diff --git a/packages/cluster-tool/README.md b/packages/cluster-tool/README.md
index 4b4912f6..8ce25ade 100644
--- a/packages/cluster-tool/README.md
+++ b/packages/cluster-tool/README.md
@@ -233,6 +233,7 @@ After `create` completes:
     ├── anvil/                       # anvil state + pid + logs (if --ethereum-path)
     ├── solana_validator/            # solana-test-validator ledger + pid + logs (if --solana-path)
     ├── eth-abis/                    # deployed contract ABIs (OPP, OPPInbound, BAR)
+    ├── ethereum-client.json          # shared unified Ethereum client config for operator daemons
     ├── solana-idls/                 # Anchor IDLs (opp_outpost.json)
     ├── opp-debugging/               # envelope .data/.metadata pairs (debugging server writes)
     └── tui/logs/                    # wire-debugging-client-tool-tui writes here (see companion)
@@ -240,6 +241,24 @@ After `create` completes:
 
 Every managed process writes `<dataPath>/<label>.pid` (e.g. `data/node_00/node-00.pid`) on spawn and removes it on clean exit. The TUI's Process Monitor iterates these.
 
+### Generated Ethereum client configuration
+
+Artifact preparation writes one `data/ethereum-client.json`, and every operator
+daemon passes it through `--outpost-ethereum-client-config-file`. The versioned
+file combines the stable `eth-default` client id and signature-provider id with
+the Anvil RPC URL and chain id. Signature-provider ids are process-local, so each
+daemon can register its own Ethereum private key as `eth-default` while safely
+sharing the same client configuration file. Daemon argument builders remain
+pure and reuse the artifact on create, run, restart, and flow-provisioned starts.
+
+Generated development-cluster files omit `transaction_policy`. Nodeop therefore
+assigns its maximum-`uint256` default caps, preserving the pre-policy behavior
+for local clusters. The schema supports an explicit nested policy when finite
+cluster limits are wanted later. Bios and producer-only nodes receive neither an
+Ethereum signing client nor an orphaned client-config option.
+
+Production policy selection happens outside `wire-tools-ts`.
+
 ---
 
 ## Programmatic usage
diff --git a/packages/cluster-tool/src/orchestration/outputs/OperatorDaemonArtifacts.ts b/packages/cluster-tool/src/orchestration/outputs/OperatorDaemonArtifacts.ts
index 99a2107f..2978db51 100644
--- a/packages/cluster-tool/src/orchestration/outputs/OperatorDaemonArtifacts.ts
+++ b/packages/cluster-tool/src/orchestration/outputs/OperatorDaemonArtifacts.ts
@@ -11,6 +11,8 @@ export interface OperatorDaemonArtifacts {
   readonly ethereumAbiFiles: string[]
   /** Deployed Ethereum outpost addresses (from `outpost-addrs.json`). */
   readonly ethereumAddresses: Record<string, string>
+  /** Generated unified Ethereum client JSON shared by operator daemon processes. */
+  readonly ethereumClientConfigurationFile: string
   /** The OPP outpost program id (base58) — `liqsol_core`'s `declare_id`. */
   readonly solanaProgramId: string
   /** Cluster-local verbatim copy of the `liqsol_core` (OPP outpost) IDL. */
@@ -18,7 +20,8 @@ export interface OperatorDaemonArtifacts {
 }
 
