HyperForje — Status, Specs & Roadmap

Current status snapshotAs of 2026-09-06, reconciled against the on-disk specs and the GitHub tracker.

40%

backlog completion (27.5 / 68 items)

13 / 39

specs implemented (10 partial · 16 not)

853 / 2,525

spec task boxes ticked (34%)

designs proven RTL→GDSII

One distinction runs through everything here: "fixed in code" is not "live in the account". Several finished specs ship a feature switched off in infrastructure, and the Well-Architected remediation is 38/38 in the repo but 0 deployed. The security page carries the deployment-state detail.

Two deployed environments, different builds

Env	Mode	What runs	Proven
POC (primary account)	tools in-image, S3 workspace	7 stacks UPDATE_COMPLETE · 13 runtimes READY · Well-Architected remediation live	calc4 prompt→GDSII, 7/7 gates PASS
DEV (`aes-dev` stack)	S3 artifact workspace, PCS/Slurm P&R on FSx	8 stacks · 13 runtimes · 3 PCS compute groups ACTIVE (min0/max1)	AES-128 & PicoRV32 to accepted GDS

SOW deliverables → completionThe 19 in-scope deliverables (D1–D19) from the Statement of Work, mapped to what the code actually does today.

#	Deliverable	Status	Evidence / note
D1	Step Functions pipeline DAG	Delivered	87-state ASL owns the full RTL→GDSII flow; shipped pipeline spec 109/109
D2	13 agent runtimes	Delivered	One arm64 image, 13 roles; `lint` renamed `verification` (also hosts formal)
D3	8 deterministic gate Lambdas	Delivered	Now 13 gate Lambdas / 7 verdicts on a normal run; no model SDK importable in gates
D4	Async task-token integration	Delivered	`waitForTaskToken` + 60s heartbeat, exactly-one signal on all 13 agents
D5	PCS/Slurm + FSx Lustre	Partial	P&R submits to Slurm (live on DEV, ACT-96 FSx workspace). Simulation still runs in-image everywhere
D6	Per-agent IAM roles	Delivered	13 scoped roles; none holds `InvokeAgentRuntime`
D7	Tool-agnostic adapter contract	Delivered	6 OSS adapters on one contract, `TOOL_REGISTRY`-driven; commercial tiers declared mocks
D8	Bounded fix loops	Delivered	State-machine counter, schema + `iverilog` compile-check before re-entry; run-wide + per-stage budgets
D9	Formal verification gate	Delivered	SymbiYosys + z3 deployed & proven live (2026-08-12); vacuity census demotes zero-assertion proofs
D10	AgentCore Memory (semantic recall)	Partial	Code complete + dedup guard; `MEMORY_ID` reaches no runtime — dead config today
D11	RAG pipeline (OpenSearch + Titan)	Not built	No RAG index in the shipped system
D12	MCP Gateway + Cognito	Partial	Gateway/eda_adapter + Cognito exist but reachable only from the legacy entrypoint; no production caller
D13	Observability pipeline	Partial	Telemetry→Glue→Athena→QuickSight live; GenAI tracing (OTEL) built on `integration`, not deployed
D14	CodeBuild image factory	Delivered	ARM_CONTAINER two-image build → ECR; base hash guards against stale-base builds
D15	CloudFormation IaC	Delivered	Layered stacks foundation→platform→runtimes + compute/notifications/quicksight/cost/gui
D16	Run registry + notifications	Delivered	DynamoDB run record with cost/token rollups; SES/SNS + presigned artifact bundle
D17	Acceptance tests (calc4, AES-128, PicoRV32)	Partial	All three proven RTL→GDSII; AES-128/PicoRV32 as measured runs, but no automated multi-design runner
D18	Documentation	Delivered	Architecture, setup, runbook, prerequisites, benchmarks, backlog — 50 docs
D19	Optional human sign-off gate	Spec only	`pipeline-human-release-preauth` spec exists (0/86); H0/H1/H2 states absent

Two acceptance criteria describe a design the measured runs do not match. AC-7 was written as AES-128 at ~36K instances; the core that runs is 9,710 cells (iterative 11-cycle, ~36K is the unrolled scale). AC-8 was written RV32IMC; the measured core is RV32IM from a frozen package. Amending an acceptance criterion is the owner's call — flagged, not silently reconciled.

