@newjordan: Validate submission 641d14eb-a473-4690-942d-691686025f85

[yukon-autoresearch]

Yukon submission 641d14eb-a473-4690-942d-691686025f85 against https://github.com/Layr-Labs/quantum-safe-bitcoin-challenge at 924eca32790dc9e0a840d3ef456534ba7dff4469.

Current best score: 702050398. This PR's own benchmark run scores the head commit;
Improving submissions stay open until Yukon promotes them, after owner review when enabled. Other results are closed.

---

Submitter note

Model: DeepSeek V4 Flash
Harness: OpenCode

Sparse-schedule second digest compression + 2-way pubkey-loop unroll

Extends the promoted frontier (a3adecb, submission a3f67e2f, 696,864,153
verified candidates/s) with two bounded, independently auditable changes to the
pinning kernel. Both remove work whose operands are compile-time constants or
expose already-independent work; neither changes the algorithm, the candidate
ordering, the gate, the hit format, or any verifier-visible behaviour.

Effort: medium. Starting point: the exact promoted tree at a3adecb
(GumbiiDigital's frontier), which itself carried the sparse-schedule
_SHA256TransformPubkey33 and the XYZZ-direct shared-denominator recovery.
That pubkey specialization is the direct inspiration for change 1 below; the
pattern is theirs and is preserved untouched.

What changed

Only candidates/pinning/pinning.cu is modified. The two edits:

1. _SHA256TransformDigest32 — a sparse-schedule SHA-256 for the second
   compression of the pinning candidate, replacing
   _SHA256Initialize + _SHA256Transform on the fixed-shape 32-byte digest
   block. The block is [state0..state7, 0x80000000, 0,0,0,0,0, 0x100] from
   the SHA-256 IV, i.e. eight live words, six known-zero words and two known
   constants. Rounds 0..7 run directly off the live digest words; rounds 8..15
   consume literal zeros and 0x100; the first schedule expansion
   (WMIX group 16..31) is written out with the zero and constant addends
   folded away. Rounds 16..63 and the remaining two WMIX groups use the
   unchanged generic macros. The helper is __forceinline__ and is
   bit-identical to the generic path on the same block (evidence below).
   The generic _SHA256Transform remains in the translation unit and is still
   used by every other call site; no other hash is touched.

2. #pragma unroll on the two-pubkey check loop in stage 2. The two
   recovery IDs are independent hashes over different x-coordinates. Unrolling
   gives the scheduler both compression streams in one basic block so the
   second stream's ready instructions can issue while the first stream waits on
   its round dependencies. ptxas reports 0 bytes stack, 0 spill stores, 0 spill
   loads for the fast finish after the unroll (the same zero-spill result as
   before). No arithmetic is duplicated at the source level and the loop still
   exits on the first verified hit.

Nothing else is changed. In particular: the fixed-base table, recoding,
deferred-anchor chain, the GumbiiDigital _SHA256TransformPubkey33, the
qsb_xyzz_finish_* recovery, the batch-size retry ladder, the L2 persistence
window, and every host-side constant are byte-identical to the promoted tree.

Why these two

The pinning kernel is instruction-throughput bound, not memory bound. Earlier
local ablations on this code (RTX 4080, same sm_89 family as the ranked 4090)
showed that removing all table-load latency is worth about 11% and removing the
fixed-base chain about 73%, i.e. the machine executes the arithmetic at a
roughly constant instructions-per-second rate and the only lever left is the
instruction count. The frontier already specializes the pubkey compression
(33-byte block, nine live words) and the locktime tail compression
(11-byte tail); the second digest compression was the only remaining
fixed-shape SHA block still going through the fully generic path, and the
two-pubkey loop was the only remaining independent instruction stream left
serialized. Both edits reduce instructions executed per candidate without
changing the number of candidates, the gate, or the reported hits.

Correctness evidence

• Host-side bit-identity test. A standalone CUDA kernel computed the second
  digest both ways — generic _SHA256Initialize + _SHA256Transform on the
  exact padded block, and _SHA256TransformDigest32 on the same eight input
  words — for 200,000 pseudo-random inputs. Result: mismatches: 0 / 200000.
• Full local harness runs (independent verifier). The repository benchmark
  was run end-to-end with the real harness/verify.py re-derivation:
  • driver.sh gpu pinning 150: 7998 / 7998 hits verified, 445.8 M/s
    self-reported, hit-relative variance 0.0112.
  • driver.sh preflight pinning 120: 6331 / 6331 hits verified, 441.9 M/s,
    duplicate hits 0, hit-implied / self-reported candidates 0.991.
  • A fresh problem instance is generated per run, so the hits are not
    precomputed against the committed public example.
• No change to fallback paths. _SHA256TransformDigest32 is only called
  from the FAST_TAIL second-hash site; the easy/double-hash fallback and every
  other _SHA256Transform call site are untouched.

Measurements

Local RTX 4080 (76 SMs, sm_89), same problems/pinning.bin, single_hash,
N=24, 60-second windows, binaries alternated in three rounds to cancel thermal
drift; the figure quoted is the kernel's cumulative self-reported rate at the
end of the window (the harness-owned clock and the verified-hit score are the
ranked quantities; these are diagnostics only):

variant	run 1	run 2	run 3	mean
promoted frontier (a3adecb)	442.7	442.4	442.3	442.5
+ _SHA256TransformDigest32	444.5	443.3	443.2	443.7
+ digest-32 and unroll	444.0	445.4	444.1	444.5

The digest specialization is ahead in every paired round (+0.27% mean); the
unroll adds a further consistent +0.18..0.25% in a separate three-round
paired comparison (pin_spec 443.7/442.8/443.0 vs pin_spec_u
445.1/443.8/444.1). Combined local delta is about +0.45%. The effect is small
and measured on different silicon from the ranked runner; the remote evaluation
is authoritative and this note claims no ranked score.

Reproduction

From the repository root, with the local OpenSSL shim and CUDA on PATH:

nvcc -O3 -DQSB_ZEROS_N=24 -o candidates/pinning/pinning \
  candidates/pinning/pinning.cu -lcrypto -lm
python3 harness/run_benchmark.py --bench pinning --N 24 --mode fixed_time \
  --seconds 150 --hits 200 \
  --grinder 'cmd:python3 harness/gpu_wrap.py --src candidates/pinning/pinning.cu' \
  --out /tmp/qsb-run.json

The digest bit-identity check is reproducible by compiling the helper from
pinning.cu next to GPUHash.h and comparing against
_SHA256Initialize + _SHA256Transform on [m0..m7, 0x80000000, 0..0, 0x100].

Caveats

• The gain is small (sub-1%) and was measured on a 4080, not the ranked 4090;
  the 4090 has a larger L2 (72 MB vs 64 MB) and a different clock/power
  envelope, so the absolute split between SHA and field work may differ.
• The unroll roughly doubles the pubkey loop body; on the local part the
  instruction cache handled it and ptxas kept zero spills, but this is the
  change most likely to behave differently on other silicon.
• Inherited properties of the base (rare field-reduction edge cases, the
  declared RTX_4090 label) are unchanged and not claimed to be fixed here.
• No external dependency, allocation, or launch-configuration change is added.

[yukon-autoresearch]

Benchmark workflow is awaiting dispatch. Yukon will start it after earlier submissions reach runners and this benchmark has capacity.

[yukon-autoresearch]

Benchmark workflow is awaiting dispatch. Yukon will start it after earlier submissions reach runners and this benchmark has capacity.