 /** Typed cross-step handle to the prepared {@link OperatorDaemonArtifacts}. */
-export const OperatorDaemonArtifactsKey: OutputKey<OperatorDaemonArtifacts> = outputKey(
-  "cluster.operatorDaemonArtifacts",
-  "outpost deploy artifacts for operator daemon command lines (ETH ABIs + addrs, SOL program id + IDL)"
-)
+export const OperatorDaemonArtifactsKey: OutputKey<OperatorDaemonArtifacts> =
+  outputKey(
+    "cluster.operatorDaemonArtifacts",
+    "outpost artifacts for operator daemon command lines (ETH ABIs + client configs, SOL program id + IDL)"
+  )
diff --git a/packages/cluster-tool/src/tools/ethereum/EthereumClientConfiguration.ts b/packages/cluster-tool/src/tools/ethereum/EthereumClientConfiguration.ts
new file mode 100644
index 00000000..1068cf0c
--- /dev/null
+++ b/packages/cluster-tool/src/tools/ethereum/EthereumClientConfiguration.ts
@@ -0,0 +1,130 @@
+import Assert from "node:assert"
+
+/** Optional finite limits for one Ethereum signing client. */
+export interface EthereumTransactionPolicy {
+  readonly max_priority_fee_per_gas_wei: string
+  readonly max_fee_per_gas_wei: string
+  readonly max_gas_limit: string
+  readonly max_total_native_cost_wei: string
+}
+
+/** One connection in the unified nodeop Ethereum client configuration. */
+export interface EthereumClientEntry {
+  readonly client_id: string
+  readonly signature_provider_id: string
+  readonly rpc_url: string
+  readonly chain_id: string
+  readonly transaction_policy?: EthereumTransactionPolicy
+}
+
+/** Versioned JSON file consumed by `--outpost-ethereum-client-config-file`. */
+export interface EthereumClientConfigurationFile {
+  readonly version: number
+  readonly clients: readonly EthereumClientEntry[]
+}
+
+const CanonicalPositiveDecimal = /^[1-9][0-9]*$/,
+  SafeIdentifier = /^[A-Za-z0-9._-]{1,64}$/,
+  MaximumUint32 = (1n << 32n) - 1n,
+  MaximumUint256 = (1n << 256n) - 1n
+
+/** Build and validate the single-client config used by one cluster operator daemon. */
+export namespace EthereumClientConfiguration {
+  export const SchemaVersion = 1
+
+  export interface CreateOptions {
+    readonly clientId: string
+    readonly signatureProviderId: string
+    readonly rpcUrl: string
+    readonly chainId: number
+    readonly transactionPolicy?: EthereumTransactionPolicy
+  }
+
+  /** Create one unified client file; omitted policy means nodeop's maximum-value defaults. */
+  export function create(
+    options: CreateOptions
+  ): EthereumClientConfigurationFile {
+    const client: EthereumClientEntry = {
+      client_id: options.clientId,
+      signature_provider_id: options.signatureProviderId,
+      rpc_url: options.rpcUrl,
+      chain_id: String(options.chainId),
+      ...(options.transactionPolicy == null
+        ? {}
+        : { transaction_policy: options.transactionPolicy })
+    }
+    const file: EthereumClientConfigurationFile = {
+      version: SchemaVersion,
+      clients: [client]
+    }
+    assertValid(file)
+    return file
+  }
+
+  /** Assert a generated client file matches nodeop's strict schema and numeric domains. */
+  export function assertValid(file: EthereumClientConfigurationFile): void {
+    Assert.equal(
+      file.version,
+      SchemaVersion,
+      `Ethereum client configuration version must be ${SchemaVersion}`
+    )
+    Assert.equal(
+      file.clients.length,
+      1,
+      "Operator daemon Ethereum configuration must contain exactly one client"
+    )
+
+    const [client] = file.clients
+    Assert.match(
+      client.client_id,
+      SafeIdentifier,
+      "Ethereum client_id must be 1-64 ASCII letters, digits, '.', '_', or '-'"
+    )
+    Assert.ok(
+      client.signature_provider_id.length > 0,
+      "Ethereum signature_provider_id must not be empty"
+    )
+    const rpcUrl = new URL(client.rpc_url)
+    Assert.ok(
+      rpcUrl.protocol === "http:" || rpcUrl.protocol === "https:",
+      "Ethereum rpc_url must use http or https"
+    )
+    const chainId = positiveUint(client.chain_id, "chain_id", MaximumUint32)
+
+    if (client.transaction_policy == null) return
+    const policy = client.transaction_policy,
+      maximumPriorityFeePerGas = positiveUint(
+        policy.max_priority_fee_per_gas_wei,
+        "max_priority_fee_per_gas_wei",
+        MaximumUint256
+      ),
+      maximumFeePerGas = positiveUint(
+        policy.max_fee_per_gas_wei,
+        "max_fee_per_gas_wei",
+        MaximumUint256
+      )
+    positiveUint(policy.max_gas_limit, "max_gas_limit", MaximumUint256)
+    positiveUint(
+      policy.max_total_native_cost_wei,
+      "max_total_native_cost_wei",
+      MaximumUint256
+    )
+    Assert.ok(chainId > 0n)
+    Assert.ok(
+      maximumPriorityFeePerGas <= maximumFeePerGas,
+      "Ethereum priority-fee cap must not exceed maximum-fee cap"
+    )
+  }
+}
+
+/** Parse one canonical positive unsigned decimal bounded by `maximum`. */
+function positiveUint(value: string, field: string, maximum: bigint): bigint {
+  Assert.match(
+    value,
+    CanonicalPositiveDecimal,
+    `Ethereum ${field} must be a canonical positive decimal string`
+  )
+  const parsed = BigInt(value)
+  Assert.ok(parsed <= maximum, `Ethereum ${field} exceeds its supported domain`)
+  return parsed
+}
diff --git a/packages/cluster-tool/src/tools/ethereum/index.ts b/packages/cluster-tool/src/tools/ethereum/index.ts
index fdfd6284..cdd3f5e5 100644
--- a/packages/cluster-tool/src/tools/ethereum/index.ts
+++ b/packages/cluster-tool/src/tools/ethereum/index.ts
@@ -3,3 +3,4 @@ export * from "./EthereumCollateralTool.js"
 export * from "./EthereumSwapTool.js"
 export * from "./EthereumYieldEmitterTool.js"
 export * from "./EthereumNodeOwnerNftTool.js"
+export * from "./EthereumClientConfiguration.js"
diff --git a/packages/cluster-tool/src/tools/wire/OperatorDaemonTool.ts b/packages/cluster-tool/src/tools/wire/OperatorDaemonTool.ts
index f0d72ded..74f57e1f 100644
--- a/packages/cluster-tool/src/tools/wire/OperatorDaemonTool.ts
+++ b/packages/cluster-tool/src/tools/wire/OperatorDaemonTool.ts
@@ -8,7 +8,7 @@
  * {@link planArtifactPreparation} is a Step (run once, after both outpost deploys) that
  * writes the cluster-local artifact files and stores the typed
  * {@link OperatorDaemonArtifacts}; {@link batchOperatorArgs} /
- * {@link underwriterArgs} are PURE value builders the operator-node start runner
+ * {@link underwriterArgs} are pure value builders the operator-node start runner
  * composes into `NodeopProcess` extra args.
  */
 
@@ -41,6 +41,7 @@ import {
 } from "../../orchestration/outputs/OperatorDaemonArtifacts.js"
 import { Report } from "../../report/Report.js"
 import { StepExtraRecorder } from "../../report/tools/StepExtraRecorder.js"
+import { EthereumClientConfiguration } from "../ethereum/EthereumClientConfiguration.js"
 import { SolanaOutpostProgramTool } from "../solana/SolanaOutpostProgramTool.js"
 import { mkdirs } from "../../utils/fsUtils.js"
 import { scaleTimeoutMs } from "../../utils/asyncUtils.js"
@@ -84,6 +85,8 @@ export namespace OperatorDaemonTool {
   export const UnderwriterActionTimeoutMs = 30_000
   /** The single ethereum outpost client id every plugin arg references. */
   export const EthereumClientId = "eth-default"
+  /** Process-local signature-provider id referenced by the shared Ethereum client file. */
+  export const EthereumSignatureProviderId = "eth-default"
   /** The single solana outpost client id every plugin arg references. */
   export const SolanaClientId = "sol-default"
   /** The `sysio.chains` codename keying the ETH outpost wiring specs. */
@@ -118,6 +121,8 @@ export namespace OperatorDaemonTool {
   ] as const
   /** Cluster-data subpath holding the generated `{contractName, address, abi}` files. */
   export const EthereumAbiSubpath = "eth-abis"
+  /** Cluster-data filename for the shared unified Ethereum client configuration. */
+  export const EthereumClientConfigurationFilename = "ethereum-client.json"
   /** Cluster-data subpath holding the copied OPP outpost IDL. */
   export const SolanaIdlSubpath = "solana-idls"
   /** The OPP outpost IDL filename (cluster-local verbatim copy). */
@@ -151,8 +156,9 @@ export namespace OperatorDaemonTool {
    * Prepare the artifacts every operator daemon's command line references:
    * generate `<dataPath>/eth-abis/<Name>.json` (`{contractName, address, abi}`,
    * from the wire-ethereum hardhat artifacts + `outpost-addrs.json`), copy the
-   * `liqsol_core` (OPP outpost) IDL to `<dataPath>/solana-idls/`, resolve the SOL program id,
-   * and store the typed {@link OperatorDaemonArtifacts}. Runs ONCE, after both
+   * `liqsol_core` (OPP outpost) IDL to `<dataPath>/solana-idls/`, generate the
+   * unified Ethereum client file, resolve the SOL program id, and
+   * store the typed {@link OperatorDaemonArtifacts}. Runs ONCE, after both
    * outpost deploys, before any operator node starts.
    */
   export function planArtifactPreparation<
@@ -254,9 +260,27 @@ export namespace OperatorDaemonTool {
     )
     Fs.copyFileSync(idlSource, solanaIdlFile)
 
