Documentation

LeanMlir.Proofs.Codegen.StableHLOPretty

StableHLOPretty — the printer: SHlo terms → StableHLO text #

The syntactic half of StableHLO: pretty B g renders a term of the AST whose denotation den the proofs are about. SSA names are annotations den ignores, and skel erases the ℝ values, so the rendered text depends on the graph's shape and names only.

partwhat
ty / tyI1 / tyBf16 / tyF8, fresh, the ShapeTbl helperstype strings, SSA names, the name ↦ shape table
Raw, skelthe value-erased skeleton of an SHlo term
Tok, toToksthe post-order token stream
emitContract, emitTok, serializeToksStableHLO text per token (f32 / bf16 / fp8)
pretty, prettyAdamW, prettyAllReduceMean, renderModulewhole graphs and modules
fmt6 / fmt12, OptKind, RmsHyper, bias-slot helpersthe literal and constant blocks the renderers share
*ModuleV, linTrainStepFaithfulVthe chapter 1–3 renderers

A module that states den facts imports StableHLO alone; one that renders text imports this. Trusted residue: the text's lexical conformance to the StableHLO spec is checked by execution (iree-compile / PJRT) and by the StableHLOParse round-trip, not proved.

Tensor-type string tensor<d₀x…xf32>.

Equations
Instances For

    Boolean (i1) tensor-type string, for compare/select masks.

    Equations
    Instances For

      bf16 tensor-type string, for the convertF round node (planning/archive/bf16_renderer.md). Only the round trip uses it today; when a bf16-operand dot_general lands (rung 2+) this is the type its operands carry.

      Equations
      Instances For

        fp8 peer of tyBf16. E4M3 only — planning/archive/cifar_lowprec_stability.md §2.3 measured that f8E5M2 compiles, lowers to a plain __cublas$lt$matmul, and leaves ZERO f8e5m2 values in the optimized HLO: the type is silently widened away. Only E4M3 reaches the fp8 units on sm_89, so there is deliberately no E5M2 spelling here.

        Equations
        Instances For
          @[reducible, inline]

          SSA name ↦ the [c,h,w] the value bound to that name really carries. See liftPointwise.

          ⚠⚠ Keyed by NAME, not by flat width — and that is not a refinement, it is the whole correctness of the table. A width table collides whenever two layers have the same element count, and on the real nets they do: ConvNeXt-T's stage-2 MLP is 1536·14·14 = 301056 and its stage-0 block is 96·56·56 = 301056; stage 3's 3072·7·7 equals stage 1's 192·28·28. First writer won, so 24 of ConvNeXt's pointwise blocks unflattened to a shape with the right element count and the wrong layout — which is not a wrong program (the bracket is still an inverse reshape pair) but is exactly the relayout the bracket exists to remove. Measured: 2.434 GB of transposes and 84.45 ms/step keyed by width, 0.122 GB and 68.28 ms keyed by name.

          Newest entry first, and no dedup: fresh never reuses a name, so a lookup for a value the previous token produced hits the head of the list.

          ⚠⚠ The Bool is the value's LAYOUT: true means this is the map's row view [h·w, c] rather than the map [c, h, w]. It is not bookkeeping — it is what makes ConvNeXt's channel-LN transparent. That chain is transpose → lnRow → rowScale → rowBias → transpose, a layout ROUND TRIP whose two ends are the same [c,h,w] map; without the flag the closing transpose's result has no entry, the drop-path multiply that consumes it falls back to flat, and every pointwise op after it on the residual chain goes with it — 0.223 GB of relayout against 0.122 (measured, ConvNeXt-T bf16). And liftPointwise must NOT fire on a row view: [h·w, c] reshaped to [B,c,h,w] is a DIFFERENT permutation, not an inverse pair, so that one would be a wrong program rather than a slow one.

          Equations
          Instances For
            @[reducible, inline]

            Emitter state: the fresh-name counter, plus the name ↦ [c,h,w] table.

            ⚠ The table lives in the STATE rather than in a pretty argument because a net renderer calls pretty once per graph FRAGMENT — a conv and the activation that consumes it land in different calls — and only the state is threaded across them.

