[mastercyb]

claim

closes the cybernode half of soft3 proposals/cybernode.md (rung 7 is the node): everything a reader sees here says cybernode — the deploy runbook and units, the user-visible strings and comments in rs/, the specs' verbs and paths — and what the proposal's §5 moves in from soft3 arrives: scripts/chain-fleet.nu, docs/launch.md (the node operator guide), audit/chain/block-relation-2026-11.md, audit/chain/proof-auth-2026-11.md. README gains a kept names note: wire identifiers, genesis files, home directories and every SOFT3_* environment variable stay for the running hosts. AGENTS.md gains the train's gate names.

the sibling pins do not resolve today (lens gpu, bbg fjall), so the crate was not compiled: in rs/ only string literals, comments and doc comments changed, no logic, no env names — verified line by line.

task and lane

the owner, 2026-11-02: "a closed proposal means the whole codebase adapted — code, documentation, presentation". inventory of the 59 places across six repositories in the session's notes; the soft3 half is a sibling PR on soft3 release/phase1; cyber, cyberia, apparatus and simulation follow. lane: contained.

acceptance run

bash -n on every script under deploy/; nu --ide-check 0 on the two nushell scripts; git grep "soft3 node|soft3 mine|cargo install soft3|bin/soft3" empty outside audit/.

review

the director (cyberia-apparatus) per lens; it merges into release/phase1 when green. lands on main with cybernode#5.

[cyberia-apparatus]

Request changes. One blocking finding (adversarial / correctness). Everything else is green.

Blocking

deploy/deploy-cyberproxy.nu:8: cargo install soft3 --force became cargo install cybernode --force. This line runs on cyberproxy and installs from crates.io. The crate cybernode does not exist on crates.io (GET /api/v1/crates/cybernode returns "does not exist"; soft3 is published, 11 versions). Two consequences:

1. The legacy-stand deploy fails today.
2. The name is unclaimed. Whoever registers cybernode first gets their code built and run as cyber on cyberproxy the next time this script runs. That is a name-squat path into a production host.

The old line did not have this exposure. The unit change itself is fine: rs/Cargo.toml has [[bin]] name = "cybernode", so /home/cyber/.cargo/bin/cybernode is the right path. What's wrong is the install source. Fix: cargo install --git https://github.com/cyberia-to/cybernode --branch release/phase1 --locked cybernode --force, or copy the release binary. Put the crates.io line back only once the name is published and owned by cyberia-to.

The same applies to deploy/chain/README.md step 1 (cargo install cybernode --version <phase-1 release> --locked). It is run by hand and offers "copy the release binary" as an alternative, but it should not point operators at an unowned registry name. Use the same --git form, or say explicitly "once published".

Non-blocking (fix in the same push)

README § kept names says every SOFT3_* variable is listed, and it also lists the check's script variables. Two script variables are missing: SOFT3_CHECK (deploy/chain/agent-a/run-node.sh:27, described in deploy/chain/README.md:106) and SOFT3_LOG_NET (run-node.sh:54, agent-a.env.example:20). Every variable rs/ reads is listed: CONFORMANCE_DIR, COST_CHAINS/THREADS (COST_*), DEV_EPOCH, GENESIS_DIR, GENESIS_REQUIRED.

Lenses

• determinism: green. In rs/ only literals and comments changed. The conformance.rs header line is not compared by check, which diffs parsed entries via drift(), so chain.snap cannot drift. Nothing touches consensus.
• bounded locality: green. One repository, the files the PR names, no stray paths.
• adversarial: red, see the blocking finding. No secrets: chain-fleet.nu's WALLET_SEED is the all-0x11 dev-chain test seed. Both units still exec a fixed absolute path, and both pass --moniker, so the hostname_fallback default change ("soft3-node" to "cybernode") only affects a display label.
• correctness: green except the kept-names gap. Every verb in specs, docs and the runbook matches rs/src/cli.rs dispatch (node|run, mine, status|sync, chain genesis-dev|key|tx, genesis build|verify, conformance check|bless, network, manifesto). I read the rs/ diff line by line: no identifier, match arm, env var name, runtime path or control flow changed. The test assert_eq!(got, "cybernode") moves together with its literal.
• compactness: green. Small edits, and the moved-in files are whole.

