igneum/docs/plans/release-0.3.8.md

# Igneum Miner 0.3.8: the cut, 5 October 2026

Release engineer, from 13:1x UTC, the project lead away ("work your magic"). Worktree `/Users/joshm/Projects/igneum-wt-ship038`,
branch `release-0.3.8` from master 8d6e6af. Every Mac build through `/Users/joshm/Projects/igneum/tools/lock/with-lock.sh build`
at `nice -n 19` with `-j 4`. Times are UTC. The 0.3.6 and 0.3.7 cuts (`release-0.3.6.md`, sections 8 to 10) are the template.

## 1. What 0.3.8 carries

| Change | Where | Already on master |
|---|---|---|
| Pinned shard and aggregator guests: the host embeds `elf/`, verifies with the pinned key (about 2 s, was 114 to 138 s), `--mode id` | `proving/igneum-prove/elf/`, `host/src/pinned.rs`, b8b40a5, b588367, 8d6e6af | yes |
| The WSL exporter path for Windows hosts (`PathBuf::join` wrote a backslash) | `app/igneum-app/src/prover.rs`, 6d51e53 | yes |
| The WSL scripts' re-stamp prunes every target dir | 0861586 | yes |
| The prover tools' source stamp, the empty-shard fixture tests | bb522db, 5bb7e86 | yes |
| The update card (one centred card over the window when an update is ready) | `update-popup` f315112, merged as 97afe52 | merged here |

Not merged: `biometrics` (the project lead has not tried it). The node does not change: fork 2b6d23ef, the 0.3.7 Windows exes
(the Mac cross-build) and the Mac arm64 binaries, reused as files.

## 2. The branch

| Commit | What |
|---|---|
| 97afe52 | Merge `update-popup` (f315112). One conflict, `.github/workflows/ci.yml`: update-popup's test step taken (it runs `notices.test.mjs` and `update-card.test.mjs`; master's ran only the first) |
| 7ce02b1 | `Igneum Miner 0.3.8: ...`, the six version files (`node tools/ship-app.mjs --check`: 0.3.8 in all 6) |
| 560a7e0 | `site: rebuilt` (`node site/build.mjs` picks up the program id journey entry already on master) |

A `vendor` symlink to the main checkout's `vendor/` (untracked) makes the relative node paths resolve, as in the 0.3.6 cut.

## 3. Tests and checks, with the command

| Tip | Command | Result |
|---|---|---|
| 97afe52 | `node --test app/igneum-app/ui/notices.test.mjs app/igneum-app/ui/update-card.test.mjs` | 10 pass, 0 fail |
| 7ce02b1 | `cargo test -p igneum-app` (under the build lock, this Mac: an app-only release, the PC build jobs are for the node) | ok: 75 (lib) + 26 (ota-sign) + 8 (prove-verify), 0 failed, 13:15 to 13:16Z |
| 7ce02b1 | `tools/ci/identity-check.sh` | 0 hits over 206 files |
| 7ce02b1 | `tools/ci/copied-sources-check.sh` | every copying build script re-stamps its sources |
| 7ce02b1 | `tools/ci/pinned-guests-check.sh` | elf/ matches its manifest, no script builds a guest outside pin-guests.sh |
| 7ce02b1 | `node tools/ci/check-workflow-shell.mjs` | 12 run blocks in 2 workflows, 25 .ps1, 0 findings |
| 560a7e0 | `node site/build.mjs && node tools/ci/link-check.mjs` | 477 internal links across 10 pages, 0 broken |
| 7ce02b1 | `node --test relay/test/parse.test.mjs relay/test/auth.test.mjs relay/test/wake.test.mjs` | 15 pass |
| 560a7e0 | `node tools/ship-app.mjs 0.3.8 ... --from ci --dry-run` | preflight ok: tree clean, 0.3.8 in all 6, fork 2b6d23ef, both exes, both Mac binaries, both folders, gh igneum-labs, live inputs 2b6d23ef built 13:25:35Z |

