eml-stdlib 0.4.0__py3-none-any.whl

eml_stdlib/math/sin.eml

@@ -0,0 +1,37 @@
+// sin.eml -- sine, with an explicit chain-order-1 contract.
+//
+// Pythagorean witness function included so downstream proofs of
+// energy conservation / unitarity can inline it directly.
+
+module sin_module;
+
+const PI:     Real = 3.141592653589793
+const TWO_PI: Real = 6.283185307179586
+
+@verify(lean, theorem = "sin_in_unit_interval")
+fn sin_kernel(x: Real) -> Real
+    where chain_order <= 1
+    ensures (result >= -1.0)
+    ensures (result <= 1.0)
+{
+    sin(x)
+}
+
+@verify(lean, theorem = "sin_zero_is_zero")
+fn sin_at_zero() -> Real
+    where chain_order <= 0
+    ensures (result == 0.0)
+{
+    sin(0.0)
+}
+
+// Squared sine -- chain order 1 (the chain budget folds in the
+// double-angle identity). Used by Mach-Zehnder / coupler power
+// ratios so it gets a name + a Lean obligation of its own.
+@verify(lean, theorem = "sin_sq_nonneg")
+fn sin_sq(x: Real) -> Real
+    where chain_order <= 1
+    ensures (result >= 0.0)
+{
+    sin(x) * sin(x)
+}

eml_stdlib/math/sinh.eml

@@ -0,0 +1,24 @@
+// sinh.eml -- hyperbolic sine.
+//
+// sinh(x) = (e^x - e^-x) / 2. Chain order 1 -- the two exps fold
+// through one shared evaluator on most backends.
+
+module sinh_module;
+
+const SINH_X_MAX: Real = 30.0
+
+@verify(lean, theorem = "sinh_zero_is_zero")
+fn sinh_kernel(x: Real) -> Real
+    where chain_order <= 1
+    requires (abs(x) < SINH_X_MAX)
+{
+    sinh(x)
+}
+
+@verify(lean, theorem = "sinh_zero_is_zero_at_zero")
+fn sinh_at_zero() -> Real
+    where chain_order <= 0
+    ensures (result == 0.0)
+{
+    sinh(0.0)
+}