+    // Signature-provider ids are process-local, so every daemon can register
+    // its own key under the stable name referenced by this shared client file.
+    const ethereumClientConfigurationFile = Path.join(
+        dataPath,
+        EthereumClientConfigurationFilename
+      ),
+      ethereumClientConfiguration = EthereumClientConfiguration.create({
+        clientId: EthereumClientId,
+        signatureProviderId: EthereumSignatureProviderId,
+        rpcUrl: networkFromConfig(ctx.config).ethereumRpcUrl,
+        chainId: AnvilProcess.DefaultChainId
+      })
+    Fs.writeFileSync(
+      ethereumClientConfigurationFile,
+      JSON.stringify(ethereumClientConfiguration, null, 2)
+    )
+
     ctx.outputs.set(OperatorDaemonArtifactsKey, {
       ethereumAbiFiles,
       ethereumAddresses,
+      ethereumClientConfigurationFile,
       solanaProgramId,
       solanaIdlFile
     })
@@ -265,9 +289,10 @@ export namespace OperatorDaemonTool {
     StepExtraRecorder.record({
       client: "harness",
       kind: "artifact",
-      text: "address-embedded ETH ABI files + liqsol_core (OPP outpost) IDL prepared for the operator daemons",
+      text: "address-embedded ETH ABIs + unified Ethereum client config + liqsol_core IDL prepared for the operator daemons",
       ethereumAbiFiles,
       ethereumAddresses,
+      ethereumClientConfigurationFile,
       solanaProgramId,
       solanaIdlFile
     })
@@ -292,13 +317,13 @@ export namespace OperatorDaemonTool {
     )
   }
 
-  /** The outpost signature-provider + client specs shared by both daemon types. */
+  /** The outpost signature-provider + client configuration shared by both daemon types. */
   function outpostClientArgs(
     operator: OperatorAccount,
     artifacts: OperatorDaemonArtifacts,
     network: OperatorDaemonNetwork
   ): string[] {
-    const ethereumProvider = `eth-${operator.account}`,
+    const ethereumProvider = EthereumSignatureProviderId,
       solanaProvider = `sol-${operator.account}`
     return [
       ...pair(
@@ -306,13 +331,8 @@ export namespace OperatorDaemonTool {
         KeyGenerator.toSignatureProvider(operator.ethereum, ethereumProvider)
       ),
       ...pair(
-        "--outpost-ethereum-client",
-        [
-          EthereumClientId,
-          ethereumProvider,
-          network.ethereumRpcUrl,
-          String(network.ethereumChainId)
-        ].join(",")
+        "--outpost-ethereum-client-config-file",
+        artifacts.ethereumClientConfigurationFile
       ),
       ...artifacts.ethereumAbiFiles.flatMap(file =>
         pair("--ethereum-abi-file", file)
@@ -362,7 +382,7 @@ export namespace OperatorDaemonTool {
       // Per-chain outpost bindings (repeatable CSV specs; replaced the removed
       // --batch-eth-{client-id,opp-addr,opp-inbound-addr} / --batch-sol-program-id —
       // the EVM RPC client is auto-selected by matching the chains row's
-      // external_chain_id against the --outpost-ethereum-client chain ids):
+      // external_chain_id against the configured Ethereum client chain ids):
       //   EVM: <chain_code>,<opp_addr>,<opp_inbound_addr>
       //   SVM: <chain_code>,<opp_outpost_program_id>
       ...pair(
diff --git a/packages/cluster-tool/tests/orchestration/steps/processes/NodeopProcessSteps.test.ts b/packages/cluster-tool/tests/orchestration/steps/processes/NodeopProcessSteps.test.ts
index 2d0df131..52d94986 100644
--- a/packages/cluster-tool/tests/orchestration/steps/processes/NodeopProcessSteps.test.ts
+++ b/packages/cluster-tool/tests/orchestration/steps/processes/NodeopProcessSteps.test.ts
@@ -17,7 +17,8 @@ import { ethereumKeyPairFromWallet } from "@wireio/cluster-tool/utils"
 import { fixtureContext } from "../../../config/clusterBuildContextFixture.js"
 
 /** anvil's deterministic mnemonic — HD-derived wallets are stable + well-known. */
-const AnvilMnemonic = "test test test test test test test test test test test junk"
+const AnvilMnemonic =
+  "test test test test test test test test test test test junk"
 
