| Challenge id |
done |
proof on the wire. Topics are operator-published signed documents; git carries no catalog. |
Crates (crates/proof-*) |
partial |
Signed topics, holdout commitments, global pin, per-topic pass + WTA/discovery payout, in-memory store, readiness checks, harvest, and HTTP exist. They do not constitute the full autonomous research loop. |
Binary (bins/proof-challenge) |
done |
HTTP API on :8100. |
Miner CLI (bins/ctx) |
done |
`ctx proof submit |
| Compose / images |
done |
Default compose + images.yml target proof-challenge. |
| Eval pin |
done |
config/proof-pin.toml — eval_image ghcr.io/cortexlm/proof-eval, digest sha256:78b614a1… (publish-proof-eval-image run 33892650063, commit 51f937c7). No HF bake; proxy_model stays empty. Live submits still 503 until harvest is wired, a baseline is sealed, and ≥1 topic is open. Do not re-pin a guessed sha256. |
| Inference offer |
v0 |
Digest-pinned RLM judge backend (proof-eval / harvest call it). Pin [inference] defaults plus schema v1 / ceilings / modes / commitment. config_commitment hashes config knobs and provider.base_url; a topic that spoofs origin is 503 before lattice. Topic require_judge_offer_commitment is optional and not a miner bind. Live InferenceOffer is operator state. Auth is PROOF_INFERENCE_API_KEY_FILE staged as harvest teacher.env (never git, never /v1/status). Missing/closed/judge down / missing key → can_score=false / 503. No baked Qwen; architecture ≠ HF stays retired. |
| Eval executor offer |
v0 |
crates/proof-executor: live 1x EvalExecutorOffer (Lium template, machine_shape, max_proof_deadline_s, digest, config_commitment, status) — a sibling of the judge offer, not the same document. Pin ceilings eval_executor_schema_version / gpu_class = "1x" / max_proof_deadline_s_ceiling = 7200 / optional allowed_lium_template_prefixes / eval_executor_commitment_alg. Public on GET /v1/status + GET /v1/proof/executor; rotated via POST /v1/admin/proof/executor (in-memory until restart; boot from PROOF_EVAL_EXECUTOR_OFFER_FILE). Topic tighten-only eval_executor.{require_offer_commitment, max_proof_deadline_s}, no per-topic machine_id. Lium path: missing/closed/shape ≠ 1x → can_score=false / 503; harvest rents the offer's digest-scoped template (raw Lium UUIDs refused under any allowlist; the resolver binds the template to eval_image@digest) at exactly 1x (rent_gpu_count ≠ 1 aborts pre-rent) and holds the run to the deadline (the deadline is the pod timeout, never clamped by the host fallback; harvest wait = deadline + grace; wrapper-cut run → 503 + stdout_tail, external SIGKILL named separately). PROOF_HARVEST_TEMPLATE_ID / _GPU_COUNT / _DEADLINE_SECS hot-swap under the pin ceilings; refused when the topic pins the offer commitment; the run request and row stamp the commitment of what actually ran. Sim does not consult it. No live Lium rent in CI. |
| Topics |
done |
sr25519 under the proof trust-root key (base-proof-topic-v1). Admin POST /v1/admin/proof/topics. A topic must be sealed to open. |
| Holdout |
done |
Per-topic operator file (PROOF_HOLDOUT_FILE). Commitment in the topic document, never in the pin. xtask proof-holdout --topic-id. |
| Live harvest |
partial |
crates/proof-harvest over harvest-pod stages request.json, teacher.env, PROOF_PROXY_MODEL_DIR, and PROOF_HOLDOUT_STORE. PROOF_FORCE_SIM is local-only. Live rent still needs a republished proof-eval digest (current pin still has the invalid HF default) plus operator-staged proxy dir + holdout shards. |
| Configured allocation |
8000 bps |
Proof-weighted 20%/80% regardless of digest. Payout splits equally across currently open topics, then wta or discovery. Empty digest / missing evaluation prerequisites still fail closed. |
| Automatic emission |
v0 loop |
ProofEmitter (PROOF_EMIT_POLL_SECS, default 120 — same cadence as bounty) pins E at the last epoch block, signs emission_scores when any lattice is positive, and otherwise covers E with NoScore(ChallengeInternal) so D24 can seal (Held once this host already scored the epoch). The scored-epoch watermark is persisted (PROOF_SCORED_EPOCH_FILE on the artefacts volume); the gateway also 409s a ChallengeInternal burn that would replace a positive leaf. In-memory store still loses submissions on restart. Do not infer on-chain payment from can_score. |
RLM engine (crates/proof-rlm*, proof-canon) |
generic / fail-closed |
