# Read-only independent operator measurements — off-mainnet only

Start from the published qualification source archive SHA256 `6568bac8d7dceaf0d96bb564e598cfc4fb48d65158badebced01c924a9049d93`, installed into your own new unprivileged directory with pinned dependencies. This supplement changes no consensus source or economic rule.

Download [SHA256SUMS](./SHA256SUMS) and the five files listed there, using the paths relative to this directory. Obtain checksum confirmation independently; adjacent checksums are not an established maintainer signature. Verify every file. Copy each file into the same relative path under your extracted source directory, only if absent; stop on collisions. No services, wallets or production credentials are installed. The existing 70-case/five-TLS-phase evidence concerns the frozen candidate. Ten additional readiness unit tests passed locally; four further own-key attestation unit cases reject foreign reports, financial-authority claims and public key-file permissions, including compound history validation with **mocked transport**; no external WAN pass is inferred.

Source files:

- [collect_operator.py](./native-work-correction/activation/launch-contract/collect_operator.py)
- [attest_compound.py](./native-work-correction/activation/launch-contract/attest_compound.py)
- [resource_assessment.py](./native-work-correction/activation/launch-contract/resource_assessment.py)
- [RESOURCE-INPUT.json](./native-work-correction/activation/launch-contract/RESOURCE-INPUT.json)
- [existing operator input/report/signature codec](./native-work-correction/activation/mission-20261112/operator_evidence.py)

Each participating operator chooses 2..4 consenting independently chosen public numeric HTTPS off-mainnet peers. Obtain their public certificates through checked channels, pin SHA256, and qualify your own TLS edge/firewall/sandbox/recovery before public exposure. Never disable TLS verification. Current Gamma/Seed addresses and actual mainnet bootstrap are refused by these tools. Use only synthetic history/funds and explicit public test workloads.

`PUBLIC_OPERATOR_INPUT.json` has exactly these keys: schema=`computenet.external-qualification-input/v1`, alias (public safe string), operator_public_key (own public Ed25519 key), bootstrap_sha256 (trusted public synthetic compound bootstrap digest), independently_administered (truthful boolean claim), monthly_cost (null or redacted actual quote with currency/amount/quote_sha256), resource_commitment (null or actual vcpus/memory_mib/disk_mib/committed_days), peers (2..4 objects containing origin/ca_file/ca_sha256). Do not put keys/tokens/identity documents in this file. Hardware and funding claims still require independent checks.

From the extracted root:

```
python3 native-work-correction/activation/launch-contract/collect_operator.py --config PUBLIC_OPERATOR_INPUT.json --bootstrap PUBLIC_SYNTHETIC_BOOTSTRAP.json --output NEW_REPORT.json
python3 native-work-correction/activation/launch-contract/attest_compound.py --directory OWN_PRIVATE_SYNTHETIC_NODE --report NEW_REPORT.json --output OWN_SIGNED_STATEMENT.json
python3 native-work-correction/activation/mission-20261112/operator_evidence.py verify --report NEW_REPORT.json --statement OWN_SIGNED_STATEMENT.json --bootstrap-sha256 EXACT_BOOTSTRAP_SHA256
python3 native-work-correction/activation/launch-contract/resource_assessment.py ACTUAL_RESOURCE_INPUT.json --output NEW_ASSESSMENT.json
```

The collector only fetches bounded TLS status/history and validates in a disposable local view; it does not sign, propose, send money or access production. Sign your own report locally using the existing ordinary-key envelope codec; share public evidence only. A signature does not prove administrative independence. Resource inputs deliberately contain unknowns. Replace them only with actual measurements/commitments and explicitly accepted assumptions. Never infer honest resources or an attacker-cost floor from receipt counts, self-paid fees, CPU labels, simulated operators or rental quotes alone.

The assessment is off-chain arithmetic, never admission or activation authority. Its equal-work known-deficit illustration is not the double-spend probability after that many API confirmations and does not establish security of the actual delayed/variable-target protocol. Majority-resource risk remains; there is no finite unconditional confirmation guarantee. Real quotes are compatible-capacity costs, not an attacker-cost lower bound. No production parameters are automatically selected.

Return public report/source/bootstrap/runtime pins, own public identity, signed administration/resource commitment and redacted quote links in the [official intake thread](https://github.com/ComputeNetProtocol/computenet-validator/issues/1). Also measure propagation/loss, actual compatible throughput, recoverability and founder-infrastructure outage; simple client status RTT is not peer-to-peer propagation. No returns are promised, funds requested or production authority granted.