{ "contract_needs": [ { "dimension": "build", "why": "every program is built" }, { "dimension": "differential", "why": "an @accuracy bound is checked against the exact semantics" }, { "dimension": "synthesis", "why": "a hardware realization (@target(fpga)) is requested" } ], "derivation": { "applied": false, "derived": { "file": "build/camera_fov.eml", "kernel_digest": "sha256:7e06222ab913834ec048bef3fbdc9bd70bc706e1955dea47f285e772331858fe", "sha256": "sha256:29cffb50d75837e09573e8a854ebc123f93e22459633001ae3b6615bdfdb6e90" }, "original": { "file": "kernel/camera_fov.eml", "kernel_digest": "sha256:7e06222ab913834ec048bef3fbdc9bd70bc706e1955dea47f285e772331858fe", "sha256": "sha256:29cffb50d75837e09573e8a854ebc123f93e22459633001ae3b6615bdfdb6e90" }, "why": "the kernel declares its own @target(fpga)" }, "establishes": [ { "command": "build", "dimension": "build", "make": "make", "sentence": "The Verilog member elaborates under the required Verilator with no error (missing pin connections, multiple drivers, out-of-range selects and implicit nets promoted to errors) and is valid synthesis input (the required yosys reads it and resolves its hierarchy to the top unit), and the VHDL member analyses and elaborates under the required GHDL as VHDL-2008; it says nothing about the values either design computes." }, { "command": "run", "dimension": "execution", "make": "make run", "sentence": "Each member's testbench ran to completion under its required simulator (Verilog under Verilator, VHDL under GHDL) on every input of the recorded set, produced exactly one valid output per input, and printed no runtime-check violation; it says nothing about whether those outputs are right." }, { "command": "check", "dimension": "differential", "make": "make check", "sentence": "On every input of the recorded set (sampled evidence), each member's output lies within that member's contracted bound of the kernel's exact real value, computed from the kernel source by the exact-real oracle (240-bit, under the locked Python), and satisfies every declared postcondition, and every pair of members agrees under its recorded relation (bit-exact on every tested cycle, for two members at one format); it demonstrates agreement under the tested conditions, does not establish universal equivalence between the two HDL implementations, and never raises the kernel's mathematical assurance." }, { "command": "synth", "dimension": "synthesis", "make": "make synth", "sentence": "The required yosys maps the Verilog member to Xilinx 7-series primitives (synth_xilinx -family xc7) with no multiple drivers, logic loops or undriven wires, and nothing simulation-only or initial-value-dependent left in the netlist. Yosys synthesis alone is not proof that the design fits the device, routes, or meets timing." }, { "command": "timing", "dimension": "timing", "make": "make timing", "sentence": "Vivado 2025.2 placed and ROUTED the Verilog member out of context on the device its own reports name as xc7a100tcsg324-1, with the binding's clock on clk and every input and output constrained against it (a register-boundary budget), check_timing showing no unconstrained endpoint, port or clock, and every constraint met with non-negative worst setup, hold and pulse-width slack; written only from a recorded Vivado run on the bench, it is not the timing of an enclosing bench design and not a programmed part." }, { "command": "hardware", "dimension": "hardware", "make": "make hardware", "sentence": "On the bench, Vivado 2025.2 built the program's Verilog member behind the bench wrapper IN CONTEXT on the board's pins, wrote its bitstream and programmed it into the xc7a100t on the