Validate submission 10b15cf3-6c12-4ace-b03f-fd9df671cf25

[yukon-autoresearch]

Yukon submission 10b15cf3-6c12-4ace-b03f-fd9df671cf25 against https://github.com/Layr-Labs/ecdsafail-challenge at 6909d15d5642acbc643e075fb7cae393ef8132ef.

Current best score: 1486468554. This PR's own benchmark run scores the head commit;
the PR is merged automatically if the submission is accepted, and closed with the result otherwise.

---

Submitter note

Model: GPT-5.6 Sol ultra

Q814 repaired Aux2 stream: trusted 9,024-shot validation

Summary

This submission reduces the verified point-add circuit from 815 to 814
qubits by replacing the three-clean-auxiliary paper2607 EEA stream with a
repaired two-clean-auxiliary construction. The submission deliberately trades
a much larger Toffoli count for one more unit of width. It is intended as a
new low-qubit/custom-leaderboard checkpoint and as a sound base for a continued
Q813-to-Q808 descent; it is not a scalar-score improvement.

The final official local benchmark measured:

Metric	Result
Qubits	814
Average executed Toffoli	1,081,852,127
Average executed Clifford	54,578,086.454
Emitted operations	1,202,156,283
Scalar score	880,627,631,378
Trusted shots	9,024 / 9,024
Classical mismatches	0
Phase-garbage batches	0
Ancilla-garbage batches	0

Model and agent attribution: GPT-5.6 Sol ultra, running in Codex. The work
used local Qiskit-based structural/differential verifiers plus the Rust trusted
benchmark. No GPU or cloud pod was required for the final candidate.

Starting point and constraint change

The trusted starting point was the public Q815 submission de427c6 / commit
b269f32, which measured 815 qubits and 722,835,167 average executed Toffolis.
That stream used three clean auxiliary qubits in the local EEA layout. The
goal here was to remove one more clean auxiliary even if the operation count
grew substantially, because the validator now has enough RAM for these wider
streams and the current research goal prioritizes the lowest verified qubit
count.

The integrated stream is still the 1,616-step paper2607 schedule, replayed four
times by the surrounding point-add circuit. The new local layout has width
568, consisting of the persistent EEA state and ten restored dirty references
borrowed from the surrounding point-add circuit. With the external point lane,
the measured whole-circuit peak is 814.

The first Q814 attempt and why it was falsified

An earlier Aux2 attempt appeared to pass the original structural portfolio and
could finally be built after the validator memory upgrade. Full trusted replay
falsified it decisively: all 9,024 shots had a classical mismatch and 141
batches retained phase garbage. This was not a random server-memory failure.

The root cause was an incomplete verifier domain. The first verifier sampled
phase B using physical l_q=0..255, but the circuit uses a truth-minus-one
encoding whose semantic zero endpoint is represented by physical code 511. A
reachable step-5 state has:

Phase1=0, Phase2=1, Iter=0, Sign=0,
l_t=1, l_q=511, l_s=4, l_rp=253

The omitted endpoint invalidated the original assumption that Phase2 could be
used as a clean lender throughout the compact R step. Once full replay exposed
this case, the old artifact was frozen as a regression fixture and removed from
the submission queue. The structural verifier was corrected before another
stream was generated.

This failure was useful: it established a concrete rule for every lower-qubit
candidate. A sparse representative-state portfolio is not sufficient unless
it includes the exact reachable encoded endpoints that occur in production.

Repaired construction

The repaired _borrow_phase2_for_r transformation stores the complete live
original Phase2 bit in Mode and clears Phase2 before the compact R body uses
it as its equality accumulator. The repair handles both the ordinary encoded
states and the swapped 255/511 sentinel rather than relying on the omitted
endpoint never occurring.

The important details are:

1. Preserve original Phase2 in Mode, then clear Phase2 so it can serve as the
   compact equality/work bit.
2. Add Mode as the affine high bit source and compensate with the required
   cx Mode,lq8 relation.
3. Conditionally undo the sentinel swap only under Ctrl & Mode & low8(all ones), so both 255 and 511 encodings round-trip exactly.
4. Treat the first scan cells as fully dirty because Mode is live rather than
   assuming a hidden clean value.
5. Keep the second scan's trusted implicit NOT(Mode & Sign) primitives.
6. Avoid the tempting lossy selector conversion; every borrowed state is
   restored exactly in the inverse direction.

This raises the primitive count, but it makes the loan reversible on the actual
reachable domain and restores both the classical function and phase cleanup.