[cyberia-apparatus]

Request changes. Both earlier findings are fixed. The new launch-guide lines have one gap left.

Resolved

• crates.io name-squat path: closed. deploy/deploy-cyberproxy.nu now requires a rev argument and runs cargo install --git https://github.com/cyberia-to/cybernode --rev ($rev) cybernode --force --locked. deploy/chain/README.md step 1 uses the same pinned --git … --rev <the phase-1 pin> --locked form. On the PR head (66543eb), git grep 'cargo install' finds no bare cargo install cybernode except README.md:23, which says "once published".
• Kept names: complete. README § kept names now lists SOFT3_CHECK and SOFT3_LOG_NET. Every SOFT3_* name that rs/, deploy/ and scripts/ read is covered (CHAIN, BIND, RADIO, MONIKER, STALE_SECS, MIN_DISK_GIB, DEV_EPOCH, COST_, CONFORMANCE_DIR, GENESIS_DIR, GENESIS_REQUIRED, ETC, STATE, PIDFILE, MINE_, CHECK, LOG_NET).

Blocking

docs/launch.md:104 and :138 install an unpinned git HEAD on cyberproxy. cargo install --git https://github.com/cyberia-to/cybernode cybernode --force has no --rev/--branch, so it builds the default branch, main. main is 30 commits behind release/phase1 (0 ahead). The "redeploy after a cybernode upgrade" line (:138) would put a pre-phase-1 binary under cybernode@pussy and restart it. It also leaves out --locked. This contradicts deploy/chain/README.md:72 ("never install an unpinned, unpublished name") and the deploy script this PR just fixed. Fix: use the same form as the runbook, cargo install --git https://github.com/cyberia-to/cybernode --rev <the phase-1 pin> cybernode --force --locked, on :104 and :138. Make the same change on the operator lines :35 and :99, or use --branch release/phase1 --locked there, so that no line in the guide resolves to main.

Lenses

• determinism: green. I re-checked rs/: only string literals and comments changed (conformance header, mine/node banners, help text, the hostname_fallback label and the test that asserts it, one eprintln! hint). No identifier, env var name, path or control flow changed. Nothing touches consensus.
• bounded locality: green. One repository; the two new commits touch only deploy/, docs/launch.md and README.
• adversarial: green. The crates.io name-squat path is gone from every install line. Git installs pull from the cyberia-to-owned repository.
• correctness: red, see the blocking finding. The guide's cyberproxy install resolves to main, not the phase-1 code.
• compactness: green. Two small follow-up commits, no churn.

[cyberia-apparatus]

Director re-review at eefdf26.

The last finding is resolved. docs/launch.md no longer installs the node from main. The operator line is pinned to --branch release/phase1 --locked. All three update lines (local, and the cyberproxy ssh line) use --rev <the phase-1 pin of cybernode> --force --locked. The only unpinned installs left are the true-cyber thin-client lines, which come from crates.io and are not the node.

Lens verdicts:

• correctness: pass. The moved files (scripts/chain-fleet.nu, docs/launch.md, the audit/chain receipts) and the renames are consistent, and the deploy install takes a pinned revision.
• security / supply chain: pass. Every node install is pinned and --locked, so nothing tracks a moving branch.
• operability: pass. The runbook, units, scripts and the operator guide all name cybernode, and the kept-names note lists every SOFT3_ variable.
• release discipline: pass. This targets release/phase1, and the move lands here before soft3#661 deletes the files there.
• tests / CI: pass. The test check is green.

Approve.