feat(validator): gate UID30 launch on a reviewed one-miner 100/0 preview - #149
Conversation
|
@codex review Please review exact head 5e06273 against its stated outcome: default no write, exact UID30 signer, one pinned verified miner, exact [65535], no burn destination, digest-bound operator confirmation, common single-writer journal, and finalized readback. Treat miner registration, axon announcement, deployment, and remote-host exclusivity as explicit external gates, not claims of this PR. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5e062734a6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if fresh.block_number > int(preview["valid_until_block"]): | ||
| raise UID30LaunchError("reviewed preview expired before submission") |
There was a problem hiding this comment.
If the sign-time RPC returns a stale finalized head below valid_from_block, while the signer, miner mapping, and last_update remain unchanged, this check accepts it because it enforces only the upper validity bound. The submission path can then sign a mortal extrinsic anchored before the digest-reviewed interval, so require fresh.block_number >= preview["valid_from_block"] as well.
Useful? React with 👍 / 👎.
|
@codex review Please review exact head Outcome target: one reviewed UID30 attempt may assign mechanism 0 exactly The five prior blockers are addressed:
Adversarial follow-up also closes malformed zero-burn generic recovery, prevents local finalization before strict identity validation, re-proves already-finalized journals from chain, and preserves recovered zero-burn status parsing. Exact-SHA focused tests are 31 passed. Critical Ruff, repository format scope, compile, and diff checks pass. One pre-existing macOS errno-name assertion remains outside the diff. No miner registration, deployment, axon announcement, signature, weight submission, or spend occurred. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 095b488fe3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| expected_subnet_owner_hotkey=str(identity.get("burn_hotkey") or ""), | ||
| expected_subnet_owner_hotkey=str( | ||
| identity.get( | ||
| "subnet_owner_hotkey" if zero_burn_uid30 else "burn_hotkey" |
There was a problem hiding this comment.
When canonical validator startup recovers a pending zero-burn UID30 attempt, this branch lets it rely on _classify_finalized_receipt and then call _finalize_common_submission without performing the historical Weights query required by the dedicated recovery path. Consequently, a restart can report a recovered finalization even when UID30's mechanism-0 storage at the inclusion block is not exactly [[miner_uid, 65535]]; run the same historical storage readback before finalizing this zero-burn path.
Useful? React with 👍 / 👎.
| version_key=VERSION_KEY, | ||
| wire_uids=[state.miner_uid], | ||
| wire_weights=[W], | ||
| uid_hotkeys={state.miner_uid: MINER_HOTKEY}, |
There was a problem hiding this comment.
If the pinned validator hotkey is remapped away from UID30 before inclusion, this proof still passes its identity checks because uid_hotkeys contains only the miner mapping; the classifier merely verifies that the signer hotkey is uniquely registered and permitted, not that its inclusion-time UID is 30. If UID30's historical storage already happens to contain the reviewed vector, the subsequent storage query also cannot expose the remap, so include the expected UID30-to-signer binding in the inclusion proof.
Useful? React with 👍 / 👎.
Exact-head repair outcomeCommit: Outcome targetA UID30 launch may finalize only when the exact signed one-miner Finding dispositions
Verification
Local environment boundaryA broad macOS run reached Next gateKeep this PR draft and stacked on #148. Require exact-head GitHub CI plus review, then merge only after #148. No wallet access, signing, submission, weight write, deploy, or CyberGym change occurred. |
|
@codex review |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
PM after #148 merge ( Still needs a rebase onto 100/0 is the Cathedral-owned miner ( Did not ping Astro. |
6d41e30 to
da1c157
Compare
|
Rebased onto New head: The UID30 launch/recovery slice was replayed without squash (3 commits). Independent_v1 fail-closed gates from #148 are unchanged. This remains draft; base is No wallet access, signing, |
|
PM after #150 merge ( Live cathedral.computer catalog unchanged (validator source only — no site/PolarIS prod deploy from this). Homepage still Sealed receipt caption. No Next ship order:
CyberGym #146/#147 stay held. #155 bearer / enroll 522 still operator-mint. Did not ping Astro. |
Add a default-no-write command that pins cathedral/default to Finney SN39 UID30, verifies one registered serving miner with the reviewed QVL and canonical SAT work, and emits an owner-only canonical preview plus detached SHA256. Require current permit, stake, cooldown, weight policy, UID replacement safety, a pristine canonical launch journal, the canonical runtime root, an explicit all-writers-stopped assertion, and an exact reviewed digest before the sole signing path can build [65535]. Recheck chain state after QVL/SAT, journal signed intent before broadcast, verify finalized readback, and leave ambiguous attempts fenced against retry. Cover wrong identity, zero-burn enforcement, stale last_update, duplicate writers, digest mismatch, pre-sign cleanup, post-sign ambiguity, and exact u16 finalization.
Bind preview and submission to the current finalized axon, bounded inclusion window, exact signed extrinsic, and canonical storage readback. Add read-only signed-attempt recovery while refusing malformed zero-burn identities before any recovery mutation, so an ambiguous UID30 write never authorizes a replacement.
Bind the reviewed validator hotkey to UID30 at the receipt block and require generic zero-burn restart recovery to read the exact mechanism-0 storage row at that same finalized block before finalizing. Archive failures remain NOT_PROVEN, concrete row drift is terminal FAIL, and adversarial tests cover signer remap, primary and recovery storage mismatch, exact query coordinates, and no-write fencing.
da1c157 to
996651c
Compare
|
Rebased this branch onto current
Conflict resolution: only This PR stays draft. Do not mark ready. Do not merge until exact-head CI is green and review is complete. Exact-head CI should rerun on No live chain/wallet action occurred: no |
Drive both the primary UID30 finalization path and canonical zero-burn recovery through historical Weights RPC failures. Prove the signed attempt remains pending or NOT_PROVEN, never finalizes, and cannot trigger a second chain call.
|
@codex review Refreshed-main exact-head merge gateExact head: Outcome targetA UID30 launch may finalize only when the exact signed one-miner Rebase and provenance proofA concurrent Cursor Agent rebase produced the clean remote chain
The feature commit's patch ID changed only because its Final finding dispositions
Claude Fable exact-patch verdict on the two new integration tests: PASS. No P0-P2 gap remains in that repair. Local verification
Keep draft until exact-head GitHub CI and review complete. No wallet access, signing, weight submission, broadcast, deployment, axon announcement, or CyberGym change occurred. |
Final merge dispositionExact head Acceptance evidence:
Verification:
Trust boundary: this merge proves source behavior and tests only. It does not access a wallet, sign or broadcast weights, register a miner, announce an axon, deploy a machine, prove live TDX/SAT evidence, or establish finalized SN39 weights. Those remain separate operator-gated launch steps. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_5f76feea-c30a-4d04-a86f-13d3ec2bf01f) |
|
PM after merge ( Live cathedral.computer catalog unchanged (validator source only — no site/PolarIS prod deploy). Homepage still Sealed receipt caption. Fast Persistent Hetzner $0.15 available, no receipt; one-shot Fast off; GPU unavailable. PolarIS prod still Next ship order:
CyberGym #146/#147 stay held. #155 bearer / enroll 522 still operator-mint. Did not ping Astro. |
1 participant
Outcome target
Provide one operator-reviewed, default-no-write path from fresh SN39 miner evidence to one UID30 mechanism-0 weight submission. The only accepted vector is one current registered Cathedral miner at u16 weight
65535, with no burn destination and zero burn mass.This PR does not register a miner, provision compute, publish an image, announce an axon, sign during preview, deploy a validator, or submit weights by itself.