            Equations
            Instances For

              Fresh SSA name %v{k}.

              Equations
              Instances For
                def Proofs.StableHLO.maxPool3s2FwdText (B c h w : ℕ) (r xn ninf p o : String) :

                The 3×3/s2 pool's emitted forward text, given already-freshened names.

                ⚠⚠ It is a shared helper rather than two copies for the reason sWGradGeom is (§2f-bis): the per-example .maxPool3s2F and the batched BatchableOp.maxPool3s2 are two emitTok arms emitting one program, and a window or padding that drifted between them would be a pair of renders that agree on every structural check and compute different functions — which is the exact failure this whole op exists to fix. With one writer they cannot drift, and TestBatchedEmitTie then measures rather than assumes it.

                window_dimensions = 3, window_strides = 2, padding = [[1,1],[1,1]] on the spatial axes: He et al./torchvision MaxPool2d(3, stride=2, padding=1), window i = input [2i−1, 2i+1]. ⚠ NOT XLA 'SAME', which pads (0,1) and slides the grid one input position — the two are different functions everywhere.

                Instances For
                  def Proofs.StableHLO.maxPool3s2BackText (B c h w : ℕ) (xN r xr dr z scn o : String) :

                  The 3×3/s2 pool's emitted backward text, given already-freshened names. Shared by the per-example and batched arms, for maxPool3s2FwdText's reason.

                  ⭐ Only the window attributes differ from maxPoolBack's emit — nothing else — because select_and_scatter's scatter region already reduces with add, which is exactly the accumulation overlapping windows need. The emitter was general enough before the op existed.

                  ⚠ %sa/%sb/%sc/%sd are hardcoded region block arguments and are therefore RESERVED SSA names (§4): a top-level value of the same name is a redefinition error that surfaces only at XLA compile time.

                  Instances For

                    The stochastic-depth mask input name for ramp index i — the mName a dropPathB carries, and the tensor<Bxf32> the signature declares for it.

                    ⚠ It lives HERE, beside the emitter, rather than in one net's renderer, because the spelling is load-bearing in three places that must agree and only one of them is Lean: dropPathP's emit reads it as an operand, every SD render's signature declares it, and scripts/misplace_drop_sites.py matches %dp\d+ textually to build the placement control. A second definition would be the double-writer disease with a committed shell script as the third writer. (It started in EfficientNetRender.lean and moved when ConvNeXt needed it too; both renderers are in this namespace, so no call site changed and no artifact byte moved.)

                    Equations
                    Instances For

                      The classifier-dropout mask input name — the mName a dropoutB carries, and the tensor<B×n×f32> the signature declares for it.

                      ⚠⚠ IT IS DELIBERATELY NOT %dp{i}-SHAPED, and that is not cosmetic. scripts/misplace_drop_sites.py builds the stochastic-depth placement control by matching %dp\d+ textually; a dropout input spelled %dp9 would be swept into that rewrite, silently changing a control's meaning on a render it was never written for. Handoff §0.11 records the other half of this hazard on ViT — a control that quietly does nothing reads exactly like a control that ran — and the cheap defence is a name the SD tooling cannot match. grep -c '%do' verified_mlir/*.mlir is 0 across every committed artifact.

                      Equations
                      Instances For

                        The renderable skeleton of an SHlo graph: opcodes + shapes + leaf SSA names, with ℝ operand values and the shape index erased — exactly what reaches the emitted text.

                        Instances For

                          The (tag, names, info) skeleton descriptor of a batched per-example op — the discriminator + the SSA names the emit references + the shape dims. Keeps the batchOp skel one line and isolates the 7-variant match into a pure function.

                          Equations
                          Instances For

                            Erase an SHlo graph to its renderable skeleton (drops ℝ values + shape index; keeps op structure, shapes, leaf names).

                            Instances For

                              One serialized token: an opcode with shapes/names; operands are positional.

                              Instances For
                                Equations
                                • One or more equations did not get rendered due to their size.
                                Instances For

                                  Postorder serialization: children, then the node's opcode token.

