@mcsherrylabs/pi-meerkat 0.7.0 → 0.10.1

package/README.md

@@ -5,28 +5,116 @@ Meerkat tools plus every tool dynamically discovered from the private
 `@mcsherrylabs/evolver-mcp@0.15.0` child. The released upstream baseline is 65 tools, so healthy
 discovery currently returns 72. The count is a comparison baseline, not a routing allowlist.
 
-**Version 0.7.0 introduces this facade.** Version 0.6.0 is the previous Pi/local-signing package
-and does **not** contain it. Use the explicit version below, not an unversioned `npx` command or
-an assumption about npm `latest`. Source/packed acceptance, publication, and verification of an
-installed published release are separate milestones.
+**Version 0.9.0 makes DevNet the default install target** (`install` installs against the public
+DevNet; `install --local` creates a private local chain). Version 0.8.0 added the
+zero-required-parameter installer (local chain only). Version 0.7.0 introduced the
+facade but required an existing node, registry, identity and key. Version 0.6.0 is the old
+Pi/local-signing package. Always use an exact published version, not npm `latest`.
 
-## Install from npm
+## Install the complete experience
 
-Run this in the same environment where Claude Code (or another MCP client) runs. Node 22 is
-the verified runtime. Installation downloads the package and its exact released dependency;
-it does not provision or start a node:
+Prerequisites in the environment where your MCP harness runs:
+
+- Node.js **22 or newer**, with `npm` and `npx` on `PATH`.
+- A reachable Docker Engine and **Docker Compose v2** (`docker version`, `docker compose version`).
+  A normal local engine or a separately hosted Docker daemon/context both work. Existing Docker
+  authentication/TLS settings are respected; no new credentials are requested for public images.
+- An MCP harness with stdio support. The installer prints registration JSON; it does not edit
+  the harness or silently replace an existing registration.
+
+### 1. Install
 
 ```bash
-npm install --prefix "$HOME/.local/share/meerkat-mcp/0.7.0" \
-  --no-audit --no-fund @mcsherrylabs/pi-meerkat@0.7.0
-export PATH="$HOME/.local/share/meerkat-mcp/0.7.0/node_modules/.bin:$PATH"
+npx --yes @mcsherrylabs/pi-meerkat@0.9.0 install          # public DevNet (default)
+npx --yes @mcsherrylabs/pi-meerkat@0.9.0 install --local  # private local chain
 ```
 
-The installed facade resolves and launches its actual dependency's `evolver-mcp` bin
-(`dist/cli.js`). It does not use a sibling source checkout, global executable, or unversioned
-runtime download. Installation under the home directory persists across rig recreation.
+No identity, key, endpoint, registry, chain ID, channel, port, GID, path, environment variables
+or paid model service is required.
+
+**Default (DevNet)** installs a single non-genesis follower node against the public DevNet, syncing
+its shared chain, and a Meerkat registry that reads and indexes the shared, pinned
+`ce.meerkat.announcements` channel (owned by the pinned `evolvermeerkatA483344` operator). That
+registry runs **read-only**: it never claims, signs or submits with any identity. DevNet catch-up
+syncs from block 0 (~14k blocks at the time of release) and is paced by the registry's own cursor
+drain, so the first install can take a while; it reports progress and fails only if sync stalls.
+
+A DevNet install **permanently claims two DevNet identities**, both funded by the public DevNet
+faucet: its node (`meerkatnode<id>`) and your agent (`meerkatuser<id>`), which signs your
+announcements. Names on DevNet cannot be reused. Re-running install never claims again. DevNet mode
+needs **outbound internet access** from Docker (the node dials DevNet's front nodes, and the faucet
+is reached over HTTPS); it still publishes no host ports.
