LOCAL SOVEREIGN V12

# Create a Windows Task Scheduler task to restart k3d after WSL starts # Run in PowerShell on the Windows host: $action = New-ScheduledTaskAction -Execute "wsl.exe" ` -Argument "-d Ubuntu-24.04 --exec bash -c 'k3d cluster start lhvcp 2>/dev/null || true'" $trigger = New-ScheduledTaskTrigger -AtStartup $settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 5) Register-ScheduledTask -TaskName "k3d-lhvcp-autostart" ` -Action $action -Trigger $trigger -Settings $settings -RunLevel Highest -Force # Verify: after next reboot, check: # wsl -- k3d cluster list

# Belt64 ingress runs in forge lhvcp (LAN only) # Other silos push via LAN, NOT internet # From msclo: curl -X POST http://192.168.2.12:9640/push \ -H "Content-Type: application/json" \ -d '{"silo":"msclo","prime":3,"gamma1_sig":"a3f2...","batch":[...]}' # γ₁ signature = sha256(batch_json + "14.134725141734693")[:16] # This IS the auth token. No Azure AD. No JWT. Pure γ₁-signed math. # If forge is unreachable (LAN down): belt64 queues locally, pushes on reconnect # Queue path: /home/ubu-cap/openclaw-fleet/fleet-sync/belt64-queue/

# After cluster create, store kubeconfig in AKV as lifeline k3d kubeconfig write lhvcp az keyvault secret set --vault-name forge-silo-kv \ --name lhvcp-kubeconfig-forge \ --value "$(k3d kubeconfig get lhvcp)" # Restore after disaster: az keyvault secret show --vault-name forge-silo-kv \ --name lhvcp-kubeconfig-forge --query value -o tsv > ~/.kube/forge-lhvcp.yaml export KUBECONFIG=~/.kube/forge-lhvcp.yaml kubectl get nodes

# Deploy OPA into forge lhvcp (run after lhvcp is created) kubectl create namespace opa-system # OPA deployment kubectl apply -f - <<'EOF' apiVersion: apps/v1 kind: Deployment metadata: name: opa namespace: opa-system spec: replicas: 1 selector: matchLabels: app: opa template: metadata: labels: app: opa spec: containers: - name: opa image: openpolicyagent/opa:latest args: ["run","--server","--addr=:8181","--log-level=info"] ports: - containerPort: 8181 --- apiVersion: v1 kind: Service metadata: name: opa namespace: opa-system spec: selector: app: opa ports: - port: 8181 targetPort: 8181 EOF

# SOSTLE L2 CLO gate (example Rego policy) # File: policies/sostle-l2-clo.rego package sostle.l2 default allow = false # Allow if: CLO signature present + jurisdiction matches allow { input.clo_sig != "" input.jurisdiction_ok == true input.gamma1_sig != "" # gamma1_sig must start with sha256 of "14.134725141734693" startswith(input.gamma1_sig, "14") } # Deny with reason deny[reason] { not input.clo_sig reason := "CLO signature required for L2 gate" } deny[reason] { not input.jurisdiction_ok reason := "Jurisdiction check failed (PHIPA/PIPEDA/OSFI not confirmed)" }

# Create k3d registry on forge k3d registry create forge-registry.local --port 5001 # Create lhvcp cluster USING the local registry k3d cluster create lhvcp \ --port "9610:80@loadbalancer" \ --port "9611:443@loadbalancer" \ --servers 1 --agents 0 \ --registry-use k3d-forge-registry.local:5001 \ --volume /home/ubu-cap/lhvcp-data:/data@server:0 # Tag + push images to local registry docker pull eosefleetacrdev.azurecr.io/pemos/mefine-static:day94-v131 docker tag eosefleetacrdev.azurecr.io/pemos/mefine-static:day94-v131 \ forge-registry.local:5001/pemos/mefine-static:v12 docker push forge-registry.local:5001/pemos/mefine-static:v12 # Other silos pull from forge registry via LAN # On msclo: docker pull 192.168.2.12:5001/pemos/mefine-static:v12