStatusCmd());
@@ -10513,13 +10745,12 @@ function validatorCmd() {
 }
 
 // src/commands/network-status.ts
-import { Command as Command39 } from "commander";
+import { Command as Command40 } from "commander";
 
 // src/network.ts
 async function probeRpcChain(network, rpc) {
-  const { ApiPromise: ApiPromise2, HttpProvider: HttpProvider2, WsProvider: WsProvider2 } = await import("@polkadot/api");
-  const provider = rpc.startsWith("ws") ? new WsProvider2(rpc) : new HttpProvider2(rpc);
-  const api = await ApiPromise2.create({ provider, noInitWarn: true });
+  const { connectFlopApi } = await import("@flop-labs/sdk");
+  const api = await connectFlopApi(rpc);
   try {
     const chain = (await api.rpc.system.chain()).toString();
     return {
@@ -10539,9 +10770,16 @@ async function probeRpcChain(network, rpc) {
 // src/commands/network-status.ts
 function networkStatusCmd(probeRpc2 = probeRpcChain, probeFaucet = async (endpoint) => {
   const { getFaucetChainInfo } = await import("@flop-labs/sdk");
-  return getFaucetChainInfo({ endpoint });
+  const identity = await getFaucetChainInfo({ endpoint });
+  try {
+    const response = await fetch(`${endpoint.replace(/\/$/, "")}/health`, { signal: AbortSignal.timeout(15e3) });
+    const health = await response.json();
+    return { ...identity, ready: typeof health.ready === "boolean" ? health.ready : null, dependencies: health.dependencies };
+  } catch (error) {
+    return { ...identity, ready: null, readinessError: error instanceof Error ? error.message : String(error) };
+  }
 }) {
-  return new Command39("status").description("Show resolved network endpoints and live chain identity").option("--offline", "Resolve configured endpoints without connecting").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command40("status").description("Show resolved network endpoints and live chain identity").option("--offline", "Resolve configured endpoints without connecting").option("--json", "Output as JSON").action(async (opts, command) => {
     const resolved = resolveNetwork(command);
     let rpcInfo = null;
     let rpcError;
@@ -10582,6 +10820,9 @@ function networkStatusCmd(probeRpc2 = probeRpcChain, probeFaucet = async (endpoi
       faucet: resolved.profile.faucet ? {
         url: resolved.profile.faucet,
         reachable: opts.offline ? null : faucetInfo !== null,
+        ready: faucetInfo?.ready ?? null,
+        dependencies: faucetInfo?.dependencies,
+        readiness_error: faucetInfo?.readinessError,
         network: faucetInfo?.network,
         genesis_hash: faucetInfo?.genesisHash,
         matches_rpc: rpcInfo && faucetInfo ? rpcInfo.genesisHash.toLowerCase() === faucetInfo.genesisHash.toLowerCase() : null,
@@ -10592,9 +10833,9 @@ function networkStatusCmd(probeRpc2 = probeRpcChain, probeFaucet = async (endpoi
 }
 
 // src/commands/faucet-request.ts
-import { Command as Command40 } from "commander";
+import { Command as Command41 } from "commander";
 function faucetRequestCmd(probeRpc2 = probeRpcChain) {
-  return new Command40("request").description("Request dev/test FLOP after verifying faucet and RPC chain identity").argument("<address>", "SS58 address to fund").option("--amount <flop>", "Requested FLOP amount; server policy may cap it").option("--endpoint <url>", "Explicit faucet endpoint override").option("--json", "Output as JSON").action(async (address, opts, command) => {
+  return new Command41("request").description("Request dev/test FLOP after verifying faucet and RPC chain identity").argument("<address>", "SS58 address to fund").option("--amount <flop>", "Requested FLOP amount; server policy may cap it").option("--endpoint <url>", "Explicit faucet endpoint override").option("--json", "Output as JSON").action(async (address, opts, command) => {
     try {
       const resolved = resolveNetwork(command);
       const endpoint = opts.endpoint ?? resolved.profile.faucet;
@@ -10647,15 +10888,15 @@ function faucetRequestCmd(probeRpc2 = probeRpcChain) {
 }
 
 // src/commands/chat.ts
-import { Command as Command41 } from "commander";
+import { Command as Command42 } from "commander";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { homedir as homedir4 } from "node:os";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
 
 // src/conversations.ts
-import { mkdir as mkdir12, readFile as readFile8, rename as rename8, writeFile as writeFile10 } from "node:fs/promises";
+import { mkdir as mkdir13, readFile as readFile8, rename as rename8, writeFile as writeFile11 } from "node:fs/promises";
 import { dirname as dirname6 } from "node:path";
 var MAX_CONVERSATIONS = 100;
 var MAX_CONVERSATION_MESSAGES = 100;
@@ -10675,9 +10916,9 @@ var ConversationStore = class {
     }
   }
   async write(data) {
-    await mkdir12(dirname6(this.path), { recursive: true, mode: 448 });
+    await mkdir13(dirname6(this.path), { recursive: true, mode: 448 });
     const temp = `${this.path}.${process.pid}.tmp`;
-    await writeFile10(temp, `${JSON.stringify(data, null, 2)}
+    await writeFile11(temp, `${JSON.stringify(data, null, 2)}
 `, { mode: 384 });
     await rename8(temp, this.path);
   }
@@ -10714,7 +10955,7 @@ function conversationPrompt(messages) {
 
 // src/commands/chat.ts
 function chatCmd() {
-  return new Command41("chat").description("Start or resume a persistent FLOP chat, optionally through a bounded session").argument("[prompt]", "One-shot prompt; omit for interactive chat").option("--conversation <id>", "Resume a conversation ID").option("--model <id>", "Registered model ID", "llama-3-70b-instruct").option("--session-owner <address>", "Use --signer as this owner's session delegate").option("--max-flop <n>", "Per-turn FLOP cap", "5").option("--skip-model-check", "Allow an unregistered model (local development only)").option("--history", "List stored conversations without connecting").option("--delete <id>", "Delete a stored conversation without connecting").option("--store <path>", "Conversation store path", join8(homedir4(), ".flop", "conversations.json")).option("--json", "Output as JSON").action(async (prompt, opts, command) => {
+  return new Command42("chat").description("Start or resume a persistent FLOP chat, optionally through a bounded session").argument("[prompt]", "One-shot prompt; omit for interactive chat").option("--conversation <id>", "Resume a conversation ID").option("--model <id>", "32-byte model hash or exact registered name from flop model list").option("--session-owner <address>", "Use --signer as this owner's session delegate").option("--max-flop <n>", "Per-turn FLOP cap", "5").option("--tee-requirements <hex>", "Registered HTLC appraisal commitments (100-byte SCALE hex)", process.env.FLOP_HTLC_TEE_REQUIREMENTS).option("--skip-model-check", "Allow an unregistered model (local development only)").option("--history", "List stored conversations without connecting").option("--delete <id>", "Delete a stored conversation without connecting").option("--store <path>", "Conversation store path", join9(homedir4(), ".flop", "conversations.json")).option("--json", "Output as JSON").action(async (prompt, opts, command) => {
     const store = new ConversationStore(opts.store);
     let agent;
     try {
@@ -10747,19 +10988,28 @@ function chatCmd() {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const conversation = existing ?? {
         id: randomUUID4(),
-        model: opts.model,
+        model: opts.model ?? "",
         sessionOwner: opts.sessionOwner,
         createdAt: now,
         updatedAt: now,
         messages: []
       };
-      if (!opts.skipModelCheck) {
+      if (!conversation.model) throw new Error("Supply --model with a hash or exact registered name from `flop model list`");
+      {
         const sdk = await import("@flop-labs/sdk");
         const check = await createClient(getRpc(command));
         try {
-          const registry = new sdk.OnChainModelRegistry(check.api);
-          const model = await registry.getModel(conversation.model) ?? await registry.getModelByName(conversation.model);
-          if (!model) throw new Error(`model not found: ${conversation.model}`);
+          if (!opts.skipModelCheck) {
+            const registry = new sdk.OnChainModelRegistry(check.api);
+            const model = /^0x[0-9a-f]{64}$/i.test(conversation.model) ? await registry.getModel(conversation.model) : await registry.getModelByName(conversation.model);
+            if (!model) throw new Error(`model not found: ${conversation.model}; use a hash or exact name from flop model list`);
+            conversation.model = model.hash;
+          }
+          if (!opts.teeRequirements) throw new Error("HTLC chat requires --tee-requirements from a registered EconomicCritical profile; check the network's attestation prerequisites before funding or signing");
+          if (/^0x[0-9a-f]{200}$/i.test(opts.teeRequirements) && /^0x[0-9a-f]{64}$/i.test(conversation.model) && opts.teeRequirements.slice(74, 138).toLowerCase() !== conversation.model.slice(2).toLowerCase()) {
+            throw new Error("HTLC model commitment must match the resolved --model hash");
+          }
+          await sdk.assertHtlcAppraisalProfile(check.api, opts.teeRequirements);
         } finally {
           await check.disconnect();
         }
@@ -10779,7 +11029,8 @@ function chatCmd() {
         conversation.messages.push({ role: "user", content: input, at: (/* @__PURE__ */ new Date()).toISOString() });
         const result = await agent.inference(conversationPrompt(conversation.messages), {
           model: conversation.model,
-          maxCost: maxFlop
+          maxCost: maxFlop,
+          teeRequirements: { appraisal: opts.teeRequirements }
         });
         conversation.messages.push({
           role: "assistant",
@@ -10829,8 +11080,8 @@ function chatCmd() {
 }
 
