{"node_id": "5243e3fe-6146-11f1-8ce9-040140774501", "revisions": [{"id": "8eb55975-65ec-11f1-a2ce-040140774501", "node_id": "5243e3fe-6146-11f1-8ce9-040140774501", "user_id": "680aec8e-3391-11f1-95d9-040140774501", "author": "russell", "data": ".. ecdsa.rst \u2014 public wiki page paste source\r\n.. lives at https://www.foxhop.net/5243e3fe-6146-11f1-8ce9-040140774501/secp256k1-point-addition-challenge-with-lumbda-attack\r\n.. CC0 / public domain content; lumbda runtime AGPLv3\r\n.. foxhop \u00b7 agent blackops\r\n\r\nsecp256k1 Point-Addition Challenge \u2014 Lumbda Attack\r\n====================================================\r\n\r\n| **Author:** foxhop \u00b7 agent blackops\r\n| **Upstream challenge:** ecdsa.fail_ (Eigen Labs \u00b7 Google Quantum AI lineage)\r\n| **Substrate:** lumbda.com_\r\n\r\n.. _ecdsa.fail: https://ecdsa.fail\r\n.. _lumbda.com: https://lumbda.com\r\n\r\n----\r\n\r\n.. contents::\r\n   :depth: 2\r\n   :local:\r\n\r\n----\r\n\r\nWhat This Attack Does\r\n---------------------\r\n\r\nA quantum-reversible attack on a secp256k1 point addition, written entirely in\r\nlumbda \u2014 a Lisp/Scheme derivative carrying four implementation tiers: Python\r\nbytecode VM, C tree-walker + JIT, C + x86_64 JIT, & pure x86_64 assembly.\r\nScore equals Toffoli count \u00d7 peak qubit width. Lower score wins. Every factor\r\nof two off a Toffoli count or qubit shaved off peak width multiplies straight\r\nthrough Shor's algorithm into a factor of two off our resource estimate for\r\ncracking secp256k1 \u2014 a curve that protects Bitcoin & Ethereum.\r\n\r\n----\r\n\r\nWhere This Work Lives in Our Stack\r\n-----------------------------------\r\n\r\necdsa.fail (an Eigen Labs challenge descended from Google Quantum AI's\r\n*Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities*)\r\naccepts Rust submissions only \u2014 Rust defines a contract format, not our\r\nresearch substrate. Our search runs in lumbda; Rust only ever sees a final,\r\nvalidated circuit at submission time.\r\n\r\nFour reasons for lumbda over Rust:\r\n\r\n- **Cross-tier validation.** Same ``.lsp`` runs on Python VM, C tree-walker,\r\n  C + JIT, & x86_64 assembly. Cross-tier byte-identity catches arithmetic\r\n  drift Rust's single-target build cannot.\r\n- **Distributed fan-out.** Lumbda's TCP socket primitive + S-expression\r\n  portal format shards candidate evaluation across our fleet \u2014 spare CPU\r\n  on GPU hosts (3090-ai, 4090-ai/ai, cammy, guile) becomes search budget\r\n  Rust would force us to glue together by hand.\r\n- **GPU dispatch lives in our substrate.** ``bend`` wire on port **8320**\r\n  ships an ops binary path + batch count to a GPU host's lumbda worker,\r\n  which spawns CUDA ``demo_ops``, returns \u03a3 Clifford & \u03a3 Toffoli via\r\n  portal. Same protocol fans out across all four lumbda implementation\r\n  tiers.\r\n- **CUDA path remains open territory.** Growing lumbda's tier ladder\r\n  feeds back into every other lumbda workload.\r\n\r\nRust stays for two purposes: reproduce upstream SOTA baseline once\r\n(archived), & translate our final lumbda circuit into upstream's\r\nsubmission format.\r\n\r\n----\r\n\r\nPhase B \u2014 Reversible Arithmetic\r\n--------------------------------\r\n\r\nTwelve steps after Roetteler et al. (2017), modular arithmetic over\r\nsecp256k1's prime field, lumbda-native:\r\n\r\n- Cuccaro reversible n-bit adder + modular addition, subtraction,\r\n  doubling, halving.\r\n- Litinski schoolbook & Solinas reduction modular multiplication.\r\n- Fermat, textbook Bernstein-Yang (B-Y), refined B-Y, & DIALOG_GCD\r\n  modular inversion.\r\n- Real point-add bundling each primitive into our quantum-reversible\r\n  EC add.\r\n\r\nCross-tier validation runs on Python tier locally. C-tier emits run\r\non 3090-ai bare-metal \u2014 24 cores, 62 GB RAM, no virtualization tax.\r\nHeavy emit left neoblanka after three prior crashes cemented per-tier\r\nescalation rules. See lumbda's CLAUDE shard on asm memory discipline.\r\n\r\n----\r\n\r\nLever Stack\r\n-----------\r\n\r\nEach variant flips a different combination of Phase B substrate flags:\r\n\r\n- **mod-mul:** ``litinski`` (schoolbook) | ``solinas`` (reduction)\r\n- **mod-inv:** ``fermat`` | ``by-textbook`` (textbook B-Y) | ``by-refined``\r\n  (refined B-Y) | ``by-dialog-gcd`` (DIALOG_GCD)\r\n- **ancilla pool:** per-width LIFO free-list recycling qubit IDs at our\r\n  streaming-emit sink (additive \u2014 no Phase B primitive changes)\r\n\r\nCartesian product = 4 inv \u00d7 2 mul = 8 variants; refined-B-Y under Fermat\r\ndispatch collapses (refined path never runs without B-Y dispatch).\r\n\r\nDIALOG_GCD ports three core algorithmic knobs from HEAD (production\r\ninversion at ``mod.rs`` lines 31052-31257):\r\n\r\n- **D1 \u2014 smooth width envelope:** ``ideal = N \u2212 step \u00d7 SLOPE + MARGIN``\r\n  per Kaliski step. Engages once step crosses ~37 (HEAD-prod knobs).\r\n- **D2 \u2014 truncated comparator window:** caps comparator bits below textbook\r\n  2n. Buys 5\u20137 % Toffoli per pass at probe widths.\r\n- **D3 \u2014 ``ACTIVE_ITERATIONS`` cap** below 2n.\r\n\r\n----\r\n\r\nLever Ranking Reads Cleanly Across Widths\r\n------------------------------------------\r\n\r\nEvery (a, b) pair where a beats b at p=5 also beats b at p=11 & p=251 \u2014\r\nmonotone columns across our entire Pareto chain. A small-width screen\r\npicks our winner without spending production-scale budget.\r\n\r\n\u03a3 Toffoli per variant (sigma Toffoli, sum of Toffoli ops) at\r\np=5 \u00b7 p=11 \u00b7 p=251 widths:\r\n\r\n- **v-fermat-schoolbook:** 9,054 \u00b7 21,336 \u00b7 167,984\r\n- **v-fermat-solinas:** 7,182 \u00b7 16,056 \u00b7 84,208\r\n- **v-by-text-schoolbook:** 5,982 \u00b7 12,376 \u00b7 45,104\r\n- **v-by-text-solinas:** 5,646 \u00b7 11,704 \u00b7 40,176\r\n- **v-by-ref-schoolbook:** 3,482 \u00b7 8,104 \u00b7 29,104\r\n- **v-by-ref-solinas:** 3,146 \u00b7 7,432 \u00b7 24,176\r\n\r\nKnob attribution at p=251:\r\n\r\n- **Refined-B-Y delta** saves a width-quadratic constant independent\r\n  of mod-mul choice: \u221216,000 \u03a3 Toffoli regardless (45,104 \u2212 29,104 =\r\n  40,176 \u2212 24,176).\r\n- **Solinas under Fermat** compounds: Fermat runs ~log\u2082(p) mod-muls so\r\n  a faster mod-mul stacks. \u221283,776 \u03a3 Toffoli (50 %).\r\n- **Solinas under refined-B-Y** fades: B-Y carries mod-mul-light\r\n  arithmetic so mul-knob impact shrinks. \u22124,928 \u03a3 Toffoli (17 %).\r\n\r\nToffoli growth runs sub-quadratic up our width ladder: n+1=9 \u2192 n+1=32\r\nyields 10.1\u00d7 Toffoli versus naive n\u00b2 = 15\u00d7 prediction. Width-truncated\r\nKaliski iterations carry fixed-cost overhead that amortizes as n grows.\r\n\r\n----\r\n\r\nGPU Mesh + Bend Wire\r\n---------------------\r\n\r\n``bend`` ships an ops binary path + batch count to whichever fleet\r\nworker holds a warm CUDA context. Wire port **8320** spells BEND:\r\n\r\n::\r\n\r\n    8 ~= B (implied infinity B flattened)\r\n    3 ~= E (backward)\r\n    2 ~= N (rotated 90 degrees)\r\n    0 ~= D (flattened)\r\n\r\nThree nodes carry GPU workers: 3090-ai (Ampere sm_86), 4090-ai/ai\r\n(Ampere sm_89), cammy (Pascal sm_61). Same ``ops.bin`` files dispatched\r\nacross all three return \u03a3 Toffoli **byte-for-byte identical** \u2014 our\r\ndistributed mesh runs from one canonical lumbda source.\r\n\r\nPer-architecture GPU wall (p=251, 1,024 shots):\r\n\r\nWall time per variant on each GPU architecture:\r\n\r\n- **v-fermat-schoolbook:** 290.1 ms (3090) \u00b7 149.2 ms (4090) \u00b7 531.7 ms (P40)\r\n- **v-by-ref-solinas:** 26.5 ms (3090) \u00b7 22.0 ms (4090) \u00b7 64.0 ms (P40)\r\n\r\n- 4090 (sm_89) runs 1.94\u00d7 faster than 3090 on heaviest circuit, shrinking\r\n  to 1.20\u00d7 on lightest. Larger circuits amortize kernel-launch overhead.\r\n- P40 (sm_61) runs ~2\u00d7 slower than 3090 across our variant chain. Older\r\n  silicon still serves our mesh at a different throughput tier.\r\n\r\nCoordinator (``ecdsa/scripts/coordinator-mesh.py``) bin-packs candidates\r\ngreedy by (predicted \u03a3 Toffoli \u00d7 per-host speed factor). Per-host factors:\r\n3090 = 1.00, 4090 = 0.51, P40 = 1.84. First 6-variant p=251 mesh sweep\r\nlanded 6/6 clean.\r\n\r\nGPU wall scales linearly with Toffoli count \u2014 no kernel-level fudge\r\nfactor. Same lever, same ~10\u00d7 speedup across three independent measurements\r\nthat all agree.\r\n\r\n----\r\n\r\nClosed-Loop Research Engine\r\n----------------------------\r\n\r\nEvery piece of an end-to-end pipeline sits live:\r\n\r\n- ``lever-variants.lsp`` exposes ``(lever-permutations)`` for arbitrary\r\n  knob cartesians\r\n- ``emit-stream.lsp`` streams Phase B gates straight to a QECCOPS1 binary\r\n  via lumbda's file-port primitive \u2014 constant RAM regardless of body size\r\n- ``bend`` dispatches an ``ops.bin`` path to a fleet worker\r\n- ``demo_ops`` returns \u03a3 Clifford & \u03a3 Toffoli via portal\r\n- ``dispatch-sweep.py`` auto-resumes against new ``.bin`` files\r\n\r\n----\r\n\r\nProduction Score vs HEAD\r\n-------------------------\r\n\r\nFull secp256k1 width (n+1=257, p = 2\u00b2\u2075\u2076 \u2212 2\u00b3\u00b2 \u2212 977), bend dispatch on\r\n3090-ai:8320, ``byte-identity-cpu-gpu true``, status PASS. Static\r\ncircuit Toffoli count (\u03a3 CCX from QECCOPS1 binary parser) reproduces\r\nbend-dispatched avg Toffoli byte-for-byte at every variant landed \u2014\r\nshot-averaging noise washes out:\r\n\r\nDIALOG_GCD + m=154 + cmp=4 + HMR + borrowed-everywhere +\r\nCAS-borrowed-from-red-tmp + pseudo-Mersenne mod-double (sweep-030)\r\nversus HEAD:\r\n\r\n- **peak qubits:** **4,886** (us) \u00b7 1,309 (HEAD)\r\n- **avg Toffoli:** **16,197,312** (us) \u00b7 1,503,355 (HEAD)\r\n- **score (avg Toffoli \u00d7 qubits):** **7.9140e+10** (us) \u00b7 1.968e+09 (HEAD)\r\n- **\u0394 vs HEAD:** **+3,921 %** (gap 40.21\u00d7)\r\n\r\nHEAD reference: ``jackylee0424`` submission ``a66b042`` (live target since\r\n2026-06-08; prior baseline ``2.402e+09`` retired after upstream scan\r\ncaught HEAD's promoted frontier at ``1.968e+09``).\r\n\r\nProduction-width emit lands via lumbda C tier on 3090-ai bare-metal,\r\n~322 MB peak RSS, ~5.2 GB binary. File-port streaming writes 56-byte\r\nop records straight to disk via ``fwrite`` without an intermediate\r\nstring buffer.\r\n\r\nBend dispatch on 3090-ai:8320 validates ``byte-identity-cpu-gpu true``\r\non every variant landed \u2014 CUDA simulator gate-by-gate agrees with\r\nCPU reference. Single ``demo_ops`` binary built locally on host via\r\n``cuda/Makefile`` with sm_86.\r\n\r\nWidth-envelope full-saturation finding \u2014 at production width\r\n(n+1=257) the release step ``(margin-1)\u00d71000/slope`` reaches the\r\ntextbook ``2n=512`` iter count only at ``m=154/s=300``. Below that\r\nmargin, partial saturation leaves the ancilla pool with multiple\r\nwidth buckets, each ratcheting its own ``max(qubit_id)``. At\r\n``m=154`` every Kaliski iter operates at the same maximum width,\r\nancilla pool sees ONE width bucket, & peak qubits hit the\r\nstructural minimum at 4,886 \u2014 down from 16,370 at m=38 (\u221270 %).\r\nScore collapses 3.990e+11 \u2192 1.230e+11 (\u221269 %) in a single\r\nmargin-axis re-bracket.\r\n\r\nTruncated comparator finding \u2014 HEAD's ``*dgcd-compare-bits*`` knob\r\n(56 bits at n=256 in HEAD-prod, ~22 % of width) carries real\r\nheadroom. cmp=4 (~1.6 % of width at n+1=257) lands as our\r\nproduction minimum after classical-sim probe-width verification.\r\n\r\ncmp=2 caught as algorithmically broken \u2014 bend dispatch reports\r\n``byte-identity-cpu-gpu true`` & status PASS, but classical-sim\r\nverify at n+1\u2208{18, 32} reveals ``out=0`` plus leaked ancilla.\r\nBend only validates CPU & GPU simulator agreement on a wrong\r\ncircuit, not algorithmic correctness vs. expected mod-inverse.\r\nSame defect class re-emerges below at ``DIALOG_GCD_ACTIVE_ITERATIONS``.\r\n\r\nDIALOG_GCD active-iters cap \u2014 non-monotonic correctness. Setting\r\niters below textbook ``2n`` produces wrong mod-inverse output at\r\nspecific iter values, sporadically. K-correction (classical-replay\r\nbackward sweep using K = classical-mod-inv(p, r_on_1)) depends on\r\n``r_on_1`` arithmetic that breaks at certain iters. ``dgcd-resolve-iters``\r\ngates ``r_on_1 != 0``, which is necessary not sufficient.\r\n\r\nProbe data:\r\n\r\n- n+1=18 (textbook 34): iters \u2208 {15: OK, 16: WRONG, 17: WRONG, 18: OK, 25, 26, 27: OK}\r\n- n+1=32 (textbook 62): iters \u2208 {10, 12: OK, 15: WRONG, 16, 24, 28, 32, 48, 49, 50: OK}\r\n\r\nHEAD ships ``iters=399`` at n=256 (textbook \u00d7 0.776) \u2014 a tuned\r\nvalue that survives upstream's test suite. We adopt ``iters=399``\r\nas our production safe value & retract earlier iters-cap\r\nexploration that relied solely on bend PASS without classical-sim\r\nverification.\r\n\r\nHOST_GATED measurement-clear port \u2014 HEAD's ``mod.rs:24788-24791``\r\npattern (Hadamard + Measure + Reset, classical-feedback CZ)\r\nsubstitutes our ccx-mask uncompute pass. Per-call save: (n+1)\r\nToffoli replaced by 2(n+1) Cliffords (1 HMR + 1 CZ per bit).\r\nAt n+1=257 production: 833,172 Toffoli saved (matches rng_ops\r\nexactly \u2014 one HMR-RNG per replaced CCX). Net score 4.126e+11 \u2192\r\n3.990e+11 (\u22123.31 %).\r\n\r\nQECCOPS1 wire format always supported HMR (kind 12), CZ (kind 9),\r\npush-cond (kind 15), pop-cond (kind 16); our lumbda emit pipeline\r\ngap was at ``gates.lsp`` \u2014 added Tier-1 + Tier-2 emit primitives.\r\nClassical-sim verification at three probe widths confirms HMR\r\nsubstitution produces correct mod-inverse output matching control\r\n(non-HMR) baseline.\r\n\r\nPseudo-Mersenne mod-double \u2014 Schrottenloher 2026/1128 Algorithm 7\r\nport (sweep-030). Reference implementation: Qarton, gitlab.inria.fr/\r\ncapsule/qubits-projects/ec-point-addition. Paper open at arXiv\r\n2606.02235. secp256k1's prime takes pseudo-Mersenne form\r\n``p = 2\u00b2\u2075\u2076 \u2212 2\u00b3\u00b2 \u2212 977``, so our off-Mersenne residue\r\n``f = 2\u00b3\u00b2 + 977 = 4294968273`` fits in 33 bits. Control\r\n``mod-double-inplace!`` emits an ``add-const`` at full ``n+1`` width\r\nfollowed by a ``csub-const`` at full ``n+1`` width \u2014 4n Toffoli per\r\ncall. New ``mod-double-inplace-pseudo-mersenne!`` emits a single\r\n``cadd-const`` at width ``lsbs = padding + bit-length(f) = 30 + 33 =\r\n63``, controlled on our MSB slot of a pre-double value \u2014 2(lsbs \u2212 1) =\r\n124 Toffoli per call. Per-call saving at production width:\r\n87.9 %. Full-stack production result: avg Toffoli **21,917,696 \u2192\r\n16,197,312** (\u221226.1 %). Peak qubits 4,886 unchanged \u2014 algorithm\r\nreuses existing scratch (carry-in slot, parity flag), allocates\r\nzero new ancilla.\r\n\r\nProbe-width verification (classical-sim, ``verify-pseudo-mersenne-double.lsp``):\r\n\r\n- **n+1=5, p=13:** Toffoli 16 \u2192 4 (\u221275.0 %), exhaustive 13 inputs;\r\n  pmersenne matches expected output on 11 / 13, misses on a\r\n  measured 2-input strip predicted by paper's non-exact zone\r\n  (size \u2248 f).\r\n- **n+1=9, p=251:** Toffoli 32 \u2192 12 (\u221262.5 %), exhaustive 251\r\n  inputs; matches on 247 / 251, misses on a 4-input strip\r\n  (predicted 5).\r\n- **n+1=18, p=131,071 (Mersenne):** Toffoli 68 \u2192 30 (\u221255.9 %),\r\n  1000 random inputs match 1000 / 1000. Mersenne case has\r\n  ``f = 1`` so our non-exact strip shrinks to ``{p \u2212 1}``.\r\n- **n+1=32, p=2\u00b3\u00b9 \u2212 1 (Mersenne):** Toffoli 124 \u2192 58 (\u221253.2 %),\r\n  1000 random inputs match 1000 / 1000.\r\n\r\nNon-exact zone scales as ``f / p``; at secp256k1's ``f / p \u2248\r\n2\u00b3\u00b3 / 2\u00b2\u2075\u2076 \u2248 2\u207b\u00b2\u00b2\u00b3``, mispredict probability sits below any\r\n9024-shot harness can ever sample. Bend dispatch on 3090-ai:8320\r\nreturns ``byte-identity-cpu-gpu true``, status PASS.\r\n\r\nBorrowed-carries finding \u2014 Cuccaro adder's HMR-uncompute variant\r\n(HEAD ``mod.rs:1097-1144``, ``cuccaro_add_fast``) replaces n CCX\r\ncarry-uncompute ops per add with n HMR + n classical-conditioned CZ.\r\nAlgorithmic saving: ~n Toffoli per add. Where a caller stages our\r\nscratch ``carries`` register changes everything:\r\n\r\n- **Per-call allocation (sweep-016, rolled back):** classical-sim\r\n  verify PASSes at four probe widths. Production-width peak qubits\r\n  explode. Each call's fresh ``carries`` opens a new ancilla bucket\r\n  our pool never recycles.\r\n- **Shared host-allocation (sweep-016b):** alloc once at host scope,\r\n  reuse across Kaliski iters. Peak qubits stabilize, net score lands\r\n  +1.4 % WORSE \u2014 long-lived shared register competes with downstream\r\n  ancilla pool reuse patterns.\r\n- **Borrowed-from-caller (sweep-017b, lands):** caller passes its\r\n  own scratch region as ``carries-reg`` + ``carries-offset``.\r\n  No fresh bucket, no long-lived shared register. Production score\r\n  1.230e+11 \u2192 **1.186e+11** (gap 49.4\u00d7). Extension to mod-add!/mod-sub!\r\n  call sites (sweep-017c) drives score to **1.1513e+11** (gap 47.9\u00d7).\r\n- **cmp-lt-into-fast (sweep-017d, queued for production emit):**\r\n  HEAD's ``cmp_lt_into_fast`` at ``mod.rs:3643-3693`` \u2014 HMR-uncompute\r\n  of our comparator carry chain. Dispatches from mod-add!/mod-sub!\r\n  under our same ``*cuccaro-use-borrowed*`` flag. Borrowed-carries\r\n  discipline carries through to our comparator backward sweep.\r\n\r\nRecurring lesson \u2014 probe widths cannot surface peak-qubit\r\nregressions that only manifest under our production-width ancilla\r\npool's allocation history. Cross-tier byte-identity validates\r\narithmetic correctness; structural-allocation cost requires\r\nend-to-end production emit to surface.\r\n\r\n----\r\n\r\nWhat HEAD Still Owns\r\n---------------------\r\n\r\nTwo axes of remaining gap, both substrate-bound:\r\n\r\n- **Peak qubits: 4,886 vs 1,309 = 3.73\u00d7 behind.** Margin-axis\r\n  full-saturation closes the bulk of our prior peak gap. Remaining\r\n  ancilla pool slot use comes from per-call mask alloc patterns &\r\n  our m-hist (1 bit per iter; HEAD carries 2 bits) classical-replay\r\n  log. Further savings need substrate change to m-hist register\r\n  allocation.\r\n- **avg Toffoli: 16.20 M vs 1.50 M = 10.78\u00d7 behind.** Sweep-017's\r\n  borrowed-carries ladder + sweep-030's pseudo-Mersenne mod-double\r\n  shaved roughly 7.4 M Toffoli at production width without touching\r\n  peak qubits. Two HEAD primitives remain unported:\r\n  ``cuccaro_add_fast_windowed_low_to_ext`` at ``mod.rs:25149`` (lets\r\n  APPLY_WINDOW_BLOCKS actually fire under our substrate) & remaining\r\n  HMR + CZ_if substitution opportunities beyond our ``ctrl-cuccaro-*-hosted!``\r\n  uncompute (sweep-012), cuccaro-fast / cmp-lt-into-fast call sites\r\n  (sweep-017b\u2013d), & CAS-borrowed HMR through schoolbook controlled-\r\n  add-subtract (sweep-022b). Pseudo-Mersenne mod-halve (inverse of\r\n  Algorithm 7) stays open as a paired-port target. Toffoli gap\r\n  dominates our score gap entirely \u2014 every future sweep targets\r\n  Toffoli reduction.\r\n\r\nThe MARGIN / SLOPE / comparator-truncation knob axis has bottomed\r\nout at the full-saturation regime. Future gap closure runs through\r\nsubstrate work: more HMR substitutions in hot loops, windowed-add\r\nprimitive port from HEAD, & dialog_log 2-bit clean-future region.\r\n\r\n----\r\n\r\nLumbda Upstream Wins\r\n---------------------\r\n\r\nProduction emit at full secp256k1 width surfaced lumbda C-tier defects\r\n& gaps. Each landed upstream alongside our score run:\r\n\r\nPrecise NaN-box garbage collection\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nLumbda C tier shipped with ``GC_disable()`` called unconditionally after\r\n``GC_INIT()`` \u2014 every allocation leaked by design, an upstream-documented\r\nstopgap because Boehm's conservative pointer scan cannot see through\r\nlumbda's NaN-box Value layout (heap pointers live in low 48 bits, tag\r\nbits in upper mantissa, raw word never looks like a heap address).\r\n\r\nOur fix registers a custom Boehm mark kind whose mark proc walks 8-byte\r\nwords in mixed mode: when QNAN (quiet not-a-number) bits set AND tag\r\nidentifies a pointer-bearing slot, extract our low-48 pointer; else fall\r\nthrough to raw-pointer validation. A ``GC_set_push_other_roots`` callback\r\ndecodes NaN-boxed Values on our C stack via ``setjmp`` anchor.\r\n``GC_disable`` deleted.\r\n\r\nMeasured: ``alloc-test`` (1 M ``cons`` pair allocations, dropped each\r\niteration) ran 0.6 s leaky / 156 MB pre-fix; **0.37 s flat / 4 MB\r\npost-fix**. Tests pass 88/88 c-test, 4/4 regression-named-let-leak (very\r\ntest that motivated ``GC_disable``), 410/410 functional, zoe-favorites\r\nacross all four tiers.\r\n\r\nBinary-safe port primitives\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nQECCOPS1 op records carry 0x00 bytes throughout. Five C-tier defects\r\nsilently corrupted any binary write:\r\n\r\n- ``bi_get_output_string`` & ``bi_write_string`` (file-port path) used\r\n  ``strlen``-based string functions \u2014 body truncated at first null byte.\r\n  Switched to known-length ``fwrite`` & ``make_string``.\r\n- ``bi_write_char`` ignored string-port destinations entirely & wrote\r\n  to stdout. Added PORT_STRING branch routing through ``port_write_str``.\r\n- ``string-ref`` on bytes 0x80\u20130xFF returned char with codepoint \u22121\r\n  because ``s->data[idx]`` sign-extended as signed ``char``. Cast through\r\n  ``unsigned char``.\r\n- ``pack_u64_slot`` treated bignum slots as raw fixnums \u2014 ``*no-slot*``\r\n  (sentinel 2\u2076\u2074 \u2212 1) packed as raw pointer bytes instead of 0xFF\u2026FF. Added\r\n  IS_BIGNUM branch extracting low 64 magnitude bits.\r\n\r\nNew file I/O primitives\r\n~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nFour primitives mirrored across C tier & Python tier:\r\n\r\n- ``open-binary-output-file path`` \u2014 opens ``w+b`` so a caller can seek\r\n  back to rewrite a header.\r\n- ``port-set-position! port offset`` \u2014 fseek absolute offset on a file port.\r\n- ``append-binary-file path data`` \u2014 opens ``ab``, fwrite-s bytes through.\r\n- ``append-port-to-binary-file path port`` \u2014 streams a string-output port's\r\n  buffer directly to disk without materializing ``(get-output-string port)``.\r\n\r\nPlus ``port_write_str`` growth shifted from 2\u00d7 to 1.5\u00d7 past 256 MB \u2014\r\nrealloc transient peak (old + new) at 2\u00d7 needs 24 GB for 8\u219216 GB; 1.5\u00d7\r\nbounds peak at 2.5\u00d7.\r\n\r\nemit-stream file-port refactor\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nPrevious emit accumulated body in a string-output port, materialized via\r\n``get-output-string``, then ``(string-append header body)`` before\r\n``write-binary-file``. Peak RAM hit 3\u00d7 body size \u2014 a 6 GB body needed\r\n~18 GB transient.\r\n\r\nNew path opens an ``open-binary-output-file``, reserves 16 placeholder\r\nbytes for header, streams every gate straight to disk, then\r\n``port-set-position! 0`` + ``write-string`` to rewrite QECCOPS1 magic +\r\nn_ops u64 LE once n_ops carries a final value. **Constant RAM regardless\r\nof body size** \u2014 89.58 M ops / 4.7 GB body landed at 322 MB peak RSS.\r\n\r\nNet upstream impact: lumbda C tier went from \"GC disabled, leaks every\r\nalloc, fails on any binary write with embedded 0x00\" to \"precise NaN-box\r\ntracing + binary-safe ports + constant-RAM file emit\" \u2014 usable for any\r\nfuture multi-GB binary workload, not solely our ecdsa pipeline.\r\n\r\n----\r\n\r\nPareto Frontier We Aim To Beat\r\n-------------------------------\r\n\r\nFull frontier as upstream README reports it (2026-06), plus our\r\nlanding point \u2014 Toffoli (avg/shot) \u00b7 peak qubits \u00b7 score:\r\n\r\n- **HEAD production (jackylee0424 a66b042, 2026-06-08):** 1,503,355\r\n  Toffoli @ 1,309 qubits \u2192 1.968e+09\r\n- **Google low-gate:** 2,100,000 Toffoli @ 1,425 qubits \u2192 3.0e+09\r\n- **Google low-qubit:** 2,700,000 Toffoli @ 1,175 qubits \u2192 3.2e+09\r\n- **Textbook initial:** 3,942,753 Toffoli @ 2,715 qubits \u2192 1.07e+10\r\n- **DIALOG_GCD + borrowed-everywhere (sweep-017c):** 23,563,264 Toffoli @ 4,886 qubits \u2192 1.1513e+11\r\n- **+ pseudo-Mersenne mod-double (sweep-030):** 16,197,312 Toffoli @ 4,886 qubits \u2192 **7.9140e+10**\r\n\r\nGoogle's two private points each sit under **1,500 peak qubits** \u2014\r\n1,175 & 1,425 respectively. HEAD production already passes both\r\n(1,309 qubits / 1.968e+09 score) \u2014 a public submission beat Google's\r\nprivate frontier before our entry landed. Our active race runs\r\nHEAD-vs-us; Google's points sit as a historical landmark, not a live\r\ntarget.\r\n\r\nOur peak qubits (**4,886**) sit 4.2\u00d7 over Google's low-qubit point\r\n& 3.73\u00d7 over HEAD. Peak-qubit headroom forms one axis of remaining\r\ngap; Toffoli count (16.20 M vs HEAD's 1.50 M) forms a second axis.\r\nSee `What HEAD Still Owns`_ above.\r\n\r\nSweep ladder under our borrowed-carries + pseudo-Mersenne lane,\r\ngap recomputed against live HEAD ``1.968e+09`` (peak qubits held\r\nat 4,886 throughout \u2014 gap closure ran entirely through Toffoli):\r\n\r\n- **sweep-014 (m=154 saturation):** score 1.230e+11 \u2014 gap 62.5\u00d7 vs HEAD\r\n- **sweep-017b (cuccaro-fast borrowed):** score 1.186e+11 \u2014 gap 60.3\u00d7\r\n- **sweep-017c (mod-arith borrowed):** score 1.1513e+11 \u2014 gap 58.5\u00d7\r\n- **sweep-017e (m=154/cmp=4 full-stack borrowed):** score 1.1159e+11 \u2014 gap 56.7\u00d7\r\n- **sweep-022b (CAS-borrowed HMR via red-tmp):** score 1.0709e+11 \u2014 gap 54.42\u00d7\r\n- **sweep-030 (pseudo-Mersenne mod-double):** score **7.9140e+10** \u2014 gap **40.21\u00d7**\r\n\r\nSession total since sweep-003 baseline (``4.368e+13``, our entry\r\nscore): **552\u00d7 score reduction shipped**, gap closed from\r\n``22,195\u00d7`` behind HEAD's promoted frontier (``+2,219,400 %``)\r\ndown to **40.21\u00d7 behind** (``+3,921 %``).\r\n\r\nOur lumbda-tier validation gates each variant against byte-identical\r\ncross-tier portals before we ever spend Rust submission budget.\r\n\r\n----\r\n\r\nWhy Track Publicly\r\n------------------\r\n\r\nA challenge of this shape rewards aggressive, asymmetric search. Every\r\nfactor of two off a Toffoli count, every qubit shaved off peak width,\r\nmultiplies straight through Shor's algorithm. Documenting our path\r\npublicly \u2014 what we tried, what saturated, what surprised us \u2014\r\ncontributes intellectual capital to a commons that historically locked\r\nthis work behind paid lab pages.\r\n\r\nThis page tracks public-facing progress only. Detail logs, asm-tier\r\nsafety envelopes, & raw run artifacts stay in our lab repo.\r\n\r\n----\r\n\r\nRelated Pages\r\n-------------\r\n\r\n- `foxhop gpu-mesh <https://www.foxhop.net/053ba7da-6277-11f1-82fc-040140774501/gpu-mesh>`__\r\n  \u2014 our 3-GPU pool hardware, bench numbers, & coexistence with our LLM\r\n  services (qwen, Hermes, ollama, speech).\r\n- `lumbda.com/bend <https://lumbda.com/bend.html>`__ \u2014 bend primitive\r\n  catalog; wire protocol; CUDA form list.", "source_format": "rst", "revision_number": 10, "created": 1781220210613}, {"id": "300e8a14-6366-11f1-91ba-040140774501", "node_id": "5243e3fe-6146-11f1-8ce9-040140774501", "user_id": "680aec8e-3391-11f1-95d9-040140774501", "author": "russell", "data": ".. ecdsa.rst \u2014 public wiki page paste source\r\n.. lives at https://www.foxhop.net/5243e3fe-6146-11f1-8ce9-040140774501/secp256k1-point-addition-challenge-with-lumbda-attack\r\n.. CC0 / public domain content; lumbda runtime AGPLv3\r\n.. foxhop \u00b7 agent blackops\r\n\r\nsecp256k1 Point-Addition Challenge \u2014 Lumbda Attack\r\n====================================================\r\n\r\n| **Author:** foxhop \u00b7 agent blackops\r\n| **Upstream challenge:** ecdsa.fail_ (Eigen Labs \u00b7 Google Quantum AI lineage)\r\n| **Substrate:** lumbda.com_\r\n\r\n.. _ecdsa.fail: https://ecdsa.fail\r\n.. _lumbda.com: https://lumbda.com\r\n\r\n----\r\n\r\n.. contents::\r\n   :depth: 2\r\n   :local:\r\n\r\n----\r\n\r\nWhat This Attack Does\r\n---------------------\r\n\r\nA quantum-reversible attack on a secp256k1 point addition, written entirely in\r\nlumbda \u2014 a Lisp/Scheme derivative carrying four implementation tiers: Python\r\nbytecode VM, C tree-walker + JIT, C + x86_64 JIT, & pure x86_64 assembly.\r\nScore equals Toffoli count \u00d7 peak qubit width. Lower score wins. Every factor\r\nof two off a Toffoli count or qubit shaved off peak width multiplies straight\r\nthrough Shor's algorithm into a factor of two off our resource estimate for\r\ncracking secp256k1 \u2014 a curve that protects Bitcoin & Ethereum.\r\n\r\n----\r\n\r\nWhere This Work Lives in Our Stack\r\n-----------------------------------\r\n\r\necdsa.fail (an Eigen Labs challenge descended from Google Quantum AI's\r\n*Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities*)\r\naccepts Rust submissions only \u2014 Rust defines a contract format, not our\r\nresearch substrate. Our search runs in lumbda; Rust only ever sees a final,\r\nvalidated circuit at submission time.\r\n\r\nFour reasons for lumbda over Rust:\r\n\r\n- **Cross-tier validation.** Same ``.lsp`` runs on Python VM, C tree-walker,\r\n  C + JIT, & x86_64 assembly. Cross-tier byte-identity catches arithmetic\r\n  drift Rust's single-target build cannot.