Exact outcome contract
cathedral, hotkeydefault, current UID exactly 30, pinned public hotkey5FF6FtDUhn7XdPYmEdH5XjLAmLfmwLTCNVBgcrj3A4sstwaw.5CJTD6znKPfsQFjPQtTvRiHHcLtpXJr7P16dF4VuEtx9qn7G.[verified_miner_uid].[65535].0.0. Booleans, an extra burn key, a second target, self-pay, or owner-pay are refusals.SubtensorModule.set_mechanism_weightswith the pinned version key.Acceptance targets
Preview succeeds only when all of these are proven from current finalized state:
last_update, rate limit, mechanism count, version key, min weights, max-weight limit, commit-reveal state, next epoch, and subnet owner match the launch contract.35bb55f89f411d5dcf5f72be90488e999ee68c41dfc0429a0dcb8cc2b448b6bb.The preview is canonical owner-only JSON with an owner-only detached SHA256. Its inclusion policy is bounded by both the reviewed epoch window and 15 minutes.
Submit additionally requires the reviewed SHA256,
--confirm-uid30-launch,--assert-exclusive-writer, and the canonical/var/lib/cathedral-validatorruntime root. After evidence collection, submit must re-read finalized state, reject a regressed or unrelated head, re-resolve the reviewed block hash, re-resolve the miner endpoint, and re-check the evidence anchor before signing.Final success requires all of these:
[[verified_miner_uid, 65535]].Signed-ambiguity recovery target
cathedral-uid30-launch recoveris read-only with respect to chain state. It never signs or submits.PASSre-proves the finalized call and historical storage before finalizing the local journal.FAILis recorded as a durable positive contradiction and blocks further recovery.NOT_PROVENstays fenced.EXPIRED_WITHOUT_INCLUSIONis allowed only after every block in the mortal era was finalized and read with no exact inclusion. It retires the attempt without retrying or spending another launch authorization.ALREADY_FINALIZEDis reported.Both dedicated and generic restart recovery use one strict zero-burn UID30 identity validator before archive reads or local finalization. It requires the pinned signer and miner, canonical SS58 owner, exact digest and report ID, exact exclusivity assertion, reviewed and fresh miner bindings, one full-weight target, and strict non-boolean numeric types.
Implementation
Verification
095b488fe3404b432cfade1bd24fbf0ce326c606.ECONNREFUSEDbut receivesOSError[111]; the same failure reproduces on the clean PR base.git diff --checkpass.Deployment target
Rollback and failure behavior
Proof boundary and next gate
This is implemented, locally verified source. It is not merged, deployed, live-QVL-proven, live-SAT-proven, validator-accepted, on-chain, or rewarded. Remote writer exclusion remains an explicit operator assertion.
Next gate: merge and publish dependencies, run one live miner, then generate a fresh no-write preview whose detached digest and exact action packet are reviewed before any UID30 signature.
Note
High Risk
Introduces a gated but real Finney weight broadcast with strict one-attempt journaling; mistakes or ambiguity handling directly affect on-chain UID30 weights and operator recovery posture.
Overview
Adds
cathedral-uid30-launch(preview/submit/recover) for a one-shot SN39 mechanism-0 weight from pinned UID30 (cathedral/default) to a single TDX-verified Cathedral miner at u16 65535, with no burn.Preview builds owner-only canonical JSON plus a detached SHA256 after live chain preflight, endpoint census (public IP, port 8081), QVL/SAT collection, and writer-lock checks—no sign or broadcast. Submit requires the reviewed digest,
--confirm-uid30-launch,--assert-exclusive-writer, and the canonical runtime root; it revalidates head/miner evidence, reserves one attempt in the canonical ambiguity journal, signs once, and finalizes only after exact extrinsic proof and historicalWeightsstorage match. Recover is read-only for journaled signed intents (including expire-without-inclusion).scaffold/validator_thingains pinned UID30 launch constants,_strict_zero_burn_uid30_owner, and_classify_zero_burn_uid30_historical_weightsso generic pending/finalized recovery treats this launch like other authority submissions while allowingburn_uid: Nonein recovered status text.Reviewed by Cursor Bugbot for commit 2d2d0b4. Bugbot is set up for automated code reviews on this repo. Configure here.