feat: bring up ASL-generated functional model for gfrun

[zhoubot]

Scope

Single PTO-SPEC Draft PR for the ASL-generated functional-model producer and checked ELF corpus consumed by gfrun. Keep this PR Draft and do not merge until the remaining governance/toolchain items below are reviewed.

Implemented

• