A portable go-kit for the ecdsa.fail post-quantum benchmark — the cheapest reversible secp256k1 point-add (Shor's-algorithm inner primitive), driven by a dual-agent autoresearch harness.
Honest framing, load-bearing: this is quantum resource estimation / a durability signal, not an attack. Nothing here claims ECDSA is practically broken, and nothing here claims anything is fully post-quantum safe.
The ecdsa.fail challenge (run by Eigen Labs) scores a reversible secp256k1 point-add
circuit by avg_executed_Toffoli × peak_qubits (lower is better), validated against
9,024 Fiat–Shamir witnesses hashed from the circuit's own op stream — a held-out gate
the optimiser structurally cannot tune to. This repo is the self-contained kit for
competing in it honestly:
- a reference Rust reversible-circuit toolchain with five EC-add circuit families (vendored — another participant's work, linked in),
- a GPU island search that accelerates the nonce hunt by ~1000× (vendored — another participant's work; it produced the current qubit SOTA),
- and a Swordsman ⚔️ ⊥ Mage 🧙 dual-agent harness (mine) that turns the search into a disciplined propose → hunt → assay → critic loop, where a proposer and a prover are held apart by the benchmark's own held-out gate.
The two toolchains are other participants' open work, downloaded into this kit so my
approach can build on them; what is mine is the method layer (these docs + the
harness). The thesis (in THE_AGENTPRIVACY_EDGE.md): the frontier here is
insight-limited, not compute-limited — the proposed edge is the structure of the
agent team, not a bigger sweep.
Frontier now
1,141,987,344 = 903,471 × 1,264(welttowelt, 2026-08-28), reproduced0/0/0here. It moved −27 % since July by a structural swap — one solver replaced the jump-2 GCD dialog with a fixed-depth ping-pong division (+171 qubits bought −332 k Toffoli, −14.8 % in one step) — followed by a week of laptop-scale swarm work walking the width back from 1,321 to 1,264. The full adjacent-pair decode, the binder migration chain, what it does to our K1–K17 map, and six priced next levers:research-notes/ARCHAEOLOGY_2026-08-29_pingpong-regime.md·NEXT_STEPS.md·chronicles/2026-08-29_the-regime-change.md. Everything below this banner describes the retired route (history, kept as the negative-results map).
The full loop now runs on a consumer box (WSL2 + RTX 4060). The community SOTA is
reproduced fresh at 0/0/0 here (1,571,592,960 = 1,364,230 × 1,152; single source of
truth: frontier.json). From there, every single-move lever on all three score axes was
taken to measurement and found exhausted — the strongest empirical form of
"insight-limited":
| Axis | Lever tried | Result | Ledger |
|---|---|---|---|
| avg-Toffoli | nonce luck (tighter island filter) | 0 clean islands / 30M nonces (~10k nonce/s) | K15 |
| Toffoli | classicalisation (offset-derived ANDs → free) | 8 / 1,446,685 classicalisable (≈ already banked) | K16 |
| qubits | drop the 1,152 peak (an 11-phase plateau) | governor + reserves a tuned local optimum | K17 |
A beat now provably requires a coordinated value-exact structural package (new
per-co-binder primitives + a GPU re-hunt that also wins the product race) or a novel
result — not a knob or a bigger sweep. The full arc: chronicles/2026-07-01_the-luck-and-the-floor.md;
the analysis: research-notes/; the negative-results map: notes/KILLED_LEVERS.md (K1–K17).
Still a prediction: whether the persona-structured proposer generates better levers
than a single flat agent for equal compute (the generative edge, CR-2) is falsifiable and
un-run — see harness/falsify.md.
