wots_rhdl/verify/

sha.rs

//! Fine-grained, single-context SHA-256 WOTS verifier.
//!
//! The context loads one exact 35-beat input frame, stores signature segments
//! directly in two mutable parity banks, derives all sixteen current-oracle
//! masks, advances only real chain steps, hashes the 67 endpoints, and retains a
//! small verification result under backpressure. It emits no task for a bypassed
//! chain position.
//!
//! Tasks may issue in any dependency-correct order. Every accepted response
//! must carry a canonical verifier-subset tag for this context and generation
//! and name an actually in-flight task. Rejected responses perform no state
//! write and latch a fail-closed transport poison that prevents context reuse
//! until shared reset.
//! Reset suppresses requests, response acceptance, memory writes, and retained
//! results; the enclosing lane must share that reset.
//!
//! The functional compression-lane contract is exact 64-cycle latency with
//! tag preservation. A 64-bit due bitmap enforces response cardinality and
//! timing locally, but is not an independent detector for a perfect swap of two
//! canonical in-flight tags. The enclosing verifier transport supplies that
//! stronger expected-tag delay line and converts every global integrity failure
//! into `transport_abort`. This context exposes ordinary request backpressure;
//! explicit outbound rejection and unowned lane returns are cluster-fatal rather
//! than being represented as an indefinitely deasserted `request_ready`.
//! Message digits are intentionally not retained after loading: the segment
//! stages and exact expected-task count capture every downstream dependency,
//! avoiding 268 bits of redundant logical register state.
//!
//! Logical RAM geometry is 36,864 bits per context. This is source geometry, not
//! synthesis, mapping, resource, timing, route, or hardware evidence.

use rhdl::prelude::*;
use rhdl_fpga::core::{
    dff::DFF,
    ram::synchronous::{In as SyncBramIn, SyncBRAM, Write as SyncBramWrite},
};
use rhdl_primitives::NoResetDff;
use sha256_rhdl::lane::{CompressionInput, CompressionOutput};

use crate::{
    blocks::{
        ChainBlockInput, EndpointPairInput, HashBytes, HashWords, PrfBlockInput,
        chain_block_kernel, endpoint_final_block_kernel, endpoint_pair_block_kernel,
        hash_words_to_bytes_kernel, initial_state_words_kernel, prf_block_kernel,
    },
    digits::message_digits_kernel,
    engine::{
        ENGINE_SEGMENTS, MASK_ADDRESS_BITS, MASK_STORAGE_BITS, SEGMENT_GROUPS,
        STATE_BANK_ADDRESS_BITS, STATE_STORAGE_BITS, SegmentGroups, SegmentStages,
        exclude_segment_groups_kernel, public_key_endpoints_ready_kernel, segment_bit_kernel,
        segment_required_mask_kernel, select_public_key_focus_segment_kernel,
        select_ready_segment_kernel, set_segment_bit_kernel, state_pair_exclusion_kernel,
        union_segment_groups_kernel, wake_segments_for_mask_kernel,
    },
    tag::{TagFields, decode_tag_kernel, encode_tag_kernel},
    verify::{
        framing::{VerifyStreamBeat, verify_beat_halves_kernel, verify_hash_equal_kernel},
        tasks::{
            verification_chain_fields_kernel, verification_sha_task_count_kernel,
            verification_tag_is_well_formed_kernel,
        },
    },
};

/// Successful protocol execution; `verified` carries the signature decision.
pub const VERIFY_ERROR_NONE: u128 = 0;
/// Noncanonical keep, last, job-ID, context, or generation framing.
pub const VERIFY_ERROR_FRAME: u128 = 1;
/// Malformed, stale, duplicate, or unexpected compression response.
pub const VERIFY_ERROR_TRANSPORT: u128 = 2;
/// Completion disagreed with exact task/dependency accounting.
pub const VERIFY_ERROR_AUDIT: u128 = 3;

const VERIFY_FULL_KEEP_BITS: u128 = u64::MAX as u128;
const VERIFY_DUE_INSERT_BITS: u128 = 1_u128 << 63;
const VERIFY_REMOVED_MESSAGE_DIGIT_STATE_BITS: usize = ENGINE_SEGMENTS * 4;