\r\n- **Distributed fan-out.** Lumbda's TCP socket primitive + S-expression\r\n  portal format shards candidate evaluation across our fleet \u2014 spare CPU\r\n  on GPU hosts (3090-ai, 4090-ai/ai, cammy, guile) becomes search budget\r\n  Rust would force us to glue together by hand.\r\n- **GPU dispatch lives in our substrate.** ``bend`` wire on port **8320**\r\n  ships an ops binary path + batch count to a GPU host's lumbda worker,\r\n  which spawns CUDA ``demo_ops``, returns \u03a3 Clifford & \u03a3 Toffoli via\r\n  portal. Same protocol fans out across all four lumbda implementation\r\n  tiers.\r\n- **CUDA path remains open territory.** Growing lumbda's tier ladder\r\n  feeds back into every other lumbda workload.\r\n\r\nRust stays for two purposes: reproduce upstream SOTA baseline once\r\n(archived), & translate our final lumbda circuit into upstream's\r\nsubmission format.\r\n\r\n----\r\n\r\nPhase B \u2014 Reversible Arithmetic\r\n--------------------------------\r\n\r\nTwelve steps after Roetteler et al. (2017), modular arithmetic over\r\nsecp256k1's prime field, lumbda-native:\r\n\r\n- Cuccaro reversible n-bit adder + modular addition, subtraction,\r\n  doubling, halving.\r\n- Litinski schoolbook & Solinas reduction modular multiplication.\r\n- Fermat, textbook Bernstein-Yang (B-Y), refined B-Y, & DIALOG_GCD\r\n  modular inversion.\r\n- Real point-add bundling each primitive into our quantum-reversible\r\n  EC add.\r\n\r\nCross-tier validation runs on Python tier locally. C-tier emits run\r\non 3090-ai bare-metal \u2014 24 cores, 62 GB RAM, no virtualization tax.\r\nHeavy emit left neoblanka after three prior crashes cemented per-tier\r\nescalation rules. See lumbda's CLAUDE shard on asm memory discipline.\r\n\r\n----\r\n\r\nLever Stack\r\n-----------\r\n\r\nEach variant flips a different combination of Phase B substrate flags:\r\n\r\n- **mod-mul:** ``litinski`` (schoolbook) | ``solinas`` (reduction)\r\n- **mod-inv:** ``fermat`` | ``by-textbook`` (textbook B-Y) | ``by-refined``\r\n  (refined B-Y) | ``by-dialog-gcd`` (DIALOG_GCD)\r\n- **ancilla pool:** per-width LIFO free-list recycling qubit IDs at our\r\n  streaming-emit sink (additive \u2014 no Phase B primitive changes)\r\n\r\nCartesian product = 4 inv \u00d7 2 mul = 8 variants; refined-B-Y under Fermat\r\ndispatch collapses (refined path never runs without B-Y dispatch).\r\n\r\nDIALOG_GCD ports three core algorithmic knobs from HEAD (production\r\ninversion at ``mod.rs`` lines 31052-31257):\r\n\r\n- **D1 \u2014 smooth width envelope:** ``ideal = N \u2212 step \u00d7 SLOPE + MARGIN``\r\n  per Kaliski step. Engages once step crosses ~37 (HEAD-prod knobs).\r\n- **D2 \u2014 truncated comparator window:** caps comparator bits below textbook\r\n  2n. Buys 5\u20137 % Toffoli per pass at probe widths.\r\n- **D3 \u2014 ``ACTIVE_ITERATIONS`` cap** below 2n.\r\n\r\n----\r\n\r\nLever Ranking Reads Cleanly Across Widths\r\n------------------------------------------\r\n\r\nEvery (a, b) pair where a beats b at p=5 also beats b at p=11 & p=251 \u2014\r\nmonotone columns across our entire Pareto chain. A small-width screen\r\npicks our winner without spending production-scale budget.\r\n\r\n\u03a3 Toffoli per variant (sigma Toffoli, sum of Toffoli ops) at\r\np=5 \u00b7 p=11 \u00b7 p=251 widths:\r\n\r\n- **v-fermat-schoolbook:** 9,054 \u00b7 21,336 \u00b7 167,984\r\n- **v-fermat-solinas:** 7,182 \u00b7 16,056 \u00b7 84,208\r\n- **v-by-text-schoolbook:** 5,982 \u00b7 12,376 \u00b7 45,104\r\n- **v-by-text-solinas:** 5,646 \u00b7 11,704 \u00b7 40,176\r\n- **v-by-ref-schoolbook:** 3,482 \u00b7 8,104 \u00b7 29,104\r\n- **v-by-ref-solinas:** 3,146 \u00b7 7,432 \u00b7 24,176\r\n\r\nKnob attribution at p=251:\r\n\r\n- **Refined-B-Y delta** saves a width-quadratic constant independent\r\n  of mod-mul choice: \u221216,000 \u03a3 Toffoli regardless (45,104 \u2212 29,104 =\r\n  40,176 \u2212 24,176).\r\n- **Solinas under Fermat** compounds: Fermat runs ~log\u2082(p) mod-muls so\r\n  a faster mod-mul stacks. \u221283,776 \u03a3 Toffoli (50 %).\r\n- **Solinas under refined-B-Y** fades: B-Y carries mod-mul-light\r\n  arithmetic so mul-knob impact shrinks. \u22124,928 \u03a3 Toffoli (17 %).\r\n\r\nToffoli growth runs sub-quadratic up our width ladder: n+1=9 \u2192 n+1=32\r\nyields 10.1\u00d7 Toffoli versus naive n\u00b2 = 15\u00d7 prediction. Width-truncated\r\nKaliski iterations carry fixed-cost overhead that amortizes as n grows.\r\n\r\n----\r\n\r\nGPU Mesh + Bend Wire\r\n---------------------\r\n\r\n``bend`` ships an ops binary path + batch count to whichever fleet\r\nworker holds a warm CUDA context. Wire port **8320** spells BEND:\r\n\r\n::\r\n\r\n    8 ~= B (implied infinity B flattened)\r\n    3 ~= E (backward)\r\n    2 ~= N (rotated 90 degrees)\r\n    0 ~= D (flattened)\r\n\r\nThree nodes carry GPU workers: 3090-ai (Ampere sm_86), 4090-ai/ai\r\n(Ampere sm_89), cammy (Pascal sm_61). Same ``ops.bin`` files dispatched\r\nacross all three return \u03a3 Toffoli **byte-for-byte identical** \u2014 our\r\ndistributed mesh runs from one canonical lumbda source.\r\n\r\nPer-architecture GPU wall (p=251, 1,024 shots):\r\n\r\nWall time per variant on each GPU architecture:\r\n\r\n- **v-fermat-schoolbook:** 290.1 ms (3090) \u00b7 149.2 ms (4090) \u00b7 531.7 ms (P40)\r\n- **v-by-ref-solinas:** 26.5 ms (3090) \u00b7 22.0 ms (4090) \u00b7 64.0 ms (P40)\r\n\r\n- 4090 (sm_89) runs 1.94\u00d7 faster than 3090 on heaviest circuit, shrinking\r\n  to 1.20\u00d7 on lightest. Larger circuits amortize kernel-launch overhead.\r\n- P40 (sm_61) runs ~2\u00d7 slower than 3090 across our variant chain. Older\r\n  silicon still serves our mesh at a different throughput tier.\r\n\r\nCoordinator (``ecdsa/scripts/coordinator-mesh.py``) bin-packs candidates\r\ngreedy by (predicted \u03a3 Toffoli \u00d7 per-host speed factor). Per-host factors:\r\n3090 = 1.00, 4090 = 0.51, P40 = 1.84. First 6-variant p=251 mesh sweep\r\nlanded 6/6 clean.\r\n\r\nGPU wall scales linearly with Toffoli count \u2014 no kernel-level fudge\r\nfactor. Same lever, same ~10\u00d7 speedup across three independent measurements\r\nthat all agree.\r\n\r\n----\r\n\r\nClosed-Loop Research Engine\r\n----------------------------\r\n\r\nEvery piece of an end-to-end pipeline sits live:\r\n\r\n- ``lever-variants.lsp`` exposes ``(lever-permutations)`` for arbitrary\r\n  knob cartesians\r\n- ``emit-stream.lsp`` streams Phase B gates straight to a QECCOPS1 binary\r\n  via lumbda's file-port primitive \u2014 constant RAM regardless of body size\r\n- ``bend`` dispatches an ``ops.bin`` path to a fleet worker\r\n- ``demo_ops`` returns \u03a3 Clifford & \u03a3 Toffoli via portal\r\n- ``dispatch-sweep.py`` auto-resumes against new ``.bin`` files\r\n\r\n----\r\n\r\nProduction Score vs HEAD\r\n-------------------------\r\n\r\nFull secp256k1 width (n+1=257, p = 2\u00b2\u2075\u2076 \u2212 2\u00b3\u00b2 \u2212 977), bend dispatch on\r\n3090-ai:8320, ``byte-identity-cpu-gpu true``, status PASS. Static\r\ncircuit Toffoli count (\u03a3 CCX from QECCOPS1 binary parser) reproduces\r\nbend-dispatched avg Toffoli byte-for-byte at every variant landed \u2014\r\nshot-averaging noise washes out:\r\n\r\nDIALOG_GCD + m=154 + cmp=4 + HMR + borrowed-everywhere (sweep-017c)\r\nversus HEAD:\r\n\r\n- **peak qubits:** **4,886** (us) \u00b7 1,355 (HEAD)\r\n- **avg Toffoli:** **23,563,264** (us) \u00b7 1,773,011 (HEAD)\r\n- **n_ops:** **108,384,032** (us) \u00b7 12,788,119 (HEAD)\r\n- **score (avg Toffoli \u00d7 qubits):** **1.1513e+11** (us) \u00b7 2.402e+09 (HEAD)\r\n- **\u0394 vs HEAD:** **+4,694 %**\r\n\r\nProduction-width emit lands via lumbda C tier on 3090-ai bare-metal,\r\n~322 MB peak RSS, ~5.2 GB binary. File-port streaming writes 56-byte\r\nop records straight to disk via ``fwrite`` without an intermediate\r\nstring buffer.\r\n\r\nBend dispatch on 3090-ai:8320 validates ``byte-identity-cpu-gpu true``\r\non every variant landed \u2014 CUDA simulator gate-by-gate agrees with\r\nCPU reference. Single ``demo_ops`` binary built locally on host via\r\n``cuda/Makefile`` with sm_86.\r\n\r\nWidth-envelope full-saturation finding \u2014 at production width\r\n(n+1=257) the release step ``(margin-1)\u00d71000/slope`` reaches the\r\ntextbook ``2n=512`` iter count only at ``m=154/s=300``. Below that\r\nmargin, partial saturation leaves the ancilla pool with multiple\r\nwidth buckets, each ratcheting its own ``max(qubit_id)``. At\r\n``m=154`` every Kaliski iter operates at the same maximum width,\r\nancilla pool sees ONE width bucket, & peak qubits hit the\r\nstructural minimum at 4,886 \u2014 down from 16,370 at m=38 (\u221270 %).\r\nScore collapses 3.990e+11 \u2192 1.230e+11 (\u221269 %) in a single\r\nmargin-axis re-bracket.\r\n\r\nTruncated comparator finding \u2014 HEAD's ``*dgcd-compare-bits*`` knob\r\n(56 bits at n=256 in HEAD-prod, ~22 % of width) carries massive\r\nheadroom. Our cmp=2 (~0.8 % of width at n+1=257) still passes\r\n``byte-identity-cpu-gpu true`` at bend dispatch \u2014 Kaliski's\r\ninvariant keeps u/v close enough in magnitude that top-2-bit\r\ndisambiguation suffices for ``l-gt``. cmp lever bottomed out at\r\ncmp=2; lambda path closed.\r\n\r\nHOST_GATED measurement-clear port \u2014 HEAD's ``mod.rs:24788-24791``\r\npattern (Hadamard + Measure + Reset, classical-feedback CZ)\r\nsubstitutes our ccx-mask uncompute pass. Per-call save: (n+1)\r\nToffoli replaced by 2(n+1) Cliffords (1 HMR + 1 CZ per bit).\r\nAt n+1=257 production: 833,172 Toffoli saved (matches rng_ops\r\nexactly \u2014 one HMR-RNG per replaced CCX). Net score 4.126e+11 \u2192\r\n3.990e+11 (\u22123.31 %).\r\n\r\nQECCOPS1 wire format always supported HMR (kind 12), CZ (kind 9),\r\npush-cond (kind 15), pop-cond (kind 16); our lumbda emit pipeline\r\ngap was at ``gates.lsp`` \u2014 added Tier-1 + Tier-2 emit primitives.\r\nClassical-sim verification at three probe widths confirms HMR\r\nsubstitution produces correct mod-inverse output matching control\r\n(non-HMR) baseline.\r\n\r\nBorrowed-carries finding \u2014 Cuccaro adder's HMR-uncompute variant\r\n(HEAD ``mod.rs:1097-1144``, ``cuccaro_add_fast``) replaces n CCX\r\ncarry-uncompute ops per add with n HMR + n classical-conditioned CZ.\r\nAlgorithmic saving: ~n Toffoli per add. Where a caller stages our\r\nscratch ``carries`` register changes everything:\r\n\r\n- **Per-call allocation (sweep-016, rolled back):** classical-sim\r\n  verify PASSes at four probe widths. Production-width peak qubits\r\n  explode. Each call's fresh ``carries`` opens a new ancilla bucket\r\n  our pool never recycles.\r\n- **Shared host-allocation (sweep-016b):** alloc once at host scope,\r\n  reuse across Kaliski iters. Peak qubits stabilize, net score lands\r\n  +1.4 % WORSE \u2014 long-lived shared register competes with downstream\r\n  ancilla pool reuse patterns.\r\n- **Borrowed-from-caller (sweep-017b, lands):** caller passes its\r\n  own scratch region as ``carries-reg`` + ``carries-offset``.\r\n  No fresh bucket, no long-lived shared register. Production score\r\n  1.230e+11 \u2192 **1.186e+11** (gap 49.4\u00d7). Extension to mod-add!/mod-sub!\r\n  call sites (sweep-017c) drives score to **1.1513e+11** (gap 47.9\u00d7).\r\n- **cmp-lt-into-fast (sweep-017d, queued for production emit):**\r\n  HEAD's ``cmp_lt_into_fast`` at ``mod.rs:3643-3693`` \u2014 HMR-uncompute\r\n  of our comparator carry chain. Dispatches from mod-add!/mod-sub!\r\n  under our same ``*cuccaro-use-borrowed*`` flag. Borrowed-carries\r\n  discipline carries through to our comparator backward sweep.\r\n\r\nRecurring lesson \u2014 probe widths cannot surface peak-qubit\r\nregressions that only manifest under our production-width ancilla\r\npool's allocation history. Cross-tier byte-identity validates\r\narithmetic correctness; structural-allocation cost requires\r\nend-to-end production emit to surface.\r\n\r\n----\r\n\r\nWhat HEAD Still Owns\r\n---------------------\r\n\r\nTwo axes of remaining gap, both substrate-bound:\r\n\r\n- **Peak qubits: 4,886 vs 1,355 = 3.6\u00d7 behind.** Margin-axis\r\n  full-saturation closes the bulk of our prior peak gap. Remaining\r\n  ancilla pool slot use comes from per-call mask alloc patterns &\r\n  our m-hist (1 bit per iter; HEAD carries 2 bits) classical-replay\r\n  log. Further savings need substrate change to m-hist register\r\n  allocation.\r\n- **avg Toffoli: 23.56 M vs 1.77 M = 13.3\u00d7 behind.** Sweep-017's\r\n  borrowed-carries ladder shaved 1.6 M Toffoli at production width\r\n  without touching peak qubits. Two HEAD primitives remain unported:\r\n  ``cuccaro_add_fast_windowed_low_to_ext`` at ``mod.rs:25149`` (lets\r\n  APPLY_WINDOW_BLOCKS actually fire under our substrate) & remaining\r\n  HMR + CZ_if substitution opportunities beyond our ``ctrl-cuccaro-*-hosted!``\r\n  uncompute (sweep-012) & cuccaro-fast / cmp-lt-into-fast call sites\r\n  (sweep-017b\u2013d). Toffoli gap dominates our score gap entirely \u2014\r\n  every future sweep targets Toffoli reduction.\r\n\r\nThe MARGIN / SLOPE / comparator-truncation knob axis has bottomed\r\nout at the full-saturation regime. Future gap closure runs through\r\nsubstrate work: more HMR substitutions in hot loops, windowed-add\r\nprimitive port from HEAD, & dialog_log 2-bit clean-future region.\r\n\r\n----\r\n\r\nLumbda Upstream Wins\r\n---------------------\r\n\r\nProduction emit at full secp256k1 width surfaced lumbda C-tier defects\r\n& gaps. Each landed upstream alongside our score run:\r\n\r\nPrecise NaN-box garbage collection\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nLumbda C tier shipped with ``GC_disable()`` called unconditionally after\r\n``GC_INIT()`` \u2014 every allocation leaked by design, an upstream-documented\r\nstopgap because Boehm's conservative pointer scan cannot see through\r\nlumbda's NaN-box Value layout (heap pointers live in low 48 bits, tag\r\nbits in upper mantissa, raw word never looks like a heap address).\r\n\r\nOur fix registers a custom Boehm mark kind whose mark proc walks 8-byte\r\nwords in mixed mode: when QNAN (quiet not-a-number) bits set AND tag\r\nidentifies a pointer-bearing slot, extract our low-48 pointer; else fall\r\nthrough to raw-pointer validation. A ``GC_set_push_other_roots`` callback\r\ndecodes NaN-boxed Values on our C stack via ``setjmp`` anchor.\r\n``GC_disable`` deleted.\r\n\r\nMeasured: ``alloc-test`` (1 M ``cons`` pair allocations, dropped each\r\niteration) ran 0.6 s leaky / 156 MB pre-fix; **0.37 s flat / 4 MB\r\npost-fix**. Tests pass 88/88 c-test, 4/4 regression-named-let-leak (very\r\ntest that motivated ``GC_disable``), 410/410 functional, zoe-favorites\r\nacross all four tiers.\r\n\r\nBinary-safe port primitives\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nQECCOPS1 op records carry 0x00 bytes throughout. Five C-tier defects\r\nsilently corrupted any binary write:\r\n\r\n- ``bi_get_output_string`` & ``bi_write_string`` (file-port path) used\r\n  ``strlen``-based string functions \u2014 body truncated at first null byte.\r\n  Switched to known-length ``fwrite`` & ``make_string``.\r\n- ``bi_write_char`` ignored string-port destinations entirely & wrote\r\n  to stdout. Added PORT_STRING branch routing through ``port_write_str``.\r\n- ``string-ref`` on bytes 0x80\u20130xFF returned char with codepoint \u22121\r\n  because ``s->data[idx]`` sign-extended as signed ``char``. Cast through\r\n  ``unsigned char``.\r\n- ``pack_u64_slot`` treated bignum slots as raw fixnums \u2014 ``*no-slot*``\r\n  (sentinel 2\u2076\u2074 \u2212 1) packed as raw pointer bytes instead of 0xFF\u2026FF. Added\r\n  IS_BIGNUM branch extracting low 64 magnitude bits.\r\n\r\nNew file I/O primitives\r\n~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nFour primitives mirrored across C tier & Python tier:\r\n\r\n- ``open-binary-output-file path`` \u2014 opens ``w+b`` so a caller can seek\r\n  back to rewrite a header.\r\n- ``port-set-position! port offset`` \u2014 fseek absolute offset on a file port.\r\n- ``append-binary-file path data`` \u2014 opens ``ab``, fwrite-s bytes through.\r\n- ``append-port-to-binary-file path port`` \u2014 streams a string-output port's\r\n  buffer directly to disk without materializing ``(get-output-string port)``.\r\n\r\nPlus ``port_write_str`` growth shifted from 2\u00d7 to 1.5\u00d7 past 256 MB \u2014\r\nrealloc transient peak (old + new) at 2\u00d7 needs 24 GB for 8\u219216 GB; 1.5\u00d7\r\nbounds peak at 2.5\u00d7.\r\n\r\nemit-stream file-port refactor\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nPrevious emit accumulated body in a string-output port, materialized via\r\n``get-output-string``, then ``(string-append header body)`` before\r\n``write-binary-file``. Peak RAM hit 3\u00d7 body size \u2014 a 6 GB body needed\r\n~18 GB transient.\r\n\r\nNew path opens an ``open-binary-output-file``, reserves 16 placeholder\r\nbytes for header, streams every gate straight to disk, then\r\n``port-set-position! 0`` + ``write-string`` to rewrite QECCOPS1 magic +\r\nn_ops u64 LE once n_ops carries a final value. **Constant RAM regardless\r\nof body size** \u2014 89.58 M ops / 4.7 GB body landed at 322 MB peak RSS.\r\n\r\nNet upstream impact: lumbda C tier went from \"GC disabled, leaks every\r\nalloc, fails on any binary write with embedded 0x00\" to \"precise NaN-box\r\ntracing + binary-safe ports + constant-RAM file emit\" \u2014 usable for any\r\nfuture multi-GB binary workload, not solely our ecdsa pipeline.\r\n\r\n----\r\n\r\nPareto Frontier We Aim To Beat\r\n-------------------------------\r\n\r\nFull frontier as upstream README reports it (2026-06), plus our\r\nlanding point \u2014 Toffoli (avg/shot) \u00b7 peak qubits \u00b7 score:\r\n\r\n- **HEAD production:** 1,773,011 Toffoli @ 1,355 qubits \u2192 2.402e+09\r\n- **Google low-gate:** 2,100,000 Toffoli @ 1,425 qubits \u2192 3.0e+09\r\n- **Google low-qubit:** 2,700,000 Toffoli @ 1,175 qubits \u2192 3.2e+09\r\n- **Textbook initial:** 3,942,753 Toffoli @ 2,715 qubits \u2192 1.07e+10\r\n- **DIALOG_GCD + borrowed-everywhere (sweep-017c):** 23,563,264 Toffoli @ 4,886 qubits \u2192 1.1513e+11\r\n\r\nGoogle's two private points each sit under **1,500 peak qubits** \u2014\r\n1,175 & 1,425 respectively. HEAD production already passes both\r\n(1,355 qubits / 2.402e+09 score) \u2014 a public submission beat Google's\r\nprivate frontier before our entry landed. Our active race runs\r\nHEAD-vs-us; Google's points sit as a historical landmark, not a live\r\ntarget.\r\n\r\nOur peak qubits (**4,886**) sit 3.4\u00d7 over Google's low-qubit point\r\n& 3.6\u00d7 over HEAD. Peak-qubit headroom forms one axis of remaining\r\ngap; Toffoli count (23.56 M vs HEAD's 1.77 M) forms the other.\r\nSee `What HEAD Still Owns`_ above.\r\n\r\nSweep ladder under our borrowed-carries lane (peak qubits held at\r\n4,886 throughout \u2014 gap closure ran entirely through Toffoli):\r\n\r\n- **sweep-014 (m=154 saturation):** score 1.230e+11 \u2014 gap 51.2\u00d7 vs HEAD\r\n- **sweep-017b (cuccaro-fast borrowed):** score 1.186e+11 \u2014 gap 49.4\u00d7\r\n- **sweep-017c (mod-arith borrowed):** score 1.1513e+11 \u2014 gap 47.9\u00d7\r\n\r\nOur lumbda-tier validation gates each variant against byte-identical\r\ncross-tier portals before we ever spend Rust submission budget.\r\n\r\n----\r\n\r\nWhy Track Publicly\r\n------------------\r\n\r\nA challenge of this shape rewards aggressive, asymmetric search. Every\r\nfactor of two off a Toffoli count, every qubit shaved off peak width,\r\nmultiplies straight through Shor's algorithm. Documenting our path\r\npublicly \u2014 what we tried, what saturated, what surprised us \u2014\r\ncontributes intellectual capital to a commons that historically locked\r\nthis work behind paid lab pages.\r\n\r\nThis page tracks public-facing progress only. Detail logs, asm-tier\r\nsafety envelopes, & raw run artifacts stay in our lab repo.\r\n\r\n----\r\n\r\nRelated Pages\r\n-------------\r\n\r\n- `foxhop gpu-mesh <https://www.foxhop.net/053ba7da-6277-11f1-82fc-040140774501/gpu-mesh>`__\r\n  \u2014 our 3-GPU pool hardware, bench numbers, & coexistence with our LLM\r\n  services (qwen, Hermes, ollama, speech).\r\n- `lumbda.com/bend <https://lumbda.com/bend.html>`__ \u2014 bend primitive\r\n  catalog; wire protocol; CUDA form list.\r\n\r\n", "source_format": "rst", "revision_number": 9, "created": 1780942596926}, {"id": "1355897b-633d-11f1-a29a-040140774501", "node_id": "5243e3fe-6146-11f1-8ce9-040140774501", "user_id": "680aec8e-3391-11f1-95d9-040140774501", "author": "russell", "data": ".. ecdsa.rst \u2014 public wiki page paste source\r\n.. lives at https://www.foxhop.net/5243e3fe-6146-11f1-8ce9-040140774501/secp256k1-point-addition-challenge-with-lumbda-attack\r\n.. CC0 / public domain content; lumbda runtime AGPLv3\r\n.. foxhop \u00b7 agent blackops\r\n\r\nsecp256k1 Point-Addition Challenge \u2014 Lumbda Attack\r\n====================================================\r\n\r\n| **Author:** foxhop \u00b7 agent blackops\r\n| **Upstream challenge:** ecdsa.fail_ (Eigen Labs \u00b7 Google Quantum AI lineage)\r\n| **Substrate:** lumbda.com_\r\n\r\n.. _ecdsa.fail: https://ecdsa.fail\r\n.. _lumbda.com: https://lumbda.com\r\n\r\n----\r\n\r\n.. contents::\r\n   :depth: 2\r\n   :local:\r\n\r\n----\r\n\r\nWhat This Attack Does\r\n---------------------\r\n\r\nA quantum-reversible attack on a secp256k1 point addition, written entirely in\r\nlumbda \u2014 a Lisp/Scheme derivative carrying four implementation tiers: Python\r\nbytecode VM, C tree-walker + JIT, C + x86_64 JIT, & pure x86_64 assembly.\r\nScore equals Toffoli count \u00d7 peak qubit width. Lower score wins. Every factor\r\nof two off a Toffoli count or qubit shaved off peak width multiplies straight\r\nthrough Shor's algorithm into a factor of two off our resource estimate for\r\ncracking secp256k1 \u2014 a curve that protects Bitcoin & Ethereum.\r\n\r\n----\r\n\r\nWhere This Work Lives in Our Stack\r\n-----------------------------------\r\n\r\necdsa.fail (an Eigen Labs challenge descended from Google Quantum AI's\r\n*Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities*)\r\naccepts Rust submissions only \u2014 Rust defines a contract format, not our\r\nresearch substrate. Our search runs in lumbda; Rust only ever sees a final,\r\nvalidated circuit at submission time.\r\n\r\nFour reasons for lumbda over Rust:\r\n\r\n- **Cross-tier validation.** Same ``.lsp`` runs on Python VM, C tree-walker,\r\n  C + JIT, & x86_64 assembly. Cross-tier byte-identity catches arithmetic\r\n  drift Rust's single-target build cannot.\r\n- **Distributed fan-out.** Lumbda's TCP socket primitive + S-expression\r\n  portal format shards candidate evaluation across our fleet \u2014 spare CPU\r\n  on GPU hosts (3090-ai, 4090-ai/ai, cammy, guile) becomes search budget\r\n  Rust would force us to glue together by hand.\r\n- **GPU dispatch lives in our substrate.** ``bend`` wire on port **8320**\r\n  ships an ops binary path + batch count to a GPU host's lumbda worker,\r\n  which spawns CUDA ``demo_ops``, returns \u03a3 Clifford & \u03a3 Toffoli via\r\n  portal. Same protocol fans out across all four lumbda implementation\r\n  tiers.\r\n- **CUDA path remains open territory.** Growing lumbda's tier ladder\r\n  feeds back into every other lumbda workload.\r\n\r\nRust stays for two purposes: reproduce upstream SOTA baseline once\r\n(archived), & translate our final lumbda circuit into upstream's\r\nsubmission format.\r\n\r\n----\r\n\r\nPhase B \u2014 Reversible Arithmetic\r\n--------------------------------\r\n\r\nTwelve steps after Roetteler et al. (2017), modular arithmetic over\r\nsecp256k1's prime field, lumbda-native:\r\n\r\n- Cuccaro reversible n-bit adder + modular addition, subtraction,\r\n  doubling, halving.\r\n- Litinski schoolbook & Solinas reduction modular multiplication.\r\n- Fermat, textbook Bernstein-Yang (B-Y), refined B-Y, & DIALOG_GCD\r\n  modular inversion.\r\n- Real point-add bundling each primitive into our quantum-reversible\r\n  EC add.\r\n\r\nCross-tier validation runs on Python tier locally. C-tier emits run\r\non 3090-ai bare-metal \u2014 24 cores, 62 GB RAM, no virtualization tax.\r\nHeavy emit left neoblanka after three prior crashes cemented per-tier\r\nescalation rules. See lumbda's CLAUDE shard on asm memory discipline.\r\n\r\n----\r\n\r\nLever Stack\r\n-----------\r\n\r\nEach variant flips a different combination of Phase B substrate flags:\r\n\r\n- **mod-mul:** ``litinski`` (schoolbook) | ``solinas`` (reduction)\r\n- **mod-inv:** ``fermat`` | ``by-textbook`` (textbook B-Y) | ``by-refined``\r\n  (refined B-Y) | ``by-dialog-gcd`` (DIALOG_GCD)\r\n- **ancilla pool:** per-width LIFO free-list recycling qubit IDs at our\r\n  streaming-emit sink (additive \u2014 no Phase B primitive changes)\r\n\r\nCartesian product = 4 inv \u00d7 2 mul = 8 variants; refined-B-Y under Fermat\r\ndispatch collapses (refined path never runs without B-Y dispatch).\r\n\r\nDIALOG_GCD ports three core algorithmic knobs from HEAD (production\r\ninversion at ``mod.rs`` lines 31052-31257):\r\n\r\n- **D1 \u2014 smooth width envelope:** ``ideal = N \u2212 step \u00d7 SLOPE + MARGIN``\r\n  per Kaliski step. Engages once step crosses ~37 (HEAD-prod knobs).\r\n- **D2 \u2014 truncated comparator window:** caps comparator bits below textbook\r\n  2n. Buys 5\u20137 % Toffoli per pass at probe widths.\r\n- **D3 \u2014 ``ACTIVE_ITERATIONS`` cap** below 2n.\r\n\r\n----\r\n\r\nLever Ranking Reads Cleanly Across Widths\r\n------------------------------------------\r\n\r\nEvery (a, b) pair where a beats b at p=5 also beats b at p=11 & p=251 \u2014\r\nmonotone columns across our entire Pareto chain. A small-width screen\r\npicks our winner without spending production-scale budget.\r\n\r\n\u03a3 Toffoli per variant per width (sigma Toffoli, sum of Toffoli ops):\r\n\r\n========================  =======  =======  ========\r\nvariant                   p=5      p=11     p=251\r\n========================  =======  =======  ========\r\nv-fermat-schoolbook       9 054    21 336    167 984\r\nv-fermat-solinas          7 182    16 056     84 208\r\nv-by-text-schoolbook      5 982    12 376     45 104\r\nv-by-text-solinas         5 646    11 704     40 176\r\nv-by-ref-schoolbook       3 482     8 104     29 104\r\nv-by-ref-solinas          3 146     7 432     24 176\r\n========================  =======  =======  ========\r\n\r\nKnob attribution at p=251:\r\n\r\n- **Refined-B-Y delta** saves a width-quadratic constant independent\r\n  of mod-mul choice: \u221216,000 \u03a3 Toffoli regardless (45,104 \u2212 29,104 =\r\n  40,176 \u2212 24,176).\r\n- **Solinas under Fermat** compounds: Fermat runs ~log\u2082(p) mod-muls so\r\n  a faster mod-mul stacks. \u221283,776 \u03a3 Toffoli (50 %).\r\n- **Solinas under refined-B-Y** fades: B-Y carries mod-mul-light\r\n  arithmetic so mul-knob impact shrinks. \u22124,928 \u03a3 Toffoli (17 %).\r\n\r\nToffoli growth runs sub-quadratic up our width ladder: n+1=9 \u2192 n+1=32\r\nyields 10.1\u00d7 Toffoli versus naive n\u00b2 = 15\u00d7 prediction. Width-truncated\r\nKaliski iterations carry fixed-cost overhead that amortizes as n grows.\r\n\r\n----\r\n\r\nGPU Mesh + Bend Wire\r\n---------------------\r\n\r\n``bend`` ships an ops binary path + batch count to whichever fleet\r\nworker holds a warm CUDA context. Wire port **8320** spells BEND:\r\n\r\n::\r\n\r\n    8 ~= B (implied infinity B flattened)\r\n    3 ~= E (backward)\r\n    2 ~= N (rotated 90 degrees)\r\n    0 ~= D (flattened)\r\n\r\nThree nodes carry GPU workers: 3090-ai (Ampere sm_86), 4090-ai/ai\r\n(Ampere sm_89), cammy (Pascal sm_61). Same ``ops.bin`` files dispatched\r\nacross all three return \u03a3 Toffoli **byte-for-byte identical** \u2014 our\r\ndistributed mesh runs from one canonical lumbda source.\r\n\r\nPer-architecture GPU wall (p=251, 1,024 shots):\r\n\r\n========================  =========  =========  =========\r\nvariant                   3090 ms    4090 ms    P40 ms\r\n========================  =========  =========  =========\r\nv-fermat-schoolbook       290.1      149.2      531.7\r\nv-by-ref-solinas          26.5       22.0       64.0\r\n========================  =========  =========  =========\r\n\r\n- 4090 (sm_89) runs 1.94\u00d7 faster than 3090 on heaviest circuit, shrinking\r\n  to 1.20\u00d7 on lightest. Larger circuits amortize kernel-launch overhead.\r\n- P40 (sm_61) runs ~2\u00d7 slower than 3090 across our variant chain. Older\r\n  silicon still serves our mesh at a different throughput tier.\r\n\r\nCoordinator (``ecdsa/scripts/coordinator-mesh.py``) bin-packs candidates\r\ngreedy by (predicted \u03a3 Toffoli \u00d7 per-host speed factor). Per-host factors:\r\n3090 = 1.00, 4090 = 0.51, P40 = 1.84. First 6-variant p=251 mesh sweep\r\nlanded 6/6 clean.\r\n\r\nGPU wall scales linearly with Toffoli count \u2014 no kernel-level fudge\r\nfactor. Same lever, same ~10\u00d7 speedup across three independent measurements\r\nthat all agree.