From 532d19853c4647c177f230bd9b32c0b27bf57b32 Mon Sep 17 00:00:00 2001 From: igneum-labs <337424239+igneum-labs@users.noreply.github.com> Date: Wed, 7 Oct 2026 20:47:43 +0000 Subject: [PATCH] release rules 5: the publisher's digest gate check (an app entry whose pin's digest differs from the network's is refused without the move's clock) Co-Authored-By: Claude Fable 5.1 --- docs/plans/release-rules.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/plans/release-rules.md b/docs/plans/release-rules.md index 3a4b8f5ab..9f9282b2d 100644 --- a/docs/plans/release-rules.md +++ b/docs/plans/release-rules.md @@ -9,7 +9,7 @@ Every cut of the Igneum Miner app and its node runs under these. The dated plan 4c. **The proving ids gate (main, 7 October 2026, after the 0.3.20 blocker).** On every candidate, a node started on the LIVE override file reports both proving ids (the shard program id and the aggregator id) on its proving v1 start line, and a prover's first statement against it is accepted; a zero-id statement is the known-failed shape. It runs beside the kept-datadir read, since both share the warm pod. Why: c4459193 read the ids as unknown, built statements with zeros and refused every proof; a sweep would have stopped every prover's pay. 4a. **Every gate starts on every candidate the moment its binary builds, never after the pin (the founder, 7 October 2026).** The digest and mixed-version gates, the kept-datadir start, the relay and poison cases and the wipe canary all begin on each candidate binary as it lands; a struck candidate's runs are stopped and its successor's begin. The post-pin wait is then the longest single form (about 80 minutes, the wipe), not the sum. 4b. **Warm pods per gate class (the founder, 7 October 2026, ordered to the fleet lane).** The fleet keeps synced pods warm for each gate class so a case form's target starts at the tip (a kept copy of the live line, caught up), never from a kept copy far behind it; the wipe canary is the only full IBD in the set. -5. **Rollout in waves, each box read back (the founder, 7 October 2026, replacing one-box-at-a-time):** PC 1 first, then PC 2, the Mac, the seed, the hands and the fleet in parallel waves as the lock lines allow; a lock line from the hub between waves; hold if the frozen table's signed share reads under 75; every box read back by its commit string. When the publish moves the consensus floor (a new digest), every 0.3.x node on the old file refuses the new ones as peers until it is swept, so the seed, the hands and the fleet move in the first wave with the apps' pollers, not last. Every lock line of a sweep that replaces nodes carrying a consensus floor names the date the sweep must finish (0.3.20: before 13 October 2026 09:00 UK). The wave list is written, not remembered: every sweep's first wave names each Hetzner seed by address (188.245.5.161:26611 for the shared devnet; the testnet seeds when they move) beside the hands and the fleet, and the seed's row closes only on its own read-back line (string, digest, first accepted block) from the lane that holds its key (the build-server lane, infra/devnet/restart-seed.sh). Added 7 October 2026 after the 0.3.20 sweep left the seed on the old object for one hour forty, found by the 0.3.21 wipe canary's reject lines. **Digest-moving node releases (7 October 2026, after the 2720d8d2 split):** when the node commit moves the consensus params digest (a height, a floor, a new switch field), a one-box-at-a-time sweep is a network split (dn3-g1 sat alone twenty minutes on its own fork at 21:18 BST), so the move is the 0.3.20 floor-move form: the binaries pre-placed on every node of the network (the fleet's, the hands, the seeds, the pool pair, every second node), every node restarted inside one minute at a clock named ten minutes ahead, the digest read back per node after, the first lock on the new side as the line; the apps' entries (manifest, HiveOS alias) publish at that minute or after, never before, so no app sits alone on the new digest. The one-box form is for digest-preserving releases only (34a2dbaa tonight). The release note names which form a release takes before its first box moves. +5. **Rollout in waves, each box read back (the founder, 7 October 2026, replacing one-box-at-a-time):** PC 1 first, then PC 2, the Mac, the seed, the hands and the fleet in parallel waves as the lock lines allow; a lock line from the hub between waves; hold if the frozen table's signed share reads under 75; every box read back by its commit string. When the publish moves the consensus floor (a new digest), every 0.3.x node on the old file refuses the new ones as peers until it is swept, so the seed, the hands and the fleet move in the first wave with the apps' pollers, not last. Every lock line of a sweep that replaces nodes carrying a consensus floor names the date the sweep must finish (0.3.20: before 13 October 2026 09:00 UK). The wave list is written, not remembered: every sweep's first wave names each Hetzner seed by address (188.245.5.161:26611 for the shared devnet; the testnet seeds when they move) beside the hands and the fleet, and the seed's row closes only on its own read-back line (string, digest, first accepted block) from the lane that holds its key (the build-server lane, infra/devnet/restart-seed.sh). Added 7 October 2026 after the 0.3.20 sweep left the seed on the old object for one hour forty, found by the 0.3.21 wipe canary's reject lines. **Digest-moving node releases (7 October 2026, after the 2720d8d2 split):** when the node commit moves the consensus params digest (a height, a floor, a new switch field), a one-box-at-a-time sweep is a network split (dn3-g1 sat alone twenty minutes on its own fork at 21:18 BST), so the move is the 0.3.20 floor-move form: the binaries pre-placed on every node of the network (the fleet's, the hands, the seeds, the pool pair, every second node), every node restarted inside one minute at a clock named ten minutes ahead, the digest read back per node after, the first lock on the new side as the line; the apps' entries (manifest, HiveOS alias) publish at that minute or after, never before, so no app sits alone on the new digest. The one-box form is for digest-preserving releases only (34a2dbaa tonight). The release note names which form a release takes before its first box moves. Gate check (main, 7 October 2026): the publisher refuses an app entry whose node pin's digest (the pinned binary with no file on the entry's network) differs from the network's current digest (the hub's RPC) unless the move's clock is recorded in the entry's notes (--move-clock), known-failed self-test on tonight's shape; tooling on the 0.3.24 publish (the build-server lane). 6. **Read-back is by commit string plus digest plus engine:** on 0.3.18+ nodes igneum_getNodeInfo powEngine must read "igneum-pow" ("stub" = FAIL); on earlier trees `strings igneumd | grep -c igneum-pow/src/` above zero. The miner embeds no commit string; its pairing is the build line and the sha. 7. **igneum-pow pairing:** a fork build takes igneum-pow by path from the igneum worktree it sits in; build each node tree inside its own app worktree whose igneum-pow is the pinned tree; the pairing log line names it. Master's build tools need rust-toolchain.toml in the tree (the app tree's pin applies to a vendor worktree under it; a standalone node checkout is unpinned until the node line carries its own file). Extended 7 October 2026 (the Devnet 3 pool pair, three WRONG HASH rounds each a tree a step behind the chain): the rule binds every crate that embeds kaspa-pow, the node, the pool daemon (igneum-pool) and the app's CPU re-check alike, each built against the pinned igneum-pow by path from the release worktree (017e7037 on 0.3.22 and 0.3.23), and the packs pin travels with the generator (the proto-cuda packs are the pin's export, never an older one); the read-back is the paired miner's "class v4 program id <16 hex>" line equal to the node's per epoch, and the daemon accepting its shares. 8. **glibc classes:** HiveOS 2.31 (`--ship hive`, smoke in ubuntu:20.04 on the box), seeds and generic 2.35 (`--ship seed`), fleet 24.04 boxes native 2.39.