Remove mutable-main root installer instructions

INVESTORS.md

@@ -152,7 +152,7 @@ forecasts, return projections or guarantees.
 
 ```bash
 # Install and configure the validator service interactively.
-curl -fsSL https://raw.githubusercontent.com/aperod-network/aperod-node/main/deploy/install-validator.sh | sudo bash
+# No signed, immutable installer release is published; do not run a mutable-main script as root.
 
 # Verify the service and local REST API.
 systemctl status aperod-node

SECURITY.md

@@ -7,11 +7,9 @@
 | Latest `main` | ✅ Active |
 | Older tags | ❌ No patches |
 
-Always run the latest release:
+### Installer security notice
 
-```bash
-curl -fsSL https://raw.githubusercontent.com/aperod-network/aperod-node/main/deploy/install-node.sh | sudo bash
-```
+No signed, immutable installer release is currently published. Do not pipe an installer fetched from the mutable `main` branch into `sudo bash`. Install only from a reviewed source commit whose identity and deployment-tools checksum have been verified independently; otherwise do not run the installer as root.
 
 ---
 

config/amount_binding_config_test.go

@@ -35,3 +35,22 @@ func TestRingCTAmountBindingActivationValidationAndLoad(t *testing.T) {
 		t.Fatalf("loaded amount-binding activation height = %d, want 300", got)
 	}
 }
+
+func TestOfflineRehearsalSchedulesStagingAmountBindingOnly(t *testing.T) {
+	cfg, err := Load("rehearsal-offline.yaml")
+	if err != nil {
+		t.Fatalf("load offline rehearsal config: %v", err)
+	}
+	if err := cfg.Validate(); err != nil {
+		t.Fatalf("validate offline rehearsal config: %v", err)
+	}
+	if !cfg.Consensus.NonValidator {
+		t.Fatal("offline amount-binding rehearsal must remain non-validator")
+	}
+	if got := cfg.Consensus.RingCTAmountBindingActivationHeight; got != 3_800_000 {
+		t.Fatalf("staging amount-binding activation = %d, want 3800000", got)
+	}
+	if cfg.Consensus.RingCTAmountBindingActivationHeight < cfg.Consensus.RingCTCLSAGActivationHeight {
+		t.Fatal("amount-binding activation must not precede CLSAG activation")
+	}
+}

config/rehearsal-offline.yaml

@@ -16,6 +16,8 @@ consensus:
   tail_reward_napro: 100000000
   ringct_v4_activation_height: 1750000
   ring_ct_clsag_activation_height: 1769500
+  # Staging-only target; never copy this activation into production config.
+  ring_ct_amount_binding_activation_height: 3800000
   staked_collateral_ring_exclusion_activation_height: 2950000
   reward_authorization_activation_height: 1750000
   avm_activation_height: 1850000

deploy/README-public.md

@@ -92,11 +92,9 @@ wallets, exchange records, or other network/application-layer information.
 
 ## ⬇ Install a Full Node
 
-### One-line install (Ubuntu / Debian)
+### Installer security notice
 
-```bash
-curl -fsSL https://raw.githubusercontent.com/aperod-network/aperod-node/main/deploy/install-node.sh | sudo bash
-```
+No signed, immutable installer release is currently published. Do not pipe an installer fetched from the mutable `main` branch into `sudo bash`. Install only from a reviewed source commit whose identity and deployment-tools checksum have been verified independently; otherwise do not run the installer as root.
 
 Supported platforms: **Ubuntu 22.04 · Ubuntu 24.04 LTS · Debian 12 · x86\_64 · ARM64**
 
@@ -155,20 +153,15 @@ Block rewards go directly to your **Telegram wallet**. You need an APRO address
 ### Step 2 — Install the validator node
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/aperod-network/aperod-node/main/deploy/install-validator.sh | sudo bash
+# No signed, immutable installer release is published; do not run a mutable-main script as root.
 ```
 
 The installer will:
 - Prompt for your APRO reward address
 - Generate a **consensus key** (signs blocks only — cannot move funds)
 - Configure the node as a `systemd` service and start it
 
-**Non-interactive install (CI / cloud-init):**
-
-```bash
-APEROD_REWARD_ADDRESS=<your-apro-address> \
-  curl -fsSL https://raw.githubusercontent.com/aperod-network/aperod-node/main/deploy/install-validator.sh | sudo bash
-```
+**CI / cloud-init installation is unavailable** until a signed, immutable installer release is published. Do not execute downloaded scripts with elevated privileges.
 
 ### Step 3 — Register your node