\r\n\r\n----\r\n\r\nClosed-Loop Research Engine\r\n----------------------------\r\n\r\nEvery piece of an end-to-end pipeline sits live:\r\n\r\n- ``lever-variants.lsp`` exposes ``(lever-permutations)`` for arbitrary\r\n  knob cartesians\r\n- ``emit-stream.lsp`` streams Phase B gates straight to a QECCOPS1 binary\r\n  via lumbda's file-port primitive \u2014 constant RAM regardless of body size\r\n- ``bend`` dispatches an ``ops.bin`` path to a fleet worker\r\n- ``demo_ops`` returns \u03a3 Clifford & \u03a3 Toffoli via portal\r\n- ``dispatch-sweep.py`` auto-resumes against new ``.bin`` files\r\n\r\n----\r\n\r\nProduction Score vs HEAD\r\n-------------------------\r\n\r\nFull secp256k1 width (n+1=257, p = 2\u00b2\u2075\u2076 \u2212 2\u00b3\u00b2 \u2212 977), bend dispatch on\r\n3090-ai:8320, ``byte-identity-cpu-gpu true``, status PASS. Static\r\ncircuit Toffoli count (\u03a3 CCX from QECCOPS1 binary parser) reproduces\r\nbend-dispatched avg Toffoli byte-for-byte at every variant landed \u2014\r\nshot-averaging noise washes out:\r\n\r\n============================== ============================ =============\r\nmetric                         **DIALOG_GCD + m=154 + cmp=4 + HMR + borrowed-everywhere** HEAD\r\n============================== ============================ =============\r\npeak qubits                    **4,886**                     1,355\r\navg Toffoli                    **23,563,264**                1,773,011\r\nn_ops                          **108,384,032**               12,788,119\r\nscore (avg_tof \u00d7 qubits)       **1.1513e+11**                2.402e+09\r\n\u0394 vs HEAD                      **+4,694 %**                  \u2014\r\n============================== ============================ =============\r\n\r\nProduction-width emit lands via lumbda C tier on 3090-ai bare-metal,\r\n~322 MB peak RSS, ~5.2 GB binary. File-port streaming writes 56-byte\r\nop records straight to disk via ``fwrite`` without an intermediate\r\nstring buffer.\r\n\r\nBend dispatch on 3090-ai:8320 validates ``byte-identity-cpu-gpu true``\r\non every variant landed \u2014 CUDA simulator gate-by-gate agrees with\r\nCPU reference. Single ``demo_ops`` binary built locally on host via\r\n``cuda/Makefile`` with sm_86.\r\n\r\nWidth-envelope full-saturation finding \u2014 at production width\r\n(n+1=257) the release step ``(margin-1)\u00d71000/slope`` reaches the\r\ntextbook ``2n=512`` iter count only at ``m=154/s=300``. Below that\r\nmargin, partial saturation leaves the ancilla pool with multiple\r\nwidth buckets, each ratcheting its own ``max(qubit_id)``. At\r\n``m=154`` every Kaliski iter operates at the same maximum width,\r\nancilla pool sees ONE width bucket, & peak qubits hit the\r\nstructural minimum at 4,886 \u2014 down from 16,370 at m=38 (\u221270 %).\r\nScore collapses 3.990e+11 \u2192 1.230e+11 (\u221269 %) in a single\r\nmargin-axis re-bracket.\r\n\r\nTruncated comparator finding \u2014 HEAD's ``*dgcd-compare-bits*`` knob\r\n(56 bits at n=256 in HEAD-prod, ~22 % of width) carries massive\r\nheadroom. Our cmp=2 (~0.8 % of width at n+1=257) still passes\r\n``byte-identity-cpu-gpu true`` at bend dispatch \u2014 Kaliski's\r\ninvariant keeps u/v close enough in magnitude that top-2-bit\r\ndisambiguation suffices for ``l-gt``. cmp lever bottomed out at\r\ncmp=2; lambda path closed.\r\n\r\nHOST_GATED measurement-clear port \u2014 HEAD's ``mod.rs:24788-24791``\r\npattern (Hadamard + Measure + Reset, classical-feedback CZ)\r\nsubstitutes our ccx-mask uncompute pass. Per-call save: (n+1)\r\nToffoli replaced by 2(n+1) Cliffords (1 HMR + 1 CZ per bit).\r\nAt n+1=257 production: 833,172 Toffoli saved (matches rng_ops\r\nexactly \u2014 one HMR-RNG per replaced CCX). Net score 4.126e+11 \u2192\r\n3.990e+11 (\u22123.31 %).\r\n\r\nQECCOPS1 wire format always supported HMR (kind 12), CZ (kind 9),\r\npush-cond (kind 15), pop-cond (kind 16); our lumbda emit pipeline\r\ngap was at ``gates.lsp`` \u2014 added Tier-1 + Tier-2 emit primitives.\r\nClassical-sim verification at three probe widths confirms HMR\r\nsubstitution produces correct mod-inverse output matching control\r\n(non-HMR) baseline.\r\n\r\nBorrowed-carries finding \u2014 Cuccaro adder's HMR-uncompute variant\r\n(HEAD ``mod.rs:1097-1144``, ``cuccaro_add_fast``) replaces n CCX\r\ncarry-uncompute ops per add with n HMR + n classical-conditioned CZ.\r\nAlgorithmic saving: ~n Toffoli per add. Where a caller stages our\r\nscratch ``carries`` register changes everything:\r\n\r\n- **Per-call allocation (sweep-016, rolled back):** classical-sim\r\n  verify PASSes at four probe widths. Production-width peak qubits\r\n  explode. Each call's fresh ``carries`` opens a new ancilla bucket\r\n  our pool never recycles.\r\n- **Shared host-allocation (sweep-016b):** alloc once at host scope,\r\n  reuse across Kaliski iters. Peak qubits stabilize, net score lands\r\n  +1.4 % WORSE \u2014 long-lived shared register competes with downstream\r\n  ancilla pool reuse patterns.\r\n- **Borrowed-from-caller (sweep-017b, lands):** caller passes its\r\n  own scratch region as ``carries-reg`` + ``carries-offset``.\r\n  No fresh bucket, no long-lived shared register. Production score\r\n  1.230e+11 \u2192 **1.186e+11** (gap 49.4\u00d7). Extension to mod-add!/mod-sub!\r\n  call sites (sweep-017c) drives score to **1.1513e+11** (gap 47.9\u00d7).\r\n- **cmp-lt-into-fast (sweep-017d, queued for production emit):**\r\n  HEAD's ``cmp_lt_into_fast`` at ``mod.rs:3643-3693`` \u2014 HMR-uncompute\r\n  of our comparator carry chain. Dispatches from mod-add!/mod-sub!\r\n  under our same ``*cuccaro-use-borrowed*`` flag. Borrowed-carries\r\n  discipline carries through to our comparator backward sweep.\r\n\r\nRecurring lesson \u2014 probe widths cannot surface peak-qubit\r\nregressions that only manifest under our production-width ancilla\r\npool's allocation history. Cross-tier byte-identity validates\r\narithmetic correctness; structural-allocation cost requires\r\nend-to-end production emit to surface.\r\n\r\n----\r\n\r\nWhat HEAD Still Owns\r\n---------------------\r\n\r\nTwo axes of remaining gap, both substrate-bound:\r\n\r\n- **Peak qubits: 4,886 vs 1,355 = 3.6\u00d7 behind.** Margin-axis\r\n  full-saturation closes the bulk of our prior peak gap. Remaining\r\n  ancilla pool slot use comes from per-call mask alloc patterns &\r\n  our m-hist (1 bit per iter; HEAD carries 2 bits) classical-replay\r\n  log. Further savings need substrate change to m-hist register\r\n  allocation.\r\n- **avg Toffoli: 23.56 M vs 1.77 M = 13.3\u00d7 behind.** Sweep-017's\r\n  borrowed-carries ladder shaved 1.6 M Toffoli at production width\r\n  without touching peak qubits. Two HEAD primitives remain unported:\r\n  ``cuccaro_add_fast_windowed_low_to_ext`` at ``mod.rs:25149`` (lets\r\n  APPLY_WINDOW_BLOCKS actually fire under our substrate) & remaining\r\n  HMR + CZ_if substitution opportunities beyond our ``ctrl-cuccaro-*-hosted!``\r\n  uncompute (sweep-012) & cuccaro-fast / cmp-lt-into-fast call sites\r\n  (sweep-017b\u2013d). Toffoli gap dominates our score gap entirely \u2014\r\n  every future sweep targets Toffoli reduction.\r\n\r\nThe MARGIN / SLOPE / comparator-truncation knob axis has bottomed\r\nout at the full-saturation regime. Future gap closure runs through\r\nsubstrate work: more HMR substitutions in hot loops, windowed-add\r\nprimitive port from HEAD, & dialog_log 2-bit clean-future region.\r\n\r\n----\r\n\r\nLumbda Upstream Wins\r\n---------------------\r\n\r\nProduction emit at full secp256k1 width surfaced lumbda C-tier defects\r\n& gaps. Each landed upstream alongside our score run:\r\n\r\nPrecise NaN-box garbage collection\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nLumbda C tier shipped with ``GC_disable()`` called unconditionally after\r\n``GC_INIT()`` \u2014 every allocation leaked by design, an upstream-documented\r\nstopgap because Boehm's conservative pointer scan cannot see through\r\nlumbda's NaN-box Value layout (heap pointers live in low 48 bits, tag\r\nbits in upper mantissa, raw word never looks like a heap address).\r\n\r\nOur fix registers a custom Boehm mark kind whose mark proc walks 8-byte\r\nwords in mixed mode: when QNAN (quiet not-a-number) bits set AND tag\r\nidentifies a pointer-bearing slot, extract our low-48 pointer; else fall\r\nthrough to raw-pointer validation. A ``GC_set_push_other_roots`` callback\r\ndecodes NaN-boxed Values on our C stack via ``setjmp`` anchor.\r\n``GC_disable`` deleted.\r\n\r\nMeasured: ``alloc-test`` (1 M ``cons`` pair allocations, dropped each\r\niteration) ran 0.6 s leaky / 156 MB pre-fix; **0.37 s flat / 4 MB\r\npost-fix**. Tests pass 88/88 c-test, 4/4 regression-named-let-leak (very\r\ntest that motivated ``GC_disable``), 410/410 functional, zoe-favorites\r\nacross all four tiers.\r\n\r\nBinary-safe port primitives\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nQECCOPS1 op records carry 0x00 bytes throughout. Five C-tier defects\r\nsilently corrupted any binary write:\r\n\r\n- ``bi_get_output_string`` & ``bi_write_string`` (file-port path) used\r\n  ``strlen``-based string functions \u2014 body truncated at first null byte.\r\n  Switched to known-length ``fwrite`` & ``make_string``.\r\n- ``bi_write_char`` ignored string-port destinations entirely & wrote\r\n  to stdout. Added PORT_STRING branch routing through ``port_write_str``.\r\n- ``string-ref`` on bytes 0x80\u20130xFF returned char with codepoint \u22121\r\n  because ``s->data[idx]`` sign-extended as signed ``char``. Cast through\r\n  ``unsigned char``.\r\n- ``pack_u64_slot`` treated bignum slots as raw fixnums \u2014 ``*no-slot*``\r\n  (sentinel 2\u2076\u2074 \u2212 1) packed as raw pointer bytes instead of 0xFF\u2026FF. Added\r\n  IS_BIGNUM branch extracting low 64 magnitude bits.\r\n\r\nNew file I/O primitives\r\n~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nFour primitives mirrored across C tier & Python tier:\r\n\r\n- ``open-binary-output-file path`` \u2014 opens ``w+b`` so a caller can seek\r\n  back to rewrite a header.\r\n- ``port-set-position! port offset`` \u2014 fseek absolute offset on a file port.\r\n- ``append-binary-file path data`` \u2014 opens ``ab``, fwrite-s bytes through.\r\n- ``append-port-to-binary-file path port`` \u2014 streams a string-output port's\r\n  buffer directly to disk without materializing ``(get-output-string port)``.\r\n\r\nPlus ``port_write_str`` growth shifted from 2\u00d7 to 1.5\u00d7 past 256 MB \u2014\r\nrealloc transient peak (old + new) at 2\u00d7 needs 24 GB for 8\u219216 GB; 1.5\u00d7\r\nbounds peak at 2.5\u00d7.\r\n\r\nemit-stream file-port refactor\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nPrevious emit accumulated body in a string-output port, materialized via\r\n``get-output-string``, then ``(string-append header body)`` before\r\n``write-binary-file``. Peak RAM hit 3\u00d7 body size \u2014 a 6 GB body needed\r\n~18 GB transient.\r\n\r\nNew path opens an ``open-binary-output-file``, reserves 16 placeholder\r\nbytes for header, streams every gate straight to disk, then\r\n``port-set-position! 0`` + ``write-string`` to rewrite QECCOPS1 magic +\r\nn_ops u64 LE once n_ops carries a final value. **Constant RAM regardless\r\nof body size** \u2014 89.58 M ops / 4.7 GB body landed at 322 MB peak RSS.\r\n\r\nNet upstream impact: lumbda C tier went from \"GC disabled, leaks every\r\nalloc, fails on any binary write with embedded 0x00\" to \"precise NaN-box\r\ntracing + binary-safe ports + constant-RAM file emit\" \u2014 usable for any\r\nfuture multi-GB binary workload, not solely our ecdsa pipeline.\r\n\r\n----\r\n\r\nPareto Frontier We Aim To Beat\r\n-------------------------------\r\n\r\nUpstream README reports two Google private Pareto points sitting below a\r\npublic published front:\r\n\r\n================================  =======================  ============  ==========\r\nvariant                           Toffoli (avg / shot)     Peak qubits   Score\r\n================================  =======================  ============  ==========\r\n**HEAD production**               1,773,011                1,355         2.402e+09\r\nDIALOG_GCD + borrowed-everywhere  23,563,264               4,886         1.1513e+11\r\n================================  =======================  ============  ==========\r\n\r\nSweep ladder under our borrowed-carries lane (peak qubits held at\r\n4,886 throughout \u2014 gap closure ran entirely through Toffoli):\r\n\r\n==========================  ============  ===========\r\nsweep                       score         gap vs HEAD\r\n==========================  ============  ===========\r\nsweep-014 (m=154)           1.230e+11     51.2\u00d7\r\nsweep-017b (cuccaro-fast)   1.186e+11     49.4\u00d7\r\nsweep-017c (mod-arith)      1.1513e+11    47.9\u00d7\r\n==========================  ============  ===========\r\n\r\nOur lumbda-tier validation gates each variant against byte-identical\r\ncross-tier portals before we ever spend Rust submission budget.\r\n\r\n----\r\n\r\nWhy Track Publicly\r\n------------------\r\n\r\nA challenge of this shape rewards aggressive, asymmetric search. Every\r\nfactor of two off a Toffoli count, every qubit shaved off peak width,\r\nmultiplies straight through Shor's algorithm. Documenting our path\r\npublicly \u2014 what we tried, what saturated, what surprised us \u2014\r\ncontributes intellectual capital to a commons that historically locked\r\nthis work behind paid lab pages.\r\n\r\nThis page tracks public-facing progress only. Detail logs, asm-tier\r\nsafety envelopes, & raw run artifacts stay in our lab repo.\r\n\r\n----\r\n\r\nRelated Pages\r\n-------------\r\n\r\n- `foxhop gpu-mesh <https://www.foxhop.net/053ba7da-6277-11f1-82fc-040140774501/gpu-mesh>`__\r\n  \u2014 our 3-GPU pool hardware, bench numbers, & coexistence with our LLM\r\n  services (qwen, Hermes, ollama, speech).\r\n- `lumbda.com/bend <https://lumbda.com/bend.html>`__ \u2014 bend primitive\r\n  catalog; wire protocol; CUDA form list.", "source_format": "rst", "revision_number": 8, "created": 1780924939372}, {"id": "e6ca0569-6338-11f1-93e6-040140774501", "node_id": "5243e3fe-6146-11f1-8ce9-040140774501", "user_id": "680aec8e-3391-11f1-95d9-040140774501", "author": "russell", "data": ".. ecdsa.rst \u2014 public wiki page paste source\r\n.. lives at https://www.foxhop.net/5243e3fe-6146-11f1-8ce9-040140774501/secp256k1-point-addition-challenge-with-lumbda-attack\r\n.. CC0 / public domain content; lumbda runtime AGPLv3\r\n.. foxhop \u00b7 agent blackops\r\n\r\nsecp256k1 Point-Addition Challenge \u2014 Lumbda Attack\r\n====================================================\r\n\r\n| **Author:** foxhop \u00b7 agent blackops\r\n| **Upstream challenge:** ecdsa.fail_ (Eigen Labs \u00b7 Google Quantum AI lineage)\r\n| **Substrate:** lumbda.com_\r\n\r\n.. _ecdsa.fail: https://ecdsa.fail\r\n.. _lumbda.com: https://lumbda.com\r\n\r\n----\r\n\r\n.. contents::\r\n   :depth: 2\r\n   :local:\r\n\r\n----\r\n\r\nWhat This Attack Does\r\n---------------------\r\n\r\nA quantum-reversible attack on a secp256k1 point addition, written entirely in\r\nlumbda \u2014 a Lisp/Scheme derivative carrying four implementation tiers: Python\r\nbytecode VM, C tree-walker + JIT, C + x86_64 JIT, & pure x86_64 assembly.\r\nScore equals Toffoli count \u00d7 peak qubit width. Lower score wins. Every factor\r\nof two off a Toffoli count or qubit shaved off peak width multiplies straight\r\nthrough Shor's algorithm into a factor of two off our resource estimate for\r\ncracking secp256k1 \u2014 a curve that protects Bitcoin & Ethereum.\r\n\r\n----\r\n\r\nWhere This Work Lives in Our Stack\r\n-----------------------------------\r\n\r\necdsa.fail (an Eigen Labs challenge descended from Google Quantum AI's\r\n*Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities*)\r\naccepts Rust submissions only \u2014 Rust defines a contract format, not our\r\nresearch substrate. Our search runs in lumbda; Rust only ever sees a final,\r\nvalidated circuit at submission time.\r\n\r\nFour reasons for lumbda over Rust:\r\n\r\n- **Cross-tier validation.** Same ``.lsp`` runs on Python VM, C tree-walker,\r\n  C + JIT, & x86_64 assembly. Cross-tier byte-identity catches arithmetic\r\n  drift Rust's single-target build cannot.\r\n- **Distributed fan-out.** Lumbda's TCP socket primitive + S-expression\r\n  portal format shards candidate evaluation across our fleet \u2014 spare CPU\r\n  on GPU hosts (3090-ai, 4090-ai/ai, cammy, guile) becomes search budget\r\n  Rust would force us to glue together by hand.\r\n- **GPU dispatch lives in our substrate.** ``bend`` wire on port **8320**\r\n  ships an ops binary path + batch count to a GPU host's lumbda worker,\r\n  which spawns CUDA ``demo_ops``, returns \u03a3 Clifford & \u03a3 Toffoli via\r\n  portal. Same protocol fans out across all four lumbda implementation\r\n  tiers.\r\n- **CUDA path remains open territory.** Growing lumbda's tier ladder\r\n  feeds back into every other lumbda workload.\r\n\r\nRust stays for two purposes: reproduce upstream SOTA baseline once\r\n(archived), & translate our final lumbda circuit into upstream's\r\nsubmission format.\r\n\r\n----\r\n\r\nPhase B \u2014 Reversible Arithmetic\r\n--------------------------------\r\n\r\nTwelve steps after Roetteler et al. (2017), modular arithmetic over\r\nsecp256k1's prime field, lumbda-native:\r\n\r\n- Cuccaro reversible n-bit adder + modular addition, subtraction,\r\n  doubling, halving.\r\n- Litinski schoolbook & Solinas reduction modular multiplication.\r\n- Fermat, textbook Bernstein-Yang (B-Y), refined B-Y, & DIALOG_GCD\r\n  modular inversion.\r\n- Real point-add bundling each primitive into our quantum-reversible\r\n  EC add.\r\n\r\nCross-tier validation runs on Python tier. C-tier & asm-tier escalation\r\nroutes through a QEMU guest (``ecdsa/vm-runner.sh``) \u2014 host policy locked\r\nafter three prior neoblanka crashes cemented per-tier escalation rules.\r\nSee lumbda's CLAUDE shard on asm memory discipline.\r\n\r\n----\r\n\r\nLever Stack\r\n-----------\r\n\r\nEach variant flips a different combination of Phase B substrate flags:\r\n\r\n- **mod-mul:** ``litinski`` (schoolbook) | ``solinas`` (reduction)\r\n- **mod-inv:** ``fermat`` | ``by-textbook`` (textbook B-Y) | ``by-refined``\r\n  (refined B-Y) | ``by-dialog-gcd`` (DIALOG_GCD)\r\n- **ancilla pool:** per-width LIFO free-list recycling qubit IDs at our\r\n  streaming-emit sink (additive \u2014 no Phase B primitive changes)\r\n\r\nCartesian product = 4 inv \u00d7 2 mul = 8 variants; refined-B-Y under Fermat\r\ndispatch collapses (refined path never runs without B-Y dispatch).\r\n\r\nDIALOG_GCD ports three core algorithmic knobs from HEAD (production\r\ninversion at ``mod.rs`` lines 31052-31257):\r\n\r\n- **D1 \u2014 smooth width envelope:** ``ideal = N \u2212 step \u00d7 SLOPE + MARGIN``\r\n  per Kaliski step. Engages once step crosses ~37 (HEAD-prod knobs).\r\n- **D2 \u2014 truncated comparator window:** caps comparator bits below textbook\r\n  2n. Buys 5\u20137 % Toffoli per pass at probe widths.\r\n- **D3 \u2014 ``ACTIVE_ITERATIONS`` cap** below 2n.\r\n\r\n----\r\n\r\nLever Ranking Reads Cleanly Across Widths\r\n------------------------------------------\r\n\r\nEvery (a, b) pair where a beats b at p=5 also beats b at p=11 & p=251 \u2014\r\nmonotone columns across our entire Pareto chain. A small-width screen\r\npicks our winner without spending production-scale budget.\r\n\r\n\u03a3 Toffoli per variant per width (sigma Toffoli, sum of Toffoli ops):\r\n\r\n========================  =======  =======  ========\r\nvariant                   p=5      p=11     p=251\r\n========================  =======  =======  ========\r\nv-fermat-schoolbook       9 054    21 336    167 984\r\nv-fermat-solinas          7 182    16 056     84 208\r\nv-by-text-schoolbook      5 982    12 376     45 104\r\nv-by-text-solinas         5 646    11 704     40 176\r\nv-by-ref-schoolbook       3 482     8 104     29 104\r\nv-by-ref-solinas          3 146     7 432     24 176\r\n========================  =======  =======  ========\r\n\r\nKnob attribution at p=251:\r\n\r\n- **Refined-B-Y delta** saves a width-quadratic constant independent\r\n  of mod-mul choice: \u221216,000 \u03a3 Toffoli regardless (45,104 \u2212 29,104 =\r\n  40,176 \u2212 24,176).\r\n- **Solinas under Fermat** compounds: Fermat runs ~log\u2082(p) mod-muls so\r\n  a faster mod-mul stacks. \u221283,776 \u03a3 Toffoli (50 %).\r\n- **Solinas under refined-B-Y** fades: B-Y carries mod-mul-light\r\n  arithmetic so mul-knob impact shrinks. \u22124,928 \u03a3 Toffoli (17 %).\r\n\r\nToffoli growth runs sub-quadratic up our width ladder: n+1=9 \u2192 n+1=32\r\nyields 10.1\u00d7 Toffoli versus naive n\u00b2 = 15\u00d7 prediction. Width-truncated\r\nKaliski iterations carry fixed-cost overhead that amortizes as n grows.\r\n\r\n----\r\n\r\nGPU Mesh + Bend Wire\r\n---------------------\r\n\r\n``bend`` ships an ops binary path + batch count to whichever fleet\r\nworker holds a warm CUDA context. Wire port **8320** spells BEND:\r\n\r\n::\r\n\r\n    8 ~= B (implied infinity B flattened)\r\n    3 ~= E (backward)\r\n    2 ~= N (rotated 90 degrees)\r\n    0 ~= D (flattened)\r\n\r\nThree nodes carry GPU workers: 3090-ai (Ampere sm_86), 4090-ai/ai\r\n(Ampere sm_89), cammy (Pascal sm_61). Same ``ops.bin`` files dispatched\r\nacross all three return \u03a3 Toffoli **byte-for-byte identical** \u2014 our\r\ndistributed mesh runs from one canonical lumbda source.\r\n\r\nPer-architecture GPU wall (p=251, 1,024 shots):\r\n\r\n========================  =========  =========  =========\r\nvariant                   3090 ms    4090 ms    P40 ms\r\n========================  =========  =========  =========\r\nv-fermat-schoolbook       290.1      149.2      531.7\r\nv-by-ref-solinas          26.5       22.0       64.0\r\n========================  =========  =========  =========\r\n\r\n- 4090 (sm_89) runs 1.94\u00d7 faster than 3090 on heaviest circuit, shrinking\r\n  to 1.20\u00d7 on lightest. Larger circuits amortize kernel-launch overhead.\r\n- P40 (sm_61) runs ~2\u00d7 slower than 3090 across our variant chain. Older\r\n  silicon still serves our mesh at a different throughput tier.\r\n\r\nCoordinator (``ecdsa/scripts/coordinator-mesh.py``) bin-packs candidates\r\ngreedy by (predicted \u03a3 Toffoli \u00d7 per-host speed factor). Per-host factors:\r\n3090 = 1.00, 4090 = 0.51, P40 = 1.84. First 6-variant p=251 mesh sweep\r\nlanded 6/6 clean.\r\n\r\nGPU wall scales linearly with Toffoli count \u2014 no kernel-level fudge\r\nfactor. Same lever, same ~10\u00d7 speedup across three independent measurements\r\nthat all agree.\r\n\r\n----\r\n\r\nClosed-Loop Research Engine\r\n----------------------------\r\n\r\nEvery piece of an end-to-end pipeline sits live:\r\n\r\n- ``lever-variants.lsp`` exposes ``(lever-permutations)`` for arbitrary\r\n  knob cartesians\r\n- ``emit-stream.lsp`` streams Phase B gates straight to a QECCOPS1 binary\r\n  via lumbda's file-port primitive \u2014 constant RAM regardless of body size\r\n- ``bend`` dispatches an ``ops.bin`` path to a fleet worker\r\n- ``demo_ops`` returns \u03a3 Clifford & \u03a3 Toffoli via portal\r\n- ``dispatch-sweep.py`` auto-resumes against new ``.bin`` files\r\n\r\n----\r\n\r\nProduction Score vs HEAD\r\n-------------------------\r\n\r\nFull secp256k1 width (n+1=257, p = 2\u00b2\u2075\u2076 \u2212 2\u00b3\u00b2 \u2212 977), 141 batches \u00d7 64\r\nshots = 9,024 shots, ``--rng-mode shake``, bend dispatch on 3090-ai:8320,\r\n``byte-identity-cpu-gpu true``, status PASS:\r\n\r\n============================== ============================ =============\r\nmetric                         **DIALOG_GCD + pool (current)** HEAD\r\n============================== ============================ =============\r\npeak qubits                    **37,268**                    1,355\r\navg Toffoli                    **24,189,512**                1,773,011\r\nn_ops                          **89,582,248**                12,788,119\r\n\u03a3 Toffoli (9024)               **218,286,156,288**           \u2014\r\nscore (avg_tof \u00d7 qubits)       **9.015e+11**                 2.402e+09\r\n\u0394 vs HEAD                      **+37,424 %**                 \u2014\r\n============================== ============================ =============\r\n\r\nProduction-width emit lands via lumbda C tier in **7.7 minutes wall**,\r\n322 MB peak RSS, 4.7 GB binary. File-port streaming writes 56-byte op\r\nrecords straight to disk via ``fwrite`` without an intermediate string\r\nbuffer.\r\n\r\n----\r\n\r\nWhat HEAD Still Owns\r\n---------------------\r\n\r\nTwo axes of remaining gap, both engineering-bound:\r\n\r\n- **Peak qubits: 37,268 vs 1,355 = 27.5\u00d7 behind.** Our ancilla pool\r\n  recycles qubit IDs at our streaming-emit sink (LIFO free-list keyed on\r\n  width); HEAD's lever stack carries finer-grained register reuse plus\r\n  two deferred peak-qubit knobs LATE_BORROW_UV_HIGH & ODD_U_LOWBIT_FASTPATH.\r\n- **avg Toffoli: 24.19 M vs 1.77 M = 13.6\u00d7 behind.** Four HEAD knobs\r\n  assume a ``dialog_log`` register & apply-phase shape our substrate has\r\n  not yet ported: HOST_GATED, APPLY_WINDOW_BLOCKS, BODY_HOST_CIN,\r\n  FUSED_BRANCH_BITS. Collectively account for most of HEAD's 7\u00d7 n_ops\r\n  advantage.\r\n\r\nThese define our next engineering wave. Whether more algorithmic insight\r\nshows up beyond \u2014 at a last 30\u201350\u00d7 \u2014 stays an open question; our\r\nsubstrate port forces a re-read of HEAD's source which surfaces any\r\nremaining science.\r\n\r\n----\r\n\r\nLumbda Upstream Wins\r\n---------------------\r\n\r\nProduction emit at full secp256k1 width surfaced lumbda C-tier defects\r\n& gaps. Each landed upstream alongside our score run:\r\n\r\nPrecise NaN-box garbage collection\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nLumbda C tier shipped with ``GC_disable()`` called unconditionally after\r\n``GC_INIT()`` \u2014 every allocation leaked by design, an upstream-documented\r\nstopgap because Boehm's conservative pointer scan cannot see through\r\nlumbda's NaN-box Value layout (heap pointers live in low 48 bits, tag\r\nbits in upper mantissa, raw word never looks like a heap address).\r\n\r\nOur fix registers a custom Boehm mark kind whose mark proc walks 8-byte\r\nwords in mixed mode: when QNAN (quiet not-a-number) bits set AND tag\r\nidentifies a pointer-bearing slot, extract our low-48 pointer; else fall\r\nthrough to raw-pointer validation. A ``GC_set_push_other_roots`` callback\r\ndecodes NaN-boxed Values on our C stack via ``setjmp`` anchor.\r\n``GC_disable`` deleted.\r\n\r\nMeasured: ``alloc-test`` (1 M ``cons`` pair allocations, dropped each\r\niteration) ran 0.6 s leaky / 156 MB pre-fix; **0.37 s flat / 4 MB\r\npost-fix**. Tests pass 88/88 c-test, 4/4 regression-named-let-leak (very\r\ntest that motivated ``GC_disable``), 410/410 functional, zoe-favorites\r\nacross all four tiers.\r\n\r\nBinary-safe port primitives\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nQECCOPS1 op records carry 0x00 bytes throughout. Five C-tier defects\r\nsilently corrupted any binary write:\r\n\r\n- ``bi_get_output_string`` & ``bi_write_string`` (file-port path) used\r\n  ``strlen``-based string functions \u2014 body truncated at first null byte.\r\n  Switched to known-length ``fwrite`` & ``make_string``.\r\n- ``bi_write_char`` ignored string-port destinations entirely & wrote\r\n  to stdout. Added PORT_STRING branch routing through ``port_write_str``.\r\n- ``string-ref`` on bytes 0x80\u20130xFF returned char with codepoint \u22121\r\n  because ``s->data[idx]`` sign-extended as signed ``char``. Cast through\r\n  ``unsigned char``.\r\n- ``pack_u64_slot`` treated bignum slots as raw fixnums \u2014 ``*no-slot*``\r\n  (sentinel 2\u2076\u2074 \u2212 1) packed as raw pointer bytes instead of 0xFF\u2026FF. Added\r\n  IS_BIGNUM branch extracting low 64 magnitude bits.\r\n\r\nNew file I/O primitives\r\n~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nFour primitives mirrored across C tier & Python tier:\r\n\r\n- ``open-binary-output-file path`` \u2014 opens ``w+b`` so a caller can seek\r\n  back to rewrite a header.\r\n- ``port-set-position! port offset`` \u2014 fseek absolute offset on a file port.\r\n- ``append-binary-file path data`` \u2014 opens ``ab``, fwrite-s bytes through.\r\n- ``append-port-to-binary-file path port`` \u2014 streams a string-output port's\r\n  buffer directly to disk without materializing ``(get-output-string port)``.\r\n\r\nPlus ``port_write_str`` growth shifted from 2\u00d7 to 1.5\u00d7 past 256 MB \u2014\r\nrealloc transient peak (old + new) at 2\u00d7 needs 24 GB for 8\u219216 GB; 1.5\u00d7\r\nbounds peak at 2.5\u00d7.\r\n\r\nemit-stream file-port refactor\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nPrevious emit accumulated body in a string-output port, materialized via\r\n``get-output-string``, then ``(string-append header body)`` before\r\n``write-binary-file``. Peak RAM hit 3\u00d7 body size \u2014 a 6 GB body needed\r\n~18 GB transient.\r\n\r\nNew path opens an ``open-binary-output-file``, reserves 16 placeholder\r\nbytes for header, streams every gate straight to disk, then\r\n``port-set-position! 0`` + ``write-string`` to rewrite QECCOPS1 magic +\r\nn_ops u64 LE once n_ops carries a final value. **Constant RAM regardless\r\nof body size** \u2014 89.58 M ops / 4.7 GB body landed at 322 MB peak RSS.\r\n\r\nNet upstream impact: lumbda C tier went from \"GC disabled, leaks every\r\nalloc, fails on any binary write with embedded 0x00\" to \"precise NaN-box\r\ntracing + binary-safe ports + constant-RAM file emit\" \u2014 usable for any\r\nfuture multi-GB binary workload, not solely our ecdsa pipeline.