Validate submission b4a51d20-16d0-4438-a5a7-d6cb6387a478

[yukon-autoresearch]

Yukon submission b4a51d20-16d0-4438-a5a7-d6cb6387a478 against https://github.com/Layr-Labs/ecdsafail-challenge at 6909d15d5642acbc643e075fb7cae393ef8132ef.

Current best score: 1486468554. This PR's own benchmark run scores the head commit;
the PR is merged automatically if the submission is accepted, and closed with the result otherwise.

---

Submitter note

Model: GPT-5.6

Q813: one-clean paper2607 EEA using a modulo-256 R carry codec

Summary

This submission is a verified low-qubit/custom-leaderboard candidate at 813
qubits. It is not intended to beat the scalar product frontier: reducing the
workspace to one clean EEA auxiliary increases the executed Toffoli count to
1,170,012,987, giving score 951,220,558,431. The purpose of publishing it is
to preserve a fully checked structural descent from Q814 and provide a sound
base for further work toward Q808 and, eventually, lower custom qubit records.

The exact uploaded circuit passed two complete 9,024-shot evaluations, including
the official ecdsafail run. Both reported:

Metric	Result
Qubits	813
Average executed Toffoli	1,170,012,987
Average executed Clifford	54,344,109.441
Emitted operations	1,289,453,386
Scalar score	951,220,558,431
Classical mismatches	0 / 9,024
Phase-garbage batches	0
Ancilla-garbage batches	0

Model attribution: GPT-5.6 Codex was used as the coding and research agent.
The task ran as a sustained high-effort agentic proof/build/debug loop; the UI
did not expose a more specific reasoning-effort label. The human solver was
Vasily Gnuchev (gnuchev). No autonomous submission harness was used for this
entry: the human explicitly authorized submission only after the trusted local
and official gates passed.

Starting point and objective

The parent was the repaired Q814 candidate frozen at commit baa569cf. Q814
used a two-clean-auxiliary local EEA layout of width 568 and had already passed
all 9,024 trusted shots at 0/0/0. Its whole-circuit metrics were 814 qubits,
1,081,852,127 executed Toffolis, and 1,202,156,283 emitted operations.

The Q813 objective was deliberately different from a scalar-score optimization:
eliminate one more clean qubit without relying on an unproved dirty-register
promise. The project had already seen several low-qubit artifacts fail only
after expensive server validation, so the acceptance rule for this descent was:

1. prove the local loan on the exact reachable domain;
2. generate and independently verify every primitive-stream shard;
3. build the complete circuit and measure the actual qubit peak;
4. replay all 9,024 challenge shots locally with 0/0/0 counters;
5. run the official benchmark on the frozen artifact;
6. only then permit a submission.

Failed approaches and why they failed

Two earlier Q813 constructions were useful counterexamples. They are not part
of this submission.

1. Direct Iter lender

The first construction reused Iter directly as the missing R carry. Its full
build reached 813 qubits but emitted 1,843,800,810 operations and averaged
1,693,840,507 executed Toffolis. The trusted replay immediately falsified it:
all 9,024 shots had classical mismatches and 141 batches retained phase garbage.
Peak RSS was about 96 GiB. This result showed that qubit-count measurement alone
was not evidence that the borrowed value had the required semantics.

2. Terminal-sentinel Iter repair

The second construction attempted to repair the loan by assuming Iter matched
a terminal l_rp sentinel. Raw-control synthesis reduced the candidate to
1,303,773,050 emitted operations and 1,184,362,955 executed Toffolis, with
about 68.1 GiB peak RSS. It nevertheless produced exactly the same 9,024
classical mismatches and 141 phase-garbage batches.

The decisive diagnostic was a reachable-state differential against trusted
Q814. It found the first divergence at schedule step 3, phase B: Iter=1 while
the physical R-prime length boundary was l_rp=254. The terminal-sentinel
relationship held in the synthetic states used by the first verifier but did
not hold on this exact live trajectory. That made the original structural test
too weak, not the trusted evaluator unpredictable.

These negative builds were retained locally under explicit falsified names so
they cannot be mistaken for the submitted artifact.

Sound construction: the modulo-256 R codec

The repaired construction starts from the exact transformed R boundary domain.
Enumeration and reachable-state tracing proved that the quotient boundary used
by the live compact R block is semantic 3 through 258, exactly 256 values.
This creates a reversible coding opportunity:

• fold high boundary values 256, 257, and 258 onto unused low codes 0, 1, and 2;
• use the freed ninth quotient bit to store the incoming dirty Iter value;
• store and clear the incoming carry in the same reversible R envelope;
• decode quotient equality from the remaining eight bits modulo 256;
• execute the R arithmetic;
• reverse the codec and restore Iter, carry, and every external register.

The arithmetic envelope conservatively retains labels 2 and 259 as arithmetic
cells, but they are excluded from quotient equality. This distinction is
important: otherwise physical aliases 2/258 and 3/259 would activate the wrong
quotient cells. The codec is contained entirely inside R, so callers see the
same register contract as trusted Q814.

Dropping one equality control also produced a useful T and memory reduction.
Compared with the falsified terminal-sentinel/raw-control build, the sound
candidate removes 14,319,664 whole-circuit emitted operations and
14,349,968 average executed Toffolis. Its build and evaluation peaks were
67.32 GiB and 67.25 GiB respectively (approximately 72.3 and 72.2 decimal GB),
with zero swap. That was comfortably below the upgraded 128 GB validation
server while remaining close to the requested 60–70 GiB engineering target.

Structural proof portfolio

The structural work was intentionally broader than random circuit tests.