 /**
  * A fully-keyed OperatorAccount fixture for the given account/type — REAL
@@ -33,7 +34,11 @@ function operatorAccount(account: string, type: OperatorType): OperatorAccount {
   return {
     account,
     type,
-    wire: { type: KeyType.K1, publicKey: `PUB_K1_${account}`, privateKey: `PVT_K1_${account}` },
+    wire: {
+      type: KeyType.K1,
+      publicKey: `PUB_K1_${account}`,
+      privateKey: `PVT_K1_${account}`
+    },
     ethereum: ethereumKeyPairFromWallet(wallet),
     solana: {
       type: KeyType.ED,
@@ -52,6 +57,7 @@ const artifactsFixture: OperatorDaemonArtifacts = {
     OperatorRegistry: "0x3333333333333333333333333333333333333333",
     ReserveManager: "0x4444444444444444444444444444444444444444"
   },
+  ethereumClientConfigurationFile: "/cluster/data/ethereum-client.json",
   solanaProgramId: "GrqvbZLCLkfeSQqvE7rL8XKHVWjNhAG2faLsY8yr9tD5",
   solanaIdlFile: "/cluster/data/solana-idls/liqsol_core.json"
 }
@@ -131,7 +137,10 @@ describe("Steps.processes.nodeop", () => {
       expect(recoverySpy).toHaveBeenCalledWith(
         ctx.processManager,
         expect.objectContaining({
-          node: expect.objectContaining({ name: bios.name, role: NodeRole.bios })
+          node: expect.objectContaining({
+            name: bios.name,
+            role: NodeRole.bios
+          })
         })
       )
     } finally {
@@ -155,7 +164,11 @@ describe("Steps.processes.nodeop", () => {
       ctx.keyStore.pushNodes({
         index: 1,
         keys: {
-          k1: { type: KeyType.K1, publicKey: "PUB_K1_node1", privateKey: "PVT_K1_node1" },
+          k1: {
+            type: KeyType.K1,
+            publicKey: "PUB_K1_node1",
+            privateKey: "PVT_K1_node1"
+          },
           bls: {
             type: KeyType.BLS,
             publicKey: "PUB_BLS_node1",
@@ -164,7 +177,9 @@ describe("Steps.processes.nodeop", () => {
           }
         }
       })
-      const node = testNode(ctx, NodeRole.producer, 1, "node_01", ["defproducera"])
+      const node = testNode(ctx, NodeRole.producer, 1, "node_01", [
+        "defproducera"
+      ])
       const operator = Steps.processes.nodeop.resolveOperator(ctx, node)
       expect(operator.account).toBe("defproducera")
       expect(operator.type).toBe(OperatorType.PRODUCER)
@@ -176,16 +191,38 @@ describe("Steps.processes.nodeop", () => {
       const ctx = fixtureContext()
       const provisioned = operatorAccount("batchopaaaa", OperatorType.BATCH)
       ctx.keyStore.setOperator(provisioned)
-      const node = testNode(ctx, NodeRole.operator, 2, "node_02", [], "batchopaaaa")
-      expect(Steps.processes.nodeop.resolveOperator(ctx, node)).toBe(provisioned)
+      const node = testNode(
+        ctx,
+        NodeRole.operator,
+        2,
+        "node_02",
+        [],
+        "batchopaaaa"
+      )
+      expect(Steps.processes.nodeop.resolveOperator(ctx, node)).toBe(
+        provisioned
+      )
     })
 
     it("operator node (underwriter) resolves the provisioned account from ctx.keyStore", () => {
       const ctx = fixtureContext()
-      const provisioned = operatorAccount("underwriteraaaa", OperatorType.UNDERWRITER)
+      const provisioned = operatorAccount(
+        "underwriteraaaa",
+        OperatorType.UNDERWRITER
+      )
       ctx.keyStore.setOperator(provisioned)
-      const node = testNode(ctx, NodeRole.operator, 3, "node_03", [], null, "underwriteraaaa")
-      expect(Steps.processes.nodeop.resolveOperator(ctx, node)).toBe(provisioned)
+      const node = testNode(
+        ctx,
+        NodeRole.operator,
+        3,
+        "node_03",
+        [],
+        null,
+        "underwriteraaaa"
+      )
+      expect(Steps.processes.nodeop.resolveOperator(ctx, node)).toBe(
+        provisioned
+      )
     })
 
     it("throws when an operator node names no batch/underwriter account", () => {
@@ -198,7 +235,14 @@ describe("Steps.processes.nodeop", () => {
 
     it("throws when the named operator account has not been provisioned in ctx.keyStore", () => {
       const ctx = fixtureContext()
-      const node = testNode(ctx, NodeRole.operator, 5, "node_05", [], "unprovisioned")
+      const node = testNode(
+        ctx,
+        NodeRole.operator,
+        5,
+        "node_05",
+        [],
+        "unprovisioned"
+      )
       expect(() => Steps.processes.nodeop.resolveOperator(ctx, node)).toThrow(
         /has not been provisioned/
       )
@@ -220,7 +264,9 @@ describe("Steps.processes.nodeop", () => {
 