+
+**`--local`** creates an **independent private local chain** — an owned consensus node, a separate
+processing node, and a Meerkat registry/content/inbox service. The agent's own identity
+(`meerkatuser<id>`) owns the install's private `meerkat.<id>.announcements` channel (claimed once,
+idempotently), and nothing touches DevNet. In either mode the registry claims no identity, and the
+installer never inspects unrelated keys or changes another deployment. The first install downloads public pinned artifacts and
+builds the wrapper images, so allow time for Docker/npm downloads. Failed
+preflight/build/readiness exits nonzero with a reason. Each mode keeps its own state directory
+(`devnet/` or `local/` under your XDG state directory); 0.8.0 state is never touched.
 
-## Configure an existing node once
+### 2. Register one server
+
+Use the one `registration.mcpServers.meerkat` entry printed by installation. For Claude Code,
+if you do not already have a registration named `meerkat`, the equivalent command is:
+
+```bash
+claude mcp add --scope user --transport stdio meerkat -- \
+  npx --yes @mcsherrylabs/pi-meerkat@0.9.0 serve
+```
+
+Add `--local` after `serve` if you installed with `install --local`.
+
+Do not remove or replace an unrelated `meerkat` registration. Choose a different harness
+registration name for this entry if necessary; its underlying saved deployment remains the same.
+Other MCP clients can add the printed stdio JSON entry directly. Do **not** register an Evolver
+child separately. Restart the harness connection, inspect its tools, and begin with
+`meerkat_summary`, `meerkat_services`, `meerkat_inbox` and `evolver_chain_height`.
+
+`serve` finds the installer's saved state automatically (default `devnet`, `--local` for the
+private chain); there is no `--config` or environment ceremony. The public package launcher is
+pinned and survives npm-cache cleanup. Each client
+gets its **own facade and exact Evolver child/session/store** inside the owned runtime container,
+connected through Docker exec stdio. Node/content/registry HTTP stays on the private owned
+Docker network, with **no host-published ports**, so a separate Docker daemon needs neither
+host-path sharing nor a public read port.
+Stdout carries MCP protocol only. Closing the connection or signalling the launcher awaits the
+exact remote facade and its private child, not the shared registry or another client's session.
+
+### Resume and ownership
+
+Run the **same install command** again to resume the same installation. Names, identity/key
+references, internal service ports, daemon identity, real genesis/node binding and ownership are saved
+privately under the operator's XDG state directory (or normal home state directory). Services
+use separately owned Docker volumes for consensus data, processing-node data, public genesis,
+registry/app state, subscriptions and announcer state. Consensus and consumer-paced processing
+are separate roles required by the released node. The follower receives only the **public** chain
+specification, never the consensus node's private volume. The released Evolver bootstrap alone
+creates/loads announcer signing keys; the facade,
+installer and output carry only references. No key bytes are copied to the harness.
+
+Rerun does not initialize subscriptions again, regenerate genesis, rotate keys, change authority,
+force-claim/unclaim, adopt another daemon's resources or recover an owner lock. A missing valued
+volume, conflicting ownership, changed daemon/binding, interrupted initializer or stale owner lock
+refuses explicitly and retains state for operator inspection. There is no automatic reset,
+force recovery, Docker prune, broad restart or harness-registration mutation. `serve` never
+creates or restarts services. An intentional **install** invocation may start its own stopped
+services; unrelated services are never touched. Automatic cross-version migration is not provided:
+resume with the saved pinned version.
+
+The installer enables the complete registry/read/announce experience, not every optional upstream
+capability. Generic Evolver subscription-control and other optional capability tools can remain
+unconfigured and refuse clearly; no Docker socket or private node-control API is exposed to the
+registry/facade. The real tool catalog baseline is 65 upstream + 7 local, **not a promise that each
+optional capability is configured**.
+
+## Advanced: attach an existing node
+
+If you already operate a node, registry and keys, you may install this exact package normally
+and use `meerkat-mcp setup` instead. This is an alternative to the automatic installer, not a
+prerequisite for it. Keep your installed package on a persistent user-owned PATH, not an
+npm-cache-internal pathname.
