Crate wots_rhdl 

Profile-specific HashSigsRS WOTS+ schedulers and synthesizable RHDL tops.

This crate is the hardware protocol layer of the workspace. It turns one already-hashed 32-byte message and one one-time private seed into a canonical fused signature/public-key stream, and it provides a separate public-data verifier for the SHA-256 profile. Hash primitives live in keccak-rhdl and sha256-rhdl; profile-safe host values and the independent software oracle live in hashsigs-types and hashsigs-reference.

Start with the security boundary

HashSigsRS uses n = 32, w = 16, and 67 hash chains. Its inputs and encodings have several non-negotiable properties:

• Every private seed and derived private key is one-time. Reusing either value to sign another message can expose enough chain positions to permit a forgery. The RHDL interfaces consume bytes, but they cannot know whether a caller has submitted those bytes before. Durable one-time-use enforcement is a system responsibility.
• The message input is already a 32-byte digest. The caller owns application prehashing, collision resistance, and domain separation.
• Serialized keys, signatures, and 512-bit frames contain no profile tag. A protocol must authenticate the selected build profile out of band.
• The custom shared-mask/address construction is not XMSS, SLH-DSA, FIPS 205, or a many-time signature system. This crate does not claim the proof of a standardized parameter set or an independent cryptographic audit.
• Resetless secret/data registers are meaningful only while separately reset ownership bits say so. Architectural overwrite is not physical zeroization, remanence resistance, or side-channel evidence.

Profiles and implemented operations

Profiles are different Rust types and different hardware build targets; there is no runtime hash-profile mux.

Profile	Compatibility	RHDL signing	RHDL verification
LEGACY_KECCAK	Byte-compatible with pinned HashSigsRS; legacy Keccak-256 0x01 padding, not SHA3-256	legacy::LegacyFusedPrivateSeedEngine and legacy::LegacyFusedPrivateKeyEngine	Not implemented; use the software oracle for legacy verification
HASHSIGS_SHA256_GENERIC_V1	Deliberately incompatible with legacy keys and signatures	top::Sha256SignerTop	verify::top::Sha256VerifierTop

The private-key legacy ingress exists for pinned upstream vectors. The production SHA signer accepts a private seed. The SHA verifier consumes only public material. No legacy Keccak verifier top exists in this crate.

All cryptographic datapaths are authored in Rust/RHDL. The modular signer and verifier aliases use a typed unresolved compression-lane leaf so the exact separately generated RHDL lane can be linked by an external HDL tool; they are not invitations to replace the lane with handwritten cryptographic RTL. Tcl, XDC, testbenches, and a future board shell remain outside this crate’s cryptographic implementation boundary.

Signing work and selected topology

Fused private-seed signing always advances every chain through all fifteen transitions. A signature segment is captured when the chain reaches the message/checksum digit, while the final value becomes a public-key endpoint:

private seed -> private key
                      +-> public seed -> 16 masks
                      +-> 67 secret PRFs
                            -> 67 secret hashes
                            -> 67 x 15 chain hashes
                                 +-> capture 67 signature segments
                                 +-> hash 67 endpoints into the public key

Under HASHSIGS_SHA256_GENERIC_V1, this graph contains exactly 1,258 SHA-256 compression tasks. engine::SingleContextWorkEngine represents one dependency-tracked job. Four contexts share one exact-latency compression lane inside cluster::LaneLocalCluster, and the production top replicates that complete cluster three times:

top::Sha256SignerTop
  +-- cluster 0: 4 contexts + 1 SHA-256 lane
  +-- cluster 1: 4 contexts + 1 SHA-256 lane
  +-- cluster 2: 4 contexts + 1 SHA-256 lane
  +-- registered, frame-locked 3-to-1 data merge
  +-- independent registered error merge

The twelve contexts overlap independent dependency graphs; each context can issue at most once every two cycles because request construction includes a synchronous-memory prefetch. Complete tags carry local context, task class, task coordinates, and generation through the lane. Job IDs remain outside cryptographic state.

sequencer::SingleContextSequencer and fabric::ShaTransportFabric are retained foundations from an earlier serial/central nine-context architecture. They are useful focused control oracles, but neither is instantiated by the selected three-cluster production signer.