/// Logical RAM bits authored by one SHA verifier context.
pub const VERIFY_CONTEXT_LOGICAL_RAM_BITS: usize = STATE_STORAGE_BITS + MASK_STORAGE_BITS;
/// Exact functional latency required from the tag-preserving SHA lane.
pub const VERIFY_LANE_LATENCY: usize = 64;

const _: () = {
    assert!(ENGINE_SEGMENTS == 67);
    assert!(VERIFY_CONTEXT_LOGICAL_RAM_BITS == 36_864);
    assert!(VERIFY_LANE_LATENCY == 64);
    assert!(VERIFY_REMOVED_MESSAGE_DIGIT_STATE_BITS == 268);
};

/// Resettable frame, dependency, ownership, and result state.
#[allow(clippy::struct_excessive_bools)]
#[derive(Clone, Copy, Debug, Digital, Eq, PartialEq)]
pub struct VerifyContextControl {
    /// A 35-beat frame is being loaded.
    pub loading: bool,
    /// Cryptographic verification work is active.
    pub active: bool,
    /// One retained result awaits transfer.
    pub result_valid: bool,
    /// Sticky compression-transport poison, cleared only by shared reset.
    pub fault: bool,
    /// Sticky framing failure during the current load.
    pub frame_fault: bool,
    /// Retained signature decision; meaningful only with no error.
    pub result_verified: bool,
    /// Retained three-bit result error code.
    pub result_error: b3,
    /// Next fixed frame beat while loading.
    pub load_beat: b6,
    /// Eligible mask PRFs.
    pub mask_ready: b16,
    /// Issued but unretired mask PRFs.
    pub mask_inflight: b16,
    /// Retired mask PRFs.
    pub mask_done: b16,
    /// Eligible chain tasks.
    pub segment_ready: SegmentGroups,
    /// Issued but unretired chain tasks.
    pub segment_inflight: SegmentGroups,
    /// Current chain stage, or endpoint sentinel 18, for every segment.
    pub segment_stage: SegmentStages,
    /// Signature values already at final chain position fifteen.
    pub endpoint_done: SegmentGroups,
    /// Rotating general chain selector cursor.
    pub segment_group_cursor: b4,
    /// Serialized endpoint-hash block currently eligible or in flight.
    pub public_key_block: b6,
    /// One endpoint-hash block is in flight.
    pub public_key_inflight: bool,
    /// Prior endpoint-hash chaining state is available.
    pub public_key_state_ready: bool,
    /// Accepted compression requests.
    pub total_issued: b11,
    /// Accepted compression responses.
    pub total_retired: b11,
    /// Request-cardinality bits due to return in exactly 1 through 64 cycles.
    pub response_due: b64,
    /// Exact message-dependent task count.
    pub expected_tasks: b11,
    /// A synchronous-memory prefetch awaits payload construction.
    pub prefetch_pending: bool,
    /// Complete tag captured for the prefetch.
    pub prefetch_tag: b32,
    /// Stable compression request is presented to transport.
    pub request_valid: bool,
    /// Local transport context captured on beat zero.
    pub context: b4,
    /// Stale-response generation captured on beat zero.
    pub generation: b8,
}

impl Default for VerifyContextControl {
    fn default() -> Self {
        Self {
            loading: false,
            active: false,
            result_valid: false,
            fault: false,
            frame_fault: false,
            result_verified: false,
            result_error: b3(0),
            load_beat: b6(0),
            mask_ready: b16(0),
            mask_inflight: b16(0),
            mask_done: b16(0),
            segment_ready: [b8(0); SEGMENT_GROUPS],
            segment_inflight: [b8(0); SEGMENT_GROUPS],
            segment_stage: [b5(18); ENGINE_SEGMENTS],
            endpoint_done: [b8(0); SEGMENT_GROUPS],
            segment_group_cursor: b4(0),
            public_key_block: b6(0),
            public_key_inflight: false,
            public_key_state_ready: false,
            total_issued: b11(0),
            total_retired: b11(0),
            response_due: b64(0),
            expected_tasks: b11(0),
            prefetch_pending: false,
            prefetch_tag: b32(0),
            request_valid: false,
            context: b4(0),
            generation: b8(0),
        }
    }
}

