Merge site-land-dn3 b554b0e7 into master on the box mirror (the site reads Devnet 3 from master; repository links on the git host)

# Conflicts:
#	tools/ci/pre-push.sh
This commit is contained in:
igneum-labs 2026-10-07 20:43:06 +00:00
commit e1f7113f6c
5 changed files with 82 additions and 0 deletions

View file

@ -337,6 +337,26 @@ measurements land.
- The ALU budgets of the M5 Max and the 9070 XT, their power at the hash, and the verifier's cost at N = 100,000
program ops are estimates; the program-length lever is a design item with its own measurements, not a result.
### 5.10 Class v5 on, the shadow at zero: does the state-derived dataset make the shadow unnecessary? (7 October 2026, 21:3x UK, the founder's question "we need a solution, deep research, other methods")
The question: with class v5 (the dataset built from the chain's execution state, refreshed per window) and the latency-shadow work of class v4 set to zero (class v3 energy on every GPU), what edge does the strongest chip keep over an RTX 5090 per joule? If it were at or under about 2x the shadow could come off after v5 and the class v4 premium (145 W on a 5090 at the unlocked core, 88 W at the 1,400 MHz lock, measured 7 October 2026) would vanish.
What class v5 changes for the chip, from `docs/design/class-v5-stored-state.md` sections 2 and 2a: the recompute chip (`f = 0`, the dataset derived on the fly from the cache) and the stateless or stale chip are removed as categories, because every item takes a leaf of the state and the leaves refresh every window. What it does NOT change: the strongest chip was never one of those. It is the `f = 1` stored-dataset chip of 5.5, a GPU's memory system without the GPU, and under class v5 it needs one thing more, the window's leaves, which section 2a.2 prices honestly: one node serves a whole farm, the leaves ship at 16.5 KB/s to 10,000 members today (45 MB per member per window over a 1 Gbit/s WAN before the state is 7,500x today's), and the rebuild on the chip is the same 32 ms per window every GPU pays. The dataset is still derived from a seed and the state, so a central node compresses everything but the state's bytes, and the chip stores the result as before.
The arithmetic, on the model's own figures (5.3: the activate-bound ceilings, 2.0 nJ per random read on GDDR7 and 1.2 nJ on HBM3, the static and controller watts; the 5090 at 136.1 MH/s on 326 W, 0.417 MH/W; 128 loads per hash, the shadow at zero so no ALU beside the memory). The node is a desktop-class CPU with an NVMe and 32 GB at about 85 W (approximate, from memory of such machines; a full node with the EVM executor at 1 block/s), shared by a farm (100 chips: 0.85 W each) or carried by every chip (the attacker's worst case, 85 W each).
| Chip, class v5 on, shadow at zero | MH/s (model) | W with a farm-shared node (0.85 W) | MH/W | Edge over the 5090 per joule | W with a node per chip (85 W) | Edge |
|---|---|---|---|---|---|---|
| GDDR7 `f = 1`, 16 devices (the 5090's own memory without the GPU) | 166 | 78 | 2.12 | 5.1x | 163 | 2.5x |
| HBM3 `f = 1`, one stack | 84 | 28 | 3.02 | 7.2x | 112 | 1.8x |
| HBM3 `f = 1`, eight stacks (an H100-class package) | 666 | 175 | 3.80 | 9.1x | 259 | 6.2x |
Every figure is modelled (arithmetic on cited memory figures, approximate where 5.3 marks it); none is measured; the node's watts are an approximate from memory.
Reading: NO. Class v5 with the shadow at zero leaves the strongest chip at 5.1x (GDDR7) to 9.1x (HBM3, eight stacks) per joule, the class v3 figures of 5.6 less a rounding, because the node is a farm cost and not a chip cost; only a chip forced to carry its own node falls near 2x, and only the small ones (one HBM3 stack at 1.8x, the GDDR7 board at 2.5x), while the eight-stack package stays at 6.2x even with a node per chip. So the shadow (class v4's 100,000 ops per hash in the memory wait, which brings the chip to 2.1x at k = 1 and 3.9x on the claimed X9 core) stays the only lever in this model that reaches the memory-system chip, and the class v4 premium is the price of that lever on today's GPUs. What class v5 buys is different and real: the recompute chip and the stale chip are gone as categories, every miner must hold and follow the chain, and a chip's dataset is wrong the moment its node is. The premium itself has two measured levers tonight: the core-clock lock (57 of 145 W back on the 5090 at 1,400 MHz for 1.4 percent of rate; the knee below 1,400 is the second pass's) and the per-card tune the app lands by itself; what would remove it is a shadow whose work is cheaper per op on a GPU than on a chip core (the research lane's question: a shadow shaped for the GPU's idle datapath at low clock, or a memory-side cost the chip cannot amortise), not the state-derived dataset.
Per tier: a miner on class v4 pays the premium and gets the 2.1x to 3.9x chip ceiling in exchange; on class v5 with the shadow kept the ceiling stays and the dataset is the chain's; on class v5 with the shadow dropped the premium goes and the ceiling returns to 5x to 9x. The decision is the founder's; this section gives the number.
## 6. The per-day derivation (item 2)
6 October 2026, Counter ASIC 3.0 item 2, worker `derive` (`docs/plans/counter-asic-3-derivation.md`; everything