## 4. The Mac binaries and the DMG (13:20 to 13:27Z, one chained script under the lock)

The release target dirs were cloned by APFS (`cp -c`) from the main checkout, then `cargo build --release` for the app
and `cargo build --release -p igneum-prove-export -p igneum-prove-host` in `proving/igneum-prove` (no Succinct
toolchain: the host embeds `elf/`). `igneum-prove-host --mode id` on this tree:

```
shard program id 0x0dfade071ffc05a50be5f7e6640fb12638bac0ea63697ec252863f55658be16a (2825296 bytes, sha256 0x65901e2dd6cc5762)
aggregator id 0x135e67e742fbbcc8303676765266f25a6520ab36299820280125541051fb6c62 (320264 bytes), pinned 2026-10-05T12:07:56Z, SP1 6.8.1 circuit v6.1.0
```

Both equal `elf/manifest.json`. The seven block fixtures ran `--mode native` with the new host (the package gate's
native half; the package itself was made with `SKIP_GATE=1`, see 6). Then
`NODE=<main>/vendor/igneum-node-036/target-integration/release/igneumd MINER=.../igneum-miner packaging/mac/build-dmg.sh`
(13:23:52 to 13:27:17Z): `prover: igneum-prove-host and igneum-prove-export from <worktree>/proving/igneum-prove/target/release`,
the same `--mode id` line printed by the script, fingerprints `477bb0ef` (intake key next) and `ed9c4d2e` (folder next).

| Artefact | sha256 | Size |
|---|---|---|
| `packaging/mac/dist/Igneum-Miner-0.3.8.dmg` (build 202610051323; engine 0.3.8, node 2b6d23ef Mac arm64 igneumd 64138a17... and igneum-miner ef438be2... as in 0.3.6/0.3.7, the 0.3.8 prover host and export) | 53c12b6e84a1c1e638d3e28d1cebb8eaf1980620c6dff5958292893033b62871 | 41,247,419 |

The DMG is 1.1 MB larger than 0.3.7's (40,156,739): the host now carries the two ELFs and keys.

## 5. The Windows payload inputs (13:25Z)

`IGNEUM_WIN_RELEASE=<main>/vendor/igneum-node-036/target-integration/x86_64-pc-windows-gnu/release IGNEUM_NODE_SRC=<main>/vendor/igneum-node-036 packaging/windows/push-inputs.sh`
from the worktree: igneumd.exe 98a40af9... (50,773,504) and igneum-miner.exe eb77bf93... (10,778,624), the 0.3.7 Mac
cross-build of 2b6d23ef, with this Mac's toolchain DLLs (libstdc++-6, libgcc_s_seh-1, libwinpthread-1). The gate
`check-runtime-dlls.sh`: igneumd.exe <- libstdc++-6.dll, all 197 imported symbols exported (5,994 exports). No worker
exes in the worktree (the 0.3.6 worktree had none either; the PC builds them). Signed inputs: zip
b587ed19fac41fe4c2fdb075b0c17a430c6e15adcd253dca6a58655c757652b5 (26,669,995 bytes, 5 files), node commit 2b6d23ef
(release-0.3.6), verified locally with the key compiled into the app, deployed, HTTP 200. `node-source.pin` unchanged.

## 6. The prover package for PC 2

`SKIP_GATE=1 proving/windows-wsl2/make-package.sh <scratch>/igneum-prove-wsl2-038.zip` from the worktree:
98c246146e89af7799efe10d08b0a6a87cd46e05e3c7dcf872559009a7273a38, 1,425,452 bytes; `package/proving/igneum-prove/elf/`
carries the two ELFs, the two keys and `manifest.json`. The gate was skipped on instruction; its native half ran on
the DMG's host (section 4), its execute half did not run here.