 // src/commands/tx-build.ts
-import { Command as Command42 } from "commander";
-import { writeFile as writeFile11 } from "node:fs/promises";
+import { Command as Command43 } from "commander";
+import { writeFile as writeFile12 } from "node:fs/promises";
 import { execFile as execFile5 } from "node:child_process";
 import { promisify as promisify5 } from "node:util";
 
@@ -10896,7 +11147,7 @@ function assertEnvelopeChain(api, envelope) {
 
 // src/commands/tx-build.ts
 function txBuildCmd() {
-  return new Command42("build").description("Build an immortal unsigned transaction envelope for air-gapped signing").requiredOption("--address <address>", "Signing account").requiredOption("--call <hex>", "SCALE call hex").option("--out <path>", "Write envelope JSON").option("--qr", "Render the signing payload using installed qrencode").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command43("build").description("Build an immortal unsigned transaction envelope for air-gapped signing").requiredOption("--address <address>", "Signing account").requiredOption("--call <hex>", "SCALE call hex").option("--out <path>", "Write envelope JSON").option("--qr", "Render the signing payload using installed qrencode").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       const resolved = resolveNetwork(command);
@@ -10909,7 +11160,7 @@ function txBuildCmd() {
         opts.call
       );
       if (opts.out) {
-        await writeFile11(opts.out, `${JSON.stringify(envelope, null, 2)}
+        await writeFile12(opts.out, `${JSON.stringify(envelope, null, 2)}
 `, { mode: 384 });
       }
       if (opts.qr) {
@@ -10941,10 +11192,10 @@ function txBuildCmd() {
 }
 
 // src/commands/tx-broadcast.ts
-import { Command as Command43 } from "commander";
+import { Command as Command44 } from "commander";
 import { readFile as readFile9 } from "node:fs/promises";
 function txBroadcastCmd() {
-  return new Command43("broadcast").description("Import an offline signature, reject chain drift, and broadcast").argument("<envelope>", "Unsigned envelope JSON").requiredOption("--signature <hex>", "SCALE MultiSignature from the offline signer").option("--allow-nonce-drift", "Broadcast even if account nonce has changed").option("--json", "Output as JSON").action(async (path5, opts, command) => {
+  return new Command44("broadcast").description("Import an offline signature, reject chain drift, and broadcast").argument("<envelope>", "Unsigned envelope JSON").requiredOption("--signature <hex>", "SCALE MultiSignature from the offline signer").option("--allow-nonce-drift", "Broadcast even if account nonce has changed").option("--json", "Output as JSON").action(async (path5, opts, command) => {
     let client;
     try {
       if (!/^0x[0-9a-f]+$/i.test(opts.signature)) throw new Error("--signature must be 0x hex");
@@ -10980,7 +11231,7 @@ function txBroadcastCmd() {
 }
 
 // src/commands/multisig.ts
-import { Command as Command44 } from "commander";
+import { Command as Command45 } from "commander";
 import { createKeyMulti, encodeAddress, sortAddresses } from "@polkadot/util-crypto";
 import { blake2AsHex } from "@polkadot/util-crypto";
 function otherSignatories(signer, values) {
@@ -11001,8 +11252,8 @@ function timepoint(opts) {
   return { height: parsePositiveInt(opts.height, "--height"), index };
 }
 function multisigCmd() {
-  const command = new Command44("multisig").description("Participate in Substrate multisig transactions");
-  command.addCommand(new Command44("address").description("Derive the deterministic multisig address").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--signatory <address...>", "All signatory addresses").option("--json", "Output as JSON").action(async (opts, cmd) => {
+  const command = new Command45("multisig").description("Participate in Substrate multisig transactions");
+  command.addCommand(new Command45("address").description("Derive the deterministic multisig address").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--signatory <address...>", "All signatory addresses").option("--json", "Output as JSON").action(async (opts, cmd) => {
     try {
       const threshold = parsePositiveInt(opts.threshold, "--threshold");
       const sorted = sortAddresses(opts.signatory, 42);
@@ -11017,7 +11268,7 @@ function multisigCmd() {
       commandError(error);
     }
   }));
-  command.addCommand(new Command44("propose").description("Create or execute a multisig call").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--other <address...>", "Other signatories (exclude configured signer)").requiredOption("--call <hex>", "SCALE call hex").option("--max-ref-time <n>", "Maximum call refTime").option("--max-proof-size <n>", "Maximum call proofSize").option("--json", "Output as JSON").action(async (opts, cmd) => {
+  command.addCommand(new Command45("propose").description("Create or execute a multisig call").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--other <address...>", "Other signatories (exclude configured signer)").requiredOption("--call <hex>", "SCALE call hex").option("--max-ref-time <n>", "Maximum call refTime").option("--max-proof-size <n>", "Maximum call proofSize").option("--json", "Output as JSON").action(async (opts, cmd) => {
     let client;
     try {
       client = await createClient(getRpc(cmd), getSigner(cmd));
@@ -11040,7 +11291,7 @@ function multisigCmd() {
       await client?.disconnect();
     }
   }));
-  command.addCommand(new Command44("approve").description("Approve a pending multisig call hash").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--other <address...>", "Other signatories").requiredOption("--call-hash <hex>", "Pending call hash").requiredOption("--height <n>", "Timepoint block height").requiredOption("--index <n>", "Timepoint extrinsic index").option("--max-ref-time <n>", "Maximum call refTime").option("--max-proof-size <n>", "Maximum call proofSize").option("--json", "Output as JSON").action(async (opts, cmd) => {
+  command.addCommand(new Command45("approve").description("Approve a pending multisig call hash").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--other <address...>", "Other signatories").requiredOption("--call-hash <hex>", "Pending call hash").requiredOption("--height <n>", "Timepoint block height").requiredOption("--index <n>", "Timepoint extrinsic index").option("--max-ref-time <n>", "Maximum call refTime").option("--max-proof-size <n>", "Maximum call proofSize").option("--json", "Output as JSON").action(async (opts, cmd) => {
     let client;
     try {
       client = await createClient(getRpc(cmd), getSigner(cmd));
@@ -11059,7 +11310,7 @@ function multisigCmd() {
       await client?.disconnect();
     }
   }));
-  command.addCommand(new Command44("cancel").description("Cancel a pending multisig as its depositor").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--other <address...>", "Other signatories").requiredOption("--call-hash <hex>", "Pending call hash").requiredOption("--height <n>", "Timepoint block height").requiredOption("--index <n>", "Timepoint extrinsic index").option("--json", "Output as JSON").action(async (opts, cmd) => {
+  command.addCommand(new Command45("cancel").description("Cancel a pending multisig as its depositor").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--other <address...>", "Other signatories").requiredOption("--call-hash <hex>", "Pending call hash").requiredOption("--height <n>", "Timepoint block height").requiredOption("--index <n>", "Timepoint extrinsic index").option("--json", "Output as JSON").action(async (opts, cmd) => {
     let client;
     try {
       client = await createClient(getRpc(cmd), getSigner(cmd));
@@ -11076,7 +11327,7 @@ function multisigCmd() {
       await client?.disconnect();
     }
   }));
-  command.addCommand(new Command44("list").alias("status").description("List pending calls for a multisig account").requiredOption("--account <address>", "Multisig account").option("--json", "Output as JSON").action(async (opts, cmd) => {
+  command.addCommand(new Command45("list").alias("status").description("List pending calls for a multisig account").requiredOption("--account <address>", "Multisig account").option("--json", "Output as JSON").action(async (opts, cmd) => {
     let client;
     try {
       client = await createClient(getRpc(cmd));
@@ -11096,10 +11347,10 @@ function multisigCmd() {
 }
 