View file

@ -112,3 +112,13 @@ Three commits on 96161037: bd710a36 the sub-version 3 re-pin (byte 7, igneum-pow
**The steward's two items before the public repository opens, both closed:** tools/exec-attacks/lib/common.mjs MINER_KEY is the public Anvil/Hardhat default account 1 key (five harnesses use it; balance 0 and nonce 0 on both chains at 20:55 and 20:59 BST; the fix is a chain-id guard in the five harnesses and a README line, a 0.3.24 steward row); app/igneum-wallet/src/hd.rs's KEY in one history commit is the public Hardhat default account 0 key in a removed test.
**Proven share, the second hour (20:59 BST):** cumulative 0.468 (1,848 of 3,952 shards since DAA 0); the hour's own segments 0.84 (1,094 of 1,304), the shortfall mostly the 34a2dbaa sweep's one-minute node restart per prover; eleven provers (five 3060s at about 85 s a segment, two 3090s, three 4090s, one A5000), a twelfth starting; the next hour's own segments should read one and the founder's 24 hours count from the first that does. **The pool hour** counts from 20:33:28 BST (dn3-pool-b's first OPEN SHARE on the 017e7037 daemons a357c581; WRONG HASH 0 since), the pool split's condition.
## 11. The 0.3.23 cut (21:1x to 21:3x BST): the fold, the version miss, the LG-4 shape
**release-0.3.23 = 05c2ddfe on the mirror:** 2f27ecb1 (the rights step 332b82eb with the deferred rule and the WebView2 right, the unattended driver install 50cdb8e4) + check-labels-23 e6f9ef0b + ota-token-23 757d7870 + the Windows pin to 2720d8d2 + dpi-23 ad407b13 (per-monitor DPI; BUILD-APP.bat, host.rc, host.manifest, host.cpp) + network-23 b18a5b0f (the first-run network step: the manifest's default_network, the testnet card present and refused until testnet_open, `--testnet --netsuffix=1` with the seeds as --addpeer; view.test.mjs resolved as the union of the check-labels and network tests) + install-close-23 5140e6fe (main's fold inside 15 minutes: the installer's stop step ends the window host first by path and waits up to 30 s for the unlock, CloseApplicationsFilter and SetupMutex in the .iss, install-running.flag holds every relaunch, the engine prints EXIT update and the host ends instead of restarting; tests known-failed first on tonight's PC 2 sequence) + the version bump 05c2ddfe. App gate GREEN on build-1 at every step (last 284 + 35 + 8), UI 86, pre-push 59. The version miss (rule 15): the branch carried 0.3.22 in every place until 21:26 BST, caught by the build-server lane before the host job; the exes and kit from 1c5323be are void. The Mac DMG re-cut under the lock on the 2720d8d2 Mac pair (igneumd efff01cd, igneum-miner 45c4c68f); the 0.3.23 host from the 05c2ddfe kit in the PC 1 slot after the hash lane's floor grid; the manifest carries default_network devnet-3 and keeps the floor file; the 0.3.23 Windows smoke is the first read of install-close-23 over a running app (the installer's own stop step, no pre-stop by the job) and of the OTA-return line through the app's own path.
