# Bitcoin: I'm retarded. ASM client/server project in the works > Source: > Published: 2026-08-17 05:53:59+00:00 This is actively developed, highly experimental software.It implements Bitcoin node functionality as hand-rolled x86-64 assembly produced by an AI. It has NOT been audited by any independent human reviewer. The project has gone through multiple rounds of AI-driven security review (see`validation/SECURITY_AUDIT.md` ), and issues found that way get fixed as they come up — but that internal process is not a substitute for independent human sign-off, and no such review has happened yet.You should treat this code as untrusted and dangerous.A bug in consensus, cryptographic, or networking logic can cause loss of funds, chain divergence, resource exhaustion, or exposure of your machine to the network. Donotrun it with real funds, on a production machine, or on an internet-exposed host, and do not rely on it for any security-sensitive purpose — until it has undergone an independent human security audit. Use at your own risk. A Bitcoin node for Linux built as **100% AI-generated machine code** — every line of assembly is authored by an AI assistant, none by a human. The security-critical crypto (SHA-256, secp256k1 field/point/scalar/ECDSA) is written directly in x86-64 assembly. **Delivered and verified:** **SHA-256 core**(`asm/sha256.asm` ) — passes the canonical FIPS-180-4 vectors plus the multi-block and extra-length-block padding cases Bitcoin requires.**secp256k1 field arithmetic**(`asm/secp256k1_fe.asm` ) —`fe_add` ,`fe_sub` ,`fe_mul` (256-bit multiply + secp256k1-prime reduction), verified against 24 fixed vectors and 50,000+ random cases vs Python's big-int oracle.**secp256k1 point / scalar / ECDSA**(`asm/secp256k1_point.asm` ,`asm/secp256k1_scalar.asm` ,`asm/secp256k1_ecdsa.asm` ) — Jacobian point ops, scalar arithmetic mod n, and low-S ECDSA signature verification, all verified against a Python big-int oracle.**Node-layer hashing**(`asm/bitcoin_hash.asm` ) —`sha256d` ,`block_hash` ,`diff_target` ,`pow_check` , and`merkle_root` , verified against the genesis block, fixed vectors, and a Python oracle (10/10 assertions in`test_block` ).**Node-layer tx parser**(`asm/bitcoin_tx.asm` ) —`tx_parse` deserializes a transaction (version, varint counts, inputs, outputs, locktime) and ALSO skips the SegWit (BIP141) witness stack, so it walks both legacy and modern on-wire txs and returns the full serialized length.`tx_txid(out32, tx, txlen, buf, buflen)` rebuilds the unwitnessed form and returns the BIP141 txid. Verified against the serialized genesis coinbase (18/18 in`test_tx` ), cross-checked against a clean Python walker, and validated on REAL mainnet blocks: the community`cons_verify` accepts both pre-SegWit block 400000 and SegWit-era block 962043.**P2P networking core**(`asm/bitcoin_net.asm` ) — raw-syscall POSIX sockets plus the Bitcoin message framer (magic + command + length + SHA-256d checksum). Verified offline (19/19 assertions in`test_net` ) and against a**live Bitcoin peer**(version/verack handshake succeeded,`live_handshake.c` ).**P2P message codecs**(`asm/bitcoin_p2p.asm` ) — getheaders / getdata / ping builders and a headers parser, byte-exact vs`validation/p2p_oracle.py` ; the whole IBD header-download path is proven end-to-end as machine code (`test_p2p` offline +`fakepeer_headers` loopback IBD test).**Block consensus**(`asm/bitcoin_cons.asm` ) —`cons_verify` validates a full block in machine code: PoW + per-tx parsing + coinbase-first + merkle-root recheck over the txids. Verified against a Python-built 2-tx block (`test_cons` , 6/6): valid accepted (root matches the oracle), and bad merkle / trailing garbage / truncation / non-coinbase / over-cap all rejected.**Persistent header chain**(`asm/bitcoin_headers.asm` ) — a restart-safe, positional append-only store of`(80-byte header, block_hash)` pairs (`headers.dat` , 112 B/entry).`hst_init/reload/append/get_at/count` verified by`test_headers` (on-disk layout, reload resume, chain continuity).**Paged headers-first IBD**(`asm/bitcoind.asm` `node_ibd_headers` ) — the persistent download loop: repeatedly fetch a 2000-header`headers` page at the running locator, verify chain continuity for every header, compute each block_hash, persist it, and advance the locator to the new tip; stops on a short/empty page. Verified by`test_ibd_headers` over a real loopback socket: a 2500-header chain (full page + short page), locator advance to tip, restart-resume, tip detection, and rejection of a tampered chain.**Block-body download off the persisted header chain**(`asm/bitcoind.asm` `node_ibd_blocks` ) — the second half of full IBD: walks every stored header in the header store, requests its block via getdata, validates it (PoW + merkle + tx walk via`cons_verify` ), re-derives the block hash and requires it to equal the stored header hash (wrong-block guard), and persists it. Verified by`test_ibd_blocks` over loopback (4-block chain stored byte-exact, plus a negative case rejecting a peer that serves the wrong body).**Full initial-block-download as one assembly pass**(`asm/bitcoind.asm` `node_ibd` ) — chains`node_ibd_headers` (persist the whole header chain from genesis in 2000-header pages) then`node_ibd_blocks` (walk every stored header -> getdata ->`cons_verify` + re-derived-hash guard -> store) over a single peer connection. Verified by`test_ibd_full` over a real loopback socket: a 1200-block chain downloaded, validated and stored byte-exact in one call — the entire headers-first IBD tail as machine code.