ci: wasm SIMD parity+correctness gate (build + run under node)

The x86 `cargo test` suite never touches `simd_wasm.rs` (cfg'd to wasm32), so
wasm SIMD correctness was guarded only by a one-off node run recorded in the
blackboard (commit 500d57e, "51 numeric checks") — no regression gate. A
silent wasm rotate/xor bug would corrupt browser ChaCha with zero CI signal.

Make that standing:

- crates/wasm-simd-parity/ — a cdylib that depends on the REAL ndarray (no
  copy → no drift) and calls `ndarray::simd::{U32x16, F32x16, I8x16}`,
  self-checking each lane's arithmetic against the scalar reference in-module:
  U32x16 ARX triple (add/xor/rotate_left, consts 0/1/7/8/12/16/24/31 +
  roundtrip), F32x16 (splat/roundtrip/add/reduce_sum), I8x16 (roundtrip/add).
  `selfcheck()` returns a distinct code per failing lane+op. WORKSPACE-EXCLUDED
  so it has zero effect on the x86 jobs; built only by the gate.
- scripts/wasm-parity.sh — builds it for wasm32-unknown-unknown +simd128 (the
  correctness/integration half: building the harness builds ndarray for wasm),
  then runs the selfcheck under node asserting rc==0 (the parity half).
- ci.yaml `wasm_simd` job (in the `conclusion` needs) — installs the wasm
  target + node 22 and runs the script. The parallel of the existing `nostd`
  target-guard job, one tier over.

Extend the per-lane blocks in lib.rs whenever a new ndarray::simd lane lands.
Verified locally: `./scripts/wasm-parity.sh` → "wasm SIMD parity: OK (rc=0)";
x86 workspace lib build clean (exclude respected); ci.yaml valid YAML.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01K6pT32kk6pnuAAqR3JiYqu

Author: claude

.github/workflows/ci.yaml

@@ -112,6 +112,29 @@ jobs:
           # crates that have no business existing in the nostd build.
           cargo rustc -p ndarray "--target=${{ matrix.target }}" --no-default-features --features portable-atomic-critical-section
 
+  wasm_simd:
+    # The x86 `cargo test` suite never touches `simd_wasm.rs` (it is cfg'd to
+    # wasm32), so wasm SIMD correctness is otherwise unverified. Build the real
+    # `ndarray::simd` wasm types (+simd128) via the excluded `wasm-simd-parity`
+    # cdylib and run its numeric selfcheck under node — both integration (the
+    # lib compiles for wasm32+simd128) and parity (each lane == scalar). The
+    # standing version of the one-off node check from commit 500d57e6.
+    runs-on: ubuntu-latest
+    name: wasm-simd/parity-node
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+      # rust-toolchain.toml pins 1.95.0 — install the wasm target for the pinned
+      # toolchain too (dtolnay installs for `stable`, which may differ).
+      - run: rustup target add wasm32-unknown-unknown
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - name: wasm SIMD parity (build + node run)
+        run: ./scripts/wasm-parity.sh
+
   tests:
     runs-on: ubuntu-latest
     needs: pass-msrv
@@ -335,6 +358,7 @@ jobs:
       - clippy
       - format
       - nostd
+      - wasm_simd
       - tests
       - native-backend
       - hpc-stream-parallel

Cargo.toml

@@ -407,7 +407,7 @@ members = [
     "ndarray-rand",
     "crates/*",
 ]
-exclude = ["crates/burn"]
+exclude = ["crates/burn", "crates/wasm-simd-parity"]
 default-members = [
     ".",
     "ndarray-rand",

crates/wasm-simd-parity/Cargo.lock

@@ -0,0 +1,25 @@
+# wasm-simd-parity — the run-under-node gate for the wasm SIMD tier.
+#
+# The x86 `cargo test` suite never touches `simd_wasm.rs` (it is `cfg`'d to
+# wasm32), so wasm SIMD correctness is otherwise unverified by CI. This crate
+# is a cdylib that calls the REAL `ndarray::simd` wasm types (no copy → no
+# drift) and self-checks each lane's arithmetic against scalar in-module; the
+# `.wasm` is built with `+simd128` and run under node, asserting rc == 0.
+#
+# EXCLUDED from the workspace (see root Cargo.toml `exclude`) so it has zero
+# effect on the x86 jobs; the CI `wasm_simd` job builds it via --manifest-path.
+[package]
+name = "wasm-simd-parity"
+version = "0.0.0"
+edition = "2021"
+publish = false
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+ndarray = { path = "../.." }
+
+[profile.release]
+panic = "abort"
+opt-level = "z"

crates/wasm-simd-parity/Cargo.toml

@@ -0,0 +1,17 @@
+// Node harness for the wasm SIMD parity gate: instantiate the .wasm and assert
+// selfcheck() == 0. A nonzero rc names the failing lane+op (see lib.rs codes).
+import { readFileSync } from 'node:fs';
+const wasmPath = process.argv[2];
+if (!wasmPath) {
+  console.error('usage: node run.mjs <path-to.wasm>');
+  process.exit(2);
+}
+const { instance } = await WebAssembly.instantiate(readFileSync(wasmPath), {});
+const rc = instance.exports.selfcheck();
+if (rc === 0) {
+  console.log('wasm SIMD parity: OK (selfcheck rc=0)');
+  process.exit(0);
+} else {
+  console.error(`wasm SIMD parity: FAIL — selfcheck rc=${rc} (see crates/wasm-simd-parity/src/lib.rs return codes)`);
+  process.exit(1);
+}