eml_stdlib/math/softmax.eml

@@ -0,0 +1,87 @@
+// softmax.eml -- numerically-stable softmax kernels.
+//
+// Softmax over an N-vector requires (a) subtracting the max for
+// numerical stability and (b) reducing across the vector. EML's
+// scalar-kernel surface naturally splits this into three pure
+// gates that the host loop composes:
+//
+//   softmax_shift_exp(logit, max_logit)   per-element exp(x - m)
+//   softmax_normalize(numer, denom_sum)   per-element / sum
+//   softmax_two_logit(a, b)               closed form for N=2
+//
+// The FPGA allocator (Patent #14) maps the per-element gates to
+// SIMD lanes and the reduction to a tree adder; cross-target
+// equivalence (Patent #22) then guarantees the C / Rust / Lean
+// reference matches the Verilog bit-for-bit at IEEE-754
+// rounding.
+
+module softmax;
+
+const SOFTMAX_X_MAX: Real = 30.0
+
+type SoftmaxNumerator = Real where chain_order <= 1
+type SoftmaxValue     = Real where chain_order <= 1
+
+// Per-element exp(x - max) -- the numerically-stable softmax
+// numerator. `max_logit` is the running maximum of the logit
+// vector, supplied by the host (computed in a separate reduce).
+// Subtracting it before exp() guarantees the largest numerator
+// equals 1.0 and the smallest doesn't underflow.
+@target(fpga, clock_mhz = 250, precision = float32)
+@verify(lean, theorem = "softmax_numerator_bounded_by_one")
+fn softmax_shift_exp(logit: Real, max_logit: Real) -> SoftmaxNumerator
+    where chain_order <= 1
+    requires (abs(logit) < SOFTMAX_X_MAX)
+    requires (abs(max_logit) < SOFTMAX_X_MAX)
+    requires (logit <= max_logit)
+    ensures  (result >= 0.0)
+    ensures  (result <= 1.0)
+{
+    exp(logit - max_logit)
+}
+
+// Per-element normaliser. `denom_sum` is the sum of the shifted
+// numerators; supplied by the host's reduction tree.
+@target(fpga, clock_mhz = 400, precision = float32)
+@verify(lean, theorem = "softmax_value_in_unit_interval")
+fn softmax_normalize(numer: Real, denom_sum: Real) -> SoftmaxValue
+    where chain_order <= 0
+    requires (numer >= 0.0)
+    requires (denom_sum > 0.0)
+    requires (numer <= denom_sum)
+    ensures  (result >= 0.0)
+    ensures  (result <= 1.0)
+{
+    numer / denom_sum
+}
+
+// Closed-form softmax for N=2 -- the binary-classifier head.
+// Equivalent to sigmoid(a - b); useful as a sanity-check
+// for the sigmoid-vs-softmax-for-binary debate. Chain order 1.
+@target(fpga, clock_mhz = 250, precision = float32)
+@verify(lean, theorem = "softmax_two_equals_sigmoid_diff")
+fn softmax_two_logit(a: Real, b: Real) -> SoftmaxValue
+    where chain_order <= 1
+    requires (abs(a) < SOFTMAX_X_MAX)
+    requires (abs(b) < SOFTMAX_X_MAX)
+    ensures  (result >= 0.0)
+    ensures  (result <= 1.0)
+{
+    1.0 / (1.0 + exp(b - a))
+}
+
+// Log-sum-exp (LSE) -- stable computation of log(sum exp(x_i)).
+// The host loop accumulates `running_lse` and `next_logit`
+// pair-wise via this gate. Chain order 2 (ln composes through
+// exp). Used as the cross-entropy denominator in transformer
+// language-model heads.
+@target(fpga, clock_mhz = 200, precision = float32)
+@verify(lean, theorem = "log_sum_exp_pair_associative")
+fn log_sum_exp_pair(a: Real, b: Real) -> Real
+    where chain_order <= 2
+    requires (abs(a) < SOFTMAX_X_MAX)
+    requires (abs(b) < SOFTMAX_X_MAX)
+{
+    let m = clamp(a, b, SOFTMAX_X_MAX);
+    m + ln(exp(a - m) + exp(b - m))
+}

eml_stdlib/math/sqrt.eml

@@ -0,0 +1,46 @@
+// sqrt.eml -- square root + 2D/3D Euclidean distance.
+//
+// `sqrt` is a Forge builtin. This module ships sqrt with an
+// explicit positivity contract plus the two most-used compositions
+// (Euclidean distance) so callers can drop them into kernels
+// without re-deriving the chain-order budget.
+
+module sqrt_module;
+
+@verify(lean, theorem = "sqrt_nonneg")
+fn sqrt_kernel(x: Real) -> Real
+    where chain_order <= 1,
+          domain: x >= 0.0
+    ensures (result >= 0.0)
+{
+    sqrt(x)
+}
+
+// 2D Euclidean distance.
+@verify(lean, theorem = "hypot2_nonneg")
+fn hypot2(x: Real, y: Real) -> Real
+    where chain_order <= 1
+    ensures (result >= 0.0)
+{
+    sqrt(x * x + y * y)
+}
+
+// 3D Euclidean distance.
+@verify(lean, theorem = "hypot3_nonneg")
+fn hypot3(x: Real, y: Real, z: Real) -> Real
+    where chain_order <= 1
+    ensures (result >= 0.0)
+{
+    sqrt(x * x + y * y + z * z)
+}
+
+// Inverse square root -- shows up in normal-vector renormalisation,
+// 1/sqrt(2pi) Gaussian prefactors, and 1/r^2 force laws.
+@verify(lean, theorem = "rsqrt_positive")
+fn rsqrt(x: Real) -> Real
+    where chain_order <= 1,
+          domain: x > 0.0
+    ensures (result > 0.0)
+{
+    1.0 / sqrt(x)
+}