 // src/commands/channel.ts
-import { Command as Command45 } from "commander";
+import { Command as Command46 } from "commander";
 function channelCmd() {
-  const command = new Command45("channel").description("Inspect and finalize compute channels");
-  command.addCommand(new Command45("list").description("List on-chain compute channels").option("--agent <address>", "Filter by paying agent").option("--miner <address>", "Filter by serving miner").option("--include-closed", "Include terminal channels").option("--json", "Output as JSON").action(async (opts, cmd) => {
+  const command = new Command46("channel").description("Inspect and finalize compute channels");
+  command.addCommand(new Command46("list").description("List on-chain compute channels").option("--agent <address>", "Filter by paying agent").option("--miner <address>", "Filter by serving miner").option("--include-closed", "Include terminal channels").option("--json", "Output as JSON").action(async (opts, cmd) => {
     let client;
     try {
       client = await createClient(getRpc(cmd));
@@ -11127,7 +11378,7 @@ function channelCmd() {
       await client?.disconnect();
     }
   }));
-  command.addCommand(new Command45("finalize").description("Finalize a force-settled channel after its challenge window").argument("<channel-id>", "0x channel ID").option("--json", "Output as JSON").action(async (channelId, _opts, cmd) => {
+  command.addCommand(new Command46("finalize").description("Finalize a force-settled channel after its challenge window").argument("<channel-id>", "0x channel ID").option("--json", "Output as JSON").action(async (channelId, _opts, cmd) => {
     let client;
     try {
       client = await createClient(getRpc(cmd), getSigner(cmd));
@@ -11573,8 +11824,8 @@ function generateGatewayConfig(input) {
 }
 
 // src/commands/gateway-allowlist.ts
-import { Command as Command46 } from "commander";
-var PRECISIONS4 = ["FP32", "FP16", "BF16", "INT8", "INT4", "Mixed"];
+import { Command as Command47 } from "commander";
+var PRECISIONS5 = ["FP32", "FP16", "BF16", "INT8", "INT4", "Mixed"];
 function field(value, camel, snake) {
   return value?.[camel] ?? value?.[snake];
 }
@@ -11601,18 +11852,19 @@ function verificationStatus(model, modelJson) {
 }
 async function fetchMinerSessionInfo(endpoint, authToken, signal) {
   const infoUrl = `${endpoint.replace(/\/+$/, "")}/session/info`;
-  const anonymous = await fetch(infoUrl, { signal });
+  const anonymous = await fetch(infoUrl, { signal, redirect: "error" });
   await anonymous.body?.cancel();
   if (anonymous.status !== 401) throw new Error("miner /session/info does not enforce bearer authentication");
-  const response = await fetch(infoUrl, { headers: { Authorization: `Bearer ${authToken}` }, signal });
+  const response = await fetch(infoUrl, { redirect: "error", headers: { Authorization: `Bearer ${authToken}` }, signal });
   if (!response.ok) throw new Error(`miner /session/info returned HTTP ${response.status}`);
-  return await response.json();
+  const { computeChannel: computeChannel7 } = await import("@flop-labs/sdk");
+  return JSON.parse(await computeChannel7.readMinerResponse(response, 16 * 1024));
 }
-async function readChainSnapshot(api, miner) {
+async function readChainSnapshot(api, miner, pinnedHead) {
   const identity = miner.modelIdentity;
-  const precision = PRECISIONS4[identity.precision];
+  const precision = PRECISIONS5[identity.precision];
   if (!precision) throw new Error(`miner precision is invalid: ${identity.precision}`);
-  const finalizedHead = await api.rpc.chain.getFinalizedHead();
+  const finalizedHead = pinnedHead ?? await api.rpc.chain.getFinalizedHead();
   const at = await api.at(finalizedHead);
   const modelRegistry = at.query.modelRegistry;
   const hwCalibration = at.query.hwCalibration;
@@ -11661,7 +11913,7 @@ async function readChainSnapshot(api, miner) {
   };
 }
 function gatewayAllowlistCmd() {
-  return new Command46("allowlist").description("Generate gateway allowlist and model catalog from a live miner and chain").requiredOption("--miner <url>", "Authenticated miner base URL").requiredOption("--auth-token-env <name>", "Environment variable containing the miner bearer token").requiredOption("--attestation <path>", "Operator/provider deployment, catalog, and price evidence JSON").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command47("allowlist").description("Generate gateway allowlist and model catalog from a live miner and chain").requiredOption("--miner <url>", "Authenticated miner base URL").requiredOption("--auth-token-env <name>", "Environment variable containing the miner bearer token").requiredOption("--attestation <path>", "Operator/provider deployment, catalog, and price evidence JSON").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       const authToken = process.env[opts.authTokenEnv];
@@ -11687,9 +11939,9 @@ function gatewayAllowlistCmd() {
 }
 
 // src/commands/gateway-renew.ts
-import { open as open3, readFile as readFile11, rename as rename9, rm as rm4, writeFile as writeFile12 } from "node:fs/promises";
-import { createHash as createHash5 } from "node:crypto";
-import { request } from "node:http";
+import { open as open3, readFile as readFile11, rename as rename9, rm as rm5, writeFile as writeFile13 } from "node:fs/promises";
+import { createHash as createHash6 } from "node:crypto";
+import { request as request2 } from "node:http";
 import { setTimeout as delay } from "node:timers/promises";
 import { Keyring as Keyring5 } from "@polkadot/keyring";
 import { decodeAddress as decodeAddress2, randomAsU8a } from "@polkadot/util-crypto";
@@ -11885,8 +12137,284 @@ function qualificationSignedToolCalls(frames) {
   });
 }
 
