ECDSA-TTT

A two-channel self-improving loop that discovers resource-efficient reversible quantum circuits for secp256k1 elliptic-curve point addition.

The target primitive is the bottleneck of Shor's algorithm against secp256k1. The system minimizes the qubit × Toffoli product of a single point addition, verified end-to-end by the ecdsafail CLI (the sole correctness authority — only circuit files may be edited). The current public record is 1,519,170,048 (1,318,724 Toffolis × 1,152 qubits; promoted July 10, 2026); the goal is to beat it, with organizer-stated headroom of roughly 3×.

VISION.md is the source of truth. It specifies the finished system — its components, the learning-science principles that make it correct, and the invariants it must hold. This README is the operational entry point; read VISION.md for the why.

Status: organs B0–B4 built, unit-tested, and wired — the coupled loop runs end-to-end on the Tinker training plane; the B5 warm-start/champion-edit track is in progress. This repository began as the TRACE paper release; the TRACE machinery (contrastive diagnosis, RLOO training helpers, LoRA/MoE routing, scaffold-and-fade) is retained as the foundation under the ECDSA organs. See Roadmap.

---

The idea in one line

Binary pass/fail reward is information-starved (~1 bit per episode). The leverage is not more compute against a sparse wall — it is extracting more information from each expensive rollout and routing it to the channel where it belongs: a fast channel (textual context, cheap, per-problem, reversible) and a slow channel (model weights, durable, compounding), coupled by a consolidation gate that promotes only proven-stable knowledge from fast to slow. This is the Complementary Learning Systems design, rediscovered by the 2026 RLVR frontier (TRACE, P²O, FST) and assembled here into one loop.

The loop

controller picks an edge-of-ability instance (6→256-bit curriculum)
      │
      ▼
proposer (slow weights + fast context) generates candidate circuit edits
      │
      ▼
inner optimizer resynthesizes arithmetic sub-blocks (Toffoli/T-count squeeze)
      │
      ▼
ecdsafail verifies → rich feedback (validity, ΔToffoli, Δqubit, error structure)
      │
      ├──► fast channel   (K-prompt Pareto population, operator library, failure ledger)
      └──► contrastive diagnosis → dense targeted practice (+ scaffold-and-fade)
                    │
                    ▼
            slow RL update (RLOO) ── periodically ──► consolidation gate ──► LoRA + MoE routing

Rollouts and fast-channel updates run continuously; consolidation into weights is a periodic, prioritized offline phase. When the loop saturates the recombination frontier, an escalation path routes the bottleneck sub-block (modular inversion) to a strong reasoning model.

The verifier (ground truth)

ecdsafail is the only judge of circuit quality — no model scores circuits. A "Toffoli win" from skipping uncomputation, leaking phase, or writing garbage to ancilla fails; it does not score faster. Get the CLI and authenticate, then verify a baseline before anything else:

ecdsafail --help          # canonical flow: login → config → clone → setup → run → submit
ecdsafail login
ecdsafail run             # verify the current circuit; reports validity + Toffoli/qubit/product

(The ecdsafail-cli skill documents the full command set. Treat ecdsafail --version as the canary; only circuit files are editable.)

Repository layout

ECDSA-TTT/
├── VISION.md                 # mission brief — the finished system (source of truth)
├── README.md  CLAUDE.md      # this file; operating guide for coding agents
├── requirements.txt  LICENSE  .gitignore  pytest.ini
│
├── src/
│   ├── circuit/              # curriculum, envs, optimizer, verifier, registry (B0–B1)
│   ├── training/             # LIVE Tinker plane
│   │   ├── context/          # Pareto prompts, all-trace store, GEPA, ledgers (B2)
│   │   ├── promotion/        # gate + promotion path (B3)
│   │   ├── champion/         # B5 warm-start + champion-edit track
│   │   ├── experiments/      # runnable CLI drivers
│   │   ├── loop.py  trainer.py  controller.py
│   │   └── rloo.py  model_families.py
│   └── moe/                  # capability-LoRA routing (Stage D target)
│
├── diagnostics/                # VISION §3.0 machinery: contrastive diagnosis, trainability
│                             #   calibration, prompt templates + renderer, YAML configs
├── tests/                    # CPU test suite (real Rust-harness tests are opt-in)
└── reference/                # foundation papers (PDFs, local only — gitignored)

