diff --git a/docs/plans/igneum-2.0-test-harness-map.md b/docs/plans/igneum-2.0-test-harness-map.md index 6bacb2699..572138472 100644 --- a/docs/plans/igneum-2.0-test-harness-map.md +++ b/docs/plans/igneum-2.0-test-harness-map.md @@ -265,7 +265,7 @@ Rule: a case maps to a cell only where the cell's tests visibly answer it; cover - Fixtures: F0, F1 - Cases: - UX-05 Keep voting keys with the miner through pooling: partial: the vote-key commitment on the wire (verify::tests::a_share_under_another_key_is_refused_before_the_hash: known-pass the member's key, known-fail another key on the share and a job naming another key, refused with code vote_key before the hash), the open pool's sidechain::check_key (the claimed key, the header's key and the reveal are one key), the same-nonce-other-template wrong_hash test, the TLS binding test; the malicious-pool run and the leave-and-retain run on the devnet-4 pair are the UX-05 batch's other evidence; review B INT-15 (8 October 2026): server::authorise_tests::a_replayed_proof_of_possession_is_not_an_authorisation (a public PoP replayed into another session, payout, pool or chain, or under another key, refused; only the challenge-bound binding v2 admits on a public network) and the_binding_policy_follows_the_network - - UX-04 Pay small operators without hidden custody: partial: PPLNS distribution tests (fee first, never overpays, late joiner), the payout key file round trip, the signed transfer decode; the live payout path on the devnet-4 pair is the UX-04 batch's evidence; review B F12 and INT-03/INT-04 (8 October 2026): payout::intent_tests (a restart from the pre-broadcast snapshot, a lost send response, a crash on either side of the broadcast, a stuck transaction replaced under the same intent, a reorged receipt and a finality pause, a failed transaction, a ledger that cannot be written: never a duplicate or a lost obligation, finalised only under the chain's final lock) and state::ledger_tests (an unreadable ledger is refused or restored, never emptied); F13/INT-16: frame, admission and pool::share_tests (the frame bound while reading, the bounded outgoing queue, one membership per session, the nonce and in-flight bounds, the share and connection budgets) + - UX-04 Pay small operators without hidden custody: partial: PPLNS distribution tests (fee first, never overpays, late joiner), the payout key file round trip, the signed transfer decode; the live payout path on the devnet-4 pair is the UX-04 batch's evidence; review B F12 and INT-03/INT-04 (8 October 2026): payout::intent_tests (a restart from the pre-broadcast snapshot, a lost send response, a crash on either side of the broadcast, a stuck transaction replaced under the same intent, a reorged receipt and a finality pause, a failed transaction, a ledger that cannot be written: never a duplicate or a lost obligation, finalised only under the chain's final lock) and state::ledger_tests (an unreadable ledger is refused or restored, never emptied); F13/INT-16: frame, admission and pool::share_tests (the frame bound while reading, the bounded outgoing queue, one membership per session, the nonce and in-flight bounds, the share and connection budgets); the devnet-4 pair's class (8 October 2026 21:24 UK): state_provider::tests::an_unsynced_node_hands_the_pool_no_state_and_no_job (no job on a node whose igneum_getExecStatus reads synced false, blocked or re-executing; known-failed first against the 8ff7a0f4 provider; pool-synced-guard-202 f3e99e9c on release-2.0.2, 986252e7 on pool-2.0, 52 of 52 on build-6) ### harness:economics-model diff --git a/docs/plans/igneum-2.0-test-registry.json b/docs/plans/igneum-2.0-test-registry.json index 62f50a77f..ac8eb71f3 100644 --- a/docs/plans/igneum-2.0-test-registry.json +++ b/docs/plans/igneum-2.0-test-registry.json @@ -1441,7 +1441,7 @@ "run_status": "NOT RUN", "evidence_path": "docs/analysis/review-2026-10-08-b/f10/packfile-test.log;docs/analysis/review-2026-10-08-b/f10/geometry-check-mini.log; docs/analysis/class-v6/family-gate.md", "run_id": "family-gate-20261008b", - "updated": "2026-10-08T20:20:03.931Z", + "updated": "2026-10-08T20:38:52.350Z", "evidence_record": { "requirement_id": "POW-02", "decision": "NOT RUN", @@ -1462,7 +1462,7 @@ }, "claim_impact": "", "reviewer": "", - "at": "2026-10-08T20:20:03.931Z" + "at": "2026-10-08T20:38:52.350Z" }, "in_progress_since": "2026-10-08T20:07:26.255Z", "approvals": { @@ -1516,7 +1516,7 @@ }, "claim_impact": "", "reviewer": "", - "at": "2026-10-08T20:20:03.931Z" + "at": "2026-10-08T20:38:52.350Z" } } }, @@ -3245,7 +3245,7 @@ "run_status": "NOT RUN", "evidence_path": "docs/analysis/class-v6/family-gate.md", "run_id": "family-gate-20261008b", - "updated": "2026-10-08T20:20:03.931Z", + "updated": "2026-10-08T20:38:52.350Z", "evidence_record": { "requirement_id": "ROT-07", "decision": "NOT RUN", @@ -3266,7 +3266,7 @@ }, "claim_impact": "", "reviewer": "", - "at": "2026-10-08T20:20:03.931Z" + "at": "2026-10-08T20:38:52.350Z" }, "in_progress_since": "2026-10-08 18:3x UK", "approvals": { @@ -3318,7 +3318,7 @@ }, "claim_impact": "", "reviewer": "", - "at": "2026-10-08T20:20:03.931Z" + "at": "2026-10-08T20:38:52.350Z" } } }, @@ -3351,7 +3351,7 @@ "run_status": "NOT RUN", "evidence_path": "docs/analysis/class-v6/family-gate.md", "run_id": "family-gate-20261008b", - "updated": "2026-10-08T20:20:03.931Z", + "updated": "2026-10-08T20:38:52.350Z", "evidence_record": { "requirement_id": "ROT-08", "decision": "NOT RUN", @@ -3372,7 +3372,7 @@ }, "claim_impact": "", "reviewer": "", - "at": "2026-10-08T20:20:03.931Z" + "at": "2026-10-08T20:38:52.350Z" }, "approvals": { "scope_approved": null, @@ -3421,7 +3421,7 @@ }, "claim_impact": "", "reviewer": "", - "at": "2026-10-08T20:20:03.931Z" + "at": "2026-10-08T20:38:52.350Z" } } } diff --git a/docs/plans/pool.md b/docs/plans/pool.md index 5155a57a8..e968ceb9b 100644 --- a/docs/plans/pool.md +++ b/docs/plans/pool.md @@ -254,3 +254,7 @@ The second external review (docs/analysis/review-2026-10-08-b) and the full-syst Known-failed first: commit 75383929 on pool-review-b carried the tests over the 8 October semantics, and the suite read seven red on build-6 (the three payout tests paid 200 of 100 due or never settled, the frame reader blocked on a newline that never came, the registry kept two members, the queue took 10,000 lines, the nonce set held 100,000 refused nonces); 065148a2 and 4a8dcbc0 turned them green, 51 of 51. Consequences per tier. A pool member on any card: a payout cannot be paid twice or lost across a pool crash, a lost node answer, a reorg or a stuck transaction; a payment shows `mined` until the chain's own finality covers it, so the row a member reads as final is final. A pool operator: the ledger cannot start empty over a corrupt file, the previous snapshot and its digest are always there to restore from, and one bad member cannot hold the daemon's memory or its verifier (every bound has a flag and a default). The network: a captured `authorize` cannot be replayed to redirect a member's pay or to vote under its key from another session, and the vote key stays the member's in every template (the pin "vote keys stay with the miner", docs/plans/igneum-2.0.md). + +### 11a. 21:24 UK, the devnet-4 pair's class: no job on an unsynced node's state + +The pair's evidence (the pool seat): identical epoch seed, day, class v5 and era on node, pool and member, the freeze's generator (`igneum-pow fingerprint cbc5bd0a`, read back on every 2.0.x line: `igneum-pow/src` is tree 93c36844, the freeze commit 1c420786's) on all three binaries, and every member share `wrong_hash`, because the node was still in class v5 catch-up and answered `igneum_getPowStateLeaves` from its still-settling state. Closed by construction: `pool/src/state_provider.rs` reads `igneum_getExecStatus` beside the leaves and refuses a stream while the node reads `synced` false, `blocked` or `reexecuting` (a missing field is not synced), so the engine builds no epoch and no job goes out on catch-up leaves; the STATUS line says `node not synced (class v5 catch-up): no jobs` with the exec RPC named while it holds. Known-failed first against the 8ff7a0f4 provider on build-6, then 52 of 52. Shas: f3e99e9c (release-2.0.2), 986252e7 (pool-2.0). Consequence per tier: a pool member is never handed work its pool's node cannot verify; an operator reads the cause, not a reject count. diff --git a/docs/plans/release-rules.md b/docs/plans/release-rules.md index 1bdc7a1af..ec50b5c8f 100644 --- a/docs/plans/release-rules.md +++ b/docs/plans/release-rules.md @@ -21,3 +21,5 @@ Every cut of the Igneum Miner app and its node runs under these. The dated plan 15. **The version bump is the release branch's first commit (7 October 2026, after the 0.3.23 miss).** When a release-0.3.N branch opens, its first commit moves the six version places (app/igneum-app/Cargo.toml and Cargo.lock, app/windows/version.h, app/igneum-app/resources/igneum-app.rc's four fields, packaging/mac/app/Info.plist, the installer's AppVersion), never left to the cut: release-0.3.23 opened at 4cdcab31 and carried 0.3.22 in every place until 21:26 BST, so the app exes and the window host crossed from its first closed tip read 0.3.22 and were void. Gate check: on a push to release-0.3.N the pre-push gate (tools/ci/release-version-check.sh, self-test on tonight's shape first) reads all six places against the branch name and goes red on any mismatch; the .rc was the second layer of the same miss (the box cross failed in build.rs at 21:30 BST). 16. **The public miner carries no remote execution; the fleet runs the lab build (the founder's ruling on review B F14, 8 October 2026, 19:57 UK).** From 2.0.2 the public build has no run-script, fetch, collect, restart or update-now jobs, no jobs feed, no wake listener and no relay client (cargo feature `lab`, off by default), and documents its least-privilege boundary; "automatic updates off" stays off for an urgent manifest (pause and notify only). Our fleet, PC 1, PC 2 and the mini run the lab build only (product "Igneum Miner Lab", channel `igneum-2.0-devnet-lab`; the kits Igneum-Miner-Lab-Setup-.exe, the lab DMG, the lab hive; the per-PC combined exes wrap the lab Setup), which verifies its manifest and jobs feed against the lab root (~/.config/igneum/lab-signing on the Mac, never in the repo), separate from the OTA key; publish-manifest.sh and publish-jobs.sh sign the lab channel with the lab key and a public channel with the public key, never cross (`--lab` / `--channel lab`). The relay agent refuses to run anything beside a public engine, and the jobs publisher refuses a target whose last upload is not a lab build. +17. **No entry publishes without a fresh-install canary on the live network (rule 33, the founder's word of 8 October 2026, 21:2x UK, after the two chain hours of the 2.0.1 night).** Before any entry (Mac, HiveOS, Windows, the fleet kit) publishes, a canary runs on a box with no AVX-512 and an empty datadir, from the entry's own artefact, on the live network: install from the artefact, sync from genesis to the tip, mine for five minutes with zero template refusals and at least one accepted block, claim and prove one shard and see it paid or queued for the lock, quit within the bound, and every line read back from the box. The steward records it as the release-gate case (INT-07 and V6-12's clean-install test are this case), BLOCKED when the canary cannot run; the publish scripts refuse without the canary's record for that exact sha; the cut note carries the canary's lines. The two classes of the 2.0.1 night that a canary would have caught: the miner's base unit (a template with six merged subsidies, refused by every shipped miner) and the rejoin at block 3847 (a sync from an empty datadir across the outage's fork); both sat on the live devnet and no canary looked. +18. **A class gets a fix clock inside the hour and a canary test, never a list entry without a time (8 October 2026).