+// ../gateway-core/src/miner-admissions.ts
+import { closeSync, fstatSync, openSync, readSync, statSync } from "node:fs";
+import { createHash as createHash5 } from "node:crypto";
+var MAX_ADMITTED_MINERS = 256;
+var MAX_FILE_BYTES = 512 * 1024;
+var HASH4 = /^0x[0-9a-f]{64}$/;
+var minerSlot = (miner) => `${miner.minerAddress}:${miner.modelIdentity.requestedSlug}`;
+var staticMinerSha256 = (miner) => createHash5("sha256").update(JSON.stringify(miner)).digest("hex");
+var sameModel = (a, b) => Object.keys(a.modelIdentity).every((key) => a.modelIdentity[key] === b.modelIdentity[key]);
+var MinerRouting = class {
+  constructor(statics, path5) {
+    this.statics = statics;
+    this.path = path5;
+  }
+  statics;
+  path;
+  stamp;
+  entries = [];
+  error;
+  revision = 0;
+  read(dynamic, now = Date.now()) {
+    if (this.path) {
+      let stamp;
+      try {
+        const stat = statSync(this.path);
+        stamp = `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`;
+      } catch {
+        stamp = "missing";
+      }
+      if (stamp !== this.stamp) {
+        this.stamp = stamp;
+        this.revision++;
+        this.entries = [];
+        this.error = void 0;
+        let fd;
+        try {
+          fd = openSync(this.path, "r");
+          const stat = fstatSync(fd);
+          if (!stat.isFile() || stat.size > MAX_FILE_BYTES) throw new Error();
+          const buffer = Buffer.alloc(MAX_FILE_BYTES + 1);
+          const size = readSync(fd, buffer, 0, buffer.length, 0);
+          if (size > MAX_FILE_BYTES) throw new Error();
+          const value = JSON.parse(buffer.subarray(0, size).toString("utf8"));
+          if (value.schema !== "flop-static-miner-handoffs/v1" || !Array.isArray(value.entries) || value.entries.length > MAX_ADMITTED_MINERS) throw new Error();
+          const slots2 = /* @__PURE__ */ new Set();
+          for (const entry of value.entries) {
+            if (!entry || typeof entry.minerAddress !== "string" || !entry.minerAddress || typeof entry.requestedSlug !== "string" || !entry.requestedSlug || !/^[0-9a-f]{64}$/.test(entry.staticSha256)) throw new Error();
+            const url = new URL(entry.endpoint);
+            if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) throw new Error();
+            const slot = `${entry.minerAddress}:${entry.requestedSlug}`;
+            if (slots2.has(slot)) throw new Error();
+            slots2.add(slot);
+          }
+          this.entries = value.entries;
+        } catch {
+          this.error = new Error("static miner handoffs file is missing or invalid; new routing is disabled");
+        } finally {
+          if (fd !== void 0) closeSync(fd);
+        }
+      }
+      if (this.error) throw this.error;
+    }
+    const handed = /* @__PURE__ */ new Map();
+    for (const entry of this.entries) {
+      const slot = `${entry.minerAddress}:${entry.requestedSlug}`;
+      const sources = this.statics.filter((miner) => minerSlot(miner) === slot);
+      const source = sources[0];
+      if (sources.length !== 1 || source.onDemand || source.admissionExpiresAt || staticMinerSha256(source) !== entry.staticSha256 || source.endpoint === entry.endpoint || !Number.isFinite(source.maxBudgetFlop) || source.maxBudgetFlop <= 0 || !Number.isSafeInteger(source.maxDurationBlocks) || source.maxDurationBlocks < 1) throw new Error("static miner handoff source differs; new routing is disabled");
+      const target = dynamic.find((miner) => minerSlot(miner) === slot && miner.endpoint === entry.endpoint && miner.enclaveKey === source.enclaveKey && sameModel(source, miner) && miner.channelSigned && !!miner.admissionExpiresAt && Date.parse(miner.admissionExpiresAt) > now);
+      handed.set(slot, target ? {
+        ...target,
+        maxBudgetFlop: Math.min(source.maxBudgetFlop, target.maxBudgetFlop),
+        maxDurationBlocks: Math.min(source.maxDurationBlocks, target.maxDurationBlocks)
+      } : void 0);
+    }
+    const slots = new Set(this.statics.map(minerSlot));
+    const selected = [];
+    for (const miner of this.statics) {
+      if (!handed.has(minerSlot(miner))) selected.push(miner);
+      else {
+        const target = handed.get(minerSlot(miner));
+        if (target) selected.push(target);
+      }
+    }
+    return [...selected, ...dynamic.filter((miner) => !slots.has(minerSlot(miner)))];
+  }
+};
+var MinerAdmissions = class {
+  constructor(path5, policy) {
+    this.path = path5;
+    this.policy = policy;
+  }
+  path;
+  policy;
+  stamp;
+  entries = [];
+  revision = 0;
+  read(now = Date.now()) {
+    let stamp;
+    try {
+      const stat = statSync(this.path);
+      stamp = `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`;
+    } catch {
+      stamp = "missing";
+    }
+    if (stamp !== this.stamp) {
+      this.stamp = stamp;
+      this.revision++;
+      this.entries = [];
+      let fd;
+      try {
+        fd = openSync(this.path, "r");
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size > MAX_FILE_BYTES) throw new Error("admissions file too large");
+        const buffer = Buffer.alloc(MAX_FILE_BYTES + 1);
+        const size = readSync(fd, buffer, 0, buffer.length, 0);
+        if (size > MAX_FILE_BYTES) throw new Error("admissions file too large");
+        const file = JSON.parse(buffer.subarray(0, size).toString("utf8"));
+        if (file.schema !== "flop-miner-admissions/v1" || !Number.isFinite(Date.parse(file.generatedAt)) || !Array.isArray(file.entries) || file.entries.length > MAX_ADMITTED_MINERS) throw new Error("invalid admissions snapshot");
+        const slots = /* @__PURE__ */ new Set();
+        const entries = file.entries.map((entry) => {
+          const id = entry.modelIdentity;
+          const url = new URL(entry.endpoint);
+          const accepted = Date.parse(entry.adAcceptedAt), expiry = Date.parse(entry.admissionExpiresAt);
+          if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash || typeof entry.minerAddress !== "string" || !entry.minerAddress || !HASH4.test(entry.enclaveKey) || !id || ![id.modelHash, id.decodePolicyHash, id.measuredRoot].every((h) => HASH4.test(h)) || ![id.requestedSlug, id.registryModel, id.registryVersion, id.backendModelName].every((s) => typeof s === "string" && s.length > 0) || !Number.isInteger(id.precision) || id.precision < 0 || id.precision > 5 || !/^[1-9]\d*$/.test(entry.calibrationCapGflopsPerSec) || !Number.isFinite(accepted) || !Number.isFinite(expiry) || accepted > now || expiry <= accepted || expiry > accepted + 36e5 || entry.observation?.countryCode !== null && !/^[A-Z]{2}$/.test(entry.observation?.countryCode) || entry.observation?.regional !== false || entry.observation.observedAt !== entry.adAcceptedAt) throw new Error("invalid admission entry");
+          requireWorkerMinimum(entry.worker?.version, entry.worker?.revision);
+          const slot = minerSlot(entry);
+          if (slots.has(slot)) throw new Error("duplicate admission slot");
+          slots.add(slot);
+          return {
+            endpoint: entry.endpoint,
+            authToken: "",
+            channelSigned: true,
+            minerAddress: entry.minerAddress,
+            enclaveKey: entry.enclaveKey,
+            modelIdentity: id,
+            ...this.policy,
+            admissionExpiresAt: entry.admissionExpiresAt,
+            deployment: {
+              countryCode: entry.observation.countryCode ?? "ZZ",
+              source: "mailbox-observed:non-regional",
+              observedAt: entry.adAcceptedAt,
+              expiresAt: entry.admissionExpiresAt
+            }
+          };
+        });
+        this.entries = entries;
+      } catch {
+      } finally {
+        if (fd !== void 0) closeSync(fd);
+      }
+    }
+    return this.entries.filter((entry) => Date.parse(entry.admissionExpiresAt) > now);
+  }
+};
+
+// ../gateway-core/src/miner-peer.ts
+import { BlockList, isIP } from "node:net";
+import { resolve4 as resolve42, resolve6 as resolve62 } from "node:dns/promises";
+import { request } from "node:https";
+import { Readable } from "node:stream";
+var NOT_PUBLIC = new BlockList();
+for (const [net, bits] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+]) NOT_PUBLIC.addSubnet(net, bits, "ipv4");
+for (const [net, bits] of [
+  // No ::ffff:0:0/96 rule: BlockList also checks IPv4 addresses against IPv4-mapped rules, so it
+  // would match every IPv4 address. A mapped address is judged by its IPv4 part instead.
+  ["::", 128],
+  ["::1", 128],
+  ["64:ff9b::", 96],
+  ["100::", 64],
+  ["2001:db8::", 32],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["ff00::", 8]
+]) NOT_PUBLIC.addSubnet(net, bits, "ipv6");
+function isPublicAddress(ip) {
+  const family = isIP(ip);
+  if (family === 0) return false;
+  if (family === 6) {
+    const canonical = new URL(`http://[${ip}]`).hostname.slice(1, -1);
+    const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(canonical);
+    if (mapped) {
+      const [high, low] = [parseInt(mapped[1], 16), parseInt(mapped[2], 16)];
+      return isPublicAddress(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
+    }
+  }
+  return !NOT_PUBLIC.check(ip, family === 4 ? "ipv4" : "ipv6");
+}
+var EndpointRefusal = class extends Error {
+};
+async function resolveDnsAddresses(host, v4 = resolve42, v6 = resolve62) {
+  for (let attempt = 0; ; attempt++) {
+    const results = await Promise.allSettled([v4(host), v6(host)]);
+    const errors = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+    const code = (error) => error?.code;
+    const fatal = errors.find((error) => code(error) !== "ENODATA" && code(error) !== "ENOTFOUND");
+    if (fatal) throw fatal;
+    const notFound = errors.find((error) => code(error) === "ENOTFOUND");
+    if (notFound) {
+      if (attempt === 0) continue;
+      throw notFound;
+    }
+    return results.flatMap((result, index) => result.status === "fulfilled" ? result.value.map((address) => ({ address, family: index === 0 ? 4 : 6 })) : []);
+  }
+}
+var systemResolve = resolveDnsAddresses;
+async function resolvePublic(host, resolve10 = systemResolve) {
+  const family = isIP(host);
+  const addresses = family ? [{ address: host, family }] : await resolve10(host);
+  if (addresses.length === 0 || !addresses.every((a) => isPublicAddress(a.address))) {
+    throw new EndpointRefusal(`${host} does not resolve to public addresses only`);
+  }
+  return addresses[0];
+}
+function minerPeerFetch(endpoint, dynamic, before = () => {
+}, resolve10 = systemResolve, send2 = request) {
+  return async (input, init = {}) => {
+    before();
+    const url = new URL(String(input));
+    if (url.origin !== new URL(endpoint).origin) throw new EndpointRefusal("miner request escaped its origin");
+    if (!dynamic) return fetch(input, { ...init, redirect: "error" });
+    if (url.protocol !== "https:" || url.username || url.password) throw new EndpointRefusal("dynamic miner requires HTTPS");
+    const signal = init.signal ?? AbortSignal.timeout(3e4);
+    const pinned = await new Promise((accept, reject) => {
+      const abort = () => reject(signal.reason);
+      signal.addEventListener("abort", abort, { once: true });
+      resolvePublic(url.hostname.replace(/^\[|\]$/g, ""), resolve10).then(accept, reject).finally(() => signal.removeEventListener("abort", abort));
+      if (signal.aborted) abort();
+    });
+    before();
+    signal.throwIfAborted();
+    return new Promise((accept, reject) => {
+      const req = send2(url, {
+        method: init.method ?? "GET",
+        headers: Object.fromEntries(new Headers(init.headers).entries()),
+        signal,
+        agent: false,
+        lookup: (_host, options, callback) => {
+          if (options.all) callback(null, [pinned]);
+          else callback(null, pinned.address, pinned.family);
+        }
+      }, (res) => {
+        const status = res.statusCode;
+        if (status >= 300 && status < 400) {
+          res.destroy();
+          req.destroy();
+          reject(new EndpointRefusal("miner redirect refused"));
+          return;
+        }
+        const headers = new Headers();
+        for (const [name, value] of Object.entries(res.headers)) {
+          if (value !== void 0) headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+        }
+        accept(new Response([204, 205].includes(status) ? null : Readable.toWeb(res), { status, headers }));
+      });
+      req.on("error", (error) => reject(signal.aborted ? signal.reason : error));
+      req.end(init.body);
+    });
+  };
+}
+
 // src/commands/gateway-renew.ts
-import { Command as Command47 } from "commander";
+import { Command as Command48 } from "commander";
 
