ML-DSA on x86-64: HighBits and LowBits with AVX2 (sign −4% instructions) by alex · Pull Request #513 · pyca/verified-garbage

alex · 2026-10-01T20:39:13Z

Based on main. #519 (the norm check and MakeHint with AVX2) was merged into this branch, so this PR now carries both: vg_mldsa_high_bits_avx2/vg_mldsa_low_bits_avx2 (described below) and vg_mldsa_norm_lt_avx2/vg_mldsa_make_hint_avx2 (see #519 for their description and proofs). #523 and #526 are stacked on it. It contains no spec or TCB changes: only implementations, their proofs and their registration.

What

This adds vg_mldsa_high_bits_avx2 and vg_mldsa_low_bits_avx2, AVX2 variants of vg_mldsa_high_bits and vg_mldsa_low_bits against the existing contracts. They work on eight coefficients at a time.

Code (Impl/MlDsa/X86_64/Round/Avx2.lean): each 128-bit lane runs the VEX.256 form (toY) of SSE2 code on four doublewords (hbX, lbX), as the AVX2 arithmetic of ML-DSA on x86-64: polynomial arithmetic in AVX2 (sign −23%, verify −10% instructions) #491 does.
- Decompose is the reference implementation's, the same as the scalar code: f = ⌊(⌊(a + 127)/2⁷⌋ · M + 2^(S-1)) / 2^S⌋. Every intermediate value fits in 32 bits.
- The multiplications by M (1025 or 11275) and by 2γ₂ are sums of shifts. There are no multiplication instructions, so the MCDT rule does not apply.
- r₁ = f mod m is f ANDed with the sign of f − m, since f ≤ m.
- r₀ gets q added if it is negative (vcadd).
- The code branches only once, on the public γ₂, and every address depends only on the pointers.
Backend: these functions, and ML-DSA on x86-64: the norm check and MakeHint with AVX2 (sign −8% instructions) #519's, are new fields of the polynomial arithmetic's Backend, alongside ML-DSA on x86-64: RejNTTPoly four at a time, in verification (verify −28% instructions with AVX2) #534's rej4. The SSE2 backend keeps the scalar code, and the AVX2 backend uses the new functions. Signing calls "vg_mldsa_high_bits" ++ P.sfx, and so on, so vg_mldsa*_sign_avx2 calls the AVX2 variants. check_variants passes.
Proofs:
- Round/YLane.lean: what the SSE2 code computes in one doubleword (hbL, lbL) is r₁ and r₀ of Decompose. This reuses the target-independent hbF_eq, lowBits_val, and so on.
- Round/YBlock.lean: hbX and lbX compute those values in each doubleword of a register.
- Round/YBits.lean: each lane does this (ylanes), the loop stores all 256 coefficients (YMap), and the prologue's comparison of γ₂ picks the right loop. Constant time is checked by taint_decide.
Artifacts: registered in Artifacts/MlDsaRound/X86_64.lean with features := ["avx", "avx2"].

Results

Callgrind instruction counts for 20 deterministic signatures plus one key generation, with AVX2. Against #491:

	before	HighBits/LowBits	+ norm check, MakeHint (#519)
ML-DSA-44	60.7M	58.2M (−4.1%)	53.5M (−8.0%)
ML-DSA-65	86.2M	82.2M (−4.6%)	75.5M (−8.2%)
ML-DSA-87	118.3M	113.8M (−3.8%)	106.1M (−6.8%)

Each step's percentage is relative to the column before it. The baseline (VG_CPU_FEATURES=none) is unchanged. use_hint in verification (#526) follows in the stack.

Checks run

lake build and lake env lean --run Emit.lean
check_lean_imports, check_lean_speed, check_vectors, check_arch_gates, check_variants, check_mcdt
cargo fmt --check, cargo clippy --all-targets -- -D warnings
cargo test, with default features and with VG_CPU_FEATURES=none, against Wycheproof

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

vg_mldsa_ntt and vg_mldsa_inv_ntt now compute on four coefficients at a time in SSE2 registers, as ML-KEM's x86-64 NTT does: a Montgomery multiplication with pmuludq (the even doublewords, then the odd ones moved down by pshufd), conditional additions of q with psrad masks, and for the layers with len 2 and 1 the coefficients of two or four blocks gathered with punpck{l,h}qdq (and pshufd) and interleaved back. The zetas are a table in Montgomery form that the prologue stores in scratch; the multiplications run inside ML-KEM's withMxcsr, so Intel's MCDT mitigation holds. Proofs: the lanes' arithmetic (VArith), the butterflies on registers (VLanes), the loads and stores of four coefficients and the zetas (VMem), the layers (VLay, VLay21), and the functions (Ntt, NttInv). Signing and verification now check that their code loads MXCSR only to restore it (ctlOk, through a compositional ctlC for verification) rather than never, since their primitives now do. ML-DSA-65 on this machine: sign 1.53 ms -> 0.81 ms, verify 281 us -> 181 us, keygen 276 us -> 248 us. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

