HashSigs RHDL privacy-sanitized source narrative Evidence record: sha256-three-lane-generated-rtl Repository-relative source: evidence/rtl/sha256-replicated-farm-arithmetic-2026-07-15.md Cryptographic subject/source commit: beb9ada48fc01e089ec4fbaa05d2fdeab338de47 Cryptographic source dirty: no Pre-sanitization narrative SHA-256: 8a780f7aadefa8652644596ca9d0d1b089fcea82af3717ffb360f129a3d6d0a6 Narrative checkout commit: 3810cf837ea79ca005f4ab227b0b5c2134fe6ad1 Narrative checkout dirty: no Sanitization substitutions: temporary-directory path: 2 -> [local-temporary-path]; process-specific pseudo-filesystem path: 1 -> [local-process-path] This public projection is not byte-identical when substitutions are listed. The digest identifies the pre-sanitization narrative bytes read by this documentation build. It does not assert that those bytes existed at the cryptographic subject commit. --- sanitized narrative --- # Replicated SHA-256 farm arithmetic — 2026-07-15 ## Evidence tier and boundary Generated-Verilog deterministic simulation. The complete lane and exact three-lane replicated farm matched the independent Rust `compress_block` oracle for the finite vectors exercised by the self-checking testbenches. The checks cover SHA-256 compression and feed-forward from non-IV chaining states, opaque 32-bit tags, adjacent accepted tokens, bubbles, exact 64-cycle latency, reset flushing, post-reset recovery, and asymmetric activity across all three farm lanes. This is lowering-equivalence evidence for the checked vectors, not a formal proof. It is not synthesis, LUT/register/BRAM/DSP utilization, timing, placement, routing, signature throughput, side-channel, or U280 execution evidence. The SystemVerilog files listed below are self-checking testbenches; the SHA datapaths under test are generated from Rust/RHDL. ## Change under test `ThreeLaneCompressionFarm` now uses `ReplicatedCompressionFarm<3, 64, 6>`. Its one `ReplicatedSynchronous, 3>` prototype lowers to one lane module definition instantiated as `c0`, `c1`, and `c2`. Behavioral RHDL simulation still owns independent state for every instance. The ordinary-array `CompressionFarm` remains available as a direct behavioral oracle. The generated farm contains: - one `sha256_compression_farm_3x64_lanes_prototype` definition; - three direct prototype instances, `c0`, `c1`, and `c2`; - one textual `reg [255:0] mem[63:0]` declaration inside that shared module definition; and - 201 Verilog module definitions in total. One textual definition does not mean one hardware lane or one physical memory. Synthesis must still elaborate the three instances independently. No mapped resource conclusion follows from generated-source deduplication. ## Reproduction ```console cargo build -j1 -p rhdl-gen target/debug/rhdl-gen check --full --keep \ --temp-root [local-temporary-path] ``` The command exited with status 0 after 938.749 seconds. Its preserved workspace is `[local-temporary-path]`. That path is not a durable artifact store; the checksums below identify the exact files. The CLI used its existing serialized Verilator configuration: `--threads 1` for lint and `--threads 1 -j 1` for arithmetic-testbench construction. A separate one-second `[local-process-path]` monitor observed the generator process throughout the run: - observed `VmHWM`: 9,935,992 KiB; - observed `VmPeak`: 11,560,244 KiB; and - shell-measured CPU time: 872.761 seconds user plus 55.391 seconds system. `VmHWM` is the kernel-maintained process high-water field sampled while the process remained alive. These memory figures cover the `rhdl-gen` process, not an aggregate of its Verilator, compiler, or simulator children. They describe this host run only and are not FPGA resource measurements. ## Provenance - Source commit: `beb9ada48fc01e089ec4fbaa05d2fdeab338de47` - Source dirty: `false` - Profile: `HASHSIGS_SHA256_GENERIC_V1` - RHDL revision: `c99d5cc53269a247bbc675d0fbd766991d409f56` - HashSigsRS revision: `2d315dd4168804b7cbc51c51a1bf7ca27bf74140` - Verilator: `5.048 2026-04-26 rev v5.048` - Full-check wall time: 938.749 seconds - Build and lint concurrency: one thread ## Artifacts | Artifact | Size / lines | SHA-256 | |---|---:|---| | Lane RTL | 1,001,581 bytes / 28,223 | `615a4e89519a5aadec2bc17a6b59833fd4bf51dc123f44d378e6f0fb7866610d` | | Replicated farm RTL | 1,013,742 bytes / 28,254 | `0b4aef07029d4ae3a9e3cfa271c8ebe899a2128dc3c95794977c5dce4c2160d9` | | Lane