 // src/commands/gateway-tools-qualification.ts
 import { decodeAddress } from "@polkadot/util-crypto";
@@ -12150,8 +12678,8 @@ function tailnetNodeRef(source) {
   return match ? { host: match[1], egress: match[2], asn: match[3] } : null;
 }
 function readTailscaleStatus(socketPath) {
-  return new Promise((resolve9, reject) => {
-    const req = request({
+  return new Promise((resolve10, reject) => {
+    const req = request2({
       socketPath,
       path: "/localapi/v0/status",
       headers: { Host: "local-tailscaled.sock", "Sec-Tailscale": "localapi" },
@@ -12165,7 +12693,7 @@ function readTailscaleStatus(socketPath) {
       res.on("end", () => {
         if (res.statusCode !== 200) return reject(new Error(`tailscaled status returned HTTP ${res.statusCode}`));
         try {
-          resolve9(JSON.parse(body));
+          resolve10(JSON.parse(body));
         } catch {
           reject(new Error("tailscaled status is not JSON"));
         }
@@ -12253,6 +12781,12 @@ async function renewGatewayEvidence(miners, records, observe) {
       const node = tailnetNodeRef(declared.source);
       let provider;
       let session;
+      if (miner.admissionExpiresAt) {
+        await observe.miner(miner);
+        if (Date.parse(miner.admissionExpiresAt) <= observe.now()) throw new Error("miner admission expired");
+        observed.push(miner);
+        continue;
+      }
       if (node) {
         session = await observe.miner(miner);
         provider = await observe.tailnet(node);
@@ -12373,12 +12907,12 @@ async function writeEvidenceFile(path5, evidence, appendQualification = false) {
       evidence = { ...prior, generated_at: evidence.generated_at, conformance: [...conformance, ...latest.values()] };
     }
     parseGatewayEvidence(evidence);
-    await writeFile12(temporary, `${JSON.stringify(evidence, null, 2)}
+    await writeFile13(temporary, `${JSON.stringify(evidence, null, 2)}
 `, { mode: 420 });
     await rename9(temporary, path5);
   } finally {
     await lock.close();
-    await rm4(`${path5}.lock`);
+    await rm5(`${path5}.lock`);
   }
 }
 async function finishRenewal(report, out, output) {
@@ -12467,11 +13001,75 @@ async function waitForSettlementAllowance(api, channelId, aggregateGn, deadline)
   }
   throw new Error("settlement allowance did not arrive before the probe deadline");
 }
+async function renewalMinerInfo(api, miner, fetchImpl = fetch) {
+  const head = await api.rpc.chain.getFinalizedHead();
+  const at = await api.at(head);
+  const registered = await at.query.minerStaking.miners(miner.minerAddress);
+  const active = registered?.isSome && registered.unwrap().isActive;
+  if (!(active?.isTrue ?? active === true)) throw new Error("miner is not registered and active at finality");
+  const encoded = await api.rpc.state.call("TrustRootApi_accepted_calibration_cap", `0x80${hex3(decodeAddress2(miner.minerAddress)).slice(2)}`, head);
+  const cap = encoded.toU8a(true);
+  if (cap.length !== 9 || cap[0] !== 1 || new DataView(cap.buffer, cap.byteOffset + 1, 8).getBigUint64(0, true) <= 0n) throw new Error("miner has no finalized calibrated capacity");
+  const identity = {
+    ...miner.modelIdentity,
+    modelHash: bytes3(miner.modelIdentity.modelHash),
+    decodePolicyHash: bytes3(miner.modelIdentity.decodePolicyHash),
+    measuredRoot: bytes3(miner.modelIdentity.measuredRoot)
+  };
+  if (!miner.channelSigned) {
+    const anonymous = await fetchImpl(`${miner.endpoint.replace(/\/$/, "")}/session/info`, { redirect: "error", signal: AbortSignal.timeout(3e4) });
+    await anonymous.body?.cancel();
+    if (anonymous.status !== 401) throw new Error("miner /session/info does not enforce authentication");
+  }
+  const info = miner.channelSigned ? await computeChannel6.fetchProvenSessionInfo(miner.endpoint, {
+    genesisHash: api.genesisHash.toU8a(),
+    account: decodeAddress2(miner.minerAddress),
+    minerAddress: miner.minerAddress,
+    enclaveKey: bytes3(miner.enclaveKey),
+    modelIdentity: identity
+  }, fetchImpl, AbortSignal.timeout(3e4)) : await computeChannel6.fetchMinerSessionInfo(
+    miner.endpoint,
+    { Authorization: `Bearer ${miner.authToken}` },
+    AbortSignal.timeout(3e4),
+    fetchImpl
+  );
+  requireWorkerMinimum(info.image?.version, info.image?.revision);
+  const wire = {
+    ...info,
+    is_ready: info.isReady,
+    enclaveKey: hex3(info.enclaveKey),
+    modelHash: hex3(info.modelHash),
+    modelIdentity: {
+      ...info.modelIdentity,
+      modelHash: hex3(info.modelIdentity.modelHash),
+      decodePolicyHash: hex3(info.modelIdentity.decodePolicyHash),
+      measuredRoot: hex3(info.modelIdentity.measuredRoot)
+    }
+  };
+  const snapshot = await readChainSnapshot(api, wire, head.toHex());
+  if (miner.channelSigned && snapshot.calibration) wire.calibration = {
+    ...snapshot.calibration,
+    ready: true,
+    state: "active",
+    currentBlock: snapshot.finalizedBlock
+  };
+  assertMinerMatchesChain(wire, snapshot);
+  if (wire.minerAddress !== miner.minerAddress || wire.enclaveKey !== miner.enclaveKey || Object.keys(miner.modelIdentity).some((field2) => wire.modelIdentity[field2] !== miner.modelIdentity[field2])) throw new Error("miner no longer advertises its allowlisted identity");
+  return { ...info, calibration: wire.calibration };
+}
+function renewalAdmissions(env, chainPriced) {
+  if (!env.GATEWAY_ADMISSIONS_FILE) return void 0;
+  const maxBudgetFlop = Number(env.GATEWAY_ADMISSION_MAX_BUDGET_FLOP), maxDurationBlocks = Number(env.GATEWAY_ADMISSION_MAX_DURATION_BLOCKS);
+  if (!chainPriced || !Number.isFinite(maxBudgetFlop) || maxBudgetFlop <= 0 || !Number.isSafeInteger(maxDurationBlocks) || maxDurationBlocks <= 0) throw new Error("dynamic admission requires chain pricing and explicit gateway budget/duration policy");
+  return new MinerAdmissions(env.GATEWAY_ADMISSIONS_FILE, { maxBudgetFlop, maxDurationBlocks });
+}
 async function probeToolsConformance(input) {
   const { api, chain, miner, record } = input;
   const deadline = Date.now() + PROBE_TIMEOUT_MS;
-  const headers = { Authorization: `Bearer ${miner.authToken}` };
-  const info = await computeChannel6.fetchMinerSessionInfo(miner.endpoint, headers, AbortSignal.timeout(3e4));
+  const fetchImpl = minerPeerFetch(miner.endpoint, !!miner.admissionExpiresAt, input.assertAdmission);
+  const headers = miner.channelSigned ? {} : { Authorization: `Bearer ${miner.authToken}` };
+  const info = await renewalMinerInfo(api, miner, fetchImpl);
+  let requestHeaders;
   const pinned = miner.modelIdentity;
   const advertised = info.modelIdentity;
   if (info.minerAddress !== miner.minerAddress || hex3(info.enclaveKey) !== miner.enclaveKey.toLowerCase() || !advertised || advertised.requestedSlug !== pinned.requestedSlug || advertised.registryModel !== pinned.registryModel || advertised.registryVersion !== pinned.registryVersion || hex3(advertised.modelHash) !== pinned.modelHash || advertised.precision !== pinned.precision || hex3(advertised.decodePolicyHash) !== pinned.decodePolicyHash || hex3(advertised.measuredRoot) !== pinned.measuredRoot || advertised.backendModelName !== pinned.backendModelName) {
@@ -12493,6 +13091,8 @@ async function probeToolsConformance(input) {
   let sequence = 0;
   const transport = new computeChannel6.HttpSessionTransport(miner.endpoint, PROBE_TIMEOUT_MS, {
     headers,
+    fetchImpl,
+    requestHeaders: (method, path5, body) => requestHeaders?.(method, path5, body) ?? {},
     onFrame: (frame) => {
       if (frame.sequence !== sequence++) throw new Error("tools probe frame sequence mismatch");
       if (frame.type === "chunk") frames.push({ kind: frame.kind, data: bytes3(frame.data) });
@@ -12500,6 +13100,7 @@ async function probeToolsConformance(input) {
   });
   const agentKey = computeChannel6.SessionKey.generate();
   const identity = { ...pinned, modelHash: bytes3(pinned.modelHash), decodePolicyHash: bytes3(pinned.decodePolicyHash), measuredRoot: bytes3(pinned.measuredRoot) };
+  input.assertAdmission?.();
   const session = await computeChannel6.ChannelSession.open({
     chain,
     transport,
@@ -12526,7 +13127,15 @@ async function probeToolsConformance(input) {
   let verdict;
   let receipt;
   try {
-    await computeChannel6.notifyMinerOpen(miner.endpoint, session.channelId, agentKey.publicKey, headers, AbortSignal.timeout(3e4));
+    if (miner.channelSigned) requestHeaders = await computeChannel6.channelSessionAuth(
+      miner.endpoint,
+      session.channelId,
+      agentKey,
+      info,
+      fetchImpl,
+      AbortSignal.timeout(3e4)
+    );
+    await computeChannel6.notifyMinerOpen(miner.endpoint, session.channelId, agentKey.publicKey, headers, AbortSignal.timeout(3e4), requestHeaders, fetchImpl);