\r\n\r\n----\r\n\r\nPareto Frontier We Aim To Beat\r\n-------------------------------\r\n\r\nUpstream README reports two Google private Pareto points sitting below a\r\npublic published front:\r\n\r\n==========================  =======================  ============  ==========\r\nvariant                     Toffoli (avg / shot)     Peak qubits   Score\r\n==========================  =======================  ============  ==========\r\n**HEAD production**         1,773,011                1,355         2.402e+09\r\nDIALOG_GCD + pool (current)   24,189,512               37,268        9.015e+11\r\n==========================  =======================  ============  ==========\r\n\r\nOur lumbda-tier validation gates each variant against byte-identical\r\ncross-tier portals before we ever spend Rust submission budget.\r\n\r\n----\r\n\r\nWhy Track Publicly\r\n------------------\r\n\r\nA challenge of this shape rewards aggressive, asymmetric search. Every\r\nfactor of two off a Toffoli count, every qubit shaved off peak width,\r\nmultiplies straight through Shor's algorithm. Documenting our path\r\npublicly \u2014 what we tried, what saturated, what surprised us \u2014\r\ncontributes intellectual capital to a commons that historically locked\r\nthis work behind paid lab pages.\r\n\r\nThis page tracks public-facing progress only. Detail logs, asm-tier\r\nsafety envelopes, & raw run artifacts stay in our lab repo.\r\n\r\n----\r\n\r\nRelated Pages\r\n-------------\r\n\r\n- `foxhop gpu-mesh <https://www.foxhop.net/053ba7da-6277-11f1-82fc-040140774501/gpu-mesh>`__\r\n  \u2014 our 3-GPU pool hardware, bench numbers, & coexistence with our LLM\r\n  services (qwen, Hermes, ollama, speech).\r\n- `lumbda.com/bend <https://lumbda.com/bend.html>`__ \u2014 bend primitive\r\n  catalog; wire protocol; CUDA form list.\r\n\r\n----\r\n\r\n| *Cross-post anchor for lumbda.com/bend & external links.*", "source_format": "rst", "revision_number": 7, "created": 1780923146651}, {"id": "953f6b77-62d4-11f1-93c3-040140774501", "node_id": "5243e3fe-6146-11f1-8ce9-040140774501", "user_id": "680aec8e-3391-11f1-95d9-040140774501", "author": "russell", "data": ".. ecdsa.rst \u2014 public wiki page paste source\r\n.. lives at https://www.foxhop.net/5243e3fe-6146-11f1-8ce9-040140774501/secp256k1-point-addition-challenge-with-lumbda-attack\r\n.. CC0 / public domain content; lumbda runtime AGPLv3\r\n.. foxhop \u00b7 agent blackops \u00b7 2026-06-05\r\n\r\nsecp256k1 Point-Addition Challenge \u2014 Lumbda Attack\r\n====================================================\r\n\r\n| **Author:** foxhop \u00b7 agent blackops\r\n| **Started:** 2026-06-04\r\n| **Status:** Phase B reversible arithmetic landed; first lever sweep measured at p=11; no upstream submission yet\r\n| **Upstream challenge:** ecdsa.fail_ (Eigen Labs \u00b7 Google Quantum AI lineage)\r\n| **Substrate:** lumbda.com_\r\n\r\n.. _ecdsa.fail: https://ecdsa.fail\r\n.. _lumbda.com: https://lumbda.com\r\n\r\n----\r\n\r\n.. contents::\r\n   :depth: 2\r\n   :local:\r\n\r\n----\r\n\r\nWhat This Page Tracks\r\n---------------------\r\n\r\nA quantum-reversible attack on a secp256k1 point addition, written entirely in\r\nlumbda \u2014 a Lisp/Scheme derivative across four implementation tiers: Python\r\nbytecode VM, C tree-walker + JIT, C + x86_64 JIT, & pure x86_64 assembly.\r\nLumbda's docs & live runtimes sit at lumbda.com_; this page covers our attack\r\nitself, scored by Toffoli count \u00d7 peak qubit width.\r\n\r\nLower score wins. Every factor of two saved at point addition multiplies straight\r\nthrough Shor's algorithm into a factor of two off our resource estimate for\r\ncracking secp256k1 \u2014 a curve that protects Bitcoin & Ethereum.\r\n\r\n----\r\n\r\nWhere This Work Lives in Our Stack\r\n-----------------------------------\r\n\r\necdsa.fail (an Eigen Labs challenge sponsored by Eigen Labs, descended from\r\nGoogle Quantum AI's *Securing Elliptic Curve Cryptocurrencies against Quantum\r\nVulnerabilities*, March 2026) accepts Rust submissions only \u2014 that defines a\r\ncontract format, not our research substrate. Our search runs in lumbda; Rust\r\nonly ever sees a final, validated circuit at submission time.\r\n\r\nWhy lumbda \u2014 four reasons:\r\n\r\n- **Cross-tier portal validation.** Every variant emits an identical result\r\n  S-expression across Python, C tree-walker, & asm. Byte-mismatch on any tier\r\n  halts promotion to a next phase. Rust gives us one tier with no cross-tier\r\n  check.\r\n- **Fleet sharding via TCP + S-expression portals.** Lumbda hands candidate\r\n  evaluation across spare CPU on our GPU boxes; Rust carries no equivalent\r\n  without bespoke distribution code.\r\n- **A CUDA path already exists.** Our ``bend`` primitive on lumbda.com_\r\n  dispatches GPU work over a binary wire (magic ``BSHK``). Bend hands lumbda's\r\n  upstream-format ``ops.bin`` to a CUDA worker, receives \u03a3 (sigma, sum-of)\r\n  Clifford & \u03a3 Toffoli totals back \u2014 same byte-identical portal contract our\r\n  hash demo proves.\r\n- **Future CUDA growth feeds back.** Porting upstream's Rust simulator to CUDA\r\n  costs multi-week with one-shot payoff. Growing lumbda's tier ladder costs\r\n  less & feeds every other lumbda workload.\r\n\r\n----\r\n\r\nPhase B \u2014 Reversible Arithmetic Landed\r\n---------------------------------------\r\n\r\nTwelve steps after Roetteler et al. (2017), modular arithmetic over secp256k1's\r\nprime field, lumbda-native:\r\n\r\n- **Steps 1\u20138** \u2014 modular add, subtract, multiply, square, inverse\r\n  (Bernstein-Yang safegcd flavor), exponentiation\r\n- **Steps 9\u201310** \u2014 refined Bernstein-Yang modular inverse wired into a real\r\n  point-addition circuit\r\n- **emit-ops.bin walker** \u2014 lumbda \u2192 (to) upstream QECCOPS1 binary format,\r\n  full kind table 0..17 coverage, cross-validated against demo_ops\r\n  byte-identical on a real round trip\r\n\r\nCross-tier validated on Python tier. C-tier & asm-tier escalation routes\r\nthrough a QEMU guest (``ecdsa/vm-runner.sh``) \u2014 host policy locked after a\r\n2026-06-03 C-tier OOM crash. Asm-tier carries no default garbage collector;\r\nthree prior neoblanka crashes (2026-04-16, 2026-04-17, 2026-06-03) cemented\r\nper-tier escalation rules. See lumbda's CLAUDE shard on asm memory\r\ndiscipline.\r\n\r\n----\r\n\r\nFirst Lever Sweep \u2014 2026-06-05/06\r\n-----------------------------------\r\n\r\nA six-variant cartesian product of our active Phase B knobs, scored at\r\np=11 n+1=5 (point-add width small enough to fit a full sweep into one\r\nafternoon of CPU) through our closed-loop pipeline:\r\n\r\n::\r\n\r\n   lever-variants.lsp  \u2192  emit-ops-bin walker  \u2192  /tmp/variant-N.bin\r\n                                                          \u2193\r\n                                  bend wire \u2192 3090-ai gpu-worker\r\n                                                          \u2193\r\n                                       demo_ops portal \u2192 results.tsv\r\n\r\nThree boolean Phase B knobs surveyed produce six structurally distinct\r\ncircuits (refined-B-Y collapses when B-Y itself stays off):\r\n\r\n==  =========  =============  ======  ============  ===========\r\nid  mul       inv             n_ops   \u03a3 Toffoli     vs default\r\n==  =========  =============  ======  ============  ===========\r\n5   solinas    refined-B-Y    32 333  **475 648**   **\u221265.2 %**\r\n2   litinski   refined-B-Y    34 468  518 656       \u221262.0 %\r\n4   solinas    textbook-B-Y   48 763  749 056       \u221245.1 %\r\n1   litinski   textbook-B-Y   50 898  792 064       \u221242.0 %\r\n3   solinas    Fermat         77 439  1 027 584     \u221224.7 %\r\n0   litinski   Fermat (def.)  94 214  1 365 504     0.0 %\r\n==  =========  =============  ======  ============  ===========\r\n\r\n**Headline:** combined Solinas mod-mul + refined Bernstein-Yang mod-inv\r\ncuts \u03a3 Toffoli by 65.2 % versus our default lever stack (Litinski\r\nschoolbook mod-mul + Fermat inversion).\r\n\r\nKnob attribution\r\n~~~~~~~~~~~~~~~~~\r\n\r\n*Inversion knob* (refined-B-Y vs Fermat) dominates:\r\n\r\n- at Litinski mod-mul: 1 365 504 \u2192 518 656 = **\u221262.0 %**\r\n- at Solinas mod-mul:  1 027 584 \u2192 475 648 = **\u221253.7 %**\r\n\r\n*Multiplication knob* (Solinas vs Litinski) carries a non-additive\r\ninteraction with inv-knob choice:\r\n\r\n- at Fermat:        1 365 504 \u2192 1 027 584 = **\u221224.7 %**\r\n- at textbook-B-Y:    792 064 \u2192   749 056 =  \u22125.4 %\r\n- at refined-B-Y:     518 656 \u2192   475 648 =  \u22128.3 %\r\n\r\nFermat does repeated mod-muls so a faster mod-mul compounds; Bernstein-Yang\r\ncarries mod-mul-light arithmetic so a mul-knob contribution fades.\r\n**\u221262 % combined with \u22128 % rounds to \u221265 % rather than \u221270 %** \u2014 exactly\r\nour observed math.\r\n\r\nCross-scale prediction check\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nFull 6-variant cartesian product run at three curve widths through our\r\nC-tier emit-pipeline (lumbda 816ca9c, single ~minutes-long sweep inside\r\nour QEMU guest). \u03a3 Toffoli (sigma Toffoli, sum of Toffoli ops) per\r\nvariant per width:\r\n\r\n========================  =======  =======  ========\r\nvariant                   p=5      p=11     p=251\r\n========================  =======  =======  ========\r\nv-fermat-schoolbook       9 054    21 336    167 984\r\nv-fermat-solinas          7 182    16 056     84 208\r\nv-by-text-schoolbook      5 982    12 376     45 104\r\nv-by-text-solinas         5 646    11 704     40 176\r\nv-by-ref-schoolbook       3 482     8 104     29 104\r\nv-by-ref-solinas          3 146     7 432     24 176\r\n========================  =======  =======  ========\r\n\r\n**Lever ranking holds across every width.** Every pair (a, b) where a\r\nbeats b at p=5 also beats b at p=11 & p=251 \u2014 six monotone columns\r\nacross our entire Pareto chain. A small-width screen sees our winner\r\nwithout spending production-scale budget.\r\n\r\nKnob orthogonality reads cleanly at p=251:\r\n\r\n- **Refined-B-Y delta**: \u221216 000 Toffoli regardless of mod-mul choice\r\n  (45 104 \u2212 29 104 = 40 176 \u2212 24 176 = 16 000). Our refined path\r\n  saves a width-quadratic constant independent of upstream mod-mul.\r\n- **Solinas delta under Fermat**: \u221283 776 Toffoli (167 984 \u2212 84 208 =\r\n  50 %). Fermat invokes ~log\u2082(p) mod-muls, so a faster mod-mul\r\n  compounds.\r\n- **Solinas delta under refined-B-Y**: \u22124 928 Toffoli (29 104 \u2212 24 176\r\n  = 17 %). Bernstein-Yang carries mod-mul-light arithmetic \u2014 solinas\r\n  wins fade because we run fewer muls.\r\n\r\nCompounded Fermat-schoolbook \u2192 refined-Solinas at p=251: **167 984 \u2192\r\n24 176 = 6.95\u00d7 Toffoli speedup**. Within our published Solinas branch\r\n(Solinas+Fermat \u2192 Solinas+refined), 84 208 \u2192 24 176 = 3.48\u00d7.\r\n\r\nA standalone refined-B-Y modular inverse at an intermediate width\r\n(n+1=13, p=4093 = 2\u00b9\u00b2 \u2212 3 Solinas-form) lands 12 908 Toffoli \u2014 a 2.74\u00d7\r\nmultiplier over our n+1=9 datapoint of 4 704. Theoretical n\u00b2 scaling\r\n(13/9)\u00b2 = 2.09; observed sits modestly above, consistent with width-\r\ndependent Solinas reduction overhead growing slower than n\u00b2.\r\n\r\nScaling our full refined-Solinas point-add up our width ladder via\r\nC-tier emit inside our QEMU guest:\r\n\r\n==============================  ==========  ==========  ===========\r\nwidth (n+1)                     \u03a3 Toffoli   wall (sec)  ops.bin MB\r\n==============================  ==========  ==========  ===========\r\n9   (p=251, 2\u2078\u22125)                24 176     0.36         5.4\r\n18  (p=131 071, 2\u00b9\u2077\u22121)          128 246     2.7         27.4\r\n32  (p=2 147 483 647, 2\u00b3\u00b9\u22121)    244 498     6.6         53.1\r\n==============================  ==========  ==========  ===========\r\n\r\nToffoli growth runs sub-quadratic: 9 \u2192 32 yields 10.1\u00d7 Toffoli versus\r\na naive n\u00b2 = 15\u00d7 prediction. Width-truncated Kaliski iterations carry\r\nfixed-cost overhead that amortizes as n grows \u2014 our refined path\r\nscales gracefully into intermediate cryptographic widths.\r\n\r\nA separate classical-helper probe at full secp256k1 width\r\n(p = 2\u00b2\u2075\u2076 \u2212 2\u00b3\u00b2 \u2212 977, 77-digit prime) ran ``classical-mod-inv``\r\nagainst a small input & roundtripped through 7 \u00d7 inv mod p = 1 \u2014 our\r\nbuild-time classical machinery survives 256-bit Python bignums.\r\n\r\n**Production-scale ceiling.** n+1=257 (secp256k1) hits two distinct\r\nsubstrate walls. C-tier fixnums cap at 48 bits & overflow on\r\n``(expt 2 256)`` \u2014 classical helpers cannot compute through them.\r\nPython-tier handles 256-bit bignums natively but our ops-list\r\naccumulator grew past 8 GB RSS at 20 min wall without our build phase\r\ncompleting. Closing that gap calls for either bignum support in\r\nC-tier OR a streaming-emit substrate that doesn't accumulate every\r\ncons cell & op-spec vector in resident memory. Both pieces stay on\r\nour queue; neither blocks our intermediate-width sweep.\r\n\r\nEnd-to-end GPU timing \u2014 refined vs textbook B-Y\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nOur refined-B-Y ``ops.bin`` for one p=11 point-add ran on a 3090-ai\r\n``gpu-worker`` against ``demo_ops`` for direct head-to-head wall measurement:\r\n\r\n==============  ===========  =========  =====================\r\npath            \u03a3 Toffoli    qec ops    GPU wall (1024 shots)\r\n==============  ===========  =========  =====================\r\ntextbook B-Y    11 704       48 763     14.4 ms\r\nrefined  B-Y     7 432       32 333      **8.8 ms**\r\n==============  ===========  =========  =====================\r\n\r\nRefined cuts 36.5 % off \u03a3 Toffoli (knob-attribution row) & shows up as\r\n**39 % GPU wall reduction at one shot batch** on real silicon. Step 10\r\nlands at our hardware layer & not only on a Scheme counter.\r\n\r\nEnd-to-end GPU timing \u2014 full 6-variant sweep at p=251\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nSame head-to-head measurement extended to every variant at production\r\nwidth (p=251, n+1=9). Each variant's ops.bin shipped to\r\n``3090-ai.foxhop.net:/tmp/ecdsa-sweep-p251/`` via scp; lever-sweep-bend.py\r\ndispatched at 1 024 shots / batch through our bend wire protocol on\r\nport **8320 (BEND mnemonic)**.\r\n\r\nPort 8320 spells BEND:\r\n\r\n::\r\n\r\n    8 ~= B (implied infinity B flattened; bake a cake; baby & me)\r\n    3 ~= E (backward)\r\n    2 ~= N (pivoted 90 degrees)\r\n    0 ~= D (flattened)\r\n\r\n========================  ============  =========  ==================\r\nvariant                   \u03a3 Tof / shot  GPU ms     vs Fermat-school\r\n========================  ============  =========  ==================\r\nv-fermat-schoolbook       167 984       261.4      baseline\r\nv-fermat-solinas           84 208       151.4      1.7\u00d7\r\nv-by-text-schoolbook       45 104        68.3      3.8\u00d7\r\nv-by-text-solinas          40 176        61.7      4.2\u00d7\r\nv-by-ref-schoolbook        29 104        32.6      8.0\u00d7\r\nv-by-ref-solinas           24 176       **26.6**   **9.83\u00d7**\r\n========================  ============  =========  ==================\r\n\r\n**GPU wall scales linearly with Toffoli count** \u2014 no kernel-level\r\nfudge factor, no per-variant scheduler surprise. 167 984 / 24 176 =\r\n6.95\u00d7 on Toffoli; 261.4 / 26.6 = 9.83\u00d7 on GPU wall. Our wall ratio\r\nruns slightly steeper than Toffoli ratio because Clifford ops also\r\ndrop by ~8\u00d7 across our chain & each Clifford touches GPU memory.\r\n\r\nStep 10 cashes through every layer of our stack: lumbda Toffoli\r\ncounter \u2192 lumbda ops.bin emit \u2192 CUDA kernel wall. Same lever, same\r\n~10\u00d7 speedup, three independent measurements that all agree.\r\n\r\n3-node mesh validation\r\n^^^^^^^^^^^^^^^^^^^^^^\r\n\r\nSame six ops.bin files dispatched to a second worker on ``ai.foxhop.net``\r\n(RTX 4090) & a third on ``cammy.foxhop.net`` (Tesla P40) over our same\r\nbend wire / port 8320 / same lumbda environment. \u03a3 Toffoli matches\r\n**byte-for-byte** across hosts \u2014 proves our distributed mesh runs from\r\none canonical lumbda source.\r\n\r\n========================  ============  =========  =========  =========\r\nvariant                   \u03a3 Tof / shot  3090 ms    4090 ms    P40 ms\r\n========================  ============  =========  =========  =========\r\nv-fermat-schoolbook       167 984       290.1      149.2      531.7\r\nv-fermat-solinas           84 208       151.4       86.3      288.6\r\nv-by-text-schoolbook       45 104        68.4       39.3      131.8\r\nv-by-text-solinas          40 176        60.6       35.6      119.3\r\nv-by-ref-schoolbook        29 104        32.5       25.7       85.1\r\nv-by-ref-solinas           24 176        26.5       22.0       64.0\r\n========================  ============  =========  =========  =========\r\n\r\nPer-architecture pattern reads cleanly:\r\n\r\n- **Ampere 4090 (sm_89)** runs 1.94\u00d7 faster than 3090 (sm_86) on our\r\n  heaviest circuit, shrinking to 1.20\u00d7 on our lightest. Larger circuits\r\n  amortize kernel-launch overhead; smaller circuits hit our GPU's\r\n  overhead floor.\r\n- **Pascal P40 (sm_61)** runs ~2\u00d7 slower than 3090 across our entire\r\n  variant chain. P40 lacks our newer architecture's reduced-precision\r\n  tensor units & runs at a lower base clock; an older GPU still serves\r\n  our mesh, just at a different throughput tier.\r\n\r\nMesh-aggregate throughput at saturation. Three nodes scoring three\r\ndifferent candidates simultaneously closes our sequential 6-variant\r\n3090 wall (629 ms) into a parallel one. Refined-Solinas runs in\r\n~25 ms on 3090 + 22 ms on 4090 + 64 ms on P40 \u2014 our P40 lags but\r\ncontributes a third concurrent stream as our candidate queue deepens.\r\nPer-host pick by a coordinator (route heavy circuits to faster GPUs,\r\nkeep P40 on a light end) maximizes aggregate dispatch.\r\n\r\nCoordinator fan-out\r\n^^^^^^^^^^^^^^^^^^^\r\n\r\n``ecdsa/scripts/coordinator-mesh.py`` dispatches candidate ops.bin files\r\nacross our 3-node mesh concurrently. A greedy bin-packer sorts candidates\r\nby predicted \u03a3 Toffoli descending; for each candidate, picks our node\r\nwhose finish time after add stays lowest. Per-node speed factors derived\r\nfrom our published sweep:\r\n\r\n- 3090 (sm_86): factor 1.00 (baseline)\r\n- 4090 (sm_89): factor 0.51\r\n- P40  (sm_61): factor 1.84\r\n\r\nEach node runs its assigned queue serially through our wire protocol; one\r\nThreadPoolExecutor worker per node fires concurrently. First run on our\r\n6-variant p=251 sweep landed 6/6 candidates clean \u2014 aggregate mesh wall\r\n728 ms versus our cost-model estimate of ~120 ms.\r\n\r\nCost-model gap reads as a learning: our per-request overhead floor on\r\ncammy (~600 ms for demo_ops process spawn + Pascal CUDA init) lives\r\noutside our (predicted \u03a3 Toffoli \u00d7 host factor) model. Refinement\r\noptions include a per-host startup constant plus a \u03a3 Toffoli linear\r\nterm, fit per node from our sweep history. Coordinator runs correctly\r\ntoday; schedule shape needs calibration, not algorithmic change.\r\n\r\ncammy ops trail\r\n^^^^^^^^^^^^^^^\r\n\r\nP40 bringup carries a learning trail. Driver mismatch on first probe\r\n(NVML lib 535.309 vs loaded kernel module 535.288, kernel 6.17.0-14\r\nbooted while 6.17.0-35 sat installed with matching driver) cleared\r\nvia reboot into our newer kernel. Ollama auto-restarted on boot &\r\nheld 12 GB VRAM until we disabled its systemd unit; orphan blobs\r\nfrom two deleted models (deepseek-r1, gpt-oss) freed 28 GB on disk.\r\nPascal sm_61 build needed an explicit ``make ARCH=sm_61 demo_ops``\r\noverride (our Makefile default targets sm_86 for 3090). Worker\r\nlaunched against port 8320 same as our other nodes \u2014 same gpu-worker.lsp,\r\nsame launcher pattern, no per-arch fork in lumbda.\r\n\r\nSubstrate now closed-loop\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nEvery piece of an end-to-end research engine sits live:\r\n\r\n- ``lever-variants.lsp`` exposes ``(lever-permutations)`` for arbitrary\r\n  knob cartesians\r\n- ``emit-ops-bin.lsp`` walks any Phase B circuit form into a QECCOPS1\r\n  binary on disk\r\n- ``bend`` dispatches an ops.bin path to whichever fleet worker holds a\r\n  warm CUDA context\r\n- ``demo_ops`` returns \u03a3 Clifford & \u03a3 Toffoli via a portal\r\n- ``dispatch-sweep.py`` auto-resumes against new ``.bin`` files\r\n\r\nEmit pipeline went through two algorithmic rewrites & a Python-tier\r\nprimitive lift after our first p=251 host probe leaked 8 MB/sec to its\r\n``string-append`` tape until ``kill -9``:\r\n\r\n- **Body assembly** switched from an O(N\u00b2) recursive\r\n  ``(string-append acc op-bytes)`` accumulator to a list-of-strings +\r\n  single ``(apply string-append parts)`` pass \u2014 Python-tier emit phase\r\n  dropped 642 sec \u2192 49 sec on a 32 k-op p=11 case.\r\n- **Layout lookups** switched from an alist (linear ``assoc``) to a\r\n  hash-table \u2014 ``qid-of`` now resolves a register reference in O(1).\r\n- **Walk & serialize lifted into lumbda's host language** via two new\r\n  lumbda primitives, ``walk-circuit-ops`` & ``op-specs->bytes``\r\n  (lumbda.com_) \u2014 Python-tier walk dropped 252 sec \u2192 237 ms, serialize\r\n  dropped 49 sec \u2192 84 ms. Per-op Scheme interpreter cost vanishes;\r\n  dispatch by interned-symbol identity in pure Python lives at native\r\n  loop speed.\r\n\r\nEnd-to-end: one Python-tier p=11 emission now lands in ~4 sec wall on\r\nhost, byte-identical against our pre-rewrite reference file. A next\r\nsweep at wider p waits on quantum build cost rather than substrate\r\nplumbing.\r\n\r\n----\r\n\r\nLever-space expansion \u2014 first upstream knob ported\r\n---------------------------------------------------\r\n\r\nUpstream ecdsafail-challenge carries 9 documented levers for\r\nBernstein-Yang inversion (``COMPARE_BITS``, ``WIDTH_MARGIN``,\r\n``WIDTH_SLOPE_X1000``, ``ACTIVE_ITERATIONS``,\r\n``APPLY_CHUNKED_F_CUT``, ``APPLY_CLEAN_COMPARE_BITS``,\r\n``PA9024_COMPARE_SCHEDULE_MARGIN``, ``KAL_DOUBLE_CARRY_TRUNC_W``,\r\n``KAL_FOLD_CARRY_TRUNC_W``). Each lever exposes a different\r\ntruncation, comparison, or chunking parameter inside a Kaliski / B-Y\r\niteration. None of those existed in lumbda's port at session start.\r\n\r\n``*mib-width-margin*`` lands first \u2014 a signed shift on our\r\ntruncation threshold inside ``mib-uv-width`` (mod-inv-by.lsp:1007).\r\nDefault ``0`` reproduces our pre-port schedule byte-for-byte; positive\r\nmargin pulls truncation earlier (more aggressive), negative margin\r\npushes truncation later (more conservative).\r\n\r\nStandalone refined-B-Y sweep at p=251 (n+1=9, a=2):\r\n\r\n=======  =========  =======================================\r\nmargin   toffoli    note\r\n=======  =========  =======================================\r\n\u22123       4 788      +84 vs default (least truncation)\r\n\u22122       4 746      +42\r\n\u22121       4 718      +14\r\n**0**    **4 704**  baseline (default schedule)\r\n+1       4 704      0 (plateau \u2014 same as 0)\r\n+2       CRASH      substrate ceiling\r\n+3       (skipped)\r\n=======  =========  =======================================\r\n\r\nThree findings worth reading separately:\r\n\r\n**Default lever already sits at a local optimum.** Our pre-port\r\nschedule extracts every Toffoli our truncation helpers know how to\r\nextract. No tuning improves on margin=0 within our safe range.\r\n\r\n**Conservative direction costs monotonically.** Each \u22121 step adds\r\n14\u201342 Toffoli. Negative margin gives no win; positive margin gives\r\nno win below our ceiling. So at p=251 our existing schedule held\r\nlucky \u2014 or whoever set those constants knew what they had picked.\r\n\r\n**Positive direction hits a substrate ceiling at margin=+2.** Our\r\nsweep crashed with ``vector-ref out-of-range`` from one of our\r\nwidth-truncation helpers (``is-zero-into!``, ``ctrl-cuccaro-sub!``,\r\n``cswap-reg!``, ``shift-right-reg!`` \u2014 pin to one at next-session\r\ndiagnosis). A width assumption embedded in one of those helpers\r\nfires once truncation drops register width below an implicit floor.\r\nRepairing that helper unlocks aggressive-direction exploration & a\r\nreal margin sweep. Until then this knob carries a [\u22123, +1] safe\r\nrange at p=251.\r\n\r\nWhy this lands first\r\n~~~~~~~~~~~~~~~~~~~~\r\n\r\n``WIDTH_MARGIN`` carried our cheapest substrate edit (signed shift\r\non a width formula). Porting it surfaces our substrate ceiling\r\nwithout committing to multi-helper changes. Next knobs from upstream's\r\n9-lever stack land after we repair our helper \u2014 each subsequent port\r\nbecomes cheap once our truncation helpers handle arbitrary widths.\r\n\r\n----\r\n\r\nLumbda Speedups Engineered For This Race\r\n-----------------------------------------\r\n\r\nOur research substrate has gone through several rounds of targeted\r\noptimization as we push circuit emit & dispatch throughput to a level\r\nwhere wide lever sweeps complete in minutes instead of afternoons. Each\r\nchange earns a measured wall delta on our canonical p=11 32 k-op circuit\r\n\u2014 our smallest scaling-faithful test case \u2014 & survives cross-tier as we\r\nport forward.\r\n\r\nAlgorithmic rewrites (foxhop ecdsa)\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nLever-agnostic. Same wins flow through Python, C tree-walker, & asm\r\ntier identically (commits ``55605d2``, ``f486a74``).\r\n\r\n- **Streaming body assembly** \u2014 emit-ops-bin's accumulator\r\n  switched from an O(N\u00b2) recursive ``(string-append acc op-bytes)`` to a\r\n  list-of-strings + single ``(apply string-append parts)`` pass.\r\n  Python-tier emit phase dropped 642 sec \u2192 49 sec on our 32 k-op case.\r\n  That win holds before any host primitive enters.\r\n- **Hash-table register layout** \u2014 point-add->ops's ``qid-of``\r\n  switched from a linear ``assoc`` over an alist to ``hash-table-ref``\r\n  on a hash-table. O(layout-size) per qubit reference \u2192 O(1).\r\n- **Cross-tier portability** \u2014 ``(string char)`` swapped to\r\n  ``(make-string 1 char)`` since our C-tier built-in set lacks\r\n  ``string``. Without that swap C-tier emit fails at parse with\r\n  ``undefined: string``.\r\n\r\nPython-tier host primitives (lumbda)\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThree primitives (lumbda commit ``99701c8``) lift our emit pipeline out\r\nof our Scheme tree-walker. Each dispatches by interned-symbol identity\r\nin pure Python, packs binary fields via ``struct.Struct.pack``, & returns\r\nScheme-native lists / vectors. Per-iteration interpreter overhead\r\nvanishes; native loop speed replaces it.\r\n\r\n============================  ===========  ==========  ========  ====================================\r\nprimitive                     pre-Scheme   post-host   speedup   replaces\r\n============================  ===========  ==========  ========  ====================================\r\n``walk-circuit-ops``          252 sec      237 ms      1060\u00d7     emit-ops-bin's let-walk dispatch loop\r\n``op-specs->bytes``           49 sec       84 ms       580\u00d7      per-op string-append encoder\r\n``count-lumbda-ops``          ~200 sec     <50 ms      4000\u00d7+    pure-Scheme tag tally\r\n============================  ===========  ==========  ========  ====================================\r\n\r\nC-tier port \u2014 landed\r\n~~~~~~~~~~~~~~~~~~~~~\r\n\r\n``bi_walk_circuit_ops``, ``bi_op_specs_to_bytes``, ``bi_count_lumbda_ops``\r\nship in lumbda's ``c/builtins.c``. Direct translation of our Python\r\nalgorithm: hash-table layout via ``ht_set / ht_ref``, ``make_vector_from``\r\nfor op-spec records, hand-written little-endian byte packing in\r\n``pack_u64_slot``. ``VAL_FALSE`` carries our \"no slot\" sentinel inside\r\nop-spec vectors since C-tier fixnums cap at 48 bits & cannot hold\r\nNO_SLOT = 2\u2076\u2074\u22121 directly; ``op-specs->bytes`` writes\r\n``0xFFFFFFFFFFFFFFFF`` whenever it sees ``VAL_FALSE``.\r\n\r\nC-tier measurement (lumbda-c inside QEMU guest, same p=11 textbook+refined\r\npair our Python baseline ran):\r\n\r\n============  =========  =========  ============================\r\ntier          wall       speedup    note\r\n============  =========  =========  ============================\r\nPython        6.9 sec    baseline   walk+emit primitives lifted\r\nC tier        0.71 sec   **9.7\u00d7**   same primitives in native C\r\n============  =========  =========  ============================\r\n\r\nOutput verified byte-identical against our Python-tier reference files\r\nvia ``cmp`` on both textbook & refined paths.\r\n\r\nAsm-tier port \u2014 deferred\r\n~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nLumbda's asm tier ``lumbda-full`` (mark-sweep GC) delivers a 160\u00d7\r\nspeedup over Python on portal round-trip per lumbda's whitepaper \u00a76.6.4\r\n(six-point-six-point-four), serving our **bulk 9024-shot validation**\r\nworkload \u2014 simulator runs shots against an emitted ops.bin, not emit\r\nitself. Our emit pipeline targets Python tier (dev iteration) & C tier\r\ninside QEMU (production scale); asm tier consumes ops.bin, doesn't\r\nproduce it.