     it("returns [] for a producer node", () => {
       const ctx = fixtureContext()
-      const node = testNode(ctx, NodeRole.producer, 1, "node_01", ["defproducera"])
+      const node = testNode(ctx, NodeRole.producer, 1, "node_01", [
+        "defproducera"
+      ])
       expect(
         Steps.processes.nodeop.resolveOperatorDaemonArgs(
           ctx,
@@ -234,14 +280,27 @@ describe("Steps.processes.nodeop", () => {
       const ctx = fixtureContext()
       ctx.outputs.set(OperatorDaemonArtifactsKey, artifactsFixture)
       const account = operatorAccount("batchopaaaa", OperatorType.BATCH)
-      const node = testNode(ctx, NodeRole.operator, 2, "node_02", [], "batchopaaaa")
-      const args = Steps.processes.nodeop.resolveOperatorDaemonArgs(ctx, node, account)
+      const node = testNode(
+        ctx,
+        NodeRole.operator,
+        2,
+        "node_02",
+        [],
+        "batchopaaaa"
+      )
+      const args = Steps.processes.nodeop.resolveOperatorDaemonArgs(
+        ctx,
+        node,
+        account
+      )
       expect(args).toEqual(
         expect.arrayContaining([
           "--batch-enabled",
           "true",
           "--batch-operator-account",
-          "batchopaaaa"
+          "batchopaaaa",
+          "--outpost-ethereum-client-config-file",
+          artifactsFixture.ethereumClientConfigurationFile
         ])
       )
     })
@@ -249,15 +308,32 @@ describe("Steps.processes.nodeop", () => {
     it("builds underwriter daemon args for an operator node with an underwriterAccount", () => {
       const ctx = fixtureContext()
       ctx.outputs.set(OperatorDaemonArtifactsKey, artifactsFixture)
-      const account = operatorAccount("underwriteraaaa", OperatorType.UNDERWRITER)
-      const node = testNode(ctx, NodeRole.operator, 3, "node_03", [], null, "underwriteraaaa")
-      const args = Steps.processes.nodeop.resolveOperatorDaemonArgs(ctx, node, account)
+      const account = operatorAccount(
+        "underwriteraaaa",
+        OperatorType.UNDERWRITER
+      )
+      const node = testNode(
+        ctx,
+        NodeRole.operator,
+        3,
+        "node_03",
+        [],
+        null,
+        "underwriteraaaa"
+      )
+      const args = Steps.processes.nodeop.resolveOperatorDaemonArgs(
+        ctx,
+        node,
+        account
+      )
       expect(args).toEqual(
         expect.arrayContaining([
           "--underwriter-enabled",
           "true",
           "--underwriter-account",
-          "underwriteraaaa"
+          "underwriteraaaa",
+          "--outpost-ethereum-client-config-file",
+          artifactsFixture.ethereumClientConfigurationFile
         ])
       )
     })
@@ -265,7 +341,14 @@ describe("Steps.processes.nodeop", () => {
     it("throws when the operator daemon artifacts have not been prepared yet", () => {
       const ctx = fixtureContext()
       const account = operatorAccount("batchopbbbb", OperatorType.BATCH)
-      const node = testNode(ctx, NodeRole.operator, 4, "node_04", [], "batchopbbbb")
+      const node = testNode(
+        ctx,
+        NodeRole.operator,
+        4,
+        "node_04",
+        [],
+        "batchopbbbb"
+      )
       expect(() =>
         Steps.processes.nodeop.resolveOperatorDaemonArgs(ctx, node, account)
       ).toThrow(/Missing asserted output/)
diff --git a/packages/cluster-tool/tests/tools/ethereum/EthereumClientConfiguration.test.ts b/packages/cluster-tool/tests/tools/ethereum/EthereumClientConfiguration.test.ts
new file mode 100644
index 00000000..3bf2d28c
--- /dev/null
+++ b/packages/cluster-tool/tests/tools/ethereum/EthereumClientConfiguration.test.ts
@@ -0,0 +1,137 @@
+import {
+  EthereumClientConfiguration,
+  type EthereumClientConfigurationFile,
+  type EthereumTransactionPolicy
+} from "@wireio/cluster-tool/tools/ethereum"
+
+const BaseOptions: EthereumClientConfiguration.CreateOptions = {
+  clientId: "eth-default",
+  signatureProviderId: "eth-batchopaaaa",
+  rpcUrl: "http://127.0.0.1:8545",
+  chainId: 31_337
+}
+
+const FinitePolicy: EthereumTransactionPolicy = {
+  max_priority_fee_per_gas_wei: "2000000000",
+  max_fee_per_gas_wei: "100000000000",
+  max_gas_limit: "2000000",
+  max_total_native_cost_wei: "250000000000000000"
+}
+
+function fileWith(
+  changes: Partial<EthereumClientConfigurationFile["clients"][number]>
+): EthereumClientConfigurationFile {
+  const file = EthereumClientConfiguration.create(BaseOptions)
+  return { ...file, clients: [{ ...file.clients[0], ...changes }] }
+}
+
+describe("EthereumClientConfiguration", () => {
+  it("creates the unified schema without a policy so nodeop applies permissive defaults", () => {
+    expect(EthereumClientConfiguration.create(BaseOptions)).toEqual({
+      version: 1,
+      clients: [
+        {
+          client_id: "eth-default",
+          signature_provider_id: "eth-batchopaaaa",
+          rpc_url: "http://127.0.0.1:8545",
+          chain_id: "31337"
+        }
+      ]
+    })
+  })
+
+  it("includes and validates an explicitly requested finite policy", () => {
+    expect(
+      EthereumClientConfiguration.create({
+        ...BaseOptions,
+        transactionPolicy: FinitePolicy
+      }).clients[0].transaction_policy
+    ).toEqual(FinitePolicy)
+  })
+
+  it("accepts identifier boundaries and rejects unsafe client ids", () => {
+    expect(
+      EthereumClientConfiguration.create({
+        ...BaseOptions,
+        clientId: "a".repeat(64)
+      }).clients[0].client_id
+    ).toHaveLength(64)
+    expect(() =>
+      EthereumClientConfiguration.create({ ...BaseOptions, clientId: "" })
+    ).toThrow(/client_id must be 1-64 ASCII/)
+    expect(() =>
+      EthereumClientConfiguration.create({ ...BaseOptions, clientId: "bad,id" })
+    ).toThrow(/client_id must be 1-64 ASCII/)
+  })
+
+  it("rejects missing providers, unsupported URLs, and non-uint32 chain ids", () => {
+    expect(() =>
+      EthereumClientConfiguration.create({
+        ...BaseOptions,
+        signatureProviderId: ""
+      })
+    ).toThrow(/signature_provider_id must not be empty/)
+    expect(() =>
+      EthereumClientConfiguration.create({
+        ...BaseOptions,
+        rpcUrl: "ws://127.0.0.1:8545"
+      })
+    ).toThrow(/rpc_url must use http or https/)
+    expect(() =>
+      EthereumClientConfiguration.create({ ...BaseOptions, chainId: 2 ** 32 })
+    ).toThrow(/chain_id exceeds its supported domain/)
+  })
+
+  it("rejects non-canonical, overflowing, and inconsistent finite policies", () => {
+    expect(() =>
+      EthereumClientConfiguration.assertValid(
+        fileWith({
+          transaction_policy: { ...FinitePolicy, max_gas_limit: "02000000" }
+        })
+      )
+    ).toThrow(/max_gas_limit must be a canonical positive decimal string/)
+    expect(() =>
+      EthereumClientConfiguration.assertValid(
+        fileWith({
+          transaction_policy: {
+            ...FinitePolicy,
+            max_gas_limit: (1n << 256n).toString()
+          }
+        })
+      )
+    ).toThrow(/max_gas_limit exceeds its supported domain/)
+    expect(() =>
+      EthereumClientConfiguration.assertValid(
+        fileWith({
+          transaction_policy: {
+            ...FinitePolicy,
+            max_priority_fee_per_gas_wei: "100000000001"
+          }
+        })
+      )
+    ).toThrow(/priority-fee cap must not exceed maximum-fee cap/)
+  })
+
+  it("accepts an independent total-cost cap below the gas and fee caps' product", () => {
+    expect(() =>
+      EthereumClientConfiguration.assertValid(
+        fileWith({
+          transaction_policy: {
+            ...FinitePolicy,
+            max_total_native_cost_wei: "1"
+          }
+        })
+      )
+    ).not.toThrow()
+  })
+
+  it("rejects a wrong schema version or client count", () => {
+    const file = EthereumClientConfiguration.create(BaseOptions)
+    expect(() =>
+      EthereumClientConfiguration.assertValid({ ...file, version: 2 })
+    ).toThrow(/version must be 1/)
+    expect(() =>
+      EthereumClientConfiguration.assertValid({ ...file, clients: [] })
+    ).toThrow(/must contain exactly one client/)
+  })
+})
diff --git a/packages/cluster-tool/tests/tools/wire/OperatorDaemonTool.test.ts b/packages/cluster-tool/tests/tools/wire/OperatorDaemonTool.test.ts
index d59e7845..414a99f4 100644
--- a/packages/cluster-tool/tests/tools/wire/OperatorDaemonTool.test.ts
+++ b/packages/cluster-tool/tests/tools/wire/OperatorDaemonTool.test.ts
@@ -20,7 +20,8 @@ import { fixtureContext } from "../../config/clusterBuildContextFixture.js"
 import { ethereumKeyPairFromWallet } from "@wireio/cluster-tool/utils"
 