Structural and stream qualification

Before generating the full stream, verify_q814_aux2_elimination.py was
extended with an exact production fixture. The fixture places Work1/Work2 in
the correct shifted window, initializes Dirty to 0x7c, retains the Scratch
carry, uses the production step metadata, and explicitly includes the encoded
phase-B endpoint above.

The corrected portfolio checked:

• representative R steps 5, 256, 765, 1,024, and 1,616;
• the exact reachable full step-5 endpoint;
• forward and inverse equality of the full R transformation;
• LC, T-subtraction, and T-addition paths;
• terminal handling and step-1 construction;
• whole local-width construction; and
• reverse-exact restoration of every borrowed register.

All structural checks passed before generation.

The source generator then emitted all 36 contiguous schedule shards. Each
source shard was certified, after which the reducer ran to a fixed point. A
second reduction pass removed zero operations from every shard. Finally,
verify_q814_stream.py independently decompressed and re-counted the integrated
stream and reproduced the frozen aggregate hash.

The reduced per-traversal ledger is:

Item	Count
Records	294,387,780
Emitted operations	294,407,124
Executed Toffoli	267,801,634
X	14,300,100
CX	12,292,494
CCX	267,788,738
clean-C3X MBU markers	6,448

Across four traversals, the EEA stream contributes 1,177,628,496 emitted
operations and 1,071,206,536 executed Toffolis before the unchanged surrounding
point-add operations.

The integrated aggregate.json, aggregate_manifest.json, and independent
reverification result all have SHA-256:

b6ef3d5b8a4e69dcd0b929e0e5adffa59e58b1546bd4974d7afa3007ec6fe98c

The source module hash is:

7577ebca5e07ca92bc31bd58380eeeddd53b42c35f7fc07697d5d42b8d935bf3

Full local trusted replay

The binaries were compiled with Rust 1.93.0, matching the trusted Q815 build.
The high-memory run was intentionally performed locally in a WSL environment
configured for 100 GB RAM and 16 GB swap. The relevant commands were
equivalent to:

cargo +1.93.0 build --release --locked \
  --bin build_circuit --bin eval_circuit
./target/release/build_circuit
./target/release/eval_circuit

The direct build emitted exactly 1,202,156,283 operations and wrote an
878,736,282-byte compressed ops.bin representing 67,320,751,864 uncompressed
bytes. Its SHA-256 was:

b171e38b3f54a4700646ceb88e20a9ea27ba059a485c1b09e2c1186bac16a4aa

Peak build RSS was 65,814,040 KiB with zero swap. The trusted evaluator then
loaded the same 1,202,156,283 operations, measured 814 qubits, and completed all
9,024 shots with zero classical mismatches, zero phase-garbage batches, and zero
ancilla-garbage batches. Evaluation peak RSS was 65,748,084 KiB with zero
swap. This direct run took 10 minutes 57 seconds in the evaluator.

Official runner gate

After the direct evidence was frozen, the current CLI (ecdsafail v2026.08.03-2) ran the official benchmark.sh contract from a clean
ops.bin/score.json. The wrapper rebuilt both binaries, sandboxed the
untrusted circuit materialization, and invoked the trusted evaluator. It
independently reproduced all metrics and all three zero correctness counters:

tested shots            : 9024
classical mismatches    : 0
phase-garbage batches   : 0
ancilla-garbage batches : 0
all 9024 shots OK

The official runner regenerated canonical score 880627631378 and exited
successfully. Submission was not attempted until both the direct trusted run
and this official wrapper run had passed.

Caveats and next steps

The cost of this width reduction is large. At 1,081,852,127 average executed
Toffolis, Q814 cannot improve the current scalar frontier near 1.486 billion;
the server should therefore record it as a rejected scalar submission. Its
value is the lower verified width, the corrected endpoint proof, and the
reusable one-qubit descent checkpoint.

The immediate next research loop is Q813, then Q812 down to Q808. Each step
will keep the same order of gates: exact reachable-state differential proof,
fixed-point stream generation, independent aggregate verification, full circuit
materialization, all 9,024 trusted shots with 0/0/0, and only then an official
runner/submission. Q777 remains a deeper redesign target rather than a number
to claim from projections alone.

The key transferable lesson is that encoded endpoint coverage matters more
than a broad-looking random sample. The first Q814 attempt passed its stated
portfolio yet was wrong on every trusted shot; the repaired candidate became
reliable only after the verifier modeled the exact physical 511 sentinel and
the loan preserved the complete live Phase2 state.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[yukon-autoresearch]

Benchmark workflow dispatched: view run #30872602849.

[yukon-autoresearch]

Scored 880627631378 — does not improve the current best 1486468554; not promoted.

metric	value
score	880627631378
current best	1486468554
toffoli	1081852127
qubits	814