CIS-2 v0.3b — bit-identical fp32 inference from a spec

CIS-2 is a normative specification for fp32 transformer inference such that two people who have never seen each other's code, working from the spec text alone, get the same bits — the same full fp32 logit vector, hashed into the same witness digest — across x86_64 and aarch64, across gcc/clang/rustc, and across optimization levels.

This is the first tagged release. The spec document is v0.3b (2026-08-29); the tag captures the repository as of 2026-09-09.

The claim

CIS2_REF = d82743059d1db929e710236fe4ec37f89e6f932524801345a006980f7c3cc9df

SmolLM2-135M, prompt Once upon a time, 16 greedy tokens, spec v0.3b. A SHA-256 chain over the full fp32 logit vector at every step — not the argmax, not a tolerance, not a top-k. One bit anywhere in the arithmetic and the digest is different.

Four implementations reach it:

Implementation	Language	Written from	Platforms
reference	Rust	—	x86_64, aarch64
verify2	Rust	spec text only	x86_64, aarch64
verify3	C11	spec text only	x86_64, aarch64, gcc + clang
CUDA port (source not published)	CUDA C++	spec text only	NVIDIA Tesla P100, sm_60

verify2 and verify3 are clean-rooms: they were written against the prose, not the reference code. That is the point of the exercise — the spec is the artifact under test, and a clean-room that diverges is a spec bug, not an implementation bug. One already found a real one (a stated witness-chain ordering error in v0.2's §12.1; see CHANGELOG).

What is in this release

• docs/CIS2_SPEC_v0.3b.md — the normative document. Pinned FP environment (FTZ/DAZ), strictly left-to-right reduction order, no FMA contraction, pinned transcendental polynomials, pinned RoPE inv_freq, the witness-chain construction.
• docs/CIS2_SPEC_v0.2.md — kept for history.
• tests/conformance/ — five op-level vectors (matvec_v1, rmsnorm_v1, rope_v1, exp_pinned_v1, attention_block_v1) with a written protocol, so a divergence localizes to one operation instead of bisecting a whole decode.
• EXPECTED_DIGESTS.md — every pinned value.
• docs/GPU_RESULT.md — the P100 leg, with its scope limits stated.
• .github/workflows/verify.yml — 10 jobs, native on both ubuntu-24.04 (x86_64) and ubuntu-24.04-arm (aarch64), each asserting uname -m matches. Green on main.
• scripts/publish_hf.sh, docs/HF_DATASET_CARD.md — the Hugging Face conformance-dataset payload.

What changed in v0.3b

v0.2's pinned sin/cos lost accuracy catastrophically with RoPE position (up to ~115,000 ULP by position 8192 at θ=1e5 — unusable). v0.3b reduces to an octant (mod π/2, f64-staged Cody–Waite) and evaluates separate Cephes degree-7/8 minimax polynomials selected by quadrant. Measured against a 60-digit mpmath oracle on a dense grid over the full position domain: max 1.5 ULP for both sin and cos, meeting the pre-registered ≤2 ULP bar.

Because the pinned transcendental coefficients are hashed into the witness chain (§6.6), fixing them moved the witness digest — a0c563ef80… (v0.2) → d82743059d… (v0.3b). The tokens the pinned vector emits (argmax_digest, generated_token_ids) have never changed across any spec version. That is the receipt mechanism working as designed: a change to the arithmetic is visible in the receipt even when the output text is identical.

Scope, stated plainly

• fp32 scalar reference code. Not a fast kernel. No timing claims here.
• Greedy decode, batch 1, one pinned model/prompt/length as the normative vector (plus a Qwen2.5-0.5B leg for θ-generality).
• The transcendentals are pinned by fiat — a specific polynomial everyone must use — not correctly rounded. That is an open limitation.
• The GPU leg is first-party. It is evidence the spec text is implementable on a different ISA and toolchain by someone reading it; it is not an independent replication.

Prior art

Bit-reproducible inference is an active area and this is not the first work in it. Gensyn's repops, Microsoft's RepDL, and the determinism flags in vLLM and SGLang all attack overlapping problems. What is specific here is the direction of the artifact: a written specification that third parties implement from, with a full-logit witness receipt and op-level conformance vectors, rather than a library you link against. No claim of being first or only.

Try to break it

There is a falsification bounty: two implementations that both follow the spec but disagree, or an implementation that follows the spec and does not reach d82743059d…. See https://github.com/Aefinity-AI/alice-aegis/blob/main/CHALLENGE.md

---

Apache-2.0. Aefinity AI Inc.