eml_stdlib/math/tan.eml

@@ -0,0 +1,36 @@
+// tan.eml -- tangent.
+//
+// Chain order 2: tan = sin / cos -- one transcendental in the
+// numerator and one in the denominator. Caller is responsible for
+// keeping x away from (k + 1/2) * pi where cos vanishes.
+
+module tan_module;
+
+const PI:           Real = 3.141592653589793
+const HALF_PI:      Real = 1.5707963267948966
+const SAFE_MARGIN:  Real = 0.01
+
+@verify(lean, theorem = "tan_zero_is_zero")
+fn tan_kernel(x: Real) -> Real
+    where chain_order <= 2,
+          domain: abs(cos(x)) > SAFE_MARGIN
+{
+    tan(x)
+}
+
+@verify(lean, theorem = "tan_at_zero_is_zero")
+fn tan_at_zero() -> Real
+    where chain_order <= 0
+    ensures (result == 0.0)
+{
+    tan(0.0)
+}
+
+// Double-tangent identity numerator: 2*tan(x) -- shows up enough
+// in trig-rationalisation passes to get its own kernel.
+fn two_tan(x: Real) -> Real
+    where chain_order <= 2,
+          domain: abs(cos(x)) > SAFE_MARGIN
+{
+    2.0 * tan(x)
+}

eml_stdlib/math/tanh.eml

@@ -0,0 +1,54 @@
+// tanh.eml -- hyperbolic-tangent activation.
+//
+// Canonical bipolar squashing function. Range (-1, 1), zero
+// mean for symmetric input distributions, smooth and analytic
+// everywhere. Chain order 1 (single transcendental).
+//
+// We also expose `hard_tanh` (a piecewise-linear
+// FPGA-friendly approximation) and `tanh_from_sigmoid` -- the
+// 2*sigmoid(2x) - 1 identity that SuperBEST canonicalises to a
+// single tanh call (saving one extra exp under the hood).
+
+module tanh_activation;
+
+const TANH_X_MAX: Real = 30.0
+
+type BipolarSignal = Real where chain_order <= 1
+
+@target(fpga, clock_mhz = 250, precision = float32)
+@verify(lean, theorem = "tanh_monotone_in_x")
+fn tanh_activation(x: Real) -> BipolarSignal
+    where chain_order <= 1
+    requires (abs(x) < TANH_X_MAX)
+    ensures  (result >= -1.0)
+    ensures  (result <= 1.0)
+{
+    tanh(x)
+}
+
+// Sigmoid-form identity: tanh(x) = 2*sigmoid(2x) - 1. SuperBEST
+// rewrites this exact pattern back to the single tanh call above,
+// recovering the chain-1 cost despite the surface chain-2 form.
+@target(fpga, clock_mhz = 250, precision = float32)
+@verify(lean, theorem = "tanh_from_sigmoid_equals_canonical")
+fn tanh_from_sigmoid(x: Real) -> BipolarSignal
+    where chain_order <= 2
+    requires (abs(x) < TANH_X_MAX)
+    ensures  (result >= -1.0)
+    ensures  (result <= 1.0)
+{
+    2.0 / (1.0 + exp(-2.0 * x)) - 1.0
+}
+
+// Hard tanh -- piecewise linear, chain order 0. Used in
+// quantised inference (int8 / int16) where the saturation
+// nonlinearity is a single clamp instead of a transcendental.
+@target(fpga, clock_mhz = 400, precision = float32)
+@verify(lean, theorem = "hard_tanh_bounded")
+fn hard_tanh(x: Real) -> BipolarSignal
+    where chain_order <= 0
+    ensures  (result >= -1.0)
+    ensures  (result <= 1.0)
+{
+    clamp(x, -1.0, 1.0)
+}

