Per-node Charter / LOTS / privacy-policy
This directory holds the live Charter, LOTS, and privacy-policy markdown for
each genesis node. Each set is signed at startup by the running node:
- Charter →
services/reference-herald/src/charter.ts(domain tagherald.charter.v1) - LOTS → same signer, domain tag
herald.lots.v1(proposed) - Canary →
services/reference-herald/src/canary.ts(domain tagherald.canary.v1), signed live on everyGET /canary
What's filled in (D-003)
The Charters and LOTS are filled in for a v0.2 single-operator UK testnet. Concrete values:
| Field | Value |
|---|---|
| Operator | Kulbir Minhas, individual researcher (sole-operator; not incorporated) |
| Country | United Kingdom |
| Jurisdiction for service of process | England and Wales |
| AWS region | eu-west-2 (London) |
| Compulsion exposure | Investigatory Powers Act 2016, UK GDPR / DPA 2018, PACE 1984, UK-US DAA 2019 (CLOUD Act partner) |
| Warrant canary | monthly, signed under herald.canary.v1, served at /canary |
| Cross-signing | each node lists the other two by name in §7.1 |
These satisfy the D-003 acceptance criteria in PHASE_5_HANDOFF.md §4.
Pre-deploy Charter customisation
Before a live AWS apply, the operator MUST search-and-replace the deployment
domain in all 9 files. The default value (testnet.manthan.example.com) is
RFC-2606 reserved-for-example and won't resolve.
# from the repo root, after deciding on a real deployment domain:
DOMAIN="testnet.manthan.acmeresearch.io" # change this
find herald-protocol/services/testnet/nodes -name '*.md' -print0 \
| xargs -0 sed -i "s/testnet\.manthan\.example\.com/${DOMAIN}/g"
# also update the tfvars so the ALB / Route 53 / ACM align:
sed -i "s/testnet\.manthan\.example\.com/${DOMAIN}/g" infra/terraform/envs/testnet.tfvarsIf the operator legal entity, country, or jurisdiction differs from this
template, edit Charter §1 / §5, LOTS §1 / §7, and privacy-policy §0 / §6
before re-signing.
S3 archival (D-003 final acceptance bullet)
After the AWS stack is applied (D-002), upload the signed Charters / LOTS /
privacy-policies to the versioned S3 bucket:
./infra/scripts/upload-charter-to-s3.shThe script reads the bucket name from the Terraform output and uploads each
file under s3://<bucket>/nodes/<name>/{charter,lots,privacy-policy}.md.
Versioning is enabled on the bucket so older revisions are retained
indefinitely; supersession (Charter §10, LOTS §11) is just "upload a newer
version".
Re-signing on update
Charter / LOTS edits don't require redeploy: edit the markdown, restart the
ECS service (aws ecs update-service --force-new-deployment), and the new
file is signed at task startup. The old version stays in the S3 archive.