/// Input ports for one SHA verifier context.
#[allow(clippy::struct_excessive_bools)]
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct VerifyContextInput {
    /// A verifier stream beat is present.
    pub stream_valid: bool,
    /// Complete 512-bit stream payload and sideband.
    pub stream: VerifyStreamBeat,
    /// Local context assigned by the enclosing cluster.
    pub context: b4,
    /// The enclosing cluster confirms this context exists.
    pub context_enabled: bool,
    /// Generation assigned to this context reuse.
    pub generation: b8,
    /// Compression transport accepted the stable request.
    pub request_ready: bool,
    /// Routed fixed-latency compression response.
    pub response: CompressionOutput,
    /// Consumer accepts the retained verification result.
    pub result_ready: bool,
    /// Enclosing transport observed a lane-global integrity failure.
    ///
    /// Loading, active, and clean retained jobs become held transport errors.
    /// An idle context and an already-retained per-job framing error are left
    /// untouched. Only shared reset clears the resulting poison.
    pub transport_abort: bool,
}

/// Output ports from one SHA verifier context.
#[allow(clippy::struct_excessive_bools)]
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct VerifyContextOutput {
    /// The presented stream beat can transfer.
    pub stream_ready: bool,
    /// Frame loading is in progress.
    pub loading: bool,
    /// Cryptographic work is in progress.
    pub active: bool,
    /// Stable request for the SHA transport.
    pub request: CompressionInput,
    /// Registered request before local response-failure output gating.
    ///
    /// The enclosing expected-tag transport uses this payload to avoid a
    /// combinational route/request-valid loop on a cycle that both launches a
    /// held request and returns another. The cluster still suppresses the
    /// actual launch and acknowledgement on every immediate fatal edge.
    pub transport_request: CompressionInput,
    /// A response passed all canonical/in-flight checks.
    pub response_ready: bool,
    /// A response was rejected without a state write.
    pub response_rejected: bool,
    /// Sticky transport fault for the current operation.
    pub fault: bool,
    /// Registered transport/audit poison before current-cycle response checks.
    pub fault_latched: bool,
    /// One-cycle pulse when a protocol or cryptographic result is completed.
    pub done: bool,
    /// A retained result is present.
    pub result_valid: bool,
    /// One-cycle result transfer pulse.
    pub result_transfer: bool,
    /// Retained external job identifier.
    pub result_job_id: b32,
    /// Retained signature decision; forced false for every protocol error.
    pub verified: bool,
    /// Retained error code.
    pub error: b3,
    /// Exact expected SHA task count.
    pub expected_tasks: b11,
    /// Accepted requests.
    pub total_issued: b11,
    /// Accepted responses before the current edge.
    pub total_retired: b11,
}

/// Inputs needed after one synchronous state/mask-memory prefetch.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct VerifyPrepareRequestInput {
    /// Canonical verifier-subset fields.
    pub fields: TagFields,
    /// Public seed used by mask PRFs.
    pub public_seed: HashBytes,
    /// Prior serialized endpoint-hash chaining value.
    pub public_key_state: HashWords,
    /// Prefetched even state/endpoint.
    pub state_even: HashWords,
    /// Prefetched odd state/endpoint.
    pub state_odd: HashWords,
    /// Prefetched one-based chain mask.
    pub mask: HashWords,
}

/// Build a SHA request for exactly Mask, Chain, or `PublicKey` work.
#[kernel]
pub fn prepare_verify_request_kernel(input: VerifyPrepareRequestInput) -> CompressionInput {
    let initial = initial_state_words_kernel(b1(0));
    let state_words = if input.fields.segment & b7(1) == b7(0) {
        input.state_even
    } else {
        input.state_odd
    };
    let mut chaining = initial;
    let mut block = prf_block_kernel(PrfBlockInput {
        seed: input.public_seed,
        index: input.fields.segment.resize(),
    });
    let mut valid = input.fields.kind == b3(2);

    if input.fields.kind == b3(6) {
        valid = true;
        block = chain_block_kernel(ChainBlockInput {
            state: hash_words_to_bytes_kernel(state_words),
            mask: hash_words_to_bytes_kernel(input.mask),
        });
    } else if input.fields.kind == b3(7) {
        valid = true;
        if input.fields.block_index != b6(0) {
            chaining = input.public_key_state;
        }
        if input.fields.block_index == b6(33) {
            block = endpoint_final_block_kernel(hash_words_to_bytes_kernel(input.state_even));
        } else {
            block = endpoint_pair_block_kernel(EndpointPairInput {
                first: hash_words_to_bytes_kernel(input.state_even),
                second: hash_words_to_bytes_kernel(input.state_odd),
            });
        }
    }

    CompressionInput {
        chaining,
        block,
        tag: encode_tag_kernel(input.fields),
        valid,
    }
}