**Node CLI**(`asm/bitcoin_cli.asm` ) —`cli_main` answers queries in pure machine code over the persistent store:`getblockcount` ,`getbestblockhash` ,`getblockhash ` ,`getblock ` ,`gettx ` ,`getbalance` ,`stop` ,`help` (hashes in Bitcoin display order). Thin driver`daemon/cli.c` ; verified by`test_cli` (all commands against expected values from the proven asm hashes). The assembly hashing/tx stack also reproduces the real genesis block hash + coinbase txid (test_block/test_tx) and a live-downloaded real mainnet block-1 hash (manual`test/live_blocks.c` ).**Optional CUDA batch-acceleration tier**(`asm/cuda/` ) — an explicit, runtime-gated accelerator for batched SHA-256 / SHA-256d (Bitcoin's double hash), matching the CPUID/SHA-NI design philosophy but with a*device probe*. A single dispatcher (`bmc_sha256d_batch` ) auto-detects a usable GPU at runtime and uses CUDA only when a device is present AND the batch is large enough to amortize launch/copy (>=512) AND not disabled (`BMC_CUDA=0` ); on any CUDA error, no device, or a small batch it falls back bit-exact to the proven assembly`sha256d` . Correctness is the priority: the CUDA digest must equal the asm oracle byte-for-byte. Verified against the asm oracle over the FIPS vectors, all Bitcoin padding edges, and 10,000 random messages (0 failures); routing/digests verified in every mode (default->CUDA, disabled/small/no-GPU ->CPU fallback). Measured ~17-18x GPU/CPU wall-clock at N=1,000,000 on an RTX 5090 (CPU wins below ~100). Building the kernels needs nvcc + CUDA GPU; the dispatcher itself links and runs with zero CUDA installed (falls back to CPU). Not yet wired into bitcoind/bitcoin_cli — see WORKING.md for the roadmap. All assembly is authored by AI; C/Python harnesses exist only to prove the machine code is correct against trusted references. Real-mainnet validation status: the full asm consensus stack accepts the REAL genesis block (285 byte header + tx-count + coinbase, real nBits 0x1d00ffff, real merkle root) via test_block_genesis (offline, in make test); pow_check/diff_target implement the real Bitcoin difficulty algorithm and are proven against real mainnet nBits; and the node reproduces a live-downloaded real block-1 hash. **The block-body download + store tail is now exercised end to end against a REAL node: real mainnet block bodies are downloaded, cons_verify-validated as VALID, and stored** — block bodies come from a large pool of verified **internet** peers via distinct-peer selection, discovered entirely through the node's own DNS-seed bootstrap (no cooperative/local test peer involved). The long-standing "seeds drop block-body getdata" wall was root-caused to our own malformed getdata: `p2p_getdata_block` emitted a 34-byte message (type as a 1-byte varint) that real nodes silently ignore. The canonical Bitcoin getdata/inv inventory is `[count varint][type int32 LE][hash32]` = 37 bytes with the hash at +5 (the p2p_oracle always encoded this; a prior stage wrongly "fixed" it -- corrected and confirmed live). Public seeds still serve the real header chain reliably; with the corrected getdata they also serve block bodies to a cooperative/unchained peer. The inbound (server) role is now real too: a new asm `node_accept_handshake` answers a genuine inbound node's `version` and serves stored blocks (verified end to end), where the old serve path reused the outbound handshake and hung on an inbound peer. **ASM inbound server serves the REAL chain over TCP — getdata AND getheaders** (from commit `32279a0` ): `bitcoind serve ` answers a peer entirely in assembly (`node_accept_handshake` -> `node_serve_loop` ) against the on-disk archive. Verified LIVE over loopback against real mainnet data: **getdata**— a real block by hash served verbatim (height-1 215 B, height-2 215 B, height-50000 647 B, plus multi-KB blocks at h=100k/200k),`requested-hash-match=YES` .**getheaders**— a*canonical*`headers` message whose CompactSize count equals the payload length, whose headers form a contiguous chain (each header's prev is the double-SHA256 of the previous header), starting from the requested locator (verified for locators at h=1, h=200000, h=293300, 2000 headers each). The server stays alive after serving. **BIP152 compact blocks** (`asm/bitcoin_cmpct.asm` , serve integration in `asm/bitcoin_serve.asm` ): SipHash-2-4 short-tx-ids and the compact-block wire codecs (`sendcmpct` negotiation incl. high-bandwidth, `cmpctblock` build/serve, `getblocktxn` /`blocktxn` ). Verified byte-exact against REAL Bitcoin Core v31.99: short-ids captured from Core's actual wire `cmpctblock` messages over loopback (`validation/bip152_vectors.h` , 12 vectors; `tests/test_bip152` 35 checks) and a loopback e2e over the asm server (`tests/test_bip152_loop` , 16 checks). The live work exposed and fixed five real bugs that fake-block unit tests could not catch: (1) the daemon had no Makefile target (ad-hoc stale command); (2) `server-test` never built the hash index, so getdata couldn't resolve a hash; (3) `build_hash_index` keyed on display (BE) order while the wire hash is LE, so getdata missed; (4) the getheaders dispatch checked `cmd[4]/[8]` for `"head"/"ers"` but getheaders is `g e t h e a d e r s` ("head" is at cmd[3..6]) so it never fired; (5) `open_file` leaked an fd per serve (`EMFILE` at ~1024 serves truncated the chain) — fixed with close-before-open, so serving spans heights 0..309998. **The crash** was the getheaders header copy passing the length in `r8` while `memcpy_len` reads its length from `RDX` (verified by disassembly): it copied `[s_p]` bytes instead of 80, sweeping through `.bss` into the relocated `stdout` /`stderr` copies (0x143e6a0) and segfaulting `main` 's printf. Found with a hardware write watchpoint on the stdout slot; fixed by loading the length into `RDX` . The test suite stays 33/33 green throughout. **Built-in multi-peer catch-up ( bitcoind serve, no external tooling needed):** the daemon now self-heals on its own — `main.c` 's `dl_catchup` runs synchronously at boot, before the node ever opens for service: it discovers peers via the existing DNS-seed bootstrap (`dl_bootstrap` /`dl_pool_from_book` , the same discovery `serve_download_worker` already used), extends `headers.dat` incrementally to the real chain tip, computes the current archive gap directly from `index.dat` (any hole below the stored tip, plus everything missing up to the real tip, as ONE combined span), and forks `>=8` chunk-claiming worker processes to fill it. Workers pull 200-block chunks from a shared `mmap` 'd atomic counter (work-stealing — a worker that lands fast peers just keeps claiming more chunks instead of idling on a static pre-split share), skip any chunk that's already fully archived (so the same span safely covers both real gaps and already-filled heights in one pass), and reuse a persistent peer connection across chunks instead of reconnecting per chunk. Peer liveness is checked via a bounded non-blocking-connect probe (several rounds, never a blind blocking connect to an unconfirmed host — that has no connect-phase timeout and can hang for minutes on a black-holed peer). Self-throttling: a node that's already caught up returns from `dl_catchup` almost instantly (pure disk reads, no network), so it's safe to run unconditionally on every boot.**Standalone bulk-download tool ( daemon/unified_ibd.c):** the same chunk-claiming/work-stealing engine as a manual ops tool, useful for a very large initial catch-up or offline reindexing outside the daemon's own boot path. Every block is written **directly into the single archive** in `data/` via the concurrent-safe asm `store_append_shared` : each append is flock-serialized on `append.lock` (each worker opens its own fd — `flock()` locks belong to the open file description, so a fork-inherited fd would not actually exclude sibling workers from each other), the block lands at the true file end of the rolling `blkNNNNN.dat` , and the index record goes positionally at `height*48` (index.dat pre-sized, grow-only). No per-worker block directories exist — the archive is one directory holding only `blk00000.dat` ..`blkNNNNN.dat` , `index.dat` , `headers.dat` . Peer distinctness is guaranteed via a flock-locked `peerclaims` table, with a deep peer pool (all of `good_internet_peers.txt` , not just a small prefix) and a live-retry fallback for peers that looked down at the one-time startup probe. Driver scripts: `hole_ranges.py` (finds gaps in `index.dat` ), `backfill_holes.sh` (one combined-span `unified_ibd` call over them), `sync_chain.sh` (chains hole-fill into extending to the real tip). Real-mainnet header-continuity bug found and fixed (see LOG #12).**Wallet / validation bridge (complete)** — the node now validates and signs real transactions in machine code, on top of the verified asm crypto. All of this was built as part of the same AI-authored assembly / C-verified work as the node: **secp256k1 pubkey parse**(`asm/bitcoin_pubkey.asm` ) —`fe_pow` +`pubkey_parse` : recover affine curve coords (Qx,Qy) from a compressed (02/03) or uncompressed (04) secp256k1 public key. Verified on G, non-residue rejection, bad length, off-curve.**Legacy SIGHASH_ALL preimage builder**(`asm/bitcoin_sighash.asm` ) — builds the unsigned-tx preimage for a target input, verified byte-exact vs Python on 1-in/1-out and 2-in/1-out txs.**DER ECDSA sig parsing**(`asm/bitcoin_script.asm` ) —`der_parse_sig` (canonical DER sig -> r,s LE limbs via`be_to_limbs` + trailing SIGHASH type byte), verified against a real`cryptography` -generated DER sig.**End-to-end P2PKH spend validation**(`bitcoin_script.asm` `verify_p2pkh` ) — validates one P2PKH input in assembly: build SIGHASH_ALL, walk the scriptSig, DER-parse the sig, parse the pubkey,`ecdsa_verify` . Valid spend -> 1, tampered sig -> 0 (the`validation CAPSTONE` ).**UTXO set**(`asm/bitcoin_utxo.asm` ) — in-memory Unspent-Transaction-Output store: txid(32)+index(u32) -> (value, scriptPubKey) open-addressing table + value/script blob.`utxo_init/put/get/del/count` . Verified: put/get round-trip, dedup, distinct outpoints, spend/delete -> miss and double-spend -> miss, and a 300-entry probing/collision-wrap bulk round-trip.**Whole-transaction validator**(`tests/test_txval.c` ) — validates a full serialized tx against the UTXO set: every input outpoint present+unspent (double-spend guard), every input's P2PKH signature verifies via asm`verify_p2pkh` , and sum(in) >= sum(out) (valid fee). Signed vectors are genuine ECDSA spends (gen_txval_vectors.py). 6 cases: 2 valid multi-input txs + double-spend / fee / sig(empty) / sig(wrong-key) negatives. Suite 40/40.**Policy + RBF / fee handling**(`asm/bitcoin_mempool_policy.c` ) — policy layer over the structural mempool + UTXO set: fee computation + min-relay-fee floor, double-spend rejection, BIP125 RBF (replacement fee math + eviction), ancestor/ descendant limits, and an EMA fee estimator. Verified against an independent pure-Python oracle (4 scenarios / 21 steps). Full offline suite 35/35 green.