                                  Equations
                                  Instances For

                                    The full entry — [c,h,w] plus the row-view flag — recorded for SSA name nm.

                                    Equations
                                    Instances For

                                      The [c,h,w] nm carries as a map. A row view answers none: it holds the same elements in a different order, so unflattening it to [B,c,h,w] would not be an inverse pair.

                                      Equations
                                      Instances For

                                        Record nm ↦ [c,h,w] + layout, newest first. fresh never reuses a name, so an entry can never be contradicted by a later one; an .operand name re-pushed in a later fragment repeats.

                                        Equations
                                        Instances For

                                          Record nm as carrying the [c,h,w] MAP (not a row view).

                                          Equations
                                          Instances For

                                            The [c,h,w] the running table has for the value bound to nm, as a map.

                                            Equations
                                            Instances For

                                              The full entry the running table has for nm.

                                              Equations
                                              Instances For

                                                Record what one token's operand and result carry, given the operand-name stack before and after it was emitted. Called from serializeToks, so no emitTok arm has to know about the table — which is what keeps the 94 arms free of it.

                                                ⭐ Three cases, and the first two exist only for the channel-LN round trip: a transpose FLIPS the layout flag when its (m,n) match the operand's [c,h,w] (and records nothing when they do not, e.g. ViT's attention transposes, which are not maps at all), and the row ops carry it through unchanged. Everything else reads its shapes off the tag.

                                                Equations
                                                • One or more equations did not get rendered due to their size.
                                                Instances For

                                                  Render a pointwise block at its 4-D shape when the OPERAND's producer recorded one. k receives the (possibly unflattened) input name and the dims to type its ops with, and returns (text, result name).

                                                  ⚠ The c*h*w == n guard is what keeps a mismatched entry from emitting an ill-typed reshape rather than merely a suboptimal one. It cannot fire today — an entry is written by the token that produced the name — and it is the difference between a missed optimisation and a render that does not parse, so it stays.

                                                  ⭐ The block's own RESULT is recorded too, which is what lets a pointwise CHAIN stay 4-D: the value crossing the token boundary keeps its flat type, so without this the second op in a swish→multiply→add chain would find nothing for its operand and drop back to flat.

                                                  Equations
                                                  • One or more equations did not get rendered due to their size.
                                                  Instances For

                                                    Two-tensor-operand peer of liftPointwise; both operands carry the same flat width. The shape comes from whichever operand has one — the cotangent first, since it is the stack operand and was produced nearby, then the saved activation.

                                                    Equations
                                                    • One or more equations did not get rendered due to their size.
                                                    Instances For

                                                      The text of the cross-replica mean — ViTRender.emitGradAllReduce's body, verbatim, so that the allReduceMean token re-renders every committed *dp* artifact byte-identically. all_reduce(add) over replica_groups = [[0..R-1]], then a divide by R; the names are %arsum{t} … %armean{t} from the tag rather than fresh. At R ≤ 1 there is no text and the operand's name is the result, exactly as the text function did.

                                                      Equations
                                                      • One or more equations did not get rendered due to their size.
                                                      Instances For

                                                        The compute precision a contraction tag asks for: …Bf16 bf16, …F8 fp8 (E4M3), otherwise f32 (none) — as the type printer of the low-precision operands.

                                                        Equations
                                                        Instances For
                                                          def Proofs.StableHLO.emitContract (lp : Option (List ℕ → String)) (x y : String) (xs ys rs : List ℕ) (op : String → String → String) (lowResult : Bool := true) :

                                                          One contraction at a compute precision — the stablehlo.convolution / dot_general line of an emit arm, op lhs rhs being its text between = and the type signature. lp = none is the f32 op. lp = some t converts both operands to t and types the op in t; with lowResult the result is t too and is converted back to f32 — the bf16 / fp8 shape (an f32-typed conv result compiles to pure f32, flatConvFBf16) — and without it the result stays f32, the dot shape whose f32 result IS the accumulator (dotInBf16). Names are drawn in that order (the two converts, the op, the convert back), so an arm draws the same %v numbers at every precision. Returns the text and the f32 result's name.

