Host a peer without becoming the authority.

READ is the default

vhalla public serve BOOTSTRAP PIN64 KEY_DIR JOURNAL NEW_PEER_STATE HTTPS_ENDPOINT ALLOWED_ORIGIN --new-state

The key directory must already exist. This creates advertisement state, validates the pinned bootstrap and local journal origin, then binds loopback HTTP. Existing state is reopened by omitting --new-state. The command does not create an identity, issue a room policy or write the consensus journal.

Explicit public activity opt-in

Create storage separately. Its full scope comes from your pinned bootstrap and explicitly selected room ID; creation alone does not establish that the room exists.

vhalla public activity-store-init BOOTSTRAP PIN64 ROOM64 NEW_STORE 100000 268435456

vhalla public serve BOOTSTRAP PIN64 KEY_DIR JOURNAL NEW_PEER_STATE HTTPS_ENDPOINT ALLOWED_ORIGIN --new-state --activity-store ROOM64 STORE 100000 268435456

Repeat --activity-store for at most 32 distinct rooms. The sample limits mean 100,000 local events and 256 MiB of accounted immutable history; filesystem and transaction overhead require additional free space. These are examples, not measured production capacity recommendations.

Reopen with the same full room IDs, absolute store paths and limits, omitting --new-state. Ordering may differ. An immutable marker prevents accidental downgrade or an in-place upgrade of a READ publisher. Missing stores, changed configuration or corrupt mode evidence fail closed.

Provide the transport deliberately

The listener remains loopback. Operate TLS at the exact advertised HTTPS endpoint, whose base path is /vhalla/v1. Configure the exact browser origin; the development loopback-origin flag is a separate opt-in.

• Preserve request targets, response bytes and proof headers. Disable shared caching.
• Apply connection, body, bandwidth and per-client rate limits at the proxy.
• Permit the bounded activity GET/POST/OPTIONS route only when explicitly enabled.
• Do not treat CORS, cookies or a relay’s hostname as room authorization.

Keep the durable renewal state

Advertisements last 24 hours and renew with 12 hours remaining. Sequences are durably reserved, not derived from wall-clock time. Uncertain publication poisons the running writer; reopen reconciles the exact retained evidence and skips reserved sequences.

Do not delete counters, mode markers, journals or intents to bypass a refusal. Torn initial creation is preserved for investigation. Expiry, clock rollback, disk exhaustion and corrupt evidence must surface rather than silently reset identity history.

Discovery is a separate service

The bounded discovery registry accepts independently signed advertisements and requires computational admission work for unknown keys. Listings contain candidates, not approved identities or validators. Native registration uses explicitly selected seeds; browser candidates are not dialed until selected. discovery-serve remains READ-only in the current CLI.

The registry holds at most 512 active/cooling keys and lists at most 16 per page. Active Sybil saturation can still deny new keys. Finite-horizon retired floors are not a lifetime rollback guarantee.

Peer/proxy protocol contract ↗ · Discovery and operator commands ↗