**Wallet CLI**(`asm/wallet_core.c` +`asm/daemon/wallet_cli.c` ) —`wallet_cli gen` (random keypair + P2PKH mainnet address),`addr ` (compressed pubkey + address), and`sign ` (legacy SIGHASH_ALL P2PKH sign, deterministic nonce k=sha256d(z||priv), low-S DER).`test_wallet` 9/9, plus an independent Python verification of the signature.**createrawtransaction + send**(`asm/wallet_core.c` ,`tests/test_send.c` ) — the wallet now*builds and sends*a real tx, not just signs a supplied one.`wallet_createrawtx` selects our prevouts, pays a destination P2PKH output and returns change (`sum(inputs) − amount − fee` ; rejects underfunded / zero-fee, omits the change output when change is 0);`wallet_sign_all_inputs` signs EVERY input (legacy SIGHASH_ALL over the pure-unsigned form, low-S DER);`wallet_send_tx` is the one-call send;`wallet_get_balance` sums the wallet's unspent prevouts. CLI:`wallet_cli send ...` prints the signed tx,`wallet_cli balance [v...]` prints the wallet UTXO sum.`test_send` (48th harness) feeds the signed tx through the SAME whole-tx validator as test_txval (UTXO presence/double-spend- per-input verify_p2pkh + fee): multi-input send VALID with correct outpoint/amount/change/fee, exact-balance send (no change output), underfunded and zero-fee REJECTED, send-vs-empty-UTXO rejected, and balance math — 6 cases / 18 checks ALL PASS. **Wallet-core + CLI/RPC surface (bitcoin-cli parity, batch complete)**— five cards (`t_wrpc_getaddr` ..`t_wrpc_send` ) delivered a coherent Core-aligned command layer on top of the verified asm crypto (in`asm/wallet_core.c` +`asm/daemon/wallet_cli.c` + harnesses`test_wrpc_addr/utxo/decoderaw/sign/send` ):`getnewaddress` /`getrawchangeaddress` — BIP84`m/84'/0'/0'/i/0` and`.../1` P2WPKH bech32 receive/change addresses from a seed.`getaddressinfo` /`validateaddress` — parse + classify base58check (P2PKH/P2SH) and bech32 (P2WPKH/P2WSH) addresses, report version + hash.`listunspent` /`gettxout` — enumerate a wallet's unspent outputs and query an outpoint, each with value + scriptPubKey + address.`decoderawtransaction` — full human-readable decode of a raw tx (version, every input outpoint/scriptSig/sequence, outputs value/scriptPubKey/address, locktime).`signrawtransactionwithkey` — sign selected inputs with provided private keys (legacy SIGHASH_ALL, low-S), per-input key-ownership matching, already-signed inputs left untouched, signed-input masking.`sendtoaddress` +`getbalance` — greedy input selection over the wallet's own UTXOs, build + sign a send, report change/fee/new-balance; getbalance sums the wallet UTXOs. All five harnesses ALL PASS (known-vector addresses/base58 decode round-trip, corrupt-checksum rejection, gettxout found/absent, full tx decode, two-key sign ACCEPT/wrong-key REJECT/partial REJECT, greedy send + insufficient-funds + exact-balance). This is the in-scope wallet-core + bitcoin-cli/RPC surface (behavioral parity target); the full RPC transport and the remaining address/UTXO-resolver commands remain for a later RPC/bitcoin-cli layer. **bitcoin-cli network layer / JSON-RPC transport**(`t_8e5be37f` ) — wired the command layer onto a REAL JSON-RPC 2.0 transport. New shared RPC layer:`asm/rpc_json.c` — Core-bit-exact UniValue serializer (`write(pretty=2)` , 2-space indent, Core field order + escape set) and strict parser;`asm/rpc_net.c` — JSON-RPC 2.0 request/reply framing + HTTP POST over a local socket with HTTP Basic auth (rpcuser/rpcpassword), a minimal HTTP/1.1 request parser, and the reply-envelope parser;`asm/rpc_commands.c` — the shared dispatch/render path that maps a parsed request (method+params) to the wallet-core command layer and emits Core-shaped result JSON (`rpc_amounts` reproduces Core`ValueFromAmount` exactly). Client binary`asm/daemon/bitcoin_cli` behaves like bitcoin-cli: string results print raw, objects/arrays via`write(2)` , RPC errors print`error code:` /`error message:` and exit non-zero. Verified end-to-end over a real loopback HTTP socket by`asm/tests/test_rpc_transport` (execs the actual`daemon/bitcoin_cli` binary against a thread-spawned HTTP JSON-RPC responder that dispatches through the same`rpc_dispatch` ) — 19 checks byte-exact (wire framing, getnewaddress / getrawchangeaddress / getbalance / validateaddress / listunspent / gettxout / decoderawtransaction rendering, method-not-found + transport-error paths);`asm/tests/test_rpc_json` (28 checks) pins the renderer +`rpc_amounts` byte-exact.**HTTP JSON-RPC server endpoint**(child card`t_0ca5d72e` ) added the production server side:`asm/rpc_server.c` (loopback listen socket + accept thread, Core-bit-exact HTTP + JSON-RPC: 405 on non-POST, 401 +`WWW-Authenticate` auth,`-32700` parse error, V2/V1 envelopes with id echo, V2-notification 204) and`asm/daemon/bitcoin_rpcd` (loads rpcport/rpcuser/ rpcpassword from`config/bitcoin.conf` , serves until SIGINT/SIGTERM), both dispatching through the same`rpc_dispatch()` .`asm/tests/test_rpc_server` proves the production path end-to-end — forks+execs the REAL`bitcoin_rpcd` and drives it with the REAL`bitcoin_cli` plus raw sockets — 23 checks byte-exact. Together the client and server close the RPC-transport OPEN item.