     receipt = await session.chatTurn({
       version,
       model: record.openrouter_slug,
@@ -12549,7 +13158,7 @@ async function probeToolsConformance(input) {
   try {
     await waitForSettlementAllowance(api, session.channelId, receipt.gN, deadline);
     const settled = await session.closeCooperative(async (claim) => {
-      const wire = await computeChannel6.notifyMinerClose(miner.endpoint, claim, headers, AbortSignal.timeout(3e4));
+      const wire = await computeChannel6.notifyMinerClose(miner.endpoint, claim, headers, AbortSignal.timeout(3e4), requestHeaders, fetchImpl);
       return wire ? {
         channelId: bytes3(wire.channelId),
         minerPaid: BigInt(wire.minerPaid),
@@ -12584,7 +13193,7 @@ function envSecret(name) {
   return value;
 }
 function gatewayRenewCmd() {
-  return new Command47("renew").description("Re-observe allowlisted miners, re-run feature conformance, and write the gateway evidence file").option("--allowlist-env <name>", "Direct probe mode: environment variable holding GATEWAY_SESSION_ALLOWLIST (never printed)").requiredOption("--catalog-env <name>", "Environment variable holding GATEWAY_MODEL_CATALOG").option("--catalog-pricing <mode>", "The gateway's GATEWAY_CATALOG_PRICING: operator, or chain when the catalog omits prices", "operator").option("--provider-key-env <name>", "Direct probe mode: environment variable holding the GPU.ai API key").option("--tailscale-socket <path>", "tailscaled LocalAPI socket for tailnet-hosted miners", "/var/run/tailscale/tailscaled.sock").option("--probe-signer-env <name>", "Direct probe mode: environment variable holding the dedicated funded probe signer URI").option("--probe-escrow <flop>", "Direct probe mode: FLOP escrowed for each conformance probe channel").option("--qualification-receipt <path>", "Receipt-only mode: settled owner tools-qualification evidence; never runs another probe").option("--qualification-receipt-sha256 <hash>", "SHA-256 of the immutable owner qualification receipt").requiredOption("--out <path>", "Evidence file the gateway reads as GATEWAY_EVIDENCE_FILE").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command48("renew").description("Re-observe allowlisted miners, re-run feature conformance, and write the gateway evidence file").option("--allowlist-env <name>", "Direct probe mode: environment variable holding GATEWAY_SESSION_ALLOWLIST (never printed)").requiredOption("--catalog-env <name>", "Environment variable holding GATEWAY_MODEL_CATALOG").option("--catalog-pricing <mode>", "The gateway's GATEWAY_CATALOG_PRICING: operator, or chain when the catalog omits prices", "operator").option("--provider-key-env <name>", "Direct probe mode: environment variable holding the GPU.ai API key").option("--tailscale-socket <path>", "tailscaled LocalAPI socket for tailnet-hosted miners", "/var/run/tailscale/tailscaled.sock").option("--probe-signer-env <name>", "Direct probe mode: environment variable holding the dedicated funded probe signer URI").option("--probe-escrow <flop>", "Direct probe mode: FLOP escrowed for each conformance probe channel").option("--qualification-receipt <path>", "Receipt-only mode: settled owner tools-qualification evidence; never runs another probe").option("--qualification-receipt-sha256 <hash>", "SHA-256 of the immutable owner qualification receipt").requiredOption("--out <path>", "Evidence file the gateway reads as GATEWAY_EVIDENCE_FILE").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       if (opts.catalogPricing !== "operator" && opts.catalogPricing !== "chain") {
@@ -12595,7 +13204,7 @@ function gatewayRenewCmd() {
           throw new Error("receipt-only mode requires the receipt/hash and cannot run direct probes");
         }
         const raw = await readFile11(opts.qualificationReceipt);
-        if (raw.length > 8e6 || createHash5("sha256").update(raw).digest("hex") !== opts.qualificationReceiptSha256) throw new Error("qualification receipt bytes differ");
+        if (raw.length > 8e6 || createHash6("sha256").update(raw).digest("hex") !== opts.qualificationReceiptSha256) throw new Error("qualification receipt bytes differ");
         const value = JSON.parse(raw.toString("utf8"));
         const records2 = parseCanonicalCatalog(envJson(opts.catalogEnv), { chainPriced: opts.catalogPricing === "chain" });
         const record = records2.find((item) => item.openrouter_slug === value.model);
@@ -12612,7 +13221,12 @@ function gatewayRenewCmd() {
         return;
       }
       if (!opts.allowlistEnv || !opts.providerKeyEnv || !opts.probeSignerEnv || !opts.probeEscrow) throw new Error("direct renewal requires allowlist, provider, signer and escrow options");
-      const miners = envJson(opts.allowlistEnv);
+      const staticMiners = envJson(opts.allowlistEnv);
+      const admissions = renewalAdmissions(process.env, opts.catalogPricing === "chain");
+      const handoffs = process.env.GATEWAY_STATIC_HANDOFFS_FILE?.trim();
+      if (handoffs && !admissions) throw new Error("static handoffs require dynamic admissions");
+      const routing = new MinerRouting(staticMiners, handoffs);
+      const miners = routing.read(admissions?.read() ?? []);
       if (!Array.isArray(miners) || miners.length === 0) throw new Error(`${opts.allowlistEnv} must list at least one miner`);
       const records = parseCanonicalCatalog(envJson(opts.catalogEnv), { chainPriced: opts.catalogPricing === "chain" });
       const providerKey = envSecret(opts.providerKeyEnv);
@@ -12626,24 +13240,40 @@ function gatewayRenewCmd() {
       await computeChannel6.ready();
       const signer = new Keyring5({ type: "sr25519" }).addFromUri(signerUri);
       const chain = new computeChannel6.ComputeChannelChainClient(new computeChannel6.FlopChainSubmitter(api, signer, true));
+      const assertAdmission = (miner) => {
+        if (!miner.admissionExpiresAt) return;
+        const dynamic = admissions?.read() ?? [];
+        const matches = (item) => !!item && item.enclaveKey === miner.enclaveKey && item.endpoint === miner.endpoint && JSON.stringify(item.modelIdentity) === JSON.stringify(miner.modelIdentity);
+        if (!matches(dynamic.find((item) => minerSlot(item) === minerSlot(miner))) || !matches(routing.read(dynamic).find((item) => minerSlot(item) === minerSlot(miner)))) throw new Error("miner admission expired or key revoked");
+      };
       const report = await renewGatewayEvidence(miners, records, {
         now: Date.now,
         provider: (ref) => observeGpuAiInstance(ref, providerKey),
         tailnet: tailnetObserver(opts.tailscaleSocket),
         miner: async (miner) => {
-          const info = await fetchMinerSessionInfo(miner.endpoint, miner.authToken, AbortSignal.timeout(3e4));
+          const proven = await renewalMinerInfo(api, miner, minerPeerFetch(miner.endpoint, !!miner.admissionExpiresAt, () => assertAdmission(miner)));
+          const info = {
+            ...proven,
+            is_ready: proven.isReady,
+            enclaveKey: hex3(proven.enclaveKey),
+            modelHash: hex3(proven.modelHash),
+            modelIdentity: {
+              ...proven.modelIdentity,
+              modelHash: hex3(proven.modelIdentity.modelHash),
+              decodePolicyHash: hex3(proven.modelIdentity.decodePolicyHash),
+              measuredRoot: hex3(proven.modelIdentity.measuredRoot)
+            }
+          };
           const pinned = miner.modelIdentity;
           const advertised = info.modelIdentity;
           if (info.minerAddress !== miner.minerAddress || info.enclaveKey?.toLowerCase() !== miner.enclaveKey.toLowerCase() || !advertised || Object.keys(pinned).some((key) => advertised[key] !== pinned[key])) {
             throw new Error("miner no longer advertises its allowlisted identity");
           }
-          const snapshot = await readChainSnapshot(api, info);
-          assertMinerMatchesChain(info, snapshot);
-          return `authenticated /session/info matches its pin and finalized block ${snapshot.finalizedBlock}`;
+          return "authenticated session identity matches its pin and finalized registry/calibration";
         },
         tools: async (miner, record) => {
           await assertProbeSignerFunded(api, signer.address, escrow);
-          return probeToolsConformance({ api, chain, miner, record, escrow });
+          return probeToolsConformance({ api, chain, miner, record, escrow, assertAdmission: () => assertAdmission(miner) });
         }
       });
       const exitCode = await finishRenewal(report, opts.out, getJson(command));
@@ -12657,9 +13287,9 @@ function gatewayRenewCmd() {
 }
 
