Privacy-sanitized source narrative
Replicated three-lane SHA-256 arithmetic
This page publishes the producing narrative as escaped plaintext. It preserves repository provenance while withholding machine-local paths and private build-host labels.
Sanitization disclosure
This is a public projection, not a byte-identical copy when substitutions are listed. The pre-sanitization digest identifies the narrative bytes read from the documentation checkout; the cryptographic subject commit is recorded separately.
- 2 temporary-directory path occurrence(s) replaced with
[local-temporary-path]. - 1 process-specific pseudo-filesystem path occurrence(s) replaced with
[local-process-path].
Provenance
The digest identifies the narrative bytes read by this documentation build before substitutions. It does not assert that those narrative bytes existed at the cryptographic subject/source commit.
Producing narrative
# Replicated SHA-256 farm arithmetic — 2026-07-15
## Evidence tier and boundary
Generated-Verilog deterministic simulation. The complete lane and exact
three-lane replicated farm matched the independent Rust `compress_block` oracle
for the finite vectors exercised by the self-checking testbenches. The checks
cover SHA-256 compression and feed-forward from non-IV chaining states, opaque
32-bit tags, adjacent accepted tokens, bubbles, exact 64-cycle latency, reset
flushing, post-reset recovery, and asymmetric activity across all three farm
lanes.
This is lowering-equivalence evidence for the checked vectors, not a formal
proof. It is not synthesis, LUT/register/BRAM/DSP utilization, timing,
placement, routing, signature throughput, side-channel, or U280 execution
evidence. The SystemVerilog files listed below are self-checking testbenches;
the SHA datapaths under test are generated from Rust/RHDL.
## Change under test
`ThreeLaneCompressionFarm` now uses
`ReplicatedCompressionFarm<3, 64, 6>`. Its one
`ReplicatedSynchronous<CompressionLane<64, 6>, 3>` prototype lowers to one lane
module definition instantiated as `c0`, `c1`, and `c2`. Behavioral RHDL
simulation still owns independent state for every instance. The ordinary-array
`CompressionFarm` remains available as a direct behavioral oracle.
The generated farm contains:
- one `sha256_compression_farm_3x64_lanes_prototype` definition;
- three direct prototype instances, `c0`, `c1`, and `c2`;
- one textual `reg [255:0] mem[63:0]` declaration inside that shared module
definition; and
- 201 Verilog module definitions in total.
One textual definition does not mean one hardware lane or one physical memory.
Synthesis must still elaborate the three instances independently. No mapped
resource conclusion follows from generated-source deduplication.
## Reproduction
```console
cargo build -j1 -p rhdl-gen
target/debug/rhdl-gen check --full --keep \
--temp-root [local-temporary-path]
```
The command exited with status 0 after 938.749 seconds. Its preserved workspace
is `[local-temporary-path]`.
That path is not a durable artifact store; the checksums below identify the
exact files.
The CLI used its existing serialized Verilator configuration: `--threads 1`
for lint and `--threads 1 -j 1` for arithmetic-testbench construction. A
separate one-second `[local-process-path]` monitor observed the generator
process throughout the run:
- observed `VmHWM`: 9,935,992 KiB;
- observed `VmPeak`: 11,560,244 KiB; and
- shell-measured CPU time: 872.761 seconds user plus 55.391 seconds system.
`VmHWM` is the kernel-maintained process high-water field sampled while the
process remained alive. These memory figures cover the `rhdl-gen` process, not
an aggregate of its Verilator, compiler, or simulator children. They describe
this host run only and are not FPGA resource measurements.
## Provenance
- Source commit: `beb9ada48fc01e089ec4fbaa05d2fdeab338de47`
- Source dirty: `false`
- Profile: `HASHSIGS_SHA256_GENERIC_V1`
- RHDL revision: `c99d5cc53269a247bbc675d0fbd766991d409f56`
- HashSigsRS revision: `2d315dd4168804b7cbc51c51a1bf7ca27bf74140`
- Verilator: `5.048 2026-04-26 rev v5.048`
- Full-check wall time: 938.749 seconds
- Build and lint concurrency: one thread
## Artifacts
| Artifact | Size / lines | SHA-256 |
|---|---:|---|
| Lane RTL | 1,001,581 bytes / 28,223 | `615a4e89519a5aadec2bc17a6b59833fd4bf51dc123f44d378e6f0fb7866610d` |
| Replicated farm RTL | 1,013,742 bytes / 28,254 | `0b4aef07029d4ae3a9e3cfa271c8ebe899a2128dc3c95794977c5dce4c2160d9` |
| Lane manifest | — | `4d41ae2fa26fef7f2856fc950945144d36d86385cfc6e1f4e377d40fe81ab339` |
| Replicated farm manifest | — | `1ad9354cc2e052754f850f622c3088d23baa0d5430efdc7d4d740c90db13d0c2` |
| Lane testbench | — | `30be37c66989b9504ddbd9ae97c29af02855d32f9e0db9a1ac901918f6cf11a3` |
| Farm testbench | — | `3427b998131cebc54766641d00ac43668d8451e2122d3833704ead264f304c70` |
| Lane lint log | — | `4d73a6455d532e4ede90bfbcf95c7f9fafbe130b61101ff8ef0482d44f3b0b4f` |
| Farm lint log | — | `9c840cbb55e78b0846685023bec4a8a5426c85e15929635642d47234ad312138` |
| Lane build log | — | `3f30ab2b962e71011f0c27dfaf5efcd39055562248fddd98b9338e20c0311c28` |
| Farm build log | — | `b195bf105483a6be4ac830758130ba49871f91a0d5f1d24e82bdd9ad843cf048` |
| Lane simulation log | — | `76707409660e4b900915669aa5250b1a8b3c6a0530cbf84f50f8a400262e1e79` |
| Farm simulation log | — | `6df649738af9f23515c0c73fcce9477b387e7720223939012c4db1a384b209e1` |
Both manifests record the source as clean and repeat the corresponding RTL
checksum.