board over JTAG, and the part, driven over the board's USB-UART, returned for every input of the recorded set, in order, exactly the word the program's Verilog member computed in simulation; recorded as four separate entries (bitstream, programming, physical_io, timing_closure: the programmed design's own routed timing), each with its own verdict. It is evidence about the inputs run, on this board, at this clock -- never a universal claim, never one label, and written only from a captured bench session." }, { "command": "reproduce", "dimension": null, "make": "make reproduce", "sentence": "The manifest's input closure re-derives, every required tool is present at its required version, the interpreter and every distribution are the locked ones, and two rebuilds from the recorded inputs produce byte-identical emitted designs and synthesized netlists matching the recorded ones; INCOMPLETE, not a pass, when a required tool or a locked distribution is not what this machine has." } ], "evidence": { "fit": { "from": "vivado", "verdict": "PASS", "why": "Vivado routed 680 LUT, 3,417 FF, 59 DSP48E1, within the part" }, "history": [], "vector": [ { "applicability": "APPLICABLE", "command": "make", "dimension": "build", "establishes": "The Verilog member elaborates under the required Verilator with no error (missing pin connections, multiple drivers, out-of-range selects and implicit nets promoted to errors) and is valid synthesis input (the required yosys reads it and resolves its hierarchy to the top unit), and the VHDL member analyses and elaborates under the required GHDL as VHDL-2008; it says nothing about the values either design computes.", "evidence": "sha256:c0abefc040ffc663aabb38c4c0be283299674ca4129ef50ef607cbb949a100fd", "record": "evidence/records/build-b20f7931d063b774.json", "recorded_at": "2026-11-04T23:24:47.863003Z", "status": "PASS" }, { "applicability": "APPLICABLE", "command": "make run", "dimension": "execution", "establishes": "Each member's testbench ran to completion under its required simulator (Verilog under Verilator, VHDL under GHDL) on every input of the recorded set, produced exactly one valid output per input, and printed no runtime-check violation; it says nothing about whether those outputs are right.", "evidence": "sha256:0bcfd6883b387c60698b1cb835e597afdf277c5a50a17c2a4cdf2b574309ae44", "record": "evidence/records/execution-ead48f42481afa59.json", "recorded_at": "2026-11-04T23:24:46.194190Z", "status": "PASS" }, { "applicability": "APPLICABLE", "command": "make check", "dimension": "differential", "establishes": "On every input of the recorded set (sampled evidence), each member's output lies within that member's contracted bound of the kernel's exact real value, computed from the kernel source by the exact-real oracle (240-bit, under the locked Python), and satisfies every declared postcondition, and every pair of members agrees under its recorded relation (bit-exact on every tested cycle, for two members at one format); it demonstrates agreement under the tested conditions, does not establish universal equivalence between the two HDL implementations, and never raises the kernel's mathematical assurance.", "evidence": "sha256:b0035557edb592ecabdc7542f64ebd760373bcc3e16155b27a36a49242a8bff8", "record": "evidence/records/differential-37d96f1a67399b71.json", "recorded_at": "2026-11-04T23:24:46.631534Z", "status": "PASS" }, { "applicability": "APPLICABLE", "command": "make synth", "dimension": "synthesis", "establishes": "The required yosys maps the Verilog member to Xilinx 7-series primitives (synth_xilinx -family xc7) with no multiple drivers, logic loops or undriven wires, and