Run a node, join the set

Running a node and voting are two different things. The first is a command; the second costs a stake and takes effect at the next epoch.

1. Keys

A node holds two: an Ed25519 identity the network layer presents, and a BLS key that signs votes and evaluates the sortition VRF. One keystore holds both.

keys

./baklava keygen -keystore node.json -member node-card.json

The member card is the public half — the thing a genesis file names. You do not need it to join an existing chain; it matters when you are starting one.

2. Run

follow the chain

./baklava run \
    -genesis genesis.json \
    -keystore node.json \
    -db node.db \
    -peer 14b49efa2d4ec817a78ff56f71889648153ff24a4577ecb7ba1ef21fa8d5a49c@seed.baklava.network:26656 \
    -listen 0.0.0.0:26656 \
    -rpc 127.0.0.1:26657

It will connect to the seed and catch up one block at a time. That is not a second, laxer validation path: a fetched block goes through exactly what a proposed one goes through, so catching up verifies every certificate on the way.

`-observe`	Follow the chain without voting, even once registered. The honest way to run for a while before taking a seat.
`-rpc`	Where to answer queries; empty for none. Keep it on the loopback — see the query surface.
`-retention`	How far back block bodies are kept; ninety days by default. `-archive` keeps everything.

Open the peer port, keep the RPC port shut

Peers reach each other on 26656 and that has to be reachable. The RPC surface has no authentication and no TLS on purpose — a wrong answer is caught by the proof it fails, not by knowing who sent it — so it belongs behind a proxy or behind nothing at all.

3. Register, and vote

Voting power is not bought. A stake opens the gate; what decides the draw is weight = maturity × reliability, where maturity is log2 of how long you have been registered and reliability is how often you turned up when drawn. The stake amount does not enter it.

./baklava stake \
    -keystore node.json \
    -genesis genesis.json \
    -rpc https://rpc.baklava.network

The stake is moved, not marked: it is debited from your account and credited to a pool with no private key. A number beside an account somebody can still spend from is not collateral. The threshold is read from the chain, not from a flag — on this network it is 1 BKLV.

Register with the same keystore the node runs with. The registry is keyed by the address the Ed25519 key derives, and the BLS key in the payload is the one that will vote; registering one node from another's keys enters a member nobody can act as.

You will not vote today

The participant set is frozen for the length of an epoch — 500 blocks here — and it is frozen from the state at the last block of the previous one. So a registration that lands now takes effect when the next epoch opens, not immediately.

Your first weight will also be near zero, because maturity is log2 of an age. That is the design working: the apprenticeship quota keeps a seat for newcomers so the draw is reachable, and seniority is earned rather than bought.

4. Check that it took

console

> /participant <your address>
> /committee <epoch>
> /status

Running it as a service

A service has no terminal, so the passphrase comes from a file only that user can read, and the unit has to give the node room to shut down: it closes the database on SIGTERM, and a block and the state it produced are written in one transaction. A hard kill is the one shutdown that can cost a resync.

The unit file this network's own node runs under, and the reasoning behind each line of it, is deploy/README.md.