Signer interface and output frame

top::SignerTopInput and top::SignerTopOutput are the production SHA signer contract:

Signal group	Contract
start_valid, start_ready, private_seed, message, job_id	Accept one new one-time job when valid and ready are both true
output_valid, output_ready, output	Transfer one registered 512-bit result beat when valid and ready are both true
error_valid, error_ready, error	Transfer one independent identified error completion
fault	Sticky structural/transport failure; shared reset is required before accepting more trusted work

Once admitted, a job owns a context until either its final successful beat is captured or its identified error is released. Output backpressure is a correctness contract: a stalled beat and its metadata remain stable. Frames never interleave. The successful stream is 2,208 bytes in 35 beats:

Beat	Low 32 bytes	High 32 bytes	keep / last
0 through 32	Signature segment 2b	Signature segment 2b + 1	All bytes valid; not last
33	Signature segment 66	Public seed	All bytes valid; not last
34	Public-key endpoint hash	Zero padding	Low half valid; last

framing::pack_fused_output and framing::unpack_fused_output are the independent host framing oracles. cluster::LaneLocalResultFramer reserves output capacity before exposing a result and releases local context credit only after ownership has moved safely to the next registered stage.

Shared reset flushes all valid, allocation, request, result, and ownership state and suppresses transfers on the reset edge. Resetless wide data is ignored while its resettable valid bit is clear. A signer transport fault invalidates immediately preceding and outstanding work until shared reset; consumers must not treat a coincident data/error payload as trusted merely because its bytes are present.

SHA-256 verification

Verification receives signature, public_seed, public_key_hash, and the 32-byte message digest as one exact 2,240-byte frame. It advances each signature segment only from its message digit to chain position fifteen, hashes all endpoints, and compares all 256 bits of the resulting public-key hash.

Let S be the sum of 15 - digit across the 64 message digits and let h(S) be the sum of the three hexadecimal checksum digits. Real verifier chain work is S + 45 - h(S), ranging from 45 to 990 hashes. Including 16 masks and 34 endpoint-stream blocks, a SHA verifier job emits between 95 and 1,040 compression tasks. Bypassed positions are idle state preservation, not hidden hash work.

The selected verifier mirrors the signer hierarchy: four verify::sha::VerifySingleContextSha contexts share one lane inside verify::cluster::VerifierCluster, and verify::top::Sha256VerifierTop replicates three clusters. The ingress frame contains exactly 35 full-valid beats:

Beats	Bytes
0 through 32	Signature segments 0 through 65
33	Signature segment 66 followed by the public seed
34	Public-key endpoint hash followed by the message digest

verify::top::VerifierTopInput uses a ready/valid stream and an independent result_ready. verify::top::VerifierTopOutput returns one registered verify::cluster::VerifyResult containing the opaque job ID, a verified decision, and an error code. Nonzero framing, transport, or audit errors always force verified false.

Verifier transport is fail closed. A 64-entry expected-tag delay line checks the lane’s exact 64-cycle return contract. Missing, extra, mistimed, swapped, malformed, unowned, or rejected tokens poison the owning cluster. The top registers that fault, aborts peers without a combinational sibling loop, and drains every already-accepted identity as a nonzero error. New admission and lane launch remain blocked until shared reset.

Evidence vocabulary and current status

Evidence from one level never implies the next:

Tier	What it establishes	What it does not establish
1. Rust/RHDL source simulation	Source behavior and modeled cycle contracts	Generated RTL, mapping, timing, route, or hardware
2. Generated-Verilog simulation	Lowering equivalence for exercised traces	Formal equivalence, synthesis, timing, route, or card behavior
3. U280 synthesis	Mapping and utilization estimates	Routed timing or hardware throughput
4. U280 placement and routing	Routed utilization and achieved timing for the constrained design	Card/runtime behavior
5. Reserved-card execution	Measured behavior for the loaded artifact and workload	Other commits, constraints, or workloads

Current production-signer evidence reaches tier 2. A sustained generated-Verilog trace measured one 23,121-cycle aggregate interval spanning 48 results, or 481.6875 cycles/result. Normalizing that simulated aggregate interval at 250 MHz gives 519,008.693 signatures/second. This is arithmetic normalization, not evidence that the RTL synthesizes, fits, routes, meets 250 or 300 MHz, or executes at that rate on a U280. The exact trace assumes an always-ready output; arbitrary stalls remain a correctness property, not a throughput guarantee.

