[{"data":1,"prerenderedAt":4},["ShallowReactive",2],{"7nT1au6hgn":3},"# SaltWorks\n\nSaltWorks is a demonstration stack from application code to a RISC-V processor\ntaped out on a community silicon shuttle. Its compiler and executive are verified\nin Lean ([`SaltWorks/HDL/`](SaltWorks/HDL/)); the processor itself is the one link\nthat was not, and the correction below says what that means. No proof passed through human review, and no\nRTL was written by a human. The working discipline — the Salt\nmethod — rests on a proof kernel no hallucinated proof can pass: mathematical\nclaims travel between agents as kernel-checked artifacts, and human attention is\nreserved for statements, designs, and rulings. Verification is stated link by\nlink, from the Lean 4 kernel to SAT-checked equivalence at the silicon boundary.\nWe include the complete accounting: theorem provenance, a pre-registered token\nmeter, and an error ledger, constituted from the campaign's append-only logs.\n\n## Correction, 2026-10-05\n\nThe RISC-V core on this chip was not verified by the method this repository\ndescribes. Lean proves a 7-instruction model of the core, but no theorem relates\nthat model to the fabricated design, and no instruction-conformance suite was run\nbefore tapeout. The first conformance run, on 2026-10-04, after submission, found\n3 of 31 in-scope instructions failing on the signed-off netlist: SRA, SRAI and LW.\n\nThe measurement, with every table reproducible from objects whose hashes\n[`docs/ledger-tools/check_fabricated_fixture.sh`](docs/ledger-tools/check_fabricated_fixture.sh)\nchecks, is\n[`docs/silicon-step0-core32-conformance-1004.md`](docs/silicon-step0-core32-conformance-1004.md).\nThe three defects, their causes and measured software workarounds are in\n[`docs/ERRATUM-core32-2026-10-05.md`](docs/ERRATUM-core32-2026-10-05.md).\n\n## The stack, layer by layer\n\n| Layer | Where | What is proved |\n|---|---|---|\n| Application | [`SaltWorks/Stack/`](SaltWorks/Stack/) | application programs and their specifications, with the bridge theorems connecting them to the layers below |\n| Compiler | [`SaltWorks/HDL/`](SaltWorks/HDL/) | the verified compiler: expressions, straight-line code, and loops, down through the circuit DSL to Verilog, with the ISA semantics |\n| Executive | [`SaltWorks/HDL/`](SaltWorks/HDL/) | the executive's isolation theorems (`Executive*.lean`), with the certificate restatement in [`SaltWorks/Certs/`](SaltWorks/Certs/) |\n| CPU / silicon | [`SaltWorks/Silicon/`](SaltWorks/Silicon/) | the flow, the netlist importer, and SAT-checked equivalence at the silicon boundary; its proofs cover the MAC cells, not the RISC-V core |\n| The switch | [`SaltWorks/Banyan/`](SaltWorks/Banyan/) | the Batcher–banyan self-routing switch, sort-then-route closed end to end |\n| Certificates | [`SaltWorks/Certs/`](SaltWorks/Certs/) | the comprehensibility layer: headline theorems restated in primitive vocabulary, the restatement kernel-proved equivalent |\n\n**A note on historical commit ids.** Documents written during the campaign cite\ncommit ids from the pre-consolidation history; those ids do not resolve in this\nrepository. The mapping from historical to current ids is\n[`docs/ledger-tools/flip-sha-map-0816.tsv`](docs/ledger-tools/flip-sha-map-0816.tsv).\nSilicon-lane readers can start at the `silicon-*` documents under\n[`docs/`](docs/), which are that lane's working set.\n\n## What is here\n\n- [`SaltWorks/`](SaltWorks/) — a Lean 4 library: the machine-checked artifacts\n  of the program (definitions, theorems, and the audit stanzas that certify\n  them). Every proof is checked by the Lean kernel; `lake build` replays the\n  entire check.\n- [`docs/`](docs/) — the program's registers and records: preregistrations,\n  evidence ledgers, design documents, and seat records, kept as the work\n  happened.\n- [`tools/`](tools/) — scripts used to build, audit, and maintain the records\n  above.\n\n## Building\n\nRequires [elan](https://github.com/leanprover/elan); the toolchain is pinned in\n`lean-toolchain`.\n\n    lake build\n\n## The Salt method\n\n\u003C!-- claim-check: not-a-claim: states the method's rule, not a claim about an artifact; the artifacts are cited in the table above -->\nThe method makes three commitments. Truth is machine-checked only: every claim\nlands in the kernel, and nothing unverified accumulates into the record. Whatever\nthe kernel cannot check is checked by structured opposition: designs receive\nadversarial refuter passes before execution, landings are witnessed\nindependently, and measurements travel with the commands that produced them.