# HoneyMesh customer setup, test, and deployment checklist

**Updated 4 November 2026.** These are controlled, noncritical evaluation paths. Node Guard Free is a standalone npm alpha with no checkout or license. Core Beta and Node Pro are separate paid Linux host pilots; verify the Stripe billing email before downloading their signed host packages.

## 1. Choose the deployment path

| Your environment | Use now | Installation rights | Current boundary |
| --- | --- | --- | --- |
| Ubuntu 24.04 AMD64 host you administer | [HoneyMesh Core Beta RC4 quickstart](./HoneyMesh-Core-Beta-rc4-Quickstart.md) | Paid subscription, root, and systemd | Generic XDP, noncritical evaluation; general production qualification remains open |
| Managed Node.js app without root | [Node Guard Free guide](./HoneyMesh-Node-Pilot-Guide.md) | App deploy access; no subscription or license | One process, application limits only; no XDP or shared state |
| Node.js app on a supported Linux host | [Node Pro beta download](https://network-decode.com/node-pilots) | Paid Pro subscription, root plus app deploy access | TEST-first bridge; distributed enforcement not included |

Node Pro and Infrastructure Pro are priced per licensed Linux host, not per CPU, application worker, or replica. The free application SDK has no billable unit.

## 2. Before installation

Assign an owner for the host or app, a maintenance window, an authorized test source, a separate normal-traffic control source, and a rollback operator. Inventory the OS, CPU architecture, kernel, ingress, existing listeners, and proxy headers. Snapshot the host or preserve the last known-good app deployment. Decide where private license and signing material will be stored. Do not send those values in a support ticket.

For Linux, check `uname -m`, `uname -r`, the `/sys/fs/bpf` mount, and `ss -lntup`. Stop if the machine is not AMD64, the kernel is below 5.8, or a planned trap port is already used. For Node Guard, confirm Node.js 20+, a trusted ingress that supplies a verified client IP, and a single pilot worker.

## 3. Install and verify

**Infrastructure Core Beta:** Purchase the Infrastructure Pro host pilot, then verify the same billing email at [network-decode.com/beta](https://network-decode.com/beta). Download the signed RC4 Debian package and follow the [RC4 quickstart](./HoneyMesh-Core-Beta-rc4-Quickstart.md) to verify its publisher signature and SHA-256 before installation. Record the package hash and service version. Keep the dashboard on loopback and reach it through an SSH tunnel. The fresh configuration has no attached interface or traps and sharing is off.

**Node Guard Free:** Install the published `@network-decode/node-guard@0.2.0-alpha.11` from npm in your application; run `npx nodeguard init`, `npx nodeguard doctor nodeguard.policy.json`, and `npx nodeguard policy validate nodeguard.policy.json`. Follow the [application setup path](https://network-decode.com/get-started#node-guard). There is no paid download or emailed license.

**Node Pro:** Verify the paid billing email at [Node Pro downloads](https://network-decode.com/node-pilots). Download the signed host bundle, verify its SHA-256, publisher signature, and internal package checksums, then follow its `CUSTOMER_INSTALL.md`. Install the emailed host license as directed. The free npm SDK is not a substitute for this host bundle.

## 4. Observe and prove source attribution

Leave Linux in **TEST** and Node Guard in **observe**. Generate a known test event from the authorized source. Send ordinary requests from the independent control source. Confirm event time, source, protocol or route, reason, and action. Verify that trusted proxy handling rejects a forged forwarded header for Node Guard. A TEST event or an app observation does not prove a kernel packet drop.

## 5. Run a bounded canary

Write down the exact source cohort, trap or app route, interface, start/end time, owner, expected outcome, and recovery command. For Linux, attach only the approved interface and move to **ENFORCE** for the short test; measure both test and control packets. For Node Guard, enable application enforcement only for the approved canary source and verify HTTP 429 for that source while the control request succeeds. Keep Exchange and peer sharing off during this initial canary. Do not use LOCKDOWN in the first Linux pilot.

## 6. Roll back and decide

Release the test ban or app limit, return to TEST/observe, detach the Linux interface if attached, and repeat both test and control requests. Confirm the service or app is healthy after restart. Stop rollout if normal traffic is affected, attribution is uncertain, or recovery fails. Before extending the pilot, review false positives, latency and resource use, alert ownership, support contacts, and paid host license expiry where applicable. Save sanitized evidence: versions, hashes, event IDs, observed response, rollback time, and operator approval.

## Delivery status and remaining gates

The signed RC4 AMD64 Debian package is the current paid Core Beta artifact for Infrastructure Pro. Node Guard Free is publicly available as the pinned npm alpha; Node Pro uses a protected, separately licensed signed host bundle. Historical package binaries are no longer public downloads. General production and distributed Exchange qualification remain open. The first real paid Node Pro invoice, live license attachment, and customer bundle download require monitoring. The [pricing page](https://network-decode.com/pricing) shows the current paid host plans.