igneum/docs/analysis/cryptanalysis/report-acceptance-rule.md

Report: adversarial pass on the program acceptance rule (class v4 sub-version 3)

internal adversarial pass, not an independent review

• Target commit: 017e703764 (class v4 sub-version 3, object byte 7).
• Crate built: igneum-pow at the frozen commit (this worktree's igneum-pow/ is reset to it; build/master diverged by 635 deletions and is not used). Harness: tools/attack/adv-accept (depends on igneum-pow by path).
• Re-base (18:3x UTC): build/master moved to 7a7caa34 whose igneum-pow IS the frozen object; merged at 8748e955ceb48be5a6cbf7f8718a4884d3de9828; git diff --quiet 017e7037 HEAD -- igneum-pow prints IDENTICAL. Nothing measured here was on a stale tree: igneum-pow/ had been reset to the frozen object before the first build.
• Binary sha256 (first build, box 2): e3d35f4464937f91aac0648e2ee7134f33c85c7aa314b87b33f91059dedc6682 (adv-accept single-binary build); the two-binary build (adv-accept, adv-live = the unmodified f8 harness) sha256 is logged per box in the run sections below.
• Boxes: igneum-build-1 (CPU-bound sweeps, by the coordinator's order) and igneum-build-2 (shard 0, already there). nice 10 on every idle core, the capacity layer's yield (run-box.sh). Logs under /srv/builds/igneum-wt-adv-accept/adv/ on each box (spared from the checkout clean by .igneum-scratch-spare; the first 10k log on box 2 was wiped by a rebuild before the spare existed and is void anyway: old labels, old binary).
• Lane scope since 18:2x UTC: THE BYPASS (Q1, Q2, Q5). Q3 is lane adv-accept-3's, Q4 lane adv-accept-2's.
• Seed space: the attack-pass F8 label space (program k = seed_words("igneum-attack-f8/program/k"), era ".../era/k"), so adv-live warps --program k measures the live hot set of exactly the program the sweep reports.
• rustc 1.99.0 both sides. First results by 8 October 2026 18:00 UTC. GPU: not available, so any per-card hash-rate confirmation of a gain is BLOCKED and said so.
• Box-hours spent so far: about 0.1 (one 7 s build, three short runs). Budget 8.

Draw-path validation (must pass before any claim)

The shared devnet epoch-0 class v4 program drawn through Epoch::chain_program(ProgramClass::V4) has program id a785001687d8688a at attempt 1 (class mx8-erad810f22d+sh256x27), which matches the frozen pack proto-cuda/packs-ca3-v4/v4-devnet-epoch0/program.json and the brief. So my draw path is the chain's. Command: adv-accept derive-check on box 2. Devnet 3 epoch-0 (id fce15bf61030be57) derive check is owed once I copy its program.json read-only from build-1.

Status board

Q	Method	Known-failed shape (must fire)	Gate	Result	Status
Q1	Steering/hot set: draw accepted class v4 programs over >=10^6 seeds, measure the hot set of the 128 live loads per hash (share of reads on top 0.1% / 1% of items vs uniform)	f8 const-item / quarter-lines / half-lines plant must FLAG; clean control within noise	X_f >= f flags a hot set; gain = implied on-die SRAM copy size	closed-form proxy sweep (10k seeds) running; live-dataset histogram owed	RUNNING
Q2	Stand-in gap: compare the (c) metrics (distinct-address sum, saturation, bias, per-site ratio) on the closed form vs the live memory-hard dataset for accepted programs; count and bound false accepts	a hand-built closed-form-accept / live-reject program must be reported as such	any false accept that reads a hot set on the live set	not started (rides on Q1 cache)	PENDING
Q3	Attempt grinding + last resort: variance of the hot set across attempts of one seed vs across seeds; what last_resort_v4 (256-cap, or/mul/mulhi->xor, no (c) check) hands an attacker	the forced last-resort program's live hot set must be measurable; derive check fce15bf61030be57	a predictable or weak accepted program the hot-set rule never sees	not started	PENDING
Q4	Header grinding for locality: vary H and nonce_hi (init words only), measure distinct DRAM rows / cache lines a 32-lane group touches, search cost vs clustering gain	a harness-mirror patch making the address depend on I must let the search find a clustering header; the real path must not	best clustering over a header budget, cost in hashes	not started	PENDING
Q5	Generator distinguishers: over accepted programs count lossy last writes, contractions, register-set collapse, low-entropy sites in the 0.98 tail; headroom of the floor	reproduce the crate's ratio verdict: p15/p18/p19/p56 rejected, p23 attempt 1 accepted	a structural shape that lowers the live distinct-item count	per-site ratio distribution in the 10k sweep; F8 reproduction owed	RUNNING
Q6	Fixed (c) sample grindability; live-size invariance of the (c) verdict	a program tuned to the 2,048 fixed nonces but failing off-sample must be found or bounded	BOUND unless something fires	not started	PENDING