 // src/release-check.ts
-import { mkdir as mkdir13, readFile as readFile12, rename as rename10, writeFile as writeFile13 } from "node:fs/promises";
+import { mkdir as mkdir14, readFile as readFile12, rename as rename10, writeFile as writeFile14 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname7, join as join9 } from "node:path";
+import { dirname as dirname7, join as join10 } from "node:path";
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var READ_ONLY = /* @__PURE__ */ new Set([
   "health",
@@ -12703,7 +13333,7 @@ async function checkRelease(options) {
   if (options.offline || (options.testing ?? (process.env.NODE_ENV === "test" || !!process.env.VITEST))) return;
   const warn = options.warn ?? ((message) => console.error(message));
   const now = options.now ?? Date.now();
-  const cacheFile = options.cacheFile ?? join9(process.env.XDG_CACHE_HOME || join9(homedir5(), ".cache"), "flop", "releases.json");
+  const cacheFile = options.cacheFile ?? join10(process.env.XDG_CACHE_HOME || join10(homedir5(), ".cache"), "flop", "releases.json");
   let releases;
   try {
     const cached = JSON.parse(await readFile12(cacheFile, "utf8"));
@@ -12718,9 +13348,9 @@ async function checkRelease(options) {
       if (!response.ok) throw new Error(`HTTP ${response.status}`);
       releases = parseOperatorReleases(await response.json());
       try {
-        await mkdir13(dirname7(cacheFile), { recursive: true });
+        await mkdir14(dirname7(cacheFile), { recursive: true });
         const temporary = `${cacheFile}.${process.pid}.tmp`;
-        await writeFile13(temporary, JSON.stringify({ fetchedAt: now, releases }), { mode: 384 });
+        await writeFile14(temporary, JSON.stringify({ fetchedAt: now, releases }), { mode: 384 });
         await rename10(temporary, cacheFile);
       } catch {
         warn("warning: could not cache operator releases");
@@ -12745,10 +13375,10 @@ async function checkRelease(options) {
 }
 