nothing simulation-only or initial-value-dependent left in the netlist. Yosys synthesis alone is not proof that the design fits the device, routes, or meets timing.", "evidence": "sha256:8c010c8dcd9a079a23fdc5444009057d8fcbdd939f8861f8bd50e462e6f14008", "record": "evidence/records/synthesis-043f7fbd60001d80.json", "recorded_at": "2026-11-04T23:24:52.368571Z", "status": "PASS" }, { "applicability": "APPLICABLE", "command": "make timing", "dimension": "timing", "establishes": "Vivado 2025.2 placed and ROUTED the Verilog member out of context on the device its own reports name as xc7a100tcsg324-1, with the binding's clock on clk and every input and output constrained against it (a register-boundary budget), check_timing showing no unconstrained endpoint, port or clock, and every constraint met with non-negative worst setup, hold and pulse-width slack; written only from a recorded Vivado run on the bench, it is not the timing of an enclosing bench design and not a programmed part.", "evidence": "sha256:7c84b19f2ae5a9f16689d4d3b1f339dc291e9c20a6f206e422f50df70cc45d46", "record": "evidence/records/timing-2d38475341a05d52.json", "recorded_at": "2026-11-06T15:19:20.014081Z", "status": "PASS" }, { "applicability": "APPLICABLE", "command": "make hardware", "dimension": "hardware", "entries": [ { "name": "bitstream", "status": "PASS" }, { "name": "programming", "status": "PASS" }, { "name": "physical_io", "status": "PASS" }, { "name": "timing_closure", "status": "PASS" } ], "establishes": "On the bench, Vivado 2025.2 built the program's Verilog member behind the bench wrapper IN CONTEXT on the board's pins, wrote its bitstream and programmed it into the xc7a100t on the board over JTAG, and the part, driven over the board's USB-UART, returned for every input of the recorded set, in order, exactly the word the program's Verilog member computed in simulation; recorded as four separate entries (bitstream, programming, physical_io, timing_closure: the programmed design's own routed timing), each with its own verdict. It is evidence about the inputs run, on this board, at this clock -- never a universal claim, never one label, and written only from a captured bench session.", "evidence": "sha256:f1589faa2809c84036be65b1e181e7ef6c50918e64c2680479430417a492037f", "record": "evidence/records/hardware-8ee63e6489fa2599.json", "recorded_at": "2026-11-06T15:24:31.352348Z", "status": "PASS" } ] }, "generated_in": { "machine": "unlabelled" }, "identity": { "artifact_files": [ { "name": "build/camera_fov.eml", "sha256": "sha256:29cffb50d75837e09573e8a854ebc123f93e22459633001ae3b6615bdfdb6e90" }, { "name": "rtl/camera_fov.v", "sha256": "sha256:d018c913c7067e422d1d49734614158e90b18eac3d97163ad8b375ca88dad7e5" }, { "name": "rtl/camera_fov.verilog.plan.json", "sha256": "sha256:93d34197e310f72d4b11922bcefce71ea219b83f5869052378e742bb4798cef2" }, { "name": "rtl/camera_fov.vhd", "sha256": "sha256:2bc77f28d2eb0270bd54db291e44355b34f1171d56f2ea92397fa37f21ab103a" }, { "name": "rtl/camera_fov.vhdl.plan.json", "sha256": "sha256:3f984a67603ea605321fbbb3f4ab0ec4c6a02b275078ae044df55676e4b63084" } ], "artifacts": "sha256:6fd4981a2dd7549d540c4363f52a9594b0c7f8c3d4c003f2382b701fffedc8e4", "closure": { "abi_version": "1", "build_configuration": { "derivation": { "annotation": null, "why": "the kernel declares its own @target(fpga)" }, "members": [ "verilog", "vhdl" ], "realization_plan": "auto: chosen afresh in an empty plan cache for every build", "scrub_environment": [ { "name": "LC_ALL", "value": "C" }, { "name": "PYTHONHASHSEED", "value": "0" }, { "name": "SOURCE_DATE_EPOCH", "value": "0" }, { "name": "TZ", "value": "UTC" } ] }, "kernel": { "file": "kernel/camera_fov.eml", "function": "camera_fov", "kernel_digest": "sha256:7e06222ab913834ec048bef3fbdc9bd70bc706e1955dea47f285e772331858fe", "sha256": "sha256:29cffb50d75837e09573e8a854ebc123f93e22459633001ae3b6615bdfdb6e90" }, "modules": { "clock": { "clock_mhz": "100", "period_ns": "10.000" }, "files": [ { "language": "systemverilog", "name": "rtl/lib/eml_atan.sv", "sha256": "sha256:98843415f157b2cd9f900e4f316de1cfde93254f2daa73ca02f6e651a0469340" }, { "language": "systemverilog", "name": "rtl/lib/eml_reciprocal.sv", "sha256": "sha256:2123448c891354e439f8dbdb333272303d622389e673a6ceb7c62cbf64826f45" }, { "language": "vhdl-2008", "name": "rtl/lib/eml_atan.vhd", "sha256": "sha256:fb895e086b7d4b4ab5df73325f7685a76fe2698b13845bb1f0270ba0357a178c" }, { "language": "vhdl-2008", "name": "rtl/lib/eml_reciprocal.vhd", "sha256": "sha256:fc8cf1bc83fab59f8681c20e44e425e10422e92328934d3a84dff9a06f1652cc" } ] }, "platform": { "name": "fpga/arty-a7", "spec_digest": "sha256:8811bd97bde4095985931469c4ecfb58f188f99ca47b7ee141a44da5a1a00aff" }, "scaffold": [ { "name": "Makefile", "sha256": "sha256:037241365e242217c4e2e1e7db11855be3bae7ce51f8a43e9a70bcd2722def30" }, { "name": "README.md", "sha256": "sha256:7bdea4ef977ad7f87f35baf837345a6358835b636135fdec899479cb6921da67" }, { "name": "bench/hardware.tcl", "sha256": "sha256:3c7a8ee95c748ea4160fc6e3dea37bc4c2d29a69142b407945dd57182b2dd828" }, { "name": "bench/timing.tcl", "sha256": "sha256:ce35c30a6eb8a9f41f327d24e7616ff43efaf4e6b4a843ae2480c847185cfe86" } ], "toolchain": { "compiler": { "distributions": [ { "name": "eml-cost", "version": "0.26.0" }, { "name": "mpmath", "version": "1.3.0" }, { "name": "numpy", "version": "2.4.4" }, { "name": "sympy", "version": "1.14.0" } ], "files": "136", "forge_version": "0.18.0", "sources": "sha256:f2465b4d9a0ce821c092b0046fb28e3b7c24e02ab4deee3ecca8e79e75ba8e81" }, "python_lock": { "digest": "sha256:b15b0a2449b3cbd46f3de114ab482fa284707e04283f59d6fb91ddec50bab24d", "interpreter": { "implementation": "cpython", "version": "3.12.3" } }, "requirements": [ { "name": "make", "version": "4.3" }, { "name": "verilator", "version": "5.024" }, { "name": "g++", "version": "13.3.0" }, { "name": "ghdl", "version": "4.1.0" }, { "name": "yosys", "version": "0.40" }, { "name": "vivado", "version": "2025.2" } ] } }, "program": "sha256:69d25616674171e4245832a2ea08154af7783fd0e09cf2b50465b9c2c879e963" }, "inputs": { "count": "2065", "definition": "box corners; per parameter (others at the box centre) its ends, one word inside each, the centre and one word either side, and zero; per postcondition `result OP C` and parameter, the two adjacent words where the exact value crosses C; seeded random words over the declared box; recipe v2 adds, per parameter (others at the box centre), zero, the least positive and least negative words and the format's greatest and least words, and the words beside each declared end, each only where the declared box holds it (a Q format has no -0, NaN or infinity); and seeded log-uniform words (a uniform bit length among those the range holds, then a uniform word of that length); then every input kept only where every declared relation admits it (a relation is evaluated by the reference interpreter), and every value left out counted with its reason in `excluded`: a value outside the declared domain is never fed, so no refusal is ever counted as a numerical