eml_stdlib/ml/attention.eml

@@ -0,0 +1,70 @@
+// attention.eml -- scaled dot-product attention kernel.
+//
+// One query-key pair contributes a score:
+//
+//   score = (q . k) / sqrt(d_k)
+//
+// The softmax over scores produces the attention weights; the
+// output is the weighted sum of values:
+//
+//   out = sum_j softmax(score_j) * v_j
+//
+// EML kernels operate on scalars; the host threads in the dot
+// product, the LSE reduction, and the value sum. This module
+// provides:
+//
+//   scale_factor(d_k)        -- 1 / sqrt(d_k)
+//   score_qk(q_dot_k, scale) -- chain order 0 multiply
+//   attention_step(...)      -- per-(j) contribution to output
+//
+// Plus the mask kernels for causal / padding masking.
+
+module attention;
+
+@verify(lean, theorem = "attn_scale_positive")
+fn scale_factor(d_k: Real) -> Real
+    where chain_order <= 1,
+          domain: d_k > 0.0
+    ensures (result > 0.0)
+{
+    1.0 / sqrt(d_k)
+}
+
+@verify(lean, theorem = "attn_score_signed")
+fn score_qk(q_dot_k: Real, scale: Real) -> Real
+    where chain_order <= 0,
+          domain: scale > 0.0
+{
+    q_dot_k * scale
+}
+
+// Per-position contribution to the output. softmax_weight is the
+// pre-computed exp(score_j - lse) value from the host. v is the
+// j-th value.
+@verify(lean, theorem = "attn_step_signed")
+fn attention_step(softmax_weight: Real, v: Real) -> Real
+    where chain_order <= 0
+    requires (softmax_weight >= 0.0)
+    requires (softmax_weight <= 1.0)
+{
+    softmax_weight * v
+}
+
+// Causal mask: returns -1e30 for masked positions, 0 otherwise.
+// Caller adds this to the score before softmax.
+@verify(lean, theorem = "causal_mask_signed")
+fn causal_mask(query_pos: Real, key_pos: Real) -> Real
+    where chain_order <= 0
+{
+    let allowed = clamp((query_pos - key_pos) * 1.0e30 + 1.0, 0.0, 1.0);
+    (1.0 - allowed) * -1.0e30
+}
+
+// Padding mask -- positions where pad == 1 get -inf.
+@verify(lean, theorem = "pad_mask_signed")
+fn padding_mask(pad: Real) -> Real
+    where chain_order <= 0
+    requires (pad == 0.0 || pad == 1.0)
+{
+    pad * -1.0e30
+}

