Module top 

Three-cluster SHA-256 verifier top with global fail-closed drainage.

One input stream is locked to a selected cluster for exactly 35 accepted beats. Beat zero strictly targets the registered three-way rotating cursor; a busy target causes bounded head-of-line stall even when another cluster is ready. The cursor advances only after accepted beat zero. The fixed accepted-beat count, never untrusted last, releases ownership. The selected cluster, physical context, and generation form the complete internal job identity. The selected child sees a standard ready/valid offer independent of its ready response; top and child frame state advance only on their identical accepted event. Field-level stream muxes keep unrelated cluster status out of that handshake’s structural dependency graph. Each cluster input is also a direct literal with independent one-hot stream-valid and result-ready fields; no dynamic aggregate mutation joins those protocols during lowering.

Results cross a one-entry registered fair merge. The retained payload is stable under stalls except that the first global fatal edge converts a clean completion to an identified transport error and suppresses its transfer. Any local cluster fault latches global poison. Peer abort is driven only from that registered poison bit, so a child output can never feed a combinational fault-to-abort-to-fault loop.

A current cluster fault is a containment-edge exception to ordinary ready/fault intuition. It may depend on a child response observed on this edge, so top admission cannot retract already-advertised credit through that path. One beat may therefore transfer while fault rises. The selected cluster receives exactly the reported accepted beat and retains its job identity; registered poison removes credit on the next cycle. Result transfer and capture remain suppressed on the original fault edge.

The first broadcast-abort edge is transition-only inside each still-clean peer: its output remains independent of external_abort, while poison, frame-clear, and diagnostic D state are recorded. The poisoned top presents neither a stream beat nor a child-result grant on that edge. At most one lane launch, one routed return, and one internal result capture belonging to already-accepted work may advance per peer. A separate registered drain_armed phase waits for peer poison to contain those effects before the top selects any poisoned child. Once armed, selection depends only on a child’s registered result_valid, never on payload data that could feed its release wire. Capture defensively converts any unexpected clean payload to an identified transport error and preserves every existing nonzero error. Every captured child is released on the same edge, and the top’s registered slot may replace a transferring completion.

This module provides source/RHDL behavioral structure only. It makes no emitted-RTL, synthesis, resource, timing, route, throughput, or card claim.

Structs

VerifierTop

Three replicated four-context verifier clusters and narrow global control.

VerifierTopControl

Narrow resettable frame, merge, and poison state.

VerifierTopInput

External verifier input and result-consumer handshake.

VerifierTopOutput

Global verifier status, accepted identity, and registered result.

VerifierTopSelection

Three-way rotating selection result.

Constants

VERIFY_TOP_CLUSTERS

Number of independent lane-local verifier clusters.

VERIFY_TOP_CONTEXTS

Number of physical verifier contexts across all clusters.

VERIFY_TOP_DIAGNOSTIC_ADMISSION_CURSOR

Admission cursor was outside 0..=2.

VERIFY_TOP_DIAGNOSTIC_CLUSTER_0

Cluster zero caused the first global poison edge.

VERIFY_TOP_DIAGNOSTIC_CLUSTER_1

Cluster one caused the first global poison edge.

VERIFY_TOP_DIAGNOSTIC_CLUSTER_2

Cluster two caused the first global poison edge.

VERIFY_TOP_DIAGNOSTIC_OWNERSHIP

Registered top/child frame ownership disagreed.

VERIFY_TOP_DIAGNOSTIC_RESULT_CURSOR

Result cursor was outside 0..=2.

Functions

select_verifier_top_cluster_kernel

Select one of three eligible clusters with rotating fairness.

sha256_verifier_top_kernel

Native-lane wrapper retained as a stable free-kernel entry point.

verifier_top_with_lane_kernel

Global frame ownership, result merge, and registered peer-abort broadcast.

Type Aliases

ModularSha256VerifierTop

Production verifier skeleton linked with one separately generated lane type.

Sha256VerifierTop

Production three-cluster verifier with three inline full SHA-256 lanes.