failure", "digest": "sha256:34f2b9974795cf9130fdafc1be9b771face3ffc3b822197878824f9235144c5d", "file": "check/inputs.json", "format": "q10.16", "recipe": "v2" }, "kernel": { "binding_applied": null, "build_kernel_digest": "sha256:7e06222ab913834ec048bef3fbdc9bd70bc706e1955dea47f285e772331858fe", "build_source": "build/camera_fov.eml", "file": "kernel/camera_fov.eml", "function": "camera_fov", "kernel_digest": "sha256:7e06222ab913834ec048bef3fbdc9bd70bc706e1955dea47f285e772331858fe", "sha256": "sha256:29cffb50d75837e09573e8a854ebc123f93e22459633001ae3b6615bdfdb6e90", "status": { "index_digest": "sha256:01dcd7c089f09824cab3b1d02dd3ec80e0eaf22d31b9a595b6e32cfa4767edb3", "lookup_status": "SUPPORTED", "note": "the kernel's own status; a program's evidence is shown beside it and never changes it", "resolution": "FOUND", "source": "evidence/verification_index.json", "summary": "CERTIFIED_CHECKED: design_identity[chisel], design_identity[systemverilog]; EXHAUSTIVELY_TESTED: primitive_error_bound[chisel/camera_fov/eml_atan@q10.16], primitive_error_bound[chisel/camera_fov/eml_reciprocal@q10.16], primitive_error_bound[systemverilog/camera_fov/eml_atan@q10.16], primitive_error_bound[systemverilog/camera_fov/eml_reciprocal@q10.16], primitive_error_bound[verilog/camera_fov/eml_atan@q10.16], primitive_error_bound[verilog/camera_fov/eml_reciprocal@q10.16], primitive_error_bound[vhdl/camera_fov/eml_atan@q10.16], primitive_error_bound[vhdl/camera_fov/eml_reciprocal@q10.16]; MIXED: model_error_bound[chisel/camera_fov], model_error_bound[systemverilog/camera_fov], model_error_bound[verilog/camera_fov], model_error_bound[vhdl/camera_fov]; NOT_ESTABLISHED: 11" } }, "lineage": [], "members": [ { "contract": { "abs_error": "1050210666921543/1152921504606846976", "certificate": "91879fee5e267995af175fbf2d18c60298ef5ba93e1b8c0068ef89ef1d41b5d7", "source": "the kernel's composed bound from its fixed-point evidence (error_certificate); the realization plan agrees where it records one" }, "design": "rtl/camera_fov.v", "emitter": "verilog", "format": "q10.16", "frac": "16", "latency": "54", "plan": "rtl/camera_fov.verilog.plan.json", "ports": [ "sensor_width", "focal_length" ], "role": "synthesized", "simulator": "verilator", "top": "camera_fov_pipeline", "width": "26" }, { "contract": { "abs_error": "1050210666921543/1152921504606846976", "certificate": "91879fee5e267995af175fbf2d18c60298ef5ba93e1b8c0068ef89ef1d41b5d7", "source": "the kernel's composed bound from its fixed-point evidence (error_certificate); the realization plan agrees where it records one" }, "design": "rtl/camera_fov.vhd", "emitter": "vhdl", "format": "q10.16", "frac": "16", "latency": "54", "plan": "rtl/camera_fov.vhdl.plan.json", "ports": [ "sensor_width", "focal_length" ], "role": "co-simulated", "simulator": "ghdl", "top": "camera_fov_pipeline", "width": "26" } ], "modules": { "clock_gate": { "checked": [ { "closure_digest": "sha256:cda5072f5fd35d0b65866a79b1450d9a7e0906a9b72602c6586984e78bacade8", "fmax_mhz": "125.4", "format": "q10.16", "implementation": "eml_atan", "measured_at_mhz": "100", "record": "module-timing-a8ae5e72766a2729.json", "slack_ns": "+2.029", "timing_report_sha256": "sha256:0bdc233ee093a09cb39cf9a3644f322b32c32da76929c68583ddf1d9520f0af8", "wns_ns": "2.029" }, { "closure_digest": "sha256:503d76cb8f2794ea3e595b5412c0b3de5cab5a17825f063c30e6a6af1a2cc065", "fmax_mhz": "156.5", "format": "q10.16", "implementation": "eml_reciprocal", "measured_at_mhz": "100", "record": "module-timing-ce0c608b31f6a3bb.json", "slack_ns": "+3.612", "timing_report_sha256": "sha256:5b4a0794eeb3a84df0f4f97e69c1801c9559a7841fc5e9b9d50cd555a01cda2e", "wns_ns": "3.612" } ], "clock_mhz": "100", "clock_source": "the platform's binding", "floor_mhz": null, "note": "every module holds the bar at the requested clock (the owner's ruling of 2026-10-24: fix the module, never the constraint)", "part": "xc7a100tcsg324-1", "period_ns": "10.000", "requested_mhz": "100", "rule": "every