From b4d86987f0826581c6b88a20886595b09006ea30 Mon Sep 17 00:00:00 2001 From: igneum-labs <337424239+igneum-labs@users.noreply.github.com> Date: Wed, 7 Oct 2026 12:24:53 +0000 Subject: [PATCH] attack-pass F8: the hash lane's confirmation of the residual on the chain path and the sub-version 2 freshness rule shape Co-Authored-By: Claude Fable 5.1 --- docs/analysis/attack-pass-2026-10.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/analysis/attack-pass-2026-10.md b/docs/analysis/attack-pass-2026-10.md index e566e6b23..1adaa0061 100644 --- a/docs/analysis/attack-pass-2026-10.md +++ b/docs/analysis/attack-pass-2026-10.md @@ -369,7 +369,15 @@ box 2 against the 8c728ca3 build (10^6 seeds, 1,871 flagged, worst 9.66 percent) draws through `candidate_class` with its own era class, not through `chain_program` where the rule lives, and the amended and the old binary print the identical program for seed igneum-f9/518927; those numbers describe the old stream under a changed evaluation and are withdrawn; the harness is being given a `chain_program` draw mode so it can -serve as the second re-gate. +serve as the second re-gate. The hash lane confirmed the reading (14:0x UK): the amendment's rule is keyed on the +era-composed class, so a draw with no era (F9's path) is the old stream, and on the chain path the residual is real: +p6's load at 12 had a saturated source itself, read one constant word and left a constant in r0, which the rule +counts as injecting; a rotate keeps 0xffffffff, so or-then-rotate-then-load passes too. Both are saturation delivered +through a writer that preserves it. Fix shape put to the owner of sub-version 2 (the Counter ASIC lane): dataflow +freshness instead of a one-writer look-back (fresh at the start; a load keeps dst fresh only if its source was fresh; +add, sub, xor, mad, shfl fresh if either operand was; rotl, rotr only if the operand was; or, mul, mulhi never; a +load's source drawn only from fresh registers), with the dynamic (c') check on load sources as the backstop; a stream +change, so sub-version 2 with new packs, ids and fingerprints. Status: FINDING-OPEN: mechanism found and ours; FIXED-AND-PASSED on the 64-seed verdict against the amended stream (igneum-pow 8c728ca3, sub-version 1, paired with release-0.3.20-node 8097d600) with F9's hot-set census agreeing.