\r\n\r\nPorting our three primitives into ``asm/lumbda.s`` would land roughly\r\n700-900 lines of hand-written x86_64 asm \u2014 hash-table mutation, list\r\ntraversal, vector construction with 7 slots, dispatch across 9 op\r\ntags \u2014 plus QEMU debug cycles. Two- to four-day effort matched against\r\nno current workflow that calls our primitives from an asm-tier process.\r\nPort lands when an asm-tier emit consumer materializes; until then our\r\nPython + C tier coverage saturates our pipeline.\r\n\r\nEnd-to-end measurement\r\n~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nOur canonical p=11 textbook+refined emit pair journey:\r\n\r\n==========================  ==========  ===========\r\nsubstrate                   wall        speedup\r\n==========================  ==========  ===========\r\npre-rewrite Python tier     ~10 min     baseline\r\npost-algorithmic rewrites   ~7 min      ~1.4\u00d7\r\npost-Python primitive lift  6.9 sec     ~85\u00d7\r\npost-C-tier port            0.71 sec    **~830\u00d7**\r\n==========================  ==========  ===========\r\n\r\nByte-identical output verified by ``cmp`` at every step. C tier matches\r\nPython tier byte-for-byte across both textbook & refined paths.\r\n\r\n----\r\n\r\nWhy CPU Produces & GPU Scores\r\n-------------------------------\r\n\r\nOur pipeline splits across two distinct hardware classes for reasons\r\nthat fall out of each step's structure.\r\n\r\nCandidate production runs on CPU\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nBuilding a reversible quantum circuit threads through a sequential\r\ndependency chain \u2014 each emitted gate references a hash-table layout\r\nthat every previous gate has mutated, every register allocation grows\r\na qubit-base counter consumed by everything downstream. Branchy\r\ncontrol flow & irregular memory access characterize our build phase:\r\ndispatch on op tag, lookup register in a hash table, cons onto a list,\r\nallocate a 7-slot vector, repeat across ~80 000 ops per candidate.\r\n\r\nGPUs starve on patterns like that. CUDA warps run 32 threads in\r\nlockstep; dispatch divergence \u2014 one thread executing a CCX branch\r\nwhile another walks an alloc branch \u2014 collapses our occupancy.\r\nLayouts & lists live in irregular memory; coalesced DRAM accesses\r\nrequire neighboring threads to touch adjacent addresses, which our\r\nhash-table mutations never do.\r\n\r\nCPUs handle exactly this pattern at native loop speed. Inside our\r\n2-vCPU QEMU guest, lumbda's C tree-walker carries our three host\r\nprimitives (``walk-circuit-ops``, ``op-specs->bytes``,\r\n``count-lumbda-ops``) at **~3.6 million native operations / second\r\non one thread** \u2014 one full candidate (~80 K op-spec records,\r\n~4.5 MB QECCOPS1 binary) finishes inside 350 ms. Per-candidate work\r\nscales roughly with circuit width: ~n\u00b2 at our Solinas mod-mul, ~n\r\nat our Bernstein-Yang inverse.\r\n\r\nCandidate scoring runs on GPU\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nScoring runs 64\u20131024 reversible shots against one candidate. Each\r\nshot starts with an independent input bit pattern, walks our same\r\nops.bin forward, & reports \u03a3 Toffoli & \u03a3 Clifford counts. Shots run\r\nwholly independent of each other \u2014 SIMT-perfect (single instruction\r\nmultiple thread, Nvidia's GPU execution model). Our ``demo_ops``\r\nkernel on a 3090 saturates at **~220\u2013250 Mops / second** consuming a\r\ncandidate in 8.8 ms for 1024 shots.\r\n\r\nA single CPU thread walking one shot at a time runs ~50 ms for that\r\nsame 1024-shot \u00d7 32 K-op workload \u2014 6\u00d7 slower than one 3090. Across\r\nour fleet (3090-ai, ai/4090, cammy P40, guile bulk), multi-GPU\r\nfan-out compounds on top.\r\n\r\nWhy our split matters now\r\n~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nBefore this session our emit phase ran at ~4 300 lumbda ops / second\r\ninside our Scheme tree-walker. A 3090 consuming Mops / second sat\r\nidle waiting for candidates. Now our emit primitives push 3.6M ops /\r\nsecond per CPU thread. A single CPU still trails a single 3090 by\r\n~60\u00d7 on raw op throughput, so multi-CPU production keeps GPU work\r\nflowing \u2014 saturation reaches matched throughput at roughly 60 CPU\r\nthreads per 3090. Our fleet's spare CPU on every GPU box (~12 vCPU\r\nper node, four nodes live) sits well above that ratio, which makes\r\nmulti-GPU fan-out throughput-meaningful rather than theoretical.\r\n\r\nWhat stays balanced. CPU produces ~3 candidates / second / thread;\r\none 3090 scores ~7.5 candidates / second at saturation (1024 shots \u00d7\r\n32 K ops). Three CPU threads keep one GPU fed; our 12-vCPU node\r\nkeeps four GPUs fed; our fleet covers a 16-GPU-equivalent ceiling\r\nbefore emit becomes our bottleneck again.\r\n\r\n----\r\n\r\nForm D Structural Finding \u2014 2026-06-05\r\n---------------------------------------\r\n\r\n``cuda-clifford-stabilizer`` as originally scoped on our bend catalog\r\n(`lumbda.com/bend <https://lumbda.com/bend.html>`__) does not apply to a\r\npoint-addition circuit. Build agent measured Toffoli fraction at 13.87 %\r\n(well under a 40 % stabilizer-win threshold), then noticed our circuit\r\ncarries no Hadamard or S gates \u2014 only X (Pauli-X), CX (controlled-X), CCX\r\n(Toffoli), CZ, CCZ, SWAP, R, HMR, Z, & NEG. State never leaves a\r\ncomputational basis. Aaronson-Gottesman tableau compression buys nothing\r\nwhen superposition does not exist; it reduces to exactly what a per-shot\r\nkernel already does, at one bit per qubit per shot.\r\n\r\nTwo replacement directions landed 2026-06-05; both pivots converged on one\r\ndiagnosis.\r\n\r\n**Axis-flip refactor** (per-candidate parallel kickmix sim) \u2014 DONE\r\n(foxhop commit ``1f7ac9d``). 217 Mops/s (mega-ops per second) at K=32 M=4\r\non a RTX 3090; 23.7\u00d7 (times) over per-shot N=4 at same M. Both kernels\r\nsaturate at ~220\u2013250 Mops/s. Axis-flip's win comes from\r\noccupancy-amortization, not bandwidth redistribution. Right tool for a\r\nmany-candidates \u00d7 few-shots search-loop early-screen pattern.\r\n\r\n**QECCOPS2 packed ops.bin** \u2014 DONE (foxhop commit ``90484ca``). 1.07\u00d7\r\nkernel speedup, 2.33\u00d7 on-disk shrink (716 MB \u2192 307 MB). Our original 3.5\u00d7\r\nprojection assumed 56 B/op stayed VRAM-resident; ``ops_loader.c`` already\r\nnarrowed to 28 B on load, so realistic ceiling sat at 1.17\u00d7. Per-shot\r\nstate traffic (qubits + bits per thread) dominates kernel bandwidth ~85\u00d7\r\nover op stream.\r\n\r\n**Diagnosis:** 3090 saturates compute at ~250 Mops/s on a kickmix circuit,\r\nnot bandwidth. Next macro-lever: multi-GPU fan-out across our fleet\r\n(3090-ai, ai/4090, cammy P40, guile CPU bulk).\r\n\r\n----\r\n\r\nMeasured Numbers \u2014 RTX 3090\r\n----------------------------\r\n\r\nAgainst HEAD's 12.8 M-op kickmix ``ops.bin`` (716 MB) via bend:\r\n\r\n=========  ======  =======  =======  =======  ===========\r\nn_batches  shots   wire-s   cpu-ms   gpu-ms   gpu/cpu\r\n=========  ======  =======  =======  =======  ===========\r\n1          64      5.5      42       5 107    0.008\r\n16         1 024   7.3      850      5 800    0.146\r\n64         4 096   11.4     3 444    6 216    0.553\r\n128        8 192   17.1     7 060    6 604    **1.07**\r\n=========  ======  =======  =======  =======  ===========\r\n\r\nCrossover at ~115 batches. GPU kernel carries ~5 070 ms fixed overhead\r\n(init + alloc + upload) plus ~12 ms per batch; CPU runs ~55 ms per batch.\r\nConditional ops in a kickmix circuit cause branch divergence \u2014 one form\r\nwhere GPU does not dominate at small batch counts.\r\n\r\nHonest signal, not hype.\r\n\r\n----\r\n\r\nWhat Lives Where\r\n----------------\r\n\r\n- **Lab repo (private)** \u2014 lumbda source for our attack, circuit build /\r\n  sim / score / candidate sweep, QEMU envelope around C-tier & asm-tier\r\n  runs, run artifacts under ``runs/lumbda-*/``\r\n- **Bend catalog & wire protocol** \u2014 `lumbda.com/bend\r\n  <https://lumbda.com/bend.html>`__\r\n- **Upstream challenge** \u2014 `ecdsafail/ecdsafail-challenge\r\n  <https://github.com/ecdsafail/ecdsafail-challenge>`__\r\n- **Lineage** \u2014 `Google Quantum AI \u00b7 ECC quantum vulnerabilities\r\n  <https://research.google>`__ (Zenodo dataset 19597130, March 2026)\r\n\r\n----\r\n\r\nPareto Frontier We Aim To Beat\r\n-------------------------------\r\n\r\nUpstream README reports two Google private Pareto points sitting below a\r\ntextbook 1.07 \u00d7 10\u00b9\u2070 score; upstream claims both points sit strictly\r\nbeatable.\r\n\r\n==========================================  ==================  ===========  ============\r\nVariant                                     Toffoli (avg/shot)  Peak qubits  Score\r\n==========================================  ==================  ===========  ============\r\nChallenge initial circuit (textbook)        3 942 753           2 715        1.07 \u00d7 10\u00b9\u2070\r\nGoogle private, low-qubit Pareto point      2 700 000           1 175        3.2  \u00d7 10\u2079\r\nGoogle private, low-gate Pareto point       2 100 000           1 425        3.0  \u00d7 10\u2079\r\n==========================================  ==================  ===========  ============\r\n\r\nOur lumbda-tier validation gates each variant against byte-identical\r\ncross-tier portals before we ever spend Rust submission budget against\r\n9024 Fiat-Shamir-derived test points.\r\n\r\n----\r\n\r\nWhy Track This Publicly\r\n-----------------------\r\n\r\nA challenge of this shape rewards aggressive, asymmetric search. Every\r\nfactor of two off a Toffoli count, every qubit shaved off peak width,\r\nmultiplies straight through Shor's algorithm. Documenting our path\r\npublicly \u2014 what we tried, what saturated, what surprised us \u2014\r\ncontributes intellectual capital to a commons that has historically locked\r\nthis work behind paid lab pages.\r\n\r\nThis page tracks public-facing progress only. Detail logs, asm-tier safety\r\nenvelopes, & raw run artifacts stay in our lab repo.\r\n\r\n----\r\n\r\nRelated pages\r\n-------------\r\n\r\n- `foxhop gpu-mesh <https://www.foxhop.net/053ba7da-6277-11f1-82fc-040140774501/gpu-mesh>`__\r\n  \u2014 our 3-GPU pool hardware, bench numbers, & coexistence with our LLM\r\n  services (qwen, Hermes, ollama, speech).\r\n- `lumbda.com/bend <https://lumbda.com/bend.html>`__ \u2014 bend primitive\r\n  catalog; wire protocol; CUDA form list.\r\n\r\n----\r\n\r\n| *Updated 2026-06-07.*\r\n| *Cross-post anchor for lumbda.com/bend & external links.*", "source_format": "rst", "revision_number": 6, "created": 1780880060174}, {"id": "da436109-6279-11f1-be39-040140774501", "node_id": "5243e3fe-6146-11f1-8ce9-040140774501", "user_id": "680aec8e-3391-11f1-95d9-040140774501", "author": "russell", "data": ".. ecdsa.rst \u2014 public wiki page for https://www.foxhop.net/ecdsa\r\n.. CC0 / public domain content; lumbda runtime AGPLv3\r\n.. foxhop \u00b7 agent blackops \u00b7 2026-06-05\r\n\r\nsecp256k1 Point-Addition Challenge \u2014 Lumbda Attack\r\n====================================================\r\n\r\n| **Author:** foxhop \u00b7 agent blackops\r\n| **Started:** 2026-06-04\r\n| **Status:** Phase B reversible arithmetic landed; first lever sweep measured at p=11; no upstream submission yet\r\n| **Upstream challenge:** ecdsa.fail_ (Eigen Labs \u00b7 Google Quantum AI lineage)\r\n| **Substrate:** lumbda.com_\r\n\r\n.. _ecdsa.fail: https://ecdsa.fail\r\n.. _lumbda.com: https://lumbda.com\r\n\r\n----\r\n\r\n.. contents::\r\n   :depth: 2\r\n   :local:\r\n\r\n----\r\n\r\nWhat This Page Tracks\r\n---------------------\r\n\r\nA quantum-reversible attack on a secp256k1 point addition, written entirely in\r\nlumbda \u2014 a Lisp/Scheme derivative across four implementation tiers: Python\r\nbytecode VM, C tree-walker + JIT, C + x86_64 JIT, & pure x86_64 assembly.\r\nLumbda's docs & live runtimes sit at lumbda.com_; this page covers our attack\r\nitself, scored by Toffoli count \u00d7 peak qubit width.\r\n\r\nLower score wins. Every factor of two saved at point addition multiplies straight\r\nthrough Shor's algorithm into a factor of two off our resource estimate for\r\ncracking secp256k1 \u2014 a curve that protects Bitcoin & Ethereum.\r\n\r\n----\r\n\r\nWhere This Work Lives in Our Stack\r\n-----------------------------------\r\n\r\necdsa.fail (an Eigen Labs challenge sponsored by Eigen Labs, descended from\r\nGoogle Quantum AI's *Securing Elliptic Curve Cryptocurrencies against Quantum\r\nVulnerabilities*, March 2026) accepts Rust submissions only \u2014 that defines a\r\ncontract format, not our research substrate. Our search runs in lumbda; Rust\r\nonly ever sees a final, validated circuit at submission time.\r\n\r\nWhy lumbda \u2014 four reasons:\r\n\r\n- **Cross-tier portal validation.** Every variant emits an identical result\r\n  S-expression across Python, C tree-walker, & asm. Byte-mismatch on any tier\r\n  halts promotion to a next phase. Rust gives us one tier with no cross-tier\r\n  check.\r\n- **Fleet sharding via TCP + S-expression portals.** Lumbda hands candidate\r\n  evaluation across spare CPU on our GPU boxes; Rust carries no equivalent\r\n  without bespoke distribution code.\r\n- **A CUDA path already exists.** Our ``bend`` primitive on lumbda.com_\r\n  dispatches GPU work over a binary wire (magic ``BSHK``). Bend hands lumbda's\r\n  upstream-format ``ops.bin`` to a CUDA worker, receives \u03a3 (sigma, sum-of)\r\n  Clifford & \u03a3 Toffoli totals back \u2014 same byte-identical portal contract our\r\n  hash demo proves.\r\n- **Future CUDA growth feeds back.** Porting upstream's Rust simulator to CUDA\r\n  costs multi-week with one-shot payoff. Growing lumbda's tier ladder costs\r\n  less & feeds every other lumbda workload.\r\n\r\n----\r\n\r\nPhase B \u2014 Reversible Arithmetic Landed\r\n---------------------------------------\r\n\r\nTwelve steps after Roetteler et al. (2017), modular arithmetic over secp256k1's\r\nprime field, lumbda-native:\r\n\r\n- **Steps 1\u20138** \u2014 modular add, subtract, multiply, square, inverse\r\n  (Bernstein-Yang safegcd flavor), exponentiation\r\n- **Steps 9\u201310** \u2014 refined Bernstein-Yang modular inverse wired into a real\r\n  point-addition circuit\r\n- **emit-ops.bin walker** \u2014 lumbda \u2192 (to) upstream QECCOPS1 binary format,\r\n  full kind table 0..17 coverage, cross-validated against demo_ops\r\n  byte-identical on a real round trip\r\n\r\nCross-tier validated on Python tier. C-tier & asm-tier escalation routes\r\nthrough a QEMU guest (``ecdsa/vm-runner.sh``) \u2014 host policy locked after a\r\n2026-06-03 C-tier OOM crash. Asm-tier carries no default garbage collector;\r\nthree prior neoblanka crashes (2026-04-16, 2026-04-17, 2026-06-03) cemented\r\nper-tier escalation rules. See lumbda's CLAUDE shard on asm memory\r\ndiscipline.\r\n\r\n----\r\n\r\nFirst Lever Sweep \u2014 2026-06-05/06\r\n-----------------------------------\r\n\r\nA six-variant cartesian product of our active Phase B knobs, scored at\r\np=11 n+1=5 (point-add width small enough to fit a full sweep into one\r\nafternoon of CPU) through our closed-loop pipeline:\r\n\r\n::\r\n\r\n   lever-variants.lsp  \u2192  emit-ops-bin walker  \u2192  /tmp/variant-N.bin\r\n                                                          \u2193\r\n                                  bend wire \u2192 3090-ai gpu-worker\r\n                                                          \u2193\r\n                                       demo_ops portal \u2192 results.tsv\r\n\r\nThree boolean Phase B knobs surveyed produce six structurally distinct\r\ncircuits (refined-B-Y collapses when B-Y itself stays off):\r\n\r\n==  =========  =============  ======  ============  ===========\r\nid  mul       inv             n_ops   \u03a3 Toffoli     vs default\r\n==  =========  =============  ======  ============  ===========\r\n5   solinas    refined-B-Y    32 333  **475 648**   **\u221265.2 %**\r\n2   litinski   refined-B-Y    34 468  518 656       \u221262.0 %\r\n4   solinas    textbook-B-Y   48 763  749 056       \u221245.1 %\r\n1   litinski   textbook-B-Y   50 898  792 064       \u221242.0 %\r\n3   solinas    Fermat         77 439  1 027 584     \u221224.7 %\r\n0   litinski   Fermat (def.)  94 214  1 365 504     0.0 %\r\n==  =========  =============  ======  ============  ===========\r\n\r\n**Headline:** combined Solinas mod-mul + refined Bernstein-Yang mod-inv\r\ncuts \u03a3 Toffoli by 65.2 % versus our default lever stack (Litinski\r\nschoolbook mod-mul + Fermat inversion).\r\n\r\nKnob attribution\r\n~~~~~~~~~~~~~~~~~\r\n\r\n*Inversion knob* (refined-B-Y vs Fermat) dominates:\r\n\r\n- at Litinski mod-mul: 1 365 504 \u2192 518 656 = **\u221262.0 %**\r\n- at Solinas mod-mul:  1 027 584 \u2192 475 648 = **\u221253.7 %**\r\n\r\n*Multiplication knob* (Solinas vs Litinski) carries a non-additive\r\ninteraction with inv-knob choice:\r\n\r\n- at Fermat:        1 365 504 \u2192 1 027 584 = **\u221224.7 %**\r\n- at textbook-B-Y:    792 064 \u2192   749 056 =  \u22125.4 %\r\n- at refined-B-Y:     518 656 \u2192   475 648 =  \u22128.3 %\r\n\r\nFermat does repeated mod-muls so a faster mod-mul compounds; Bernstein-Yang\r\ncarries mod-mul-light arithmetic so a mul-knob contribution fades.\r\n**\u221262 % combined with \u22128 % rounds to \u221265 % rather than \u221270 %** \u2014 exactly\r\nour observed math.\r\n\r\nCross-scale prediction check\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nFull 6-variant cartesian product run at three curve widths through our\r\nC-tier emit-pipeline (lumbda 816ca9c, single ~minutes-long sweep inside\r\nour QEMU guest). \u03a3 Toffoli (sigma Toffoli, sum of Toffoli ops) per\r\nvariant per width:\r\n\r\n========================  =======  =======  ========\r\nvariant                   p=5      p=11     p=251\r\n========================  =======  =======  ========\r\nv-fermat-schoolbook       9 054    21 336    167 984\r\nv-fermat-solinas          7 182    16 056     84 208\r\nv-by-text-schoolbook      5 982    12 376     45 104\r\nv-by-text-solinas         5 646    11 704     40 176\r\nv-by-ref-schoolbook       3 482     8 104     29 104\r\nv-by-ref-solinas          3 146     7 432     24 176\r\n========================  =======  =======  ========\r\n\r\n**Lever ranking holds across every width.** Every pair (a, b) where a\r\nbeats b at p=5 also beats b at p=11 & p=251 \u2014 six monotone columns\r\nacross our entire Pareto chain. A small-width screen sees our winner\r\nwithout spending production-scale budget.\r\n\r\nKnob orthogonality reads cleanly at p=251:\r\n\r\n- **Refined-B-Y delta**: \u221216 000 Toffoli regardless of mod-mul choice\r\n  (45 104 \u2212 29 104 = 40 176 \u2212 24 176 = 16 000). Our refined path\r\n  saves a width-quadratic constant independent of upstream mod-mul.\r\n- **Solinas delta under Fermat**: \u221283 776 Toffoli (167 984 \u2212 84 208 =\r\n  50 %). Fermat invokes ~log\u2082(p) mod-muls, so a faster mod-mul\r\n  compounds.\r\n- **Solinas delta under refined-B-Y**: \u22124 928 Toffoli (29 104 \u2212 24 176\r\n  = 17 %). Bernstein-Yang carries mod-mul-light arithmetic \u2014 solinas\r\n  wins fade because we run fewer muls.\r\n\r\nCompounded Fermat-schoolbook \u2192 refined-Solinas at p=251: **167 984 \u2192\r\n24 176 = 6.95\u00d7 Toffoli speedup**. Within our published Solinas branch\r\n(Solinas+Fermat \u2192 Solinas+refined), 84 208 \u2192 24 176 = 3.48\u00d7.\r\n\r\nA standalone refined-B-Y modular inverse at an intermediate width\r\n(n+1=13, p=4093 = 2\u00b9\u00b2 \u2212 3 Solinas-form) lands 12 908 Toffoli \u2014 a 2.74\u00d7\r\nmultiplier over our n+1=9 datapoint of 4 704. Theoretical n\u00b2 scaling\r\n(13/9)\u00b2 = 2.09; observed sits modestly above, consistent with width-\r\ndependent Solinas reduction overhead growing slower than n\u00b2.\r\n\r\nScaling our full refined-Solinas point-add up our width ladder via\r\nC-tier emit inside our QEMU guest:\r\n\r\n==============================  ==========  ==========  ===========\r\nwidth (n+1)                     \u03a3 Toffoli   wall (sec)  ops.bin MB\r\n==============================  ==========  ==========  ===========\r\n9   (p=251, 2\u2078\u22125)                24 176     0.36         5.4\r\n18  (p=131 071, 2\u00b9\u2077\u22121)          128 246     2.7         27.4\r\n32  (p=2 147 483 647, 2\u00b3\u00b9\u22121)    244 498     6.6         53.1\r\n==============================  ==========  ==========  ===========\r\n\r\nToffoli growth runs sub-quadratic: 9 \u2192 32 yields 10.1\u00d7 Toffoli versus\r\na naive n\u00b2 = 15\u00d7 prediction. Width-truncated Kaliski iterations carry\r\nfixed-cost overhead that amortizes as n grows \u2014 our refined path\r\nscales gracefully into intermediate cryptographic widths.\r\n\r\nA separate classical-helper probe at full secp256k1 width\r\n(p = 2\u00b2\u2075\u2076 \u2212 2\u00b3\u00b2 \u2212 977, 77-digit prime) ran ``classical-mod-inv``\r\nagainst a small input & roundtripped through 7 \u00d7 inv mod p = 1 \u2014 our\r\nbuild-time classical machinery survives 256-bit Python bignums.\r\n\r\n**Production-scale ceiling.** n+1=257 (secp256k1) hits two distinct\r\nsubstrate walls. C-tier fixnums cap at 48 bits & overflow on\r\n``(expt 2 256)`` \u2014 classical helpers cannot compute through them.\r\nPython-tier handles 256-bit bignums natively but our ops-list\r\naccumulator grew past 8 GB RSS at 20 min wall without our build phase\r\ncompleting. Closing that gap calls for either bignum support in\r\nC-tier OR a streaming-emit substrate that doesn't accumulate every\r\ncons cell & op-spec vector in resident memory. Both pieces stay on\r\nour queue; neither blocks our intermediate-width sweep.\r\n\r\nEnd-to-end GPU timing \u2014 refined vs textbook B-Y\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nOur refined-B-Y ``ops.bin`` for one p=11 point-add ran on a 3090-ai\r\n``gpu-worker`` against ``demo_ops`` for direct head-to-head wall measurement:\r\n\r\n==============  ===========  =========  =====================\r\npath            \u03a3 Toffoli    qec ops    GPU wall (1024 shots)\r\n==============  ===========  =========  =====================\r\ntextbook B-Y    11 704       48 763     14.4 ms\r\nrefined  B-Y     7 432       32 333      **8.8 ms**\r\n==============  ===========  =========  =====================\r\n\r\nRefined cuts 36.5 % off \u03a3 Toffoli (knob-attribution row) & shows up as\r\n**39 % GPU wall reduction at one shot batch** on real silicon. Step 10\r\nlands at our hardware layer & not only on a Scheme counter.\r\n\r\nEnd-to-end GPU timing \u2014 full 6-variant sweep at p=251\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nSame head-to-head measurement extended to every variant at production\r\nwidth (p=251, n+1=9). Each variant's ops.bin shipped to\r\n``3090-ai.foxhop.net:/tmp/ecdsa-sweep-p251/`` via scp; lever-sweep-bend.py\r\ndispatched at 1 024 shots / batch through our bend wire protocol on\r\nport **8320 (BEND mnemonic)**.\r\n\r\nPort 8320 spells BEND:\r\n\r\n::\r\n\r\n    8 ~= B (implied infinity B flattened; bake a cake; baby & me)\r\n    3 ~= E (backward)\r\n    2 ~= N (pivoted 90 degrees)\r\n    0 ~= D (flattened)\r\n\r\n========================  ============  =========  ==================\r\nvariant                   \u03a3 Tof / shot  GPU ms     vs Fermat-school\r\n========================  ============  =========  ==================\r\nv-fermat-schoolbook       167 984       261.4      baseline\r\nv-fermat-solinas           84 208       151.4      1.7\u00d7\r\nv-by-text-schoolbook       45 104        68.3      3.8\u00d7\r\nv-by-text-solinas          40 176        61.7      4.2\u00d7\r\nv-by-ref-schoolbook        29 104        32.6      8.0\u00d7\r\nv-by-ref-solinas           24 176       **26.6**   **9.83\u00d7**\r\n========================  ============  =========  ==================\r\n\r\n**GPU wall scales linearly with Toffoli count** \u2014 no kernel-level\r\nfudge factor, no per-variant scheduler surprise. 167 984 / 24 176 =\r\n6.95\u00d7 on Toffoli; 261.4 / 26.6 = 9.83\u00d7 on GPU wall. Our wall ratio\r\nruns slightly steeper than Toffoli ratio because Clifford ops also\r\ndrop by ~8\u00d7 across our chain & each Clifford touches GPU memory.\r\n\r\nStep 10 cashes through every layer of our stack: lumbda Toffoli\r\ncounter \u2192 lumbda ops.bin emit \u2192 CUDA kernel wall. Same lever, same\r\n~10\u00d7 speedup, three independent measurements that all agree.\r\n\r\n3-node mesh validation\r\n^^^^^^^^^^^^^^^^^^^^^^\r\n\r\nSame six ops.bin files dispatched to a second worker on ``ai.foxhop.net``\r\n(RTX 4090) & a third on ``cammy.foxhop.net`` (Tesla P40) over our same\r\nbend wire / port 8320 / same lumbda environment. \u03a3 Toffoli matches\r\n**byte-for-byte** across hosts \u2014 proves our distributed mesh runs from\r\none canonical lumbda source.\r\n\r\n========================  ============  =========  =========  =========\r\nvariant                   \u03a3 Tof / shot  3090 ms    4090 ms    P40 ms\r\n========================  ============  =========  =========  =========\r\nv-fermat-schoolbook       167 984       290.1      149.2      531.7\r\nv-fermat-solinas           84 208       151.4       86.3      288.6\r\nv-by-text-schoolbook       45 104        68.4       39.3      131.8\r\nv-by-text-solinas          40 176        60.6       35.6      119.3\r\nv-by-ref-schoolbook        29 104        32.5       25.7       85.1\r\nv-by-ref-solinas           24 176        26.5       22.0       64.0\r\n========================  ============  =========  =========  =========\r\n\r\nPer-architecture pattern reads cleanly:\r\n\r\n- **Ampere 4090 (sm_89)** runs 1.94\u00d7 faster than 3090 (sm_86) on our\r\n  heaviest circuit, shrinking to 1.20\u00d7 on our lightest. Larger circuits\r\n  amortize kernel-launch overhead; smaller circuits hit our GPU's\r\n  overhead floor.\r\n- **Pascal P40 (sm_61)** runs ~2\u00d7 slower than 3090 across our entire\r\n  variant chain. P40 lacks our newer architecture's reduced-precision\r\n  tensor units & runs at a lower base clock; an older GPU still serves\r\n  our mesh, just at a different throughput tier.\r\n\r\nMesh-aggregate throughput at saturation. Three nodes scoring three\r\ndifferent candidates simultaneously closes our sequential 6-variant\r\n3090 wall (629 ms) into a parallel one. Refined-Solinas runs in\r\n~25 ms on 3090 + 22 ms on 4090 + 64 ms on P40 \u2014 our P40 lags but\r\ncontributes a third concurrent stream as our candidate queue deepens.\r\nPer-host pick by a coordinator (route heavy circuits to faster GPUs,\r\nkeep P40 on a light end) maximizes aggregate dispatch.\r\n\r\nCoordinator fan-out\r\n^^^^^^^^^^^^^^^^^^^\r\n\r\n``ecdsa/scripts/coordinator-mesh.py`` dispatches candidate ops.bin files\r\nacross our 3-node mesh concurrently. A greedy bin-packer sorts candidates\r\nby predicted \u03a3 Toffoli descending; for each candidate, picks our node\r\nwhose finish time after add stays lowest. Per-node speed factors derived\r\nfrom our published sweep:\r\n\r\n- 3090 (sm_86): factor 1.00 (baseline)\r\n- 4090 (sm_89): factor 0.51\r\n- P40  (sm_61): factor 1.84\r\n\r\nEach node runs its assigned queue serially through our wire protocol; one\r\nThreadPoolExecutor worker per node fires concurrently. First run on our\r\n6-variant p=251 sweep landed 6/6 candidates clean \u2014 aggregate mesh wall\r\n728 ms versus our cost-model estimate of ~120 ms.\r\n\r\nCost-model gap reads as a learning: our per-request overhead floor on\r\ncammy (~600 ms for demo_ops process spawn + Pascal CUDA init) lives\r\noutside our (predicted \u03a3 Toffoli \u00d7 host factor) model. Refinement\r\noptions include a per-host startup constant plus a \u03a3 Toffoli linear\r\nterm, fit per node from our sweep history. Coordinator runs correctly\r\ntoday; schedule shape needs calibration, not algorithmic change.\r\n\r\ncammy ops trail\r\n^^^^^^^^^^^^^^^\r\n\r\nP40 bringup carries a learning trail. Driver mismatch on first probe\r\n(NVML lib 535.309 vs loaded kernel module 535.288, kernel 6.17.0-14\r\nbooted while 6.17.0-35 sat installed with matching driver) cleared\r\nvia reboot into our newer kernel. Ollama auto-restarted on boot &\r\nheld 12 GB VRAM until we disabled its systemd unit; orphan blobs\r\nfrom two deleted models (deepseek-r1, gpt-oss) freed 28 GB on disk.\r\nPascal sm_61 build needed an explicit ``make ARCH=sm_61 demo_ops``\r\noverride (our Makefile default targets sm_86 for 3090). Worker\r\nlaunched against port 8320 same as our other nodes \u2014 same gpu-worker.lsp,\r\nsame launcher pattern, no per-arch fork in lumbda.\r\n\r\nSubstrate now closed-loop\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nEvery piece of an end-to-end research engine sits live:\r\n\r\n- ``lever-variants.lsp`` exposes ``(lever-permutations)`` for arbitrary\r\n  knob cartesians\r\n- ``emit-ops-bin.lsp`` walks any Phase B circuit form into a QECCOPS1\r\n  binary on disk\r\n- ``bend`` dispatches an ops.bin path to whichever fleet worker holds a\r\n  warm CUDA context\r\n- ``demo_ops`` returns \u03a3 Clifford & \u03a3 Toffoli via a portal\r\n- ``dispatch-sweep.py`` auto-resumes against new ``.bin`` files\r\n\r\nEmit pipeline went through two algorithmic rewrites & a Python-tier\r\nprimitive lift after our first p=251 host probe leaked 8 MB/sec to its\r\n``string-append`` tape until ``kill -9``:\r\n\r\n- **Body assembly** switched from an O(N\u00b2) recursive\r\n  ``(string-append acc op-bytes)`` accumulator to a list-of-strings +\r\n  single ``(apply string-append parts)`` pass \u2014 Python-tier emit phase\r\n  dropped 642 sec \u2192 49 sec on a 32 k-op p=11 case.