**Live-wire end-to-end sighash spend**(`tests/test_e2e_sighash.c` ) — the full wallet->validator path exercised as ONE integrated test across a real process boundary, not isolated pre-generated vectors: it builds a genuine unsigned P2PKH tx in memory, hands it to the ACTUAL`daemon/wallet_cli sign` binary (legacy SIGHASH_ALL, low-S, deterministic nonce) and captures its real`signed-tx:` stdout, then feeds that CLI-signed tx through the whole-tx validator (UTXO presence/double-spend +`verify_p2pkh` per input + fee) and requires it to pass. The CLI signature is additionally cross-checked as a genuine spend through the repo's independently-verified`ecdsa_verify` . Live negative cases round it out: the CLI signs a negative-fee tx (valid sig) that the validator rejects on`[fee]` ; an output-value tamper invalidates the SIGHASH_ALL digest -> rejected; a corrupted DER byte -> rejected; and the same signed tx against an empty UTXO set -> double-spend rejected. 9/9.**BIP32 full-path derivation + extended keys (xprv/xpub)**(`asm/bitcoin_bip32.asm` ) — three new functions on top of the verified`bip32_master` /`bip32_ckd_priv` :`bip32_derive_path` (derive a full path`m/44'/0'/0'/0/0` from a seed in one call),`bip32_fingerprint` (HASH160(pub)[0..4], the BIP32 parent fingerprint), and`bip32_extkey_serialize` (build the 78-byte xprv/xpub payload). Combined with the verified base58check encoder this yields real`xprv` /`xpub` strings, tying key -> address -> extended key together.`test_bip32_extkey` verifies the BIP32 vector-1 chain end, a BIP44 and a BIP84 path, and the master extended keys byte-exact against an independent`bip32` Python oracle. (The base58 encoder's digit-work buffers were enlarged to hold 78-byte payloads; the 25-byte address path is unchanged and still green.)**BIP39 mnemonic <-> seed**(`asm/bitcoin_bip39.asm` ) — full mnemonic generation/validation + PBKDF2 seed derivation, pairing with BIP32 for recoverable wallets. Embedded 2048-word English wordlist (`asm/wordlist.inc` , 9-byte fixed-width records, official order abandon..zoo); entropy (128..256 bits, 12..24 words) -> 11-bit groups with the trailing SHA-256 checksum (CS = ENT/32); validation re-derives the checksum and rejects bad word count, unknown words, and checksum mismatches; and seed derivation is PBKDF2-HMAC-SHA512(P=mnemonic, S="mnemonic"||pass, c=2048, dkLen=64) built on the verified asm`hmac_sha512` .`test_bip39` (24 vectors) verifies generate/validate/mnemonic->entropy and both empty- and "TREZOR"-passphrase seeds byte-exact against the official bip-0039 vectors via the independent Python oracle (`asm/validation/gen_bip39_vectors.py` , cross-checked with`hashlib.pbkdf2_hmac` ). The wallet CLI now reports a recoverable seed end to end:`wallet_cli mnemonic` `->` `wallet_cli seed "" [pass]` yields the mnemonic, 64-byte seed, master`xprv` , and`m/44'/0'/0'/0/0` address.**Persistent UTXO store**(`asm/bitcoin_utxo_store.asm` ) — a crash-safe, reloadable on-disk layer over the in-memory UTXO set, mirroring the proven append-only store/index pattern of the block archive: a write-ahead operation log`utxo.dat` (framed PUSH/DEL records; the durable source of truth) plus a checkpoint index`utxo.idx` (a snapshot of the live set + the log offset it covers).`utxo_store_put/del` append the op to the WAL first, then apply it in memory;`utxo_store_sync` writes a checkpoint and fsyncs both files;`utxo_store_reload` restores the checkpoint O(n) and replays the WAL tail past it (restart-resume), recovering a crash between checkpoints exactly like the block store's resume.`test_utxo_store` verifies put/spend/dedup, full-WAL reload, checkpoint + crash-tail restart-resume, and on-disk framing.**bech32 / bech32m codec**(`asm/bech32.asm` ) — BIP173/350 address codec (`bech32_polymod` 30-bit CRC, create/verify checksum with the XOR-1 vs 0x2bc830a3 switch, 8<->5 bit regroup, encode/decode), verified against every authoritative BIP173/BIP350 vector plus exact real mainnet segwit addresses (P2WPKH bc1qw508..., P2WSH bc1qrp33..., P2TR bech32m bc1p...).**P2SH / multisig**(`asm/bitcoin_multisig.asm` ) —`p2sh_hash` (RIPEMD160(SHA256(redeemScript))) and`multisig_verify` (OP_CHECKMULTISIG evaluation: walk the scriptSig pushes, take the push before the target pubkey as that signer's DER sig, and ECDSA-verify it against the legacy SIGHASH_ALL preimage with the redeem script as the signing script).`test_multisig` (8/8) is cross-checked by the independent pure-Python`ecdsa` oracle (`asm/validation/p2sh_oracle.py` ): known p2sh hashes, a self-consistent spend that verifies, and tampered-sig / wrong-pubkey negatives.**Full script interpreter**(`asm/bitcoin_interp.asm` built on the verified support layer`asm/bitcoin_scriptcodec.asm` ) — a complete Bitcoin Script EvalScript engine covering the full opcode set with Bitcoin Core semantics: flow control (`OP_IF/ELSE/ENDIF/VERIFY/RETURN` ,`vfExec` condition stack), stack/splice (`DUP/DROP/SWAP/ROT/PICK/ROLL/2DUP/2OVER/2ROT/...` ), bitwise (`SIZE/EQUAL[VERIFY]` ), arithmetic (monadic`1ADD/1SUB/NEGATE/ABS/ NOT/0NOTEQUAL` + binary`ADD/SUB/BOOLAND/BOOLOR/NUMEQUAL[VERIFY]/ NUMNOTEQUAL/LESSTHAN/GREATERTHAN/.../MIN/MAX/WITHIN` over clamped 32-bit and 64-bit ScriptNum), crypto (`OP_SHA256/OP_HASH160/OP_HASH256/OP_RIPEMD160` ,`OP_CODESEPARATOR` , and the`OP_CHECKSIG` family host via a callback), disabled opcodes returning**false**, reserved->bad-opcode,`OP_CLTV/OP_CSV` handling, and**tapscript/BIP342** semantics:`OP_SUCCESSx` pre-scan (short-circuit success /`DISCOURAGE_OP_SUCCESS` ), cleanstack + empty-stack treatment (`CLEANSTACK` /`EVAL_FALSE` ), tapscript-minimal-IF as an unconditional consensus rule,`OP_CHECKSIGVERIFY` forbidden,`OP_CHECKMULTISIG` ->`TAPSCRIPT_CHECKMULTISIG` , and`OP_CHECKSIGADD` gating (valid only under tapscript). Verified differentially against Bitcoin Core's`script_tests.json` (`tests/script_tests_diff.py` : 67/67 BASE opcode vectors byte-for-byte, exit 0) plus a dedicated 24-check tapscript harness (`tests/test_tapscript_interp.c` ) and`tests/smoke_interp` /`test_interp` . The taproot/schnorr signature callback layer is wired downstream (t_93b2695f, taproot/segwit v1).