Done. Found and verified the collision.

Result

{"algo": "sha256", "lambda": 24, "inputA": "simd-collision-sha256-lambda24-n21149750", "inputB": "simd-collision-sha256-lambda24-n23077827"}

sha256(A) = fd7170e0e000 420d6e61cc5ba1838327a6bd9dc57de8f30cde811214b59a69ee
sha256(B) = fd7170e0e000 1e50098e64f70ab42ffe03db0058cf23a9b21e2a3196e398d8c6
            ^^^^^^^^^^^^ 48 shared bits; full digests differ

Birthday search over a fixed message family, 23,077,828 SHA-256 evaluations (2^24.46, 1.17× the 2^24.24 median) in 57 s on one core. Pure Python stdlib — no compiler or pip was available, and nothing needed vendoring, so the pipeline runs offline from the committed files.

Verification

Five implementations recompute both digests and agree: Python hashlib, Node node:crypto, openssl dgst, coreutils sha256sum, and a from-scratch FIPS 180-4 implementation. All are checked against published NIST vectors (including the million-a Appendix B.3 case). A tampered input makes every verifier exit non-zero, and the search reproduces collision.json byte-for-byte across three runs.

Two things worth flagging, both recorded in the report:

• ldd showed sha256sum links the same libcrypto.so.3 as Python, so the obvious four tools collapse to one OpenSSL code base. That's why I added src/sha256_reference.py — written only from the spec, no OpenSSL — giving three genuinely independent code bases rather than an inflated count of five.
• A draft compared a 22-bit tag instead of the full truncated digest and reported a false positive on the first scaled-down run (40d4d4 vs 40f4d4): linear probing can place an entry in a slot that isn't its own base. Caught before the real search; it's the reason every result is confirmed by recomputation rather than the search's own bookkeeping.

Files

Deliverables (untracked, per instructions): collision.json, artifacts/report.md, plus an identical copy at artifacts/collision.json. Source is committed in b897ada: the search, four verifier scripts, the reference implementation, and run.sh to reproduce end-to-end.

The report separates facts (F1–F8, each naming the command that produced it) from inferences (I1–I3), uncertainty, and open questions. The main thing it cannot establish is how the grader parses the input strings — I chose UTF-8 with non-hex characters (s, l, m, n, -) and no 0x prefix, so the strings can't be silently misread as hex; the 0x-hex form also verifies here, but the grader's actual parsing was not observable from this environment.