Research · Papers · The SHA-256 record and exact synthesis · MF-057
On the full-word gauge of the consecutive-Maj identity
m_t xor m_(t+1) = (a_t xor b_t) * (a_t xor b_t xor c_t xor a_(t+1)) across all 16 local inputs
Published 2026-08-29
For everyone
Plain summary
In SHA-256, the majority operation Maj takes three bits and returns one whenever at least two inputs are one. Linking two neighboring rounds yields an algebraic identity that holds across all 16 possible one-bit inputs. However, hiding the intermediate state a leaves an entire 32-bit word undetermined. That free coordinate is called a gauge. Tallying 1,024 rows for a 64-round run assumes an ideal layout that does not produce an actual saving; keeping both original Maj witnesses saves zero rows. The result carries a caveat, and the register records no prior art.
Result
For consecutive round products,
m_t xor m_(t+1) = (a_t xor b_t) * (a_t xor b_t xor c_t xor a_(t+1)).
The scalar identity holds across all 16 local inputs. When intermediate a is hidden, the exact local two-round screen reveals 12 wrong-branch signatures spanning rank six and produces 387,200 collisions per K pair. The edge row therefore fails to form a function graph. Across the 64-round leader, 32 disjoint round-pair placements of 32 bits yield 1,024 rows under conditional arithmetic. Retaining both old Maj witnesses delivers zero row savings. The word-level analysis shows that the omitted first-vertex residual is a permutation of the intermediate a word, confirming the gauge is a full 32-bit coordinate rather than a localized carry defect.
Setting and definitions
The symbols m_t, m_(t+1), a_t, b_t, c_t, and a_(t+1) denote the local state variables in the consecutive-Maj relation. The two-round screen hides intermediate word a and records collisions in the projected edge relation. A function graph assigns exactly one output to each visible input; multiple compatible hidden continuations break this property. The gauge is the residual hidden coordinate that persists after projecting out the intermediate word.
Method
The scalar identity is evaluated over all 16 local inputs. The local screen isolates the 12 wrong-branch signatures, determines their rank-six span, and tabulates the 387,200 collisions per K pair. Analysis of the omitted first-vertex residual, with verification data available in this paper's downloadable evidence pack, demonstrates that it permutes the intermediate a word. The 1,024-row leader metric scales 32 disjoint round-pair placements across 32-bit words.
Discussion
The identity is exact and proved, but its hidden freedom constitutes a full 32-bit gauge coordinate rather than a minor carry defect. Projecting out the intermediate word leaves a structural obstruction in the edge row. The 1,024-row metric is conditional arithmetic rather than realized table compression, as retaining both original Maj witnesses yields zero net savings. The entry retires the bounded/affine Maj phase, receives a page verdict of CAVEAT, and notes no prior art in the register.
For everyone — the takeaway
What this means
The underlying equation is mathematically correct, but using it to shrink the table fails. Even though the formula works on every small input, hiding the intermediate word leaves 32 bits of unresolved state. Counting 1,024 rows represents a theoretical best case, not an actual compression. The result confirms the algebraic relation while proving that hidden state blocks a practical reduction.
Register references
MF-057
Receipts: CONT lens_l3_jsc_maj_verification_report.md; CONT lens_l3_jsc_maj_verification_receipt.json; CONT lens_r2b_majgauge_verification_report.md; package certificates/maj_gauge_maximal_defect.json.
Prior art: the register does not record this.
Every artifact named above is bundled in, or hashed by, this paper's evidence pack below.
Evidence pack
Everything needed to check this entry against its receipts: the register text, a manifest with a SHA-256 hash for every named receipt, and 4 of 4 receipt files bundled (12 KB). Anything not bundled is still hashed in the manifest and lives in the compute-box working trees.
Changelog
Last reviewed 2026-08-29
- 2026-08-13The local rank-6 / 387,200-collision screen stands. A later verification confirmed that the omitted first-vertex residual is a permutation of the intermediate `a` word, showing that the gauge is a full 32-bit coordinate rather than a small carry defect.
- 2026-08-29Published on this site.