vg_mldsa_multiply_ntt, vg_mldsa_multiply_add_ntt, vg_mldsa_add and vg_mldsa_sub now compute on four coefficients at a time in SSE2 registers, with the vector helpers of the NTT (Vec.lean). The products are two Montgomery multiplications: f·g·2⁻³², then by 2⁶⁴ mod q, which is f·g in [0, 2q), reduced with vcsub (for multiply_add, h is then added and the sum reduced). They use pmuludq, so they run inside ML-KEM's withMxcsr. These functions have no working space and use no stack, so MXCSR goes through the last 8 bytes of h, addressed through r8 = h. The last four coefficients of h are loaded into xmm6 first. The loop stores the first 252 coefficients. The last four are computed from registers before MXCSR is loaded back, and stored after it. Their callers' proofs are unchanged: the functions still need no stack and never write rsp. add and sub use paddd/psubd and vcsub/vcadd. Proofs: the lanes of a product (mul_lane, mulAdd_lane), the loop (Mul.step, Mul.loop_ok), the last block (Mul.last), the function (Mul.fn_ok), and withMxcsr through the end of a polynomial (withMxcsrH_ok). AddSub is reproven the same way. ML-DSA-65 instructions executed (callgrind, PR #464 -> this): sign -19%, verify -11%, keygen -2%. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

…into claude/fervent-einstein-ukl7t7-mul

…er the arithmetic Key generation, signing and verification on x86-64 now call the polynomial arithmetic of an implementation given as a variant of the new interface MlDsaArith (Variants/MlDsaArith/X86_64/). They are registered in Generic/MlDsaArith/X86_64/ and emitted once for each implementation, so a faster arithmetic (e.g. AVX2) reaches them without editing them. The only variant is the existing SSE2 code (Sse2), and the generated code is unchanged. - Impl: Arith.Backend holds the six functions' code and a name suffix. Each Prims gets a sfx field, and the arithmetic calls are named "vg_mldsa_ntt" ++ sfx and so on. primsWith B swaps in B's arithmetic. - Proof: ArithImpl is a backend with FnOk for each function: verified without stack, no rsp writes, depth <= 2, ctlOk, spSafe. prims_okWith builds each caller's PrimsOk from it. - ctlOk and spSafe of signing and key generation are no longer evaluated on the whole code with a concrete backend. Same/same_tac (Proof/MlDsa/X86_64/Arith/Same.lean) shows that a check composing over the code's structure (ctlC, Code.allInstrs) gives the same result as on the code with every arithmetic function empty, which the kernel evaluates once per parameter set. Verification already did this by hand; its call lemmas now allow the names to differ. - The registration files Artifacts/MlDsa{KeyGen,Sign,Verify}/X86_64.lean move to Generic/MlDsaArith/X86_64/. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

…de/fervent-einstein-ukl7t7-generic Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Add an AVX2 variant of MlDsaArith on x86-64: vg_mldsa_ntt_avx2, vg_mldsa_inv_ntt_avx2, vg_mldsa_multiply_ntt_avx2, vg_mldsa_multiply_add_ntt_avx2, vg_mldsa_add_avx2 and vg_mldsa_sub_avx2 compute on eight coefficients at a time, four in each 128-bit lane of an AVX2 register. In each lane the VEX.256 form of the SSE2 code does what the SSE2 code does to an xmm register, so the proofs lift the SSE2 lemmas to each lane (ML-KEM's ylanes). The NTT layers with len >= 8 load eight coefficients of each half of a block; len = 4 regroups two blocks with vperm2i128; len = 2 and 1 run the SSE2 gatherings in each lane, with the zetas of each lane arranged by vpshufd/vpblendd or vpermq. Key generation, signing and verification are generic over MlDsaArith, so the emitter generates their _avx2 instances; the Rust API selects them on CPUs with AVX and AVX2 (mldsa_common::Backend). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

The contract of a function that samples four elements of the matrix A at once, as ML-KEM's vg_mlkem_sample_ntt4 does: for each of the four 34-byte seeds, RejNTTPoly (FIPS 204 Algorithm 30) of it, reduced, or 0 if the loop does not finish within Appendix C's least bound for one of them. Its scratch is that of vg_mldsa_rej_ntt_poly (256 u64s), so callers can pass the same working space. No implementation yet: an x86-64 one, with four SHAKE128 instances in AVX2 registers, follows in its own PR. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Four interleaved Keccak states, the second buffer of the 4-way permutation and its table of round constants already take 2368 bytes, before the squeezed output; ML-KEM's vg_mlkem_sample_ntt4 has 1024 u64s for the same. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