The plant (known-failed shape for the harness itself) fired: planting an or write of a load's source register immediately before the load makes the rule reject with "(a') load at 1 reads r4, not fresh by dataflow in the loop's steady state". So the harness reads the real rule, not a copy. Command: adv-accept plant --seed 0 on box 2.

Q1 and Q5: the accepted-program sweep (RUNNING, sharded)

Ten shards of 100,000 seeds (k = 2..1,000,001 of the F8 label space), each adv-accept sweep --seed-start S --seeds 100000 --threads 96 --ratio-units 256 --out /srv/builds/igneum-wt-adv-accept/adv/sweep-sNN.txt, started through run-box.sh (nice 10, yield to builds, pid/pgid/yield pid files beside the log). Shard 00 (S = 2) on box 2, started 18:27Z. Shard 01 (S = 100,002) on box 1, started 18:30Z. Shards 02..09 sit as self-contained scripts in /srv/builds/_adv/accept/queue/ on box 2 (claim by mkdir under claims/), to be run back to back on whichever box has idle cores. Every row is written as it lands, so a partial shard is data.

Live hot set (the measure the chip model prices): adv-live warps --program k --nonces N (the unmodified f8 harness: the day's items derived into a table, the cross-hash item histogram, the hot-set test X_f >= f against the window-model control, the 6-sigma test, library agreement checks). Known-failed shape run first: --plant const-item on program 2 at 10^6 nonces (box 1, 18:30Z, log adv/live-plant-p2.log) beside its clean control (adv/live-control-p2.log). The plant must be FLAGGED and the control clear before any live number below is trusted.

Seeds: epoch bytes = LE words of seed_words_from_bytes("igneum-attack-f8/program/k"), era bytes of ".../era/k"; each drawn through the chain path generate_era(V4_CLASS, V3_ALLOWED), which runs the full attempt loop and the real acceptance rule.

Per accepted program the sweep records: attempt, program id, the closed-form distinct-item mean per hash (the rule's own (c) metric; 128 is ideal, the rule floor is a mean above 120), the minimum per-site distinct-index ratio at 256 units (the (c'') metric sampled cheaply; the enforced floor is 0.98 at 2^20 units), the saturated-final count and the output-bias max.

This is the closed-form proxy for Q1 and the headroom characterization for Q5. The live-dataset hot set (the memory-hard cache, items derived into a table, the cross-hash histogram with the hot-set test) is the next run and is what the chip model prices; the closed-form distinct mean is a cheap upper bound on how concentrated an accepted program can be on the stand-in.

Numbers land here when the run finishes (first results by 8 October 18:00 UTC).

Results as they land

Tool validation (box 1, 18:30Z, 10^6 nonces each, about 30 s per run on 32 threads)

Run	Hot-set test (window-model control)	Top 0.1% share ratio over the window model	6-sigma	Verdict
adv-live warps --program 2 --plant const-item (known-failed shape)	f 1%: S_f 8.58%, E_f 2.09%, X_f +6.49% (X_f/f 6.49) HOT SET	21.80x (flat control 26.85x)	FLAGGED	FLAGGED
adv-live warps --program 2 (clean control)	f 1%: S_f 2.56%, E_f 2.09%, X_f +0.47% (X_f/f 0.47) no hot set	0.9996x (flat 1.2312x, the window layer)	clear	PASS

The plant fires and the control is clean, so the live hot-set numbers below are trusted. Logs adv/live-plant-p2.log and adv/live-control-p2.log on box 1.