manifest | — | `4d41ae2fa26fef7f2856fc950945144d36d86385cfc6e1f4e377d40fe81ab339` | | Replicated farm manifest | — | `1ad9354cc2e052754f850f622c3088d23baa0d5430efdc7d4d740c90db13d0c2` | | Lane testbench | — | `30be37c66989b9504ddbd9ae97c29af02855d32f9e0db9a1ac901918f6cf11a3` | | Farm testbench | — | `3427b998131cebc54766641d00ac43668d8451e2122d3833704ead264f304c70` | | Lane lint log | — | `4d73a6455d532e4ede90bfbcf95c7f9fafbe130b61101ff8ef0482d44f3b0b4f` | | Farm lint log | — | `9c840cbb55e78b0846685023bec4a8a5426c85e15929635642d47234ad312138` | | Lane build log | — | `3f30ab2b962e71011f0c27dfaf5efcd39055562248fddd98b9338e20c0311c28` | | Farm build log | — | `b195bf105483a6be4ac830758130ba49871f91a0d5f1d24e82bdd9ad843cf048` | | Lane simulation log | — | `76707409660e4b900915669aa5250b1a8b3c6a0530cbf84f50f8a400262e1e79` | | Farm simulation log | — | `6df649738af9f23515c0c73fcce9477b387e7720223939012c4db1a384b209e1` | Both manifests record the source as clean and repeat the corresponding RTL checksum. ## Results ### Default parser gate Icarus syntax/elaboration passed for `legacy-keccak-round`, `legacy-keccak-iterative`, `sha256-round`, and `sha256-pipeline-2`. This is a parser/elaboration result only for those default targets. ### Complete lane - Verilator lint command: `verilator --lint-only -Wall -Wno-fatal --threads 1 --top-module sha256_compression_lane ...` - Lint/elaboration: passed in 5.228 seconds. - Accepted warning inventory: 2,193 total — 2,191 `UNUSEDSIGNAL`, one `DECLFILENAME`, and one `UNOPTFLAT`. - Arithmetic build command: `verilator --binary --timing -Wno-fatal -Wno-DECLFILENAME -Wno-UNUSEDSIGNAL --threads 1 -j 1 --top-module sha256_lane_arithmetic_tb ...` - Testbench build: passed in 55.903 seconds. - Simulation: passed in 0.081 seconds. - Marker: `SHA256_LANE_RTL_EQUIVALENCE_PASS vectors=3 latency=64 reset_flush=1`. ### Exact replicated three-lane farm - Verilator lint command: `verilator --lint-only -Wall -Wno-fatal --threads 1 --top-module sha256_compression_farm_3x64 ...` - Lint/elaboration: passed in 12.789 seconds. - Accepted warning inventory: 2,194 total — 2,192 `UNUSEDSIGNAL`, one `DECLFILENAME`, and one `UNOPTFLAT`. - Arithmetic build command: `verilator --binary --timing -Wno-fatal -Wno-DECLFILENAME -Wno-UNUSEDSIGNAL --threads 1 -j 1 --top-module sha256_farm_arithmetic_tb ...` - Testbench build: passed in 167.870 seconds. - Simulation: passed in 0.407 seconds. - Marker: `SHA256_FARM_RTL_EQUIVALENCE_PASS lanes=3 vectors=5 latency=64 reset_flush=1`. The farm's five expected outputs exercise unrelated inputs and bubbles across all three lanes, adjacent-cycle transport, non-IV feed-forward, full-width opaque tags, and post-reset recovery. Three additional in-flight farm inputs are deliberately invalidated by reset. The expected digests come from the allocation-free Rust compression model, not from generated RTL. The `-Wno-fatal` lint runs are accepted elaboration with a recorded warning inventory; they are not warning-clean claims. The remaining `UNOPTFLAT` report names RHDL's packed `od` feedback envelope around the sequential child hierarchy. Passing arithmetic simulation does not dispose of that warning. Vivado synthesis and combinational-loop DRC remain mandatory before hardware claims. ## Generated-source comparison The earlier ordinary-array farm at source commit `9833e13` emitted 3,025,187 bytes, 84,700 lines, 599 module definitions, and 6,578 accepted lint warnings. The replicated farm emits 1,013,742 bytes, 28,254 lines, 201 module definitions, and 2,194 accepted lint warnings. This is a 66.49% byte reduction and 66.64% line reduction in generated source. The unchanged lane RTL checksum and unchanged testbench checksums make the hierarchy change visible without changing the checked arithmetic stimuli. This comparison is generator/source-size evidence across two commits, not a mapped-area comparison. Only synthesis can show whether a downstream tool elaborates the shared definition as the intended three independent hardware instances and what resources those instances consume. ## Next gate Integrate the fine-grained WOTS context engine and bounded result framer, then prove the complete signer in RHDL and generated RTL at no more than 500 normalized cycles per unique fused private-seed result. U280 synthesis and implementation remain separate higher evidence tiers.