## 7. The proving rollout order (proving/README.md), with times

| Step | What | When |
|---|---|---|
| (1) provers off | Mac: already off (the app's prove setting, `enabled: false`, `status: off`). PC 2: run job `prove-off-pc2-038` (`POST <app.url>/api/prove {"on":false}` from a PowerShell script, then the app state and the node's `igneum_getProvingStatus`), published 13:18:53Z. PC 2's 0.3.7 app refused that first file: `jobs: jobs file signature does not verify` (13:19:41Z); the local and live bytes were identical and both signers (main checkout, this tree) verified it, so the file was re-signed and redeployed (`publish-jobs.sh sign --deploy`, 13:23:04Z) and the same job ran at once. Unexplained; recorded in 11 | ran 13:23:57 to 13:24:08Z: `api/prove off: {"ok":true}`; PC 2's node pool `{entries 17, failed 1, pending 0, verified 210}`, paidShards 210, tip DAA 104125 |
| (2) empty pool | The Mac app node's pool (127.0.0.1:26800, `igneum_getProvingStatus`): 17 pending at 13:18Z (PC 2's records, every one rejected by the Mac's old host: `NOT VERIFIED`), 13 at 13:25Z, 9 at 13:29Z, 7 at 13:31Z, 2 at 13:35Z (tip DAA 104780). The last record from PC 2 reached the Mac at 13:30:17Z (rejected). A 30-s watch for `entries 0, pending 0` reported nothing before it expired at 13:59Z (its curl treated the node restart as "not empty" and did not say so: the CLAUDE.md rule on watchers, again); at 14:00:03Z the restarted node showed `{entries 0, failed 0, pending 0}` at tip DAA 106245. The pool was therefore not OBSERVED empty before step (3); it is inferred: no record entered after 13:30Z and the Mac restarted at 13:53:34Z, 1,400 DAA later, past the 600-DAA record window | inferred by 13:53Z |
| (3) new host on every node | Not by the update-now job: the Mac and PC 1 took 0.3.8 on their own hourly slots (PC 1 engine restart 13:42:01Z, 8 min 41 s after the manifest; Mac 13:53:34Z). PC 2 from `update-now-038` (14:00:39Z): see 9. PC 2's WSL tools from the package: `rebuild-prover-pc2-038` (see below) | |
| (4) `--mode id` | Mac (the installed `/Applications/Igneum Miner.app/Contents/Resources/bin/igneum-prove-host --mode id`): shard `0x0dfade071ffc05a50be5f7e6640fb12638bac0ea63697ec252863f55658be16a`, aggregator `0x135e67e7...`. PC 2: see below | |
| (5) provers on | PC 2: run job `prove-on-pc2-038` | see below |


### 7a. PC 2's WSL tools from the package

| Job | Published | Result |
|---|---|---|
| `fetch-prove-038` (fetch, `--dir prove --extract --extract-dir igneum-prove-wsl2-038 --fresh`) | 13:28:06Z | ran 13:28:50Z: the zip (1,425,452 bytes, sha256 ok) extracted into `%LOCALAPPDATA%\igneum\prove\igneum-prove-wsl2-038` |
| `rebuild-prover-pc2-038` (run, PowerShell, after PC 2 was on 0.3.8) | 14:03:04Z | ran 14:03:34 to 14:03:45Z as root in Ubuntu-24.04: rsync of `package/` into `~/igneum-prove` (`--delete`, target kept), every source re-stamped (`-name target -prune`), `elf/` listed (the two ELFs, two keys, manifest.json; the package manifest's shard id `0x0dfade07...`), `cargo clean -p igneum-prove-core -p igneum-prove-export -p igneum-prove-host`, `cargo build --release -p igneum-prove-export -p igneum-prove-host --features igneum-prove-host/cuda` (Finished in 5.65 s: only the three crates rebuilt, every dependency cached from the 0.3.7 build), installed into `/opt/igneum` (host 72,990,472 bytes b4bdc0680420c533a267f4f1b67845d287edad666ed6ab421506db3085b03896, export 3,474,768 bytes f19481b041a8383fb42d4fc812ef4008d98a6040114af4049b96d2790b4f47dd; `ldd`: 0 libs missing). `/opt/igneum` holds only the two tools (nothing else there to keep). No `/home/*/igneum-prove/target/release` dir exists, so the app's probe falls through to `/opt/igneum` |
| `--mode id` on PC 2 (`/opt/igneum/igneum-prove-host --mode id`, in the same job) | | `shard program id 0x0dfade071ffc05a50be5f7e6640fb12638bac0ea63697ec252863f55658be16a (2825296 bytes, sha256 0x65901e2dd6cc5762) aggregator id 0x135e67e742fbbcc8303676765266f25a6520ab36299820280125541051fb6c62`: equal to the Mac DMG's and the installed Mac app's. A 0.3.7 host has no `--mode id`, so the line is also the proof that the installed binary is the new build |
| `prove-on-pc2-038` (run: `POST <app.url>/api/prove {"on":true}`, then the app state) | 14:04:55Z | ran 14:05:27 to 14:05:47Z: `api/prove on: {"ok":true}`; the app's state 20 s later: `backend cuda`, `status proving`, `message "proving on the GPU"`, `current "block 68178 shard 0"`, keys 10, pool 0; PC 2's engine log: `prover: host /opt/igneum/igneum-prove-host (WSL2), CUDA` at 14:05:36Z, then `block 68178 shard 0 assigned ... export, cut, prove (CUDA), sign, submit` |

