SOVEREIGN_NODE_KEY.md

Sovereign Node Key — Production Authorization Credential

To run PAX-Coder in production you must hold a provisioned Sovereign Node Key.

A Sovereign Node Key is an Ed25519 keypair + operator-signed authorization record that grants production authorization for protected operations. The PAX-Coder authority signs the authorization; the node cannot self-authorize.

---

What a Node Key Grants

A provisioned Sovereign Node Key authorizes a specific workstation/node to:

• ✓ Sign production releases
• ✓ Deploy production kernels
• ✓ Perform protected operations within your authorized scope

---

Commercial Pricing Model

Production-authorized nodes are available through commercial tiers:

Tier	Price	What You Get
Individual Node	$250–$500	One production-authorized node (one workstation)
Commercial Team	$12,000–$25,000/year	Unlimited production-authorized nodes within your organization
Enterprise	$50,000–$150,000+/year	Custom audits, white-label rights, direct SLA

---

How to Get a Production-Authorized Node

Step 1 — Request Access

Submit provisioning request at:

• Form: CONTACT.md
• Email: jessica@collectivekitty.com

Include:

• Your name/organization
• Intended use case
• Requested tier
• Deployment requirements

Step 2 — Approval

PAX-Coder reviews and approves or denies (1–3 business days).

Step 3 — Generate Your Ed25519 Keypair (or operator generates one for you)

# Generate keypair (standard Ed25519)
openssl genpkey -algorithm Ed25519 -out node_sk.pem
openssl pkey -in node_sk.pem -pubout -out node_pk.pem

# Extract raw 32-byte keys
openssl pkey -in node_sk.pem -outform DER | tail -c 32 > node_sk.bin
openssl pkey -in node_pk.pem -pubin -outform DER | tail -c 32 > node_pk.bin

Send your public key (node_pk.bin as hex or base64) in the email. We register it in the Bifrost WORM ledger and return your signed node certificate.

Step 3 — Run with your key

# Ollama — set node key as env var
export PAX_NODE_KEY="$(xxd -p node_sk.bin | tr -d '\n')"
ollama run pax-coder "Write a verified GEMM kernel"

# Python — pass key at init
from pax_coder import PAXCoder
model = PAXCoder(node_key_path="node_sk.bin")

---

How the Key Works Technically

Every output PAX-Coder seals is signed with your node key via Ed25519:

output_hash  = Blake3(lean_proof || ptx_kernel || futhark_spec || pax_certificate)
signature    = Ed25519_sign(node_sk, output_hash)
worm_entry   = { hash, signature, node_pk, timestamp, tier }

The WORM ledger records your public key against every output you seal. Anyone can verify: Ed25519_verify(node_pk, output_hash, signature).

Your contributions are cryptographically timestamped and permanently attributed.

---

What the Key Does NOT Do

• It does not phone home. The key runs entirely local.
• It does not restrict what kernels you generate.
• It does not expire (Node tier keys are perpetual).
• It does not require internet access to verify locally.

---

Registering Your Key

After receiving your signed node certificate, register it:

# Register in local PAX keystore
pax-coder register --cert node_cert.json --pk node_pk.bin

# Verify registration
pax-coder verify-key --pk node_pk.bin
# → Node registered: FORGE tier · WORM block #4821 · 2026-08-17

---

Enterprise API Access

Enterprise tier ($5,000/yr) includes access to the pax-verify REST API:

# POST a kernel for remote verification
curl -X POST https://api.collectivekitty.com/pax-verify \
  -H "Authorization: Bearer $PAX_ENTERPRISE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"lean_proof": "...", "ptx_kernel": "...", "target_arch": "sm_86"}'

# Response:
# {
#   "verified": true,
#   "obligations": ["PO1", "PO3", "PO5", "PO8"],
#   "worm_seal": "blake3:a3f8...",
#   "certificate": "ed25519:..."
# }

---

Bel Esprit D'Accord Irrevocable Trust · SnapKitty West · EIN 42-6976431 Evidence or Silence — 2026