Sweep shard 01, first 864 accepted programs (box 1, seeds 100,002..., read at 18:33Z)

Metric	Value
Attempt histogram 0..9	273, 191, 134, 90, 59, 38, 34, 12, 7, 11; max 26
Min per-site distinct-index ratio at 256 units	0.9986 (floor 0.98 at 2^20; every row above 0.998)
Programs with a lossy (or/mul/mulhi) last write to an output register	715 of 864 (83%)
Programs writing fewer than 8 registers	0
Last-resort programs	0
Lowest-ratio seeds (live hot set queued)	100211 (0.9986), 100629 (0.9987), 100064, 100767 (0.9988), 100159

Reading: on the stand-in the accepted population sits 0.02 above the 0.98 floor at this sample size; the floor leaves headroom (Q5), and no accepted program in this sample comes near it. Whether any of the lossy-last-write programs concentrate reads on the LIVE set is what the live census answers.

Rule change in the method column (box-hours honesty)

18:27Z to 18:4xZ: shards ran under the capacity layer's SIGSTOP yield and were paused almost the whole time (a build slot held nearly continuously on both boxes). Ruling at 18:4xZ: yield dropped, every sweep at nice 10 on cores 8-95 (cores 0-7 reserved for release builds, the seed and the observer). Shards 00 and 01 SIGCONTed and re-pinned at 18:4xZ. Box-hours before the ruling: about 0.1 of running time.

Live hot set of the five lowest-ratio shard-01 programs (box 1, 18:37Z, 10^6 nonces each)

All five pass the rule (they are the chain's accepted programs). Log logs/adv-accept/live-lowratio-s01.log. Columns: the f8 gate (top 0.1% share over the window-model control, gate 1.2x), the hot-set excess X_f at f = 0.1% and 1% (a hot set needs X_f >= f), the windowed 6-sigma test, the hottest item and its traced source.

Seed	id	attempt	closed ratio (256 u)	top 0.1% over window model	X_0.1% / X_1%	6-sigma (buckets64)	hottest item, reads, share, source
100211	d07885a437e237c7	0	0.9986	1.08x	+0.026% / +0.049%	+42.4 sigma FLAGGED	0x454585, 1238 (0.0010%), site instr 4 reads r0 one-zero-bit, writer load@3
100629	37c849d9741c5994	0	0.9987	1.01x	+0.003% / +0.015%	+5.6 within	30 reads, none
100064	2442abf9d56f6611	2	0.9988	1.17x	+0.044% / +0.189%	+77.3 sigma FLAGGED	54 reads; the flag is a 256-item bucket at p43 (iteration 2, site 11, instr 33) holding 0.048% of that position's reads against 0.0061% expected (8x)
100767	9d68e6286fc817d4	2	0.9988	1.34x BEYOND the 1.2x gate	+0.087% / +0.138%	+68.0 sigma FLAGGED	0x000000, 1677 (0.0013%), site instr 6 reads r6 = zero, writer mad@4; saturated-source share 0.013% at that position (the (c') limit is 1%)
100159	573d650159a8b04e	3	0.9988	1.07x	+0.020% / +0.124%	+37.5 sigma FLAGGED	37 reads, none
p2 control (18:30Z)	f8 seed 2			0.9996x	+0.00% / +0.47% (flat)	clear	32 reads

Reading, as an attacker. (1) The stand-in ratio does correlate with live concentration: four of the five lowest-ratio seeds flag the windowed 6-sigma test at 10^6 nonces where the random control is clear, and one sits beyond the f8 gate. (2) The concentration is NOT a hot set a chip can use: the top 0.1% of items (16.7k items, 1 MB) take at most 0.34% of reads against 0.26% expected; the hottest single item takes 0.0013% of reads. An on-die copy of these items saves under 0.1% of DRAM reads: no row of chip-model-v3.md moves. (3) The mechanism is the known one, a near-saturated source (zero, or one bit off all ones) at one site in one iteration, below the (c') 1% limit (0.013% here), so (c') never fires, and the per-site ratio at 0.98 is loose enough (these sit at 0.9986) that (c'') never fires either. (4) Confirmation at the gate's own 2^24 nonces with attribution is running (adv/live-confirm-16m.log); numbers replace this paragraph when it lands.

Live hot-set census (RUNNING)

• box 2, 18:5xZ: adv-live census --programs 2..201 --nonces 1000000 --threads 32 (200 consecutive accepted programs of shard 00's range: the random sample), log adv/live-census-s00-2-201.log.
• box 1, 18:5xZ: adv-live warps --program k --nonces 1000000 for the five lowest-ratio shard-01 seeds, log adv/live-lowratio-s01.log.

Running notes

• Box-hours and commands are logged in each section with the seed, so every claim is reproducible by re-running the exact command on box 2.
• No cargo on the Mac. Pushes to the build mirror only. Commits as igneum-labs.