Scope: what shipping CORE as the canonical guest would take

[defenwycke]

Requested after v0.20.0 shipped the stock guest and the acceleration stayed off. This is what changing that would cost, and what it would buy.

What Core is

Stock plus exactly two levers:

lever	fidelity class	what it means
0013 liftx hint	advice-and-verify	Core's own arithmetic still decides; the hint is checked with libsecp's fe_sqr against y² = x³+7
0012 field backend	substitution (narrow)	one primitive replaced at a backend interface libsecp already parameterises; every algorithm above it untouched

⇒ The precedent already exists. patches/0002 (SHA-256 → risc0 accelerator) is also a narrow substitution and is already shipped in the stock guest. Core is not a new category of claim — it is the same decision, taken once more, at the field layer instead of the hash layer.

What it buys

	cards to hold tip
stock (shipping today)	~29
Core	10

Measured on two L40S, block 962,000, real proving: chunk work 4,029 card-seconds, straggler 1.295, aggregate 473 s.

Evidence already in hand

• Journal digest byte-identical to a stock control on block 962,000 — 4fb3e3c5…4656d, all_valid=1, binds=8006. The consensus output is unchanged; only how the arithmetic is computed differs.
• scripts/field-backend-tests.sh — 3 gates, 9 mutation controls, two of which are caught ONLY by the mod-p harness because libsecp's own suite passes two broken lazy backends.
• 892 real mainnet inputs verify through the guest's VerifyScript (Native differential + memory-safety harness: run the guest's Core code without a zkVM #222).
• 7/7 consensus rules refused when violated one at a time (Negative corpus: every consensus rule violated alone must be refused — 7/7 #223).

The work

1. Decide the narrow substitution is acceptable as canonical. This is the only judgement call; everything else is mechanical.
2. Arm the levers in the canonical build path — provision-vps.sh / reproduce/Dockerfile. Today they default off and nothing turns them on.
3. Ship Core's packing constants as the defaults — 417798 / 462435 / 2 / 41387. Worth straggler 1.311 → 1.210 on its own, and they are per-build-mode, so stock's defaults are wrong for Core.
4. New METHOD_ID → scripts/rebaseline-id.sh, then every doc that states the id.
5. Regenerate the SNARK fixtures. A proof carries its guest id; they cannot be re-pointed, only re-proved. ~2 hours, procedure in prover/testdata/snark/README.md.
6. CI green, then cut v0.21.0 — same flow as v0.20.0.
7. Cutover: verifier release, wasm deploy, coordinator swap, board reset. Every trap from 2026-09-06 now documented, including the spine file served independently of the DB, and setting the worker identity BEFORE starting workers.
8. Re-prove the board. Today's rebuild ran 0 → ~1,600 in about 90 minutes on two L40S — and at Core's speed it would be faster.

Cost

Roughly a day, most of it waiting on CI and re-proving. Every proof published under 3867611d is invalidated — including the ones being produced right now.

The honest counter-argument

Doing it twice in two days is the cost, not the work. Every re-baseline invalidates the board, and a project whose pitch is "check it yourself" spends credibility each time the thing to check is replaced. If Core ships, it should ship once, deliberately, with the fidelity decision written down — not as a follow-up patch to a release that just landed.

⚠ Also unresolved: Ghost's calibration is measured but not shipped (#209), and the COST_* defaults are per-build-mode. Whatever ships needs its own constants, or the packer optimises against work that is not there.

[defenwycke]

⚖ DECISION (operator, 2026-09-06): three channels, Core is canonical

stock   — plain and old      → the CONTROL. Fidelity floor, `identical` class.
core    — current            → CANONICAL. What ships, what the board counts.
ghost   — experimental       → where new levers land first.

This supersedes the framing above. Three binaries, one canonical guest id — Core's.

Why this is coherent (not just naming)

stock keeps a real engineering job after it stops being the default: it is the digest oracle. Every claim that an acceleration did not change consensus is made by comparing a journal against stock's. That is how the field backend was cleared — 4fb3e3c5…4656d, byte-identical, all_valid=1, binds=8006. Stock does not graduate and does not get retired; it is the thing the other two are checked against.

ghost stays unshippable on measured grounds, not taste: BUILDS.md §3 — "Ghost needs its own calibration; it does not have one." Core's refit actively hurts it (straggler 1.407 → 1.884, ≈ one card). Ghost cannot be canonical until someone fits its constants.

⏰ Timing: do this now, and it is nearly free

Board right now: 1,586 proven / frontier 1,585 / tip 965,833 / 1 contributor / 0.164%, guest 3867611d (stock).