 
 Setup records **references**, not key bytes. Select an existing node endpoint, separate content
 endpoint, identity, existing key file, registry read origin, explicit genesis/chain ID and node ID,
@@ -70,24 +158,12 @@ Pi adapter, or separately managed child is required. Direct launch uses the same
 meerkat-mcp --config "$MEERKAT_CONFIG"
 ```
 
-### Register in Claude Code
-
-From the environment where Claude Code runs, register the installed facade with the same
-absolute config path used for setup:
-
-```bash
-claude mcp add --scope user --transport stdio meerkat -- \
-  "$(command -v node)" \
-  "$HOME/.local/share/meerkat-mcp/0.7.0/node_modules/@mcsherrylabs/pi-meerkat/dist/mcp-cli.js" \
-  --config "$MEERKAT_CONFIG"
-```
-
-`--scope user` makes this operator registration available across your projects. Use
-`--scope local` instead to restrict the initial test to the current project. Start a fresh
-Claude Code session and run `/mcp` to inspect the connection and its tools. Do not register the
-private Evolver child separately. Begin with `meerkat_summary`, a small `meerkat_services`
-query, `meerkat_inbox`, and the upstream read-only `evolver_chain_height`; do not approve
-announcement/sign/submit calls until you deliberately choose to exercise a write.
+For advanced attach, register the exact persistent installed entrypoint/config returned by
+setup; do not point a client at an npm-cache-internal file. The automatic installer's pinned
+`serve` registration above is the recommended route for a virgin harness. In Claude Code,
+`--scope user` makes the operator registration available across projects; `--scope local`
+limits it to the current project. Start a fresh session and use `/mcp` to inspect the connection.
+Do not approve announcement/sign/submit calls until you deliberately choose to exercise a write.
 
 The stdio connection uses stdout exclusively for MCP messages. Diagnostics go to stderr. The
 operator-selected node/content/trust/identity/key/channel inputs are captured at facade startup;

package/dist/installer/committee-init.sh

@@ -0,0 +1,117 @@
+#!/bin/sh
+# node entrypoint: host keys + genesis on first boot, then exec the node.
+#
+# On FIRST boot it generates this node's key material ON THE HOST (never in the
+# image or the repo), renders a one-node genesis committee from the derived public
+# keys, and persists everything into the /data volume. On every subsequent boot it
+# REUSES the same keys + genesis so the chain continues — the genesis committee must
+# stay byte-stable or the chain identity diverges.
+#
+# Two secrets, handled identically (spec 101 — both are host-only secrets):
+#   - Ed25519 node-identity key  -> ce.evolver.node.private-key (EVOLVER_PRIVATE_KEY)
+#   - BLS consensus key (IKM)    -> ce.evolver.node.bls-secret   (EVOLVER_BLS_SEED)
+# Their public keys go into genesis (public-key / bls-public-key).
+set -eu
+
+# Deliberately NOT derived from the app name. This id is written into the genesis
+# file on the volume at FIRST BOOT, so changing it on an existing chain would launch
+# the node under a name absent from its own genesis. Keeping it neutral means
+# `npm run rename` never has to touch this file and cannot leave a previous project's
+# name behind — the template used to default to `tmplnode0`, so every app built from
+# it had a node introducing itself by the TEMPLATE's name, in its logs and in its
+# published deployment artifact.
+NODE_ID="${NODE_ID:-node0}"
+KEYS=/data/keys
+GENESIS=/data/genesis.gen.conf
+ED_KEY="$KEYS/ed25519.key"     # base64 PKCS#8 Ed25519 private
+BLS_KEY="$KEYS/bls.key"        # base64 BLS IKM (>=32 bytes)
+
+if [ -f "$ED_KEY" ] || [ -f "$BLS_KEY" ] || [ -f "$GENESIS" ]; then
+  [ -s "$ED_KEY" ] && [ -s "$BLS_KEY" ] && [ -s "$GENESIS" ] || {
+    echo '[node-init] incomplete owned keys/genesis; refusing regeneration' >&2; exit 1;
+  }
+fi
+if [ ! -f "$ED_KEY" ]; then
+  echo "[node-init] first boot: generating host key material for '$NODE_ID'"
+  mkdir -p "$KEYS"; chmod 700 "$KEYS"
+
+  # Ed25519 identity keypair — PKCS#8 private + X.509 public, base64 DER.
