igneum/docs/plans/release-0.3.8.md

Igneum Miner 0.3.8: the cut, 5 October 2026

Release engineer, from 13:1x UTC, the project lead away ("work your magic"). Worktree /Users/joshm/Projects/igneum-wt-ship038, branch release-0.3.8 from master 8d6e6af. Every Mac build through /Users/joshm/Projects/igneum/tools/lock/with-lock.sh build at nice -n 19 with -j 4. Times are UTC. The 0.3.6 and 0.3.7 cuts (release-0.3.6.md, sections 8 to 10) are the template.

1. What 0.3.8 carries

Change	Where	Already on master
Pinned shard and aggregator guests: the host embeds elf/, verifies with the pinned key (about 2 s, was 114 to 138 s), --mode id	proving/igneum-prove/elf/, host/src/pinned.rs, b8b40a5, b588367, 8d6e6af	yes
The WSL exporter path for Windows hosts (PathBuf::join wrote a backslash)	app/igneum-app/src/prover.rs, 6d51e53	yes
The WSL scripts' re-stamp prunes every target dir	0861586	yes
The prover tools' source stamp, the empty-shard fixture tests	bb522db, 5bb7e86	yes
The update card (one centred card over the window when an update is ready)	update-popup f315112, merged as 97afe52	merged here

Not merged: biometrics (the project lead has not tried it). The node does not change: fork 2b6d23ef, the 0.3.7 Windows exes (the Mac cross-build) and the Mac arm64 binaries, reused as files.

2. The branch

Commit	What
97afe52	Merge update-popup (f315112). One conflict, .github/workflows/ci.yml: update-popup's test step taken (it runs notices.test.mjs and update-card.test.mjs; master's ran only the first)
7ce02b1	Igneum Miner 0.3.8: ..., the six version files (node tools/ship-app.mjs --check: 0.3.8 in all 6)
560a7e0	site: rebuilt (node site/build.mjs picks up the program id journey entry already on master)

A vendor symlink to the main checkout's vendor/ (untracked) makes the relative node paths resolve, as in the 0.3.6 cut.

3. Tests and checks, with the command

Tip	Command	Result
97afe52	node --test app/igneum-app/ui/notices.test.mjs app/igneum-app/ui/update-card.test.mjs	10 pass, 0 fail
7ce02b1	cargo test -p igneum-app (under the build lock, this Mac: an app-only release, the PC build jobs are for the node)	ok: 75 (lib) + 26 (ota-sign) + 8 (prove-verify), 0 failed, 13:15 to 13:16Z
7ce02b1	tools/ci/identity-check.sh	0 hits over 206 files
7ce02b1	tools/ci/copied-sources-check.sh	every copying build script re-stamps its sources
7ce02b1	tools/ci/pinned-guests-check.sh	elf/ matches its manifest, no script builds a guest outside pin-guests.sh
7ce02b1	node tools/ci/check-workflow-shell.mjs	12 run blocks in 2 workflows, 25 .ps1, 0 findings
560a7e0	node site/build.mjs && node tools/ci/link-check.mjs	477 internal links across 10 pages, 0 broken
7ce02b1	node --test relay/test/parse.test.mjs relay/test/auth.test.mjs relay/test/wake.test.mjs	15 pass
560a7e0	node tools/ship-app.mjs 0.3.8 ... --from ci --dry-run	preflight ok: tree clean, 0.3.8 in all 6, fork 2b6d23ef, both exes, both Mac binaries, both folders, gh igneum-labs, live inputs 2b6d23ef built 13:25:35Z

4. The Mac binaries and the DMG (13:20 to 13:27Z, one chained script under the lock)

The release target dirs were cloned by APFS (cp -c) from the main checkout, then cargo build --release for the app and cargo build --release -p igneum-prove-export -p igneum-prove-host in proving/igneum-prove (no Succinct toolchain: the host embeds elf/). igneum-prove-host --mode id on this tree:

shard program id 0x0dfade071ffc05a50be5f7e6640fb12638bac0ea63697ec252863f55658be16a (2825296 bytes, sha256 0x65901e2dd6cc5762)
aggregator id 0x135e67e742fbbcc8303676765266f25a6520ab36299820280125541051fb6c62 (320264 bytes), pinned 2026-10-05T12:07:56Z, SP1 6.8.1 circuit v6.1.0

Both equal elf/manifest.json. The seven block fixtures ran --mode native with the new host (the package gate's native half; the package itself was made with SKIP_GATE=1, see 6). Then NODE=<main>/vendor/igneum-node-036/target-integration/release/igneumd MINER=.../igneum-miner packaging/mac/build-dmg.sh (13:23:52 to 13:27:17Z): prover: igneum-prove-host and igneum-prove-export from <worktree>/proving/igneum-prove/target/release, the same --mode id line printed by the script, fingerprints 477bb0ef (intake key next) and ed9c4d2e (folder next).

Artefact	sha256	Size
packaging/mac/dist/Igneum-Miner-0.3.8.dmg (build 202610051323; engine 0.3.8, node 2b6d23ef Mac arm64 igneumd 64138a17... and igneum-miner ef438be2... as in 0.3.6/0.3.7, the 0.3.8 prover host and export)	53c12b6e84a1c1e638d3e28d1cebb8eaf1980620c6dff5958292893033b62871	41,247,419

The DMG is 1.1 MB larger than 0.3.7's (40,156,739): the host now carries the two ELFs and keys.

5. The Windows payload inputs (13:25Z)

IGNEUM_WIN_RELEASE=<main>/vendor/igneum-node-036/target-integration/x86_64-pc-windows-gnu/release IGNEUM_NODE_SRC=<main>/vendor/igneum-node-036 packaging/windows/push-inputs.sh from the worktree: igneumd.exe 98a40af9... (50,773,504) and igneum-miner.exe eb77bf93... (10,778,624), the 0.3.7 Mac cross-build of 2b6d23ef, with this Mac's toolchain DLLs (libstdc++-6, libgcc_s_seh-1, libwinpthread-1). The gate check-runtime-dlls.sh: igneumd.exe <- libstdc++-6.dll, all 197 imported symbols exported (5,994 exports). No worker exes in the worktree (the 0.3.6 worktree had none either; the PC builds them). Signed inputs: zip b587ed19fac41fe4c2fdb075b0c17a430c6e15adcd253dca6a58655c757652b5 (26,669,995 bytes, 5 files), node commit 2b6d23ef (release-0.3.6), verified locally with the key compiled into the app, deployed, HTTP 200. node-source.pin unchanged.

6. The prover package for PC 2

SKIP_GATE=1 proving/windows-wsl2/make-package.sh <scratch>/igneum-prove-wsl2-038.zip from the worktree: 98c246146e89af7799efe10d08b0a6a87cd46e05e3c7dcf872559009a7273a38, 1,425,452 bytes; package/proving/igneum-prove/elf/ carries the two ELFs, the two keys and manifest.json. The gate was skipped on instruction; its native half ran on the DMG's host (section 4), its execute half did not run here.