**Taproot / segwit v1 validation (BIP341/340/342)**— BIP340 Schnorr signature verify + signing (`asm/secp256k1_schnorr.asm` , verified against all 19 official`bip-0340` test vectors), BIP341 taproot helpers (`asm/secp256k1_taproot.asm` : x-only tweak with parity, tagged-hash tapleaf/ branch/merkle-root, control-block parsing), bech32m P2TR address<->scriptPubKey (BIP341/350), and end-to-end spend validation in`asm/bitcoin_taproot_sighash.c` : BIP341 SigMsg serialization + TapSighash for key-path and script-path (BIP342 ext) with every hash type, key-path schnorr verify against the output key (including witness-annex commitment), script-path`OP_CHECKSIG` /`OP_CHECKSIGADD` verify, and the`checksig_fn` callback that drives live tapscript`OP_CHECKSIG` /`CHECKSIGADD` spends through the ASM script interpreter. Verified byte-for-byte against the official Bitcoin Core`wallet-test-vectors` (keyPathSpending) + Core-validated reference preimages, cross-checked by the independent pure-Python oracle (`asm/validation/gen_taproot_vectors.py` ).`test_taproot_sighash` 48 checks green;`make test` suite green.**Witness-v0 + taproot full mempool acceptance parity vs Core**— modern-output transactions (P2WPKH / P2WSH / P2TR) through the entire mempool-acceptance pipeline. BIP143 segwit-v0 sighash (`asm/bitcoin_segwit.c` , mirroring Core`SignatureHash WITNESS_V0` ) verified byte-exact against the official BIP-0143 test vector via the independent Python oracle (`asm/validation/gen_modern_vectors.py` ); a unified whole-tx validator (`asm/bitcoin_txval_modern.c` ) dispatches by prevout type and runs each genuine spend through strip-witness + per-input ECDSA (P2WPKH, P2WSH`OP_CHECKSIG` + 2-of-2`OP_CHECKMULTISIG` ) / Schnorr (P2TR key-path) verify on top of the verified ASM secp256k1; driven end-to-end with the mempool policy layer (`mpool_policy_add` : fee, double-spend, RBF, ancestor limits) in`test_mempool_accept_modern` . Every genuine modern tx is accepted by BOTH policy and whole-tx validation; every negative (corrupted sig, wrong pubkey, absent prevout, double-spend, negative fee) rejected in agreement with Core.`test_segwit_sighash` 17 +`test_mempool_accept_modern` 23 checks green;`make test` suite green. Closes the modern-output validation gap.**Differential consensus harness vs Bitcoin Core (compliance gate)**—`validation/consensus_diff.py` +`asm/tests/consensus_shim` feed the SAME real mainnet block/tx bytes to (a) the ASM consensus stack (`cons_verify` /`block_hash` /`pow_check` /`diff_target` /`tx_txid` via the shim) and (b) a real Bitcoin Core node's RPC, and compare every verdict byte-for-byte. Two differential passes: an**ACCEPT path**(every real mainnet block the active chain accepted must be`cons_verify` -valid AND its ASM block_hash must equal Core's height->hash — a rejection/`hash mismatch is a false-negative consensus bug), and a **REJECT path** (deterministic mutations of real blocks — flipped merkle/tx/nonce/prev bytes, txcount corruption, truncation — are fed as identical bytes to` cons_verify`and Core` submitblock`; both must reject together). A per-tx **txid differential** verifies the ASM BIP141 txid against Core's canonical txid for up to 120 real txs per sampled block. Verified clean (zero divergences) across the consensus-critical epochs: genesis, BIP16 activation (173805), BIP34 (227931), SegWit (481824), Taproot (709632), recent mainnet (918000).` tests/consensus_shim`builds via` make`; drive with` python3 validation/consensus_diff.py --start H --count N`. **Peer discovery layer (self-contained, full-client):** `asm/bitcoin_addrmgr.asm` is a persisted peer address book (`peers.dat` ) plus byte-exact `addr` v1 codecs (verified by `test_addrmgr` ). `daemon/crawler.c` / `daemon/addrgather.c` harvest peers via getaddr->addr/addrv2 and fold them into the book; `daemon/peertest.c` verifies which peers actually serve block bodies. Combined with the distinct-peer selection this is the basis for self-directed discovery. **The durable archive** is a single unified store (`data/blk00000.dat` .. + `index.dat` + `headers.dat` — one directory, no worker shards) that is queryable via the asm CLI and **served entirely in assembly**. Serving was rebuilt around an **O(1) in-memory hash→height index** built in assembly (`asm/bitcoin_idx.asm` : `idx_init/put/get` , open-addressing, full 32-byte keys) — a linear per-height scan never finished on a large archive and a single hole aborted it. `asm/bitcoin_serve.asm` (`node_serve_loop` ) is the per-connection server message loop in pure machine code: ping→pong, getaddr→addr (address book), getdata→block (O(1) lookup + `node_serve_block` ), getheaders (2000x81B pages), inv. The serve daemon (`./bitcoind serve` ) calls it after `node_accept_handshake` , so both halves of the node's core run in assembly (outbound download `node_ibd_*` + inbound server `node_serve_loop` ). Verified live against the daemon: 8 real mainnet blocks served byte-exact on one connection, each hashing back to the requested hash. The buffer sizing is hardened for modern (up to 4 MB) blocks. One-shot health: `daemon/nodecheck.sh` (audit + progress + serve round-trip) and `daemon/chainprogress.sh` (coverage toward a complete 0..tip archive). As the