\nHuman attention is treated as the scarcest resource in the system, spent\nexclusively on statements, designs, and rulings.\n\n**Every objective returns five artifacts:**\n\n| Artifact | |\n|---|---|\n| implementation | *P* |\n| specification | *S* |\n| correctness proof | ⊢ *P* ∈ *S* |\n| adversarial tests | *T(P)* |\n| comprehensibility certificates *S′* | ⊢ *S* ⇒ *S′* |\n\n\u003C!-- claim-check: not-a-claim: defines a term of the method; no artifact is claimed -->\nThe certificates *S′* are easily comprehensible properties that justify the\nspecification *S*. A common example of such an *S′* is that the tests are\nformally proved: ⊢ *S* ⇒ *T(P)*, in other words, the system tests are formally\nproved.\n\n**Six required invariants** (tool-agnostic — what the method *is*):\n\n- **R1** — there are five artifacts (listed above), at every level from project\n  design to component design.\n- **R2** — no claim is admitted without its checker: the kernel for mathematics,\n  the named instrument for measurements, structured opposition for designs.\n- **R3** — all design decisions, including human choices, are recorded in an\n  append-only ledger whose distinctive content is the errors and retractions,\n  amended at their source and recorded as first-class results.\n- **R4** — no statement is ever weakened to admit a proof; statement changes are\n  design-tier acts, never taken by an executor agent.\n- **R5** — a small class of irreversible, outward-facing acts is reserved to\n  human hands; the system's job is to reduce each to a prepared click and stop.\n- **R6** — conditional objectives are allowed: a statement may name hypotheses it\n  does not discharge, provided each is named in the statement itself with a\n  declared disposition — *to be discharged* (ledger-owed) or *out of domain* (a\n  stated trust boundary with another discipline). A program's final deliverable\n  carries no undischarged in-domain hypotheses.\n\n**Six advisory articles** (the reference configuration this case study ran and\nmeasured):\n\n- **A1** — a single orchestrator agent on the top model class performs the most\n  complex design work, passes routine work to executor agents, and owns the\n  referee's own infrastructure; audit tooling is never owned by a seat it\n  audits.\n- **A2** — executor agents are the workhorses — building, verifying, proving,\n  refuting — and every task is classified by difficulty and priced before it is\n  attempted.\n- **A3** — attempts are budgeted small, and an agent that exhausts its budget\n  stops and announces its failure rather than grinding on.\n- **A4** — every major design phase has an exploration part and an adversarial\n  refutation part, iterated until dry, with acceptance criteria pre-registered\n  before the artifact exists.\n- **A5** — human interaction is periodic and scheduled; this program held a\n  daily council with recorded rulings.\n- **A6** — every landing is verified by a second agent that did not produce it. \u003C!-- claim-check: not-a-claim: an invariant of the method, not a claim about an artifact -->\n\n## Reading the record\n\nThis repository is a record first and a library second. Three kinds of documents\nlive in `docs/`, and they are read differently:\n\n- **Preregistrations** ([`docs/measurement-preregistration.md`](docs/measurement-preregistration.md)\n  and the `*-PREREG-*` files): commitments written before their measurements ran —\n  including the token meter named above. Read these first when evaluating any\n  claimed result; the matching scores and retractions sit beside them under the\n  same name stem.\n- **Evidence ledgers** (`docs/EVIDENCE-*.md`, [`docs/ledger-tools/`](docs/ledger-tools/)): the error\n  ledger and measurement records named above, kept append-only, corrections\n  landed as corrections rather than edits. Errors are part of the record by\n  design.\n- **Design documents** (`*-design-*.md`, the `aim-high-*` series): what each\n  campaign intended, written before it ran. Theorem provenance travels in the\n  library's audit stanzas: every public theorem is roll-called with its axiom\n  audit, and `lake build` replays the certification.\n\nThe submission-state snapshot of this repository is preserved as an annotated\ntag and a release bundle; the default branch continues past it as the program\ncontinues.\n\n## Provenance\n\nThe work in this repository was produced by a human-directed fleet of AI agents\n(Claude, by Anthropic), with human direction, review, and rulings throughout, and\nthe Lean kernel as the final referee for all formal claims. The collaboration\nmethodology and its numbers of record are described in the paper.\n\n## License\n\nApache License 2.0 — see `LICENSE`.\n\n",1792350339634]