 /** anvil's deterministic mnemonic — HD-derived wallets are stable + well-known. */
-const AnvilMnemonic = "test test test test test test test test test test test junk"
+const AnvilMnemonic =
+  "test test test test test test test test test test test junk"
 
 function operatorAccount(account: string, type: OperatorType): OperatorAccount {
   const wallet = ethers.HDNodeWallet.fromMnemonic(
@@ -31,7 +32,11 @@ function operatorAccount(account: string, type: OperatorType): OperatorAccount {
   return {
     account,
     type,
-    wire: { type: KeyType.K1, publicKey: `PUB_K1_${account}`, privateKey: `PVT_K1_${account}` },
+    wire: {
+      type: KeyType.K1,
+      publicKey: `PUB_K1_${account}`,
+      privateKey: `PVT_K1_${account}`
+    },
     ethereum: ethereumKeyPairFromWallet(wallet),
     solana: {
       type: KeyType.ED,
@@ -42,13 +47,17 @@ function operatorAccount(account: string, type: OperatorType): OperatorAccount {
 }
 
 const artifacts: OperatorDaemonArtifacts = {
-  ethereumAbiFiles: ["/cluster/data/eth-abis/OPP.json", "/cluster/data/eth-abis/OPPInbound.json"],
+  ethereumAbiFiles: [
+    "/cluster/data/eth-abis/OPP.json",
+    "/cluster/data/eth-abis/OPPInbound.json"
+  ],
   ethereumAddresses: {
     OPP: "0x1111111111111111111111111111111111111111",
     OPPInbound: "0x2222222222222222222222222222222222222222",
     OperatorRegistry: "0x3333333333333333333333333333333333333333",
     ReserveManager: "0x4444444444444444444444444444444444444444"
   },
+  ethereumClientConfigurationFile: "/cluster/data/ethereum-client.json",
   solanaProgramId: "GrqvbZLCLkfeSQqvE7rL8XKHVWjNhAG2faLsY8yr9tD5",
   solanaIdlFile: "/cluster/data/solana-idls/liqsol_core.json"
 }
@@ -81,7 +90,10 @@ describe("OperatorDaemonTool", () => {
       try {
         await OperatorDaemonTool.runDaemonStart(
           ctx,
-          { kind: "OperatorDaemonTool.StartDaemonInput", account: "batchopbbbb" },
+          {
+            kind: "OperatorDaemonTool.StartDaemonInput",
+            account: "batchopbbbb"
+          },
           new AbortController().signal
         )
         // A flow rerun reuses the daemon's data dir, so this launch must go
@@ -90,7 +102,11 @@ describe("OperatorDaemonTool", () => {
           ctx.processManager,
           expect.objectContaining({
             operator,
-            extraArgs: expect.arrayContaining(["--batch-enabled"])
+            extraArgs: expect.arrayContaining([
+              "--batch-enabled",
+              "--outpost-ethereum-client-config-file",
+              artifacts.ethereumClientConfigurationFile
+            ])
           })
         )
       } finally {
@@ -101,11 +117,17 @@ describe("OperatorDaemonTool", () => {
 
   describe("batchOperatorArgs", () => {
     const operator = operatorAccount("batchopaaaa", OperatorType.BATCH)
-    const args = OperatorDaemonTool.batchOperatorArgs(operator, artifacts, network)
+    const args = OperatorDaemonTool.batchOperatorArgs(
+      operator,
+      artifacts,
+      network
+    )
 
     it("loads the batch plugin set at irreversible read-mode", () => {
       expect(valuesOf(args, "--read-mode")).toEqual(["irreversible"])
-      expect(valuesOf(args, "--plugin")).toEqual([...OperatorDaemonTool.BatchOperatorPlugins])
+      expect(valuesOf(args, "--plugin")).toEqual([
+        ...OperatorDaemonTool.BatchOperatorPlugins
+      ])
     })
 
     it("signs WIRE with the operator's OWN unique wire key (account active)", () => {
@@ -113,27 +135,42 @@ describe("OperatorDaemonTool", () => {
       expect(providers[0]).toBe(
         "wire-PUB_K1_batchopaaaa,wire,wire,PUB_K1_batchopaaaa,KEY:PVT_K1_batchopaaaa"
       )
-      // + the ETH and SOL outpost providers, named per-operator
+      // ETH uses a process-local stable id; SOL keeps its per-operator id.
       expect(providers.length).toBe(3)
-      expect(providers[1]).toMatch(/^eth-batchopaaaa,ethereum,ethereum,0x[0-9a-fA-F]{128},KEY:0x/)
+      expect(providers[1]).toMatch(
+        /^eth-default,ethereum,ethereum,0x[0-9a-fA-F]{128},KEY:0x/
+      )
       expect(providers[2]).toMatch(/^sol-batchopaaaa,solana,solana,/)
     })
 