The production SHA verifier reaches tier 1. Its complete three-cluster source simulation admits twelve worst-case jobs, accepts and routes exactly 12,480 SHA tasks, checks all results under stalls, and reaches quiescence. Its modular descriptor also has a bounded unresolved-skeleton check. It does not yet have linked generated-Verilog simulation, synthesis, timing, route, or card evidence.

Legacy engines match the pinned upstream vectors in source/RHDL tests. That compatibility result does not establish synthesis, physical zeroization, side-channel behavior, timing, or card execution. No U280 utilization, timing-closure, routed, or hardware-throughput claim is made by this crate.

Newcomer reading order

Follow the active path from protocol bytes to composed hardware:

1. crate::framing and crate::verify::framing define the exact output and verification-input bytes before control logic is introduced.
2. crate::digits explains message/checksum digits; crate::blocks defines every fixed SHA-256 preimage and byte-order boundary; and crate::tag defines the sole 32-bit lane-tag encoding.
3. crate::engine is one active SHA signer context. Read its dependency, reset, request-prefetch, response-validation, and secret-ownership contracts before changing scheduling.
4. crate::cluster composes four contexts, one compression lane, and the local result framer. crate::top composes exactly three such clusters and owns only narrow global admission/data/error merges.
5. For verification, read crate::verify and then its framing, tasks, sha, transport, cluster, and top modules in that order.
6. For byte-compatible signing, read crate::legacy after keccak-rhdl. It is a separate serial engine, not a SHA signer mode.
7. Read crate::tasks, crate::sequencer, and crate::fabric when auditing the serial task oracle or historical central-fabric experiments; do not infer the production topology from them.

Source, test, and evidence map

Concern	Source	Focused tests / evidence
Profile-safe bytes and software semantics	hashsigs-types, hashsigs-reference	Upstream compatibility vectors and randomized differential tests
Legacy signer	crate::legacy	tests/legacy.rs
SHA block/digit/tag semantics	crate::blocks, crate::digits, crate::tag	tests/tag_and_blocks.rs, tests/digits.rs
One SHA signer context	crate::engine	tests/engine.rs
Active signer cluster and top	crate::cluster, crate::top	tests/cluster.rs, tests/top.rs, tests/top_full.rs
SHA verifier	crate::verify	tests/verify_framing.rs through tests/verify_top_full.rs
Generated RTL and immutable manifests	rhdl-gen	crates/rhdl-gen/tests/cli.rs and date-stamped files under evidence/rtl
U280 boundary	fpga/u280	Staged source manifest plus Vivado reports; none may be inferred from simulation

Contributor workflow

Start at the smallest owning layer and preserve its public contracts:

1. Add or update an independent host oracle before changing a cryptographic kernel, framing rule, task count, or tag encoding.
2. Run the focused leaf test, then its context, cluster, and top tests. A change is not integrated merely because its final digest matches; exact task cardinality, identity, latency, reset flushing, fault behavior, and backpressure also matter.
3. Keep LEGACY_KECCAK and HASHSIGS_SHA256_GENERIC_V1 as distinct types and build targets. Never introduce a runtime profile mux or silently reinterpret serialized bytes.
4. Generate Verilog through rhdl-gen; do not patch generated cryptographic RTL. Any unresolved modular skeleton must be linked with the exact separately generated RHDL lane before an external parse or simulation.
5. Record negative results and promote claims only with matching source/RTL provenance. A logical storage count is not mapped area, an output interval is not clock closure, and synthesis is not a routed or card result.