Topic schema carries generic bindings (constraints.{firecracker_required, model_pin, task_slice, params}, checklist rule vector, eval_executor.{require_offer_commitment, max_proof_deadline_s}); custom_id is topic data (open needs a registered runner). Core: versioned rule sets + checklist + spend token (no paid inference behind a red checklist), lifecycle draft → owner_presend → awaiting_owner_keys → provisioning → baselining → open ⇄ evaluating → promoting → closed with owner hooks, CustomRunner + RunnerRegistry (empty by default), TopicVmOrchestrator boundary with UnwiredVmOrchestrator and the generic VmBackedRunner, promotion rule. Store: migration 0020_proof_rlm.sql + PgRlmStore / MemoryRlmStore (topic versions, rule versions, checklists, transitions, baseline, artefact metadata, promotion continuum). Host: RlmScorer routed through FamilyMux (per-topic lease from score to persist, promotion decided against the store's best with a compare-and-swap on the pointer; runner-measured flops_used in the verdict, missing → 503, over budget → reject; artifact_uri reaches the runner), artefact zips + best.json + events.jsonl, TopicSetup driver (mark_sealed opens only a signed, valid, open document sealing the RLM's measured value). No registered runner, no challenge content by default: every custom topic answers 503 until the operator lists ids in PROOF_VM_RUNNER_CUSTOM_IDS. The registry is wired from the topic-VM orchestrator env alone: live orchestrator + ≥1 id with no Lium harvest → FamilyMux::custom_only (custom scores, nll / throughput 503, no row); no placeholder Lium key is needed to open custom topics. /v1/status reports the families apart — live_harvest_wired is Lium only; custom_family_wired / registered_custom / custom_ready are the custom family. |
Topic-VM orchestrator (crates/proof-vm-proto, proof-vm-fc, proof-vm-agent, proof-fc-host, bins/proof-vm-orchestrator) |
implemented / operator-gated |
FirecrackerOrchestrator is the live TopicVmOrchestrator: HTTPS client (bearer file, never logged; https only off loopback) of the proof-vm-orchestrator agent on a dedicated KVM host. Preferred by bins/proof-challenge when PROOF_VM_ORCHESTRATOR_URL + PROOF_VM_ORCHESTRATOR_TOKEN_FILE are set; PROOF_RLM_VM_IMAGE_DIGEST pins the RLM rootfs (4 vCPU / 8192 MiB; unpinned → 503). Agent: one jailed Firecracker RLM VM per topic_id (digest re-hashed before boot, hard topic bind on envelope + job, per-VM job lock), vsock jobs, owner key material staged from the host's own dir, per-VM nftables egress allowlist, sister miner guest with no network for every paid run, host-stamped sandboxed / guest-measured flops_used (the attestation names the job's topic / submission / artefact and both agent and CP run bind_evidence before accepting it), jail guard so a failed boot or a cancelled sister leaves nothing on the host, dead-VM reaping per retain policy (crashed, topic may recreate), destroy-or-retain teardown. deploy/systemd/proof-vm-orchestrator.service + runbooks/proof-vm-orchestrator.md. Operator probe GET /v1/admin/proof/vm-orchestrator (the CP's own client: ready / reason, agent health, custom_family_wired / registered_custom, live_harvest_wired Lium-only) and the staging harness deploy/scripts/proof-vm-wire-check.sh (env / agent / cp / boot-probe / submit-probe / matrix; tested against the fake agent) with placeholder overlays deploy/env/*.staging*.example. Staging: the agent booted Firecracker colocated on cortex-staging (nested DO /dev/kvm — an allowed exception, proven) and the runbook's § 4 fail-closed matrix came back green; image digests are operator state on that host (computed from images built outside this repo; nothing in git invents one), the § 5 happy path and § 6 sign-off are still to be recorded, and nested KVM stays fragile (boot fails → provision the dedicated droplet). Production: a dedicated DO droplet (g-8vcpu-32gb, nyc1, nested /dev/kvm) on the VPC, never colocated on the CP; the agent's certificate must carry a SAN for the host the CP's URL names (PROOF_VM_AGENT_TLS_SANS, boot-checked); not deployed. CI runs the fake hypervisor only. mTLS is a follow-up. |
Experiment VMs — one VM per paid job (crates/proof-experiment, proof-fc-experiment, proof-vm-guest, bins/proof-vm-guest-agent, deploy/guest/) |
implemented / not yet baked or booted |
