Hardening week: 147 changes, 1 to 6 August 2026

[wallscaler]

1 to 6 August 2026 · 147 changes merged across five repositories

This was a hardening week. Almost nothing shipped that added a way to earn. Nearly every change either closed a way the subnet could pay for work it had not verified, or made a failure louder when it happens.

Pull requests merged	147 in six days
Lines	+56,641 / -27,169
cathedral-validator	63
cathedral-distill	56
cathedral-compute	15
cathedral-site	7
cathedral	6

Two days carried most of it: 49 merges on Tuesday and 46 on Wednesday, when the sealed-task and attested-receipt work landed together.

---

1. The exploit lane stopped being able to pay for nothing

The CyberGym lane ran end to end a week ago, but several ways it could credit work that did not happen were still open. Closed since:

• Real solves were scoring zero. Crash detection missed MemorySanitizer output, so genuine work was recorded as failure.
• A sealed batch could be re-drawn, which meant the task set was not actually fixed at the moment of commitment.
• Crash evidence was not bound to the task it came from, so evidence could travel between tasks.
• The same canonical solve could be counted more than once.
• Attestations were not bound to the model commitment, so the thing that was attested and the thing that did the work were not provably the same.
• Invalid attestations reached Docker before being rejected.
• The registry probe failed open on error, so a task whose answer might be publicly available could still be admitted.
• Recoverable fresh tasks could still pay.

Built on top of those fixes: private challenge artifacts are sealed, holdout manifests carry digest-bound admission verdicts, the real-corpus path runs in a persistent enclave with its own verifier and an approved in-enclave solver, miners have an attestation client, scoring became a top-5 rank tournament rather than a flat payout, and the receipt check is trustless. The validator verifies Cathedral's signature from a pinned key instead of taking the producer's word for it.

There is now an end-to-end test in which a miner client earns by passing the enforced checks rather than by bypassing them.

2. The validator tells the truth when it breaks

Sixty-three merges, and the theme is unglamorous. Failures that used to be silent or actively misleading now say what happened:

• A stale-but-verified vector fired the tamper alarm. It is classified correctly now, and staleness is bounded to a single epoch.
• A tick inside the chain weight cooldown counted as a failure. It skips now.
• Chain failures reported their shape but not their cause.
• Nothing named which condition refused a submission.
• One error code meant both "wait a block" and "nobody is writing at all".
• The alert went green when the validator was blind, rather than red when it was dead. That is the difference between an alert and a decoration.
• A lost head-drift race could cost an entire write cycle.

Structurally, the validator consolidated into one self-composing mode with attestation verified by default, and 18,786 lines of ceremony and authority profiles were deleted in a single change. One mode, one command. A third party can now build and run the exact pinned release we run. There is an executable preflight that proves a contract cutover is safe to attempt before attempting it, and a staged-install rollback that refuses to guess.

3. Security fixes in the compute lane

• A worker locality guard keyed off TLS instead of authentication.
• The TLS handshake ran in the accept loop, so a single slow client could stall the listener.
• A terminated worker could re-enroll itself by changing its endpoint.
• The 29th miner could stall epoch production, because scored dispatch was unbounded.
• Deploy would accept privileged paths that an unprivileged user can rewrite.
• Measurement approval did not name and verify its target profile, so an approval could apply to the wrong thing.
• Probe budgets are now bounded without starving anyone.

This week also brought the repository's first outside contribution: AMD SEV-SNP evidence served through the worker.

4. Public claims pulled back to match the code

• The live SN39 board and the signed feeds are published for anyone to inspect.
• A live leaderboard shows verified compute nodes by UID rather than raw hotkey.
• The unwired +30% trace bonus was de-advertised rather than left advertised and unpaid.
• Clean miner quickstarts for both lanes.
• Operator SSH accounts and host addresses are no longer published.
• Validator operators are routed to the single repository that owns the validator, deleting more than a thousand lines of duplicate instruction.

5. Guards that catch us being wrong

A small change landed on Sunday: a guard that holds every test count stated in the documentation to what the suite actually collects.

It caught a real drift this week. The docs claimed 1,484 tests, the suite collected 1,488, and the guard failed loudly rather than letting a false claim sit in the first file a newcomer reads. A number nobody verifies is worse than no number, because it is a specific, checkable claim that happens to be false.

---

What is still not done

Worth stating plainly, because a merge count invites the wrong conclusion.

• The CyberGym reward loop is not open. The mechanism is close. The sealed corpus is not populated, and that is the work in front of us.
• The deployed vector and the independent verifier have not converged. The public comparison still records a failure on contract shape.
• Nobody outside is enrolled. The allowlist is deployed and currently holds internal canaries only.
• No reference miner has yet earned continuously over a sustained run. Until one has, the reward path is implemented rather than proven.

147 merges is throughput, not proof.

Do not register or spend on the CyberGym track before a launch notice. Positive weight and emissions are never guaranteed.

---

Every change referenced here is public and reviewable in cathedral-validator, cathedral-distill, cathedral-compute, cathedral-site and cathedral.