+  tmp="$(mktemp)"
+  openssl genpkey -algorithm ed25519 -outform DER -out "$tmp" 2>/dev/null
+  ED_PRIV="$(base64 -w0 < "$tmp")"
+  ED_PUB="$(openssl pkey -inform DER -in "$tmp" -pubout -outform DER 2>/dev/null | base64 -w0)"
+  rm -f "$tmp"
+
+  # BLS consensus keypair — random IKM + derived pubkey, via the evolver keygen.
+  BLS_OUT="$(java -cp "/opt/evolver/lib/*" ce.evolver.crypto.keys.BLSKeyGenerator)"
+  BLS_SECRET="$(echo "$BLS_OUT" | awk '/^bls-secret:/{print $2}')"
+  BLS_PUB="$(echo "$BLS_OUT" | awk '/^bls-public-key:/{print $2}')"
+
+  if [ -z "$ED_PRIV" ] || [ -z "$ED_PUB" ] || [ -z "$BLS_SECRET" ] || [ -z "$BLS_PUB" ]; then
+    echo "[node-init] FATAL: key generation produced empty output" >&2
+    exit 1
+  fi
+
+  # Persist secrets — host-only, mode 600.
+  printf '%s' "$ED_PRIV"    > "$ED_KEY";  chmod 600 "$ED_KEY"
+  printf '%s' "$BLS_SECRET"  > "$BLS_KEY"; chmod 600 "$BLS_KEY"
+
+  # Render the chain spec (089): committee PUBLIC keys + the chain-wide consensus
+  # parameters. This exact file is published verbatim to every follower / app node
+  # (102 follower-join: the genesis file IS the chain, byte-identical everywhere) and
+  # its canonical hash is pinned as the genesis block id (ce.evolver.genesis-file in
+  # node.conf). 103: the host is the ROUTABLE public address — followers dial the
+  # committee at exactly this host:port. Chain-wide params live HERE, not in node.conf,
+  # so joiners inherit them automatically — quiescence especially (FR-019: a joiner
+  # with different quiescence would time out the deliberately-lingering leader).
+  PUBLIC_HOST="${PUBLIC_HOST:-localhost}"
+  cat > "$GENESIS" <<EOF
+ce.evolver.genesis.nodes = [
+  {
+    node-id        = "$NODE_ID"
+    host           = "$PUBLIC_HOST"
+    port           = 7000
+    public-key     = "$ED_PUB"
+    bls-public-key = "$BLS_PUB"
+    quorum-weight  = 1000
+  }
+]
+
+ce.evolver.consensus {
+  n-nodes                   = 1
+  block-time-ms             = 600
+  round-timeout-ms          = 1500
+  block-reward-tokens       = 10000   # generous dev reward: the faucet (5000/identity) is funded from the FIRST blocks, even under quiescence
+  snapshot-interval-blocks  = 0       # single-node: no snapshot cadence; joiners sync from block 0
+  identity-sponsorship-cost = 100
+
+  # Low idle disk-write: after 3 empty blocks the leader lingers on a 5-MINUTE heartbeat
+  # instead of the 600ms cadence (#31: idle-heartbeat-ms > block-time-ms activates quiescence);
+  # wake-on-work (node-local, always on) still proposes immediately on incoming txs.
+  # CHAIN-WIDE — identical on every node by construction.
+  quiescence {
+    idle-heartbeat-ms       = 300000
+    idle-after-empty-rounds = 3
+  }
+}
+EOF
+  echo "[node-init] generated keys (secrets in $KEYS, mode 600) + chain spec (host=$PUBLIC_HOST)"
+  echo "[node-init] PUBLISH the chain spec (public keys + chain-wide config): docker compose cp node:/data/genesis.gen.conf ."
+else
+  echo "[node-init] existing keys found in $KEYS — reusing (chain continues)"
+fi
+
+# Secrets reach the node via env (HOCON ${?...} substitution in node.conf).
