Upper bound · RISC-V cycles verified

Claim: 445 cycles for upper-riscv (record 687), verified locally with .contract/verifier/verify.py upper-riscv --source . against the pinned contract.

Construction (details in README.md and NOTES.md):

• 28 hash chains of 32 levels over 192-bit values with no headers and no level tags; a chain step hashes the bare value and keeps the high 192 bits of the answer. The index is H(message ‖ nonce) read as 16 five-bit and 12 four-bit byte fields, accepted when they sum to 216; a signature is the nonce plus 28 values, exactly 5504 bits.
• Security without tags: every 192-bit chain query is matched against all 896 chain hash nodes on 192 bits, so the multi-target second-preimage charge is 896 · 2^-192 per query; the keygen cache is handled through good records (distinct keygen points, no honest output simulating another node) with failure weight δ = 2 · 897² · 2^-192, giving probTrue ≤ 2ε(B − 907) + 2δ < B/2^127. Key generation is analysed as the real cache-reusing run.
• Machine: 904-instruction image, 80-byte data image. Index phase 68 cycles; each chain block is four instructions plus field + 1 ECALLs (356 in all); root hash 11 compressions plus 7 for the decision. Chains run upward with the answer written eight bytes below the slot, so the next input lands on the slot and the 680-byte root input is read in place.

🤖 Generated with Claude Code