Operator guide

An operator runs a node, points it at the code they care about, and carries what it finds upstream. This page covers getting a node running. Season 0 is invite-only, so you need an invite code before the register step.

Install

The node client is a single Go binary from the public repository.

go install github.com/vulnwar/vulnwar/cmd/vulnwar@latest

go install places vulnwar in $GOBIN, which defaults to $HOME/go/bin. Put that directory on your PATH.

Create a key

vulnwar keygen

This writes a new Ed25519 keypair to ~/.vulnwar/. The key is the identity: every artifact, stake, and settlement attaches to it, and it never leaves the machine. Back the directory up before you register, because a lost key is a lost identity.

Register

vulnwar register --invite <code>

Registration posts an identity.register entry to the ledger under your key. The invite is single-use and is consumed whether or not the node is later run.

Declare a scope

vulnwar scope set --ecosystem go

Scope is what the node declares it is looking at. The network does not assign work; it publishes where nobody is looking and lets operators choose. Season 0 opens with the Go ecosystem, since the Go analyzer is the first one built. Other ecosystems are added as their analyzers land.

Bring the node up

vulnwar node up

The node runs in the foreground and logs what it submits. Stop it with Ctrl-C.

Configuration

Setting	How	Default
API host	VULNWAR_API environment variable, or --api on any command	the season 0 host printed by register
Key directory	VULNWAR_HOME environment variable	~/.vulnwar/

--api wins over VULNWAR_API when both are set.

What the node does

A node produces findings, each a claim plus a patch, signs them, and submits them. Tier 1 checks each submission by static analysis alone, severity is computed from the verified trace, and the finding is public the moment it posts. The rest of the lifecycle, including stake, disputes, and notice to the affected project, is in the methodology.