                                                          Equations
                                                          • One or more equations did not get rendered due to their size.
                                                          Instances For

                                                            The input-side dense contraction x · W (dotIn / dotInBf16).

                                                            Equations
                                                            • One or more equations did not get rendered due to their size.
                                                            Instances For
                                                              def Proofs.StableHLO.emitFlatConv (B : ℕ) (lp : Option (List ℕ → String)) (w b : String) (ic oc h w' kH kW : ℕ) (r : String) :

                                                              The flat-carrier SAME conv + bias (flatConvF / flatConvFBf16): reshape the [B, ic·h·w] carrier to NCHW, convolve at lp's precision (emitContract), add the broadcast bias, flatten.

                                                              Equations
                                                              • One or more equations did not get rendered due to their size.
                                                              Instances For
                                                                def Proofs.StableHLO.emitMatmul (B : ℕ) (lp : Option (List ℕ → String)) (a b : String) (m k n : ℕ) :

                                                                The flattened batched matrix multiply C = A·B (matmulF / "matmulFBf16"): reshape both operands to rank 3, dot_general with batching dim 0 (A's last axis against B's middle) at lp's precision, reshape back to flat.

                                                                Equations
                                                                • One or more equations did not get rendered due to their size.
                                                                Instances For

                                                                  The squeeze-excite activations inside one seBlock emission, by name: the squeeze (GAP, [B,c]), the reduce dense + bias ([B,r]), its swish, and the excite dense + bias ([B,c]) — the four values the SE backward reads. k0 is the fresh-name counter when the seBlock token is emitted. The offsets are the order the "seBlock" arm of emitTok below calls fresh in (sq 5th, ex 8th, a1 10th, h2 13th); the #guard after emitTok checks each name is defined by the op it claims. A renderer that saves these reuses the SE the forward already computes instead of emitting a second, un-fused copy.

                                                                  Equations
                                                                  Instances For

                                                                    Render one token: pop its operands' result-names off the stack, emit its StableHLO line(s), push its fresh result name. The per-op StableHLO syntax here is the audited lexical boundary (validated by iree-compile + GPU run); the structure it consumes is the proven-faithful token stream.

                                                                    Instances For

                                                                      Fold a token stream to accumulated (code, result-name-stack).

                                                                      Equations
                                                                      Instances For

                                                                        The bias's slot in a return-name list, gated the way biasName gates the operand: with convBias := false no bias SGD op is emitted, so the slot must LEAVE the list rather than carry the empty string the if convBias then … else pure ("", "") idiom hands back.

                                                                        ⚠ This exists because leaving it in is silent twice over. An empty name renders return %a, , %b — malformed text, but only the lowerer ever sees it; and the name list keeps its FULL length, so an arity #guard on the signature still passes. Measured on the first swap attempt: mobilenetv2_train_step at convBias := false returned 210 names (52 of them empty) against 160 types. Use this at every site where a names := [...] list is built from gated ops.

                                                                        Equations
                                                                        Instances For
                                                                          def Proofs.StableHLO.zeroBiasPrelude (convBias : Bool) (widths : List ℕ) :

                                                                          The zero-bias constants the convBias := false render consumes, one per channel width used as a conv bias. Emitted once at the top of the body; XLA folds the resulting add.

                                                                          Equations
                                                                          • One or more equations did not get rendered due to their size.
                                                                          Instances For

                                                                            Fixed-6-decimal float literal, so a computed smoothing constant emits in the SAME textual form the hand-written literals used and nClasses = 10 re-renders byte-identical.

                                                                            Equations
                                                                            • One or more equations did not get rendered due to their size.
                                                                            Instances For

                                                                              Fixed-12-decimal float literal, for constants fmt6 would destroy.

                                                                              ⚠ It exists because fmt6 is not a formatting preference, it is a PRECISION CEILING, and small derived constants fall straight through it. Gradient accumulation's second-moment coefficient is (1−β₂)/K²; at K = 4 that is 6.25e-5, which fmt6 emits as 0.000063 — 0.8% wrong, in a baked literal, in the optimizer, where nothing downstream would question it. Same class as §2k's hardcoded 0.010000 label-smoothing mass. fmt6 stays the default so every committed artifact re-renders byte-identically; this is for constants that need the room.