**The 0.3.22 Windows smoke, take 1 FAIL (20:54 BST), the job shape:** the installer 5ac3dc62 built clean on PC 2 (every exe 0.3.22, the MSVC host 4bc25b7f through the host gate), but the job's silent install over the running 0.3.21 app sent api/quit, the engine stopped, the window host (the same pid since 19:14 BST) never stopped and its restart ladder relaunched the old engine 10 s later, Inno could not replace the locked host with its message box suppressed, every file stayed 0.3.21. Take 2 in the 0.3.10 smoke shape (the job stops the app by pid first, installs, asserts every file's version and sha, starts the host, reads the app alive at 60 s on 0.3.22 with stdin open). The defect is install-close-23 in 0.3.23. Devnet 3: the 34a2dbaa pass complete on every node by 21:17 BST (thirty-two read-backs incl. hub-1's and pool-1's second nodes); the 2720d8d2 pass started 21:17:23 BST with dn3-g1, the pair whole (igneumd df6476ed, miner dfdc6883, paired: program id 571131ccbd6e0de9 equal with c29f33bb at epoch 2).
**LG-4 (the founder: "use PC 1 or PC 2 or get another machine"; main's ruling):** on PC 2 tonight after both smokes, a fresh Windows user account created by job (no Igneum state, no card cache), the three timed steps (download and install, sync to the tip, dataset build to the first accepted share) as FIRST-SHARE lines, ten runs with the app uninstalled and the profile wiped between runs, no click anywhere, the rows on /evidence labelled "PC 2, fresh user account, not a fresh image, 7 October 2026", the 9-of-10 under-10-minutes bar read against them; macOS the same way as a fresh user account on the Mac tomorrow; a rented Windows VM only if the account shape fails the bar for a reason an image would change. PC 1 stays the founder's desk.
**0.3.22 Windows take 2 FAIL (21:13 BST) and the skip:** the job's detached helper was ended with the job's process tree before its first sleep ran out (Start-Process stays in the runner's tree; a survivor needs Win32_Process.Create or a scheduled task); nothing was installed, every file still 0.3.21, the payload untouched. Ruling: no take 3; the 0.3.22 Windows entry is skipped (the Mac and HiveOS entries stand); the first install over a running app is 0.3.23's installer with install-close-23 in the simplest job shape (Start-Process -Wait; the installer's own stop step and the install-running flag do the work), its smoke read the gate line for both; the Discord card publishes on the 0.3.23 Windows entry. **The version miss, second layer (21:30 BST):** the box cross of 0.3.23's exes failed in build.rs because igneum-app.rc still read 0.3.22 (Info.plist and the installer's AppVersion too); fixed at release-0.3.23 = 7c7489ac, the rule 15 check extended to six places and green on the tree; the 0.3.23 node pairs under /srv/artefacts/0323-2720d8d2/ (hands f2cf6a87/fb147dd1, seed 3edaf83d/be5ca735, win 8326d78a/38c74545) with the engine string.