Generic in-guest binding read from the signed topic's constraints.params (in_guest_benchmark_runner, experiment_pack_digest, optional experiment_pack_path / size ask; proof-experiment), held under configurable caps (lock: 16 vCPU / 32 GiB RAM — default, ceiling, and hard maximum: ExperimentCeilings::validate refuses a CP or host ceiling above 16 / 32768 so the process does not boot, and no shape above it is admitted; writable disk ≥ 16 GiB with 32 GiB default, not locked; both CP PROOF_EXPERIMENT_VM_* and host PROOF_VM_AGENT_EXPERIMENT_MAX_*; over = 503, never a clamp). proof_rlm::run_paid_job creates one dedicated TopicVmSpec { experiment } per Baseline / Evaluate, runs the job, tears the VM down with a policy that follows the outcome — destroy after a successful job whose report passed final verification, returning the outcome only when the orchestrator confirms the destroy (Ok(false) or a teardown error is VmError::TeardownUnconfirmed, 503, no row, no baseline, even after a successful run); retain after a failed one or an Evaluated report that fails binding / sandbox checks (the jail — guest console.log, scratch.ext4 with report.json — moves under PROOF_VM_AGENT_RETAIN_DIR/<vm-id> when free, else <vm-id>-<stamp> so a restart cannot nest, the job's own error is returned, an unconfirmed retain is logged with the VM id, nothing is scored) — and RlmScorer::score logs every refusal (evaluate refused; no row: topic, frozen digest, the 503 body's error string) so the host journal keeps what the miner's 503 body carried (VmBackedRunner and TopicSetup both route through run_paid_job). Agent: experiment VMs bypass the one-per-topic rule, never answer attach, count against PROOF_VM_AGENT_MAX_EXPERIMENT_VMS (503 capacity), ids <topic>-x<n>; health reports experiment_vms. Host layer proof-fc-experiment: ceilings → pack resolved under PROOF_VM_AGENT_EXPERIMENT_PACK_DIR + re-hashed (verify_artifact, ≤ 160 MiB) before any jail → boot with disk_mib scratch → StagePack over vsock → job bound to the VM's runner + pack → SisterAttestation { mode: experiment_vm } for that VM and job; CP refuses an attestation naming another VM. Guest (proof-vm-guest-agent, vsock :5000 or stdio): hello, tmpfs secrets (chowned to the run-as user), pack verify + unpack, artefact fetch streamed under a hard 64 MiB cap (cut mid-body, never buffered first), adaptor exec contract (/opt/proof/runners/<id>/{run,inspect,propose_rules}, PROOF_* env — two signed params that collide as one PROOF_PARAM_* name are refused before anything runs — report.json / checklist.json / rules.json), stdout / stderr drained into a rolling 64 KiB tail while the process runs, deadline kill, secret redaction in tails and evidence; no default value ever — no runner / adaptor / pack / report / finite value → Failed. Bake deploy/guest/bake-rootfs.sh (Debian minbase + rootless podman/crun/fuse-overlayfs with the store on run-as-owned scratch paths init.sh creates — graphroot /var/lib/proof/containers/storage, runroot /run/user/<uid>/containers — generic operator hooks --extra-pkgs / --overlay / --chroot-hook for harness tooling, tree budget 2560 MiB, image named after its own sha256sum, RE-LOCK steps printed) with the adaptor contract, fail-closed skeleton, and Harbor evaluate reference adaptor (deploy/guest/runners/rlm_fc_in_guest_harbor/); generic guest scripts (bake-rootfs.sh, init.sh, agent-loop.sh) still must not name a harness. Harbor CLI, venv, and task packs stay operator artefacts. Tests: fake orchestrator (incl. injected unconfirmed / failed teardown, retain-on-fail, the refusal journal line) / hypervisor / recording stager / shell-script adaptors (incl. param collision, output flood) / chunked-body fetch cap / bake --dry-run; no image built or booted, no live run, no metal evidence — runbook runbooks/proof-experiment-vms.md § Limitations (rootless podman not Docker-in-VM, guest kernel features, guest-authored flops_used, inspection needs an adaptor). |
| Autonomous research judge |
partial |
Python judge.py requests an acknowledgement, while agent.py uses static text checks. General recipe reproduction and the paper's recursive investigation are not implemented. |
| Research persistence |
missing |
The service uses MemoryStore; submissions and scores are lost on restart. Public HTTP records are not a durable artifact archive. |
| Synthesis / shared-stack adoption |
missing |
The second agent and verified adoption loop described in whitepaper §7 are not implemented. |
| Spec |
live |
PROOF.md. |