module's slack at the clock at least +1.000 ns, from the critical delay its row measured (module_timing.slack_ns; FMAX_RULE)", "speed": "-1", "vivado": "2025.2" }, "composed_bound": [ { "abs_error": "1050210666921543/1152921504606846976", "abs_error_float": "0.0009109125493150299", "certificate": "91879fee5e267995af175fbf2d18c60298ef5ba93e1b8c0068ef89ef1d41b5d7", "member": "verilog", "status": "VERIFIED", "why": "the reference conformance's bound is the evidence certificate's composed abs_error, exactly" }, { "abs_error": "1050210666921543/1152921504606846976", "abs_error_float": "0.0009109125493150299", "certificate": "91879fee5e267995af175fbf2d18c60298ef5ba93e1b8c0068ef89ef1d41b5d7", "member": "vhdl", "status": "VERIFIED", "why": "the reference conformance's bound is the evidence certificate's composed abs_error, exactly" } ], "designs": [ { "language": "verilog-2005", "name": "rtl/camera_fov.v" }, { "language": "vhdl-2008", "name": "rtl/camera_fov.vhd" } ], "file": "build/modules.json", "files": [ { "language": "systemverilog", "name": "rtl/lib/eml_atan.sv", "sha256": "sha256:98843415f157b2cd9f900e4f316de1cfde93254f2daa73ca02f6e651a0469340", "source": { "commit": "a9ecca88f8b6f38c4c3c4fd050d576600067e582", "path": "hardware/modules/transcendental/eml_atan.v" } }, { "language": "systemverilog", "name": "rtl/lib/eml_reciprocal.sv", "sha256": "sha256:2123448c891354e439f8dbdb333272303d622389e673a6ceb7c62cbf64826f45", "source": { "commit": "a9ecca88f8b6f38c4c3c4fd050d576600067e582", "path": "hardware/modules/eml_operators/eml_reciprocal.v" } }, { "language": "vhdl-2008", "name": "rtl/lib/eml_atan.vhd", "sha256": "sha256:fb895e086b7d4b4ab5df73325f7685a76fe2698b13845bb1f0270ba0357a178c", "source": { "commit": "a9ecca88f8b6f38c4c3c4fd050d576600067e582", "path": "hardware/modules/transcendental/eml_atan.vhd" } }, { "language": "vhdl-2008", "name": "rtl/lib/eml_reciprocal.vhd", "sha256": "sha256:fc8cf1bc83fab59f8681c20e44e425e10422e92328934d3a84dff9a06f1652cc", "source": { "commit": "a9ecca88f8b6f38c4c3c4fd050d576600067e582", "path": "hardware/modules/eml_operators/eml_reciprocal.vhd" } } ], "fit": { "capacity": { "bram36": "135", "dsp48e1": "240", "ff": "126800", "lut": "63400" }, "predictors": { "cost_model": { "none": "the cost model prices no eml_atan, eml_reciprocal (hardware/targets/xilinx/artix7.PER_UNIT_COST: the narrow exp, ln, sin, cos, tan and sqrt units only)", "unpriced": [ "eml_atan", "eml_reciprocal" ] }, "yosys": { "bram36": "0", "dsp48e1": "64", "ff": "3601", "lut": "599", "recipe": "the platform's synth step (synth_xilinx -family xc7, the whole Verilog member)" } }, "rule": "the owner's three-way rule (2026-10-31, item 5) on the whole design; a predictor with no number is not established; the module closure's own yosys rows stay as a floor (`gate`)", "verdict": "NOT_ESTABLISHED", "vivado": { "none": "no bench run of this program yet: its timing record carries Vivado's utilization" }, "why": "cost_model: no number -- the cost model prices no eml_atan, eml_reciprocal (hardware/targets/xilinx/artix7.PER_UNIT_COST: the narrow exp, ln, sin, cos, tan and sqrt units only); yosys: fits -- settled by Vivado's utilization in the program's timing record" }, "fit_gate": { "capacity": { "bram36": "135", "dsp48e1": "240", "ff": "126800", "lut": "63400" }, "counted": [ { "bram36": "0", "dsp48e1": "26", "ff": "692", "format": "q10.16", "implementation": "eml_atan", "lut": "202" }, { "bram36": "0", "dsp48e1": "34", "ff": "1843", "format": "q10.16", "implementation": "eml_reciprocal", "lut": "373" } ], "rule": "the module closure's sums under yosys synth_xilinx (xc7), each module alone