View file

@ -18,3 +18,4 @@ Every cut of the Igneum Miner app and its node runs under these. The dated plan
11. **Kill by pid, never by name,** on the shared Mac; a merge worktree never checks out master.
12. **The Discord card only when every platform is live.** Live manifest changes beyond the binaries (a moved consensus floor) go out only on the founder's explicit word, staged beside the release with their digest and a one-line diff.
13. **Ship on green:** no calendar waits; when the gates are green, publish and state the clock time (UK). Checkpoints are for slips, not for waiting.
15. **The version bump is the release branch's first commit (7 October 2026, after the 0.3.23 miss).** When a release-0.3.N branch opens, its first commit moves the six version places (app/igneum-app/Cargo.toml and Cargo.lock, app/windows/version.h, app/igneum-app/resources/igneum-app.rc's four fields, packaging/mac/app/Info.plist, the installer's AppVersion), never left to the cut: release-0.3.23 opened at 4cdcab31 and carried 0.3.22 in every place until 21:26 BST, so the app exes and the window host crossed from its first closed tip read 0.3.22 and were void. Gate check: on a push to release-0.3.N the pre-push gate (tools/ci/release-version-check.sh, self-test on tonight's shape first) reads all six places against the branch name and goes red on any mismatch; the .rc was the second layer of the same miss (the box cross failed in build.rs at 21:30 BST).

View file

@ -71,6 +71,11 @@ never_push_checks() {
# A secret or an identity leak must not reach the remote on any branch; together about 20 s on the Mac.
run "identity grep of the public export list and the served site" bash tools/ci/identity-check.sh
run "no secret file names and no 64-hex secrets in the tree" bash -c 'bash tools/ci/no-secrets-check.sh --self-test && bash tools/ci/no-secrets-check.sh'
# the third never-push class (7 October 2026, 20:5x UK): a founder name on ANY branch, because every branch went to the public host's
# mirror and a branch green-stamped before the check existed carried one onto master through the deferred merge
run "no founder name, personal login, earlier business or personal address in any tracked text file (the pre-public scrub; self-test first, encoded list)" bash -c 'bash tools/ci/founder-strings-check.sh --self-test && bash tools/ci/founder-strings-check.sh'
# rule 15 (7 October 2026): a release branch reads its own version in Cargo.toml, Cargo.lock and version.h from its first commit
run "release-version: a release-0.3.N branch reads 0.3.N in Cargo.toml, Cargo.lock and version.h (self-test first)" bash -c 'bash tools/ci/release-version-check.sh --self-test && bash tools/ci/release-version-check.sh'
}
tree_checks() {