/// Complete one-context SHA verifier.
#[derive(Clone, Debug, Synchronous, SynchronousDQ)]
#[rhdl(dq_no_prefix)]
pub struct VerifySingleContextSha {
    control: DFF<VerifyContextControl>,
    request: NoResetDff<CompressionInput>,
    public_seed: NoResetDff<HashBytes>,
    expected_hash: NoResetDff<HashBytes>,
    public_key_state: NoResetDff<HashWords>,
    job_id: NoResetDff<b32>,
    state_even: SyncBRAM<HashWords, STATE_BANK_ADDRESS_BITS>,
    state_odd: SyncBRAM<HashWords, STATE_BANK_ADDRESS_BITS>,
    masks: SyncBRAM<HashWords, MASK_ADDRESS_BITS>,
}

impl Default for VerifySingleContextSha {
    fn default() -> Self {
        Self {
            control: DFF::new(VerifyContextControl::default()),
            request: NoResetDff::new(),
            public_seed: NoResetDff::new(),
            expected_hash: NoResetDff::new(),
            public_key_state: NoResetDff::new(),
            job_id: NoResetDff::new(),
            state_even: SyncBRAM::default(),
            state_odd: SyncBRAM::default(),
            masks: SyncBRAM::default(),
        }
    }
}

impl SynchronousIO for VerifySingleContextSha {
    type I = VerifyContextInput;
    type O = VerifyContextOutput;
    type Kernel = verify_single_context_sha_kernel;
}

/// State transition and memory connectivity for [`VerifySingleContextSha`].
#[allow(
    clippy::assign_op_pattern,
    clippy::comparison_chain,
    clippy::match_same_arms,
    clippy::needless_range_loop
)]
#[kernel]
pub fn verify_single_context_sha_kernel(
    clock_reset: ClockReset,
    input: VerifyContextInput,
    q: Q,
) -> (VerifyContextOutput, D) {
    let resetting = clock_reset.reset.any();
    let zero_words = [b32(0); 8];
    let halves = verify_beat_halves_kernel(input.stream.data);
    let mut first_words = [b32(0); 8];
    let mut second_words = [b32(0); 8];
    for word in 0..8 {
        let first_byte = word * 4;
        let a: b32 = halves.first[first_byte].resize();
        let b: b32 = halves.first[first_byte + 1].resize();
        let c: b32 = halves.first[first_byte + 2].resize();
        let d: b32 = halves.first[first_byte + 3].resize();
        first_words[word] = (a << 24) | (b << 16) | (c << 8) | d;
        let e: b32 = halves.second[first_byte].resize();
        let f: b32 = halves.second[first_byte + 1].resize();
        let g: b32 = halves.second[first_byte + 2].resize();
        let h: b32 = halves.second[first_byte + 3].resize();
        second_words[word] = (e << 24) | (f << 16) | (g << 8) | h;
    }

    let mut control = q.control;
    let mut next_request = q.request;
    let mut next_public_seed = q.public_seed;
    let mut next_expected_hash = q.expected_hash;
    let mut next_public_key_state = q.public_key_state;
    let mut next_job_id = q.job_id;
    let mut state_read_addr = b6(0);
    let mut mask_read_addr = b4(0);
    let mut state_even_write = SyncBramWrite::<HashWords, STATE_BANK_ADDRESS_BITS> {
        addr: b6(0),
        value: zero_words,
        enable: false,
    };
    let mut state_odd_write = SyncBramWrite::<HashWords, STATE_BANK_ADDRESS_BITS> {
        addr: b6(0),
        value: zero_words,
        enable: false,
    };
    let mut mask_write = SyncBramWrite::<HashWords, MASK_ADDRESS_BITS> {
        addr: b4(0),
        value: zero_words,
        enable: false,
    };
    let mut done = false;

    let idle =
        !q.control.loading && !q.control.active && !q.control.result_valid && !q.control.fault;
    let transport_abort_live = !resetting
        && input.transport_abort
        && (q.control.loading
            || q.control.active
            || (q.control.result_valid
                && !q.control.fault
                && q.control.result_error == b3(VERIFY_ERROR_NONE)));
    let stream_ready = !resetting
        && !input.transport_abort
        && (q.control.loading || (idle && input.context_enabled));
    let stream_accepted = input.stream_valid && stream_ready;
    let frame_start = stream_accepted && !q.control.loading;
    let beat_index = if q.control.loading {
        q.control.load_beat
    } else {
        b6(0)
    };