ML-DSA now chooses between its SSE2 and AVX2 polynomial arithmetic by CPU feature, so test it end to end where the choice differs: under SDE's Pentium 4 (the SSE2 code, and the line that chooses it) and Haswell. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

…rvent-einstein-ukl7t7-rej4

vg_mldsa_rej_ntt_poly4 runs RejNTTPoly on four seeds. Its AVX2 variant runs the four SHAKE128 instances at once in the 64-bit elements of ymm registers, with the absorb and squeeze code of vg_mlkem_sample_ntt4_avx2, and runs vg_mldsa_rej_ntt_poly's loop over the same 1008 bytes of each seed's output (squeezed in two rounds of three blocks). The baseline calls vg_mldsa_rej_ntt_poly on each seed. Both are proven against rejNTT4Contract with 24 bytes of stack, and are a new function of the MlDsaArith backend. Verification now samples each row of Â four entries at a time from SB4 (four copies of ρ with the row's indices): the entries from 0, then for ℓ = 7 the last four (sampling entry 3 again), or for ℓ = 5 the last one alone. Its rej4 working space is the 8 KiB after the last row of Â, which the scratch size already allows. Its stack grows from 24 to 32 bytes, as its baseline callee calls three deep. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

vg_mldsa_high_bits_avx2 and vg_mldsa_low_bits_avx2 compute on eight coefficients at a time: in each 128-bit lane, the VEX.256 form of SSE2 code on four doublewords (hbX, lbX). Decompose is the reference implementation's, in 32 bits, with the multiplications by M and by 2γ₂ sums of shifts (no multiplication instructions, so nothing MCDT affects), r₁ = f mod m as f ANDed with the sign of f - m, and r₀ plus q if negative. They branch once on the public γ₂. They join the polynomial arithmetic's backend, as variants of vg_mldsa_high_bits and vg_mldsa_low_bits, so signing with AVX2 calls them. The proofs: what the SSE2 code computes in a doubleword is r₁ and r₀ of Decompose (YLane), each lane does it (YBlock, ylanes), and the loop stores all 256 (YBits). Instructions for 20 deterministic signatures (callgrind, AVX2): ML-DSA-44 60.7M → 58.2M (−4.1%), ML-DSA-65 86.2M → 82.2M (−4.6%), ML-DSA-87 118.3M → 113.8M (−3.8%); the baseline is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

…t-einstein-ukl7t7-ybits2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

…t-einstein-ukl7t7-rej4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Also fixes the conflict markers the previous merge left in ci.yml: the x86-64 CPU-feature matrix runs both poly1305's and mldsa's tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

…t-einstein-ukl7t7-ybits2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

…t-einstein-ukl7t7-rej4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

alex · 2026-10-02T00:07:42Z

merge conflicts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

alex · 2026-10-02T00:20:38Z

Merged main in b482411. The conflicts came from #491's squash: its files were add/add against this branch's copies, which already had #491's final content plus this PR's changes. So the only new content is #529's Rust changes, and the README tables are regenerated. #519, #523 and #526 are updated on top.

Generated by Claude Code

…t-einstein-ukl7t7-ybits2 Both add functions to the polynomial arithmetic's Backend: the merged Backend has highBits, lowBits and rej4 (and BackendOk their proofs). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Main has #534's vg_mldsa_rej_ntt_poly4, which this branch already merged with its own Backend fields (highBits, lowBits and rej4). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

alex · 2026-10-02T02:25:17Z

Merged main, now with #534, in c3926b2. Both PRs add fields to the arithmetic Backend, and the merged one has highBits, lowBits and rej4, in Backend/BackendOk and the SSE2, AVX2 and empty instances. lake build, the emitter (src/asm unchanged), the ci/check_*.py scripts and cargo test (default and VG_CPU_FEATURES=none) pass locally. #519, #523 and #526 are updated the same way.