7. The proving rollout order (proving/README.md), with times

Step	What	When
(1) provers off	Mac: already off (the app's prove setting, enabled: false, status: off). PC 2: run job prove-off-pc2-038 (POST <app.url>/api/prove {"on":false} from a PowerShell script, then the app state and the node's igneum_getProvingStatus), published 13:18:53Z. PC 2's 0.3.7 app refused that first file: jobs: jobs file signature does not verify (13:19:41Z); the local and live bytes were identical and both signers (main checkout, this tree) verified it, so the file was re-signed and redeployed (publish-jobs.sh sign --deploy, 13:23:04Z) and the same job ran at once. Unexplained; recorded in 11	ran 13:23:57 to 13:24:08Z: api/prove off: {"ok":true}; PC 2's node pool {entries 17, failed 1, pending 0, verified 210}, paidShards 210, tip DAA 104125
(2) empty pool	The Mac app node's pool (127.0.0.1:26800, igneum_getProvingStatus): 17 pending at 13:18Z (PC 2's records, every one rejected by the Mac's old host: NOT VERIFIED), 13 at 13:25Z, 9 at 13:29Z, 7 at 13:31Z, 2 at 13:35Z (tip DAA 104780). The last record from PC 2 reached the Mac at 13:30:17Z (rejected). A 30-s watch for entries 0, pending 0 reported nothing before it expired at 13:59Z (its curl treated the node restart as "not empty" and did not say so: the CLAUDE.md rule on watchers, again); at 14:00:03Z the restarted node showed {entries 0, failed 0, pending 0} at tip DAA 106245. The pool was therefore not OBSERVED empty before step (3); it is inferred: no record entered after 13:30Z and the Mac restarted at 13:53:34Z, 1,400 DAA later, past the 600-DAA record window	inferred by 13:53Z
(3) new host on every node	Not by the update-now job: the Mac and PC 1 took 0.3.8 on their own hourly slots (PC 1 engine restart 13:42:01Z, 8 min 41 s after the manifest; Mac 13:53:34Z). PC 2 from update-now-038 (14:00:39Z): see 9. PC 2's WSL tools from the package: rebuild-prover-pc2-038 (see below)
(4) --mode id	Mac (the installed /Applications/Igneum Miner.app/Contents/Resources/bin/igneum-prove-host --mode id): shard 0x0dfade071ffc05a50be5f7e6640fb12638bac0ea63697ec252863f55658be16a, aggregator 0x135e67e7.... PC 2: see below
(5) provers on	PC 2: run job prove-on-pc2-038	see below

7a. PC 2's WSL tools from the package

Job	Published	Result
fetch-prove-038 (fetch, --dir prove --extract --extract-dir igneum-prove-wsl2-038 --fresh)	13:28:06Z	ran 13:28:50Z: the zip (1,425,452 bytes, sha256 ok) extracted into %LOCALAPPDATA%\igneum\prove\igneum-prove-wsl2-038
rebuild-prover-pc2-038 (run, PowerShell, after PC 2 was on 0.3.8)	14:03:04Z	ran 14:03:34 to 14:03:45Z as root in Ubuntu-24.04: rsync of package/ into ~/igneum-prove (--delete, target kept), every source re-stamped (-name target -prune), elf/ listed (the two ELFs, two keys, manifest.json; the package manifest's shard id 0x0dfade07...), cargo clean -p igneum-prove-core -p igneum-prove-export -p igneum-prove-host, cargo build --release -p igneum-prove-export -p igneum-prove-host --features igneum-prove-host/cuda (Finished in 5.65 s: only the three crates rebuilt, every dependency cached from the 0.3.7 build), installed into /opt/igneum (host 72,990,472 bytes b4bdc0680420c533a267f4f1b67845d287edad666ed6ab421506db3085b03896, export 3,474,768 bytes f19481b041a8383fb42d4fc812ef4008d98a6040114af4049b96d2790b4f47dd; ldd: 0 libs missing). /opt/igneum holds only the two tools (nothing else there to keep). No /home/*/igneum-prove/target/release dir exists, so the app's probe falls through to /opt/igneum
--mode id on PC 2 (/opt/igneum/igneum-prove-host --mode id, in the same job)		shard program id 0x0dfade071ffc05a50be5f7e6640fb12638bac0ea63697ec252863f55658be16a (2825296 bytes, sha256 0x65901e2dd6cc5762) aggregator id 0x135e67e742fbbcc8303676765266f25a6520ab36299820280125541051fb6c62: equal to the Mac DMG's and the installed Mac app's. A 0.3.7 host has no --mode id, so the line is also the proof that the installed binary is the new build
prove-on-pc2-038 (run: POST <app.url>/api/prove {"on":true}, then the app state)	14:04:55Z	ran 14:05:27 to 14:05:47Z: api/prove on: {"ok":true}; the app's state 20 s later: backend cuda, status proving, message "proving on the GPU", current "block 68178 shard 0", keys 10, pool 0; PC 2's engine log: prover: host /opt/igneum/igneum-prove-host (WSL2), CUDA at 14:05:36Z, then block 68178 shard 0 assigned ... export, cut, prove (CUDA), sign, submit

