# E11 network and custody deployment notes

Each validator identity requires:

- one stable validator identifier;
- one independent durable data directory;
- a certificate whose authenticated identity equals the validator identifier;
- a separately provisioned private key;
- a common trusted CA bundle and peer-address map;
- network policy that permits only authenticated validator/operator traffic.

Membership activation must never call the legacy certificate-only route. Operators must submit a canonical membership command, obtain a current-membership COMMIT QC, append the committed entry to the membership journal, then permit activation. Sharing one membership journal between validator identities is forbidden.

The E11 WAN controller is a qualification instrument. A production deployment must replace its local JSON plan with an independently controlled network-emulation or infrastructure fault platform and preserve immutable experiment receipts.

The bundled custody device is explicitly classified `SOFTWARE_REFERENCE_NOT_CERTIFIED_HSM`. It demonstrates API boundaries and ceremonies; it does not satisfy hardware-security or regulatory certification by itself. Production keys require independently qualified hardware, operator procedures, tamper evidence, backup/recovery ceremonies and external audit.