Generated by Claude Code

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

…tructions) (#519) * ML-DSA on x86-64: the norm check and MakeHint with AVX2 vg_mldsa_norm_lt_avx2 and vg_mldsa_make_hint_avx2 compute on eight coefficients at a time, in the VEX.256 form of SSE2 code on the four doublewords of each 128-bit lane, as HighBits and LowBits do. norm_lt clamps the public bound to q (which changes no result), so that a - b and (q - b) - a fit in 32 bits and one of them is negative exactly when a coefficient is out of bounds; it ANDs their ORs into an accumulator, spreads its sign bits and returns (vpmovmskb + 1) >> 32. There is no branch on data. make_hint computes r₁ of r and of (r + z) mod q with hbX, the hint as (r₁ ^ r₁' + 63) >> 6, and counts the eight hints of an iteration from the byte mask of the hints shifted to bit 7 (vpmovmskb), summing its nibbles with three shifts and additions. Both join the polynomial arithmetic's backend, as variants of vg_mldsa_norm_lt and vg_mldsa_make_hint, so signing (both) and verification (norm_lt) with AVX2 call them. The proofs: YNorm (the differences, the mask and the result) and YHint (the hint in a doubleword, the count, the loop, and the count is hintOnes). Instructions (callgrind, AVX2), 20 deterministic signatures: ML-DSA-44 58.2M → 53.5M (−8.0%), ML-DSA-65 82.2M → 75.5M (−8.2%), ML-DSA-87 113.8M → 106.1M (−6.8%); 20 verifications: 23.5M → 23.0M (−2.0%), 35.7M → 35.4M (−0.8%), 72.0M → 70.2M (−2.4%). The baseline is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr * Regenerate src/asm after merging claude/fervent-einstein-ukl7t7-ybits2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr --------- Co-authored-by: Claude <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Main has #513, #519 and #523, which this branch already has. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

claude added 14 commits October 1, 2026 13:33

Merge remote-tracking branch 'origin/main' into pr1-merge

e49e9bb

Merge remote-tracking branch 'origin/claude/fervent-einstein-ukl7t7' …

04e1ac6

…into claude/fervent-einstein-ukl7t7-mul

Merge origin/main into claude/fervent-einstein-ukl7t7-mul

3e2aa65

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Merge claude/fervent-einstein-ukl7t7-mul (with origin/main) into clau…

55761ef

…de/fervent-einstein-ukl7t7-generic Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Merge branch 'claude/fervent-einstein-ukl7t7-rej4spec' into claude/fe…

e04e23b

…rvent-einstein-ukl7t7-rej4

This was referenced Oct 1, 2026

ML-DSA on x86-64: the norm check and MakeHint with AVX2 (sign −8% instructions) #519

Merged

ML-DSA on x86-64: UseHint with AVX2 (verify −2% instructions) #526

Merged

claude added 6 commits October 1, 2026 22:40

Merge main into claude/fervent-einstein-ukl7t7-avx2

4563920

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Merge branch 'claude/fervent-einstein-ukl7t7-avx2' into claude/ferven…

11c34b1

…t-einstein-ukl7t7-ybits2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Merge branch 'claude/fervent-einstein-ukl7t7-avx2' into claude/ferven…

8160f69

…t-einstein-ukl7t7-rej4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Merge branch 'claude/fervent-einstein-ukl7t7-avx2' into claude/ferven…

ac45439

…t-einstein-ukl7t7-ybits2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Merge branch 'claude/fervent-einstein-ukl7t7-avx2' into claude/ferven…

3f51d68

…t-einstein-ukl7t7-rej4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Base automatically changed from claude/fervent-einstein-ukl7t7-avx2 to main October 2, 2026 00:07

claude added 2 commits October 2, 2026 00:19

Merge main into claude/fervent-einstein-ukl7t7-rej4

8cc896c

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Merge main into claude/fervent-einstein-ukl7t7-ybits2

b482411

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

alex enabled auto-merge October 2, 2026 00:23

alex added this pull request to the merge queue Oct 2, 2026

github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Oct 2, 2026

alex enabled auto-merge October 2, 2026 02:06

alex added this pull request to the merge queue Oct 2, 2026

github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Oct 2, 2026

claude and others added 3 commits October 2, 2026 02:43

Merge main into claude/fervent-einstein-ukl7t7-ybits2

199d9b3

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

Merge #519 (already on the remote branch) with main

2e45fea

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

alex added this pull request to the merge queue Oct 2, 2026

Merged via the queue into main with commit 010defe Oct 2, 2026
49 checks passed

alex deleted the claude/fervent-einstein-ukl7t7-ybits2 branch October 2, 2026 03:53

Navigation Menu

ML-DSA on x86-64: HighBits and LowBits with AVX2 (sign −4% instructions) - #513

ML-DSA on x86-64: HighBits and LowBits with AVX2 (sign −4% instructions)#513
alex merged 27 commits into
mainfrom
claude/fervent-einstein-ukl7t7-ybits2

alex commented Oct 1, 2026 •

edited

Loading

Uh oh!

alex commented Oct 2, 2026

Uh oh!

alex commented Oct 2, 2026

Uh oh!

alex commented Oct 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Conversation

alex commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Results

Checks run

Uh oh!

alex commented Oct 2, 2026

Uh oh!

alex commented Oct 2, 2026

Uh oh!

alex commented Oct 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

alex commented Oct 1, 2026 •

edited

Loading