                                                                              Equations
                                                                              • One or more equations did not get rendered due to their size.
                                                                              Instances For
                                                                                def Proofs.StableHLO.alphaOverK (nClasses : ℕ) (alpha : Float := 0.1) :

                                                                                The label-smoothing mass per class, α/K. α = 0.1 throughout; K is nClasses.

                                                                                ⚠ This was hardcoded 0.010000 — correct at K = 10 and WRONG at every other K, and it sat in the COTANGENT, not just in the report-only %loss. At nClasses = 1000 it made the smoothing term 100× too large: it removes 10.0 of probability mass instead of 0.1, i.e. a different objective, silently. Caught 2026-07-30 by the first ImageNet smoke run reporting loss ≈ 87 where 1000-class CE at init must be ≈ ln(1000) = 6.9 — the number was implausible, and that is the only reason it surfaced. Nothing in the repo's proofs covers it: α is a literal in emitted text, which is exactly the carve-out class §5 says needs its own numeric check, and §2b's %loss bug is the standing precedent for it going wrong unnoticed.

                                                                                Equations
                                                                                Instances For

                                                                                  1 − α, the ON-class weight of label-smoothed CE. Emitted beside alphaOverK, because the two always move together and splitting them is how one of them gets updated alone.

                                                                                  Equations
                                                                                  Instances For

                                                                                    1 − ρ, the RMSProp mean-square mixing weight. Derived from ρ, never written as a second literal beside it — the oneMinusAlpha precedent, and the K-constant lesson (§2k): any emitted constant that depends on a hyperparameter must be DERIVED, because the copy is what gets left behind when the original moves. Five copies of one label-smoothing constant were found across four nets in a single session for exactly this reason.

                                                                                    Equations
                                                                                    Instances For

                                                                                      Which optimizer tail a whole-net render emits. .adamw is every net's committed default and reproduces the existing artifacts byte-identically; .rmsprop is what the MobileNetV2 and EfficientNet ImageNet references actually use (planning/archive/recipe_gaps.md v1.2).

                                                                                      Lives here rather than in either renderer because both need it: a per-net copy of a two-constructor choice is the double-writer disease one level down, in code — the same argument vitBackAll/enetBackAll exist for (§2a-quater). Each renderer threads it through ONE traversal, so gate 1 applies for free: at .adamw every committed artifact must re-render byte-identical.

                                                                                      Instances For
                                                                                        @[instance_reducible]
                                                                                        Equations
                                                                                        Equations
                                                                                        • One or more equations did not get rendered due to their size.
                                                                                        Instances For

                                                                                          The RMSProp hyperparameters, as the JAX reference configs state them. ρ/μ are 0.9 on both nets that use this optimizer; ε and wd are what differ, and ε differs in the way that matters most (see Proofs.rmsBufNext_eps_placement_at_zero).

                                                                                          • rho : Float

                                                                                            rmspropDecay — the running mean-square decay.

                                                                                          • mu : Float

                                                                                            momentum — μ for the buffer on the normalised gradient.

                                                                                          • eps : Float

                                                                                            rmspropEps — ⚠ emitted INSIDE the square root (TensorFlow), not added to the root.

                                                                                          • wd : Float

                                                                                            COUPLED L2 (folded into the gradient), not AdamW's decoupled decay.

                                                                                          Instances For

                                                                                            ρ / (1−ρ) / μ / ε / wd as graph constants — the RMSProp peer of each renderer's adamConsts block. %lr stays a runtime tensor<f32> arg so one graph serves a whole LR schedule.

                                                                                            Equations
                                                                                            • One or more equations did not get rendered due to their size.
                                                                                            Instances For

                                                                                              MobileNetV2's RMSProp knobs (jax/MainMobilenetV2Imagenet.lean): ε = 1.0.

                                                                                              Equations
                                                                                              Instances For

                                                                                                EfficientNet-B0's RMSProp knobs (jax/MainEfficientNetImagenet.lean): ε = 1e-3.