    let result_transfer_requested =
        !resetting && !transport_abort_live && q.control.result_valid && input.result_ready;
    if result_transfer_requested {
        control.result_valid = false;
        control.result_verified = false;
        control.result_error = b3(VERIFY_ERROR_NONE);
        control.frame_fault = false;
    }

    if frame_start {
        control.loading = true;
        control.active = false;
        control.result_valid = false;
        control.fault = false;
        control.frame_fault = false;
        control.result_verified = false;
        control.result_error = b3(VERIFY_ERROR_NONE);
        control.load_beat = b6(0);
        control.mask_ready = b16(0);
        control.mask_inflight = b16(0);
        control.mask_done = b16(0);
        control.segment_ready = [b8(0); SEGMENT_GROUPS];
        control.segment_inflight = [b8(0); SEGMENT_GROUPS];
        control.segment_stage = [b5(18); ENGINE_SEGMENTS];
        control.endpoint_done = [b8(0); SEGMENT_GROUPS];
        control.segment_group_cursor = b4(0);
        control.public_key_block = b6(0);
        control.public_key_inflight = false;
        control.public_key_state_ready = false;
        control.total_issued = b11(0);
        control.total_retired = b11(0);
        control.response_due = b64(0);
        control.expected_tasks = b11(0);
        control.prefetch_pending = false;
        control.request_valid = false;
        control.context = input.context;
        control.generation = input.generation;
        next_job_id = input.stream.job_id;
        next_public_key_state = zero_words;
    }

    if stream_accepted {
        let expected_last = beat_index == b6(34);
        let identity_matches = frame_start
            || (input.stream.job_id == q.job_id
                && input.context == q.control.context
                && input.generation == q.control.generation);
        let beat_fault = input.stream.keep != b64(VERIFY_FULL_KEEP_BITS)
            || input.stream.last != expected_last
            || !identity_matches;
        control.frame_fault = control.frame_fault || beat_fault;

        if beat_index < b6(33) {
            state_even_write = SyncBramWrite::<HashWords, STATE_BANK_ADDRESS_BITS> {
                addr: beat_index,
                value: first_words,
                enable: true,
            };
            state_odd_write = SyncBramWrite::<HashWords, STATE_BANK_ADDRESS_BITS> {
                addr: beat_index,
                value: second_words,
                enable: true,
            };
        } else if beat_index == b6(33) {
            state_even_write = SyncBramWrite::<HashWords, STATE_BANK_ADDRESS_BITS> {
                addr: b6(33),
                value: first_words,
                enable: true,
            };
            next_public_seed = halves.second;
        } else {
            next_expected_hash = halves.first;
            let digits = message_digits_kernel(halves.second);
            control.loading = false;
            if control.frame_fault {
                control.result_valid = true;
                control.result_verified = false;
                control.result_error = b3(VERIFY_ERROR_FRAME);
                done = true;
            } else {
                control.active = true;
                control.mask_ready = b16(0xffff);
                control.public_key_state_ready = true;
                control.expected_tasks = verification_sha_task_count_kernel(digits);
                for segment in 0..ENGINE_SEGMENTS {
                    let segment_index = b7(segment as u128);
                    let digit = digits[segment];
                    if digit == b4(15) {
                        control.endpoint_done =
                            set_segment_bit_kernel(control.endpoint_done, segment_index, true);
                        control.segment_stage[segment] = b5(18);
                    } else {
                        let digit_wide: b5 = digit.resize();
                        control.segment_stage[segment] = digit_wide + b5(3);
                    }
                }
            }
        }
        if beat_index < b6(34) {
            control.load_beat = beat_index + b6(1);
        }
    }