\r\n- **Layout lookups** switched from an alist (linear ``assoc``) to a\r\n  hash-table \u2014 ``qid-of`` now resolves a register reference in O(1).\r\n- **Walk & serialize lifted into lumbda's host language** via two new\r\n  lumbda primitives, ``walk-circuit-ops`` & ``op-specs->bytes``\r\n  (lumbda.com_) \u2014 Python-tier walk dropped 252 sec \u2192 237 ms, serialize\r\n  dropped 49 sec \u2192 84 ms. Per-op Scheme interpreter cost vanishes;\r\n  dispatch by interned-symbol identity in pure Python lives at native\r\n  loop speed.\r\n\r\nEnd-to-end: one Python-tier p=11 emission now lands in ~4 sec wall on\r\nhost, byte-identical against our pre-rewrite reference file. A next\r\nsweep at wider p waits on quantum build cost rather than substrate\r\nplumbing.\r\n\r\n----\r\n\r\nLever-space expansion \u2014 first upstream knob ported\r\n---------------------------------------------------\r\n\r\nUpstream ecdsafail-challenge carries 9 documented levers for\r\nBernstein-Yang inversion (``COMPARE_BITS``, ``WIDTH_MARGIN``,\r\n``WIDTH_SLOPE_X1000``, ``ACTIVE_ITERATIONS``,\r\n``APPLY_CHUNKED_F_CUT``, ``APPLY_CLEAN_COMPARE_BITS``,\r\n``PA9024_COMPARE_SCHEDULE_MARGIN``, ``KAL_DOUBLE_CARRY_TRUNC_W``,\r\n``KAL_FOLD_CARRY_TRUNC_W``). Each lever exposes a different\r\ntruncation, comparison, or chunking parameter inside a Kaliski / B-Y\r\niteration. None of those existed in lumbda's port at session start.\r\n\r\n``*mib-width-margin*`` lands first \u2014 a signed shift on our\r\ntruncation threshold inside ``mib-uv-width`` (mod-inv-by.lsp:1007).\r\nDefault ``0`` reproduces our pre-port schedule byte-for-byte; positive\r\nmargin pulls truncation earlier (more aggressive), negative margin\r\npushes truncation later (more conservative).\r\n\r\nStandalone refined-B-Y sweep at p=251 (n+1=9, a=2):\r\n\r\n=======  =========  =======================================\r\nmargin   toffoli    note\r\n=======  =========  =======================================\r\n\u22123       4 788      +84 vs default (least truncation)\r\n\u22122       4 746      +42\r\n\u22121       4 718      +14\r\n**0**    **4 704**  baseline (default schedule)\r\n+1       4 704      0 (plateau \u2014 same as 0)\r\n+2       CRASH      substrate ceiling\r\n+3       (skipped)\r\n=======  =========  =======================================\r\n\r\nThree findings worth reading separately:\r\n\r\n**Default lever already sits at a local optimum.** Our pre-port\r\nschedule extracts every Toffoli our truncation helpers know how to\r\nextract. No tuning improves on margin=0 within our safe range.\r\n\r\n**Conservative direction costs monotonically.** Each \u22121 step adds\r\n14\u201342 Toffoli. Negative margin gives no win; positive margin gives\r\nno win below our ceiling. So at p=251 our existing schedule held\r\nlucky \u2014 or whoever set those constants knew what they had picked.\r\n\r\n**Positive direction hits a substrate ceiling at margin=+2.** Our\r\nsweep crashed with ``vector-ref out-of-range`` from one of our\r\nwidth-truncation helpers (``is-zero-into!``, ``ctrl-cuccaro-sub!``,\r\n``cswap-reg!``, ``shift-right-reg!`` \u2014 pin to one at next-session\r\ndiagnosis). A width assumption embedded in one of those helpers\r\nfires once truncation drops register width below an implicit floor.\r\nRepairing that helper unlocks aggressive-direction exploration & a\r\nreal margin sweep. Until then this knob carries a [\u22123, +1] safe\r\nrange at p=251.\r\n\r\nWhy this lands first\r\n~~~~~~~~~~~~~~~~~~~~\r\n\r\n``WIDTH_MARGIN`` carried our cheapest substrate edit (signed shift\r\non a width formula). Porting it surfaces our substrate ceiling\r\nwithout committing to multi-helper changes. Next knobs from upstream's\r\n9-lever stack land after we repair our helper \u2014 each subsequent port\r\nbecomes cheap once our truncation helpers handle arbitrary widths.\r\n\r\n----\r\n\r\nLumbda Speedups Engineered For This Race\r\n-----------------------------------------\r\n\r\nOur research substrate has gone through several rounds of targeted\r\noptimization as we push circuit emit & dispatch throughput to a level\r\nwhere wide lever sweeps complete in minutes instead of afternoons. Each\r\nchange earns a measured wall delta on our canonical p=11 32 k-op circuit\r\n\u2014 our smallest scaling-faithful test case \u2014 & survives cross-tier as we\r\nport forward.\r\n\r\nAlgorithmic rewrites (foxhop ecdsa)\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nLever-agnostic. Same wins flow through Python, C tree-walker, & asm\r\ntier identically (commits ``55605d2``, ``f486a74``).\r\n\r\n- **Streaming body assembly** \u2014 emit-ops-bin's accumulator\r\n  switched from an O(N\u00b2) recursive ``(string-append acc op-bytes)`` to a\r\n  list-of-strings + single ``(apply string-append parts)`` pass.\r\n  Python-tier emit phase dropped 642 sec \u2192 49 sec on our 32 k-op case.\r\n  That win holds before any host primitive enters.\r\n- **Hash-table register layout** \u2014 point-add->ops's ``qid-of``\r\n  switched from a linear ``assoc`` over an alist to ``hash-table-ref``\r\n  on a hash-table. O(layout-size) per qubit reference \u2192 O(1).\r\n- **Cross-tier portability** \u2014 ``(string char)`` swapped to\r\n  ``(make-string 1 char)`` since our C-tier built-in set lacks\r\n  ``string``. Without that swap C-tier emit fails at parse with\r\n  ``undefined: string``.\r\n\r\nPython-tier host primitives (lumbda)\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThree primitives (lumbda commit ``99701c8``) lift our emit pipeline out\r\nof our Scheme tree-walker. Each dispatches by interned-symbol identity\r\nin pure Python, packs binary fields via ``struct.Struct.pack``, & returns\r\nScheme-native lists / vectors. Per-iteration interpreter overhead\r\nvanishes; native loop speed replaces it.\r\n\r\n============================  ===========  ==========  ========  ====================================\r\nprimitive                     pre-Scheme   post-host   speedup   replaces\r\n============================  ===========  ==========  ========  ====================================\r\n``walk-circuit-ops``          252 sec      237 ms      1060\u00d7     emit-ops-bin's let-walk dispatch loop\r\n``op-specs->bytes``           49 sec       84 ms       580\u00d7      per-op string-append encoder\r\n``count-lumbda-ops``          ~200 sec     <50 ms      4000\u00d7+    pure-Scheme tag tally\r\n============================  ===========  ==========  ========  ====================================\r\n\r\nC-tier port \u2014 landed\r\n~~~~~~~~~~~~~~~~~~~~~\r\n\r\n``bi_walk_circuit_ops``, ``bi_op_specs_to_bytes``, ``bi_count_lumbda_ops``\r\nship in lumbda's ``c/builtins.c``. Direct translation of our Python\r\nalgorithm: hash-table layout via ``ht_set / ht_ref``, ``make_vector_from``\r\nfor op-spec records, hand-written little-endian byte packing in\r\n``pack_u64_slot``. ``VAL_FALSE`` carries our \"no slot\" sentinel inside\r\nop-spec vectors since C-tier fixnums cap at 48 bits & cannot hold\r\nNO_SLOT = 2\u2076\u2074\u22121 directly; ``op-specs->bytes`` writes\r\n``0xFFFFFFFFFFFFFFFF`` whenever it sees ``VAL_FALSE``.\r\n\r\nC-tier measurement (lumbda-c inside QEMU guest, same p=11 textbook+refined\r\npair our Python baseline ran):\r\n\r\n============  =========  =========  ============================\r\ntier          wall       speedup    note\r\n============  =========  =========  ============================\r\nPython        6.9 sec    baseline   walk+emit primitives lifted\r\nC tier        0.71 sec   **9.7\u00d7**   same primitives in native C\r\n============  =========  =========  ============================\r\n\r\nOutput verified byte-identical against our Python-tier reference files\r\nvia ``cmp`` on both textbook & refined paths.\r\n\r\nAsm-tier port \u2014 deferred\r\n~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nLumbda's asm tier ``lumbda-full`` (mark-sweep GC) delivers a 160\u00d7\r\nspeedup over Python on portal round-trip per lumbda's whitepaper \u00a76.6.4\r\n(six-point-six-point-four), serving our **bulk 9024-shot validation**\r\nworkload \u2014 simulator runs shots against an emitted ops.bin, not emit\r\nitself. Our emit pipeline targets Python tier (dev iteration) & C tier\r\ninside QEMU (production scale); asm tier consumes ops.bin, doesn't\r\nproduce it.\r\n\r\nPorting our three primitives into ``asm/lumbda.s`` would land roughly\r\n700-900 lines of hand-written x86_64 asm \u2014 hash-table mutation, list\r\ntraversal, vector construction with 7 slots, dispatch across 9 op\r\ntags \u2014 plus QEMU debug cycles. Two- to four-day effort matched against\r\nno current workflow that calls our primitives from an asm-tier process.\r\nPort lands when an asm-tier emit consumer materializes; until then our\r\nPython + C tier coverage saturates our pipeline.\r\n\r\nEnd-to-end measurement\r\n~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nOur canonical p=11 textbook+refined emit pair journey:\r\n\r\n==========================  ==========  ===========\r\nsubstrate                   wall        speedup\r\n==========================  ==========  ===========\r\npre-rewrite Python tier     ~10 min     baseline\r\npost-algorithmic rewrites   ~7 min      ~1.4\u00d7\r\npost-Python primitive lift  6.9 sec     ~85\u00d7\r\npost-C-tier port            0.71 sec    **~830\u00d7**\r\n==========================  ==========  ===========\r\n\r\nByte-identical output verified by ``cmp`` at every step. C tier matches\r\nPython tier byte-for-byte across both textbook & refined paths.\r\n\r\n----\r\n\r\nWhy CPU Produces & GPU Scores\r\n-------------------------------\r\n\r\nOur pipeline splits across two distinct hardware classes for reasons\r\nthat fall out of each step's structure.\r\n\r\nCandidate production runs on CPU\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nBuilding a reversible quantum circuit threads through a sequential\r\ndependency chain \u2014 each emitted gate references a hash-table layout\r\nthat every previous gate has mutated, every register allocation grows\r\na qubit-base counter consumed by everything downstream. Branchy\r\ncontrol flow & irregular memory access characterize our build phase:\r\ndispatch on op tag, lookup register in a hash table, cons onto a list,\r\nallocate a 7-slot vector, repeat across ~80 000 ops per candidate.\r\n\r\nGPUs starve on patterns like that. CUDA warps run 32 threads in\r\nlockstep; dispatch divergence \u2014 one thread executing a CCX branch\r\nwhile another walks an alloc branch \u2014 collapses our occupancy.\r\nLayouts & lists live in irregular memory; coalesced DRAM accesses\r\nrequire neighboring threads to touch adjacent addresses, which our\r\nhash-table mutations never do.\r\n\r\nCPUs handle exactly this pattern at native loop speed. Inside our\r\n2-vCPU QEMU guest, lumbda's C tree-walker carries our three host\r\nprimitives (``walk-circuit-ops``, ``op-specs->bytes``,\r\n``count-lumbda-ops``) at **~3.6 million native operations / second\r\non one thread** \u2014 one full candidate (~80 K op-spec records,\r\n~4.5 MB QECCOPS1 binary) finishes inside 350 ms. Per-candidate work\r\nscales roughly with circuit width: ~n\u00b2 at our Solinas mod-mul, ~n\r\nat our Bernstein-Yang inverse.\r\n\r\nCandidate scoring runs on GPU\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nScoring runs 64\u20131024 reversible shots against one candidate. Each\r\nshot starts with an independent input bit pattern, walks our same\r\nops.bin forward, & reports \u03a3 Toffoli & \u03a3 Clifford counts. Shots run\r\nwholly independent of each other \u2014 SIMT-perfect (single instruction\r\nmultiple thread, Nvidia's GPU execution model). Our ``demo_ops``\r\nkernel on a 3090 saturates at **~220\u2013250 Mops / second** consuming a\r\ncandidate in 8.8 ms for 1024 shots.\r\n\r\nA single CPU thread walking one shot at a time runs ~50 ms for that\r\nsame 1024-shot \u00d7 32 K-op workload \u2014 6\u00d7 slower than one 3090. Across\r\nour fleet (3090-ai, ai/4090, cammy P40, guile bulk), multi-GPU\r\nfan-out compounds on top.\r\n\r\nWhy our split matters now\r\n~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nBefore this session our emit phase ran at ~4 300 lumbda ops / second\r\ninside our Scheme tree-walker. A 3090 consuming Mops / second sat\r\nidle waiting for candidates. Now our emit primitives push 3.6M ops /\r\nsecond per CPU thread. A single CPU still trails a single 3090 by\r\n~60\u00d7 on raw op throughput, so multi-CPU production keeps GPU work\r\nflowing \u2014 saturation reaches matched throughput at roughly 60 CPU\r\nthreads per 3090. Our fleet's spare CPU on every GPU box (~12 vCPU\r\nper node, four nodes live) sits well above that ratio, which makes\r\nmulti-GPU fan-out throughput-meaningful rather than theoretical.\r\n\r\nWhat stays balanced. CPU produces ~3 candidates / second / thread;\r\none 3090 scores ~7.5 candidates / second at saturation (1024 shots \u00d7\r\n32 K ops). Three CPU threads keep one GPU fed; our 12-vCPU node\r\nkeeps four GPUs fed; our fleet covers a 16-GPU-equivalent ceiling\r\nbefore emit becomes our bottleneck again.\r\n\r\n----\r\n\r\nForm D Structural Finding \u2014 2026-06-05\r\n---------------------------------------\r\n\r\n``cuda-clifford-stabilizer`` as originally scoped on our bend catalog\r\n(`lumbda.com/bend <https://lumbda.com/bend.html>`__) does not apply to a\r\npoint-addition circuit. Build agent measured Toffoli fraction at 13.87 %\r\n(well under a 40 % stabilizer-win threshold), then noticed our circuit\r\ncarries no Hadamard or S gates \u2014 only X (Pauli-X), CX (controlled-X), CCX\r\n(Toffoli), CZ, CCZ, SWAP, R, HMR, Z, & NEG. State never leaves a\r\ncomputational basis. Aaronson-Gottesman tableau compression buys nothing\r\nwhen superposition does not exist; it reduces to exactly what a per-shot\r\nkernel already does, at one bit per qubit per shot.\r\n\r\nTwo replacement directions landed 2026-06-05; both pivots converged on one\r\ndiagnosis.\r\n\r\n**Axis-flip refactor** (per-candidate parallel kickmix sim) \u2014 DONE\r\n(foxhop commit ``1f7ac9d``). 217 Mops/s (mega-ops per second) at K=32 M=4\r\non a RTX 3090; 23.7\u00d7 (times) over per-shot N=4 at same M. Both kernels\r\nsaturate at ~220\u2013250 Mops/s. Axis-flip's win comes from\r\noccupancy-amortization, not bandwidth redistribution. Right tool for a\r\nmany-candidates \u00d7 few-shots search-loop early-screen pattern.\r\n\r\n**QECCOPS2 packed ops.bin** \u2014 DONE (foxhop commit ``90484ca``). 1.07\u00d7\r\nkernel speedup, 2.33\u00d7 on-disk shrink (716 MB \u2192 307 MB). Our original 3.5\u00d7\r\nprojection assumed 56 B/op stayed VRAM-resident; ``ops_loader.c`` already\r\nnarrowed to 28 B on load, so realistic ceiling sat at 1.17\u00d7. Per-shot\r\nstate traffic (qubits + bits per thread) dominates kernel bandwidth ~85\u00d7\r\nover op stream.\r\n\r\n**Diagnosis:** 3090 saturates compute at ~250 Mops/s on a kickmix circuit,\r\nnot bandwidth. Next macro-lever: multi-GPU fan-out across our fleet\r\n(3090-ai, ai/4090, cammy P40, guile CPU bulk).\r\n\r\n----\r\n\r\nMeasured Numbers \u2014 RTX 3090\r\n----------------------------\r\n\r\nAgainst HEAD's 12.8 M-op kickmix ``ops.bin`` (716 MB) via bend:\r\n\r\n=========  ======  =======  =======  =======  ===========\r\nn_batches  shots   wire-s   cpu-ms   gpu-ms   gpu/cpu\r\n=========  ======  =======  =======  =======  ===========\r\n1          64      5.5      42       5 107    0.008\r\n16         1 024   7.3      850      5 800    0.146\r\n64         4 096   11.4     3 444    6 216    0.553\r\n128        8 192   17.1     7 060    6 604    **1.07**\r\n=========  ======  =======  =======  =======  ===========\r\n\r\nCrossover at ~115 batches. GPU kernel carries ~5 070 ms fixed overhead\r\n(init + alloc + upload) plus ~12 ms per batch; CPU runs ~55 ms per batch.\r\nConditional ops in a kickmix circuit cause branch divergence \u2014 one form\r\nwhere GPU does not dominate at small batch counts.\r\n\r\nHonest signal, not hype.\r\n\r\n----\r\n\r\nWhat Lives Where\r\n----------------\r\n\r\n- **Lab repo (private)** \u2014 lumbda source for our attack, circuit build /\r\n  sim / score / candidate sweep, QEMU envelope around C-tier & asm-tier\r\n  runs, run artifacts under ``runs/lumbda-*/``\r\n- **Bend catalog & wire protocol** \u2014 `lumbda.com/bend\r\n  <https://lumbda.com/bend.html>`__\r\n- **Upstream challenge** \u2014 `ecdsafail/ecdsafail-challenge\r\n  <https://github.com/ecdsafail/ecdsafail-challenge>`__\r\n- **Lineage** \u2014 `Google Quantum AI \u00b7 ECC quantum vulnerabilities\r\n  <https://research.google>`__ (Zenodo dataset 19597130, March 2026)\r\n\r\n----\r\n\r\nPareto Frontier We Aim To Beat\r\n-------------------------------\r\n\r\nUpstream README reports two Google private Pareto points sitting below a\r\ntextbook 1.07 \u00d7 10\u00b9\u2070 score; upstream claims both points sit strictly\r\nbeatable.\r\n\r\n==========================================  ==================  ===========  ============\r\nVariant                                     Toffoli (avg/shot)  Peak qubits  Score\r\n==========================================  ==================  ===========  ============\r\nChallenge initial circuit (textbook)        3 942 753           2 715        1.07 \u00d7 10\u00b9\u2070\r\nGoogle private, low-qubit Pareto point      2 700 000           1 175        3.2  \u00d7 10\u2079\r\nGoogle private, low-gate Pareto point       2 100 000           1 425        3.0  \u00d7 10\u2079\r\n==========================================  ==================  ===========  ============\r\n\r\nOur lumbda-tier validation gates each variant against byte-identical\r\ncross-tier portals before we ever spend Rust submission budget against\r\n9024 Fiat-Shamir-derived test points.\r\n\r\n----\r\n\r\nWhy Track This Publicly\r\n-----------------------\r\n\r\nA challenge of this shape rewards aggressive, asymmetric search. Every\r\nfactor of two off a Toffoli count, every qubit shaved off peak width,\r\nmultiplies straight through Shor's algorithm. Documenting our path\r\npublicly \u2014 what we tried, what saturated, what surprised us \u2014\r\ncontributes intellectual capital to a commons that has historically locked\r\nthis work behind paid lab pages.\r\n\r\nThis page tracks public-facing progress only. Detail logs, asm-tier safety\r\nenvelopes, & raw run artifacts stay in our lab repo.\r\n\r\n----\r\n\r\n| *Updated 2026-06-06.*\r\n| *Cross-post anchor for lumbda.com/bend & external links.*", "source_format": "rst", "revision_number": 5, "created": 1780841091761}, {"id": "0e1cb332-6274-11f1-97ac-040140774501", "node_id": "5243e3fe-6146-11f1-8ce9-040140774501", "user_id": "680aec8e-3391-11f1-95d9-040140774501", "author": "russell", "data": ".. ecdsa.rst \u2014 public wiki page for https://www.foxhop.net/ecdsa\r\n.. CC0 / public domain content; lumbda runtime AGPLv3\r\n.. foxhop \u00b7 agent blackops \u00b7 2026-06-05\r\n\r\nsecp256k1 Point-Addition Challenge \u2014 Lumbda Attack\r\n====================================================\r\n\r\n| **Author:** foxhop \u00b7 agent blackops\r\n| **Started:** 2026-06-04\r\n| **Status:** Phase B reversible arithmetic landed; first lever sweep measured at p=11; no upstream submission yet\r\n| **Upstream challenge:** ecdsa.fail_ (Eigen Labs \u00b7 Google Quantum AI lineage)\r\n| **Substrate:** lumbda.com_\r\n\r\n.. _ecdsa.fail: https://ecdsa.fail\r\n.. _lumbda.com: https://lumbda.com\r\n\r\n----\r\n\r\n.. contents::\r\n   :depth: 2\r\n   :local:\r\n\r\n----\r\n\r\nWhat This Page Tracks\r\n---------------------\r\n\r\nA quantum-reversible attack on a secp256k1 point addition, written entirely in\r\nlumbda \u2014 a Lisp/Scheme derivative across four implementation tiers: Python\r\nbytecode VM, C tree-walker + JIT, C + x86_64 JIT, & pure x86_64 assembly.\r\nLumbda's docs & live runtimes sit at lumbda.com_; this page covers our attack\r\nitself, scored by Toffoli count \u00d7 peak qubit width.\r\n\r\nLower score wins. Every factor of two saved at point addition multiplies straight\r\nthrough Shor's algorithm into a factor of two off our resource estimate for\r\ncracking secp256k1 \u2014 a curve that protects Bitcoin & Ethereum.\r\n\r\n----\r\n\r\nWhere This Work Lives in Our Stack\r\n-----------------------------------\r\n\r\necdsa.fail (an Eigen Labs challenge sponsored by Eigen Labs, descended from\r\nGoogle Quantum AI's *Securing Elliptic Curve Cryptocurrencies against Quantum\r\nVulnerabilities*, March 2026) accepts Rust submissions only \u2014 that defines a\r\ncontract format, not our research substrate. Our search runs in lumbda; Rust\r\nonly ever sees a final, validated circuit at submission time.\r\n\r\nWhy lumbda \u2014 four reasons:\r\n\r\n- **Cross-tier portal validation.** Every variant emits an identical result\r\n  S-expression across Python, C tree-walker, & asm. Byte-mismatch on any tier\r\n  halts promotion to a next phase. Rust gives us one tier with no cross-tier\r\n  check.\r\n- **Fleet sharding via TCP + S-expression portals.** Lumbda hands candidate\r\n  evaluation across spare CPU on our GPU boxes; Rust carries no equivalent\r\n  without bespoke distribution code.\r\n- **A CUDA path already exists.** Our ``bend`` primitive on lumbda.com_\r\n  dispatches GPU work over a binary wire (magic ``BSHK``). Bend hands lumbda's\r\n  upstream-format ``ops.bin`` to a CUDA worker, receives \u03a3 (sigma, sum-of)\r\n  Clifford & \u03a3 Toffoli totals back \u2014 same byte-identical portal contract our\r\n  hash demo proves.\r\n- **Future CUDA growth feeds back.** Porting upstream's Rust simulator to CUDA\r\n  costs multi-week with one-shot payoff. Growing lumbda's tier ladder costs\r\n  less & feeds every other lumbda workload.\r\n\r\n----\r\n\r\nPhase B \u2014 Reversible Arithmetic Landed\r\n---------------------------------------\r\n\r\nTwelve steps after Roetteler et al. (2017), modular arithmetic over secp256k1's\r\nprime field, lumbda-native:\r\n\r\n- **Steps 1\u20138** \u2014 modular add, subtract, multiply, square, inverse\r\n  (Bernstein-Yang safegcd flavor), exponentiation\r\n- **Steps 9\u201310** \u2014 refined Bernstein-Yang modular inverse wired into a real\r\n  point-addition circuit\r\n- **emit-ops.bin walker** \u2014 lumbda \u2192 (to) upstream QECCOPS1 binary format,\r\n  full kind table 0..17 coverage, cross-validated against demo_ops\r\n  byte-identical on a real round trip\r\n\r\nCross-tier validated on Python tier. C-tier & asm-tier escalation routes\r\nthrough a QEMU guest (``ecdsa/vm-runner.sh``) \u2014 host policy locked after a\r\n2026-06-03 C-tier OOM crash. Asm-tier carries no default garbage collector;\r\nthree prior neoblanka crashes (2026-04-16, 2026-04-17, 2026-06-03) cemented\r\nper-tier escalation rules. See lumbda's CLAUDE shard on asm memory\r\ndiscipline.\r\n\r\n----\r\n\r\nFirst Lever Sweep \u2014 2026-06-05/06\r\n-----------------------------------\r\n\r\nA six-variant cartesian product of our active Phase B knobs, scored at\r\np=11 n+1=5 (point-add width small enough to fit a full sweep into one\r\nafternoon of CPU) through our closed-loop pipeline:\r\n\r\n::\r\n\r\n   lever-variants.lsp  \u2192  emit-ops-bin walker  \u2192  /tmp/variant-N.bin\r\n                                                          \u2193\r\n                                  bend wire \u2192 3090-ai gpu-worker\r\n                                                          \u2193\r\n                                       demo_ops portal \u2192 results.tsv\r\n\r\nThree boolean Phase B knobs surveyed produce six structurally distinct\r\ncircuits (refined-B-Y collapses when B-Y itself stays off):\r\n\r\n==  =========  =============  ======  ============  ===========\r\nid  mul       inv             n_ops   \u03a3 Toffoli     vs default\r\n==  =========  =============  ======  ============  ===========\r\n5   solinas    refined-B-Y    32 333  **475 648**   **\u221265.2 %**\r\n2   litinski   refined-B-Y    34 468  518 656       \u221262.0 %\r\n4   solinas    textbook-B-Y   48 763  749 056       \u221245.1 %\r\n1   litinski   textbook-B-Y   50 898  792 064       \u221242.0 %\r\n3   solinas    Fermat         77 439  1 027 584     \u221224.7 %\r\n0   litinski   Fermat (def.)  94 214  1 365 504     0.0 %\r\n==  =========  =============  ======  ============  ===========\r\n\r\n**Headline:** combined Solinas mod-mul + refined Bernstein-Yang mod-inv\r\ncuts \u03a3 Toffoli by 65.2 % versus our default lever stack (Litinski\r\nschoolbook mod-mul + Fermat inversion).\r\n\r\nKnob attribution\r\n~~~~~~~~~~~~~~~~~\r\n\r\n*Inversion knob* (refined-B-Y vs Fermat) dominates:\r\n\r\n- at Litinski mod-mul: 1 365 504 \u2192 518 656 = **\u221262.0 %**\r\n- at Solinas mod-mul:  1 027 584 \u2192 475 648 = **\u221253.7 %**\r\n\r\n*Multiplication knob* (Solinas vs Litinski) carries a non-additive\r\ninteraction with inv-knob choice:\r\n\r\n- at Fermat:        1 365 504 \u2192 1 027 584 = **\u221224.7 %**\r\n- at textbook-B-Y:    792 064 \u2192   749 056 =  \u22125.4 %\r\n- at refined-B-Y:     518 656 \u2192   475 648 =  \u22128.3 %\r\n\r\nFermat does repeated mod-muls so a faster mod-mul compounds; Bernstein-Yang\r\ncarries mod-mul-light arithmetic so a mul-knob contribution fades.\r\n**\u221262 % combined with \u22128 % rounds to \u221265 % rather than \u221270 %** \u2014 exactly\r\nour observed math.\r\n\r\nCross-scale prediction check\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nA small-fixture screen (p=5, n+1=4) ran during lever-space discovery\r\npredicted refined-B-Y at roughly \u221256 %; an independent p=251 ground-truth\r\nreference predicted \u221240 %. Our p=11 measurement landed at \u221236.5 % within a\r\nSolinas branch \u2014 within three percentage points of our p=251 prediction.\r\n**A cheap small-width screen survives a scale jump faithfully**, which\r\nlets future runs sweep wide at p=11 first, filter to winners, then spend\r\nexpensive p=251 budget only on a short list.\r\n\r\nA standalone refined-B-Y modular inverse at an intermediate width\r\n(n+1=13, p=4093 = 2\u00b9\u00b2 \u2212 3 Solinas-form) lands 12 908 Toffoli \u2014 a 2.74\u00d7\r\nmultiplier over our n+1=9 datapoint of 4 704. Theoretical n\u00b2 scaling\r\n(13/9)\u00b2 = 2.09; observed sits modestly above, consistent with width-\r\ndependent Solinas reduction overhead growing slower than n\u00b2. A separate\r\nclassical-helper probe at full secp256k1 width (p = 2\u00b2\u2075\u2076 \u2212 2\u00b3\u00b2 \u2212 977,\r\n77-digit prime) ran ``classical-mod-inv`` against a small input &\r\nroundtripped through 7 \u00d7 inv mod p = 1 \u2014 our build-time classical\r\nmachinery survives 256-bit Python bignums; only an emit-side substrate\r\nupgrade gates a full quantum build at that width.\r\n\r\nEnd-to-end GPU timing \u2014 refined vs textbook B-Y\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nOur refined-B-Y ``ops.bin`` for one p=11 point-add ran on a 3090-ai\r\n``gpu-worker`` against ``demo_ops`` for direct head-to-head wall measurement:\r\n\r\n==============  ===========  =========  =====================\r\npath            \u03a3 Toffoli    qec ops    GPU wall (1024 shots)\r\n==============  ===========  =========  =====================\r\ntextbook B-Y    11 704       48 763     14.4 ms\r\nrefined  B-Y     7 432       32 333      **8.8 ms**\r\n==============  ===========  =========  =====================\r\n\r\nRefined cuts 36.5 % off \u03a3 Toffoli (knob-attribution row) & shows up as\r\n**39 % GPU wall reduction at one shot batch** on real silicon. Step 10\r\nlands at our hardware layer & not only on a Scheme counter.\r\n\r\nSubstrate now closed-loop\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nEvery piece of an end-to-end research engine sits live:\r\n\r\n- ``lever-variants.lsp`` exposes ``(lever-permutations)`` for arbitrary\r\n  knob cartesians\r\n- ``emit-ops-bin.lsp`` walks any Phase B circuit form into a QECCOPS1\r\n  binary on disk\r\n- ``bend`` dispatches an ops.bin path to whichever fleet worker holds a\r\n  warm CUDA context\r\n- ``demo_ops`` returns \u03a3 Clifford & \u03a3 Toffoli via a portal\r\n- ``dispatch-sweep.py`` auto-resumes against new ``.bin`` files\r\n\r\nEmit pipeline went through two algorithmic rewrites & a Python-tier\r\nprimitive lift after our first p=251 host probe leaked 8 MB/sec to its\r\n``string-append`` tape until ``kill -9``:\r\n\r\n- **Body assembly** switched from an O(N\u00b2) recursive\r\n  ``(string-append acc op-bytes)`` accumulator to a list-of-strings +\r\n  single ``(apply string-append parts)`` pass \u2014 Python-tier emit phase\r\n  dropped 642 sec \u2192 49 sec on a 32 k-op p=11 case.\r\n- **Layout lookups** switched from an alist (linear ``assoc``) to a\r\n  hash-table \u2014 ``qid-of`` now resolves a register reference in O(1).