A re-baseline invalidates every published proof. Today that is 1,586 blocks — about 90 minutes of two L40S. After a full proving campaign it is 220,001. The cost of this decision only ever goes up, so it should be taken now rather than deferred.

⚠ The L40S loan has ended — both boxes are unreachable. Re-proving needs GPUs back; the build, the gates and the re-baseline do not.

Not in scope

Per-proof rung tagging (a verifier that holds a table of ids and a board showing per-rung coverage) is the interesting long-term shape, but it is a schema + verifier + board change and 3× the proving. Explicitly deferred — it should not be designed during a cutover.

[defenwycke]

Mechanical scope — surveyed against the code, 2026-09-06

⛔ Finding: Core's patches are not wired into the canonical build at all

provision-vps.sh never references 0012 or 0013 (grepped: no match for the patch numbers, FIELD_BIGINT2, LIFTX_HINT, or ECMULT_WINDOW). The patches sit in patches/ unused by the canonical path.

So this is not "flip some env vars". Today the canonical path applies exactly two patches, unconditionally, at provision-vps.sh:168-171:

0001-serialize-ilp32-int-overload.patch
0002-sha256-route-through-risc0-accelerator.patch

Core needs 0012/0013 added to that same unconditional block, plus their defines exported. Both halves are required — arming the env without applying the patch is the documented silent-stock trap, and it has already cost three bogus measurement runs.

⚠ The __LINE__ subtlety, from the 0005 block's own comment

"The patch body is #ifdef'd … so applying it without the define compiles identically — but it still edits the shared source tree, and libsecp's VERIFY_CHECK embeds __LINE__, so do not assume 'applied but undefined' is a no-op for the id."

⇒ The canonical id must be built with the patch set exactly as it will ship. There is no "apply now, arm later" intermediate that keeps the id stable.

✅ Finding: the calibration refit does NOT move METHOD_ID

HAZYNC_COST_* is read only at prover/host/src/main.rs:1838 — host-side chunk packing. Nothing under prover/methods/guest/ reads it.

This cleanly splits the work into two risk classes:

	moves METHOD_ID?	consequence
patches 0012/0013 + defines	yes	full re-baseline, fixtures, cutover, board reset
COST_* refit 417798/462435/2/41387	no	host-side only, no proof invalidated

⚠ But the constants are per-build-mode and must travel with the mode — Core's refit costs Ghost a card (1.407 → 1.884). They ship with Core, not ahead of it.

Ordered work

1. provision-vps.sh — apply 0012+0013 in the unconditional block; export HAZYNC_FIELD_BIGINT2=1 HAZYNC_LIFTX_HINT=1 HAZYNC_ECMULT_WINDOW=21.
2. Host defaults — Core's COST_* as the built-in defaults (no re-baseline).
3. Build canonical → new METHOD_ID; scripts/rebaseline-id.sh; scripts/check-guest-inputs.sh.
4. Digest gate vs stock on block 962,000 — must reproduce 4fb3e3c5…4656d byte-identical. This is the go/no-go.
5. Regenerate SNARK fixtures (~2 h; they cannot be re-pointed, only re-proved).
6. CI green → cut v0.21.0.
7. Cutover: verifier, wasm, coordinator, board reset. ⚠ spine file is served independently of the DB; set worker identity before starting workers.
8. Re-prove — needs GPUs; the L40S loan has ended. Steps 1-6 do not.

Doc debt this creates

#224 (in flight) documents that stock ships. True today, false after step 6 — it needs revising in the same release. docs/BUILDS.md, docs/CORE_VS_GHOST.md and the README banner all state the shipping channel and must move together.

[defenwycke]

✅ DIGEST GATE: PASS — with a real control this time

Block 962,000, 8,006 inputs, one chunk, execute mode (no GPU). Both arms built from the same tree, differing only in whether patches 0012/0013 are applied and their defines set. HAZYNC_ECMULT_WINDOW=21 held constant across both, so the experiment isolates exactly the two Core levers.

	METHOD_ID	fq_mul	lift_x_hint	journal sha256	cycles
CORE	05a5a279…	1	1	4fb3e3c5…4656d	3,357,576,338
STOCK	fb4d7352…	0	0	4fb3e3c5…4656d	13,748,003,793

Journals byte-identical, kind=0xc4a10004, all_valid=1, binds=8006 on both.

⇒ Core changes no consensus output. Same 32 bytes, 4.095x fewer cycles.

