Run beta-cluster.sh up and the script installs the pinned host tools, builds or pulls every image, applies the trusted-boundary manifests, waits for the LayerX node's genesis artifacts, and deploys the settlement contracts through the Paxeer boundary. You get the chain, the node, the boundary, Human, registry and authority services on one machine. Run down and the cluster, its volumes and the local material go away. This is bring-up only, and the limited beta has not opened.

What it does

platform/hosted/tests/beta-cluster.sh up creates a throwaway Kubernetes cluster that runs a single-validator Paxeer chain at EVM chain ID 125 together with the LayerX node, the boundary, Human, registry and authority services. The same run installs the pinned host tools, builds or pulls every image in the shared image table, applies the trusted-boundary manifests, waits for the LayerX node's genesis artifacts, deploys the settlement contracts through the Paxeer boundary, and publishes the resulting GuarantorBond and CheckpointRegistry addresses as ConfigMap layerx-node-settlement. Work products land under build/beta-cluster, including the environment file the hosted smoke test consumes. beta-cluster.sh down deletes the cluster, its persistent volumes and the local material.

Key capabilities

• Creates a kind cluster, default name layerx-beta, or targets an owner cluster through LAYERX_BETA_KUBECONFIG.
• Initializes a one-validator Paxeer chain and refuses any EVM chain ID other than 125.
• Builds every image from the tracked source tree, or pulls them from GHCR by digest.
• Appends an independent observer full node with its own home, ports and volume.
• Deploys the settlement suite with the zero-delay immediate-beta timelock profile.
• Tears the whole cluster, its volumes and the downloaded tools back down in one command.

Differentiators

The bring-up checks the chain's identity rather than assuming it: it fetches /genesis from both TLS origins, requires byte-identical bodies, requires the X-LayerX-Genesis-SHA256 header to equal the SHA-256 of those bytes, requires the genesis chain_id to equal the CometBFT chain id read from the validator's home, and requires eth_chainId to return 125. The observer node's genesis.json is compared byte for byte against the validator's before its process starts. The guarantor's Ed25519 checkpoint authority key is generated before the Paxeer genesis is built, because deposit_root_authority is genesis state and nothing sets it afterwards.

Outcomes

• A full Paxeer X stack on one machine, from one command
• Teardown removes the cluster, its volumes and the downloaded tools
• Bring-up checks chain identity rather than assuming chain ID 125

Technical notes

• Operator chain: make platform-test-tooling, make platform-beta-cluster-up, make platform-hosted-smoke, make platform-beta-cluster-down. Make sets .NOTPARALLEL when up or down is among the goals. The images and publish-images commands are run on the script, not through Make.
• init-chain.sh refuses any LAYERX_PAXEER_CHAIN_ID other than 125, because paxd maps EVM chain ID 125 only from the CometBFT chain id hyperpax_125-1. CometBFT RPC and P2P, gRPC and the EVM HTTP listener bind on loopback; the EVM listener is reached through the boundary container. A completed home is marked and skipped, and a partial genesis.json without that marker is refused.
• deploy-contracts.sh bootstrap requires the immediate-beta timelock profile and runs deploy, permissions, activate, bond and finalize in that order. That profile refuses a chain ID other than 125 and a delay other than zero; the beta input pins the profile and a delay of 0.
• One Paxeer StatefulSet replica with a 40Gi data volume at /var/lib/paxeer, plus an appended observer container at /var/lib/paxeer-observer with a second volume, observer RPC on 26667 and P2P on 26666, and its own boundary on port 9444.
• Image source is build by default or ghcr; the GHCR path is kind-only, pulls by digest and retags locally, with tag beta by default. The publish path requires every name in the shared table to come from one git revision, and verifies each published digest against its signature, SBOM attestation and build provenance before it moves the release and beta tags.
• LAYERX_BETA_RETAIN_MATERIAL=1 reapplies an existing CA, Secrets and ConfigMaps after completeness, ownership, 0600/0700 permission, profile, registry-consistency and live KMS seal digest checks; missing material or a seal mismatch refuses the run. Retained material does not survive teardown.
• Not implemented in this path: custody-first genesis. Bring-up waits for the node's genesis artifacts and then runs deploy-contracts.sh bootstrap, which consumes the deployment descriptor and registration request before prediction and deployment; there is no pre-genesis custody deploy pinned by a signed native genesis.
• This is bring-up only. No image, cluster or chain-125 deployment qualification is claimed for it, and a set custody profile is accepted only as a readable, non-symlink regular file of exactly 223 bytes.
• The limited beta has not opened. The gateway API, the faucet and the public api.paxeer.network RPC endpoints are documented as unavailable until it does, so this cluster is a local stack, not a route to a live public endpoint.

More in Network