8. The ship (13:27 to 13:34Z)

git push -u origin release-0.3.8 at 560a7e0 (13:27Z, the credential helper), gh workflow run windows.yml --ref release-0.3.8 → run 37316906713, started 13:27:14Z, green 13:32:30Z (parse checks; engine, window host, payload, installer, smoke run; the G13 inputs step verified the signed inputs of section 5: built 13:25:35Z, node 2b6d23ef, repo commit 560a7e0).

node tools/ship-app.mjs 0.3.8 --node vendor/igneum-node-036 --branch release-0.3.8 --dl-both \
  --activation-height 84100 --deadline-note "proving v0" --notes "Pinned proving programs: one program id on every machine, the verifier answers in about 2 s; the update card; the Windows exporter path fix; re-stamped WSL scripts; node 2b6d23ef unchanged" \
  --from ci

Step	Result
preflight	ok: tree 560a7e0 clean, 0.3.8 in all 6, fork 2b6d23ef, gh igneum-labs, live inputs 2b6d23ef
ci	green after 4 min of polling
fetch	Igneum-Miner-Setup-0.3.8.exe 18.9 MB, igneum-windows-app.zip 26.3 MB
dmg	already (section 4)
copy, mirror	the DMG into the OLD folder; 8 files into the NEXT folder (the DMG, the installer, the payload zip, the three payload-inputs files, the CI record, igneum-prove-wsl2.zip), 2 same
manifest	consensus.override carried over from the OLD folder's 0.3.7 manifest; both manifests signed (key 8f186e37...), verified locally, same fields
deploy	one deploy, 13:33Z
verify	both folders: the three files HEAD 200 with the local sizes, GET sha256 ok, the manifest signature ok
console	item #354 "Igneum Miner 0.3.8 shipped (mac+windows)"; exit 0 at 13:34:36Z, 337 s

File	sha256	Size
Igneum-Miner-0.3.8.dmg	53c12b6e84a1c1e638d3e28d1cebb8eaf1980620c6dff5958292893033b62871	41,247,419
Igneum-Miner-Setup-0.3.8.exe	86cffd144adb89b9d886be9a3b4c76b91ed78afc737b3a9fc19ce44a2d71afcc	19,794,320
igneum-windows-app.zip	8f08a3040ac7d2b0e95714f8e930452bb26656f62af08f3ba07376ab72884a22	27,591,281

The live manifests, read 13:34:54Z, compared field by field with the 0.3.7 OLD-folder manifest saved before the cut:

Field	0.3.7 (before)	0.3.8 OLD folder	0.3.8 NEXT folder
version, channel, min_supported_version	0.3.7, devnet, 0.3.0	0.3.8, devnet, 0.3.0	same
published_at	2026-10-05T10:16:29Z	2026-10-05T13:33:20Z	2026-10-05T13:33:22Z
consensus	override {difficulty_v2_activation_daa 33000, proving_v0_activation_daa 84100}, activation_height 84100, deadline_note "proving v0"	identical	identical
fees_v1_activation_daa, tuning	absent	absent	absent
mac	dmg 8ee96b3b..., 40,156,739	dmg 53c12b6e..., 41,247,419, URL in its folder	same bytes, URL in the NEXT folder
windows	inno-setup 2bacba64..., 19,784,297	inno-setup 86cffd14..., 19,794,320, URL in its folder	same bytes, URL in the NEXT folder

update-now-038 to all, published 14:00:39Z (both folders, the apps woken, stamp 2026-10-05T14:00:39Z.898f4a38).