    let response_fields = decode_tag_kernel(input.response.tag);
    let response_common = !resetting
        && !transport_abort_live
        && q.control.active
        && input.response.valid
        && verification_tag_is_well_formed_kernel(input.response.tag)
        && response_fields.context == q.control.context
        && response_fields.generation == q.control.generation;
    let bounded_segment = if response_fields.segment < b7(67) {
        response_fields.segment
    } else {
        b7(0)
    };
    let bounded_mask = if response_fields.segment < b7(16) {
        response_fields.segment
    } else {
        b7(0)
    };
    let mask_bit = b16(1) << bounded_mask;
    let mask_response = response_common
        && response_fields.kind == b3(2)
        && q.control.mask_inflight & mask_bit != b16(0);
    let expected_chain = verification_chain_fields_kernel(
        q.control.segment_stage[bounded_segment],
        bounded_segment,
        q.control.context,
        q.control.generation,
    );
    let chain_response = response_common
        && response_fields.kind == b3(6)
        && segment_bit_kernel(q.control.segment_inflight, bounded_segment)
        && input.response.tag == encode_tag_kernel(expected_chain);
    let public_key_response = response_common
        && response_fields.kind == b3(7)
        && q.control.public_key_inflight
        && response_fields.block_index == q.control.public_key_block;
    let response_due_now = q.control.response_due & b64(1) != b64(0);
    let operation_live = q.control.loading
        || q.control.active
        || frame_start
        || (q.control.result_valid && !q.control.fault);
    let response_payload_accepted = mask_response || chain_response || public_key_response;
    let response_accepted = response_due_now && response_payload_accepted;
    let response_timing_matches = (q.control.active && response_due_now) == input.response.valid;
    let local_terminal_transport = !resetting
        && !transport_abort_live
        && operation_live
        && (!response_timing_matches || (input.response.valid && !response_accepted));
    let terminal_transport = transport_abort_live || local_terminal_transport;
    let response_rejected = local_terminal_transport && input.response.valid;
    let mut response_cycle_excluded = [b8(0); SEGMENT_GROUPS];
    let mut public_key_response_guard = false;

    if q.control.active {
        control.response_due = q.control.response_due >> 1;
    }

    let request_accepted = !terminal_transport
        && !resetting
        && q.control.active
        && q.control.request_valid
        && input.request_ready;
    if request_accepted {
        let issued_fields = decode_tag_kernel(q.request.tag);
        control.request_valid = false;
        control.total_issued = q.control.total_issued + b11(1);
        control.response_due = control.response_due | b64(VERIFY_DUE_INSERT_BITS);
        if issued_fields.kind == b3(2) {
            let bit = b16(1) << issued_fields.segment;
            control.mask_ready = q.control.mask_ready & !bit;
            control.mask_inflight = q.control.mask_inflight | bit;
        } else if issued_fields.kind == b3(6) {
            control.segment_ready =
                set_segment_bit_kernel(q.control.segment_ready, issued_fields.segment, false);
            control.segment_inflight =
                set_segment_bit_kernel(q.control.segment_inflight, issued_fields.segment, true);
        } else if issued_fields.kind == b3(7) {
            control.public_key_inflight = true;
            control.public_key_state_ready = false;
        } else {
            control.fault = true;
        }
    }
    if response_accepted {
        control.total_retired = q.control.total_retired + b11(1);
    }

    if mask_response {
        control.mask_inflight = control.mask_inflight & !mask_bit;
        control.mask_done = control.mask_done | mask_bit;
        mask_write = SyncBramWrite::<HashWords, MASK_ADDRESS_BITS> {
            addr: response_fields.segment.resize(),
            value: input.response.digest,
            enable: true,
        };
        let ready_before = control.segment_ready;
        control.segment_ready = wake_segments_for_mask_kernel(
            control.segment_stage,
            control.segment_ready,
            control.segment_inflight,
            response_fields.segment.resize(),
        );
        response_cycle_excluded = union_segment_groups_kernel(
            response_cycle_excluded,
            exclude_segment_groups_kernel(control.segment_ready, ready_before),
        );
    }

    if chain_response {
        let segment = response_fields.segment;
        let pair_addr: b6 = (segment >> 1).resize();
        control.segment_inflight = set_segment_bit_kernel(control.segment_inflight, segment, false);
        response_cycle_excluded = union_segment_groups_kernel(
            response_cycle_excluded,
            state_pair_exclusion_kernel(segment),
        );
        if segment & b7(1) == b7(0) {
            state_even_write = SyncBramWrite::<HashWords, STATE_BANK_ADDRESS_BITS> {
                addr: pair_addr,
                value: input.response.digest,
                enable: true,
            };
        } else {
            state_odd_write = SyncBramWrite::<HashWords, STATE_BANK_ADDRESS_BITS> {
                addr: pair_addr,
                value: input.response.digest,
                enable: true,
            };
        }