The PR/FAQ narrativeThe problem, the promise, and the honesty the FAQ insists on.

The problem

Semiconductor front-end design is 1–3 days of senior-engineer time per standard block, most of it repetitive rule-governed work — and the talent shortage means teams cannot hire fast enough. The routine 60–70% (FIFOs, bus interfaces, encryption cores, state machines, ALUs) follows well-understood patterns, but existing AI copilots offer only code completion, not end-to-end verified design.

The promise

"The critical innovation is the trust model. Every pass/fail verdict is made by a deterministic Lambda function that parses tool exit codes and log files — no AI is involved in any verdict decision. The AI writes the code; mathematical solvers and EDA tools judge it."

Plain-English spec → validated routed GDSII in 3–15 minutes, running entirely in the customer's AWS account with zero design-IP egress, at ~$0.67–2 per run (measured on calc4).

What the FAQ is careful about

"How can I trust AI-generated designs?" — You don't trust the AI, you trust the deterministic verification stack. A formal counterexample is a mathematical proof of a bug; the AI never gets to say "this passed" in a way that matters.
"Verified" means the gates passed, not that the design is correct. For any design without an external vector set, the testbench is generated from the RTL it checks — so a consistently misread spec passes. AES-128 is the exception (FIPS-197 vectors, outside the model), which is why it is the stronger result.
Autonomy is honest L3. The system runs the full workflow autonomously; a human reviews the output. An optional approval gate is config-gated and defaults OFF.
Time-to-silicon speedup is 100–300× for the routine 60–70% of blocks — and the output is engineer-reviewed draft silicon, not signed-off tape-out.

Spec inventory — quality & coverageEvery `.kiro/specs/` folder mapped to implementation status, re-derived from disk. A checked task box is not a live behaviour — the Evidence column names code or a test.

Implemented 13 · Partial 10 · Not built 16 — 39 rows

33% of specs finished. The finished specs are the small ones — 34% of all planned task boxes are ticked.

Spec	Tasks	Status
pipeline-chip-design-orchestrator	109/109	Implemented
agents-agentic-optimization	96/96	Implemented
eda-tool-exit-code-fidelity	95/95	Implemented
gui-desktop-client	104/104	Implemented
eda-waveform-visualization	63/63	Implemented (not yet in a deployed image)
agents-notification-envelope	41/41	Implemented (pending deploy)
agents-runtime-session-identity	10/17	Implemented (code-complete, deploy-unverified)
obs-agent-tracing	63/63	Implemented (on integration, pending deploy)
gui-optional-stage-selection	19/19	Implemented
pipeline-optional-stage-selection	24/24	Implemented (CLI half)
pipeline-mpw-precheck	—	Implemented
pipeline-prelayout-sta	—	Implemented
gui-gds3d-qt-test-allocation	5/6	Implemented
agents-bedrock-guardrails	13/26	Agent code complete, provably inert
agents-memory-strategy-upgrade	17/28	Code complete, `MEMORY_ID` unwired
gds-3d-viewer	40/99	Builder + auto-load works, rest is a shell
gui-chat-style-run-workspace	0/65	Mostly implemented, acceptance unrecorded
obs-business-metrics-fidelity	21/73	Partial
ops-cost-optimization	1/37	Partial (thread config + Graviton5 shipped)
ops-eda-plane-separation	0/71	Partial (PCS P&R + FSx landed; sim boundary reserved)
pipeline-frozen-reference-package	8/9	Backend + CLI implemented
pipeline-signoff-gate-spine	—	Substantially implemented
gui-run-history-tracking	placeholder	Config-only placeholder
agents-complex-design-generation	0/18	Not built
agents-eval-harness	0/74	Not built
agents-model-config-automation	0/102	Not built
agents-taxonomy-realignment	0/20	Not built
eda-physical-signoff	0/37	Not built
gui-concurrent-run-submission	0/95	Not built
gui-run-start-end-time	0/66	Not built
obs-dashboards-agent-analytics	0/91	Not built
obs-visualization	0/72	Not built
ops-acceptance-automation	0/82	Not built
ops-ci-cd-pipeline	0/84	Not built
ops-fsx-workspace-lifecycle	1/59	Not built
ops-security-acceptance-evidence	0/86	Not built
pipeline-coverage-measurement	0/79	Not built
pipeline-human-release-preauth	0/86	Not built
pipeline-repair-taxonomy-corpus	0/90	Not built