View file

@ -0,0 +1,46 @@
#!/usr/bin/env bash
# Rule 15 (7 October 2026, after the 0.3.23 miss): the version bump is a release branch's first commit. release-0.3.23 opened
# at 4cdcab31 and carried 0.3.22 in Cargo.toml, Cargo.lock and app/windows/version.h until 21:26 BST, so the app exes and the
# window host crossed from its first closed tip read 0.3.22 and were void. On a push to release-0.3.N this check reads the
# six version places (Cargo.toml, Cargo.lock, version.h, igneum-app.rc's four fields, Info.plist, the installer's AppVersion) against the branch name and goes red on a mismatch; a branch that is not release-* passes.
#
# tools/ci/release-version-check.sh [<branch>] # the current branch when omitted; exit 1 with the mismatch named
# tools/ci/release-version-check.sh --self-test # a release-0.3.23 tree reading 0.3.22 fails on every place; a matching tree passes; a feature branch passes
set -euo pipefail
cd "$(dirname "$0")/../.."
check() { # <branch> <cargo toml> <cargo lock> <version.h> [<igneum-app.rc> <Info.plist> <Igneum-Miner.iss>] -> prints each mismatch, exit 1 if any
local branch="$1" toml="$2" lock="$3" vh="$4" rc="${5:-}" plist="${6:-}" iss="${7:-}" want bad=0
case "$branch" in release-*) want="${branch#release-}" ;; *) echo "release-version: $branch is not a release branch; nothing to check"; return 0 ;; esac
case "$want" in *.*.*) ;; *) echo "release-version: $branch is not a three-part version (rule 1)"; return 1 ;; esac
local got_toml got_lock got_h got_rc
got_toml=$(awk -F'"' '/^version = "/{print $2; exit}' "$toml")
got_lock=$(awk '/^name = "igneum-app"$/{f=1;next} f&&/^version = /{gsub(/"/,"",$3); print $3; exit}' "$lock")
got_h=$(awk -F'"' '/IGNEUM_HOST_VERSION_STR/{print $2; exit}' "$vh")
got_rc=$(awk '/IGNEUM_HOST_VERSION_RC/{print $3; exit}' "$vh" | tr -d ' ')
[ "$got_toml" = "$want" ] || { echo "release-version: $toml reads $got_toml, the branch is $branch"; bad=1; }
[ "$got_lock" = "$want" ] || { echo "release-version: $lock reads $got_lock for igneum-app, the branch is $branch"; bad=1; }
[ "$got_h" = "$want" ] || { echo "release-version: $vh IGNEUM_HOST_VERSION_STR reads $got_h, the branch is $branch"; bad=1; }
[ "$got_rc" = "$(echo "$want" | tr . ,),0" ] || { echo "release-version: $vh IGNEUM_HOST_VERSION_RC reads $got_rc, want $(echo "$want" | tr . ,),0"; bad=1; }
if [ -n "$rc" ]; then
local n; n=$(grep -cE "^(FILEVERSION|PRODUCTVERSION) +$(echo "$want" | tr . ,),0\$|VALUE \"(FileVersion|ProductVersion)\", +\"$want\"" "$rc" || true)
[ "$n" = 4 ] || { echo "release-version: $rc carries $n of 4 version fields at $want (build.rs refuses the cross otherwise)"; bad=1; }
grep -qF "<string>$want</string>" "$plist" || { echo "release-version: $plist does not read $want"; bad=1; }
grep -qF "#define AppVersion \"$want\"" "$iss" || { echo "release-version: $iss AppVersion does not read $want"; bad=1; }
fi
[ $bad = 0 ] && echo "release-version: $branch reads $want in Cargo.toml, Cargo.lock, version.h${rc:+, igneum-app.rc, Info.plist and the installer}"
return $bad
}
if [ "${1:-}" = "--self-test" ]; then
T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
printf '[package]\nname = "igneum-app"\nversion = "0.3.22"\n' > "$T/Cargo.toml"
printf '[[package]]\nname = "igneum-app"\nversion = "0.3.22"\n' > "$T/Cargo.lock"
printf '#define IGNEUM_HOST_VERSION_STR "0.3.22"\n#define IGNEUM_HOST_VERSION_RC 0,3,22,0\n' > "$T/version.h"
out=$(check release-0.3.23 "$T/Cargo.toml" "$T/Cargo.lock" "$T/version.h" 2>&1 || true)
[ "$(printf '%s\n' "$out" | grep -cF ' reads 0.3.22')" = 3 ] && printf '%s\n' "$out" | grep -q 'VERSION_RC reads 0,3,22,0' || { echo "self-test: the 0.3.23 miss was not caught on every place"; printf '%s\n' "$out"; exit 1; }
sed -i.bak 's/0\.3\.22/0.3.23/g; s/0,3,22,0/0,3,23,0/' "$T/Cargo.toml" "$T/Cargo.lock" "$T/version.h"
check release-0.3.23 "$T/Cargo.toml" "$T/Cargo.lock" "$T/version.h" >/dev/null || { echo "self-test: a matching tree failed"; exit 1; }
check driver-check "$T/Cargo.toml" "$T/Cargo.lock" "$T/version.h" >/dev/null || { echo "self-test: a feature branch failed"; exit 1; }
echo "self-test passed: the 0.3.23 shape fails on every place, a matching release tree passes, a feature branch passes"; exit 0
fi
BRANCH="${1:-$(git rev-parse --abbrev-ref HEAD)}"
check "$BRANCH" app/igneum-app/Cargo.toml app/igneum-app/Cargo.lock app/windows/version.h app/igneum-app/resources/igneum-app.rc packaging/mac/app/Info.plist packaging/windows/Igneum-Miner.iss