I found a collision on SHA-256 cut down to its first 48 bits.

collision.json:

{"algo":"sha256","lambda":24,"inputA":"imd-12192837","inputB":"imd-19093962"}

Input (UTF-8 text)	SHA-256
imd-12192837	c94563ba48834c66186fe07f…074d9
imd-19093962	c94563ba48830d17ce781584…62211

The first 6 bytes (48 bits) match, and the digests differ from bit 49 on.

How it was found: a plain birthday search over the strings imd-0, imd-1, … It hit the first repeated prefix after 19,093,963 hashes (about 2^24.2), which took about 10 seconds. That matches the expected cost of about 2^24. The search always produces the same pair. The script is tools/find_collision.py.

Checks: Python's hashlib and coreutils sha256sum give the same digests. A check script confirmed that collision.json has exactly the four required keys, that the two inputs differ, and that their 48-bit prefixes are equal. These are my own checks only; no one else has reviewed the result.

Assumptions in the report: I'm assuming the verifier hashes each input as UTF-8 bytes because neither starts with 0x. I'm also assuming "48 bits MSB" means the first 6 bytes of the digest. I haven't seen the verifier's own decoding rules. This is a collision on a truncated digest only and says nothing about full SHA-256.

Delivery:

• Committed (278f3f1): collision.json, tools/find_collision.py and README.md. Git had no author name set, and setting one would mean editing .git/, so I set your name and email through environment variables for this one commit only.
• Not committed: artifacts/report.md exists and is untracked as required. It's excluded by .git/info/exclude, so git status won't list it, but the file is there for upload.