⛔ Why this was re-run rather than trusting the recorded digest

The earlier attempt never had a control. Its stock arm failed to link:

rust-lld: error: undefined symbol: hazync_fq_sqr_limbs

Unsetting HAZYNC_FIELD_BIGINT2 while leaving patch 0012 applied does not give you stock — it gives you patched source calling symbols nothing compiled. That run recorded DIGEST GATE: *** FAIL *** ... control digest MISSING, and 4fb3e3c5… has been carried since as a recorded value with nothing to compare against.

The control here reverts the patches properly, which is the only way to get a stock arm out of a shared tree.

Two checks that make the PASS mean something

1. The METHOD_IDs differ (05a5a279 vs fb4d7352). Identical ids would mean one arm never rebuilt and the comparison is void — the failure mode scripts/gpu-stack-ab.sh already guards against.
2. Each arm verified its own guest symbols before its digest was believed — Core shows fq_mul=1 liftx=1, stock shows 0 0. A silently-stock "Core" arm would produce a matching digest and a meaningless pass.

⚠ What this does and does not say

• ✅ Consensus output identical on this block: measured.
• ✅ 4.095x fewer cycles for the two Core levers with window held constant: measured.
• ⛔ It is not a card count. Cards need the straggler across a real chunked proving run, not one execute-mode chunk.
• ⛔ It is one block. 962,000 is 1.8% taproot; a taproot-heavy block exercises a different mix.
• ⚠ Both ids here are LOCAL and non-canonical — built at laptop paths. The canonical id comes from reproduce/Dockerfile.

Go/no-go: GO. Proceeding to the re-baseline.

[defenwycke]

Closing: shipped as v0.21.0, guest 37987b85…. Verified item by item rather than by the release existing.

#	work item	state
1	Decide the narrow substitution is acceptable as canonical	✅ the judgement is written down in docs/RELEASE_NOTES_v0.21.0.md ("Why Core is defensible as the shipped guest"), resting on the patches/0002 precedent this issue names
2	Arm the levers in the canonical build path	✅ 0012/0013 are applied unconditionally by provision-vps.sh phase 5a, with the defines exported at three sites — HAZYNC_PROVISION=build skips phases 1-7, so exporting only in phase 6 yields a third id that is neither stock nor Core, silently and with exit 0
3	Ship Core's packing constants as defaults	✅ all four are defaults in prover/host/src/main.rs, not env overrides: COST_PER_EC_OP 417_798, COST_PER_SCHNORR_OP 462_435, COST_PER_INPUT_BYTE 2, COST_INPUT_BASE 41_387
4	New METHOD_ID + every doc that states it	✅ 37987b85…; scripts/check-versions.sh exit 0
5	Regenerate the SNARK fixtures	✅ re-proved and re-wrapped on the coordinator; fold_8 exits 0, neg500 exits 2 (refused on the anchor, not as an invalid proof)
6	CI green, cut v0.21.0	✅ published, signed, latest confirmed via both the API and the CDN
7	Cutover	✅ coordinator binary swapped, board cleared, spine retired, wasm deployed, workers restarted after the coordinator moved
8	Re-prove the board	✅ underway and healthy — proven 2,299, frontier 2,299 (contiguous from genesis), spine_hi 515

Independent confirmation of the headline claim, measured on one L40S after the release rather than before it: block 962,000 executes in 3,357,576,338 cycles with the digest gate passing — the same figure the release notes carry — and the harness asserted the arm was genuinely Core rather than silently stock. 16 chunks proved at mean 247s / max 293s (straggler 1.186x, against the 1.210 this issue predicted from the constants), aggregate 1,238.9s, succinct receipt verified.

The two carve-outs this issue flagged as unresolved stay open, deliberately:

• COST_PER_EC_OP_REPEAT is still 104_222, a bigint2 verifies ECDSA 13.78x faster than libsecp256k1 in-guest — decide what to do about it #139 derivation — tracked in Refit COST_PER_EC_OP_REPEAT for Core — the last constant still carrying a #139 derivation #226. Every other cost constant is refitted, so the packer is not optimising against work that is not there, but this one has not been re-measured for Core.
• Ghost's calibration remains Ghost's next build: the four levers reopened by "fastest wins" #209. Ghost calibration MEASURED on hardware: straggler 1.462x → 1.189x #227 landed the measurement; shipping it is separate.

Also opened from the post-release benchmark run: #229 (gpu-benchmark.sh phase 3 cannot find its own receipts, and the fallback path holds cross-guest ones), and a fresh #119 occurrence — 1 invalid receipt in 16 proves, recovered on retry.