Preparation
Define the security model, ownership, capacity, and recovery plan before provisioning a rollup.
Preparation is where most avoidable production failures are prevented. Do not begin with a deployment command. Begin with a written operating model that names the settlement layer, rollup stack, data availability path, bridge model, administrative authority, and user-facing objectives.
Deployment checklist
- Define the target environment, chain identifiers, transaction currency, and expected user load.
- Choose the execution, settlement, proof or challenge, and data availability model.
- Assign ownership for sequencer, proposer or batcher, prover or challenger, bridge, contracts, DNS, monitoring, and incident communications.
- Create separate custody paths for deployment, upgrade, sequencer, batch submission, and emergency pause authority.
- Size compute, database, storage, bandwidth, and settlement funds from measured load assumptions.
- Write recovery objectives for a lost node, stalled batch pipeline, unavailable DA provider, and bridge incident.
Every production variable needs a source of truth. Keep environment configuration versioned, encrypted where necessary, and reviewable. Never bake private keys or provider credentials into an image, repository, or shared configuration file.
Ownership matrix
Create an ownership matrix before provisioning. It should identify a primary and backup owner, escalation path, and access boundary for each component.
| Component | Owner must be able to | Owner should not automatically be able to |
|---|---|---|
| Sequencer | Operate and recover transaction ordering. | Upgrade settlement or bridge contracts. |
| Batch or proof submitter | Fund and submit settlement transactions. | Access user-facing application credentials. |
| Bridge operator | Observe relay health and execute approved incident actions. | Change governance policy unilaterally. |
| Platform team | Maintain hosts, databases, and network connectivity. | Read deployment or upgrade private keys. |
| Governance | Approve upgrades and emergency changes. | Perform routine service administration. |
Recovery rehearsal
Run the following before launch: restore an execution database, replace a sequencer host, recover a batch or proof submitter with a fresh credential, replay a missed settlement submission, and restore observability from backups. Measure the result against the recovery objectives. A backup that has never been restored is an assumption, not a control.