9. The machines after the publish (manifest live 13:33:20Z)

Baseline 13:29:05Z: Mac d937c69d app 0.3.7 node 2b6d23ef DAA 104402 20.6 MH/s; PC 1 ae432dc7 0.3.7 DAA 104392 113.1 MH/s; PC 2 1ccfe586 0.3.7 DAA 104389 128.9 MH/s; PC 37ba0461 0.3.7 DAA 104376 2.3 MH/s; Sam's Mac 3a9bf309 silent 3 h (0.3.5). A machine counts as updated only when its node reports a DAA score and the miner a hash rate on 0.3.8.

Machine	On 0.3.8	Its log (IGNEUM-APP version=0.3.8, fingerprints 477bb0ef key / ed9c4d2e folder on every one)
PC 1 ae432dc7 (Windows)	engine restart 13:42:01Z (unix 1791207722), 8 min 41 s after the manifest, on its own hourly slot (before the update-now job existed); node started 13:42:06Z, node proof verifier reported: command +6 s, update to 0.3.8 complete (from 0.3.7) 13:43:32Z; console 14:00Z: node 2b6d23ef, DAA 106190, 111.0 MH/s	run win-ae432dc7-20261005-134201: [ok] updated to Igneum Miner 0.3.8 from 0.3.7, node proof verifier: command (...\igneum-prove-verify.exe), no exited with code line
Mac d937c69d	engine restart 13:53:34Z (unix 1791208415), 20 min 14 s after the manifest, on its hourly slot; ota-apply.log: apply: engine 99165 host 99158 ... version 0.3.8, staged bundle digest verified, swapped, 0.3.8 is running (13:53:29Z); node proof verifier: command (/Applications/Igneum Miner.app/Contents/Resources/bin/igneum-prove-host) and reported: command +10 s; update to 0.3.8 complete 13:55:05Z; console 14:00Z: node 2b6d23ef, DAA 106221, 22.0 MH/s	run mac-d937c69d-20261005-135334; the node log node-20261005-135334.log: proving v0: payouts from DAA score 84100, window 7200 DAA, dust 5, verifier Command(".../igneum-prove-host")
PC 2 1ccfe586 (Windows)	update-now-038 ran 14:01:12Z (33 s after the publish, woken); installer downloaded and verified 14:01:16Z; engine restart 14:01:22Z (unix 1791208882), 43 s after the publish; node started 14:01:26Z, synced at 106308 blocks with 3 peers at +1 s, verifier reported: command +7 s, 119.86 MH/s at +60 s; update to 0.3.8 complete 14:02:52Z; console 14:03:39Z: node 2b6d23ef, DAA 106429, 122.7 MH/s	run win-1ccfe586-20261005-140122
PC 37ba0461 (Windows, the US laptop)	not reached: silent from 13:52:20Z (its last status line 13:51:51Z, 2.31 MH/s, up 3 h 26 min; its hourly slot is minute 57, the 13:57Z slot passed in silence). The update-now job and the manifest wait for it	run win-37ba0461-20261005-102457
Sam's Mac 3a9bf309	not reached: silent since 09:41Z (0.3.5)

PC 2's 0.3.7 app and the jobs file: at 13:19:41Z PC 2 fetched the woken jobs file and logged jobs: jobs file signature does not verify; the same bytes re-signed at 13:23:04Z verified and ran. The file is canonical JSON signed by the same key; nothing in the signer or jobs.rs changed since 0.3.7. Unexplained (11).

