feat(cli): add digest + set-validators subcommands to genesis command

CLAUDE.md

@@ -57,7 +57,7 @@ cargo build
 ```bash
 target/debug/summit --help
 # Usage: summit <COMMAND>
-# Commands: run, keys, help
+# Commands: run, keys, genesis, help
 ```
 
 ## Test
@@ -153,7 +153,6 @@ cd testnet && ./reset.sh
 | ----------------------------------------- | ------------ | --------------------------------------------------- |
 | `summit`                                  | —            | Main validator node                                 |
 | `testnet`                                 | —            | Spin up 4-node local testnet (needs `reth` in PATH) |
-| `genesis`                                 | —            | Generate genesis files from validator list          |
 | `stake-and-checkpoint`                    | `e2e`        | E2E: stake validator + checkpoint test              |
 | `stake-and-join-with-outdated-checkpoint` | `e2e`        | E2E: join with outdated checkpoint                  |
 | `withdraw-and-exit`                       | `e2e`        | E2E: withdrawal flow test                           |
@@ -164,14 +163,15 @@ cd testnet && ./reset.sh
 ## Project Layout
 
 ```
-node/                  Main binary crate (summit, testnet, genesis)
+node/                  Main binary crate (summit, testnet)
   src/engine.rs          Central coordinator — component lifecycle, message routing
   src/args.rs            CLI argument parsing (clap)
   src/config.rs          Channel sizes, timeouts, default paths
   src/keys.rs            Key management (generate/show)
+  src/genesis.rs         Genesis file utilities (set-validators/digest)
   src/test_harness/      Shared test harness for e2e tests
   src/tests/             Integration tests (syncer, checkpointing, execution requests)
-  src/bin/               Additional binaries (testnet, genesis, e2e, bench)
+  src/bin/               Additional binaries (testnet, e2e, bench)
 
 application/           Consensus interface — implements Simplex Automaton + Relay traits
   src/actor.rs           Propose, verify, broadcast blocks

README.md

@@ -47,21 +47,26 @@ cargo build --release
 
 ### 1. Generate Validator Keys
 ```bash
-cargo run -- keys generate --key-store-path /path/to/keys
+cargo run --bin summit -- keys generate --key-store-path /path/to/keys
 ```
 
 ### 2. View Your Public Key
 ```bash
-cargo run -- keys show --key-store-path /path/to/keys
+cargo run --bin summit -- keys show --key-store-path /path/to/keys
 ```
 
 ### 3. Configure Genesis
 Create a genesis file that references your EVM genesis configuration. See [example_genesis.toml](https://github.com/SeismicSystems/summit/blob/main/example_genesis.toml) for the required format.
 
+Print the config digest that identifies the chain it founds — every validator must agree on it, and the file is checked on the way in:
+```bash
+cargo run --bin summit -- genesis digest /path/to/genesis.toml
+```
+
 ### 4. Start Your Validator
 Ensure your EVM client is running, then:
 ```bash
-cargo run -- run \
+cargo run --bin summit -- run \
   --key-store-path /path/to/keys \
   --store-path /storage/directory \
   --engine-ipc-path /tmp/reth_engine_api.ipc \

docs/running-local-network.md

@@ -73,7 +73,7 @@ This removes `node*/data/reth_db`, `node*/db`, and `./stores`. Keys in `testnet/
 
 ## Running distributed
 
-To run a fresh network on multiple systems you should install Summit on each server and then run `cargo run -- keys generate` and `cargo run -- keys show` to get the keys for each node.
+To run a fresh network on multiple systems you should install Summit on each server and then run `cargo run --bin summit -- keys generate` and `cargo run --bin summit -- keys show` to get the keys for each node.
 
 You will then recreate the example_genesis.toml file to have the keys and IPs of all your nodes.
 

