Add downloadable three-machine rehearsal flow and ceremony kit installer - #5
Merged
Conversation
…discovery, region guidance (#3) - README 'Stop': the tiny transcript is NOT blocked from finalization. finalize prepare/complete and audit compile the circuit named by the ceremony definition (compileCircuitForCeremony), so they run against rehearsal-tiny-v1. Only the production decision's exact-k21-rehearsal gate requires K=21. The old text ('proof-tool intentionally rejects tiny-circuit finalization') was wrong. - 10-coordinator-generate-operational-fixtures.sh: this optional step shells out to 'go build'; resolve the toolchain explicitly (GO_BIN, common install dirs) and fail with a clear message instead of a bare 'go: command not found' when go is off a non-login PATH (e.g. ~/.local/go/bin). - machine-1/.env.example: recommend setting AWS_REGION explicitly; SSO/AssumeRole profiles often have no default region, so blank-region endpoint discovery can silently target the wrong region.
…tributed ceremony (#4) The rehearsal co-locates roles and centralizes two things (key generation and operational-evidence generation) so it runs fast on three hosts. The README flagged this as 'not production independence evidence' but did not say what actually changes when every role is its own independently operated machine. Add a table mapping each of the three co-location shortcuts to its distributed replacement: - central keygen -> each role generates and enrolls its own key; - central operational evidence (steps 33-41) -> each witness/mirror/auditor produces and signs its own record locally (ops prepare-public-witness-receipt, mirror receipt -> ops prepare-mirror-receipt, audit); - role co-location -> one key per machine (the scripts are already identity-parameterized, so the 3-machine split is illustrative). Points to COORDINATOR_RUNBOOK.md / ROLE_RUNBOOK.md as the authority for the distributed procedure. Docs only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merges the ceremony-kit / three-machine rehearsal flow into main (13 commits):
setup --machine N) that installs verified binaries, extracts the rehearsal scripts, and prefills each machine's.env; kit archive layout verification.00-coordinator-initialize.sh(fresh signedrehearsal-tiny-v1ceremony viampc-ceremony rehearsal init), WORK_ROOT-derived layout, and the full 42-step scripted flow with measured timing tables.docs/AWS_SETUP.mdanddocs/R2_SETUP.mdplusscripts/storage-setup/(bucket creation, credential validation,.envupdate; R2 control-plane inbox-privacy checks, Wrangler OAuth or bearer-token paths).Validated on 2026-08-20 with two complete three-machine rehearsals — AWS S3 and Cloudflare R2 — all 42 steps passing on both, driven across three separate hosts.
Pairs with zksecurity/proof-tool#10 (the
rehearsal-tiny-v1circuit andrehearsal initsubcommand); relay invokesmpc-ceremonyas a binary, so there is no build-order dependency.