The score engine is simpler than the story around it

Sketch it out in Python first

Before dealing with hardware cycles and signals, let's write down exactly what values we need to generate after accepting a piece of corpus data. This snippet handles one single scalar value, but remember: the real hardware is doing this same math across 16 parallel lanes and multiple residue limbs.

def encrypted_product(q0, q1, d0, d1, modulus):
    e0 = (q0 * d0) % modulus
    stash = (q1 * d0) % modulus     # phase 0 state
    e1 = (q0 * d1 + stash) % modulus
    e2 = (q1 * d1) % modulus
    return e0, e1, e2

assert encrypted_product(2, 3, 5, 7, 97) == (10, 29, 21)

The source code comments are a contract

// Two protocols share one datapath:
// ct × pt: out_a[i] = c0[i]*pt[i], out_b[i] = c1[i]*pt[i]
// ct × ct: e0 = q0*d0, e1 = q0*d1 + q1*d0, e2 = q1*d1
// phase 0 stashes q1*d0; phase 1 completes e1 and e2.
// No evaluation keys; the client decrypts with (1, s, s^2).

Here's how it plays out: The query components (q₀ and q₁) are loaded and live permanently in on-chip RAM. Meanwhile, the corpus words come streaming in from memory. If we're scoring a plaintext corpus, the hardware grabs one row of the corpus and multiplies it by both query components at once. But if we're scoring an encrypted corpus, the hardware receives d₀ and d₁ on alternating clock phases, reusing the exact same multipliers.

Time-sharing to build the cross term

The concept of a phase is crucial state information. It tells the hardware which piece of the corpus data just arrived. If the pipeline stalls, the hardware has to freeze the arithmetic data AND the phase bit together. If you mess that up, you might accidentally combine d₁ from one transaction with the stashed q₁d₀ from a completely different transaction.

When one part stalls, the whole pipeline freezes

wire en = ~(m_valid & ~m_ready);
assign s_ready = en;

If we have valid output ready to go, but the next guy in line says they aren't ready (m_ready is low), our enable wire (en) drops to zero. That single wire freezes the query reads, the registers, the phase chains, and the multipliers. Everything locks up in perfect alignment. In hardware, keeping data synchronized is vastly more important than keeping a specific multiplier busy.

Test the timeline interactively

This notebook doesn't do any cryptography. Instead, it lets you play with the control logic: can you build a pipeline that survives totally random stalls without dropping, duplicating, or scrambling items?

def ct_ct(c0,c1,d0,d1):
    phase0=(c0*d0,c1*d0)
    phase1=(c0*d1,c1*d1)
    return phase0[0], phase0[1]+phase1[0], phase1[1]