        let current_stage = q.control.segment_stage[segment];
        if current_stage < b5(17) {
            let next_stage = current_stage + b5(1);
            control.segment_stage[segment] = next_stage;
            let required = segment_required_mask_kernel(next_stage);
            if control.mask_done & (b16(1) << required) != b16(0) {
                control.segment_ready =
                    set_segment_bit_kernel(control.segment_ready, segment, true);
                response_cycle_excluded =
                    set_segment_bit_kernel(response_cycle_excluded, segment, true);
            }
        } else {
            control.segment_stage[segment] = b5(18);
            control.endpoint_done = set_segment_bit_kernel(control.endpoint_done, segment, true);
            public_key_response_guard = true;
        }
    }

    if public_key_response {
        next_public_key_state = input.response.digest;
        control.public_key_inflight = false;
        control.public_key_state_ready = true;
        if q.control.public_key_block == b6(33) {
            let endpoints_complete = q.control.endpoint_done[0] == b8(0xff)
                && q.control.endpoint_done[1] == b8(0xff)
                && q.control.endpoint_done[2] == b8(0xff)
                && q.control.endpoint_done[3] == b8(0xff)
                && q.control.endpoint_done[4] == b8(0xff)
                && q.control.endpoint_done[5] == b8(0xff)
                && q.control.endpoint_done[6] == b8(0xff)
                && q.control.endpoint_done[7] == b8(0xff)
                && q.control.endpoint_done[8] == b8(0x07);
            let exact_final = q.control.total_issued == q.control.expected_tasks
                && q.control.total_retired + b11(1) == q.control.expected_tasks
                && q.control.mask_done == b16(0xffff)
                && endpoints_complete;
            control.active = false;
            control.result_valid = true;
            control.prefetch_pending = false;
            control.request_valid = false;
            control.result_verified = false;
            if !exact_final {
                control.result_error = b3(VERIFY_ERROR_AUDIT);
                control.fault = true;
            } else if control.fault {
                control.result_error = b3(VERIFY_ERROR_TRANSPORT);
            } else {
                control.result_error = b3(VERIFY_ERROR_NONE);
                control.result_verified = verify_hash_equal_kernel(
                    hash_words_to_bytes_kernel(input.response.digest),
                    q.expected_hash,
                );
            }
            done = true;
        } else {
            control.public_key_block = q.control.public_key_block + b6(1);
        }
    }

    if !resetting && control.active && q.control.prefetch_pending && !q.control.request_valid {
        next_request = prepare_verify_request_kernel(VerifyPrepareRequestInput {
            fields: decode_tag_kernel(q.control.prefetch_tag),
            public_seed: q.public_seed,
            public_key_state: q.public_key_state,
            state_even: q.state_even,
            state_odd: q.state_odd,
            mask: q.masks,
        });
        control.prefetch_pending = false;
        control.request_valid = true;
    }

    let request_slot_free = !control.request_valid && !control.prefetch_pending;
    let visible_ready =
        exclude_segment_groups_kernel(control.segment_ready, response_cycle_excluded);
    let segment_selection =
        select_ready_segment_kernel(visible_ready, control.segment_group_cursor);
    let focus_selection = select_public_key_focus_segment_kernel(
        visible_ready,
        control.public_key_block,
        control.public_key_inflight,
    );
    let public_key_ready = !public_key_response_guard
        && !control.public_key_inflight
        && control.public_key_state_ready
        && public_key_endpoints_ready_kernel(control.endpoint_done, control.public_key_block);
    let mut selected_valid = false;
    let mut selected_fields = TagFields {
        context: control.context,
        generation: control.generation,
        ..TagFields::default()
    };

