[gHashTag]

CLARA Gap-4 — restraint_ctrl hard-wired (DARPA TA1.4 bounded rationality)

Overview

Implements CLARA Gap-4 from CROWN47_DARPA_DRONE_ANALYSIS.md §3.4:

Hard-wired controller that forces K_UNKNOWN when phi_drift > 0.5%, step_count > 10, or receipt_failure.

t27 spec: gHashTag/t27/specs/ar/restraint.t27 (RestraintType::UNKNOWN_TO_FALSE, threshold 0.5)

---

Files Changed

File	Change
src/restraint_ctrl.v	New module — ~91 lines, pure Verilog-2005, R-SI-1 clean
test/restraint_ctrl_tb.v	4-scenario testbench — all 9 assertions PASS (iverilog)
src/tt_um_trinity_max_true.v	Instantiate u_restraint, wire phi_dist, fsm_step_count, restraint_rcpt_ok; force_unknown → uio[4]
info.yaml	Add restraint_ctrl.v to source_files; update uio[4] pinout

---

Module: restraint_ctrl

Inputs:
  phi_drift[15:0]   Q1.15 from phi_distance_oracle (already in GAMMA)
  step_count[3:0]   counted from host_in_valid && host_in_ready pulses
  receipt_ok        mesh_rcpt_valid | rcpt_valid_d from crc32_receipt path
  current_state[1:0] 00=IDLE 01=COMPUTE 10=EMIT

Outputs:
  force_unknown     1 when restraint trips
  halt_mac          mirrors force_unknown (not yet gated to MAC for safety)
  reason[2:0]       001=phi_drift  010=step_overflow  100=receipt_fail

Threshold math: 0.5% × 2^15 = 163.84 → 16'd164 (ceiling).
Sticky: once tripped, stays high until rst_n de-asserted.

---

Testbench Results (iverilog, Verilog-2005)

Scenario	Expected	Result
1 — Happy path (phi_drift=100, step=5, rcpt_ok=1)	force_unknown=0, reason=000	✅ PASS
2 — phi_drift trigger (165 > 164)	force_unknown=1, reason=001	✅ PASS
3 — step_count overflow (11 > 10)	force_unknown=1, reason=010	✅ PASS
4 — receipt failure (receipt_ok=0)	force_unknown=1, reason=100	✅ PASS
Sticky (input cleared, output holds)	force_unknown=1 persists	✅ PASS
Reset clears sticky	force_unknown=0 after rst_n	✅ PASS

9/9 assertions PASS.

---

DARPA CLARA TA1.4 Compliance

This module closes CROWN47 §3.4 Gap 4:

"If AI not confident, chip stays silent" — φ-drift bound checking as formal honesty proof.

CLARA invariant	Implementation
restraint_preserves_true	force_unknown=0 on clean inputs (Scenario 1)
restraint_transforms_unknown	force_unknown=1, sticky on trigger
bounded_rationality MAX_STEPS=10	step_count > 10 trips restraint
receipt_integrity	receipt_ok=0 trips restraint

---

Integration Strategy (first PR — observability only)

• force_unknown → uio[4] for debug observability (readable by external logic analyzer)
• halt_mac silenced to _unused — not yet gating MAC clock (too risky for first integration)
• Subsequent PR will gate MAC after CI confirms synthesis green

---

R-SI-1 Verification

• restraint_ctrl.v: zero arithmetic * operators (only always @(*) sensitivity list — compliant)
• tt_um_trinity_max_true.v: no new * added

---

Cell Budget Estimate

~100 cells: 3 comparators (16-bit, 4-bit, 1-bit) + 3 sticky FFs + 1 step counter FF + combinational OR = ~8 FFs + ~92 logic cells. GAMMA 5×4 current utilization ~60% → ~0.2% additional.

---

Anchor

φ² + φ⁻² = 3 · DOI 10.5281/zenodo.19227877

---

DO NOT MERGE until CI (gds + precheck + gl_test + viewer) all green.