From ddfd9af8af4d57a94292153d6ec83c7d178a1004 Mon Sep 17 00:00:00 2001
From: igneum-labs <337424239+igneum-labs@users.noreply.github.com>
Date: Tue, 6 Oct 2026 16:18:57 +0000
Subject: [PATCH] Counter ASIC 3.0 gates (hash): the G2 job writes its found
 lines to g2-<pack>.found and prints the count and sha256 (no found line in
 the report, every RESULT line inside the cap, the log and collect glob
 named); tools/ca3-v4/g2-recheck.sh derives the digest from hash-bound and
 diffs a found file; trusted on a known-good and a known-bad file

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 tools/ca3-v4/g2-recheck.sh    | 45 +++++++++++++++++++++++++++++++++++
 tools/ca3-v4/pc2-v4-gates.ps1 | 26 ++++++++++++++++----
 2 files changed, 66 insertions(+), 5 deletions(-)
 create mode 100755 tools/ca3-v4/g2-recheck.sh

diff --git a/tools/ca3-v4/g2-recheck.sh b/tools/ca3-v4/g2-recheck.sh
new file mode 100755
index 000000000..aa6bb73eb
--- /dev/null
+++ b/tools/ca3-v4/g2-recheck.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Counter ASIC 3.0 gate G2, the Mac re-check (6 October 2026). Derives the found-lines file a serve-mode G2 job writes
+# (g2-<pack>.found: "found g2 <nonce> <hash>" for nonces 0..1023 at prehash 00..01, LF, nonce order) from the Rust
+# verifier on the same pack, and compares by sha256 digest. A digest match is 1,024 of 1,024 with no file moved; on a
+# mismatch, or when a found file is given, the lines are compared one by one and the differing nonces printed.
+#   tools/ca3-v4/g2-recheck.sh <pack dir> [--digest <sha256 from the job's RESULT g2 line>] [--file <g2-<pack>.found>]
+# The pack's seeds come from its program.h (IGNEUM_SEED_BYTES_HEX, IGNEUM_DAY_BYTES_HEX, IGNEUM_ERA_SEED_HEX) and its class
+# from IGNEUM_LOAD_CLASS ("<base>-era<label>+sh<S>x<R>" is run as --class <base>+sh<S>x<R> --era 0:<era hex>;
+# "<base>-era<label>" as --program-class v3 --era-hex <era hex>; a class without an era as --class <class>).
+# Exit 0 on a match, 1 on a mismatch, 2 on a usage or build error. Runs igneum-pow from the tree this script sits in.
+set -u
+here=$(cd "$(dirname "$0")/../.." && pwd)
+POW=${IGNEUM_POW:-$here/igneum-pow/target/release/igneum-pow}
+PRE=0000000000000000000000000000000000000000000000000000000000000001
+pack=${1:-}; shift || true
+[ -d "$pack" ] || { echo "usage: g2-recheck.sh <pack dir> [--digest <hex>] [--file <found file>]" >&2; exit 2; }
+digest=""; file=""
+while [ $# -gt 0 ]; do case "$1" in --digest) digest=$2; shift 2 ;; --file) file=$2; shift 2 ;; *) echo "unknown $1" >&2; exit 2 ;; esac; done
+[ -x "$POW" ] || { echo "no igneum-pow at $POW (cargo build --release in igneum-pow)" >&2; exit 2; }
+ph=$pack/program.h
+epoch=$(sed -n 's/^#define IGNEUM_SEED_BYTES_HEX "\(.*\)"/\1/p' "$ph"); day=$(sed -n 's/^#define IGNEUM_DAY_BYTES_HEX "\(.*\)"/\1/p' "$ph")
+era=$(sed -n 's/^#define IGNEUM_ERA_SEED_HEX "\(.*\)"/\1/p' "$ph"); cls=$(sed -n 's/^#define IGNEUM_LOAD_CLASS "\(.*\)"/\1/p' "$ph")
+base=${cls%%-era*}; sh=""; case "$cls" in *+sh*) sh="+sh${cls##*+sh}" ;; esac
+if [ -n "$era" ] && [ -n "$sh" ]; then args="--class $base$sh --era 0:$era"
+elif [ -n "$era" ]; then args="--program-class v3 --era-hex $era"
+else args="--class $cls"; fi
+tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT
+"$POW" hash-bound --prehash $PRE --nonce 0 --count 1024 --epoch-hex "$epoch" --day-hex "$day" $args 2>/dev/null | awk '{printf "found g2 %s %s\n", $1, $2}' > "$tmp/expected.found"
+n=$(wc -l < "$tmp/expected.found" | tr -d ' ')
+[ "$n" = 1024 ] || { echo "verifier gave $n lines, not 1024 (class $cls, args $args)" >&2; exit 2; }
+exp=$(shasum -a 256 "$tmp/expected.found" | cut -c1-64)
+echo "RECHECK pack $(basename "$pack") class $cls verifier sha256 $exp (1,024 lines, $args)"
+rc=0
+if [ -n "$digest" ]; then
+  if [ "$digest" = "$exp" ]; then echo "RECHECK digest MATCH: 1,024 of 1,024 (the job's file equals the verifier's)"; else echo "RECHECK digest MISMATCH: job $digest, verifier $exp (collect the found file and run with --file)"; rc=1; fi
+fi
+if [ -n "$file" ]; then
+  cp "$file" "$tmp/job.found" || exit 2   # one copy, read twice below (a pipe or /dev/fd input reads once)
+  file=$tmp/job.found
+  got=$(shasum -a 256 "$file" | cut -c1-64)
+  eq=$(awk 'NR==FNR { e[$3]=$4; next } /^found g2 / { if (e[$3]==$4) c++ } END { print c+0 }' "$tmp/expected.found" "$file")
+  tot=$(grep -c '^found g2 ' "$file")
+  if [ "$got" = "$exp" ]; then echo "RECHECK file $file sha256 $got MATCH: $eq of $tot equal, 1,024 of 1,024"; else echo "RECHECK file $file sha256 $got differs from the verifier's: $eq of $tot lines equal"; awk 'NR==FNR { e[$3]=$4; next } /^found g2 / && e[$3]!=$4 { printf "  nonce %s: job %s verifier %s\n", $3, $4, e[$3] }' "$tmp/expected.found" "$file" | head -20; rc=1; fi
+fi
+exit $rc
diff --git a/tools/ca3-v4/pc2-v4-gates.ps1 b/tools/ca3-v4/pc2-v4-gates.ps1
index 20269f596..c2f9575ce 100644
--- a/tools/ca3-v4/pc2-v4-gates.ps1
+++ b/tools/ca3-v4/pc2-v4-gates.ps1
@@ -9,13 +9,21 @@
 # G1: the INSTALLED igneum-worker-cuda.exe (NVRTC, the pack's own kernel text) --bench on every pack: the self-test
 # (cache FNV, dataset head, word MASK, 64 samples, 96 vector lanes) and the 2^24 fingerprint at base nonce 0, which
 # must equal the Mac's (Metal and Apple OpenCL). G2: the worker's serve mode, one job of 1,024 nonces at target
-# ffffffffffffffff per pack (every nonce a "found g2 <nonce> <hash>" line), re-hashed on the Mac with
-# `igneum-pow hash-bound --prehash 00..01 --count 1024` on the same pack. Every result line starts with RESULT.
+# ffffffffffffffff per pack (every nonce a "found g2 <nonce> <hash>" line). The found lines never go to stdout: the
+# intake's closing report keeps the last 200 KB of job.log and a file upload its last 256 KB, and the first run of this
+# job (15:52Z) lost its G1 lines under 8 x 1,024 found lines. Each pack's found lines go to g2-<pack>.found in this job's
+# folder (LF, nonce order), and stdout carries one line per pack: the count and the file's sha256. The Mac re-check
+# (tools/ca3-v4/g2-recheck.sh) derives the same file from `igneum-pow hash-bound --prehash 00..01 --count 1024` on the
+# same pack and compares digests: equal digests are 1,024 of 1,024; on a mismatch the file is fetched with
+# `publish-jobs.sh add --kind collect --glob "app/jobs/<job id>/g2-*.found"` and diffed line by line. Every result line
+# starts with RESULT, there are about 60 of them, and the report carries them all whatever the log length; the full
+# job.log stays at app/jobs/<job id>/job.log on the PC (the RESULT log line names it; collect it with the same glob form).
 $ErrorActionPreference = 'Continue'
 function Stamp { (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') }
 function Smi($q) { try { (& nvidia-smi --query-gpu=$q --format=csv,noheader,nounits 2>$null) -join ' | ' } catch { 'nvidia-smi failed' } }
 function CudaApps { @(& nvidia-smi --query-compute-apps=pid,process_name,used_memory --format=csv,noheader 2>$null | ForEach-Object { "$_" }) }
 "RESULT start $(Stamp) machine $env:COMPUTERNAME"
+"RESULT log $(Join-Path $env:IGNEUM_JOB_DIR 'job.log') (the full output; the found lines of G2 are g2-<pack>.found beside it: collect --glob app/jobs/<job id>/g2-*.found)"
 "RESULT gpus $(Stamp) $(Smi 'index,name,driver_version,memory.used,clocks.sm,clocks.mem,power.draw,power.limit,temperature.gpu')"
 
