What HyperForje doesTakes a plain-English hardware spec and runs the whole front-end flow as an AWS Step Functions state machine, with 13 Strands agents as async leaves. Every pass/fail decision is made by a pure-Python Lambda — never by a model.
Generates & verifies RTL
Synthesizable Verilog plus a self-checking testbench, then proves it with Verilator, SymbiYosys, Icarus, Yosys and OpenROAD.
Proves properties formally
A generated SymbiYosys/z3 harness runs between lint and simulation. A vacuous proof (zero assertions) is demoted to inconclusive, never reported as verified.
Streams out real GDSII
Routed DEF → GDSII via KLayout with a SHA-256 manifest. The gate checks header, checksum, hierarchy and PDK provenance — never accepts a DEF as a substitute.
Deterministic verdicts
Gate Lambdas parse tool exit codes and logs; no model output ever reaches a Choice state. Same input → same verdict, always.
Self-healing fix loop
On failure the supervisor reads the real tool log, extracts file:line guidance, and re-enters behind a schema check and an iverilog compile check. Bounded by the state machine.
Runs in your account
All compute, storage and inference stay in your AWS account. No design IP leaves the boundary. 13 idle AgentCore runtimes cost $0 — consumption-priced.
Proof — measured, not modelledEvery figure below has run ids behind it in the repo benchmarks. Nothing here is projected.
| Design | What it is | Synth cells | Mean wall | Mean cost | Status |
|---|---|---|---|---|---|
| calc4 | 4-function calculator, 8-bit operands | 888 | ~5.7 min | $0.67 | Proven · POC |
| AES-128 | Encryption core, iterative 11-cycle | 9,710 | 27.9 min | $2.88 | Proven · DEV 0/2 POC |
| PicoRV32 | RV32IM CPU, unmodified upstream core | 8,399 | 18.8 min | $0.198 | Flow-proven · frozen pkg |
Cost anatomy — consistent across designs
- Cost is generation; time is P&R. Design + testbench = ~95% of spend, while P&R is the longest single stage (789 s mean on AES-128).
- The fix loop is the dominant variable. Zero-repair calc4: $0.77 / 7 min. Five-repair AES-128: $5.26 / 31 min.
- Acceptance repeats; generated bytes do not. One prompt produces different RTL across runs — spread is reported alongside every mean.
→ Open the live evals dashboard for per-run cost, tokens, fix iterations, caching, and tape-out tier across every run on record.
Reference architectureStep Functions owns the entire DAG. A Lambda bridge accepts the task token and calls InvokeAgentRuntime, because SFN has no native AgentCore integration.
Step Functions owns sequencing
Retry, catch, timeout and branching are native state-machine features — no LLM routing risk, and a run is inspectable in the console.
waitForTaskToken per agent
The agent returns ACCEPTED immediately, works on a background thread, heartbeats every 60s, and signals exactly once. No HTTP timeout ceiling.
One adapter contract
AdapterInput{design_name, file_paths, params} → AdapterOutput{passed, metrics, log_path}. Every tool, one shape.
Explore the solutionEverything below is demo-ready and reads from the same account data.
▶ Watch the demo →
A full executive walkthrough of a calc4 prompt-to-GDSII run — the pipeline hits a failure, the supervisor reads the real tool log, and the self-healing fix loop recovers to an accepted GDSII.
Evaluation dashboard →
Per-run pass/fail, precise failing stage, cost, tokens, fix iterations, caching efficiency, GDSII presence and tape-out tier — across every run on POC and DEV, with per-environment config matrices.
Status, specs & roadmap →
SOW deliverables mapped to completion, PRFAQ narrative, the full 39-spec inventory with quality/coverage, backlog completion, and the tape-out readiness roadmap by phase.
Security & Well-Architected →
The trust model and invariants, per-agent IAM, the 5-pillar Well-Architected review (2026-08-04) and the 38-item remediation status — what is fixed in code vs live in the account.
Lessons & learnings →
The war-stories of building this — deployment traps, the honesty-invariant defect class, CloudFormation gotchas, grader bugs, and the branching discipline that keeps main deployable.
13 agents · 7 gate verdictsOne arm64 container image; AGENT_ROLE selects behaviour at startup; 13 dedicated least-privilege roles. No role holds InvokeAgentRuntime — agents cannot call each other.
The agents
| design | Generate RTL + testbench via Bedrock |
| testbench | Generate or repair testbench code |
| verification | Verilator lint + SymbiYosys formal proof |
| simulate | Icarus in-image, or PCS/Slurm |
| synth | Yosys synthesis |
| pnr | OpenROAD place & route |
| signoff | Compose the sign-off report from parsed gates |
| supervisor | decide_fix — deterministic retry/escalate |
| registry / notifier | DynamoDB run record; SES/SNS + artifact bundle |
| provision / cleanup / escalation | Run dir; teardown (gated); exhaustion alert |
The gate verdicts (7 on a normal run)
| GateSpec | Frozen-package root-of-trust + schema; passes a prompt-driven run as legacy_generated |
| GateLint | Verilator error_count == 0 |
| GateFormal | Branches on SymbiYosys outcome, never the exit code; inconclusive = advisory |
| GateSim | Pass marker present; fail markers take priority |
| GateSynth | exit 0 · no errors · 0 latches · cells > 0 |
| GatePnR | exit 0 · WNS ≥ 0 · no congestion overflow |
| GateGDSII | GDS + manifest; header, SHA-256, no empty cells; a DEF is never a fallback |
Pluggable models & EDA toolsSwap per workload, per customer — zero agent code changes. Tool selection is the TOOL_REGISTRY env var (JSON).
Foundation LLMs
Claude Sonnet (default) · Nova · Nemotron · DeepSeek
EDA — open source
Verilator · Icarus · Yosys · OpenROAD · KLayout · SymbiYosys · z3
EDA — Synopsys
VCS · Fusion Compiler · DSO.ai
EDA — Cadence / Siemens
JasperGold · Innovus · Calibre · Cerebrus