     it("configures the batch plugin + both outpost clients + artifacts", () => {
       expect(valuesOf(args, "--batch-enabled")).toEqual(["true"])
-      expect(valuesOf(args, "--batch-operator-account")).toEqual(["batchopaaaa"])
-      expect(valuesOf(args, "--batch-epoch-poll-ms")).toEqual([String(OperatorDaemonTool.BatchEpochPollMs)])
-      expect(valuesOf(args, "--batch-delivery-timeout-ms")).toEqual([String(OperatorDaemonTool.BatchDeliveryTimeoutMs)])
-      expect(valuesOf(args, "--ext-debugging-server")).toEqual([network.debuggingServerUrl])
-      expect(valuesOf(args, "--outpost-ethereum-client")).toEqual([
-        `eth-default,eth-batchopaaaa,${network.ethereumRpcUrl},31337`
+      expect(valuesOf(args, "--batch-operator-account")).toEqual([
+        "batchopaaaa"
+      ])
+      expect(valuesOf(args, "--batch-epoch-poll-ms")).toEqual([
+        String(OperatorDaemonTool.BatchEpochPollMs)
+      ])
+      expect(valuesOf(args, "--batch-delivery-timeout-ms")).toEqual([
+        String(OperatorDaemonTool.BatchDeliveryTimeoutMs)
+      ])
+      expect(valuesOf(args, "--ext-debugging-server")).toEqual([
+        network.debuggingServerUrl
+      ])
+      expect(valuesOf(args, "--outpost-ethereum-client")).toEqual([])
+      expect(valuesOf(args, "--outpost-ethereum-client-config-file")).toEqual([
+        artifacts.ethereumClientConfigurationFile
       ])
       expect(valuesOf(args, "--outpost-solana-client")).toEqual([
         `sol-default,sol-batchopaaaa,${network.solanaRpcUrl}`
       ])
-      expect(valuesOf(args, "--ethereum-abi-file")).toEqual(artifacts.ethereumAbiFiles)
+      expect(valuesOf(args, "--ethereum-abi-file")).toEqual(
+        artifacts.ethereumAbiFiles
+      )
       expect(valuesOf(args, "--batch-sol-client-id")).toEqual(["sol-default"])
-      expect(valuesOf(args, "--solana-idl-file")).toEqual([artifacts.solanaIdlFile])
+      expect(valuesOf(args, "--solana-idl-file")).toEqual([
+        artifacts.solanaIdlFile
+      ])
       // The cleanroom hosts the outpost interface in liqsol_core — nodeop's
       // IDL-name gate must be pointed at it.
       expect(valuesOf(args, "--solana-outpost-program-name")).toEqual([
@@ -148,7 +185,10 @@ describe("OperatorDaemonTool", () => {
           artifacts.ethereumAddresses.OPP,
           artifacts.ethereumAddresses.OPPInbound
         ].join(","),
-        [OperatorDaemonTool.SolanaChainCodename, artifacts.solanaProgramId].join(",")
+        [
+          OperatorDaemonTool.SolanaChainCodename,
+          artifacts.solanaProgramId
+        ].join(",")
       ])
     })
 
@@ -172,12 +212,20 @@ describe("OperatorDaemonTool", () => {
 
   describe("underwriterArgs", () => {
     const operator = operatorAccount("uwritaaaaaa", OperatorType.UNDERWRITER)
-    const args = OperatorDaemonTool.underwriterArgs(operator, artifacts, network)
+    const args = OperatorDaemonTool.underwriterArgs(
+      operator,
+      artifacts,
+      network
+    )
 
     it("passes the SCALED action timeout (flow timing scale reaches the daemon)", () => {
       process.env.WIRE_FLOW_TIMEOUT_SCALE = "4"
       try {
-        const scaled = OperatorDaemonTool.underwriterArgs(operator, artifacts, network)
+        const scaled = OperatorDaemonTool.underwriterArgs(
+          operator,
+          artifacts,
+          network
+        )
         expect(valuesOf(scaled, "--underwriter-action-timeout-ms")).toEqual([
           String(OperatorDaemonTool.UnderwriterActionTimeoutMs * 4)
         ])
@@ -187,15 +235,41 @@ describe("OperatorDaemonTool", () => {
     })
 
     it("loads the underwriter plugin set + source-deposit verification targets", () => {
-      expect(valuesOf(args, "--plugin")).toEqual([...OperatorDaemonTool.UnderwriterPlugins])
+      expect(valuesOf(args, "--plugin")).toEqual([
+        ...OperatorDaemonTool.UnderwriterPlugins
+      ])
       expect(valuesOf(args, "--underwriter-enabled")).toEqual(["true"])
       expect(valuesOf(args, "--underwriter-account")).toEqual(["uwritaaaaaa"])
-      expect(valuesOf(args, "--underwriter-eth-source-deposit-function")).toEqual(["requestSwap"])
-      expect(valuesOf(args, "--underwriter-sol-source-deposit-instruction")).toEqual(["request_swap"])
-      expect(valuesOf(args, "--solana-idl-file")).toEqual([artifacts.solanaIdlFile])
+      expect(
+        valuesOf(args, "--underwriter-eth-source-deposit-function")
+      ).toEqual(["requestSwap"])
+      expect(
+        valuesOf(args, "--underwriter-sol-source-deposit-instruction")
+      ).toEqual(["request_swap"])
+      expect(valuesOf(args, "--solana-idl-file")).toEqual([
+        artifacts.solanaIdlFile
+      ])
       expect(valuesOf(args, "--solana-outpost-program-name")).toEqual([
         SolanaOutpostProgramTool.ProgramName
       ])
+      expect(
+        valuesOf(args, "--outpost-ethereum-client-config-file")
+      ).toHaveLength(1)
+    })
+
+    it("reuses the shared config and process-local provider id across daemons", () => {
+      const secondArgs = OperatorDaemonTool.underwriterArgs(
+        operatorAccount("uwritbbbbbb", OperatorType.UNDERWRITER),
+        artifacts,
+        network
+      )
+      expect(valuesOf(args, "--signature-provider")[1]).toMatch(/^eth-default,/)
+      expect(valuesOf(secondArgs, "--signature-provider")[1]).toMatch(
+        /^eth-default,/
+      )
+      expect(
+        valuesOf(secondArgs, "--outpost-ethereum-client-config-file")
+      ).toEqual(valuesOf(args, "--outpost-ethereum-client-config-file"))
     })
 