On memory-constrained hosts, use one Cargo job and one test thread. Expensive ignored gates document their own memory limits and evidence boundaries; they should never be folded into an ordinary quick test run.

Re-exports

pub use benchmark::AXI_RESP_OKAY;

pub use benchmark::AXI_RESP_SLVERR;

pub use benchmark::AxiLiteBenchmarkConfig;

pub use benchmark::AxiLiteBenchmarkControl;

pub use benchmark::AxiLiteBenchmarkInput;

pub use benchmark::AxiLiteBenchmarkKernel;

pub use benchmark::AxiLiteBenchmarkOutput;

pub use benchmark::BENCHMARK_ABI_VERSION;

pub use benchmark::BENCHMARK_AXI_ADDR_BITS;

pub use benchmark::BENCHMARK_AXI_RANGE_BYTES;

pub use benchmark::BENCHMARK_CHECKSUM_WORDS;

pub use benchmark::BENCHMARK_FAULT_ADMISSION;

pub use benchmark::BENCHMARK_FAULT_COUNTER;

pub use benchmark::BENCHMARK_FAULT_ERROR;

pub use benchmark::BENCHMARK_FAULT_FRAME;

pub use benchmark::BENCHMARK_FAULT_NONE;

pub use benchmark::BENCHMARK_FAULT_SIGNER;

pub use benchmark::BENCHMARK_LIVE_JOB_SLOTS;

pub use benchmark::BENCHMARK_NONCE_WORDS;

pub use benchmark::BENCHMARK_REJECT_INDEX_OVERFLOW;

pub use benchmark::BENCHMARK_REJECT_NONE;

pub use benchmark::BENCHMARK_REJECT_ZERO_BATCH;

pub use benchmark::BenchmarkChecksumInput;

pub use benchmark::BenchmarkCounterAuditInput;

pub use benchmark::BenchmarkCounterAuditOutput;

pub use benchmark::BenchmarkEngine;

pub use benchmark::BenchmarkEngineControl;

pub use benchmark::BenchmarkEngineData;

pub use benchmark::BenchmarkEngineInput;

pub use benchmark::BenchmarkEngineOutput;

pub use benchmark::BenchmarkFrameValidationInput;

pub use benchmark::BenchmarkJobMaterial;

pub use benchmark::BenchmarkLaunchValidationInput;

pub use benchmark::BenchmarkLaunchValidationOutput;

pub use benchmark::BenchmarkLiveJob;

pub use benchmark::BenchmarkReadDecodeInput;

pub use benchmark::BenchmarkReadDecodeOutput;

pub use benchmark::BenchmarkScoreboardAdmissionInput;

pub use benchmark::BenchmarkScoreboardAdmissionOutput;

pub use benchmark::BenchmarkScoreboardAuditInput;

pub use benchmark::BenchmarkScoreboardAuditOutput;

pub use benchmark::BenchmarkScoreboardLookupInput;

pub use benchmark::BenchmarkScoreboardLookupOutput;

pub use benchmark::ModularWotsSha256AxiLiteBenchmarkKernel;

pub use benchmark::ModularWotsSha256BenchmarkEngine;

pub use benchmark::REG_ABI_VERSION;

pub use benchmark::REG_ACCEPTED_LO;

pub use benchmark::REG_AP_CTRL;

pub use benchmark::REG_BASE_HI;

pub use benchmark::REG_BASE_LO;

pub use benchmark::REG_BATCH;

pub use benchmark::REG_BEATS_LO;

pub use benchmark::REG_CHECKSUM_0;

pub use benchmark::REG_CODES;

pub use benchmark::REG_COMPLETED_LO;

pub use benchmark::REG_COMPLETION_SPAN_LO;

pub use benchmark::REG_ELAPSED_LO;

pub use benchmark::REG_ERRORS_LO;

pub use benchmark::REG_FIRST_COMPLETION_LO;

pub use benchmark::REG_GIE;

pub use benchmark::REG_IER;

pub use benchmark::REG_ISR;

pub use benchmark::REG_LAST_COMPLETION_LO;

pub use benchmark::REG_NONCE_0;

