Run a sealer

One page, from the public materials alone: a node of your own that syncs the public test network, bonds a mining bonded key and seals blocks when the draw selects it. Every command runs as written on Ubuntu 24.04. Nothing here needs a word from the team. Steps 1, 2, 3, 4 and 6 are the lines a rented machine ran from the public store and the feed on 12 October 2026; two things are written from the materials and not yet from a public run, and each says so where it stands: the proof program the sealer needs (not in the release store yet) and the bond through the faucets (step 5).

What you need: a Linux machine with an NVIDIA GPU (the block's proof runs on the card, about a fifth of a second a block; the keyed search runs on eight CPU threads, one 2 GiB context each), a public address with one TCP and UDP port open, 60 GB of disk, curl, jq and python3. The chain: chain id 7319, network id 7391, 20-second blocks, genesis 0xeae5e6083195fe58658b1f13771362b19a38a0bffb5c8808d458993ee9f54ea1.

1. The node release, checked against its signature

The status feed names the current release every minute; the release store holds it with its builders' manifests and a signature over its sums by the release key.

mkdir -p ~/igneum && cd ~/igneum
REL=$(curl -fsSL https://build.igneum.network/feed/devnet9/index.json | jq -r .current_release.store)
curl -fsSLO "$REL/SHA256SUMS" && curl -fsSLO "$REL/MANIFEST.json"
BIN=$(jq -r '.builders[0].manifest' MANIFEST.json | sed 's/\.manifest-.*//'); curl -fsSLO "$REL/$BIN"
grep " $BIN$" SHA256SUMS | sha256sum -c -
curl -fsSLO https://build.igneum.network/keys/allowed_signers
curl -fsSL "$REL/SHA256SUMS.sig" -o SHA256SUMS.sig && ssh-keygen -Y verify -f allowed_signers -I igneum-release -n igneum-release -s SHA256SUMS.sig < SHA256SUMS
chmod +x "$BIN" && ln -sf "$BIN" geth && ./geth version | head -3

If SHA256SUMS.sig is not beside the release yet, the store says "unsigned candidate; sha256 published": the sum check above is what you have, and the signature check runs the day the file is there. MANIFEST.json names the two builders whose builds were byte-identical.

2. The genesis set and the bootnode line

Five files and one enode, each checked against the sum the feed's index names; the enode goes into the node's static peers as well as its bootnode list, so a node that finds no peer by discovery still dials it.

mkdir -p ~/igneum/devnet9/data/geth && cd ~/igneum/devnet9
curl -fsSL https://build.igneum.network/feed/devnet9/index.json -o index.json
for f in params.json schedule.json authority.json sortition.json difficulty.json enode; do curl -fsSL "https://build.igneum.network/feed/devnet9/$f" -o "$f"; done
for f in params.json schedule.json authority.json sortition.json difficulty.json; do echo "$(jq -r ".files[\"$f\"]" index.json)  $f"; done | sha256sum -c -
python3 -c "import json; print(json.dumps([l.strip() for l in open('enode') if l.strip()]))" > data/geth/static-nodes.json
cat enode

3. The node key, the bond seed and the wallet, made on your machine

Two 32-byte secrets that never leave this machine: the node key (the node's bonded key on the network) and the bond seed (the node derives the mining bonded key the registry knows from it, and signs the blocks it seals with it). Then a wallet whose address receives what the node earns and posts the bond: its words shown once, its password in a file only you can read.

cd ~/igneum
( umask 077; head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n' > nodekey; echo "0x$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')" > bondseed )
W=https://build.igneum.network/releases/wallet/0.0.3-19e227fd
curl -fsSLO "$W/igneum-wallet-linux-x86_64-0.0.3-19e227fd.tar.gz" && curl -fsSL "$W/SHA256SUMS" | grep ' igneum-wallet-linux-x86_64-0.0.3-19e227fd.tar.gz$' | sha256sum -c -
tar -xzf igneum-wallet-linux-x86_64-0.0.3-19e227fd.tar.gz && ln -sf igneum-wallet-linux-x86_64-0.0.3-19e227fd/bin/igneum-wallet igneum-wallet
( umask 077; read -rsp 'a password for the wallet: ' PW; echo; printf '%s' "$PW" > wallet.pw )
./igneum-wallet create --vault wallet.json --password-file wallet.pw     # 24 words shown once; keep them
ADDR=$(./igneum-wallet address --vault wallet.json | tail -1 | jq -r .address); echo "$ADDR"

Keep bondseed as you would keep the wallet's words: whoever holds it holds the bond.

4. Start the node and let it sync

The line a rented sealer ran, with the proof program's path as the one thing still to come from the release store: the block's proof runs on the GPU in a separate program the sealer starts under --igneum.pi-prover; it is not in the public store yet (the day it is, its download and sum check go here, and the flag takes its path). Without it the same line, minus --igneum.pi-prover, runs a plain node that syncs and verifies and seals nothing. The port (here 26611, TCP and UDP) must be reachable from outside at the address you give --nat; on a rented container give the provider's mapped port.