eml_stdlib/ml/cross_entropy.eml

@@ -0,0 +1,85 @@
+// cross_entropy.eml -- cross-entropy loss kernels.
+//
+// The standard classifier loss. For binary targets:
+//
+//   bce(p, y) = -(y * ln(p) + (1-y) * ln(1-p))
+//
+// The numerically-stable form is to compute the loss in
+// logit-space (the input to the final sigmoid) instead of
+// probability-space, since ln(sigmoid(z)) collapses to
+// -softplus(-z) which avoids the catastrophic-cancellation
+// region around p ≈ 0 or p ≈ 1.
+//
+// Both forms ship here; SuperBEST's cross_entropy rewrite rule
+// (E-193 calibration) detects the prob-space form and rewrites
+// it to the logit-space form, saving ~2.4 decimal digits at the
+// saturated tails.
+
+module cross_entropy;
+
+const MAX_LOGIT: Real = 30.0
+const EPS: Real = 1.0e-7
+
+type LossSignal = Real where chain_order <= 2
+
+// Probability-space binary cross-entropy. Hand-written form;
+// SuperBEST rewrites to the logit-space form below before any
+// backend emits.
+@target(fpga, clock_mhz = 200, precision = float32)
+@verify(lean, theorem = "bce_loss_nonnegative")
+fn bce_loss(prediction: Real, target: Real) -> LossSignal
+    where chain_order <= 2,
+          domain: 0.0 < prediction && prediction < 1.0
+    requires (target >= 0.0)
+    requires (target <= 1.0)
+    ensures  (result >= 0.0)
+{
+    -(target * ln(prediction) + (1.0 - target) * ln(1.0 - prediction))
+}
+
+// Logit-space (numerically stable) form. Equivalent to
+//   max(z, 0) - z * y + ln(1 + exp(-|z|))
+// the form torch.nn.BCEWithLogitsLoss compiles to. Chain order 2
+// (ln composes through exp).
+@target(fpga, clock_mhz = 200, precision = float32)
+@verify(lean, theorem = "bce_with_logits_equals_bce")
+fn bce_with_logits(logit: Real, target: Real) -> LossSignal
+    where chain_order <= 2
+    requires (abs(logit) < MAX_LOGIT)
+    requires (target >= 0.0)
+    requires (target <= 1.0)
+    ensures  (result >= 0.0)
+{
+    let pos = clamp(logit, 0.0, MAX_LOGIT);
+    pos - logit * target + ln(1.0 + exp(-abs(logit)))
+}
+
+// Categorical cross-entropy contribution from one (logit, target)
+// pair, given the host has already supplied log_sum_exp(logits)
+// from the LSE reduction. Chain order 1 (single ln baked into
+// log_sum_exp; this gate is just subtract-and-multiply).
+@target(fpga, clock_mhz = 400, precision = float32)
+@verify(lean, theorem = "categorical_ce_pair_nonnegative")
+fn categorical_ce_pair(logit: Real, log_sum_exp_val: Real, target_one_hot: Real) -> LossSignal
+    where chain_order <= 0
+    requires (abs(logit) < MAX_LOGIT)
+    requires (target_one_hot >= 0.0)
+    requires (target_one_hot <= 1.0)
+{
+    target_one_hot * (log_sum_exp_val - logit)
+}
+
+// Gradient of BCE-with-logits w.r.t. the logit. Equals
+//   sigmoid(z) - y
+// SuperBEST recognises -ln(sigmoid(-z))-shaped patterns in the
+// surrounding code and hoists this gradient when the forward
+// pass and backward pass share the same logit.
+@target(fpga, clock_mhz = 250, precision = float32)
+fn bce_with_logits_grad(logit: Real, target: Real) -> LossSignal
+    where chain_order <= 1
+    requires (abs(logit) < MAX_LOGIT)
+    requires (target >= 0.0)
+    requires (target <= 1.0)
+{
+    1.0 / (1.0 + exp(-logit)) - target
+}

eml_stdlib/ml/gelu.eml

@@ -0,0 +1,51 @@
+// gelu.eml -- Gaussian Error Linear Unit, the activation BERT
+// and GPT use.
+//
+// The exact GELU is
+//
+//   gelu(x) = x * Phi(x)
+//
+// where Phi is the standard normal CDF. Phi has no closed-form
+// elementary expression, so production code uses one of two
+// approximations:
+//
+//   gelu_tanh   chain 1: 0.5*x*(1 + tanh(sqrt(2/pi) * (x + 0.044715*x^3)))
+//   gelu_erf    chain 1: 0.5*x*(1 + erf(x / sqrt(2)))
+//
+// erf is a Forge builtin in the f64 path; for f32 the tanh form
+// is the canonical FPGA-friendly choice (one transcendental
+// instead of one + special function).
+//
+// Numeric range: bounded |x| < 30 keeps the cubic term inside
+// float32 dynamic range and lets the Lean monotonicity proof
+// avoid +/-inf edge cases.
+
+module gelu;
+
+const GELU_X_MAX:    Real = 30.0
+const SQRT_2_OVER_PI: Real = 0.7978845608028654
+const GELU_CUBIC:    Real = 0.044715
+const HALF:          Real = 0.5
+
+type GeluSignal = Real where chain_order <= 1
+
+@target(fpga, clock_mhz = 200, precision = float32)
+@verify(lean, theorem = "gelu_tanh_monotone_in_x")
+fn gelu_tanh(x: Real) -> GeluSignal
+    where chain_order <= 1
+    requires (abs(x) < GELU_X_MAX)
+{
+    HALF * x * (1.0 + tanh(SQRT_2_OVER_PI * (x + GELU_CUBIC * x * x * x)))
+}
+
+// QuickGELU -- the OpenAI CLIP variant: x * sigmoid(1.702 * x).
+// Cheaper than gelu_tanh (one exp instead of one tanh + cubic);
+// matches gelu_tanh to ~3 decimal digits on N(0,1) inputs.
+@target(fpga, clock_mhz = 250, precision = float32)
+@verify(lean, theorem = "quick_gelu_monotone_in_x")
+fn quick_gelu(x: Real) -> GeluSignal
+    where chain_order <= 1
+    requires (abs(x) < GELU_X_MAX)
+{
+    x / (1.0 + exp(-1.702 * x))
+}