## 8. The ship (13:27 to 13:34Z)

`git push -u origin release-0.3.8` at 560a7e0 (13:27Z, the credential helper), `gh workflow run windows.yml --ref release-0.3.8` → run
37316906713, started 13:27:14Z, green 13:32:30Z (parse checks; engine, window host, payload, installer, smoke run; the G13
inputs step verified the signed inputs of section 5: built 13:25:35Z, node 2b6d23ef, repo commit 560a7e0).

```
node tools/ship-app.mjs 0.3.8 --node vendor/igneum-node-036 --branch release-0.3.8 --dl-both \
  --activation-height 84100 --deadline-note "proving v0" --notes "Pinned proving programs: one program id on every machine, the verifier answers in about 2 s; the update card; the Windows exporter path fix; re-stamped WSL scripts; node 2b6d23ef unchanged" \
  --from ci
```

| Step | Result |
|---|---|
| preflight | ok: tree 560a7e0 clean, 0.3.8 in all 6, fork 2b6d23ef, gh igneum-labs, live inputs 2b6d23ef |
| ci | green after 4 min of polling |
| fetch | Igneum-Miner-Setup-0.3.8.exe 18.9 MB, igneum-windows-app.zip 26.3 MB |
| dmg | already (section 4) |
| copy, mirror | the DMG into the OLD folder; 8 files into the NEXT folder (the DMG, the installer, the payload zip, the three payload-inputs files, the CI record, igneum-prove-wsl2.zip), 2 same |
| manifest | `consensus.override` carried over from the OLD folder's 0.3.7 manifest; both manifests signed (key 8f186e37...), verified locally, same fields |
| deploy | one deploy, 13:33Z |
| verify | both folders: the three files HEAD 200 with the local sizes, GET sha256 ok, the manifest signature ok |
| console | item #354 "Igneum Miner 0.3.8 shipped (mac+windows)"; exit 0 at 13:34:36Z, 337 s |

| File | sha256 | Size |
|---|---|---|
| Igneum-Miner-0.3.8.dmg | 53c12b6e84a1c1e638d3e28d1cebb8eaf1980620c6dff5958292893033b62871 | 41,247,419 |
| Igneum-Miner-Setup-0.3.8.exe | 86cffd144adb89b9d886be9a3b4c76b91ed78afc737b3a9fc19ce44a2d71afcc | 19,794,320 |
| igneum-windows-app.zip | 8f08a3040ac7d2b0e95714f8e930452bb26656f62af08f3ba07376ab72884a22 | 27,591,281 |

The live manifests, read 13:34:54Z, compared field by field with the 0.3.7 OLD-folder manifest saved before the cut:

| Field | 0.3.7 (before) | 0.3.8 OLD folder | 0.3.8 NEXT folder |
|---|---|---|---|
| version, channel, min_supported_version | 0.3.7, devnet, 0.3.0 | 0.3.8, devnet, 0.3.0 | same |
| published_at | 2026-10-05T10:16:29Z | 2026-10-05T13:33:20Z | 2026-10-05T13:33:22Z |
| consensus | override {difficulty_v2_activation_daa 33000, proving_v0_activation_daa 84100}, activation_height 84100, deadline_note "proving v0" | identical | identical |
| fees_v1_activation_daa, tuning | absent | absent | absent |
| mac | dmg 8ee96b3b..., 40,156,739 | dmg 53c12b6e..., 41,247,419, URL in its folder | same bytes, URL in the NEXT folder |
| windows | inno-setup 2bacba64..., 19,784,297 | inno-setup 86cffd14..., 19,794,320, URL in its folder | same bytes, URL in the NEXT folder |

`update-now-038` to all, published 14:00:39Z (both folders, the apps woken, stamp 2026-10-05T14:00:39Z.898f4a38).