pub use benchmark::REG_PAYLOAD_CYCLES_LO;

pub use benchmark::REG_RUN_BASE_HI;

pub use benchmark::REG_RUN_BASE_LO;

pub use benchmark::REG_STATUS;

pub use benchmark::WotsSha256AxiLiteBenchmarkKernel;

pub use benchmark::WotsSha256BenchmarkEngine;

pub use benchmark::axi_lite_benchmark_kernel;

pub use benchmark::benchmark_checksum_kernel;

pub use benchmark::benchmark_counter_audit_kernel;

pub use benchmark::benchmark_engine_kernel;

pub use benchmark::benchmark_frame_is_canonical_kernel;

pub use benchmark::benchmark_job_material_kernel;

pub use benchmark::benchmark_launch_validation_kernel;

pub use benchmark::benchmark_merge_write_kernel;

pub use benchmark::benchmark_read_decode_kernel;

pub use benchmark::benchmark_scoreboard_admission_kernel;

pub use benchmark::benchmark_scoreboard_audit_kernel;

pub use benchmark::benchmark_scoreboard_lookup_kernel;

pub use blocks::ChainBlockInput;

pub use blocks::EndpointPairInput;

pub use blocks::HashBytes;

pub use blocks::HashWords;

pub use blocks::PrfBlockInput;

pub use blocks::SecretDataInput;

pub use blocks::ShaBlock;

pub use blocks::chain_block_kernel;

pub use blocks::endpoint_final_block_kernel;

pub use blocks::endpoint_pair_block_kernel;

pub use blocks::hash_words_to_bytes_kernel;

pub use blocks::initial_state_words_kernel;

pub use blocks::prf_block_kernel;

pub use blocks::private_seed_block_kernel;

pub use blocks::secret_data_block_kernel;

pub use blocks::secret_padding_block_kernel;

pub use blocks::sha256_32_byte_block_kernel;

pub use cluster::AssembleLaneLocalBeatInput;

pub use cluster::CompressionLaneComponent;

pub use cluster::LANE_LOCAL_BEAT_BUFFER_DEPTH;

pub use cluster::LANE_LOCAL_CONTEXTS;

pub use cluster::LANE_LOCAL_OUTPUT_BEATS;

pub use cluster::LaneFramerContextInput;

pub use cluster::LaneIssueControlInput;

pub use cluster::LaneIssueControlOutput;

pub use cluster::LaneIssueInput;

pub use cluster::LaneIssueOutput;

pub use cluster::LaneLocalBeat;

pub use cluster::LaneLocalCluster;

pub use cluster::LaneLocalClusterControl;

pub use cluster::LaneLocalClusterInput;

pub use cluster::LaneLocalClusterOutput;

pub use cluster::LaneLocalFramerControl;

pub use cluster::LaneLocalResultFramer;

pub use cluster::LaneLocalResultFramerInput;

pub use cluster::LaneLocalResultFramerOutput;

pub use cluster::LaneResponseRouteOutput;

pub use cluster::LaneResultSelection;

pub use cluster::LaneStartSelection;

pub use cluster::ModularSha256LaneLocalCluster;

pub use cluster::Sha256LaneLocalCluster;

pub use cluster::assemble_lane_local_beat_kernel;

pub use cluster::issue_lane_request_kernel;

pub use cluster::lane_issue_control_kernel;

pub use cluster::lane_local_cluster_kernel;

pub use cluster::lane_local_result_framer_kernel;

pub use cluster::route_lane_response_kernel;

pub use cluster::select_lane_result_kernel;

pub use cluster::select_lane_start_kernel;

pub use digits::MessageBytes;

pub use digits::MessageDigitArray;

pub use digits::SignatureCaptureInput;

pub use digits::message_digits_kernel;

pub use digits::signature_capture_kernel;

pub use engine::CONTEXT_LOGICAL_RAM_BITS;

pub use engine::ContextEngineInput;

pub use engine::ContextEngineOutput;

pub use engine::ENGINE_SEGMENTS;

pub use engine::EngineControl;

