igneum/docs/analysis/cryptanalysis/report-acceptance-rule.md

Report: adversarial pass on the program acceptance rule (class v4 sub-version 3)

internal adversarial pass, not an independent review

• Target commit: 017e703764 (class v4 sub-version 3, object byte 7).
• Crate built: igneum-pow at the frozen commit (this worktree's igneum-pow/ is reset to it; build/master diverged by 635 deletions and is not used). Harness: tools/attack/adv-accept (depends on igneum-pow by path).
• Binary sha256: e3d35f4464937f91aac0648e2ee7134f33c85c7aa314b87b33f91059dedc6682
• Box: igneum-build-2 (build class, nice 10, core band 0-31). Logs under /srv/builds/igneum-wt-adv-accept/adv/.
• rustc 1.99.0 both sides. First results by 8 October 2026 18:00 BST. GPU: not available, so any per-card hash-rate confirmation of a gain is BLOCKED and said so.
• Box-hours spent so far: about 0.1 (one 7 s build, three short runs). Budget 8.

Draw-path validation (must pass before any claim)

The shared devnet epoch-0 class v4 program drawn through Epoch::chain_program(ProgramClass::V4) has program id a785001687d8688a at attempt 1 (class mx8-erad810f22d+sh256x27), which matches the frozen pack proto-cuda/packs-ca3-v4/v4-devnet-epoch0/program.json and the brief. So my draw path is the chain's. Command: adv-accept derive-check on box 2. Devnet 3 epoch-0 (id fce15bf61030be57) derive check is owed once I copy its program.json read-only from build-1.

Status board

Q	Method	Known-failed shape (must fire)	Gate	Result	Status
Q1	Steering/hot set: draw accepted class v4 programs over >=10^6 seeds, measure the hot set of the 128 live loads per hash (share of reads on top 0.1% / 1% of items vs uniform)	f8 const-item / quarter-lines / half-lines plant must FLAG; clean control within noise	X_f >= f flags a hot set; gain = implied on-die SRAM copy size	closed-form proxy sweep (10k seeds) running; live-dataset histogram owed	RUNNING
Q2	Stand-in gap: compare the (c) metrics (distinct-address sum, saturation, bias, per-site ratio) on the closed form vs the live memory-hard dataset for accepted programs; count and bound false accepts	a hand-built closed-form-accept / live-reject program must be reported as such	any false accept that reads a hot set on the live set	not started (rides on Q1 cache)	PENDING
Q3	Attempt grinding + last resort: variance of the hot set across attempts of one seed vs across seeds; what last_resort_v4 (256-cap, or/mul/mulhi->xor, no (c) check) hands an attacker	the forced last-resort program's live hot set must be measurable; derive check fce15bf61030be57	a predictable or weak accepted program the hot-set rule never sees	not started	PENDING
Q4	Header grinding for locality: vary H and nonce_hi (init words only), measure distinct DRAM rows / cache lines a 32-lane group touches, search cost vs clustering gain	a harness-mirror patch making the address depend on I must let the search find a clustering header; the real path must not	best clustering over a header budget, cost in hashes	not started	PENDING
Q5	Generator distinguishers: over accepted programs count lossy last writes, contractions, register-set collapse, low-entropy sites in the 0.98 tail; headroom of the floor	reproduce the crate's ratio verdict: p15/p18/p19/p56 rejected, p23 attempt 1 accepted	a structural shape that lowers the live distinct-item count	per-site ratio distribution in the 10k sweep; F8 reproduction owed	RUNNING
Q6	Fixed (c) sample grindability; live-size invariance of the (c) verdict	a program tuned to the 2,048 fixed nonces but failing off-sample must be found or bounded	BOUND unless something fires	not started	PENDING

The plant (known-failed shape for the harness itself) fired: planting an or write of a load's source register immediately before the load makes the rule reject with "(a') load at 1 reads r4, not fresh by dataflow in the loop's steady state". So the harness reads the real rule, not a copy. Command: adv-accept plant --seed 0 on box 2.

Q1 and Q5: the accepted-program sweep (RUNNING)

Command (box 2, background): adv-accept sweep --seeds 10000 --threads 32 --ratio-units 256 --out /srv/builds/igneum-wt-adv-accept/adv/sweep-10k.txt. Log /srv/builds/igneum-wt-adv-accept/adv/sweep-10k.log, pid file beside it. Seeds: epoch bytes = LE words of seed_words_from_bytes("igneum-adv-accept/epoch/k"), era bytes of ".../era/k", for k = 0..9999; each drawn through the chain path generate_era(V4_CLASS, V3_ALLOWED), which runs the full attempt loop and the real acceptance rule.

Per accepted program the sweep records: attempt, program id, the closed-form distinct-item mean per hash (the rule's own (c) metric; 128 is ideal, the rule floor is a mean above 120), the minimum per-site distinct-index ratio at 256 units (the (c'') metric sampled cheaply; the enforced floor is 0.98 at 2^20 units), the saturated-final count and the output-bias max.

This is the closed-form proxy for Q1 and the headroom characterization for Q5. The live-dataset hot set (the memory-hard cache, items derived into a table, the cross-hash histogram with the hot-set test) is the next run and is what the chip model prices; the closed-form distinct mean is a cheap upper bound on how concentrated an accepted program can be on the stand-in.

Numbers land here when the run finishes (first results by 8 October 18:00 BST).

Running notes

• Box-hours and commands are logged in each section with the seed, so every claim is reproducible by re-running the exact command on box 2.
• No cargo on the Mac. Pushes to the build mirror only. Commits as igneum-labs.