| … | … | @@ -98,6 +98,53 @@ long-term proper fix. |
| 98 | 98 | 4. **Refereed delegation / statistical** (Gensyn Verde, TrueBit, TOPLOC) — do they |
| 99 | 99 | apply to deterministic-but-not-bit-reproducible builds, or only ML inference? |
| 100 | 100 | |
| 101 | ## Round 2 (2026-06-17, run wf_c8c2da32-c03) — advanced tiers for the non-reproducible tail |
| 102 | |
| 103 | > ⚠ **Harness verification + synthesis BOTH failed on API rate-limiting.** Only the |
| 104 | > 3 Nix-tail claims got genuine 3-0 votes. Everything below was **fetched and |
| 105 | > quoted from primary sources but NOT vote-confirmed** — treat as primary-source |
| 106 | > -extracted, verification pending. The TEE.fail finding is cross-corroborated by |
| 107 | > 4 independent fetched sources, so it carries more weight than the lone-source items. |
| 108 | |
| 109 | **1. Residual tail (CONFIRMED 3-0):** Nix 69–91% bitwise / >99% rebuildable |
| 110 | (arXiv 2501.15919); timestamps ≈15% of failures; **~80% of the tail has NO |
| 111 | identified root cause** (only 19.7% explained). Debian ~94–95.5%, SUSE 99.5% |
| 112 | (sourced, unvoted). ⟹ the tail is small but **substantially irreducible by |
| 113 | mechanical means**. |
| 114 | |
| 115 | **2. TEE-attested builds — anchor broken for OUR threat model (tee.fail, Oct 2025; |
| 116 | 4 corroborating sources).** A sub-$1000 DDR5 memory-bus interposer extracts |
| 117 | attestation keys from SGX / TDX / SEV-SNP and lets an attacker FORGE remote |
| 118 | attestations. TEE defends against a malicious host with physical access — but in |
| 119 | P2P the builder peer IS that host. Trust also shifts to the CPU vendor. ⟹ not a |
| 120 | sound escape for commodity P2P. |
| 121 | |
| 122 | **3. zkVM proof-of-build — feasible, ~5 OOM too slow.** Jolt <100k cycles to prove |
| 123 | 1 RISC-V cycle (~100,000× overhead); real programs (58 benchmarks incl. SPEC CPU |
| 124 | 2017) proven on RISC0/SP1 but seconds-to-hours vs ms native (a16z; arXiv 2508.17518). |
| 125 | ⟹ T3, research-grade. |
| 126 | |
| 127 | **4. ★ Refereed delegation / fraud proofs PRESUPPOSE determinism — they don't escape |
| 128 | it.** Verde (arXiv 2502.19405), Arbitrum interactive fraud proofs, and RDoC (CRR11) |
| 129 | all REQUIRE bitwise-deterministic re-execution to adjudicate the disputed step |
| 130 | (1-of-N honest). So for the non-reproducible tail they DON'T apply — they're an |
| 131 | optimization of T1 (re-run only the divergent step), valid only once determinism |
| 132 | already holds. |
| 133 | |
| 134 | **5. Statistical / TOPLOC** (primeintellect) — built for transformer-inference |
| 135 | nondeterminism; no evidence it transfers to compilation. Open, unlikely (builds |
| 136 | have no smooth approximate-equality notion). |
| 137 | |
| 138 | ### Verdict — no sound escape from T0 for the residual tail on commodity peers |
| 139 | |
| 140 | Fraud proofs need determinism (the precondition we lack); zkVM is ~5 OOM too slow; |
| 141 | TEEs are the only verifiability-without-reproducibility option but their anchor is |
| 142 | broken against exactly our threat model (malicious physical host) and shifts trust |
| 143 | to the CPU vendor. **Honest ceiling for the tail: T0 + provenance/attestation |
| 144 | (SLSA / in-toto signed "who built it, from what") — auditable, not bit-verifiable.** |
| 145 | Engineering leverage is in SHRINKING the tail (playbook + normalize → T1 rebuilder |
| 146 | voting), not chasing TEE/zkVM. |
| 147 | |
| 101 | 148 | ## Implications for the hypercompute code |
| 102 | 149 | |
| 103 | 150 | - The `result`-op handling must become **write-once** (`pool.js:60` currently does |