File size: 4,228 Bytes
ef6eb55 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 | # Sovereign Node Key — Production Authorization Credential
To run PAX-Coder in production you must hold a provisioned Sovereign Node Key.
A **Sovereign Node Key** is an Ed25519 keypair + operator-signed authorization record that grants production authorization for protected operations. The PAX-Coder authority signs the authorization; the node cannot self-authorize.
---
## What a Node Key Grants
A provisioned Sovereign Node Key authorizes a specific workstation/node to:
- ✓ Sign production releases
- ✓ Deploy production kernels
- ✓ Perform protected operations within your authorized scope
---
## Commercial Pricing Model
Production-authorized nodes are available through commercial tiers:
| Tier | Price | What You Get |
|------|-------|--------------|
| **Individual Node** | $250–$500 | One production-authorized node (one workstation) |
| **Commercial Team** | $12,000–$25,000/year | Unlimited production-authorized nodes within your organization |
| **Enterprise** | $50,000–$150,000+/year | Custom audits, white-label rights, direct SLA |
---
## How to Get a Production-Authorized Node
**Step 1 — Request Access**
Submit provisioning request at:
- **Form:** [CONTACT.md](CONTACT.md)
- **Email:** jessica@collectivekitty.com
Include:
- Your name/organization
- Intended use case
- Requested tier
- Deployment requirements
**Step 2 — Approval**
PAX-Coder reviews and approves or denies (1–3 business days).
**Step 3 — Generate Your Ed25519 Keypair** (or operator generates one for you)
```bash
# Generate keypair (standard Ed25519)
openssl genpkey -algorithm Ed25519 -out node_sk.pem
openssl pkey -in node_sk.pem -pubout -out node_pk.pem
# Extract raw 32-byte keys
openssl pkey -in node_sk.pem -outform DER | tail -c 32 > node_sk.bin
openssl pkey -in node_pk.pem -pubin -outform DER | tail -c 32 > node_pk.bin
```
Send your **public key** (`node_pk.bin` as hex or base64) in the email.
We register it in the Bifrost WORM ledger and return your signed node certificate.
**Step 3 — Run with your key**
```bash
# Ollama — set node key as env var
export PAX_NODE_KEY="$(xxd -p node_sk.bin | tr -d '\n')"
ollama run pax-coder "Write a verified GEMM kernel"
# Python — pass key at init
from pax_coder import PAXCoder
model = PAXCoder(node_key_path="node_sk.bin")
```
---
## How the Key Works Technically
Every output PAX-Coder seals is signed with your node key via Ed25519:
```
output_hash = Blake3(lean_proof || ptx_kernel || futhark_spec || pax_certificate)
signature = Ed25519_sign(node_sk, output_hash)
worm_entry = { hash, signature, node_pk, timestamp, tier }
```
The WORM ledger records your public key against every output you seal.
Anyone can verify: `Ed25519_verify(node_pk, output_hash, signature)`.
Your contributions are cryptographically timestamped and permanently attributed.
---
## What the Key Does NOT Do
- It does not phone home. The key runs entirely local.
- It does not restrict what kernels you generate.
- It does not expire (Node tier keys are perpetual).
- It does not require internet access to verify locally.
---
## Registering Your Key
After receiving your signed node certificate, register it:
```bash
# Register in local PAX keystore
pax-coder register --cert node_cert.json --pk node_pk.bin
# Verify registration
pax-coder verify-key --pk node_pk.bin
# → Node registered: FORGE tier · WORM block #4821 · 2026-08-17
```
---
## Enterprise API Access
Enterprise tier ($5,000/yr) includes access to the `pax-verify` REST API:
```bash
# POST a kernel for remote verification
curl -X POST https://api.collectivekitty.com/pax-verify \
-H "Authorization: Bearer $PAX_ENTERPRISE_KEY" \
-H "Content-Type: application/json" \
-d '{"lean_proof": "...", "ptx_kernel": "...", "target_arch": "sm_86"}'
# Response:
# {
# "verified": true,
# "obligations": ["PO1", "PO3", "PO5", "PO8"],
# "worm_seal": "blake3:a3f8...",
# "certificate": "ed25519:..."
# }
```
---
*Bel Esprit D'Accord Irrevocable Trust · SnapKitty West · EIN 42-6976431*
*Evidence or Silence — 2026*
|