Spec quality is high where it counts. Every spec carries requirements/design/tasks; the inventory is reconciled by a script (no hand-maintained counts), and "not built" specs are genuine plans with acceptance criteria — not stubs. Known hygiene items: 3 folders were unrowed and 1 was double-rowed at prior passes (now caught by a 4-check reconciliation), and 3 specId values collide across 6 .config.kiro files (harmless to text, flagged for tooling).

Backlog completion68 numbered items ever opened; completion counted by script, not by hand.

40% = (21 archived + 5 closed-in-place + 0.5×3 partially-closed) / 68. "Partially delivered" items contribute 0 to the numerator by design, so a landed half is visible without inflating the figure.

closed & archived

closed in place

partially delivered / closed

fully open

Highest-value open work (P1)

#57 Self-certification — the testbench is generated from the RTL it certifies. Stamp the oracle class (external-bundle vs model-generated) onto every run. The centrepiece: it changes what a viewer may believe about every other number.
#64/#67 Gate-count under-reporting — the sign-off report and GUI show 6 of 7 gate verdicts (omit spec). Five list literals across two registers.
#66 Task faults bypass the fix loop — a stage that faults never reaches a gate; the formal stage destroyed its own evidence on the way out (half fixed).
#44 Simulation compute boundary — P&R submits to Slurm; simulation still has no submit path (owner-reserved decision).

Three other tallies, none the same number: spec tasks 853/2,525 (34%) · Well-Architected remediation 38/38 in repo, 0 deployed · tape-out readiness 1/30 tasks formally, Phase A substantially built.

Roadmap — tape-out readinessWhat stands between the GDSII candidate and a foundry-accepted handoff. Nothing below is broken; it is absent, and the repo says so consistently.

Phase A — physical implementation completeness substantially built

Real SDC timing constraints (T1), clock tree synthesis (T2, landed), power grid (T3, pinned PDN landed), filler/tap cells (T4), timing repair (T5). Running DRC/LVS before these produces artifacts, not real defects — which is why this phase is first.

Phase B — physical verification gates not built

Magic DRC + Netgen LVS adapters and gates (comparator settled as Netgen), antenna (done) + density, route-DRC promoted to a verdict, ASL wiring, manifest schema v2. The single highest-leverage unlock: the post-GDS sign-off spine is deployed but returns required:false for every prompt-generated design.

Phase C — netlist-level & timing verification not built

Logical equivalence RTL↔netlist↔P&R (no equivalence check exists at any link today), gate-level sim with SDF, extraction + multi-corner STA on the worst corner, power/IR drop, CDC.

Phase D — foundry handoff not built

NDA PDK handling (on FSx, never in the image), foundry signoff decks via the Gateway http/batch tier, chip-level structures (pad frame, seal ring), ECO flow, immutable handoff bundle with Object Lock.

Adjacent roadmap themes

Multi-PDK — Sky130HD is effectively hardcoded; GF180MCU/ASAP7 are parameterisation (days per PDK), not new integration. The GUI picker currently offers 4 PDKs, 3 of which fail at P&R (known defect #55).
Eval harness (#58) — the gates are a trustworthy correctness oracle but not evals; a runner that produces pass-rate/effort/quality scoreboards automatically is missing. Sequenced behind #57.
CI/CD (#50) — there is no CI today; every gate is manual (make check, preflight).
Complex design generation (#68) — the generator has never produced a design the flow has already carried to GDS (PicoRV32 came from a frozen package).