E2b: trinet_node.t27 -- TRI-NET MAC32 job core with SipHash-2-4 receipts (AX7203) #8356

Part of #8327 (E2: TRI-NET node over UDP on the AX7203). Refs #6655.

Goal

A t27 spec for the job core of the TRI-NET node: take the UDP payload that EthRx (#8333) hands out one byte per clock, run one MAC32 job or one key request per datagram, and produce the 19-byte v2 receipt (Y, STATUS, NONCE, NODE_ID, SipHash-2-4 TAG) bit for bit as gHashTag/trinity-fpga src/trinet/protocol.zig defines it. The wire format does not change; only the transport moves from UART to UDP.

Where we are

• The UART node exists in Verilog (fpga/portable/trinet_node_core.v in trinity-fpga) and earns receipts on the bench AX7203 (census 1280/1280 on 2026-10-09). There is no t27 spec for it.
• specs/fpga/eth_rx.t27 (E2a: eth_rx.t27 -- receive path for UDP datagrams to the TRI-NET node (AX7203) #8333, PR feat(fpga): eth_rx.t27 -- receive path of the Ethernet job link (E2a) #8337) gives the payload bytes, done and ok.
• The reply frame (E2c) and RGMII capture on silicon (E2d) are separate issues.

Boundary

• New: specs/fpga/trinet_node.t27, .trinity/seals/fpga_TrinetNode.json.
• Out of bounds: every existing spec, the compiler, wrappers and XDC files, the TRI-NET protocol, trinity-fpga.

User Scenarios & Testing

1. An unkeyed node gets a MAC32 request: the receipt has the right Y, STATUS 4 (no key) and a tag under the zero key.
2. A key request (OP 2) on an unkeyed node installs W||X as the key: STATUS 2, Y 0, tag under the new key. A second key request is refused with STATUS 3 and does not change the key.
3. A keyed node gets MAC32 requests: STATUS 1, tags under the key, equal to protocol.zig for the same inputs.
4. A valid request that arrives while a job runs is dropped and counted; an accepted datagram that is not a request (no AA 55 or shorter than 24 bytes) starts nothing and is counted; a frame that EthRx rejected starts nothing.

Requirements

• R1. Request AA 55 OP NONCE[4] W[8] X[8] TRIG; receipt A5 Y STATUS NONCE[4] NODE_ID[4] TAG[8], little-endian fields; trit codes 01 = +1, 10 = -1, 00/11 = 0.
• R2. TAG = SipHash-2-4 over the 26-byte preimage OP NONCE W X Y NODE_ID; the round functions reproduce the SipHash paper vector (key 00..0f, message 00..0e -> a129ca6149be45e5).
• R3. Reference receipts come from protocol.zig itself (std.hash.SipHash64(2, 4), protocol.dot, Job.setKey) run as a separate Zig program, not from the spec.
• R4. Hardware semantics as in E2a: eth_rx.t27 -- receive path for UDP datagrams to the TRI-NET node (AX7203) #8333: one assignment per var per path, right-hand sides read pre-edge values, no locals in on_clock, no *, at most one 64-bit adder between two registers.

Success Criteria

• t27c test-report specs/fpga/trinet_node.t27: every test passes, 0 vacuous, covering scenarios 1-4 and the paper vector.
• Seven job vectors from protocol.zig (unkeyed, setkey, keyed, locked, three keyed MAC32) give the same Y, STATUS and TAG.
• gen-verilog output synthesises with yosys for xc7a200tfbg484-2 and closes 125 MHz in nextpnr-xilinx out of context.
• Sealed with the compiler built from the PR tree; required checks green.

Requirements

• FR-001: The spec MUST accept request bytes AA 55 OP NONCE[4] W[8] X[8] TRIG and produce receipt bytes A5 Y STATUS NONCE[4] NODE_ID[4] TAG[8] with little-endian fields and trit codes 01 = +1, 10 = -1, 00/11 = 0.
• FR-002: The TAG MUST be SipHash-2-4 over the 26-byte preimage OP NONCE W X Y NODE_ID, and the round functions MUST reproduce the SipHash paper vector (key 00..0f, message 00..0e → a129ca6149be45e5).
• FR-003: Reference receipts for test vectors MUST be generated from protocol.zig itself (std.hash.SipHash64(2,4), protocol.dot, Job.setKey) run as a separate Zig program, not from the spec.
• FR-004: Hardware semantics MUST follow E2a: eth_rx.t27 -- receive path for UDP datagrams to the TRI-NET node (AX7203) #8333: one assignment per variable per path, right-hand sides read pre-edge values, no locals in on_clock, no *, at most one 64-bit adder between two registers.