                                                                                                Equations
                                                                                                Instances For

                                                                                                  pretty — render an SHlo graph to StableHLO, now defined as serialize ∘ toToks ∘ skel: tokenize the graph (postorder), then print the tokens. The emitter shares ONE structured form with the parser, so the round-trip parse (toToks (skel a)) = skel a (StableHLOParse.lean) is about the very tokens this prints — the printer can't structurally drift.

                                                                                                  Equations
                                                                                                  • One or more equations did not get rendered due to their size.
                                                                                                  Instances For
                                                                                                    @[reducible, inline]

                                                                                                    The rounding a render hands the bf16/fp8 ops: the identity. A placeholder, exactly as a renderer's zero kernels are: a render produces TEXT, skel erases every ℝ payload before a token is emitted, and the emitted text is decided by the tag. The rounding-bearing den lives in the tie theorems, where rnd is arbitrary and the accuracy statement (Proofs/Float/*MixedFloatBridge.lean) instantiates it at bf16 round-to-nearest with |rnd x − x| ≤ 2⁻⁸|x|. A render that baked a concrete rounding here would be claiming the emitter knows about it, which it does not.

                                                                                                    Equations
                                                                                                    Instances For

                                                                                                      The cross-replica gradient mean as pretty of the allReduceMeanF node — the drop-in for ViTRender.emitGradAllReduce in every batched render (4d piece 2, 2026-09-07), measured byte-identical on every committed *dp* artifact. At replicas ≤ 1 it emits nothing and threads the gradient's name, exactly as the text function did. The R operand graphs are all .operand grad at a zero placeholder, because a render is value-independent — skel erases values — while the family is what den sums over in the tie.

                                                                                                      Equations
                                                                                                      • One or more equations did not get rendered due to their size.
                                                                                                      Instances For
                                                                                                        def Proofs.StableHLO.prettyAdamW (B : ℕ) (nm : String) (ds : List ℕ) (grad : String) (wdName : String := "%wd") :

                                                                                                        One parameter's AdamW update, as pretty of the proven triple — adamMNextF, adamVNextF and the decoupled-decay adamWParamF on the gradient grad, reading the graph constants adamWConsts binds, the step's %bc1/%bc2/%lr, and the decay operand wdName ("%wdz" for a timm no-decay parameter). Returns (code, θ', m', v'); every batched renderer's AdamW tail is this. ⚠ wdName and den's wd must move together: both are 0 here only because every ℝ slot is a placeholder the emit ignores; if that changes, a no-decay site must pass wd := 0 as well as %wdz, or the artifact and the denotation describe different optimizers.

                                                                                                        Equations
                                                                                                        • One or more equations did not get rendered due to their size.
                                                                                                        Instances For
                                                                                                          def Proofs.StableHLO.adamWConsts (wdStr : String := "0.0001") :

                                                                                                          The AdamW graph constants — β₁ = 0.9, β₂ = 0.999, ε = 1e-8 and the baked decay wdStr (1e-4 is the Imagenette recipe every batched net shares; the ImageNet configs pass their own).

                                                                                                          Equations
                                                                                                          • One or more equations did not get rendered due to their size.
                                                                                                          Instances For
                                                                                                            def Proofs.StableHLO.renderModule (name argSig : String) (B retLen : ℕ) (g : SHlo retLen) :

                                                                                                            Wrap a rendered single-result graph as a func.func module.

                                                                                                            Equations
                                                                                                            • One or more equations did not get rendered due to their size.
                                                                                                            Instances For
                                                                                                              def Proofs.StableHLO.linearFwdModuleV (B d₀ d₁ : ℕ) (W : Mat d₀ d₁) (b : Vec d₁) (x : Vec d₀) :

                                                                                                              @linear_fwd rendered from the verified AST.

                                                                                                              Equations
                                                                                                              • One or more equations did not get rendered due to their size.
                                                                                                              Instances For
                                                                                                                def Proofs.StableHLO.linearBackModuleV (B d₀ d₁ : ℕ) (W : Mat d₀ d₁) (dy : Vec d₁) :

                                                                                                                @linear_back rendered from the verified AST.