• Reachable Q814-to-Q813 trajectory comparisons passed forward and reverse for
  steps 1 through 8, 16, 32, 64, 130, 257, 519, 800, 1200, and 1616, with 16
  independent challenge-derived cases per checkpoint.
• The step-4 R-codec test covered every one of the 259 boundary labels and both
  modes: 4,088 total cases, including every one of the 3,723 states satisfying
  the trusted Q814 clean-carry promise.
• Representative codec checks also passed at steps 5, 256, 765, and 1024. Step
  1616 was verified to be inactive.
• The retained portfolio covered pre/post state, both phases, LC, R, T-sub,
  T-add, terminal maps, full-step construction width, and reverse exactness.
• Synthetic states outside the Q814 clean-carry promise were not silently
  promoted into assumptions. The proof is explicitly scoped to the reachable
  domain on which the trusted parent is correct.

The principal proof tools are:

• analyze_q813_r_loan_domain.py
• verify_q813_r_mod256_codec.py
• verify_q813_reachable_trajectory.py
• verify_q813_repaired_aux1.py
• verify_q813_terminal_256raw.py

Stream generation and integrity

The repaired source generated all 1,616 schedule steps in 36 resumable shards.
Every source shard was certified before reduction. The frozen reducer reached a
fixed point: a second pass removed zero records from every shard.

Per traversal, the integrated primitive stream contains:

Primitive/count	Value
Records and emitted operations	316,231,401
X	14,145,878
CX	12,243,674
CCX / executed Toffoli	289,841,849
Clean C3X MBU	0

Four EEA traversals contribute 1,264,925,604 emitted operations and
1,159,367,396 executed Toffolis. The unchanged surrounding point-add path
brings the exact whole-circuit totals to 1,289,453,386 operations and
1,170,012,987 Toffolis.

The 36 compressed shards, 36 sidecars, aggregate manifests, reduction receipt,
and re-verification receipts are bound by an 82-entry SHA256SUMS. All 82 hashes
were checked again after the full trusted replay. Independent aggregation
reproduced:

acbf126984eef2c62a8bc59e57503ca1ddb555764cfca27a0ad4cc784d6a4975

The built ops.bin was 976,252,730 bytes compressed and had SHA-256:

7589a35f8e02a5d029349a922e512be62f8b664c20388609743317547e692e15

The source module SHA-256 was:

4cd989a6b37f58c2eefae6cabe856954e18ad46fc0b4aaac94f310c3fa5440f1

Reproduction commands

The Python structural environment used Qiskit from the dedicated contest venv:

& 'C:\tmp\ecdsafail-qiskit-venv\Scripts\python.exe' analyze_q813_r_loan_domain.py
& 'C:\tmp\ecdsafail-qiskit-venv\Scripts\python.exe' verify_q813_r_mod256_codec.py
& 'C:\tmp\ecdsafail-qiskit-venv\Scripts\python.exe' verify_q813_reachable_trajectory.py
& 'C:\tmp\ecdsafail-qiskit-venv\Scripts\python.exe' verify_q813_repaired_aux1.py

The frozen stream was generated and reduced with:

& 'C:\tmp\ecdsafail-qiskit-venv\Scripts\python.exe' generate_q813_source.py `
  --out q813_rmod256_source_run2 --jobs 8
& 'C:\tmp\ecdsafail-qiskit-venv\Scripts\python.exe' reduce_q813_stream.py `
  --source q813_rmod256_source_run2 --out q813_rmod256_reduced_run2 --jobs 8

The Rust source passed Rust 1.93.0 checks and release compilation for both
benchmark binaries. The full direct build emitted the exact guarded operation
count; the evaluator then tested all 9,024 shots. Finally, the current CLI was
invoked through Bun from the repository root:

& "$env:LOCALAPPDATA\reflex\bun\bin\bun.exe" `
  "$env:USERPROFILE\.local\share\ecdsafail\ecdsafail.js" run

The official result was:

loaded ops  : 1289453386
qubits      : 813
tested shots            : 9024
classical mismatches    : 0
phase-garbage batches   : 0
ancilla-garbage batches : 0
avg executed Toffoli    : 1170012987.000
Benchmark complete (score: 951220558431)

On Windows/WSL, the first official wrapper invocation stopped before candidate
code because benchmark.sh had a CRLF shebang. A narrow .gitattributes rule
now pins that launcher to LF. After that harness-only correction, the official
run completed normally and reproduced the direct replay exactly.

Caveats and intended follow-up

This submission is expected to be rejected by the scalar-product leaderboard:
the current promoted scalar frontier is far smaller. Its useful result is the
verified 813-qubit point and the reusable reversible codec. The higher Toffoli
count is the explicit price of eliminating the clean auxiliary; it should not
be presented as a scalar optimization.

The next descent should use this exact Q813 artifact as its trusted parent. A
Q812 or lower proposal must not inherit correctness merely because it measures
fewer qubits. It must repeat the reachable-domain differential, fixed-point
stream verification, complete build, all-9,024 trusted replay, fresh frontier
check, and official benchmark. The longer-term target is a structurally sound
path toward Q808 and possibly Q777, while looking for decoder sharing or
conditional factoring that recovers some of the Toffoli cost without reopening
the dirty-loan bug.

No RunPod worker, GitHub credential, or autonomous submitter was required for
this final validation. Submission uses only the configured challenge CLI
identity and this public note.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[yukon-autoresearch]

Benchmark workflow dispatched: view run #30882806134.

[yukon-autoresearch]

Scored 951220558431 — does not improve the current best 1486468554; not promoted.

metric	value
score	951220558431
current best	1486468554
toffoli	1170012987
qubits	813