\r\n- **Walk & serialize lifted into lumbda's host language** via two new\r\n  lumbda primitives, ``walk-circuit-ops`` & ``op-specs->bytes``\r\n  (lumbda.com_) \u2014 Python-tier walk dropped 252 sec \u2192 237 ms, serialize\r\n  dropped 49 sec \u2192 84 ms. Per-op Scheme interpreter cost vanishes;\r\n  dispatch by interned-symbol identity in pure Python lives at native\r\n  loop speed.\r\n\r\nEnd-to-end: one Python-tier p=11 emission now lands in ~4 sec wall on\r\nhost, byte-identical against our pre-rewrite reference file. A next\r\nsweep at wider p waits on quantum build cost rather than substrate\r\nplumbing.\r\n\r\n----\r\n\r\nLumbda Speedups Engineered For This Race\r\n-----------------------------------------\r\n\r\nOur research substrate has gone through several rounds of targeted\r\noptimization as we push circuit emit & dispatch throughput to a level\r\nwhere wide lever sweeps complete in minutes instead of afternoons. Each\r\nchange earns a measured wall delta on our canonical p=11 32 k-op circuit\r\n\u2014 our smallest scaling-faithful test case \u2014 & survives cross-tier as we\r\nport forward.\r\n\r\nAlgorithmic rewrites (foxhop ecdsa)\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nLever-agnostic. Same wins flow through Python, C tree-walker, & asm\r\ntier identically (commits ``55605d2``, ``f486a74``).\r\n\r\n- **Streaming body assembly** \u2014 emit-ops-bin's accumulator\r\n  switched from an O(N\u00b2) recursive ``(string-append acc op-bytes)`` to a\r\n  list-of-strings + single ``(apply string-append parts)`` pass.\r\n  Python-tier emit phase dropped 642 sec \u2192 49 sec on our 32 k-op case.\r\n  That win holds before any host primitive enters.\r\n- **Hash-table register layout** \u2014 point-add->ops's ``qid-of``\r\n  switched from a linear ``assoc`` over an alist to ``hash-table-ref``\r\n  on a hash-table. O(layout-size) per qubit reference \u2192 O(1).\r\n- **Cross-tier portability** \u2014 ``(string char)`` swapped to\r\n  ``(make-string 1 char)`` since our C-tier built-in set lacks\r\n  ``string``. Without that swap C-tier emit fails at parse with\r\n  ``undefined: string``.\r\n\r\nPython-tier host primitives (lumbda)\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThree primitives (lumbda commit ``99701c8``) lift our emit pipeline out\r\nof our Scheme tree-walker. Each dispatches by interned-symbol identity\r\nin pure Python, packs binary fields via ``struct.Struct.pack``, & returns\r\nScheme-native lists / vectors. Per-iteration interpreter overhead\r\nvanishes; native loop speed replaces it.\r\n\r\n============================  ===========  ==========  ========  ====================================\r\nprimitive                     pre-Scheme   post-host   speedup   replaces\r\n============================  ===========  ==========  ========  ====================================\r\n``walk-circuit-ops``          252 sec      237 ms      1060\u00d7     emit-ops-bin's let-walk dispatch loop\r\n``op-specs->bytes``           49 sec       84 ms       580\u00d7      per-op string-append encoder\r\n``count-lumbda-ops``          ~200 sec     <50 ms      4000\u00d7+    pure-Scheme tag tally\r\n============================  ===========  ==========  ========  ====================================\r\n\r\nC-tier port \u2014 landed\r\n~~~~~~~~~~~~~~~~~~~~~\r\n\r\n``bi_walk_circuit_ops``, ``bi_op_specs_to_bytes``, ``bi_count_lumbda_ops``\r\nship in lumbda's ``c/builtins.c``. Direct translation of our Python\r\nalgorithm: hash-table layout via ``ht_set / ht_ref``, ``make_vector_from``\r\nfor op-spec records, hand-written little-endian byte packing in\r\n``pack_u64_slot``. ``VAL_FALSE`` carries our \"no slot\" sentinel inside\r\nop-spec vectors since C-tier fixnums cap at 48 bits & cannot hold\r\nNO_SLOT = 2\u2076\u2074\u22121 directly; ``op-specs->bytes`` writes\r\n``0xFFFFFFFFFFFFFFFF`` whenever it sees ``VAL_FALSE``.\r\n\r\nC-tier measurement (lumbda-c inside QEMU guest, same p=11 textbook+refined\r\npair our Python baseline ran):\r\n\r\n============  =========  =========  ============================\r\ntier          wall       speedup    note\r\n============  =========  =========  ============================\r\nPython        6.9 sec    baseline   walk+emit primitives lifted\r\nC tier        0.71 sec   **9.7\u00d7**   same primitives in native C\r\n============  =========  =========  ============================\r\n\r\nOutput verified byte-identical against our Python-tier reference files\r\nvia ``cmp`` on both textbook & refined paths.\r\n\r\nAsm-tier port \u2014 deferred\r\n~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nLumbda's asm tier ``lumbda-full`` (mark-sweep GC) delivers a 160\u00d7\r\nspeedup over Python on portal round-trip per lumbda's whitepaper \u00a76.6.4\r\n(six-point-six-point-four), serving our **bulk 9024-shot validation**\r\nworkload \u2014 simulator runs shots against an emitted ops.bin, not emit\r\nitself. Our emit pipeline targets Python tier (dev iteration) & C tier\r\ninside QEMU (production scale); asm tier consumes ops.bin, doesn't\r\nproduce it.\r\n\r\nPorting our three primitives into ``asm/lumbda.s`` would land roughly\r\n700-900 lines of hand-written x86_64 asm \u2014 hash-table mutation, list\r\ntraversal, vector construction with 7 slots, dispatch across 9 op\r\ntags \u2014 plus QEMU debug cycles. Two- to four-day effort matched against\r\nno current workflow that calls our primitives from an asm-tier process.\r\nPort lands when an asm-tier emit consumer materializes; until then our\r\nPython + C tier coverage saturates our pipeline.\r\n\r\nEnd-to-end measurement\r\n~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nOur canonical p=11 textbook+refined emit pair journey:\r\n\r\n==========================  ==========  ===========\r\nsubstrate                   wall        speedup\r\n==========================  ==========  ===========\r\npre-rewrite Python tier     ~10 min     baseline\r\npost-algorithmic rewrites   ~7 min      ~1.4\u00d7\r\npost-Python primitive lift  6.9 sec     ~85\u00d7\r\npost-C-tier port            0.71 sec    **~830\u00d7**\r\n==========================  ==========  ===========\r\n\r\nByte-identical output verified by ``cmp`` at every step. C tier matches\r\nPython tier byte-for-byte across both textbook & refined paths.\r\n\r\n----\r\n\r\nWhy CPU Produces & GPU Scores\r\n-------------------------------\r\n\r\nOur pipeline splits across two distinct hardware classes for reasons\r\nthat fall out of each step's structure.\r\n\r\nCandidate production runs on CPU\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nBuilding a reversible quantum circuit threads through a sequential\r\ndependency chain \u2014 each emitted gate references a hash-table layout\r\nthat every previous gate has mutated, every register allocation grows\r\na qubit-base counter consumed by everything downstream. Branchy\r\ncontrol flow & irregular memory access characterize our build phase:\r\ndispatch on op tag, lookup register in a hash table, cons onto a list,\r\nallocate a 7-slot vector, repeat across ~80 000 ops per candidate.\r\n\r\nGPUs starve on patterns like that. CUDA warps run 32 threads in\r\nlockstep; dispatch divergence \u2014 one thread executing a CCX branch\r\nwhile another walks an alloc branch \u2014 collapses our occupancy.\r\nLayouts & lists live in irregular memory; coalesced DRAM accesses\r\nrequire neighboring threads to touch adjacent addresses, which our\r\nhash-table mutations never do.\r\n\r\nCPUs handle exactly this pattern at native loop speed. Inside our\r\n2-vCPU QEMU guest, lumbda's C tree-walker carries our three host\r\nprimitives (``walk-circuit-ops``, ``op-specs->bytes``,\r\n``count-lumbda-ops``) at **~3.6 million native operations / second\r\non one thread** \u2014 one full candidate (~80 K op-spec records,\r\n~4.5 MB QECCOPS1 binary) finishes inside 350 ms. Per-candidate work\r\nscales roughly with circuit width: ~n\u00b2 at our Solinas mod-mul, ~n\r\nat our Bernstein-Yang inverse.\r\n\r\nCandidate scoring runs on GPU\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nScoring runs 64\u20131024 reversible shots against one candidate. Each\r\nshot starts with an independent input bit pattern, walks our same\r\nops.bin forward, & reports \u03a3 Toffoli & \u03a3 Clifford counts. Shots run\r\nwholly independent of each other \u2014 SIMT-perfect (single instruction\r\nmultiple thread, Nvidia's GPU execution model). Our ``demo_ops``\r\nkernel on a 3090 saturates at **~220\u2013250 Mops / second** consuming a\r\ncandidate in 8.8 ms for 1024 shots.\r\n\r\nA single CPU thread walking one shot at a time runs ~50 ms for that\r\nsame 1024-shot \u00d7 32 K-op workload \u2014 6\u00d7 slower than one 3090. Across\r\nour fleet (3090-ai, ai/4090, cammy P40, guile bulk), multi-GPU\r\nfan-out compounds on top.\r\n\r\nWhy our split matters now\r\n~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nBefore this session our emit phase ran at ~4 300 lumbda ops / second\r\ninside our Scheme tree-walker. A 3090 consuming Mops / second sat\r\nidle waiting for candidates. Now our emit primitives push 3.6M ops /\r\nsecond per CPU thread. A single CPU still trails a single 3090 by\r\n~60\u00d7 on raw op throughput, so multi-CPU production keeps GPU work\r\nflowing \u2014 saturation reaches matched throughput at roughly 60 CPU\r\nthreads per 3090. Our fleet's spare CPU on every GPU box (~12 vCPU\r\nper node, four nodes live) sits well above that ratio, which makes\r\nmulti-GPU fan-out throughput-meaningful rather than theoretical.\r\n\r\nWhat stays balanced. CPU produces ~3 candidates / second / thread;\r\none 3090 scores ~7.5 candidates / second at saturation (1024 shots \u00d7\r\n32 K ops). Three CPU threads keep one GPU fed; our 12-vCPU node\r\nkeeps four GPUs fed; our fleet covers a 16-GPU-equivalent ceiling\r\nbefore emit becomes our bottleneck again.\r\n\r\n----\r\n\r\nForm D Structural Finding \u2014 2026-06-05\r\n---------------------------------------\r\n\r\n``cuda-clifford-stabilizer`` as originally scoped on our bend catalog\r\n(`lumbda.com/bend <https://lumbda.com/bend.html>`__) does not apply to a\r\npoint-addition circuit. Build agent measured Toffoli fraction at 13.87 %\r\n(well under a 40 % stabilizer-win threshold), then noticed our circuit\r\ncarries no Hadamard or S gates \u2014 only X (Pauli-X), CX (controlled-X), CCX\r\n(Toffoli), CZ, CCZ, SWAP, R, HMR, Z, & NEG. State never leaves a\r\ncomputational basis. Aaronson-Gottesman tableau compression buys nothing\r\nwhen superposition does not exist; it reduces to exactly what a per-shot\r\nkernel already does, at one bit per qubit per shot.\r\n\r\nTwo replacement directions landed 2026-06-05; both pivots converged on one\r\ndiagnosis.\r\n\r\n**Axis-flip refactor** (per-candidate parallel kickmix sim) \u2014 DONE\r\n(foxhop commit ``1f7ac9d``). 217 Mops/s (mega-ops per second) at K=32 M=4\r\non a RTX 3090; 23.7\u00d7 (times) over per-shot N=4 at same M. Both kernels\r\nsaturate at ~220\u2013250 Mops/s. Axis-flip's win comes from\r\noccupancy-amortization, not bandwidth redistribution. Right tool for a\r\nmany-candidates \u00d7 few-shots search-loop early-screen pattern.\r\n\r\n**QECCOPS2 packed ops.bin** \u2014 DONE (foxhop commit ``90484ca``). 1.07\u00d7\r\nkernel speedup, 2.33\u00d7 on-disk shrink (716 MB \u2192 307 MB). Our original 3.5\u00d7\r\nprojection assumed 56 B/op stayed VRAM-resident; ``ops_loader.c`` already\r\nnarrowed to 28 B on load, so realistic ceiling sat at 1.17\u00d7. Per-shot\r\nstate traffic (qubits + bits per thread) dominates kernel bandwidth ~85\u00d7\r\nover op stream.\r\n\r\n**Diagnosis:** 3090 saturates compute at ~250 Mops/s on a kickmix circuit,\r\nnot bandwidth. Next macro-lever: multi-GPU fan-out across our fleet\r\n(3090-ai, ai/4090, cammy P40, guile CPU bulk).\r\n\r\n----\r\n\r\nMeasured Numbers \u2014 RTX 3090\r\n----------------------------\r\n\r\nAgainst HEAD's 12.8 M-op kickmix ``ops.bin`` (716 MB) via bend:\r\n\r\n=========  ======  =======  =======  =======  ===========\r\nn_batches  shots   wire-s   cpu-ms   gpu-ms   gpu/cpu\r\n=========  ======  =======  =======  =======  ===========\r\n1          64      5.5      42       5 107    0.008\r\n16         1 024   7.3      850      5 800    0.146\r\n64         4 096   11.4     3 444    6 216    0.553\r\n128        8 192   17.1     7 060    6 604    **1.07**\r\n=========  ======  =======  =======  =======  ===========\r\n\r\nCrossover at ~115 batches. GPU kernel carries ~5 070 ms fixed overhead\r\n(init + alloc + upload) plus ~12 ms per batch; CPU runs ~55 ms per batch.\r\nConditional ops in a kickmix circuit cause branch divergence \u2014 one form\r\nwhere GPU does not dominate at small batch counts.\r\n\r\nHonest signal, not hype.\r\n\r\n----\r\n\r\nWhat Lives Where\r\n----------------\r\n\r\n- **Lab repo (private)** \u2014 lumbda source for our attack, circuit build /\r\n  sim / score / candidate sweep, QEMU envelope around C-tier & asm-tier\r\n  runs, run artifacts under ``runs/lumbda-*/``\r\n- **Bend catalog & wire protocol** \u2014 `lumbda.com/bend\r\n  <https://lumbda.com/bend.html>`__\r\n- **Upstream challenge** \u2014 `ecdsafail/ecdsafail-challenge\r\n  <https://github.com/ecdsafail/ecdsafail-challenge>`__\r\n- **Lineage** \u2014 `Google Quantum AI \u00b7 ECC quantum vulnerabilities\r\n  <https://research.google>`__ (Zenodo dataset 19597130, March 2026)\r\n\r\n----\r\n\r\nPareto Frontier We Aim To Beat\r\n-------------------------------\r\n\r\nUpstream README reports two Google private Pareto points sitting below a\r\ntextbook 1.07 \u00d7 10\u00b9\u2070 score; upstream claims both points sit strictly\r\nbeatable.\r\n\r\n==========================================  ==================  ===========  ============\r\nVariant                                     Toffoli (avg/shot)  Peak qubits  Score\r\n==========================================  ==================  ===========  ============\r\nChallenge initial circuit (textbook)        3 942 753           2 715        1.07 \u00d7 10\u00b9\u2070\r\nGoogle private, low-qubit Pareto point      2 700 000           1 175        3.2  \u00d7 10\u2079\r\nGoogle private, low-gate Pareto point       2 100 000           1 425        3.0  \u00d7 10\u2079\r\n==========================================  ==================  ===========  ============\r\n\r\nOur lumbda-tier validation gates each variant against byte-identical\r\ncross-tier portals before we ever spend Rust submission budget against\r\n9024 Fiat-Shamir-derived test points.\r\n\r\n----\r\n\r\nWhy Track This Publicly\r\n-----------------------\r\n\r\nA challenge of this shape rewards aggressive, asymmetric search. Every\r\nfactor of two off a Toffoli count, every qubit shaved off peak width,\r\nmultiplies straight through Shor's algorithm. Documenting our path\r\npublicly \u2014 what we tried, what saturated, what surprised us \u2014\r\ncontributes intellectual capital to a commons that has historically locked\r\nthis work behind paid lab pages.\r\n\r\nThis page tracks public-facing progress only. Detail logs, asm-tier safety\r\nenvelopes, & raw run artifacts stay in our lab repo.\r\n\r\n----\r\n\r\n| *Updated 2026-06-06.*\r\n| *Cross-post anchor for lumbda.com/bend & external links.*", "source_format": "rst", "revision_number": 4, "created": 1780838601768}, {"id": "8f8452bc-61ad-11f1-9655-040140774501", "node_id": "5243e3fe-6146-11f1-8ce9-040140774501", "user_id": "680aec8e-3391-11f1-95d9-040140774501", "author": "russell", "data": ".. ecdsa.rst \u2014 public wiki page for https://www.foxhop.net/ecdsa\r\n.. CC0 / public domain content; lumbda runtime AGPLv3\r\n.. foxhop \u00b7 agent blackops \u00b7 2026-06-05\r\n\r\nsecp256k1 Point-Addition Challenge \u2014 Lumbda Attack\r\n====================================================\r\n\r\n| **Author:** foxhop \u00b7 agent blackops\r\n| **Started:** 2026-06-04\r\n| **Status:** Phase B reversible arithmetic landed; first lever sweep measured at p=11; no upstream submission yet\r\n| **Upstream challenge:** ecdsa.fail_ (Eigen Labs \u00b7 Google Quantum AI lineage)\r\n| **Substrate:** lumbda.com_\r\n\r\n.. _ecdsa.fail: https://ecdsa.fail\r\n.. _lumbda.com: https://lumbda.com\r\n\r\n----\r\n\r\n.. contents::\r\n   :depth: 2\r\n   :local:\r\n\r\n----\r\n\r\nWhat This Page Tracks\r\n---------------------\r\n\r\nA quantum-reversible attack on a secp256k1 point addition, written entirely in\r\nlumbda \u2014 a Lisp/Scheme derivative across four implementation tiers: Python\r\nbytecode VM, C tree-walker + JIT, C + x86_64 JIT, & pure x86_64 assembly.\r\nLumbda's docs & live runtimes sit at lumbda.com_; this page covers our attack\r\nitself, scored by Toffoli count \u00d7 peak qubit width.\r\n\r\nLower score wins. Every factor of two saved at point addition multiplies straight\r\nthrough Shor's algorithm into a factor of two off our resource estimate for\r\ncracking secp256k1 \u2014 a curve that protects Bitcoin & Ethereum.\r\n\r\n----\r\n\r\nWhere This Work Lives in Our Stack\r\n-----------------------------------\r\n\r\necdsa.fail (an Eigen Labs challenge sponsored by Eigen Labs, descended from\r\nGoogle Quantum AI's *Securing Elliptic Curve Cryptocurrencies against Quantum\r\nVulnerabilities*, March 2026) accepts Rust submissions only \u2014 that defines a\r\ncontract format, not our research substrate. Our search runs in lumbda; Rust\r\nonly ever sees a final, validated circuit at submission time.\r\n\r\nWhy lumbda \u2014 four reasons:\r\n\r\n- **Cross-tier portal validation.** Every variant emits an identical result\r\n  S-expression across Python, C tree-walker, & asm. Byte-mismatch on any tier\r\n  halts promotion to a next phase. Rust gives us one tier with no cross-tier\r\n  check.\r\n- **Fleet sharding via TCP + S-expression portals.** Lumbda hands candidate\r\n  evaluation across spare CPU on our GPU boxes; Rust carries no equivalent\r\n  without bespoke distribution code.\r\n- **A CUDA path already exists.** Our ``bend`` primitive on lumbda.com_\r\n  dispatches GPU work over a binary wire (magic ``BSHK``). Bend hands lumbda's\r\n  upstream-format ``ops.bin`` to a CUDA worker, receives \u03a3 (sigma, sum-of)\r\n  Clifford & \u03a3 Toffoli totals back \u2014 same byte-identical portal contract our\r\n  hash demo proves.\r\n- **Future CUDA growth feeds back.** Porting upstream's Rust simulator to CUDA\r\n  costs multi-week with one-shot payoff. Growing lumbda's tier ladder costs\r\n  less & feeds every other lumbda workload.\r\n\r\n----\r\n\r\nPhase B \u2014 Reversible Arithmetic Landed\r\n---------------------------------------\r\n\r\nTwelve steps after Roetteler et al. (2017), modular arithmetic over secp256k1's\r\nprime field, lumbda-native:\r\n\r\n- **Steps 1\u20138** \u2014 modular add, subtract, multiply, square, inverse\r\n  (Bernstein-Yang safegcd flavor), exponentiation\r\n- **Steps 9\u201310** \u2014 refined Bernstein-Yang modular inverse wired into a real\r\n  point-addition circuit\r\n- **emit-ops.bin walker** \u2014 lumbda \u2192 (to) upstream QECCOPS1 binary format,\r\n  full kind table 0..17 coverage, cross-validated against demo_ops\r\n  byte-identical on a real round trip\r\n\r\nCross-tier validated on Python tier. C-tier & asm-tier escalation routes\r\nthrough a QEMU guest (``ecdsa/vm-runner.sh``) \u2014 host policy locked after a\r\n2026-06-03 C-tier OOM crash. Asm-tier carries no default garbage collector;\r\nthree prior neoblanka crashes (2026-04-16, 2026-04-17, 2026-06-03) cemented\r\nper-tier escalation rules. See lumbda's CLAUDE shard on asm memory\r\ndiscipline.\r\n\r\n----\r\n\r\nFirst Lever Sweep \u2014 2026-06-05/06\r\n-----------------------------------\r\n\r\nA six-variant cartesian product of our active Phase B knobs, scored at\r\np=11 n+1=5 (point-add width small enough to fit a full sweep into one\r\nafternoon of CPU) through our closed-loop pipeline:\r\n\r\n::\r\n\r\n   lever-variants.lsp  \u2192  emit-ops-bin walker  \u2192  /tmp/variant-N.bin\r\n                                                          \u2193\r\n                                  bend wire \u2192 3090-ai gpu-worker\r\n                                                          \u2193\r\n                                       demo_ops portal \u2192 results.tsv\r\n\r\nThree boolean Phase B knobs surveyed produce six structurally distinct\r\ncircuits (refined-B-Y collapses when B-Y itself stays off):\r\n\r\n==  =========  =============  ======  ============  ===========\r\nid  mul       inv             n_ops   \u03a3 Toffoli     vs default\r\n==  =========  =============  ======  ============  ===========\r\n5   solinas    refined-B-Y    32 333  **475 648**   **\u221265.2 %**\r\n2   litinski   refined-B-Y    34 468  518 656       \u221262.0 %\r\n4   solinas    textbook-B-Y   48 763  749 056       \u221245.1 %\r\n1   litinski   textbook-B-Y   50 898  792 064       \u221242.0 %\r\n3   solinas    Fermat         77 439  1 027 584     \u221224.7 %\r\n0   litinski   Fermat (def.)  94 214  1 365 504     0.0 %\r\n==  =========  =============  ======  ============  ===========\r\n\r\n**Headline:** combined Solinas mod-mul + refined Bernstein-Yang mod-inv\r\ncuts \u03a3 Toffoli by 65.2 % versus our default lever stack (Litinski\r\nschoolbook mod-mul + Fermat inversion).\r\n\r\nKnob attribution\r\n~~~~~~~~~~~~~~~~~\r\n\r\n*Inversion knob* (refined-B-Y vs Fermat) dominates:\r\n\r\n- at Litinski mod-mul: 1 365 504 \u2192 518 656 = **\u221262.0 %**\r\n- at Solinas mod-mul:  1 027 584 \u2192 475 648 = **\u221253.7 %**\r\n\r\n*Multiplication knob* (Solinas vs Litinski) carries a non-additive\r\ninteraction with inv-knob choice:\r\n\r\n- at Fermat:        1 365 504 \u2192 1 027 584 = **\u221224.7 %**\r\n- at textbook-B-Y:    792 064 \u2192   749 056 =  \u22125.4 %\r\n- at refined-B-Y:     518 656 \u2192   475 648 =  \u22128.3 %\r\n\r\nFermat does repeated mod-muls so a faster mod-mul compounds; Bernstein-Yang\r\ncarries mod-mul-light arithmetic so a mul-knob contribution fades.\r\n**\u221262 % combined with \u22128 % rounds to \u221265 % rather than \u221270 %** \u2014 exactly\r\nour observed math.\r\n\r\nCross-scale prediction check\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nA small-fixture screen (p=5, n+1=4) ran during lever-space discovery\r\npredicted refined-B-Y at roughly \u221256 %; an independent p=251 ground-truth\r\nreference predicted \u221240 %. Our p=11 measurement landed at \u221236.5 % within a\r\nSolinas branch \u2014 within three percentage points of our p=251 prediction.\r\n**A cheap small-width screen survives a scale jump faithfully**, which\r\nlets future runs sweep wide at p=11 first, filter to winners, then spend\r\nexpensive p=251 budget only on a short list.\r\n\r\nA standalone refined-B-Y modular inverse at an intermediate width\r\n(n+1=13, p=4093 = 2\u00b9\u00b2 \u2212 3 Solinas-form) lands 12 908 Toffoli \u2014 a 2.74\u00d7\r\nmultiplier over our n+1=9 datapoint of 4 704. Theoretical n\u00b2 scaling\r\n(13/9)\u00b2 = 2.09; observed sits modestly above, consistent with width-\r\ndependent Solinas reduction overhead growing slower than n\u00b2. A separate\r\nclassical-helper probe at full secp256k1 width (p = 2\u00b2\u2075\u2076 \u2212 2\u00b3\u00b2 \u2212 977,\r\n77-digit prime) ran ``classical-mod-inv`` against a small input &\r\nroundtripped through 7 \u00d7 inv mod p = 1 \u2014 our build-time classical\r\nmachinery survives 256-bit Python bignums; only an emit-side substrate\r\nupgrade gates a full quantum build at that width.\r\n\r\nEnd-to-end GPU timing \u2014 refined vs textbook B-Y\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nOur refined-B-Y ``ops.bin`` for one p=11 point-add ran on a 3090-ai\r\n``gpu-worker`` against ``demo_ops`` for direct head-to-head wall measurement:\r\n\r\n==============  ===========  =========  =====================\r\npath            \u03a3 Toffoli    qec ops    GPU wall (1024 shots)\r\n==============  ===========  =========  =====================\r\ntextbook B-Y    11 704       48 763     14.4 ms\r\nrefined  B-Y     7 432       32 333      **8.8 ms**\r\n==============  ===========  =========  =====================\r\n\r\nRefined cuts 36.5 % off \u03a3 Toffoli (knob-attribution row) & shows up as\r\n**39 % GPU wall reduction at one shot batch** on real silicon. Step 10\r\nlands at our hardware layer & not only on a Scheme counter.\r\n\r\nSubstrate now closed-loop\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nEvery piece of an end-to-end research engine sits live:\r\n\r\n- ``lever-variants.lsp`` exposes ``(lever-permutations)`` for arbitrary\r\n  knob cartesians\r\n- ``emit-ops-bin.lsp`` walks any Phase B circuit form into a QECCOPS1\r\n  binary on disk\r\n- ``bend`` dispatches an ops.bin path to whichever fleet worker holds a\r\n  warm CUDA context\r\n- ``demo_ops`` returns \u03a3 Clifford & \u03a3 Toffoli via a portal\r\n- ``dispatch-sweep.py`` auto-resumes against new ``.bin`` files\r\n\r\nEmit pipeline went through two algorithmic rewrites & a Python-tier\r\nprimitive lift after our first p=251 host probe leaked 8 MB/sec to its\r\n``string-append`` tape until ``kill -9``:\r\n\r\n- **Body assembly** switched from an O(N\u00b2) recursive\r\n  ``(string-append acc op-bytes)`` accumulator to a list-of-strings +\r\n  single ``(apply string-append parts)`` pass \u2014 Python-tier emit phase\r\n  dropped 642 sec \u2192 49 sec on a 32 k-op p=11 case.\r\n- **Layout lookups** switched from an alist (linear ``assoc``) to a\r\n  hash-table \u2014 ``qid-of`` now resolves a register reference in O(1).\r\n- **Walk & serialize lifted into lumbda's host language** via two new\r\n  lumbda primitives, ``walk-circuit-ops`` & ``op-specs->bytes``\r\n  (lumbda.com_) \u2014 Python-tier walk dropped 252 sec \u2192 237 ms, serialize\r\n  dropped 49 sec \u2192 84 ms. Per-op Scheme interpreter cost vanishes;\r\n  dispatch by interned-symbol identity in pure Python lives at native\r\n  loop speed.\r\n\r\nEnd-to-end: one Python-tier p=11 emission now lands in ~4 sec wall on\r\nhost, byte-identical against our pre-rewrite reference file. A next\r\nsweep at wider p waits on quantum build cost rather than substrate\r\nplumbing.\r\n\r\n----\r\n\r\nLumbda Speedups Engineered For This Race\r\n-----------------------------------------\r\n\r\nOur research substrate has gone through several rounds of targeted\r\noptimization as we push circuit emit & dispatch throughput to a level\r\nwhere wide lever sweeps complete in minutes instead of afternoons. Each\r\nchange earns a measured wall delta on our canonical p=11 32 k-op circuit\r\n\u2014 our smallest scaling-faithful test case \u2014 & survives cross-tier as we\r\nport forward.\r\n\r\nAlgorithmic rewrites (foxhop ecdsa)\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nLever-agnostic. Same wins flow through Python, C tree-walker, & asm\r\ntier identically (commits ``55605d2``, ``f486a74``).\r\n\r\n- **Streaming body assembly** \u2014 emit-ops-bin's accumulator\r\n  switched from an O(N\u00b2) recursive ``(string-append acc op-bytes)`` to a\r\n  list-of-strings + single ``(apply string-append parts)`` pass.\r\n  Python-tier emit phase dropped 642 sec \u2192 49 sec on our 32 k-op case.\r\n  That win holds before any host primitive enters.\r\n- **Hash-table register layout** \u2014 point-add->ops's ``qid-of``\r\n  switched from a linear ``assoc`` over an alist to ``hash-table-ref``\r\n  on a hash-table. O(layout-size) per qubit reference \u2192 O(1).\r\n- **Cross-tier portability** \u2014 ``(string char)`` swapped to\r\n  ``(make-string 1 char)`` since our C-tier built-in set lacks\r\n  ``string``. Without that swap C-tier emit fails at parse with\r\n  ``undefined: string``.\r\n\r\nPython-tier host primitives (lumbda)\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThree primitives (lumbda commit ``99701c8``) lift our emit pipeline out\r\nof our Scheme tree-walker. Each dispatches by interned-symbol identity\r\nin pure Python, packs binary fields via ``struct.Struct.pack``, & returns\r\nScheme-native lists / vectors. Per-iteration interpreter overhead\r\nvanishes; native loop speed replaces it.\r\n\r\n============================  ===========  ==========  ========  ====================================\r\nprimitive                     pre-Scheme   post-host   speedup   replaces\r\n============================  ===========  ==========  ========  ====================================\r\n``walk-circuit-ops``          252 sec      237 ms      1060\u00d7     emit-ops-bin's let-walk dispatch loop\r\n``op-specs->bytes``           49 sec       84 ms       580\u00d7      per-op string-append encoder\r\n``count-lumbda-ops``          ~200 sec     <50 ms      4000\u00d7+    pure-Scheme tag tally\r\n============================  ===========  ==========  ========  ====================================\r\n\r\nC-tier & asm-tier ports\r\n~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nLumbda's tier ladder demands every primitive run on every tier \u2014 our\r\nasm tier delivers a 160\u00d7 speedup over Python on portal round-trip per\r\nlumbda's whitepaper \u00a76.6.4 (six-point-six-point-four). C tree-walker\r\nlands ~10\u00d7 over CPython on hot loops, C+JIT another 7\u201310\u00d7 on top.\r\n\r\nOur three Python-tier primitives port forward as follows:\r\n\r\n- **C tier** \u2014 ``bi_walk_circuit_ops``, ``bi_op_specs_to_bytes``,\r\n  ``bi_count_lumbda_ops`` in lumbda's ``c/builtins.c``. Direct\r\n  translation; same algorithm, native struct-pack via inline\r\n  little-endian byte writes.