10. Cross-machine proving after the rollout

The first cross-verified shard: block 68178 shard 0, proven on PC 2 (prover key e809e396..., payout address 0xCAfc6e74...), proven and submitted in 28 s (assigned 14:05:37Z, submitted 14:06:05Z); the Mac's app node (node-20261005-135334.log): proof record for block 68178 shard 0 by e809e396... (peer): accepted, verify Command(".../igneum-prove-host") at 14:06:04.949Z, then proof of block 68178 shard 0 by e809e396...: verified in 0.5 s: RESULT verify: VERIFIED in 0.052 s at 14:06:05.638Z, then chain block 68211: proof record for block 68178 shard 0 ... paid 868202990000000000 wei to 0xCAfc6e74... at 14:06:08.782Z (PC 2's engine: block 68178 shard 0 paid 0.86820299 IGN at 14:06:15Z). Before the cut the same Mac host answered rejected in 87.0 s: RESULT verify: NOT VERIFIED in 0.113 s for every PC 2 record (the last at 13:30:17Z): the whole point of 0.3.8, measured on the live devnet: a verify that took 87 to 88 s and failed now takes 0.5 s and passes.

Tally at 14:07:34Z (2 minutes after proving came back on): the Mac app node's pool {entries 3, failed 0, pending 0, verified 3}, paidShards 213 (211 before, both PCs' earlier records); the Mac node log since 14:04Z: 3 VERIFIED in, 0 NOT VERIFIED, 3 paid. Blocks 68178, 68207 and 68235, each proven on PC 2 in 28 s, each verified on the Mac in 0.5 s, 68178 and 68207 paid (0.8682 and 1.7366 IGN) when this was written. The live page (/api/live, fed by the observer): pool {entries 3, verified 3, failed 0}, paid_shards_total 213, shards_proven_10m 3, shards_paid_10m 3, and the block list shows the paid shard of block afdbec35 (DAA 106576) with prover e809e396, lag 39, payout 1.7365 IGN. So verified records and payouts are visible on the Mac's node and on the live page, not only on PC 2's node.

Program id on each machine: Mac (installed app) 0x0dfade071ffc05a50be5f7e6640fb12638bac0ea63697ec252863f55658be16a; PC 2 (/opt/igneum) the same; PC 1 has no prover (its node verifies through the wrapper's probe, which found no WSL host, so it reports command and trusts: not changed by this release); PC 37ba0461 has no WSL prover.

11. Open after the cut

Item	State
PC 37ba0461	silent from 13:52:20Z (before the update-now job); on 0.3.7; takes 0.3.8 on its next check (hourly slot minute 57) or when the job reaches it
Sam's Mac 3a9bf309	silent since 09:41Z, on 0.3.5; the same
PC 2's 0.3.7 app refused the jobs file once (jobs file signature does not verify, 13:19:41Z)	EXPLAINED and closed (housekeeping, 5 October 2026): the app fetched the file and its signature in two requests while the edge was still serving the previous deployment for one of the two objects (a publish that afternoon needed 15 s before the edge served the new file), so the pair did not belong together. From 0.3.9 the app fetches igneum-jobs.signed.json, one object carrying the file text and the signature, and the publisher verifies every folder after the deploy. Details: release-0.3.6 plan, section 10
The pool was not observed empty before the Mac's host changed (section 7, step 2)	inferred from the 23 minutes between the last record and the restart; the watch that should have reported it treated a connection error as "not empty" and said nothing: the next watch of this kind prints every error line
The package gate's execute half	skipped (SKIP_GATE=1 on instruction); the native half ran on the DMG's host; PC 2's CUDA build proved three shards within two minutes, which is the stronger check
PC 2's prover crates rebuilt in 5.65 s	plausible (three small crates, every dependency cached) and the installed host answers --mode id, which a 0.3.7 host cannot; not verified by a clean build
Carried from 0.3.6/0.3.7 (section 10 there)	the app marks "update complete" on its own health; igneumd not reproducible across PC 1 and PC 2. Answered on 5 October 2026 (housekeeping, release-0.3.6 plan section 10): why the PC-built Windows node died at start (the dynamic libstdc++; static since the fork's database/build.rs), the two finality tests under the parallel suite (the test process waits for a cache build slot)