at its format, against the part; the kernel's own datapath is not counted (the owner's ruling of 2026-10-29 (b), item 6)", "used": { "bram36": "0", "dsp48e1": "60", "ff": "2535", "lut": "575" } }, "instances": [ { "file": "hardware/modules/transcendental/eml_atan.v", "format": "q10.16", "hdl": "verilog", "instance": "camera_fov_pipeline/eml_atan_2", "latency": "14", "library": true, "module": "eml_atan", "parameters": { "FRAC": "16", "WIDTH": "26" }, "parent": "camera_fov_pipeline" }, { "file": "hardware/modules/eml_operators/eml_reciprocal.v", "format": "q10.16", "hdl": "verilog", "instance": "camera_fov_pipeline/eml_reciprocal_1", "latency": "36", "library": true, "module": "eml_reciprocal", "parameters": { "FRAC": "16", "WIDTH": "26" }, "parent": "camera_fov_pipeline" }, { "file": "hardware/modules/transcendental/eml_atan.vhd", "format": "q10.16", "hdl": "vhdl", "instance": "camera_fov_pipeline/u_eml_atan_2", "latency": "14", "library": true, "module": "eml_atan", "parameters": { "FRAC": "16", "WIDTH": "26" }, "parent": "camera_fov_pipeline" }, { "file": "hardware/modules/eml_operators/eml_reciprocal.vhd", "format": "q10.16", "hdl": "vhdl", "instance": "camera_fov_pipeline/u_eml_reciprocal_1", "latency": "36", "library": true, "module": "eml_reciprocal", "parameters": { "FRAC": "16", "WIDTH": "26" }, "parent": "camera_fov_pipeline" } ], "note": "the hardware program's TRUSTED BASE: every library module its designs instantiate, by sha256, language and source commit, and each instance the kernel makes linked to the measurement or certificate its bound rests on at this format, its certified domain and the kernel's argument there (the owner's ruling of 2026-10-24)", "trusted_base": [ { "binding": "MEASURED", "coverage": [ { "argument": [ 0.08719867578118495, 0.4871434294819729 ], "domain": [ -0.5, 0.5 ], "execution_domain": "CERTIFIED", "supported_domain": [ -1.0, 1.0 ] } ], "file": "hardware/modules/transcendental/eml_atan.v", "format": "q10.16", "hdl": "verilog", "instance": "camera_fov_pipeline/eml_atan_2", "latency": "14", "library": true, "module": "eml_atan", "parameters": { "FRAC": "16", "WIDTH": "26" }, "parent": "camera_fov_pipeline", "premises": [ { "argument": [ 5735, 31905 ], "assurance": "TESTED_EXHAUSTIVE", "basis": "7ea9e73672dc995f4f4b6d04cab6e182d179fe418d4a16ac312bb36f6c8803a1", "binding_check": "BASIS_RECOMPUTED", "bound": "0.0001465026613112029", "certified_domain": [ -0.5, 0.5 ], "evidence": "range-measurement", "measured": "26211", "method": "EXHAUSTIVE_TEST", "population": [ 5715, 31925 ], "provenance": "EXHAUSTIVE" } ], "why": "the premise's measurement basis, recomputed from this program's copied files, is the premise's: these are the bytes the measurement measured, at this format" }, { "binding": "MEASURED", "coverage": [ { "argument": [ 75.99998474121094, 400.00001525878906 ], "domain": [ 0.5, 511.99998474121094 ], "execution_domain": "CERTIFIED", "supported_domain": [ 0.0019683837890625, 511.99998474121094 ] } ], "file": "hardware/modules/eml_operators/eml_reciprocal.v", "format": "q10.16", "hdl": "verilog", "instance": "camera_fov_pipeline/eml_reciprocal_1", "latency": "36", "library": true, "module": "eml_reciprocal", "parameters": { "FRAC": "16", "WIDTH": "26" }, "parent": "camera_fov_pipeline", "premises": [ { "argument": [ 4980736, 26214400 ], "assurance": "TESTED_EXHAUSTIVE", "basis": "489411f0ed8d36389080412380f703e534aee485ceaf823eb62ec9d80d517712", "binding_check": "BASIS_RECOMPUTED", "bound": "7.728856343781037e-06", "certified_domain": [ 0.5, 511.99998474121094 ], "evidence": "range-measurement", "measured": "21233667", "method": "EXHAUSTIVE_TEST", "population": [ 