Foundation (inherited from TRACE, kept as substrate)

• Contrastive diagnosis — diagnostics/aggregate_capabilities.py computes coverage Cov(c) and the contrastive gap Δ(c) = ER⁻ − ER⁺, retaining a capability iff Cov ≥ ρ and Δ ≥ δ in ≥ K of N labeling runs (defaults ρ=0.10, δ=0.20, K=8/10).
• Difficulty calibration — diagnostics/calibrate_environment.py checks that base success sits in the trainable band (mean reward / success rate in ~[0.3, 0.6]).
• RLOO training helpers — src/training/rloo.py (formerly train/train_grpo.py): exact leave-one-out advantages, constant-reward-group filtering, hard-sample routing, and hint-swap (rollout under a hint prompt, gradient on the bare eval-time prompt — the scaffold-and-fade seam), all imported by the live Tinker plane. The torchrun/vLLM trainer that surrounded them was removed (git history retains it).
• MoE routing — src/moe/ composes capability LoRAs, y = base(x) + Σ gᵢ·LoRAᵢ(x), with a lightweight per-block gate — the slow-channel composition the consolidation gate promotes into.

Run everything from the repo root with src on PYTHONPATH; import modules as circuit.*, training.*, and moe.

Compute

Development and CPU-side TDD run locally (.venv, Python 3.13). Training runs on the Tinker remote plane — LoRA sampling + RLOO updates against hosted openai/gpt-oss-20b (plumbing/debug) and openai/gpt-oss-120b (the target core). Every training.* entry point needs source ~/.config/tinker/env first and costs credits; there are no local GPU or SLURM jobs.

Roadmap

The finished system is defined in VISION.md. Build order (each organ scaffolded from its paper, test-first):

1. B0 — enabling organs (built): ecdsafail verifier + circuit I/O, point-addition environment + dense (correctness-gated, multiplicative-with-floor ΔToffoli) reward, 6→256-bit curriculum (rungs 33–255 not yet transcribed).
2. B1 — inner optimizer (built, classical backend): oracle-verified Toffoli-non-increasing resynthesis on arithmetic sub-blocks; AlphaTensor-Quantum-style learned resynthesis is aspirational.
3. B2 — fast channel (P²O) (built): hard-sample ledger, GEPA reflective prompt evolution, K≥8 Pareto population, operator library, failure ledger.
4. B3 — consolidation (FST) (built; convergence-signal fix in flight): fast/slow interleaving + a consolidation gate that promotes only proven capabilities (never distillation-only).
5. B4 — controller + online/offline loop (built; loop wiring of the scheduler pending).
6. B5 — warm-start SFT on the mined submission trajectory (in progress: warm-start SFT, STaR trace SFT, and the champion-edit/bake-off harness exist); implementer ensemble and escalation path (not started).

Research lineage

This system assembles, rather than competes with, the following:

• TRACE — Capability-Targeted Agentic Training — Kang, Suresh, Saad-Falcon, Mirhoseini (Stanford). arXiv:2604.05336
• P²O — Joint Policy and Prompt Optimization — Lu, Zhang, Yang et al. (CAS). arXiv:2603.21877
• Learning, Fast and Slow (FST) — Tiwari, Sareen, Agrawal et al. (Berkeley / Mila / UT Austin). arXiv:2605.12484
• AlphaTensor-Quantum — Ruiz et al. (DeepMind). arXiv:2402.14396
• GEPA — Reflective Prompt Evolution — Agrawal et al. arXiv:2507.19457
• DeepSeekMath / GRPO — Shao et al. arXiv:2402.03300
• ECDLP challenges / the 6→256-bit ladder — arXiv:2508.14011
• Verifier: the ecdsafail challenge; harness adapted from Google Quantum AI's published resource-estimate code.

See VISION.md §6 for the full reference list and theoretical anchors.

License

MIT (see LICENSE), retaining upstream attribution.