cd ~/igneum && EXT=$(curl -fsSL -4 https://api.ipify.org) && ADDR=$(./igneum-wallet address --vault wallet.json | tail -1 | jq -r .address)
nohup ./geth --dev --dev.chainid 7319 --dev.algorithm igneumhash \
  --dev.algorithm.params "$(cat devnet9/params.json)" --dev.algorithm.schedule "$(cat devnet9/schedule.json)" \
  --dev.authority "$(cat devnet9/authority.json)" --dev.sortition "$(cat devnet9/sortition.json)" --dev.difficulty "$(cat devnet9/difficulty.json)" \
  --dev.bondseed "$(cat bondseed)" --dev.bondkey keyed --nodekey "$PWD/nodekey" --dev.p2p --networkid 7391 --port 26611 --nat "extip:$EXT" --maxpeers 24 --nodiscover \
  --igneum.pi-verify --igneum.pi-prover "$PWD/pi-prove" --dev.cpuseal=true --miner.threads 8 --miner.seal-stagger 2000 --miner.gaslimit 16000000 --miner.etherbase "$ADDR" --dev.period 10 \
  --datadir devnet9/data --http --http.addr 127.0.0.1 --http.port 8608 --http.api eth,net,web3,igneum > node.log 2>&1 &
echo $! > geth.pid

The sync shows in the log as "Imported new chain segment number=N"; the head against the public head:

grep "Imported new chain segment" node.log | tail -1
curl -s -X POST -H 'Content-Type: application/json' --data '{"jsonrpc":"2.0","id":1,"method":"eth_blockNumber","params":[]}' http://127.0.0.1:8608
curl -s -X POST -H 'Content-Type: application/json' --data '{"jsonrpc":"2.0","id":1,"method":"eth_blockNumber","params":[]}' https://rpc.igneum.network
curl -s -X POST -H 'Content-Type: application/json' --data '{"jsonrpc":"2.0","id":1,"method":"net_peerCount","params":[]}' http://127.0.0.1:8608

Equal heads and a peer count above zero: synced. A node with no peer seals its own chain from block 1 and none of it counts; nothing you seal counts until your head matches the public RPC's. The genesis hash your node reports must be the one at the top of this page (eth_getBlockByNumber with "0x0"); any other and you are on another chain.

5. The bond: test IGN from the two faucets, then the registry

Test IGN to pay the gas, the bond faucet's draw for the bond itself (a bond's worth and its fee at the epoch's unit price, about 87 IGN; once per bonded key and once per address), then the bond from the wallet's account, which is the account that releases it. A unit's price moves with the epoch (28.76 IGN at epoch 1,537), so the amount below buys the units the wallet's draw shows, two today. KEY is the mining bonded key your node derived from the bond seed, read from the node itself. This step is written from the materials: the rented sealers of 12 October were bonded another way, and no public run has taken it yet.

cd ~/igneum && ADDR=$(./igneum-wallet address --vault wallet.json | tail -1 | jq -r .address)
KEY=$(curl -s -X POST -H 'Content-Type: application/json' --data '{"jsonrpc":"2.0","id":1,"method":"igneum_sortition","params":[]}' http://127.0.0.1:8608 | jq -r .result.bondKey); echo "$KEY"
curl -s -X POST -H 'Content-Type: application/json' --data "{\"address\":\"$ADDR\"}" https://build.igneum.network/devnet9/faucet
curl -s -X POST -H 'Content-Type: application/json' --data "{\"address\":\"$ADDR\",\"key_hash\":\"$KEY\"}" https://build.igneum.network/devnet9/faucet/bond
./igneum-wallet bond --rpc http://127.0.0.1:8608 --vault wallet.json --password-file wallet.pw --key "$KEY" --amount 86
./igneum-wallet draw --rpc http://127.0.0.1:8608 --key "$KEY"

draw prints the bond's units, its share of the bonded total and the round at which the bonded key is eligible at the next height, recomputed from the chain's seed beside the node's own reading. The bond is locked for 200 blocks from the block that carried it (the chain's lockBlocks); a top-up at any time never moves the lock. The wallet's bond builds the registry transaction itself: the amount as the value, the 32-byte key as the data.

6. The one check that the node seals

curl -s -X POST -H 'Content-Type: application/json' --data '{"jsonrpc":"2.0","id":1,"method":"igneum_sortition","params":[]}' http://127.0.0.1:8608 | jq '.result | {bondKey, units, bond, total, eligibleRound, epoch}'
grep -E "mined potential block|Imported new chain segment" node.log | tail -4

Your key enters the draw's table two epochs after the bond is posted; from then units above zero is the registry seeing your bond and eligibleRound is the round the draw gives you at the next height (round 0 comes before the rest). The sealer's line is "mined potential block number=N" followed by "Imported new chain segment number=N" at a height equal to the public RPC's head; the block shows your bonded key as its sealer on https://explorer.igneum.network. Without a bond the node seals only the open seat, with the same two lines once synced.

7. The exit

At or past the earliest exit height (the block that carried the bond plus 200), the bond's account releases the bonded key with one transaction to the registry (0x0000000000000000000000000000000000000b0d): the byte 0x12 followed by the 32-byte key, no value. The whole bond goes to the registered exit address (the bond's account unless it set another) and the key never bonds again.

./igneum-wallet send --rpc http://127.0.0.1:8608 --vault wallet.json --password-file wallet.pw --to 0x0000000000000000000000000000000000000b0d --amount 0 --data "0x12${KEY#0x}"
./igneum-wallet draw --rpc http://127.0.0.1:8608 --key "$KEY"

Stop the node with kill -INT $(cat geth.pid); it resumes from its data directory on the same line.

---

The feed's status page (https://build.igneum.network/feed/status.json) carries the current release and any notice; a reset of the network means a new genesis set from step 2 and a fresh data directory.