     it("wires each outpost with one consolidated per-chain CSV spec", () => {
@@ -238,7 +312,13 @@ describe("OperatorDaemonTool", () => {
         Path.join(ethereumDeploymentsPath, "outpost-addrs.json"),
         JSON.stringify({ OPP: "0xaaa0000000000000000000000000000000000aaa" })
       )
-      const oppArtifactDir = Path.join(ethereumPath, "artifacts", "contracts", "outpost", "OPP.sol")
+      const oppArtifactDir = Path.join(
+        ethereumPath,
+        "artifacts",
+        "contracts",
+        "outpost",
+        "OPP.sol"
+      )
       Fs.mkdirSync(oppArtifactDir, { recursive: true })
       Fs.writeFileSync(
         Path.join(oppArtifactDir, "OPP.json"),
@@ -258,7 +338,9 @@ describe("OperatorDaemonTool", () => {
         Path.join(solanaPath, "target", "idl", "liqsol_core.json"),
         JSON.stringify({
           metadata: { name: "liqsol_core" },
-          instructions: OperatorDaemonTool.RequiredSolanaIdlInstructions.map(name => ({ name }))
+          instructions: OperatorDaemonTool.RequiredSolanaIdlInstructions.map(
+            name => ({ name })
+          )
         })
       )
 
@@ -271,23 +353,69 @@ describe("OperatorDaemonTool", () => {
         ethereumPath,
         solanaPath
       })
-      await OperatorDaemonTool.runArtifactPreparation(ctx, null, new AbortController().signal)
+      await OperatorDaemonTool.runArtifactPreparation(
+        ctx,
+        null,
+        new AbortController().signal
+      )
 
       const prepared = ctx.outputs.assert(OperatorDaemonArtifactsKey)
       expect(prepared.solanaProgramId).toBe(programKeypair.publicKey.toBase58())
       expect(Fs.existsSync(prepared.solanaIdlFile)).toBe(true)
       // Verbatim copy under the liqsol_core filename — metadata.name is NOT
       // rewritten (nodeop is pointed at it via --solana-outpost-program-name).
-      expect(Path.basename(prepared.solanaIdlFile)).toBe(OperatorDaemonTool.SolanaIdlFilename)
-      const copiedIdl = JSON.parse(Fs.readFileSync(prepared.solanaIdlFile, "utf-8"))
+      expect(Path.basename(prepared.solanaIdlFile)).toBe(
+        OperatorDaemonTool.SolanaIdlFilename
+      )
+      const copiedIdl = JSON.parse(
+        Fs.readFileSync(prepared.solanaIdlFile, "utf-8")
+      )
       expect(copiedIdl.metadata.name).toBe(SolanaOutpostProgramTool.ProgramName)
       expect(prepared.ethereumAbiFiles.length).toBe(1)
-      const abi = JSON.parse(Fs.readFileSync(prepared.ethereumAbiFiles[0], "utf-8"))
+      const abi = JSON.parse(
+        Fs.readFileSync(prepared.ethereumAbiFiles[0], "utf-8")
+      )
       expect(abi).toEqual({
         contractName: "OPP",
         address: "0xaaa0000000000000000000000000000000000aaa",
         abi: [{ type: "event", name: "OPPEnvelope" }]
       })
+      expect(Path.basename(prepared.ethereumClientConfigurationFile)).toBe(
+        OperatorDaemonTool.EthereumClientConfigurationFilename
+      )
+      expect(
+        JSON.parse(
+          Fs.readFileSync(prepared.ethereumClientConfigurationFile, "utf-8")
+        )
+      ).toEqual({
+        version: 1,
+        clients: [
+          {
+            client_id: "eth-default",
+            signature_provider_id: "eth-default",
+            rpc_url: OperatorDaemonTool.networkFromConfig(ctx.config)
+              .ethereumRpcUrl,
+            chain_id: "31337"
+          }
+        ]
+      })
+
+      // Saved-cluster `run` invokes the same preparation runner and overwrites
+      // stale content without a state migration.
+      Fs.writeFileSync(
+        prepared.ethereumClientConfigurationFile,
+        JSON.stringify({ stale: true })
+      )
+      await OperatorDaemonTool.runArtifactPreparation(
+        ctx,
+        null,
+        new AbortController().signal
+      )
+      expect(
+        JSON.parse(
+          Fs.readFileSync(prepared.ethereumClientConfigurationFile, "utf-8")
+        ).clients[0].signature_provider_id
+      ).toBe("eth-default")
     })
 
     it("rejects an IDL missing a daemon-invoked instruction (wrong/stale IDL guard)", async () => {
@@ -300,7 +428,13 @@ describe("OperatorDaemonTool", () => {
         Path.join(ethereumDeploymentsPath, "outpost-addrs.json"),
         JSON.stringify({ OPP: "0xaaa0000000000000000000000000000000000aaa" })
       )
-      const oppArtifactDir = Path.join(ethereumPath, "artifacts", "contracts", "outpost", "OPP.sol")
+      const oppArtifactDir = Path.join(
+        ethereumPath,
+        "artifacts",
+        "contracts",
+        "outpost",
+        "OPP.sol"
+      )
       Fs.mkdirSync(oppArtifactDir, { recursive: true })
       Fs.writeFileSync(
         Path.join(oppArtifactDir, "OPP.json"),
@@ -329,7 +463,11 @@ describe("OperatorDaemonTool", () => {
         solanaPath
       })
       await expect(
-        OperatorDaemonTool.runArtifactPreparation(ctx, null, new AbortController().signal)
+        OperatorDaemonTool.runArtifactPreparation(
+          ctx,
+          null,
+          new AbortController().signal
+        )
       ).rejects.toThrow(/missing the 'epoch_in' instruction/)
     })
   })