eml_stdlib/ml/layernorm.eml

@@ -0,0 +1,49 @@
+// layernorm.eml -- per-feature layer normalization kernel.
+//
+// Given a feature vector x, the LayerNorm transform is:
+//
+//   mu     = mean(x)
+//   var    = mean((x - mu)^2)
+//   x_norm = (x - mu) / sqrt(var + eps)
+//   y      = gamma * x_norm + beta
+//
+// EML kernels operate per-element -- the host program threads the
+// per-vector statistics in. Chain order 1 (single sqrt). The
+// closed proofs cover unit-variance + zero-mean of `x_norm` in the
+// no-noise limit.
+
+module layernorm;
+
+const DEFAULT_EPS: Real = 1.0e-5
+
+// Normalisation step for a single element.
+@verify(lean, theorem = "layernorm_unit_variance_in_limit")
+fn layernorm_step(x: Real, mu: Real, var: Real, eps: Real,
+                  gamma: Real, beta: Real) -> Real
+    where chain_order <= 1,
+          domain: var >= 0.0 && eps > 0.0
+{
+    let x_norm = (x - mu) / sqrt(var + eps);
+    gamma * x_norm + beta
+}
+
+// Default-eps variant.
+@verify(lean, theorem = "layernorm_default_eps_unit_variance_in_limit")
+fn layernorm_default(x: Real, mu: Real, var: Real,
+                     gamma: Real, beta: Real) -> Real
+    where chain_order <= 1,
+          domain: var >= 0.0
+{
+    let x_norm = (x - mu) / sqrt(var + DEFAULT_EPS);
+    gamma * x_norm + beta
+}
+
+// RMSNorm variant -- skips the mean subtraction (used in LLaMA).
+//   y = x / sqrt(mean(x^2) + eps) * gamma
+@verify(lean, theorem = "rmsnorm_signed_in_input_band")
+fn rmsnorm_step(x: Real, mean_sq: Real, eps: Real, gamma: Real) -> Real
+    where chain_order <= 1,
+          domain: mean_sq >= 0.0 && eps > 0.0
+{
+    gamma * x / sqrt(mean_sq + eps)
+}