4980735, 26214401 ], "provenance": "EXHAUSTIVE" } ], "why": "the premise's measurement basis, recomputed from this program's copied files, is the premise's: these are the bytes the measurement measured, at this format" }, { "binding": "MEASURED", "coverage": [ { "argument": [ 0.08719867578118495, 0.4871434294819729 ], "domain": [ -0.5, 0.5 ], "execution_domain": "CERTIFIED", "supported_domain": [ -1.0, 1.0 ] } ], "file": "hardware/modules/transcendental/eml_atan.vhd", "format": "q10.16", "hdl": "vhdl", "instance": "camera_fov_pipeline/u_eml_atan_2", "latency": "14", "library": true, "module": "eml_atan", "parameters": { "FRAC": "16", "WIDTH": "26" }, "parent": "camera_fov_pipeline", "premises": [ { "assurance": "TESTED_EXHAUSTIVE", "basis": "0d15dc91ef4f462718e1689b48502845a37ccba20b51caa0696399da517b6598", "binding_check": "VHDL_BASIS_RECOMPUTED", "bound": "0.0001465026613112029", "evidence": "vhdl-range-measurement", "for_premise": { "basis": "7ea9e73672dc995f4f4b6d04cab6e182d179fe418d4a16ac312bb36f6c8803a1", "bound": "0.0001465026613112029", "population": [ "5715", "31925" ] }, "inputs": "26211", "measurement": "683cb838026171f35bf1a811c30890ba2d56e504184c418c9fec6d6430a345ad", "method": "EXHAUSTIVE_TEST", "simulator": "GHDL 4.1.0 (Ubuntu 4.1.0+dfsg-0ubuntu2) [Dunoon edition]; llvm 18.1.3 code generator", "words": [ "5715", "31925" ] } ], "why": "the VHDL file's OWN measurement (RC-1): the same harness through GHDL over a population containing the premise's, its basis recomputed from this program's copy of the VHDL file, its bound no larger than the premise's" }, { "binding": "MEASURED", "coverage": [ { "argument": [ 75.99998474121094, 400.00001525878906 ], "domain": [ 0.5, 511.99998474121094 ], "execution_domain": "CERTIFIED", "supported_domain": [ 0.0019683837890625, 511.99998474121094 ] } ], "file": "hardware/modules/eml_operators/eml_reciprocal.vhd", "format": "q10.16", "hdl": "vhdl", "instance": "camera_fov_pipeline/u_eml_reciprocal_1", "latency": "36", "library": true, "module": "eml_reciprocal", "parameters": { "FRAC": "16", "WIDTH": "26" }, "parent": "camera_fov_pipeline", "premises": [ { "assurance": "TESTED_EXHAUSTIVE", "basis": "566bb6134b6fc0329b3358e3905746280eb2fba1e774a5390613ae3df11f4c5f", "binding_check": "VHDL_BASIS_RECOMPUTED", "bound": "7.728856343781037e-06", "evidence": "vhdl-range-measurement", "for_premise": { "basis": "489411f0ed8d36389080412380f703e534aee485ceaf823eb62ec9d80d517712", "bound": "7.728856343781037e-06", "population": [ "4980735", "26214401" ] }, "inputs": "21233667", "measurement": "0e646d4fa5f6b96ad54ac38da972bcdd245e1825f390da12e736dc0723d6f31e", "method": "EXHAUSTIVE_TEST", "simulator": "GHDL 4.1.0 (Ubuntu 4.1.0+dfsg-0ubuntu2) [Dunoon edition]; llvm 18.1.3 code generator", "words": [ "4980735", "26214401" ] } ], "why": "the VHDL file's OWN measurement (RC-1): the same harness through GHDL over a population containing the premise's, its basis recomputed from this program's copy of the VHDL file, its bound no larger than the premise's" } ] }, "platform": { "display_name": "Arty A7-100T", "name": "fpga/arty-a7", "spec": "platform.json", "spec_digest": "sha256:8811bd97bde4095985931469c4ecfb58f188f99ca47b7ee141a44da5a1a00aff", "tier": "product" }, "program": "camera_fov", "python_lock": { "digest": "sha256:b15b0a2449b3cbd46f3de114ab482fa284707e04283f59d6fb91ddec50bab24d", "distributions": "4", "file": "python.lock", "interpreter": { "implementation": "cpython", "version": "3.12.3" } }, "reproduction": { "record": "evidence/records/reproduction-338c2ab884cd8a12.json", "recorded_at": "2026-11-04T23:25:31.824851Z", "status": "REPRODUCED" }, "schema": "forge.program/v2" }