+EVOLVER_PRIVATE_KEY="$(cat "$ED_KEY")";  export EVOLVER_PRIVATE_KEY
+EVOLVER_BLS_SEED="$(cat "$BLS_KEY")";    export EVOLVER_BLS_SEED
+mkdir -p /data/chain
+
+echo "[node-init] launching evolver node '$NODE_ID'"
+if [ -f /public-genesis/genesis.conf ]; then
+  cmp -s "$GENESIS" /public-genesis/genesis.conf || { echo '[node-init] public genesis differs; refusing replacement' >&2; exit 1; }
+else
+  cp "$GENESIS" /public-genesis/genesis.pending
+  chmod 640 /public-genesis/genesis.pending
+  mv /public-genesis/genesis.pending /public-genesis/genesis.conf
+fi
+exec /opt/evolver/bin/evolver -Dconfig.file=/config/node.conf "$NODE_ID"

package/dist/installer/committee.conf

@@ -0,0 +1,102 @@
+# Single-node full-quorum, quiescent. The chain spec (committee with this
+# node's generated public keys + ALL chain-wide consensus params, incl. quiescence) is
+# rendered at first boot by node-init.sh into /data/genesis.gen.conf and included
+# here — this file holds only NODE-LOCAL config. Secrets arrive via env (never in this
+# file).
+include file("/data/genesis.gen.conf")
+
+# 089 chain-spec pin: the canonical hash of the genesis file IS the chain's genesis
+# block id. Joiners set this to their verbatim copy — any drift refuses to boot.
+ce.evolver.genesis-file = "/data/genesis.gen.conf"
+
+ce.evolver.node {
+  private-key = ${?EVOLVER_PRIVATE_KEY}   # Ed25519 PKCS#8 (host secret, from node-init.sh)
+  bls-secret  = ${?EVOLVER_BLS_SEED}      # BLS IKM       (host secret, from node-init.sh)
+}
+
+evolver.peer-discovery {
+  # What this node ADVERTISES about ITSELF to peers — not somewhere it connects to.
+  # This chain is standalone (one node, its own genesis, no seeds) so nothing reads
+  # these; localhost is used because the alternative is advertising an address that
+  # is not this node. They named devnet.mcsherrylabs.com purely because this config
+  # was copied from that deployment. Joining a real chain means setting them to the
+  # ROUTABLE p2p transport (raw TCP mTLS :7000) and HTTPS API your peers can dial.
+  # 163 — `host:port`, no scheme: the transport is raw TCP + mTLS and never was a URL.
+  transport-address       = "committee:7000"
+  # No `peer-url`: this chain is one node, so nothing fetches content from it, and the
+  # plain-HTTP :8440 above could not serve a peer anyway — a content fetch carries the
+  # caller's client certificate and needs the node's OWN TLS listener. Joining a real
+  # chain means setting `transport-address` to the routable :7000 and `peer-url` to this
+  # node's https listener (never a reverse proxy: it presents no client certificate).
+  gossip-interval-seconds = 60
+}
+
+# Chain-wide consensus params (n-nodes, block-time, quiescence, ...) come from the
+# included chain spec — do NOT set them here, they must stay byte-identical on every
+# node. Only node-local knobs below.
+ce.evolver.consensus {
+  validate-chain-on-startup = false
+
+  # Reactivity (node-local, always on since #28): on incoming work the leader proposes
+  # IMMEDIATELY rather than waiting out the (5-minute) idle heartbeat — tx latency stays
+  # sub-second despite slow idle.
+  wake-on-work {
+    forward-watermark = 16
+  }
+}
+
+data.base       = "/data/chain"
+state.snapshots = "snapshots"
+# PLAIN HTTP on 8440 for everything that TALKS to this node, deliberately. The HTTPS
+# listener presents the node's IDENTITY certificate — self-signed, and valid for ~13
+# MINUTES, because it is a peer authentication credential and not a web certificate. No
+# browser can be made happy with that: an exception you click through expires before you
+# finish reading the page. Tolerating it in code means NODE_TLS_REJECT_UNAUTHORIZED=0,
+# which disables verification PROCESS-WIDE for every host — a bad habit to ship in a
+# template.