                                                                                                                Equations
                                                                                                                • One or more equations did not get rendered due to their size.
                                                                                                                Instances For
                                                                                                                  def Proofs.StableHLO.linearTrainStepModuleV (B d₀ d₁ : ℕ) (lr : String) (W : Mat d₀ d₁) (b : Vec d₁) (x : Vec d₀) :

                                                                                                                  The full @linear_train_step rendered from the verified AST: forward + softmax-CE cotangent come from pretty (lossCotGraph …) (the %onehot operand value is pretty-irrelevant, so any placeholder renders the same text — at runtime %onehot is a graph input); the weight grad (dot_general over the batch axis), bias grad (reduce), and the SGD multiply/subtract updates are appended. Returns the two updated params. The verified-AST peer of IRPrint.linearTrainStepModule.

                                                                                                                  Instances For
                                                                                                                    def Proofs.StableHLO.linTrainStepFaithfulV (B m n : ℕ) (lrStr : String) (W : Mat m n) (b : Vec n) (x : Vec m) :

                                                                                                                    The linear train step rendered ENTIRELY from the verified AST. Unlike linearTrainStepModuleV (forward via pretty, tail hand-written), here the whole module is pretty of denoted nodes: the cotangent (lossCotGraph, rendered once → shared %dy), then the two fused SGD ops weightSgd/biasSgd that consume %dy. So every emitted line is pretty(provenNode) and LinearFold proves the two outputs' den = the certified loss-descent SGD step. The lr ℝ / operand values are skel-erased (render is value-independent), so placeholders here render identically to the live graph the den theorems use.

                                                                                                                    Equations
                                                                                                                    • One or more equations did not get rendered due to their size.
                                                                                                                    Instances For
                                                                                                                      def Proofs.StableHLO.mlpFwdModuleV (B d₀ d₁ d₂ d₃ : ℕ) (W₀ : Mat d₀ d₁) (b₀ : Vec d₁) (W₁ : Mat d₁ d₂) (b₁ : Vec d₂) (W₂ : Mat d₂ d₃) (b₂ : Vec d₃) (x : Vec d₀) :

                                                                                                                      @mlp_fwd rendered from the verified forward AST mlpFwdGraph.

                                                                                                                      Equations
                                                                                                                      • One or more equations did not get rendered due to their size.
                                                                                                                      Instances For
                                                                                                                        def Proofs.StableHLO.cnnFwdModuleV (B ic c h w d1 nClasses kH kW : ℕ) (W₁ : Kernel4 c ic kH kW) (b₁ : Vec c) (W₂ : Kernel4 c c kH kW) (b₂ : Vec c) (W₃ : Mat (c * h * w) d1) (b₃ : Vec d1) (W₄ : Mat d1 d1) (b₄ : Vec d1) (W₅ : Mat d1 nClasses) (b₅ : Vec nClasses) (x : Vec (ic * (2 * h) * (2 * w))) :

                                                                                                                        @cnn_fwd rendered from the verified CNN forward AST cnnFwdGraph.

                                                                                                                        Equations
                                                                                                                        • One or more equations did not get rendered due to their size.
                                                                                                                        Instances For
                                                                                                                          def Proofs.StableHLO.cifarFwdModuleV (B ic c1 c2 h w d1 nClasses kH kW : ℕ) (W₁ : Kernel4 c1 ic kH kW) (b₁ : Vec c1) (W₂ : Kernel4 c1 c1 kH kW) (b₂ : Vec c1) (W₃ : Kernel4 c2 c1 kH kW) (b₃ : Vec c2) (W₄ : Kernel4 c2 c2 kH kW) (b₄ : Vec c2) (W₅ : Mat (c2 * h * w) d1) (b₅ : Vec d1) (W₆ : Mat d1 d1) (b₆ : Vec d1) (W₇ : Mat d1 nClasses) (b₇ : Vec nClasses) (x : Vec (ic * (2 * (2 * h)) * (2 * (2 * w)))) :

                                                                                                                          @cifar_fwd rendered from the verified CIFAR forward AST cifarFwdGraph.