 # the kit: the fetch job's folder under the app's jobs folder (nothing of another job's is reached)
@@ -78,9 +86,17 @@ foreach ($pk in $order) {
   $lines = G2-JobLines $d
   "RESULT g2 $pk start $(Stamp) job-line $($lines[0])"
   $out = $lines | & $exe --serve --pack $d --race off 2>&1
-  $n = 0
-  foreach ($l in $out) { $s = [string]$l; if ($s -match '^found g2 ') { $n++; "RESULT g2 $pk $s" } elseif ($s -match '^(ready|done|error|need|info)') { "RESULT g2 $pk $s" } }
-  "RESULT g2 $pk found $n of 1024 exit=$LASTEXITCODE"
+  $code = $LASTEXITCODE
+  $found = @()
+  foreach ($l in $out) { $s = [string]$l; if ($s -match '^found g2 (\d+) ([0-9a-f]{16})$') { $found += [pscustomobject]@{ n = [uint64]$Matches[1]; line = $s } } elseif ($s -match '^(ready|done|error|need)') { "RESULT g2 $pk $s" } }
+  # the found lines to a file in this job's folder: nonce order, LF, no BOM (the Mac derives the same bytes from hash-bound)
+  $ff = Join-Path $env:IGNEUM_JOB_DIR "g2-$pk.found"
+  $text = (($found | Sort-Object n | ForEach-Object { $_.line }) -join "`n")
+  if ($found.Count -gt 0) { $text += "`n" }
+  [IO.File]::WriteAllText($ff, $text, (New-Object Text.UTF8Encoding $false))
+  $dg = (Get-FileHash -Algorithm SHA256 $ff).Hash.ToLower()
+  $distinct = ($found | Select-Object -ExpandProperty n -Unique | Measure-Object).Count
+  "RESULT g2 $pk found $($found.Count) of 1024 distinct=$distinct sha256 $dg file $ff exit=$code"
 }
 $w = @(Get-Process -Name 'igneum-worker-cuda' -ErrorAction SilentlyContinue)
 "RESULT processes $(Stamp) igneum-worker-cuda running: $($w.Count); compute apps: $((CudaApps) -join '; ')"