+#
+# TLS on 8441 for PEERS, because the content cache needs somewhere mTLS to live: its peer
+# route identifies callers by client certificate and the node refuses to start content
+# without a TLS listener. Before evolver v0.16.0 those were the same listener, so
+# "hold documents" and "put every client on an unpinnable certificate" were one decision.
+# They are not, and this is what that separation looks like in a deployment.
+http.port       = 8440
+# ⚠️ REQUIRED since evolver #131: the plain API listener now defaults to 127.0.0.1. The app
+# container reaches this node over the CONTAINER NETWORK, which is not loopback from the
+# node's point of view — without this line the app gets connection refused and the node
+# logs nothing unusual. "0.0.0.0" is what this deployment effectively had before.
+http.bind-host  = "0.0.0.0"
+https.port      = 8441
+evolver.grpc.port = 9000
+
+# 139 — CONTENT, so a detail document announced on this chain can actually be fetched.
+#
+# `bind-host` is what lets a SIBLING CONTAINER reach the publish/read route: it is
+# authorized by what can reach it, and the default (loopback) means "inside this node's
+# container and nowhere else". 0.0.0.0 here says: this compose project's network is the
+# boundary. It holds because the port below is published to 127.0.0.1 only.
+ce.evolver.content {
+  enabled   = true
+  http-port = 8450
+  bind-host = "0.0.0.0"
+}
+
+chainDb {
+  datasource {
+    driver                    = "org.hsqldb.jdbc.JDBCDriver"
+    user                      = "sa"
+    pass                      = ""
+    maxPoolSize               = 5
+    connectionProperties      = ""
+    cachePrepStmts            = true
+    prepStmtCacheSize         = 250
+    prepStmtCacheSqlLimit     = 2048
+    connectionTimeout         = 5000
+    useServerPrepStmts        = false
+    transactionIsolationLevel = "TRANSACTION_READ_COMMITTED"
+  }
+  viewCachesSize  = 50
+  useShutdownHook = false
+  freeBlobsEarly  = false
+}
+ce.evolver.execution.enabled = false

package/dist/installer/genesis.devnet.conf

@@ -0,0 +1,92 @@
+# devnet genesis — the committee, plus SEED NODES (170).
+#
+# ⚠️ THIS FILE IS THE CHAIN'S IDENTITY. Its canonical hash is the genesis block id, so any edit
+# here produces a DIFFERENT CHAIN. Every node must hold a byte-identical copy; a node with an
+# older one does not disagree politely, it cannot join at all.
+#
+# ── Why the seed entries exist (170, issue #121) ────────────────────────────────────────────
+# A node starting with an empty volume can only learn a peer's ADDRESS from this file, and can
+# only VERIFY a peer whose key is already in its chain state — which, before it has synced, is
+# also only this file. Both roads lead here. Before 170 this file named one node, the committee,
+# whose `allowed-inbound` is deliberately full, so a newcomer could reach nothing it was able to
+# trust and nothing it was able to trust would accept it. No configuration could fix that.
+#
+# A `quorum-weight = 0` entry is present-and-trusted WITHOUT being on the committee: it is seeded
+# as an identity, its Ed25519 key becomes verifiable, and its address becomes dialable — while
+# `seedGenesis` keeps it out of the quorum store and leader rotation filters it out of the
+# proposer set. That is the whole mechanism; no new key, no new trust path.
+#
+# ⚠️ The two front nodes keep the names they already had. They were NOT in genesis before, so a
+# chain rebuild would have reassigned their names and invalidated every pin across the estate and
+# the published installer. Pinning them here makes the names stable by construction.