crates/wasm-simd-parity/run.mjs

@@ -0,0 +1,107 @@
+//! Run-under-node parity gate for the wasm SIMD tier.
+//!
+//! `#[no_mangle] selfcheck()` runs each wasm SIMD lane's arithmetic against the
+//! scalar `u32`/`f32`/`i8` reference **in the same module**, returning `0` iff
+//! every lane is bit-identical. The companion `run.mjs` instantiates the
+//! `.wasm` and asserts `selfcheck() == 0`; `scripts/wasm-parity.sh` wires the
+//! build + node run, and the CI `wasm_simd` job runs the script. This is the
+//! standing version of the one-off node check from commit 500d57e6 — extend the
+//! per-lane blocks below whenever a new `ndarray::simd` lane lands.
+//!
+//! The whole crate is gated to `wasm32 + simd128` so it compiles to nothing on
+//! any other target (it is workspace-excluded and only built by the CI job).
+#![cfg(all(target_arch = "wasm32", target_feature = "simd128"))]
+
+use ndarray::simd::{F32x16, I8x16, U32x16};
+
+/// Distinct nonzero return codes make a CI failure point at the exact lane+op.
+#[no_mangle]
+pub extern "C" fn selfcheck() -> u32 {
+    if let Err(code) = check_u32x16() {
+        return code;
+    }
+    if let Err(code) = check_f32x16() {
+        return code;
+    }
+    if let Err(code) = check_i8x16() {
+        return code;
+    }
+    0
+}
+
+/// `U32x16` ARX triple (Add / BitXor / rotate_left) — the ChaCha20/BLAKE lane.
+fn check_u32x16() -> Result<(), u32> {
+    let a_arr: [u32; 16] = [
+        0x0000_0000, 0xFFFF_FFFF, 0x0000_0001, 0x8000_0000, 0x1234_5678, 0x9ABC_DEF0, 0xDEAD_BEEF, 0xCAFE_BABE,
+        0x0F0F_0F0F, 0xF0F0_F0F0, 0x5555_5555, 0xAAAA_AAAA, 0x0000_00FF, 0xFF00_0000, 0x0101_0101, 0x8080_8080,
+    ];
+    let b_arr: [u32; 16] = [
+        0x9E37_79B9, 0x1111_1111, 0xDEAD_C0DE, 0x0BAD_F00D, 0x7FFF_FFFF, 0x0000_0000, 0xFFFF_FFFF, 0x1357_9BDF,
+        0x2468_ACE0, 0xFEDC_BA98, 0x0000_0010, 0x0000_001F, 0xABCD_EF01, 0x1020_4080, 0x0F0F_F0F0, 0xC0DE_CAFE,
+    ];
+    // from_array / to_array roundtrip (lane ordering).
+    if U32x16::from_array(a_arr).to_array() != a_arr {
+        return Err(10);
+    }
+    let a = U32x16::from_array(a_arr);
+    let b = U32x16::from_array(b_arr);
+    let add = (a + b).to_array();
+    let xor = (a ^ b).to_array();
+    for i in 0..16 {
+        if add[i] != a_arr[i].wrapping_add(b_arr[i]) {
+            return Err(11);
+        }
+        if xor[i] != a_arr[i] ^ b_arr[i] {
+            return Err(12);
+        }
+    }
+    // ARX rotate — ChaCha20 uses 16/12/8/7; edges included.
+    for &n in &[0u32, 1, 7, 8, 12, 16, 24, 31] {
+        let r = a.rotate_left(n).to_array();
+        for i in 0..16 {
+            if r[i] != a_arr[i].rotate_left(n) {
+                return Err(13);
+            }
+        }
+    }
+    Ok(())
+}
+
+/// `F32x16` — the float hot-path lane (splat / roundtrip / add / reduce_sum).
+fn check_f32x16() -> Result<(), u32> {
+    let data: [f32; 16] = [
+        0.0, 1.0, 2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0, 10.0, 11.0, 12.0, 13.0, 14.0, 15.0,
+    ];
+    if F32x16::from_array(data).to_array() != data {
+        return Err(20);
+    }
+    let a = F32x16::from_array(data);
+    let b = F32x16::splat(2.0);
+    let sum = (a + b).to_array();
+    for i in 0..16 {
+        if sum[i] != data[i] + 2.0 {
+            return Err(21);
+        }
+    }
+    // 0+1+…+15 = 120.
+    if F32x16::from_array(data).reduce_sum() != 120.0 {
+        return Err(22);
+    }
+    Ok(())
+}
+
+/// `I8x16` — the byte lane (roundtrip / add).
+fn check_i8x16() -> Result<(), u32> {
+    let a_arr: [i8; 16] = [-128, -1, 0, 1, 127, 2, -2, 3, -3, 42, -42, 100, -100, 7, -7, 64];
+    let b_arr: [i8; 16] = [1, 1, 1, 1, 1, -1, -1, -1, 5, -5, 10, -10, 25, -25, 63, -64];
+    if I8x16::from_array(a_arr).to_array() != a_arr {
+        return Err(30);
+    }
+    let sum = I8x16::from_array(a_arr).add(I8x16::from_array(b_arr)).to_array();
+    for i in 0..16 {
+        if sum[i] != a_arr[i].wrapping_add(b_arr[i]) {
+            return Err(31);
+        }
+    }
+    Ok(())
+}