papers/hanzo-ai-chain/sections/10-deployment.tex

\section{Deployment and Activation}
\label{sec:deploy}

This document is a working protocol and implementation report. Historical
calendar dates and benchmark targets are not activation evidence. PoAI mining,
the two-trillion AI monetary policy, and omnichain payout remain fail-closed
until governance fixes their parameters and the gates below pass.

\subsection{Phase 0: arithmetic and wire freeze}

\begin{itemize}[leftmargin=1.2em]
  \item Freeze field, serialization, domain tags, accumulator and overflow rules,
        graph operation set, and challenge derivation.
  \item Publish byte-identical CPU/GPU vectors for every activated operation.
  \item Demonstrate a production Zen model emitting the complete integer graph
        and transcript on its normal execution path.
  \item Freeze the A-Chain job, commitment, nullifier, receipt, and root formats,
        plus the A-to-Z settlement statement.
\end{itemize}

\subsection{Phase 1: exact replay and shadow proofs}

Small jobs may use canonical exact replay. Larger jobs produce optimistic or
succinct shadow evidence without authorizing subsidy. The network measures
proof-capture overhead, CPU validation cost, transcript size, data availability,
challenge latency, and cross-backend divergence under production load.
Shadow evidence has no mint authority. This stage is deployment safety and
measurement, not a weaker proof class accepted by consensus.

\subsection{Phase 2: optimistic PoAI activation}

Optimistic proof authority may activate only after:

\begin{itemize}[leftmargin=1.2em]
  \item honest CPU/GPU commitments agree byte-for-byte;
  \item fabricated operations are objectively caught and honest work is never
        falsely rejected;
  \item independent watchers can reconstruct and challenge all committed data;
  \item no receipt authorizes irreversible issuance before challenge finality;
  \item metering and anti-self-dealing rules withstand adversarial tests;
  \item one global nullifier and one halving allowance remain correct across
        reorganization and failure;
  \item an authenticated A-Chain receipt is checkpointed through the fail-closed
        Z-Chain settlement path and consumed exactly once by at least two
        destination environments.
\end{itemize}

\subsection{Phase 3: cloud-provider pilot}

At least one existing cloud scheduler and one independent provider integrate the
same job adapter. The pilot must show that proof capture adds acceptable cost to
ordinary paid inference or training, that CPU validators do not repeat the full
GPU workload, that confidential jobs fail closed when TEE collateral is stale,
and that customer privacy/authorization is preserved.

\subsection{Phase 4: succinct-proof authority}

P3Q may replace the optimistic challenge path and activate as the Z-Chain
settlement rollup only after the exact PoAI AIR, parameters, recursive batch
policy, A-to-Z state-transition binding, verifier, node integration, resource
bounds, and audits are complete. P3Q is Plonky3-derived and pairing-free; that
design label is not deployment evidence. Shadow parity with the already active
policy is required before authority changes. Here ``parity'' means that the
candidate P3Q statement accepts exactly the same finalized A-Chain receipt
transitions; it is an activation test, not part of the public mining story.

\subsection{Monetary activation}

Governance must fix the genesis DAO address and controls, A-Chain activation
height $h_0$, halving interval $H$, miner/validator split, job-class reward
normalization, per-epoch caps, fee-burn fraction, and emergency back-off policy.
The canonical ledger must enforce the one-trillion DAO allocation, one-trillion
proof-earned pool, and two-trillion hard cap. Every legacy one-billion or
per-chain mint contract must be disabled or upgraded first.

\subsection{Back-off}

If a proof, availability, metering, PQ authentication, bridge, or economic
invariant fails, governance disables new job admission and mining issuance while
preserving already finalized receipts and canonical balances. A destination
adapter may be paused independently, but it may never fall back to raw proof
acceptance.