+ce.evolver.genesis.nodes = [
+  # ── the committee ──────────────────────────────────────────────────────────────────────────
+  {
+    node-id        = "devnet1-node0"
+    host           = "devnet.mcsherrylabs.com"
+    port           = 7000
+    public-key     = "MCowBQYDK2VwAyEAxTC3mipBz3Ae6nkUzORWLAco21eX3iSSC+QEUSbJMCs="
+    bls-public-key = "rCrpHeLH85ECkow6A58I54fjvtCmOHfdm1llPrish+aD49l32sBciyYAzytRxwak"
+    quorum-weight  = 1000
+  },
+
+  # ── seed nodes: weight 0, so present and trusted but never voting, never leading ───────────
+  #
+  # ⚠️ Keys are the ones these two nodes ALREADY hold, read from their own /status. Their host
+  # secrets are untouched and stay where they are — only the public halves appear here.
+  {
+    node-id        = "evolvermeerkatnode920080"
+    host           = "65.21.255.224"
+    port           = 7100
+    public-key     = "MCowBQYDK2VwAyEAvDNSSDsSYRHfvFCOcl/Fba89VnBrkLzYBy28xqjg8Zg="
+    bls-public-key = "iJZMbE+J+TnNnHpYxk2lQDJipTvvUg0qCQNVJViTfoatqZkqazLCZbUmSP4W26Vj"
+    quorum-weight  = 0
+  },
+  {
+    node-id        = "schednode2"
+    host           = "65.21.255.224"
+    port           = 7200
+    public-key     = "MCowBQYDK2VwAyEAvUOp3fA1nTjv546jme0n14wYDVjHshLL3I7XpQxQ8V4="
+    bls-public-key = "ht3U8qRoQtKIU0NUbuuwx/ni4iF+rcAs2dJgxDOcf+YOs+brlSKSnC2XBFBp1rR1"
+    quorum-weight  = 0
+  },
+
+  # ⚠️ devnet-seed-3 IS NEVER DEPLOYED, ON PURPOSE, AND MUST STAY THAT WAY. A list of seeds is
+  # only worth having if a dead entry is walked past rather than waited on, and a seed that is
+  # permanently absent tests that on every single join instead of on the one afternoon somebody
+  # remembers to stop a live one. Its private key material was generated in a throwaway container
+  # and destroyed with it — nobody can bring this node up, which is the point. `.invalid` is
+  # reserved by RFC 2606 and can never resolve, so the attempt fails fast instead of hanging.
+  # If you are reading this because something reports it unreachable: that is the test passing.
+  {
+    node-id        = "devnet-seed-3"
+    host           = "devnet-seed-3.invalid"
+    port           = 7300
+    public-key     = "MCowBQYDK2VwAyEAHY2onS4+fZss0VZaT84AMcQQugILPagvBm3PFDE5cYY="
+    bls-public-key = "oO91EyEt4jvpP3XuuNiT+6F/9djCjAqgs/+e7eI64eGz9iRCcHT5HY17coLLKfsk"
+    quorum-weight  = 0
+  }
+]
+
+ce.evolver.consensus {
+  # ⚠️ ONE voting node. This is the committee size, not the number of genesis entries — the three
+  # seed entries above carry weight 0 and are not counted (NodeBootstrap derives the consensus
+  # cluster size with the same `quorumWeight > 0` filter the quorum store and leader rotation
+  # already use; before 170 it counted every entry, which would have put the relay threshold
+  # beyond anything a one-member committee could reach).
+  n-nodes                   = 1
+  block-time-ms             = 600
+  round-timeout-ms          = 1500
+  block-reward-tokens       = 10000   # generous dev reward: the faucet (5000/identity) is funded from the FIRST blocks, even under quiescence
+  snapshot-interval-blocks  = 0       # single-node: no snapshot cadence; joiners sync from block 0
+  identity-sponsorship-cost = 100
+
+  # Low idle disk-write: after 3 empty blocks the leader lingers on a 5-MINUTE heartbeat
+  # instead of the 600ms cadence (#31: idle-heartbeat-ms > block-time-ms activates quiescence);
+  # wake-on-work (node-local, always on) still proposes immediately on incoming txs.
+  # CHAIN-WIDE — identical on every node by construction.
+  quiescence {
+    idle-heartbeat-ms       = 300000
+    idle-after-empty-rounds = 3
+  }
+}