This repository was archived by the owner on Aug 3, 2026. It is now read-only.
op1/op2: Hopper-only GPU bind + H100-hour budget cap (fair 1x-H100 contest) - #90
Merged
Merged
Conversation
… 1x-H100 contest) - proof/gpu_arch.py: verify_gpu_arch_allowed reads the NVIDIA-signed, nonce-bound, digest-committed NRAS hwmodel; GH100 (H100+H200, one Hopper die) allowed, Blackwell (GB20X/GB1xx/GB2xx)/unknown/missing denied. Wired into op2 after the NRAS ES384 + eat_nonce + TDX checks (real_* only). RALPH_ALLOWED_GPU_DIES, RALPH_ARCH_GATE_OFF. - check_compute_budget (integrity.py): reject normalized_H100h > RALPH_H100H_BUDGET (default 5.0). Spoof-proof: fixed Hopper ref in the denominator, not the miner-reported matmul_ms. Wired into op1 after the MFU gate. RALPH_H100H_GATE_OFF. - verified vs live bundles: GH100 allow / GB20X deny / no-token deny; martyniukr 7.96h reject (unchanged under a matmul_ms=5.0 spoof), c48ad59d 2.93h pass. - validator-only (not measured) -> no measurement cutover. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
Author
|
Thanks — confirmed. With #89 merged, #90 now rebases clean against main (1 commit / 4 files: Both gates are already deployed and enforcing live on the sn40 validator, so this PR only lands the code — no rush to merge; leaving it open for your live test is the right call. What to watch in
Kill-switches if anything false-rejects a legit Hopper miner (e.g. NRAS token framing drifts and you see
Ping me if a real Hopper bundle gets denied and I'll dig into the token framing. |
- check_canonical_data_source folds an absolute path through the canonical "data" tree back to its relative tail before the allowlist, so the runner- pinned resolved-absolute --manifest/--data-base-dir (recorded verbatim into final_state.config by train.py) passes. ~/.. escapes + absolute paths outside data/ still rejected. - for any op2-passing bundle the config path IS the runner pin (its CLI arg overrides config at load), i.e. the container mount point (/workspace,/dstack, /home/...), not a miner-chosen swap vector -> the strict check only false- rejected honest miners on non-/workspace mounts (miner-reported op1 breakage). - data-lock is not a path-string boundary anyway (runner pins the load dir; container fs is miner-owned); real deterrent is re-derivation. - tests updated to the corrected semantics. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…xation - check_model_size: reject n_params > RALPH_MAX_N_PARAMS (default 400M). The compute-budget cap limits FLOPs not capacity, so a 1.2B model at <1 tok/param fits under 5 H100h and wins on capacity/held-out-memorization not recipe quality (recurring "1.2B, 0.6 tok/param, val_bpb 1.33" fraud). n_params is un-forgeable (op4 load_state_dict fails on shape mismatch). Wired into op1.
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes the crown a fair fixed-hardware, fixed-compute contest.
Hopper bind (op2): accept only the NVIDIA-signed GH100 die (H100+H200, cryptographically one die); deny Blackwell (RTX PRO 6000 GB20X, B100/B200). Reads the die from the digest-committed, nonce-bound NRAS hwmodel (rides op2 existing ES384+nonce checks; no PKI pinning).
Budget cap (op1): reject normalized_H100_hours > 5. Spoof-proof: fixed Hopper reference in the denominator so a fabricated matmul_ms cannot duck the cap; wall_clock is lower-bounded by the existing MFU gate.
Deployed + verified live on the netuid-40 validator (king held at 7fd43cef). Validator-only, no measurement cutover. Knobs: RALPH_ALLOWED_GPU_DIES, RALPH_H100H_BUDGET, RALPH_H100H_MM_REF_HOPPER, RALPH_ARCH_GATE_OFF, RALPH_H100H_GATE_OFF.
NOTE: stacks on #89 (based on that branch); merge #89 first, then this.