\r\n- **Asm tier** \u2014 same three primitives in ``asm/builtins.s``. The asm\r\n  tier's bump allocator pattern matches our list-building workload\r\n  cleanly (cons cells & vector allocations stay flat across our\r\n  pipeline). For our heaviest workload, ``lumbda-full`` (mark-sweep\r\n  GC) carries our preferred binary.\r\n\r\nTier-port wins compound with our Python win since our build phase also\r\nruns in Scheme on every tier \u2014 speeding our walk loop in C / asm earns\r\nour same multiplier on a build side once we port our build primitives\r\nforward (separate work, our next lift candidate).\r\n\r\nEnd-to-end measurement\r\n~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nOur canonical p=11 textbook+refined emit pair dropped from ~10 min wall\r\nto **6.9 sec wall** on Python tier \u2014 **~85\u00d7 end-to-end**. Byte-identical\r\noutput verified by ``cmp`` against pre-rewrite reference files on both\r\ntextbook & refined paths. Re-baseline pending C tier & asm tier port\r\nlanding.\r\n\r\n----\r\n\r\nForm D Structural Finding \u2014 2026-06-05\r\n---------------------------------------\r\n\r\n``cuda-clifford-stabilizer`` as originally scoped on our bend catalog\r\n(`lumbda.com/bend <https://lumbda.com/bend.html>`__) does not apply to a\r\npoint-addition circuit. Build agent measured Toffoli fraction at 13.87 %\r\n(well under a 40 % stabilizer-win threshold), then noticed our circuit\r\ncarries no Hadamard or S gates \u2014 only X (Pauli-X), CX (controlled-X), CCX\r\n(Toffoli), CZ, CCZ, SWAP, R, HMR, Z, & NEG. State never leaves a\r\ncomputational basis. Aaronson-Gottesman tableau compression buys nothing\r\nwhen superposition does not exist; it reduces to exactly what a per-shot\r\nkernel already does, at one bit per qubit per shot.\r\n\r\nTwo replacement directions landed 2026-06-05; both pivots converged on one\r\ndiagnosis.\r\n\r\n**Axis-flip refactor** (per-candidate parallel kickmix sim) \u2014 DONE\r\n(foxhop commit ``1f7ac9d``). 217 Mops/s (mega-ops per second) at K=32 M=4\r\non a RTX 3090; 23.7\u00d7 (times) over per-shot N=4 at same M. Both kernels\r\nsaturate at ~220\u2013250 Mops/s. Axis-flip's win comes from\r\noccupancy-amortization, not bandwidth redistribution. Right tool for a\r\nmany-candidates \u00d7 few-shots search-loop early-screen pattern.\r\n\r\n**QECCOPS2 packed ops.bin** \u2014 DONE (foxhop commit ``90484ca``). 1.07\u00d7\r\nkernel speedup, 2.33\u00d7 on-disk shrink (716 MB \u2192 307 MB). Our original 3.5\u00d7\r\nprojection assumed 56 B/op stayed VRAM-resident; ``ops_loader.c`` already\r\nnarrowed to 28 B on load, so realistic ceiling sat at 1.17\u00d7. Per-shot\r\nstate traffic (qubits + bits per thread) dominates kernel bandwidth ~85\u00d7\r\nover op stream.\r\n\r\n**Diagnosis:** 3090 saturates compute at ~250 Mops/s on a kickmix circuit,\r\nnot bandwidth. Next macro-lever: multi-GPU fan-out across our fleet\r\n(3090-ai, ai/4090, cammy P40, guile CPU bulk).\r\n\r\n----\r\n\r\nMeasured Numbers \u2014 RTX 3090\r\n----------------------------\r\n\r\nAgainst HEAD's 12.8 M-op kickmix ``ops.bin`` (716 MB) via bend:\r\n\r\n=========  ======  =======  =======  =======  ===========\r\nn_batches  shots   wire-s   cpu-ms   gpu-ms   gpu/cpu\r\n=========  ======  =======  =======  =======  ===========\r\n1          64      5.5      42       5 107    0.008\r\n16         1 024   7.3      850      5 800    0.146\r\n64         4 096   11.4     3 444    6 216    0.553\r\n128        8 192   17.1     7 060    6 604    **1.07**\r\n=========  ======  =======  =======  =======  ===========\r\n\r\nCrossover at ~115 batches. GPU kernel carries ~5 070 ms fixed overhead\r\n(init + alloc + upload) plus ~12 ms per batch; CPU runs ~55 ms per batch.\r\nConditional ops in a kickmix circuit cause branch divergence \u2014 one form\r\nwhere GPU does not dominate at small batch counts.\r\n\r\nHonest signal, not hype.\r\n\r\n----\r\n\r\nWhat Lives Where\r\n----------------\r\n\r\n- **Lab repo (private)** \u2014 lumbda source for our attack, circuit build /\r\n  sim / score / candidate sweep, QEMU envelope around C-tier & asm-tier\r\n  runs, run artifacts under ``runs/lumbda-*/``\r\n- **Bend catalog & wire protocol** \u2014 `lumbda.com/bend\r\n  <https://lumbda.com/bend.html>`__\r\n- **Upstream challenge** \u2014 `ecdsafail/ecdsafail-challenge\r\n  <https://github.com/ecdsafail/ecdsafail-challenge>`__\r\n- **Lineage** \u2014 `Google Quantum AI \u00b7 ECC quantum vulnerabilities\r\n  <https://research.google>`__ (Zenodo dataset 19597130, March 2026)\r\n\r\n----\r\n\r\nPareto Frontier We Aim To Beat\r\n-------------------------------\r\n\r\nUpstream README reports two Google private Pareto points sitting below a\r\ntextbook 1.07 \u00d7 10\u00b9\u2070 score; upstream claims both points sit strictly\r\nbeatable.\r\n\r\n==========================================  ==================  ===========  ============\r\nVariant                                     Toffoli (avg/shot)  Peak qubits  Score\r\n==========================================  ==================  ===========  ============\r\nChallenge initial circuit (textbook)        3 942 753           2 715        1.07 \u00d7 10\u00b9\u2070\r\nGoogle private, low-qubit Pareto point      2 700 000           1 175        3.2  \u00d7 10\u2079\r\nGoogle private, low-gate Pareto point       2 100 000           1 425        3.0  \u00d7 10\u2079\r\n==========================================  ==================  ===========  ============\r\n\r\nOur lumbda-tier validation gates each variant against byte-identical\r\ncross-tier portals before we ever spend Rust submission budget against\r\n9024 Fiat-Shamir-derived test points.\r\n\r\n----\r\n\r\nWhy Track This Publicly\r\n-----------------------\r\n\r\nA challenge of this shape rewards aggressive, asymmetric search. Every\r\nfactor of two off a Toffoli count, every qubit shaved off peak width,\r\nmultiplies straight through Shor's algorithm. Documenting our path\r\npublicly \u2014 what we tried, what saturated, what surprised us \u2014\r\ncontributes intellectual capital to a commons that has historically locked\r\nthis work behind paid lab pages.\r\n\r\nThis page tracks public-facing progress only. Detail logs, asm-tier safety\r\nenvelopes, & raw run artifacts stay in our lab repo.\r\n\r\n----\r\n\r\n| *Updated 2026-06-06.*\r\n| *Cross-post anchor for lumbda.com/bend & external links.*", "source_format": "rst", "revision_number": 3, "created": 1780753349024}, {"id": "f0924215-61aa-11f1-a065-040140774501", "node_id": "5243e3fe-6146-11f1-8ce9-040140774501", "user_id": "680aec8e-3391-11f1-95d9-040140774501", "author": "russell", "data": "secp256k1 Point-Addition Challenge \u2014 Lumbda Attack\r\n====================================================\r\n\r\n| **Author:** foxhop \u00b7 agent blackops\r\n| **Started:** 2026-06-04\r\n| **Status:** Phase B reversible arithmetic landed; first lever sweep measured at p=11; no upstream submission yet\r\n| **Upstream challenge:** ecdsa.fail_ (Eigen Labs \u00b7 Google Quantum AI lineage)\r\n| **Substrate:** lumbda.com_\r\n\r\n.. _ecdsa.fail: https://ecdsa.fail\r\n.. _lumbda.com: https://lumbda.com\r\n\r\n----\r\n\r\n.. contents::\r\n   :depth: 2\r\n   :local:\r\n\r\n----\r\n\r\nWhat This Page Tracks\r\n---------------------\r\n\r\nA quantum-reversible attack on a secp256k1 point addition, written entirely in\r\nlumbda \u2014 a Lisp/Scheme derivative across four implementation tiers: Python\r\nbytecode VM, C tree-walker + JIT, C + x86_64 JIT, & pure x86_64 assembly.\r\nLumbda's docs & live runtimes sit at lumbda.com_; this page covers our attack\r\nitself, scored by Toffoli count \u00d7 peak qubit width.\r\n\r\nLower score wins. Every factor of two saved at point addition multiplies straight\r\nthrough Shor's algorithm into a factor of two off our resource estimate for\r\ncracking secp256k1 \u2014 a curve that protects Bitcoin & Ethereum.\r\n\r\n----\r\n\r\nWhere This Work Lives in Our Stack\r\n-----------------------------------\r\n\r\necdsa.fail (an Eigen Labs challenge sponsored by Eigen Labs, descended from\r\nGoogle Quantum AI's *Securing Elliptic Curve Cryptocurrencies against Quantum\r\nVulnerabilities*, March 2026) accepts Rust submissions only \u2014 that defines a\r\ncontract format, not our research substrate. Our search runs in lumbda; Rust\r\nonly ever sees a final, validated circuit at submission time.\r\n\r\nWhy lumbda \u2014 four reasons:\r\n\r\n- **Cross-tier portal validation.** Every variant emits an identical result\r\n  S-expression across Python, C tree-walker, & asm. Byte-mismatch on any tier\r\n  halts promotion to a next phase. Rust gives us one tier with no cross-tier\r\n  check.\r\n- **Fleet sharding via TCP + S-expression portals.** Lumbda hands candidate\r\n  evaluation across spare CPU on our GPU boxes; Rust carries no equivalent\r\n  without bespoke distribution code.\r\n- **A CUDA path already exists.** Our ``bend`` primitive on lumbda.com_\r\n  dispatches GPU work over a binary wire (magic ``BSHK``). Bend hands lumbda's\r\n  upstream-format ``ops.bin`` to a CUDA worker, receives \u03a3 (sigma, sum-of)\r\n  Clifford & \u03a3 Toffoli totals back \u2014 same byte-identical portal contract our\r\n  hash demo proves.\r\n- **Future CUDA growth feeds back.** Porting upstream's Rust simulator to CUDA\r\n  costs multi-week with one-shot payoff. Growing lumbda's tier ladder costs\r\n  less & feeds every other lumbda workload.\r\n\r\n----\r\n\r\nPhase B \u2014 Reversible Arithmetic Landed\r\n---------------------------------------\r\n\r\nTwelve steps after Roetteler et al. (2017), modular arithmetic over secp256k1's\r\nprime field, lumbda-native:\r\n\r\n- **Steps 1\u20138** \u2014 modular add, subtract, multiply, square, inverse\r\n  (Bernstein-Yang safegcd flavor), exponentiation\r\n- **Steps 9\u201310** \u2014 refined Bernstein-Yang modular inverse wired into a real\r\n  point-addition circuit\r\n- **emit-ops.bin walker** \u2014 lumbda \u2192 (to) upstream QECCOPS1 binary format,\r\n  full kind table 0..17 coverage, cross-validated against demo_ops\r\n  byte-identical on a real round trip\r\n\r\nCross-tier validated on Python tier. C-tier & asm-tier escalation routes\r\nthrough a QEMU guest (``ecdsa/vm-runner.sh``) \u2014 host policy locked after a\r\n2026-06-03 C-tier OOM crash. Asm-tier carries no default garbage collector;\r\nthree prior neoblanka crashes (2026-04-16, 2026-04-17, 2026-06-03) cemented\r\nper-tier escalation rules. See lumbda's CLAUDE shard on asm memory\r\ndiscipline.\r\n\r\n----\r\n\r\nFirst Lever Sweep \u2014 2026-06-05/06\r\n-----------------------------------\r\n\r\nA six-variant cartesian product of our active Phase B knobs, scored at\r\np=11 n+1=5 (point-add width small enough to fit a full sweep into one\r\nafternoon of CPU) through our closed-loop pipeline:\r\n\r\n::\r\n\r\n   lever-variants.lsp  \u2192  emit-ops-bin walker  \u2192  /tmp/variant-N.bin\r\n                                                          \u2193\r\n                                  bend wire \u2192 3090-ai gpu-worker\r\n                                                          \u2193\r\n                                       demo_ops portal \u2192 results.tsv\r\n\r\nThree boolean Phase B knobs surveyed produce six structurally distinct\r\ncircuits (refined-B-Y collapses when B-Y itself stays off):\r\n\r\n==  =========  =============  ======  ============  ===========\r\nid  mul       inv             n_ops   \u03a3 Toffoli     vs default\r\n==  =========  =============  ======  ============  ===========\r\n5   solinas    refined-B-Y    32 333  **475 648**   **\u221265.2 %**\r\n2   litinski   refined-B-Y    34 468  518 656       \u221262.0 %\r\n4   solinas    textbook-B-Y   48 763  749 056       \u221245.1 %\r\n1   litinski   textbook-B-Y   50 898  792 064       \u221242.0 %\r\n3   solinas    Fermat         77 439  1 027 584     \u221224.7 %\r\n0   litinski   Fermat (def.)  94 214  1 365 504     0.0 %\r\n==  =========  =============  ======  ============  ===========\r\n\r\n**Headline:** combined Solinas mod-mul + refined Bernstein-Yang mod-inv\r\ncuts \u03a3 Toffoli by 65.2 % versus our default lever stack (Litinski\r\nschoolbook mod-mul + Fermat inversion).\r\n\r\nKnob attribution\r\n~~~~~~~~~~~~~~~~~\r\n\r\n*Inversion knob* (refined-B-Y vs Fermat) dominates:\r\n\r\n- at Litinski mod-mul: 1 365 504 \u2192 518 656 = **\u221262.0 %**\r\n- at Solinas mod-mul:  1 027 584 \u2192 475 648 = **\u221253.7 %**\r\n\r\n*Multiplication knob* (Solinas vs Litinski) carries a non-additive\r\ninteraction with inv-knob choice:\r\n\r\n- at Fermat:        1 365 504 \u2192 1 027 584 = **\u221224.7 %**\r\n- at textbook-B-Y:    792 064 \u2192   749 056 =  \u22125.4 %\r\n- at refined-B-Y:     518 656 \u2192   475 648 =  \u22128.3 %\r\n\r\nFermat does repeated mod-muls so a faster mod-mul compounds; Bernstein-Yang\r\ncarries mod-mul-light arithmetic so a mul-knob contribution fades.\r\n**\u221262 % combined with \u22128 % rounds to \u221265 % rather than \u221270 %** \u2014 exactly\r\nour observed math.\r\n\r\nCross-scale prediction check\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nA small-fixture screen (p=5, n+1=4) ran during lever-space discovery\r\npredicted refined-B-Y at roughly \u221256 %; an independent p=251 ground-truth\r\nreference predicted \u221240 %. Our p=11 measurement landed at \u221236.5 % within a\r\nSolinas branch \u2014 within three percentage points of our p=251 prediction.\r\n**A cheap small-width screen survives a scale jump faithfully**, which\r\nlets future runs sweep wide at p=11 first, filter to winners, then spend\r\nexpensive p=251 budget only on a short list.\r\n\r\nSubstrate now closed-loop\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nEvery piece of an end-to-end research engine sits live:\r\n\r\n- ``lever-variants.lsp`` exposes ``(lever-permutations)`` for arbitrary\r\n  knob cartesians\r\n- ``emit-ops-bin.lsp`` walks any Phase B circuit form into a QECCOPS1\r\n  binary on disk\r\n- ``bend`` dispatches an ops.bin path to whichever fleet worker holds a\r\n  warm CUDA context\r\n- ``demo_ops`` returns \u03a3 Clifford & \u03a3 Toffoli via a portal\r\n- ``dispatch-sweep.py`` auto-resumes against new ``.bin`` files\r\n\r\nNo piece needs hand-running. A next sweep at wider p only waits on emit\r\nthroughput, never on substrate plumbing.\r\n\r\n----\r\n\r\nForm D Structural Finding \u2014 2026-06-05\r\n---------------------------------------\r\n\r\n``cuda-clifford-stabilizer`` as originally scoped on our bend catalog\r\n(`lumbda.com/bend <https://lumbda.com/bend.html>`__) does not apply to a\r\npoint-addition circuit. Build agent measured Toffoli fraction at 13.87 %\r\n(well under a 40 % stabilizer-win threshold), then noticed our circuit\r\ncarries no Hadamard or S gates \u2014 only X (Pauli-X), CX (controlled-X), CCX\r\n(Toffoli), CZ, CCZ, SWAP, R, HMR, Z, & NEG. State never leaves a\r\ncomputational basis. Aaronson-Gottesman tableau compression buys nothing\r\nwhen superposition does not exist; it reduces to exactly what a per-shot\r\nkernel already does, at one bit per qubit per shot.\r\n\r\nTwo replacement directions landed 2026-06-05; both pivots converged on one\r\ndiagnosis.\r\n\r\n**Axis-flip refactor** (per-candidate parallel kickmix sim) \u2014 DONE\r\n(foxhop commit ``1f7ac9d``). 217 Mops/s (mega-ops per second) at K=32 M=4\r\non a RTX 3090; 23.7\u00d7 (times) over per-shot N=4 at same M. Both kernels\r\nsaturate at ~220\u2013250 Mops/s. Axis-flip's win comes from\r\noccupancy-amortization, not bandwidth redistribution. Right tool for a\r\nmany-candidates \u00d7 few-shots search-loop early-screen pattern.\r\n\r\n**QECCOPS2 packed ops.bin** \u2014 DONE (foxhop commit ``90484ca``). 1.07\u00d7\r\nkernel speedup, 2.33\u00d7 on-disk shrink (716 MB \u2192 307 MB). Our original 3.5\u00d7\r\nprojection assumed 56 B/op stayed VRAM-resident; ``ops_loader.c`` already\r\nnarrowed to 28 B on load, so realistic ceiling sat at 1.17\u00d7. Per-shot\r\nstate traffic (qubits + bits per thread) dominates kernel bandwidth ~85\u00d7\r\nover op stream.\r\n\r\n**Diagnosis:** 3090 saturates compute at ~250 Mops/s on a kickmix circuit,\r\nnot bandwidth. Next macro-lever: multi-GPU fan-out across our fleet\r\n(3090-ai, ai/4090, cammy P40, guile CPU bulk).\r\n\r\n----\r\n\r\nMeasured Numbers \u2014 RTX 3090\r\n----------------------------\r\n\r\nAgainst HEAD's 12.8 M-op kickmix ``ops.bin`` (716 MB) via bend:\r\n\r\n=========  ======  =======  =======  =======  ===========\r\nn_batches  shots   wire-s   cpu-ms   gpu-ms   gpu/cpu\r\n=========  ======  =======  =======  =======  ===========\r\n1          64      5.5      42       5 107    0.008\r\n16         1 024   7.3      850      5 800    0.146\r\n64         4 096   11.4     3 444    6 216    0.553\r\n128        8 192   17.1     7 060    6 604    **1.07**\r\n=========  ======  =======  =======  =======  ===========\r\n\r\nCrossover at ~115 batches. GPU kernel carries ~5 070 ms fixed overhead\r\n(init + alloc + upload) plus ~12 ms per batch; CPU runs ~55 ms per batch.\r\nConditional ops in a kickmix circuit cause branch divergence \u2014 one form\r\nwhere GPU does not dominate at small batch counts.\r\n\r\nHonest signal, not hype.\r\n\r\n----\r\n\r\nWhat Lives Where\r\n----------------\r\n\r\n- **Lab repo (private)** \u2014 lumbda source for our attack, circuit build /\r\n  sim / score / candidate sweep, QEMU envelope around C-tier & asm-tier\r\n  runs, run artifacts under ``runs/lumbda-*/``\r\n- **Bend catalog & wire protocol** \u2014 `lumbda.com/bend\r\n  <https://lumbda.com/bend.html>`__\r\n- **Upstream challenge** \u2014 `ecdsafail/ecdsafail-challenge\r\n  <https://github.com/ecdsafail/ecdsafail-challenge>`__\r\n- **Lineage** \u2014 `Google Quantum AI \u00b7 ECC quantum vulnerabilities\r\n  <https://research.google>`__ (Zenodo dataset 19597130, March 2026)\r\n\r\n----\r\n\r\nPareto Frontier We Aim To Beat\r\n-------------------------------\r\n\r\nUpstream README reports two Google private Pareto points sitting below a\r\ntextbook 1.07 \u00d7 10\u00b9\u2070 score; upstream claims both points sit strictly\r\nbeatable.\r\n\r\n==========================================  ==================  ===========  ============\r\nVariant                                     Toffoli (avg/shot)  Peak qubits  Score\r\n==========================================  ==================  ===========  ============\r\nChallenge initial circuit (textbook)        3 942 753           2 715        1.07 \u00d7 10\u00b9\u2070\r\nGoogle private, low-qubit Pareto point      2 700 000           1 175        3.2  \u00d7 10\u2079\r\nGoogle private, low-gate Pareto point       2 100 000           1 425        3.0  \u00d7 10\u2079\r\n==========================================  ==================  ===========  ============\r\n\r\nOur lumbda-tier validation gates each variant against byte-identical\r\ncross-tier portals before we ever spend Rust submission budget against\r\n9024 Fiat-Shamir-derived test points.\r\n\r\n----\r\n\r\nWhy Track This Publicly\r\n-----------------------\r\n\r\nA challenge of this shape rewards aggressive, asymmetric search. Every\r\nfactor of two off a Toffoli count, every qubit shaved off peak width,\r\nmultiplies straight through Shor's algorithm. Documenting our path\r\npublicly \u2014 what we tried, what saturated, what surprised us \u2014\r\ncontributes intellectual capital to a commons that has historically locked\r\nthis work behind paid lab pages.\r\n\r\nThis page tracks public-facing progress only. Detail logs, asm-tier safety\r\nenvelopes, & raw run artifacts stay in our lab repo.\r\n\r\n----\r\n\r\n| *Updated 2026-06-06.*\r\n| *Cross-post anchor for lumbda.com/bend & external links.*", "source_format": "rst", "revision_number": 2, "created": 1780752223364}, {"id": "d2bc8ed3-61a8-11f1-b5ba-040140774501", "node_id": "5243e3fe-6146-11f1-8ce9-040140774501", "user_id": "680aec8e-3391-11f1-95d9-040140774501", "author": "russell", "data": ".. ecdsa.rst \u2014 public wiki page for https://www.foxhop.net/ecdsa\r\n.. CC0 / public domain content; lumbda runtime AGPLv3\r\n.. foxhop \u00b7 agent blackops \u00b7 2026-06-05\r\n\r\nsecp256k1 Point-Addition Challenge with Lumbda Attack\r\n======================================================\r\n\r\n| **Author:** foxhop \u00b7 agent blackops\r\n| **Started:** 2026-06-04\r\n| **Status:** Phase B reversible arithmetic landed; no upstream submission yet\r\n| **Upstream challenge:** ecdsa.fail_ (Eigen Labs \u00b7 Google Quantum AI lineage)\r\n| **Substrate:** lumbda.com_\r\n\r\n.. _ecdsa.fail: https://ecdsa.fail\r\n.. _lumbda.com: https://lumbda.com\r\n\r\n----\r\n\r\n.. contents::\r\n   :depth: 2\r\n   :local:\r\n\r\n----\r\n\r\nWhat This Page Tracks\r\n---------------------\r\n\r\nA quantum-reversible attack on a secp256k1 point addition, written entirely in\r\nlumbda \u2014 a Lisp/Scheme derivative across four implementation tiers: Python\r\nbytecode VM, C tree-walker + JIT, C + x86_64 JIT, & pure x86_64 assembly.\r\nLumbda's docs & live runtimes sit at lumbda.com_; this page covers our attack\r\nitself, scored by Toffoli count \u00d7 peak qubit width.\r\n\r\nLower score wins. Every factor of two saved at point addition multiplies straight\r\nthrough Shor's algorithm into a factor of two off our resource estimate for\r\ncracking secp256k1 \u2014 a curve that protects Bitcoin & Ethereum.\r\n\r\n----\r\n\r\nWhere This Work Lives in Our Stack\r\n-----------------------------------\r\n\r\necdsa.fail (an Eigen Labs challenge sponsored by Eigen Labs, descended from\r\nGoogle Quantum AI's *Securing Elliptic Curve Cryptocurrencies against Quantum\r\nVulnerabilities*, March 2026) accepts Rust submissions only \u2014 that defines a\r\ncontract format, not our research substrate. Our search runs in lumbda; Rust\r\nonly ever sees a final, validated circuit at submission time.\r\n\r\nWhy lumbda \u2014 four reasons:\r\n\r\n- **Cross-tier portal validation.** Every variant emits an identical result\r\n  S-expression across Python, C tree-walker, & asm. Byte-mismatch on any tier\r\n  halts promotion to a next phase. Rust gives us one tier with no cross-tier\r\n  check.\r\n- **Fleet sharding via TCP + S-expression portals.** Lumbda hands candidate\r\n  evaluation across spare CPU on our GPU boxes; Rust carries no equivalent\r\n  without bespoke distribution code.\r\n- **A CUDA path already exists.** Our ``bend`` primitive on lumbda.com_\r\n  dispatches GPU work over a binary wire (magic ``BSHK``). Bend hands lumbda's\r\n  upstream-format ``ops.bin`` to a CUDA worker, receives \u03a3 (sigma, sum-of)\r\n  Clifford & \u03a3 Toffoli totals back \u2014 same byte-identical portal contract our\r\n  hash demo proves.\r\n- **Future CUDA growth feeds back.** Porting upstream's Rust simulator to CUDA\r\n  costs multi-week with one-shot payoff. Growing lumbda's tier ladder costs\r\n  less & feeds every other lumbda workload.\r\n\r\n----\r\n\r\nPhase B \u2014 Reversible Arithmetic Landed\r\n---------------------------------------\r\n\r\nTwelve steps after Roetteler et al. (2017), modular arithmetic over secp256k1's\r\nprime field, lumbda-native:\r\n\r\n- **Steps 1\u20138** \u2014 modular add, subtract, multiply, square, inverse\r\n  (Bernstein-Yang safegcd flavor), exponentiation\r\n- **Steps 9\u201310** \u2014 refined Bernstein-Yang modular inverse wired into a real\r\n  point-addition circuit\r\n- **emit-ops.bin walker** \u2014 lumbda \u2192 (to) upstream QECCOPS1 binary format\r\n\r\nStatus: cross-tier validated on Python tier. C-tier & asm-tier escalation\r\nroutes through a QEMU guest (``ecdsa/vm-runner.sh``) \u2014 host policy locked\r\nafter a 2026-06-03 C-tier OOM crash. Asm-tier carries no default garbage\r\ncollector; three prior neoblanka crashes (2026-04-16, 2026-04-17,\r\n2026-06-03) cemented per-tier escalation rules. See lumbda's CLAUDE shard on\r\nasm memory discipline.\r\n\r\n----\r\n\r\nForm D Structural Finding \u2014 2026-06-05\r\n---------------------------------------\r\n\r\n``cuda-clifford-stabilizer`` as originally scoped on our bend catalog\r\n(`lumbda.com/bend <https://lumbda.com/bend.html>`__) does not apply to a\r\npoint-addition circuit. Build agent measured Toffoli fraction at 13.87 %\r\n(well under a 40 % stabilizer-win threshold), then noticed our circuit\r\ncarries no Hadamard or S gates \u2014 only X (Pauli-X), CX (controlled-X), CCX\r\n(Toffoli), CZ, CCZ, SWAP, R, HMR, Z, & NEG. State never leaves a\r\ncomputational basis. Aaronson-Gottesman tableau compression buys nothing\r\nwhen superposition does not exist; it reduces to exactly what a per-shot\r\nkernel already does, at one bit per qubit per shot.\r\n\r\nTwo replacement directions landed 2026-06-05; both pivots converged on one\r\ndiagnosis.\r\n\r\n**Axis-flip refactor** (per-candidate parallel kickmix sim) \u2014 DONE\r\n(foxhop commit ``1f7ac9d``). 217 Mops/s (mega-ops per second) at K=32 M=4\r\non a RTX 3090; 23.7\u00d7 (times) over per-shot N=4 at same M. Both kernels\r\nsaturate at ~220\u2013250 Mops/s. Axis-flip's win comes from\r\noccupancy-amortization, not bandwidth redistribution. Right tool for a\r\nmany-candidates \u00d7 few-shots search-loop early-screen pattern.\r\n\r\n**QECCOPS2 packed ops.bin** \u2014 DONE (foxhop commit ``90484ca``). 1.07\u00d7\r\nkernel speedup, 2.33\u00d7 on-disk shrink (716 MB \u2192 307 MB). Our original 3.5\u00d7\r\nprojection assumed 56 B/op stayed VRAM-resident; ``ops_loader.c`` already\r\nnarrowed to 28 B on load, so realistic ceiling sat at 1.17\u00d7. Per-shot\r\nstate traffic (qubits + bits per thread) dominates kernel bandwidth ~85\u00d7\r\nover op stream.\r\n\r\n**Diagnosis:** 3090 saturates compute at ~250 Mops/s on a kickmix circuit,\r\nnot bandwidth. Next macro-lever: multi-GPU fan-out across our fleet\r\n(3090-ai, ai/4090, cammy P40, guile CPU bulk).\r\n\r\n----\r\n\r\nMeasured Numbers \u2014 RTX 3090\r\n----------------------------\r\n\r\nAgainst HEAD's 12.8 M-op kickmix ``ops.bin`` (716 MB) via bend:\r\n\r\n=========  ======  =======  =======  =======  ===========\r\nn_batches  shots   wire-s   cpu-ms   gpu-ms   gpu/cpu\r\n=========  ======  =======  =======  =======  ===========\r\n1          64      5.5      42       5 107    0.008\r\n16         1 024   7.3      850      5 800    0.146\r\n64         4 096   11.4     3 444    6 216    0.553\r\n128        8 192   17.1     7 060    6 604    **1.07**\r\n=========  ======  =======  =======  =======  ===========\r\n\r\nCrossover at ~115 batches. GPU kernel carries ~5 070 ms fixed overhead\r\n(init + alloc + upload) plus ~12 ms per batch; CPU runs ~55 ms per batch.\r\nConditional ops in a kickmix circuit cause branch divergence \u2014 one form\r\nwhere GPU does not dominate at small batch counts.\r\n\r\nHonest signal, not hype.\r\n\r\n----\r\n\r\nWhat Lives Where\r\n----------------\r\n\r\n- **Lab repo (private)** \u2014 lumbda source for our attack, circuit build /\r\n  sim / score / candidate sweep, QEMU envelope around C-tier & asm-tier\r\n  runs, run artifacts under ``runs/lumbda-*/``\r\n- **Bend catalog & wire protocol** \u2014 `lumbda.com/bend\r\n  <https://lumbda.com/bend.html>`__\r\n- **Upstream challenge** \u2014 `ecdsafail/ecdsafail-challenge\r\n  <https://github.com/ecdsafail/ecdsafail-challenge>`__\r\n- **Lineage** \u2014 `Google Quantum AI \u00b7 ECC quantum vulnerabilities\r\n  <https://research.google>`__ (Zenodo dataset 19597130, March 2026)\r\n\r\n----\r\n\r\nPareto Frontier We Aim To Beat\r\n-------------------------------\r\n\r\nUpstream README reports two Google private Pareto points sitting below a\r\ntextbook 1.07 \u00d7 10\u00b9\u2070 score; upstream claims both points sit strictly\r\nbeatable.\r\n\r\n==========================================  ==================  ===========  ============\r\nVariant                                     Toffoli (avg/shot)  Peak qubits  Score\r\n==========================================  ==================  ===========  ============\r\nChallenge initial circuit (textbook)        3 942 753           2 715        1.07 \u00d7 10\u00b9\u2070\r\nGoogle private, low-qubit Pareto point      2 700 000           1 175        3.2  \u00d7 10\u2079\r\nGoogle private, low-gate Pareto point       2 100 000           1 425        3.0  \u00d7 10\u2079\r\n==========================================  ==================  ===========  ============\r\n\r\nOur lumbda-tier validation gates each variant against byte-identical\r\ncross-tier portals before we ever spend Rust submission budget against\r\n9024 Fiat-Shamir-derived test points.\r\n\r\n----\r\n\r\nWhy Track This Publicly\r\n-----------------------\r\n\r\nA challenge of this shape rewards aggressive, asymmetric search. Every\r\nfactor of two off a Toffoli count, every qubit shaved off peak width,\r\nmultiplies straight through Shor's algorithm. Documenting our path\r\npublicly \u2014 what we tried, what saturated, what surprised us \u2014\r\ncontributes intellectual capital to a commons that has historically locked\r\nthis work behind paid lab pages.\r\n\r\nThis page tracks public-facing progress only. Detail logs, asm-tier safety\r\nenvelopes, & raw run artifacts stay in our lab repo.\r\n", "source_format": "rst", "revision_number": 1, "created": 1780751314322}], "count": 10}