 // src/cli.ts
-var program = new Command48();
+var program = new Command49();
 var outputMode = outputModeFromArgv(process.argv.slice(2));
 setOutputMode(outputMode);
-program.name("flop").description("FLOP Network CLI").version(operatorVersion(JSON.parse(readFileSync2(join10(packageRoot, "package.json"), "utf8")).version)).option("--offline", "Skip the operator release check").addOption(new Option7("--network <network>", "Network profile").choices(["local", "devnet", "testnet", "mainnet"]).default("local")).option("--rpc <url>", "RPC endpoint override").option("--signer <uri>", "Signer URI (local/dev only; required outside local unless --keystore)").option("--keystore <path>", "Encrypted Polkadot JSON keystore").option("--password-env <name>", "Environment variable containing the keystore password").addOption(new Option7("--output <mode>", "Output mode").choices(["human", "json", "agent"]).default("human")).option("--json", "Output as JSON");
+program.name("flop").description("FLOP Network CLI").version(operatorVersion(JSON.parse(readFileSync2(join11(packageRoot, "package.json"), "utf8")).version)).option("--offline", "Skip the operator release check").addOption(new Option8("--network <network>", "Network profile").choices(["local", "devnet", "testnet", "mainnet"]).default("local")).option("--rpc <url>", "RPC endpoint override").option("--signer <uri>", "Signer URI (local/dev only; required outside local unless --keystore)").option("--keystore <path>", "Encrypted Polkadot JSON keystore").option("--password-env <name>", "Environment variable containing the keystore password").addOption(new Option8("--output <mode>", "Output mode").choices(["human", "json", "agent"]).default("human")).option("--json", "Output as JSON");
 program.addCommand(healthCmd());
 program.addCommand(balanceCmd());
 program.addCommand(gpuCmd());
@@ -12760,13 +13390,13 @@ program.addCommand(chatCmd());
 program.addCommand(agentCmd());
 program.addCommand(minerCmd());
 program.addCommand(validatorCmd());
-var networkCmd = new Command48("network").description("Resolve and inspect network profiles");
+var networkCmd = new Command49("network").description("Resolve and inspect network profiles");
 networkCmd.addCommand(networkStatusCmd());
 program.addCommand(networkCmd);
-var faucetCmd = new Command48("faucet").description("Request dev/test FLOP");
+var faucetCmd = new Command49("faucet").description("Request dev/test FLOP");
 faucetCmd.addCommand(faucetRequestCmd());
 program.addCommand(faucetCmd);
-var sessionCmd = new Command48("session").description("Manage session keys");
+var sessionCmd = new Command49("session").description("Manage session keys");
 sessionCmd.addCommand(sessionRunCmd());
 sessionCmd.addCommand(sessionListCmd());
 sessionCmd.addCommand(sessionCreateCmd());
@@ -12774,7 +13404,7 @@ sessionCmd.addCommand(sessionInfoCmd());
 sessionCmd.addCommand(sessionRevokeCmd());
 sessionCmd.addCommand(sessionLimitsCmd());
 program.addCommand(sessionCmd);
-var keysCmd = new Command48("keys").description("Manage keys");
+var keysCmd = new Command49("keys").description("Manage keys");
 keysCmd.addCommand(keysGenerateCmd());
 keysCmd.addCommand(keysInspectCmd());
 keysCmd.addCommand(keysHardwareCmd());
@@ -12782,44 +13412,45 @@ keysCmd.addCommand(keysImportCmd());
 keysCmd.addCommand(keysExportCmd());
 keysCmd.addCommand(keysClaudeProfileCmd());
 program.addCommand(keysCmd);
-var walletCmd = new Command48("wallet").description("Manage wallets");
-var agentWalletCmd = new Command48("agent").description("Agent wallet operations");
+var walletCmd = new Command49("wallet").description("Manage wallets");
+var agentWalletCmd = new Command49("agent").description("Agent wallet operations");
 agentWalletCmd.addCommand(walletAgentCreateCmd());
 walletCmd.addCommand(agentWalletCmd);
 program.addCommand(walletCmd);
-var txCmd = new Command48("tx").description("Build, sign, and broadcast transactions");
+var txCmd = new Command49("tx").description("Build, sign, and broadcast transactions");
 txCmd.addCommand(txBuildCmd());
 txCmd.addCommand(txBroadcastCmd());
 program.addCommand(txCmd);
 program.addCommand(multisigCmd());
 program.addCommand(channelCmd());
-var gatewayCmd = new Command48("gateway").description("Generate verified gateway configuration");
+var gatewayCmd = new Command49("gateway").description("Generate verified gateway configuration");
 gatewayCmd.addCommand(gatewayAllowlistCmd());
 gatewayCmd.addCommand(gatewayRenewCmd());
 program.addCommand(gatewayCmd);
-var x402Cmd = new Command48("x402").description("x402 payment gateway operations");
+var x402Cmd = new Command49("x402").description("x402 payment gateway operations");
 x402Cmd.addCommand(x402SettleCmd());
 program.addCommand(x402Cmd);
-var daCmd = new Command48("da").description("Sovereign DA registry (leases, deposits)");
+var daCmd = new Command49("da").description("Sovereign DA registry (leases, deposits)");
 daCmd.addCommand(daDepositCmd());
 daCmd.addCommand(daRegisterCmd());
 daCmd.addCommand(daTopupCmd());
 daCmd.addCommand(daWithdrawCmd());
 program.addCommand(daCmd);
-var modelCmd = new Command48("model").description("Model registry operations");
+var modelCmd = new Command49("model").description("Model registry operations");
 modelCmd.addCommand(modelListCmd());
 modelCmd.addCommand(modelGetCmd());
 modelCmd.addCommand(modelFetchCmd());
 modelCmd.addCommand(modelUploadCmd());
 modelCmd.addCommand(modelPreflightCmd());
 modelCmd.addCommand(modelOnboardCmd());
+modelCmd.addCommand(modelBackupCmd());
 modelCmd.addCommand(modelAuditCmd());
 program.addCommand(modelCmd);
 program.hook("preAction", async (_root, action) => {
   const path5 = [];
   for (let command = action; command && command !== program; command = command.parent) path5.unshift(command.name());
   await checkRelease({
-    version: operatorVersion(JSON.parse(readFileSync2(join10(packageRoot, "package.json"), "utf8")).version),
+    version: operatorVersion(JSON.parse(readFileSync2(join11(packageRoot, "package.json"), "utf8")).version),
     readOnly: isReadOnlyCommand(path5),
     offline: program.opts().offline,
     image: !!process.env.FLOP_IMAGE_VERSION