pub use engine::MASK_STORAGE_BITS;

pub use engine::PRIVATE_KEY_CONSUMERS;

pub use engine::PUBLIC_KEY_FOCUS_BLOCKS;

pub use engine::PrepareRequestInput;

pub use engine::SEGMENT_GROUPS;

pub use engine::SEGMENT_STAGE_CHAIN_FIRST;

pub use engine::SEGMENT_STAGE_CHAIN_LAST;

pub use engine::SEGMENT_STAGE_ENDPOINT;

pub use engine::SEGMENT_STAGE_PRF;

pub use engine::SEGMENT_STAGE_SECRET_DATA;

pub use engine::SEGMENT_STAGE_SECRET_PADDING;

pub use engine::SIGNATURE_STORAGE_BITS;

pub use engine::STATE_STORAGE_BITS;

pub use engine::SegmentGroups;

pub use engine::SegmentSelection;

pub use engine::SegmentStages;

pub use engine::SignatureBanks;

pub use engine::SignatureBanksInput;

pub use engine::SignatureBanksOutput;

pub use engine::SingleContextWorkEngine;

pub use engine::exclude_segment_groups_kernel;

pub use engine::increment_segment_group_kernel;

pub use engine::prepare_request_kernel;

pub use engine::public_key_endpoints_ready_kernel;

pub use engine::segment_bit_kernel;

pub use engine::segment_required_mask_kernel;

pub use engine::segment_task_fields_kernel;

pub use engine::select_public_key_focus_segment_kernel;

pub use engine::select_ready_segment_kernel;

pub use engine::set_segment_bit_kernel;

pub use engine::signature_banks_kernel;

pub use engine::single_context_work_engine_kernel;

pub use engine::state_pair_exclusion_kernel;

pub use engine::union_segment_groups_kernel;

pub use engine::wake_segments_for_mask_kernel;

pub use fabric::CONTEXT_COUNT;

pub use fabric::IssueControlInput;

pub use fabric::IssueControlOutput;

pub use fabric::IssueInput;

pub use fabric::IssueOutput;

pub use fabric::LANE_COUNT;

pub use fabric::ResponseControlInput;

pub use fabric::ResponseControlOutput;

pub use fabric::ResponseRouterInput;

pub use fabric::ResponseRouterOutput;

pub use fabric::ShaTransportFabric;

pub use fabric::TransportInput;

pub use fabric::TransportOutput;

pub use fabric::host_issue_oracle;

pub use fabric::host_response_router_oracle;

pub use fabric::issue_control_kernel;

pub use fabric::issue_requests_kernel;

pub use fabric::response_control_kernel;

pub use fabric::route_responses_kernel;

pub use fabric::sha_transport_fabric_kernel;

pub use framing::FUSED_OUTPUT_BEATS;

pub use framing::FusedBeat;

pub use framing::FusedFrame;

pub use framing::OUTPUT_BEAT_BYTES;

pub use framing::OutputFrameError;

pub use framing::pack_fused_output;

pub use framing::unpack_fused_output;

pub use legacy::LEGACY_CHAIN_STEPS;

pub use legacy::LEGACY_ENDPOINT_BLOCKS;

pub use legacy::LEGACY_FUSED_OUTPUT_BEATS;

pub use legacy::LEGACY_FUSED_PERMUTATIONS;

pub use legacy::LEGACY_FUSED_PRIVATE_KEY_PERMUTATIONS;

pub use legacy::LEGACY_HASH_BYTES;

pub use legacy::LEGACY_MASK_COUNT;

pub use legacy::LegacyBeatBytes;

pub use legacy::LegacyChainStateInput;

pub use legacy::LegacyEndpointBlockInput;

pub use legacy::LegacyFusedBeat;

pub use legacy::LegacyFusedInput;

pub use legacy::LegacyFusedOutput;

pub use legacy::LegacyFusedPrivateKeyEngine;

pub use legacy::LegacyFusedPrivateKeyInput;

pub use legacy::LegacyFusedPrivateSeedEngine;

pub use legacy::LegacyHashLanes;