example_genesis.toml

@@ -1,40 +1,56 @@
+# Example Summit genesis. `summit genesis digest <file>` prints a genesis file's
+# config digest: the chain identity every node must agree on, derived from the
+# parsed content below (see `Genesis::config_digest`).
+#
+# `validators[].ip_address` is the one field the digest does NOT cover. It is
+# network topology, not consensus identity, so a validator that changes IP still
+# belongs to the same chain. Every other field here is hashed.
+
+namespace = "_SUMMIT"
 eth_genesis_hash = "0x78ab9057bb67f95a6182969c5d755ac02802c98c0d2f0d8daeb52f4bddc60be5"
 leader_timeout_ms = 2000
 notarization_timeout_ms = 4000
 nullify_timeout_ms = 4000
 activity_timeout_views = 256
 skip_timeout_views = 32
 max_message_size_bytes = 10485760
-namespace = "_SUMMIT"
+
+# Everything below is a governed protocol parameter: hashed here as the value the
+# chain launches with, while the live value is chain state, changed by transaction
+# through ProtocolParams.sol. The digest keeps committing to what the chain
+# started with, not to what it currently runs. For the parameter ids and their
+# bounds, see types/src/protocol_params.rs.
 validator_minimum_stake = 32000000000
 validator_maximum_stake = 32000000000
 blocks_per_epoch = 10000
 allowed_timestamp_future_ms = 10000
+treasury_address = "0x0000000000000000000000000000000000000000"
 max_deposits_per_epoch = 3
 max_withdrawals_per_epoch = 16
 observers_per_validator = 5
 minimum_validator_count = 3
+invalid_deposit_tax = 0
 
 [[validators]]
 node_public_key = "1be3cb06d7cc347602421fb73838534e4b54934e28959de98906d120d0799ef2"
 consensus_public_key = "a6f61154ae7be4fd38cd43cf69adfd4896c57473cacb389702bb83f8adf923eecf4854c745e064c0a2db79db5674332b"
-ip_address = "127.0.0.1:26600"
 withdrawal_credentials = "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266"
+ip_address = "127.0.0.1:26600"  # not covered by the config digest (see above)
 
 [[validators]]
 node_public_key = "32efa16e3cd62292db529e8f4babd27724b13b397edcf2b1dbe48f416ce40f0d"
 consensus_public_key = "b82eaa7fbc7f9cf9d60826e5155ca8ccc46e13d87f64f7bcdcaa2972c370766b87635334bfc49b8fba7fb784e763d44e"
-ip_address = "127.0.0.1:26610"
 withdrawal_credentials = "0x70997970C51812dc3A010C7d01b50e0d17dc79C8"
+ip_address = "127.0.0.1:26610"
 
 [[validators]]
 node_public_key = "ce9b314ac9d55d28bedf543164120eecf737380015c977eaa78d59894bbccf52"
 consensus_public_key = "b806a3638975b2c33ccdda9cc55231e1328a0d1f70a3dde804e473e22ec21d5703ee34264c702b971cd0f9d5892434e8"
-ip_address = "127.0.0.1:26620"
 withdrawal_credentials = "0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC"
+ip_address = "127.0.0.1:26620"
 
 [[validators]]
 node_public_key = "f205c8c88d5d1753843dd0fc9810390efd00d6f752dd555c0ad4000bfcac2226"
 consensus_public_key = "83c50f2fa828c5e132a2ac00792ef9c892372976ff26400711b7061bdb045f0751559b4a04cfd7399555a2aed5b54f3f"
-ip_address = "127.0.0.1:26630"
 withdrawal_credentials = "0x90F79bf6EB2c4f870365E785982E1f101E93b906"
+ip_address = "127.0.0.1:26630"

node/Cargo.toml

@@ -7,10 +7,6 @@ edition.workspace = true
 name = "testnet"
 path = "src/bin/testnet.rs"
 
-[[bin]]
-name = "genesis"
-path = "src/bin/genesis.rs"
-
 [[bin]]
 name = "stake-and-checkpoint"
 path = "src/bin/stake_and_checkpoint.rs"

node/src/args.rs

@@ -4,6 +4,7 @@ use crate::{
         MESSAGE_BACKLOG, PENDING_CHANNEL, RECOVERED_CHANNEL, RESOLVER_CHANNEL, expect_key_store,
     },
     engine::Engine,
+    genesis::GenesisSubCmd,
     keys::KeySubCmd,
 };
 use clap::{Args, Parser, Subcommand};
@@ -80,6 +81,9 @@ pub enum Command {
     /// Key management utilities
     #[command(subcommand)]
     Keys(KeySubCmd),
+    /// Genesis file utilities
+    #[command(subcommand)]
+    Genesis(GenesisSubCmd),
 }
 
 #[derive(Args, Debug, Clone)]
@@ -225,6 +229,8 @@ impl Command {
             Command::Run { flags } => self.run_node(flags),
 
             Command::Keys(cmd) => cmd.exec(),
+
+            Command::Genesis(cmd) => cmd.exec(),
         }
     }