## 9. The machines after the publish (manifest live 13:33:20Z)

Baseline 13:29:05Z: Mac d937c69d app 0.3.7 node 2b6d23ef DAA 104402 20.6 MH/s; PC 1 ae432dc7 0.3.7 DAA 104392 113.1 MH/s;
PC 2 1ccfe586 0.3.7 DAA 104389 128.9 MH/s; PC 37ba0461 0.3.7 DAA 104376 2.3 MH/s; Sam's Mac 3a9bf309 silent 3 h (0.3.5).
A machine counts as updated only when its node reports a DAA score and the miner a hash rate on 0.3.8.

| Machine | On 0.3.8 | Its log (`IGNEUM-APP version=0.3.8`, fingerprints 477bb0ef key / ed9c4d2e folder on every one) |
|---|---|---|
| PC 1 ae432dc7 (Windows) | engine restart 13:42:01Z (unix 1791207722), 8 min 41 s after the manifest, on its own hourly slot (before the update-now job existed); node started 13:42:06Z, `node proof verifier reported: command` +6 s, `update to 0.3.8 complete (from 0.3.7)` 13:43:32Z; console 14:00Z: node 2b6d23ef, DAA 106190, 111.0 MH/s | run `win-ae432dc7-20261005-134201`: `[ok] updated to Igneum Miner 0.3.8 from 0.3.7`, `node proof verifier: command (...\igneum-prove-verify.exe)`, no `exited with code` line |
| Mac d937c69d | engine restart 13:53:34Z (unix 1791208415), 20 min 14 s after the manifest, on its hourly slot; `ota-apply.log`: `apply: engine 99165 host 99158 ... version 0.3.8`, `staged bundle digest verified`, `swapped`, `0.3.8 is running` (13:53:29Z); `node proof verifier: command (/Applications/Igneum Miner.app/Contents/Resources/bin/igneum-prove-host)` and `reported: command` +10 s; `update to 0.3.8 complete` 13:55:05Z; console 14:00Z: node 2b6d23ef, DAA 106221, 22.0 MH/s | run `mac-d937c69d-20261005-135334`; the node log `node-20261005-135334.log`: `proving v0: payouts from DAA score 84100, window 7200 DAA, dust 5, verifier Command(".../igneum-prove-host")` |
| PC 2 1ccfe586 (Windows) | `update-now-038` ran 14:01:12Z (33 s after the publish, woken); installer downloaded and verified 14:01:16Z; engine restart 14:01:22Z (unix 1791208882), 43 s after the publish; node started 14:01:26Z, synced at 106308 blocks with 3 peers at +1 s, `verifier reported: command` +7 s, 119.86 MH/s at +60 s; `update to 0.3.8 complete` 14:02:52Z; console 14:03:39Z: node 2b6d23ef, DAA 106429, 122.7 MH/s | run `win-1ccfe586-20261005-140122` |
| PC 37ba0461 (Windows, the US laptop) | not reached: silent from 13:52:20Z (its last status line 13:51:51Z, 2.31 MH/s, up 3 h 26 min; its hourly slot is minute 57, the 13:57Z slot passed in silence). The update-now job and the manifest wait for it | run `win-37ba0461-20261005-102457` |
| Sam's Mac 3a9bf309 | not reached: silent since 09:41Z (0.3.5) | |

PC 2's 0.3.7 app and the jobs file: at 13:19:41Z PC 2 fetched the woken jobs file and logged `jobs: jobs file signature
does not verify`; the same bytes re-signed at 13:23:04Z verified and ran. The file is canonical JSON signed by the same
key; nothing in the signer or `jobs.rs` changed since 0.3.7. Unexplained (11).