                                                                                                                          Equations
                                                                                                                          • One or more equations did not get rendered due to their size.
                                                                                                                          Instances For
                                                                                                                            def Proofs.StableHLO.cifar8FwdModuleV (B ic c1 c2 c3 c4 h w d1 nClasses kH kW : ℕ) (W₁ : Kernel4 c1 ic kH kW) (b₁ : Vec c1) (W₂ : Kernel4 c1 c1 kH kW) (b₂ : Vec c1) (W₃ : Kernel4 c2 c1 kH kW) (b₃ : Vec c2) (W₄ : Kernel4 c2 c2 kH kW) (b₄ : Vec c2) (W₅ : Kernel4 c3 c2 kH kW) (b₅ : Vec c3) (W₆ : Kernel4 c3 c3 kH kW) (b₆ : Vec c3) (W₇ : Kernel4 c4 c3 kH kW) (b₇ : Vec c4) (W₈ : Kernel4 c4 c4 kH kW) (b₈ : Vec c4) (W₉ : Mat (c4 * h * w) d1) (b₉ : Vec d1) (Wa : Mat d1 d1) (ba : Vec d1) (Wb : Mat d1 nClasses) (bb : Vec nClasses) (x : Vec (ic * (2 * (2 * (2 * (2 * h)))) * (2 * (2 * (2 * (2 * w)))))) :

                                                                                                                            @cifar8_fwd rendered from the verified 8-conv CIFAR forward AST cifar8FwdGraph (cifar8FwdGraph_faithful proves it denotes cifarCnn8Forward). The 4-stage peer of cifarFwdModuleV — the committed verified_mlir/cifar8_fwd.mlir is renderModule(provenGraph).

                                                                                                                            Equations
                                                                                                                            • One or more equations did not get rendered due to their size.
                                                                                                                            Instances For
                                                                                                                              def Proofs.StableHLO.cifar8BnFwdModuleV (B ic c1 c2 c3 c4 h w d1 nClasses kH kW : ℕ) (epsStr : String) (W₁ : Kernel4 c1 ic kH kW) (b₁ : Vec c1) (ε₁ : ℝ) (γ₁ β₁ : Vec c1) (W₂ : Kernel4 c1 c1 kH kW) (b₂ : Vec c1) (ε₂ : ℝ) (γ₂ β₂ : Vec c1) (W₃ : Kernel4 c2 c1 kH kW) (b₃ : Vec c2) (ε₃ : ℝ) (γ₃ β₃ : Vec c2) (W₄ : Kernel4 c2 c2 kH kW) (b₄ : Vec c2) (ε₄ : ℝ) (γ₄ β₄ : Vec c2) (W₅ : Kernel4 c3 c2 kH kW) (b₅ : Vec c3) (ε₅ : ℝ) (γ₅ β₅ : Vec c3) (W₆ : Kernel4 c3 c3 kH kW) (b₆ : Vec c3) (ε₆ : ℝ) (γ₆ β₆ : Vec c3) (W₇ : Kernel4 c4 c3 kH kW) (b₇ : Vec c4) (ε₇ : ℝ) (γ₇ β₇ : Vec c4) (W₈ : Kernel4 c4 c4 kH kW) (b₈ : Vec c4) (ε₈ : ℝ) (γ₈ β₈ : Vec c4) (W₉ : Mat (c4 * h * w) d1) (b₉ : Vec d1) (Wa : Mat d1 d1) (ba : Vec d1) (Wb : Mat d1 nClasses) (bb : Vec nClasses) (x : Vec (ic * (2 * (2 * (2 * (2 * h)))) * (2 * (2 * (2 * (2 * w)))))) :

                                                                                                                              @cifar8_bn_fwd rendered from the verified 8-conv per-channel-BN CIFAR forward AST cifar8BnFwdGraph (cifar8BnFwdGraph_faithful proves it denotes cifarCnnBn8Forward). The BN peer of cifar8FwdModuleV.

                                                                                                                              Equations
                                                                                                                              • One or more equations did not get rendered due to their size.
                                                                                                                              Instances For