forward pass and the early-height backfill converge, the archive reaches **block 0 (the 2009 genesis block)** upward — `verify` on contiguous runs reports 100% hash-match / chain-link / PoW / consensus (`CHAIN VERIFIED` ). **Wallet message signing / verification**(`asm/wallet_msgsign.c` ,`asm/daemon/wallet_cli.c` ) —`signmessage ` and`verifymessage ` using only the verified asm crypto. Two encodings, both over the byte-exact BIP137 digest (double-SHA256 of`"\x18Bitcoin Signed Message:\n" || varint || msg` ): a plain`r||s` hex form (verify against a pubkey), and a**Core-compatible recoverable** form (`msg_sign_core` /`msg_verify_core` ) that emits the 65-byte base64 compact signature`[27+4+recid(+low-s bit)]||r||s` via hand-rolled ECDSA**public-key recovery**(recid search over the asm`fe` /`point` /`scalar` primitives) and verifies from an**address alone**— the exact Core`verifymessage` flow. Pinned by`tests/test_msg_sign.c` : 120-message recoverable round-trip + tamper reject + wrong-message reject (all recovery-ids and both low-s states).**Persistent transaction history journal**(`asm/wallet_txlog.c` ) —`wallet_cli history` /`listtransactions` render an append-only, versioned, own-format journal (BMCTX v1, 0600 perms, one record per sent tx: ts, txid, amount, fee, dest-h160, inputs, rawlen).`cmd_send` /`cmd_sendtoaddress` record each sent tx;`test_wallet_txlog` (11 checks) covers path derivation, perms, versioned header, list round-trip and append-only behavior.**Fast block store read path**(`asm/bitcoin_store_fast.asm` ,`asm/bench_store_read.c` ) — cuts the per-block serve cost from six syscalls to two (positioned`pread` of index + body via a direct-mapped 8-slot read-only fd cache), and to zero-copy via a guarded`mmap` path (`store_map_*` ) with remap-on-growth and SIGBUS-past-EOF protection. Verified byte-exact vs the old path on 4000 blocks incl. random-access, mmap, append-while-mapped remap; ~1.1x (pread) and ~2.1x (mmap) at page-cache speeds. Removes the shared-index-fd race making concurrent reads safe;`store_prune_safe` invalidates both caches before unlink.**Security audit status**(`validation/SECURITY_AUDIT.md` ) — two completed audit passes, 2026-08-15 (PASS 1) and 2026-08-16 (PASS 2), of the assembly crypto + consensus + wallet core, following an internal line-by-line review method and backed by regression harnesses committed to the suite.- PASS 1 findings all **FIXED**: the CRITICAL non-constant-time signing path (FINDING 1 — fixed via a constant-time`point_scalar_mul_ct` repointed onto the two secret-scalar call sites; field arithmetic made branch-free per FINDING 3), and the legacy-sighash out-of-bounds read / write-cap defects (FINDING 2 / 2b, both with`test_sighash_oob.c` regression). - PASS 2 (2026-08-16, post-delta review) found **no new CRITICAL or HIGH** issue across the newest crypto/networking surfaces; two hardening items are recorded as open (INFO/LOW — journal durability, recovery-scan efficiency / Core-header extension bit). - With FINDING 1 fully landed the **signing path is constant-time end-to-end**. The README warning above remains because the code has not undergone an*independent third-party*audit; the internal audit is complete, tracked in-repo, and green. - PASS 1 findings all ``` bitcoinmachinecode/ +-- asm/ | +-- sha256.asm # SHA-256: init, block compression, one-shot (x86-64 NASM) | +-- secp256k1_fe.asm # field add/sub/mul/sqr/inv mod secp256k1 prime p | +-- secp256k1_point.asm # Jacobian point double/add/scalar-mul over secp256k1 | +-- secp256k1_scalar.asm # scalar add/sub/mul/sqr/inv mod curve order n | +-- secp256k1_ecdsa.asm # low-S ECDSA signature verification | +-- bitcoin_hash.asm # sha256d / block_hash / merkle_root / pow_check | +-- bitcoin_tx.asm # transaction deserializer (tx_parse) | +-- bitcoin_net.asm # POSIX sockets + P2P framing (raw syscalls) | +-- bitcoin_p2p.asm # getheaders/getdata/ping builders + headers parser | +-- bitcoin_store.asm # persistent blk file + positional block index | +-- bitcoin_headers.asm # persistent header chain (hdr, block_hash) store | +-- bitcoin_cons.asm # full-block consensus check (cons_verify) | +-- bitcoin_cli.asm # S6 CLI: query the store (cli_main) | +-- bitcoin_addrmgr.asm # persisted peer address book + addr v1 codecs | +-- bitcoin_idx.asm # O(1) block hash->height index for serving (idx_*) | +-- bitcoin_serve.asm # inbound server message loop (node_serve_loop) | +-- bitcoin_pubkey.asm # fe_pow + pubkey_parse: secp256k1 pubkey de/compress | +-- bitcoin_sighash.asm # legacy SIGHASH_ALL preimage builder | +-- bitcoin_script.asm # der_parse_sig + verify_p2pkh (end-to-end P2PKH validate) | +-- bitcoin_utxo.asm # in-memory UTXO set (prevout value/script) | +-- bitcoin_utxo_store.asm # PERSISTENT UTXO: WAL utxo.dat + idx checkpoint | +-- bech32.asm # BIP173/350 bech32/bech32m address codec | +-- bitcoin_bip32.asm # BIP32 master/CKD/derive_path + xprv/xpub | +-- bitcoin_bip39.asm # BIP39 mnemonic<->seed (PBKDF2-HMAC-SHA512) | +-- wordlist.inc # 2048-word BIP39 English wordlist (9-byte records) | +-- bitcoin_multisig.asm # p2sh_hash + multisig_verify (OP_CHECKMULTISIG) | +-- wallet_core.c # wallet primitives glue over asm crypto | +-- bitcoin_mempool_policy.c # policy/RBF/fee layer over mempool + UTXO | +-- build.sh # assemble + build + run every verification harness | +-- Makefile # make asm | test | clean | +-- cuda/ # optional CUDA batch-acceleration tier (crypto) | | +-- cuda_sha256.cu # batch SHA-256 / SHA-256d kernel + host ABI | | +-- cuda_sha256.h # opaque batch ABI header | | +-- cuda_autodetect.c # runtime auto-detect + CPU-fallback dispatcher | | +-- cuda_verify.cu # correctness gate vs the asm oracle (PASSES) | | +-- cuda_bench.cu # GPU/CPU throughput comparison | | +-- cuda_autodetect_test.c # routing/digest matrix (all modes) | | +-- Makefile # make verify | bench | detect | all | | +-- WORKING.md # feasibility analysis + roadmap | +-- tests/ # C harnesses proving the machine code correct | +-- validation/ # Python big-int oracles (trusted reference) | +-- daemon/ # C orchestration + peer discovery/serving tools | +-- wallet_cli.c # wallet CLI: addr/sign/send/sendtoaddress/balance/getnewaddress/getrawchangeaddress/getaddressinfo/validateaddress/gettxout/listunspent/decoderawtransaction/signrawtransactionwithkey + mnemonic/seed | +-- unified_ibd.c # standalone bulk-download tool: chunk-claiming/work-stealing engine (same design bitcoind's own built-in dl_catchup uses) | +-- hole_ranges.py # find gaps in index.dat (unified_ibd's driver) | +-- backfill_holes.sh # one combined-span unified_ibd call over current holes | +-- sync_chain.sh # chains hole-fill into extending to the real tip | +-- chainctl.c # chunked full-chain orchestrator (resume/audit/ETA) | +-- check_chain.c # integrity audit (dups/holes/corruption, chain-breaks) | +-- verify.c # full chain validation (hash/chain/PoW/consensus) | +-- dumpblock.c # inspect a stored block (raw bytes / header summary) | +-- nodecheck.sh # one-shot health: audit + progress + serve round-trip | +-- chainprogress.sh # coverage toward a complete 0..tip archive | +-- crawler.c # parallel getaddr peer harvester | +-- addrgather.c # getaddr -> addr/addrv2 -> peers.dat address book | +-- peertest.c # verify which peers serve block bodies | +-- main.c # daemon: sync / ibd / follow / serve (self-healing built-in catch-up) / server-test | +-- cli.c # thin driver for the asm cli_main +-- data/ # durable chain storage: ONE unified archive | # (blk00000.dat..blkNNNNN.dat + index.dat + headers.dat) +-- README.md ``` Blocks persist to the current working directory as `blk00000.dat` (append-only framed blocks) + `index.dat` (positional height index) + `bitcoind.log` . The durable home is ** data/** under the project root, on the `/storage` NVMe mount (ext4, ~2.6 TB free — room for a full archive node; pruned mode fits in just a few GB). Point the daemon/CLI there: ``` cd /storage/bitcoinmachinecode/asm/daemon ./bitcoind sync /storage/bitcoinmachinecode/data # download + validate + store ./bitcoind ibd /storage/bitcoinmachinecode/data # FULL IBD as one asm pass # (headers-first persist + # getdata block bodies + # validate + store) # self-healing: discovers peers, fills any archive gap AND catches up to the # real chain tip on its own (dl_catchup, >=8 chunk-claiming workers), THEN # opens for inbound service -- no external tooling needed for normal operation: ./bitcoind serve /storage/bitcoinmachinecode/data 8333 # standalone bulk-download tool (same chunk-claiming engine as dl_catchup), # for a very large initial catch-up or offline reindexing: ./unified_ibd /storage/bitcoinmachinecode/data 8 ./backfill_holes.sh /storage/bitcoinmachinecode/data 8 # fill every current gap ./sync_chain.sh /storage/bitcoinmachinecode/data 8 # gaps, then extend to real tip # chunked full-chain orchestrator (forward to tip, resuming + auditing each chunk): ./chainctl /storage/bitcoinmachinecode/data 8 16000 20 # health / progress / audit / serve round-trip: ./nodecheck.sh /storage/bitcoinmachinecode/data # audit + progress + serve ./chainprogress.sh /storage/bitcoinmachinecode/data # coverage toward 0..tip ./check_chain /storage/bitcoinmachinecode/data # dups/holes/corruption audit ./verify /storage/bitcoinmachinecode/data # hash/chain/PoW/consensus ./cli /storage/bitcoinmachinecode/data getblockcount # query the stored chain ./asm/build.sh # or cd asm && make test ``` Requires `nasm` and `gcc` . Exit code 0 means the assembly hash is correct. ``` // sha256.asm void sha256_init (u32 state[8]); // hash init void sha256_block(u32 state[8], const u8 block[64]); // one block void sha256_full (u8 out[32], const void *msg, unsigned long len); // one-shot // bitcoin_hash.asm (node-layer hashing, built on sha256) void sha256d (u8 out[32], const void *msg, long len); // double SHA-256 void block_hash (u8 out[32], const u8 hdr[80]); // sha256d(hdr,80) void diff_target (u8 target[32], u32 bits); // compact nBits->target int pow_check (const u8 hdr[80]); // PoW holds? void merkle_root (u8 out[32], u8 hashes[], unsigned long n); // tx merkle (in place) // bitcoin_tx.asm (transaction deserializer) int tx_parse(u64 info[8], const void *tx, unsigned long txlen); // 1 if fully parsed (legacy + SegWit) int tx_txid (u8 out[32], const void *tx, long txlen, void* buf, long buflen); // BIP141 txid // bitcoin_net.asm (POSIX sockets + P2P framing) long fd_write_all(int fd, const void* buf, size_t n); // n or -1 long fd_read_full (int fd, void* buf, size_t n); // n / long int cli_hex_to_bin(u8* out32, const char* hex64); // 64-hex -> 32 bytes, 1/0 (void cli_hex / cli_rev32 are internal helpers; cli_main is the entry point) // secp256k1_fe.asm / _point.asm / _scalar.asm / _ecdsa.asm // see asm/source headers for the field/point/scalar/ECDSA APIs ``` No human-written code. The compiler/assembler performs only the mechanical translation of AI-authored instructions into machine code; the algorithm, the register allocation, the padding logic, and every comment are produced by an AI.