| Tier | Files | Role |
|---|---|---|
| Start | START_HERE.md |
north-star, first-session checklist, portability — read first |
| Nav | MANIFEST.md · COHERENCE.md · bootstrap.sh |
inventory · scope rules · guided Linux+GPU setup |
| Method | SHOR_MAGE_CHRONICLE.md · SHOR_MAGE_DOSSIER.md · THE_AGENTPRIVACY_EDGE.md |
operating manual · review brief · the edge thesis |
| Registers | frontier.json · claims_register.md · notes/KILLED_LEVERS.md |
single source of truth (numbers) · every claim with proven/predicted status · the K1–K17 negative-results ledger |
| Harness | harness/ · harness/falsify.md |
the runnable Swordsman ⊥ Mage dual-agent loop · the generative-edge falsification stub |
| Skills | SKILLS.md |
portability manifest — the Claude Code skills the loop assumes (in-kit vs external) |
| Findings | chronicles/ · research-notes/ · papers/methodology_draft.md |
the working chronicles · EX-1 / qubit-floor analyses · the methodology-and-negative-results draft |
| Toolchain (vendored) | trailmix-main/ · ecdsafail_gpu_toolkit-main/ |
other participants' work, linked in: reversible-circuit Rust toolchain · GPU Fiat–Shamir island search |
| Reference | REFERENCES.md |
agent-discipline papers (RCI, SkillOpt) + multiplicative-complexity prior art, linked not redistributed |
| Context | context/ |
narrative essays — public story, not method (see context/README.md) |
The Mage 🧙 (proposer) re-expresses paid Toffoli work as free Clifford moves and proposes
bounded tightenings; the Swordsman ⚔️ (prover) referees the score product and runs the
full held-out 9,024 — only a 0/0/0 validation that strictly beats the synced frontier
counts. The two are held apart by the Gap: the witnesses are hashed from the proposer's
own op stream, so tuning to the test set is structurally impossible. Grounding, hard
rules, and how to run it: harness/README.md.
Proven vs predicted (read honestly). What is proven is a negative filter: cheap
CPU/GPU probes killed the candidate levers for the cost of scripts, zero wasted builds
(notes/KILLED_LEVERS.md; ~10 novel kills / ~5 re-confirmations, spanning all three
score axes — K15/K16/K17 above). What is predicted, not shown, is that the
persona-structured proposer generates better levers than one flat agent for equal compute —
a falsifiable, un-run prediction (harness/falsify.md). The held-out gate itself is the
arena's, inherited, not invented here. Every claim resolves to a row in
claims_register.md.
The loop needs a Linux + NVIDIA GPU box (confirmed working on WSL2 Ubuntu + RTX 4060, CUDA 12.4 — reproduction and hunts run there; see the 2026-07-01 chronicle).
- Read
START_HERE.md. - On the GPU box:
./bootstrap.sh(guided, checkpointed; outward-facing steps are explicitly gated). - Drive the harness per
harness/README.md. Baking and submitting are human-triggered — the harness stops at proven candidates.
What's useful to the group (calibrated honestly by audience — the full read is
chronicles/2026-07-01_who-this-helps.md):
- Newcomers / mid-tier contributors — concrete time saved. The
notes/KILLED_LEVERS.mdledger (K1–K17) is an on-ramp: a map of what's already spent and why (RNS, projective, BY-divstep, Karatsuba, tape-codec, lazy-Solinas, classicalisation, the qubit plateau…), so you don't re-walk dead levers — hours-to-days each. Plus a reproduce-at-0/0/0recipe on consumer hardware (notes/ENV_SETUP_WSL2_CUDA.md) and the cheap-check-before-build discipline that spared every wasted GPU/Rust build here. - Anyone reading the leaderboard for threat-timing (Mosca
X+Y>Z). The "frontier is an island" reframe: the scored number is an island-tuned avg-executed figure, and the honest density-neutral cost sits well above it. If you're using the number to reason about the quantum-threat clock, that distinction matters. - Anyone optimising against a held-out validator (any benchmark). The proposer ⊥ referee discipline and the typed, cheap-first negative-results method transfer directly — they're not specific to this circuit.
Who it doesn't help: the frontier insiders who built the SOTA already know the lever map (they spent it). For them the value is the reframe and the honest negatives, not the map — which is why everything here is written deflation-first: not a claim; here's the method and what's spent.
Why this approach / where I'm coming from. I'm a domain outsider to reversible-circuit design — the two toolchains here are other people's work, linked in. I come from privacy-is-value / ZKP / agentic separation-axiom work, where the core move is a two-role split held apart by a validator you cannot tune. ecdsa.fail's 9,024 Fiat–Shamir witnesses are exactly that validator, so I treated the whole challenge as a trust task and pointed the dual-agent harness at it. I care more about whether that discipline transfers and yields honest, reusable results than about a score claim — which is why the deliverable is a method plus a typed negative-results map, labelled proven-vs-predicted throughout, and why nothing here claims a frontier advance. I'd genuinely rather be shown where I'm wrong than be right quietly.
ecdsa.fail / Eigen Labs run the arena · Google Quantum AI set the cost targets · the
Schrottenloher and Proos–Zalka lines gave the circuits · SigmaPrime reviewed · Michele
Mosca gave the X+Y>Z inequality. The dual-agent method derives from the
agentprivacy model (V6: neg(bnot(x)) = succ(x),
proven on Z/64Z). Full citations: REFERENCES.md.
MIT (see LICENSE), matching the GPU toolkit's license. The vendored
ecdsafail_gpu_toolkit-main/ carries its own MIT license.