eml_stdlib/ml/leaky_relu.eml

@@ -0,0 +1,51 @@
+// leaky_relu.eml -- Leaky ReLU activation.
+//
+//   leaky_relu(x) = x if x >= 0 else alpha * x
+//
+// Standard alpha = 0.01 prevents the dying-ReLU problem at the
+// cost of a small negative-tail contribution to the gradient.
+// Chain order 0; branch-free via clamp + linear blend.
+
+module leaky_relu;
+
+const DEFAULT_ALPHA: Real = 0.01
+
+@verify(lean, theorem = "leaky_relu_at_zero_is_zero")
+fn leaky_relu(x: Real, alpha: Real) -> Real
+    where chain_order <= 0
+    requires (alpha >= 0.0)
+{
+    let pos = clamp(x, 0.0, 1.0e30);
+    let neg = clamp(x, -1.0e30, 0.0);
+    pos + alpha * neg
+}
+
+@verify(lean, theorem = "default_leaky_relu_at_zero_is_zero")
+fn leaky_relu_default(x: Real) -> Real
+    where chain_order <= 0
+{
+    let pos = clamp(x, 0.0, 1.0e30);
+    let neg = clamp(x, -1.0e30, 0.0);
+    pos + DEFAULT_ALPHA * neg
+}
+
+// PReLU: alpha is a learnable parameter (per channel).
+@verify(lean, theorem = "prelu_at_zero_is_zero")
+fn prelu(x: Real, alpha: Real) -> Real
+    where chain_order <= 0
+{
+    let pos = clamp(x, 0.0, 1.0e30);
+    let neg = clamp(x, -1.0e30, 0.0);
+    pos + alpha * neg
+}
+
+// Gradient of leaky_relu: 1 for x >= 0, alpha for x < 0.
+@verify(lean, theorem = "leaky_relu_grad_in_alpha_band")
+fn leaky_relu_grad(x: Real, alpha: Real) -> Real
+    where chain_order <= 0
+    requires (alpha >= 0.0)
+    ensures (result >= 0.0)
+{
+    let s = clamp(x * 1.0e30, 0.0, 1.0);
+    s + alpha * (1.0 - s)
+}

eml_stdlib/ml/relu.eml

@@ -0,0 +1,63 @@
+// relu.eml -- rectified linear unit family.
+//
+// All four entries in this module are chain order 0 -- ReLU is
+// branch-free in EML because we lower max(0, x) to clamp(x, 0, +inf)
+// which a backend can either emit as a CMOV / select or as a
+// single MAX instruction. No transcendental.
+//
+// On FPGA this is the cheapest activation per layer and the
+// reason quantised inference cores (Patent #14 allocator) bias
+// toward ReLU + variants over sigmoid / tanh.
+
+module relu;
+
+const RELU_UPPER:  Real = 1.0e30
+const ALPHA_LEAKY: Real = 0.01
+
+type RectifiedSignal = Real where chain_order <= 0
+
+@target(fpga, clock_mhz = 500, precision = float32)
+@verify(lean, theorem = "relu_nonnegative")
+fn relu(x: Real) -> RectifiedSignal
+    where chain_order <= 0
+    ensures  (result >= 0.0)
+    ensures  (result >= x)
+{
+    clamp(x, 0.0, RELU_UPPER)
+}
+
+// Leaky ReLU -- non-zero gradient for negative inputs, helps
+// dead-neuron problem. `alpha` is typically 0.01.
+@target(fpga, clock_mhz = 500, precision = float32)
+@verify(lean, theorem = "leaky_relu_monotone_in_x")
+fn leaky_relu(x: Real, alpha: Real) -> RectifiedSignal
+    where chain_order <= 0
+    requires (alpha >= 0.0)
+    requires (alpha <= 1.0)
+{
+    clamp(x, alpha * x, RELU_UPPER)
+}
+
+// ReLU6 (mobile inference favourite). Clamped to [0, 6]
+// so int8 quantisation has a sane fixed range.
+@target(fpga, clock_mhz = 500, precision = float32)
+@verify(lean, theorem = "relu6_bounded")
+fn relu6(x: Real) -> RectifiedSignal
+    where chain_order <= 0
+    ensures  (result >= 0.0)
+    ensures  (result <= 6.0)
+{
+    clamp(x, 0.0, 6.0)
+}
+
+// Parametric ReLU with a fixed-but-loaded slope -- here `alpha`
+// is the per-channel learned slope shipped as a kernel argument
+// (the surface form a quantised PReLU layer takes).
+@target(fpga, clock_mhz = 500, precision = float32)
+fn prelu(x: Real, alpha: Real) -> RectifiedSignal
+    where chain_order <= 0
+    requires (alpha >= 0.0)
+    requires (alpha <= 2.0)
+{
+    clamp(x, alpha * x, RELU_UPPER)
+}