## Results
### Default parser gate
Icarus syntax/elaboration passed for `legacy-keccak-round`,
`legacy-keccak-iterative`, `sha256-round`, and `sha256-pipeline-2`. This is a
parser/elaboration result only for those default targets.
### Complete lane
- Verilator lint command:
`verilator --lint-only -Wall -Wno-fatal --threads 1 --top-module sha256_compression_lane ...`
- Lint/elaboration: passed in 5.228 seconds.
- Accepted warning inventory: 2,193 total — 2,191 `UNUSEDSIGNAL`, one
`DECLFILENAME`, and one `UNOPTFLAT`.
- Arithmetic build command:
`verilator --binary --timing -Wno-fatal -Wno-DECLFILENAME -Wno-UNUSEDSIGNAL --threads 1 -j 1 --top-module sha256_lane_arithmetic_tb ...`
- Testbench build: passed in 55.903 seconds.
- Simulation: passed in 0.081 seconds.
- Marker:
`SHA256_LANE_RTL_EQUIVALENCE_PASS vectors=3 latency=64 reset_flush=1`.
### Exact replicated three-lane farm
- Verilator lint command:
`verilator --lint-only -Wall -Wno-fatal --threads 1 --top-module sha256_compression_farm_3x64 ...`
- Lint/elaboration: passed in 12.789 seconds.
- Accepted warning inventory: 2,194 total — 2,192 `UNUSEDSIGNAL`, one
`DECLFILENAME`, and one `UNOPTFLAT`.
- Arithmetic build command:
`verilator --binary --timing -Wno-fatal -Wno-DECLFILENAME -Wno-UNUSEDSIGNAL --threads 1 -j 1 --top-module sha256_farm_arithmetic_tb ...`
- Testbench build: passed in 167.870 seconds.
- Simulation: passed in 0.407 seconds.
- Marker:
`SHA256_FARM_RTL_EQUIVALENCE_PASS lanes=3 vectors=5 latency=64 reset_flush=1`.
The farm's five expected outputs exercise unrelated inputs and bubbles across
all three lanes, adjacent-cycle transport, non-IV feed-forward, full-width
opaque tags, and post-reset recovery. Three additional in-flight farm inputs
are deliberately invalidated by reset. The expected digests come from the
allocation-free Rust compression model, not from generated RTL.
The `-Wno-fatal` lint runs are accepted elaboration with a recorded warning
inventory; they are not warning-clean claims. The remaining `UNOPTFLAT` report
names RHDL's packed `od` feedback envelope around the sequential child
hierarchy. Passing arithmetic simulation does not dispose of that warning.
Vivado synthesis and combinational-loop DRC remain mandatory before hardware
claims.
## Generated-source comparison
The earlier ordinary-array farm at source commit `9833e13` emitted 3,025,187
bytes, 84,700 lines, 599 module definitions, and 6,578 accepted lint warnings.
The replicated farm emits 1,013,742 bytes, 28,254 lines, 201 module definitions,
and 2,194 accepted lint warnings. This is a 66.49% byte reduction and 66.64%
line reduction in generated source. The unchanged lane RTL checksum and
unchanged testbench checksums make the hierarchy change visible without
changing the checked arithmetic stimuli.
This comparison is generator/source-size evidence across two commits, not a
mapped-area comparison. Only synthesis can show whether a downstream tool
elaborates the shared definition as the intended three independent hardware
instances and what resources those instances consume.
## Next gate
Integrate the fine-grained WOTS context engine and bounded result framer, then
prove the complete signer in RHDL and generated RTL at no more than 500
normalized cycles per unique fused private-seed result. U280 synthesis and
implementation remain separate higher evidence tiers.