pub use legacy::LegacyMaskStore;

pub use legacy::LegacyOutputBeatInput;

pub use legacy::LegacyPrfStateInput;

pub use legacy::LegacyPrivateSeedBytes;

pub use legacy::LegacySecretStateInput;

pub use legacy::LegacySegmentStore;

pub use legacy::legacy_bytes_to_lanes_kernel;

pub use legacy::legacy_chain_state_kernel;

pub use legacy::legacy_digest_lanes_kernel;

pub use legacy::legacy_endpoint_block_state_kernel;

pub use legacy::legacy_fused_private_key_kernel;

pub use legacy::legacy_fused_private_seed_kernel;

pub use legacy::legacy_hash32_state_kernel;

pub use legacy::legacy_output_beat_kernel;

pub use legacy::legacy_prf_state_kernel;

pub use legacy::legacy_secret_state_kernel;

pub use sequencer::HardwareTaskCounts;

pub use sequencer::SequencerInput;

pub use sequencer::SequencerOutput;

pub use sequencer::SingleContextSequencer;

pub use sequencer::decode_hardware_counts_kernel;

pub use sequencer::encode_hardware_counts_kernel;

pub use sequencer::single_context_sequencer_kernel;

pub use tag::DecodedTaskTag;

pub use tag::TagFields;

pub use tag::TaskKind;

pub use tag::TaskTagError;

pub use tag::decode_tag_kernel;

pub use tag::decode_task_tag;

pub use tag::encode_tag_kernel;

pub use tag::tag_is_well_formed_kernel;

pub use tasks::TaskAudit;

pub use tasks::TaskCounts;

pub use tasks::TaskTraceError;

pub use tasks::audit_task_trace;

pub use tasks::canonical_task_trace;

pub use top::GlobalBeatValidationInput;

pub use top::GlobalErrorMerge;

pub use top::GlobalErrorMergeControl;

pub use top::GlobalErrorMergeInput;

pub use top::GlobalErrorMergeOutput;

pub use top::GlobalErrorSource;

pub use top::GlobalFrameMerge;

pub use top::GlobalFrameMergeControl;

pub use top::GlobalFrameMergeInput;

pub use top::GlobalFrameMergeOutput;

pub use top::GlobalFrameSource;

pub use top::GlobalLaneSelection;

pub use top::ModularSha256SignerTop;

pub use top::SIGNER_CLUSTER_COUNT;

pub use top::SIGNER_FRAME_BEATS;

pub use top::Sha256SignerTop;

pub use top::SignerErrorCompletion;

pub use top::SignerOutputBeat;

pub use top::SignerTop;

pub use top::SignerTopControl;

pub use top::SignerTopInput;

pub use top::SignerTopOutput;

pub use top::global_beat_is_canonical_kernel;

pub use top::global_error_merge_kernel;

pub use top::global_frame_merge_kernel;

pub use top::select_global_lane_kernel;

pub use top::signer_top_kernel;

pub use verify::*;

Modules

benchmark

On-chip U280 benchmark control for the SHA-256 WOTS signer.

blocks

Fixed SHA-256 block builders for the performance-profile WOTS datapath.

cluster

One-lane, four-context SHA-profile WOTS cluster.

digits

Fixed-work message-digit extraction and signature-capture selection.

engine

Fine-grained, BRAM-oriented SHA-profile WOTS context engine.

fabric

Historical nine-context, three-lane SHA transport fabric.

framing

Canonical 512-bit framing for a fused signature and public key.

legacy

Byte-compatible LEGACY_KECCAK fused private-seed signing engine.

sequencer

Historical single-context SHA-profile WOTS task sequencer.

tag

Opaque SHA-lane tag encoding for fused WOTS tasks.

tasks

Auditable task model for the serial single-context SHA-profile baseline.

top

Three-cluster SHA-profile signer top.

verify

SHA-256 WOTS verification framing, exact work accounting, and RHDL tops.

Constants

MAX_AVERAGE_CYCLES_PER_RESULT

Maximum average simulated cycles per fused private-seed result in the sustained gate.