    if control.active && request_slot_free {
        if public_key_ready {
            selected_valid = true;
            selected_fields.kind = b3(7);
            selected_fields.block_index = control.public_key_block;
        } else if control.mask_ready != b16(0) {
            selected_valid = true;
            selected_fields.kind = b3(2);
            if control.mask_ready & b16(0x0001) != b16(0) {
                selected_fields.segment = b7(0);
            } else if control.mask_ready & b16(0x0002) != b16(0) {
                selected_fields.segment = b7(1);
            } else if control.mask_ready & b16(0x0004) != b16(0) {
                selected_fields.segment = b7(2);
            } else if control.mask_ready & b16(0x0008) != b16(0) {
                selected_fields.segment = b7(3);
            } else if control.mask_ready & b16(0x0010) != b16(0) {
                selected_fields.segment = b7(4);
            } else if control.mask_ready & b16(0x0020) != b16(0) {
                selected_fields.segment = b7(5);
            } else if control.mask_ready & b16(0x0040) != b16(0) {
                selected_fields.segment = b7(6);
            } else if control.mask_ready & b16(0x0080) != b16(0) {
                selected_fields.segment = b7(7);
            } else if control.mask_ready & b16(0x0100) != b16(0) {
                selected_fields.segment = b7(8);
            } else if control.mask_ready & b16(0x0200) != b16(0) {
                selected_fields.segment = b7(9);
            } else if control.mask_ready & b16(0x0400) != b16(0) {
                selected_fields.segment = b7(10);
            } else if control.mask_ready & b16(0x0800) != b16(0) {
                selected_fields.segment = b7(11);
            } else if control.mask_ready & b16(0x1000) != b16(0) {
                selected_fields.segment = b7(12);
            } else if control.mask_ready & b16(0x2000) != b16(0) {
                selected_fields.segment = b7(13);
            } else if control.mask_ready & b16(0x4000) != b16(0) {
                selected_fields.segment = b7(14);
            } else {
                selected_fields.segment = b7(15);
            }
        } else if focus_selection.valid {
            selected_valid = true;
            selected_fields = verification_chain_fields_kernel(
                control.segment_stage[focus_selection.segment],
                focus_selection.segment,
                control.context,
                control.generation,
            );
        } else if segment_selection.valid {
            selected_valid = true;
            selected_fields = verification_chain_fields_kernel(
                control.segment_stage[segment_selection.segment],
                segment_selection.segment,
                control.context,
                control.generation,
            );
            control.segment_group_cursor = segment_selection.next_group;
        }
    }

    if selected_valid {
        control.prefetch_pending = true;
        control.prefetch_tag = encode_tag_kernel(selected_fields);
        if selected_fields.kind == b3(6) {
            state_read_addr = (selected_fields.segment >> 1).resize();
            mask_read_addr = selected_fields.chain_step;
        } else if selected_fields.kind == b3(7) {
            state_read_addr = selected_fields.block_index;
        }
    }

    if terminal_transport {
        control.loading = false;
        control.active = false;
        control.result_valid = true;
        control.fault = true;
        control.result_verified = false;
        control.result_error = b3(VERIFY_ERROR_TRANSPORT);
        control.prefetch_pending = false;
        control.request_valid = false;
        control.response_due = b64(0);
        next_request.valid = false;
        state_even_write.enable = false;
        state_odd_write.enable = false;
        mask_write.enable = false;
        done = true;
    }

    if resetting {
        state_even_write.enable = false;
        state_odd_write.enable = false;
        mask_write.enable = false;
    }

    let mut transport_request = q.request;
    transport_request.valid = !resetting && q.control.request_valid;
    let mut request = transport_request;
    request.valid = transport_request.valid && !terminal_transport;
    let result_transfer = result_transfer_requested && !terminal_transport;
    let output = VerifyContextOutput {
        stream_ready,
        loading: !resetting && q.control.loading,
        active: !resetting && q.control.active,
        request,
        transport_request,
        response_ready: response_accepted,
        response_rejected,
        fault: !resetting && (q.control.fault || terminal_transport),
        fault_latched: !resetting && q.control.fault,
        done,
        result_valid: !resetting && q.control.result_valid,
        result_transfer,
        result_job_id: q.job_id,
        verified: !terminal_transport
            && !resetting
            && q.control.result_valid
            && q.control.result_error == b3(VERIFY_ERROR_NONE)
            && q.control.result_verified,
        error: if terminal_transport {
            b3(VERIFY_ERROR_TRANSPORT)
        } else {
            q.control.result_error
        },
        expected_tasks: q.control.expected_tasks,
        total_issued: q.control.total_issued,
        total_retired: q.control.total_retired,
    };

    let d = D {
        control,
        request: next_request,
        public_seed: next_public_seed,
        expected_hash: next_expected_hash,
        public_key_state: next_public_key_state,
        job_id: next_job_id,
        state_even: SyncBramIn::<HashWords, STATE_BANK_ADDRESS_BITS> {
            read_addr: state_read_addr,
            write: state_even_write,
        },
        state_odd: SyncBramIn::<HashWords, STATE_BANK_ADDRESS_BITS> {
            read_addr: state_read_addr,
            write: state_odd_write,
        },
        masks: SyncBramIn::<HashWords, MASK_ADDRESS_BITS> {
            read_addr: mask_read_addr,
            write: mask_write,
        },
    };
    (output, d)
}