# HoneyMesh Core Beta 2.3.6-rc4: Ubuntu 24.04 AMD64 quickstart

This guide applies to the signed **HoneyMesh Core Beta 2.3.6-rc4 Iron-Hive** Debian package built from source `b47095a81d0b09d9084b4c961ddad49c50afa3d1`. It is for noncritical evaluation on Ubuntu 24.04 AMD64 with generic XDP. Node Guard and distributed Exchange enforcement are outside this beta. Keep a separate console or management route available throughout testing.

## 1. Prepare and verify

Use an Ubuntu 24.04 AMD64 test VPS. Record its kernel, selected test interface, and management path. Keep Exchange and trusted sharing disabled. Download the Debian package from the [beta page](https://network-decode.com/beta) after purchasing a paid HoneyMesh subscription and verifying the same billing email. Download the [manifest](./HoneyMesh-Core-Beta-rc4-manifest.json), [detached signature](./HoneyMesh-Core-Beta-rc4-manifest.asc), and [publisher public key](./HoneyMesh-Core-Beta-publisher-public.asc) into the same directory.

```bash
uname -m
uname -r
mountpoint /sys/fs/bpf
gpg --import HoneyMesh-Core-Beta-publisher-public.asc
gpg --fingerprint D67F75E94480FC5F974885F30DC7BAB5FD2544D1
gpg --verify HoneyMesh-Core-Beta-rc4-manifest.asc HoneyMesh-Core-Beta-rc4-manifest.json
echo 'fbd192d23acbe1f02c68934c34aeadf06cb40adac3da0096c7789b1a65c6ebf5  honeymesh_2.3.6-rc4-Iron-Hive_amd64.deb' | sha256sum -c -
```

Check that the fingerprint shown is exactly `D67F75E94480FC5F974885F30DC7BAB5FD2544D1`. Stop if architecture, signature, or checksum differs. A checksum from the same website alone does not authenticate the publisher.

## 2. Install in TEST

```bash
sudo apt install ./honeymesh_2.3.6-rc4-Iron-Hive_amd64.deb
sudo systemctl status honeymesh.service --no-pager
curl --cacert /etc/honeymesh/certs/ca/ca.crt https://127.0.0.1:8443/api/health
```

The initial state should be **TEST**, with no selected enforcement interface or active bans, and Exchange/trusted sharing off. Keep the dashboard bound to loopback and reach it through an SSH tunnel if needed: `ssh -L 8443:127.0.0.1:8443 USER@HOST`. Do not expose dashboard port 8443 publicly. Back up `/etc/honeymesh` and `/var/lib/honeymesh` before an upgrade.

If you joined the paid Infrastructure Pro beta pilot, wait for the signed `license.json` attachment after the paid invoice. Upload it through the local dashboard and confirm the displayed tier, node allowance, and expiry. Keep Exchange and trusted sharing disabled for this pilot. A renewed license must be imported after each paid renewal; protect the license file as an entitlement.

## 3. Observe before any enforcement

Use a test source you control and a separate control source. Select only a disposable test interface and a lab trap in the local dashboard. Observe events in TEST without blocking. If the application sees legitimate traffic classified as hostile, stop and review the policy. The automatic local-ban setting is `security.automatic_ban_ttl_seconds`: its default is 900 seconds (15 minutes), and accepted values are 30–86,400 seconds. The field tests used explicit 120- and 600-second settings; the 900-second default was source-tested but not timed in a VM.

## 4. Optional short ENFORCE test

Before switching modes, confirm your console route and a second operator or timed rollback. Allowlist protected management addresses. Then select the intended lab interface, enable generic XDP, and move to ENFORCE for a short scheduled window. Trigger only your authorized lab trap. Confirm the test source is blocked, the independent control source stays reachable, and the grant expires or can be released. Return to TEST and detach the interface when finished. Do not enable LOCKDOWN, Exchange sharing, or trusted mesh for this Core beta exercise.

## 5. Emergency recovery and removal

Use your VPS console if SSH access is affected. Replace `IFACE` below with the interface you selected; inspect it before acting. These commands disable HoneyMesh enforcement on that interface and stop the service.

```bash
sudo systemctl stop honeymesh.service
sudo ip -details link show dev IFACE
sudo ip link set dev IFACE xdp off
sudo systemctl disable honeymesh.service
```

Check access from both test and control sources. To remove the package after detaching XDP:

```bash
sudo apt remove honeymesh
sudo systemctl daemon-reload
```

Removal retains configuration and runtime state for recovery; back them up securely before deleting them. If a manual HoneyMesh process is still running, the package removal script will refuse removal until that process is stopped. Contact `Admin@Network-Decode.com` with a sanitized report if recovery does not match these steps.

## Known limits

The beta has controlled evidence for Ubuntu 24.04 AMD64 generic XDP, an automatic TCP trap path, bounded local grants, and a small Node.js API smoke test. It has not completed general production, native-XDP line-rate, broad detection-accuracy, representative customer false-positive, or distributed Pro qualification. The local-only configuration can be changed by an administrator; it is not a code-locked edition. Do not rely on this beta as the sole control for critical systems.