Who runs the validators?

What the fleet is asked to be

A diagram shows ten cities and ten independent operators. A security review asks which regulator signs blocks. A status page is read as nine of ten because a demo used that ratio. Someone looks for a public validator set they can join. The live fleet is 10 validators, all operated by JIL Sovereign Technologies, Inc. Agreement is among the validators that respond. The chain halts if they diverge.

Those are the signs.

The live fleet is 10 validators. All of them are operated by JIL Sovereign Technologies, Inc. under the license from JIL Sovereign Holdings, LLC (WY). The set is permissioned. Operators are known at genesis. This is not anonymous mining. A validator named for a compliance zone is labelled for that zone. The label does not mean the machine is located in that zone. One hosting provider runs the fleet. No regulator operates a node. No regulator endorses a node. No regulator has reviewed a node. The named validators reading is the page this answer sits on top of, and it should be read with this one rather than instead of it.

The agreement rule is 100% among responding validators. If the responses diverge, the chain halts. That is the fault rule in the company brief. It is not Byzantine fault tolerance. It is not a design in which some number of anonymous operators can be outvoted and the chain still finalizes. The sovereign cell, federation, and original Layer-1 readings record the worked example in a second sentence that should be kept beside the first: agreement on that showcase is 10 in the set, 9 signing, all operated by JIL. Both sentences name the same operator. Neither sentence is a purchase, and neither sentence moves the machines to a ministry.

The eight-region fleet is not this 10-validator set, and it is not in service. Four regions are shown and four are shadow. This page does not name the shadow regions. A corridor profile on that plan names ten processes and spans at most two shown regions. Eight of the named ten must vote yes. Seven does not pass. Silence is not a yes. Validators on that plan stay named, and every validator is operated by JIL. That plan uses the ACL. The claims are filed and patent pending. The sentence above is the recorded set.

Named, on this system, means three concrete things. A legal identity the cell operator can name: a ministry, a licensed institution, or JIL under the Class A or Class B license. A cryptographic identity pinned at genesis. And a place in a known set, so that settlement is agreement inside that set rather than a race. Rotation is a ceremony. Adding or removing a validator is a governed event, recorded and re-certified. It is not an anonymous join. On the fleet that is actually running, the operator named in that set is JIL. One machine is a demonstration, not a national chain. The architecture is the same under Class A and Class B. The class changes the fee, not the engine, and it does not by itself change who operates the recorded set.

The keys should be described as they are built, not as a future diagram. Validator signing keys are Ed25519, held in software on each node. Attestation seals are already hybrid: Ed25519 and ML-DSA-65, and both must verify. Post-quantum validator signing is on the roadmap. The post-quantum reading is more precise than a slogan. Post-quantum validator identity keys are pinned in genesis but do not yet sign consensus. Hybrid seals are in production. An independent external security audit of the full consensus path is the named next gate, not a published audit this page can point to. A hardware security module path is designed and not built. Validator signing keys today are software keys. The deployment runbook writes a later gate at which a state's own set would be stood up, with ML-DSA-65 identities pinned from block zero. That gate is the written procedure for a prepared licensee. It is not a description of the recorded fleet, and it does not change the fact that validator signing today is Ed25519 software.

Who does not run these validators is part of the same answer. JIL Sovereign Holdings, LLC (Wyoming) owns the intellectual property and licenses it. The licensing model reading separates that role cleanly. Holdings does not operate validators and does not operate this site. Payment integrity at jilsovereign.com, JIL Sovereign Technologies, Inc., does not run this set. The retail wallet at getjil.com and wallet.getjil.com does not run this set. This page does not add that host to the operation claim. A Class A or Class B license does not, by itself, move the recorded set off JIL, and it does not move custody of the cell's banking to JIL. JIL does not custody that banking.

The federation reading describes the architecture a national deployment is aimed at: each cell with a validator set the operator can point to, and no foreign anonymous community governing the settlement. The named-validator reading and the company brief describe the fleet that exists today. Both can be true only if they are not collapsed. A country does not acquire the live 10 by opening the cell demo. The demo is simulated. From the runbook's validator gate onward, the written test is that the nation, not JIL, operates the machines that finalize that cell's blocks. Until that gate is actually closed for a licensee, saying the nation runs the validators is ahead of the record. This page will not say it about the live fleet.

Custody of the retail default key is a different set of machines and a different mistake. Readers mix who signs the block with who holds the wallet key. Validator keys sign consensus. The default service key on the wallet is a 2-of-3 threshold whose three shares are created and held server-side. Signing reconstructs the secret in memory. The three-shard page states it directly: a user-held shard is not the live path. You can authorize a signature. That authorization is not possession of a shard. Threshold signing of the FROST or GG20 class, where the key is never reconstructed, is on the roadmap. Until it ships, compromise of the signing host is compromise of that key. Holdings does not change that fact by licensing the IP.

Public copy sometimes reaches for a larger anonymous set, or for a count this host does not use. Do not use one. The number on the company brief is 10, all operated by JIL. The showcase sentence is 10 in the set, 9 signing, same operator. The rule is unanimity of those who respond, and a halt on divergence. ACL is the name of the consensus layer because it attests the act, not only the order. Identity, policy, and jurisdiction are evaluated in the same pass as ordering, by validators that are named rather than anonymous. That property is the design. The live operator of the set that exists is still JIL Sovereign Technologies.

If the question is how a country would ever stand up its own set, the next page is the runbook path, not a claim that the path has already been walked. If the question is what the seals on a record will still mean later, stay on the post-quantum reading: hybrid seals today, post-quantum validator signing later, and no claim that the archive is already signed with a post-quantum validator key. Validator identity is the root of later proofs, including corridor headers and reserve attestations. Describing that identity as already post-quantum at the signing step would be ahead of the post-quantum page.

Questions

Read with this

Named validators, Post-quantum, An original Layer-1, What is a sovereign cell, Three-shard custody, The licensing model, The deployment runbook, The federation.