## 10. Cross-machine proving after the rollout

The first cross-verified shard: block 68178 shard 0, proven on PC 2 (prover key e809e396..., payout address
0xCAfc6e74...), `proven and submitted in 28 s` (assigned 14:05:37Z, submitted 14:06:05Z); the Mac's app node
(`node-20261005-135334.log`): `proof record for block 68178 shard 0 by e809e396... (peer): accepted, verify Command(".../igneum-prove-host")`
at 14:06:04.949Z, then `proof of block 68178 shard 0 by e809e396...: verified in 0.5 s: RESULT verify: VERIFIED in 0.052 s`
at 14:06:05.638Z, then `chain block 68211: proof record for block 68178 shard 0 ... paid 868202990000000000 wei to 0xCAfc6e74...`
at 14:06:08.782Z (PC 2's engine: `block 68178 shard 0 paid 0.86820299 IGN` at 14:06:15Z). Before the cut the same
Mac host answered `rejected in 87.0 s: RESULT verify: NOT VERIFIED in 0.113 s` for every PC 2 record (the last at
13:30:17Z): the whole point of 0.3.8, measured on the live devnet: a verify that took 87 to 88 s and failed now takes
0.5 s and passes.

Tally at 14:07:34Z (2 minutes after proving came back on): the Mac app node's pool `{entries 3, failed 0, pending 0,
verified 3}`, paidShards 213 (211 before, both PCs' earlier records); the Mac node log since 14:04Z: 3 `VERIFIED in`,
0 `NOT VERIFIED`, 3 `paid`. Blocks 68178, 68207 and 68235, each proven on PC 2 in 28 s, each verified on the Mac in
0.5 s, 68178 and 68207 paid (0.8682 and 1.7366 IGN) when this was written. The live page (`/api/live`, fed by the
observer): `pool {entries 3, verified 3, failed 0}`, `paid_shards_total 213`, `shards_proven_10m 3`, `shards_paid_10m 3`,
and the block list shows the paid shard of block afdbec35 (DAA 106576) with prover e809e396, lag 39, payout 1.7365 IGN.
So verified records and payouts are visible on the Mac's node and on the live page, not only on PC 2's node.

Program id on each machine: Mac (installed app) `0x0dfade071ffc05a50be5f7e6640fb12638bac0ea63697ec252863f55658be16a`;
PC 2 (`/opt/igneum`) the same; PC 1 has no prover (its node verifies through the wrapper's probe, which found no
WSL host, so it reports `command` and trusts: not changed by this release); PC 37ba0461 has no WSL prover.

## 11. Open after the cut

| Item | State |
|---|---|
| PC 37ba0461 | silent from 13:52:20Z (before the update-now job); on 0.3.7; takes 0.3.8 on its next check (hourly slot minute 57) or when the job reaches it |
| Sam's Mac 3a9bf309 | silent since 09:41Z, on 0.3.5; the same |
| PC 2's 0.3.7 app refused the jobs file once (`jobs file signature does not verify`, 13:19:41Z) | EXPLAINED and closed (housekeeping, 5 October 2026): the app fetched the file and its signature in two requests while the edge was still serving the previous deployment for one of the two objects (a publish that afternoon needed 15 s before the edge served the new file), so the pair did not belong together. From 0.3.9 the app fetches `igneum-jobs.signed.json`, one object carrying the file text and the signature, and the publisher verifies every folder after the deploy. Details: release-0.3.6 plan, section 10 |
| The pool was not observed empty before the Mac's host changed (section 7, step 2) | inferred from the 23 minutes between the last record and the restart; the watch that should have reported it treated a connection error as "not empty" and said nothing: the next watch of this kind prints every error line |
| The package gate's execute half | skipped (`SKIP_GATE=1` on instruction); the native half ran on the DMG's host; PC 2's CUDA build proved three shards within two minutes, which is the stronger check |
| PC 2's prover crates rebuilt in 5.65 s | plausible (three small crates, every dependency cached) and the installed host answers `--mode id`, which a 0.3.7 host cannot; not verified by a clean build |
| Carried from 0.3.6/0.3.7 (section 10 there) | the app marks "update complete" on its own health; igneumd not reproducible across PC 1 and PC 2. Answered on 5 October 2026 (housekeeping, release-0.3.6 plan section 10): why the PC-built Windows node died at start (the dynamic libstdc++; static since the fork's `database/build.rs`), the two finality tests under the parallel suite (the test process waits for a cache build slot) |