** The lane that finds a class names the fix's owner, its clock inside the hour and the canary line that proves it, in the same message; "on the 2.0.2 list" without a time is refused by the shipper. The 3847 class was handed to the node lane at 20:03 and had no clock until 21:40. diff --git a/tools/ci/test-map.json b/tools/ci/test-map.json index ef7fa6c3c..dca147e97 100644 --- a/tools/ci/test-map.json +++ b/tools/ci/test-map.json @@ -455,7 +455,7 @@ ], "coverage": { "UX-05": "partial: the vote-key commitment on the wire (verify::tests::a_share_under_another_key_is_refused_before_the_hash: known-pass the member's key, known-fail another key on the share and a job naming another key, refused with code vote_key before the hash), the open pool's sidechain::check_key (the claimed key, the header's key and the reveal are one key), the same-nonce-other-template wrong_hash test, the TLS binding test; the malicious-pool run and the leave-and-retain run on the devnet-4 pair are the UX-05 batch's other evidence; review B INT-15 (8 October 2026): server::authorise_tests::a_replayed_proof_of_possession_is_not_an_authorisation (a public PoP replayed into another session, payout, pool or chain, or under another key, refused; only the challenge-bound binding v2 admits on a public network) and the_binding_policy_follows_the_network", - "UX-04": "partial: PPLNS distribution tests (fee first, never overpays, late joiner), the payout key file round trip, the signed transfer decode; the live payout path on the devnet-4 pair is the UX-04 batch's evidence; review B F12 and INT-03/INT-04 (8 October 2026): payout::intent_tests (a restart from the pre-broadcast snapshot, a lost send response, a crash on either side of the broadcast, a stuck transaction replaced under the same intent, a reorged receipt and a finality pause, a failed transaction, a ledger that cannot be written: never a duplicate or a lost obligation, finalised only under the chain's final lock) and state::ledger_tests (an unreadable ledger is refused or restored, never emptied); F13/INT-16: frame, admission and pool::share_tests (the frame bound while reading, the bounded outgoing queue, one membership per session, the nonce and in-flight bounds, the share and connection budgets)" + "UX-04": "partial: PPLNS distribution tests (fee first, never overpays, late joiner), the payout key file round trip, the signed transfer decode; the live payout path on the devnet-4 pair is the UX-04 batch's evidence; review B F12 and INT-03/INT-04 (8 October 2026): payout::intent_tests (a restart from the pre-broadcast snapshot, a lost send response, a crash on either side of the broadcast, a stuck transaction replaced under the same intent, a reorged receipt and a finality pause, a failed transaction, a ledger that cannot be written: never a duplicate or a lost obligation, finalised only under the chain's final lock) and state::ledger_tests (an unreadable ledger is refused or restored, never emptied); F13/INT-16: frame, admission and pool::share_tests (the frame bound while reading, the bounded outgoing queue, one membership per session, the nonce and in-flight bounds, the share and connection budgets); the devnet-4 pair's class (8 October 2026 21:24 UK): state_provider::tests::an_unsynced_node_hands_the_pool_no_state_and_no_job (no job on a node whose igneum_getExecStatus reads synced false, blocked or re-executing; known-failed first against the 8ff7a0f4 provider; pool-synced-guard-202 f3e99e9c on release-2.0.2, 986252e7 on pool-2.0, 52 of 52 on build-6)" } }, "harness:economics-model": {