Model bring-up on silicon you have already bought

A new accelerator earns nothing until models run correctly on it. Bringing one up is measured in weeks to months, and the majority of that window is spent establishing that the lowering is correct rather than making it run at all.

The hardware is installed and idle

The fleet is racked. The toolchain compiles. A model runs, and produces numbers. What nobody can yet say is whether those numbers are the ones the reference implementation would have produced, and until someone can say it, the fleet is not carrying production traffic.

That gap is closed today by testing: differential comparison against a reference, coverage over representative inputs, and engineering judgment about when enough is enough. It closes slowly, it reopens on the next model release, and it never reaches certainty.

Lowering

Specifications to Compute Fabric

LOGOS acts as one executable specification across every level. Each step carries an obligation that the semantics of the level above are preserved, so correctness is established once rather than retested per model.

Every toolchain has these levels. The obligation on each transition is what makes the bottom rung something you can rely on rather than something you have to test.

One specification, lowered through four levels to the chipAn inverted pyramid, apex down, cut into four layers. The LOGOS source is the wide base at the top. Below it the interpreter, then the register virtual machine, each layer narrower by exactly the ratio its height is lower, because every cross-section of a pyramid is similar to the base. The dataflow tiles are the tip, and from the tip a beam lands on a chip drawn as an eight by eight grid of tiles, the spatial compute fabric. Each transition between layers carries a discharged proof obligation that semantics are preserved.01020304

  1. Source

    LOGOS, the executable specification

    Proof obligation dischargedsemantics preserved

  2. Interpreter

    Reference semantics, software

    Proof obligation dischargedsemantics preserved

  3. Register VM

    Sequential execution model

    Proof obligation dischargedsemantics preserved

  4. Dataflow tiles

    Spatial placement, physical fabric

    The tip lands on the chip.

ProvenZero counterexamples

Every lowering discharges its proof obligation in our proof kernel, and the 8x8 run of the int8 matmul primitive matches an independent reference oracle, checksum 510,720. The kernel behind that proof finishes families Z3 and Kissat do not.

The specification is lowered through four levels, from the LOGOS source to the dataflow tiles, and the tip of that lowering lands on the spatial compute fabric. Each lowering carries a discharged proof obligation that semantics are preserved, which is what makes the bottom level something to rely on rather than something to test.

Verification stops being the long pole

The int8 quantized matmul primitive executes on the fabric and agrees bit for bit with an independent reference implementation, verified on physical hardware. The obligation re-runs on every build, across 15,725+ passing regression tests inside existing pipelines.

Designing the silicon rather than buying it? Design verification and signoff

How is agreement with the reference actually established?

How the obligation is discharged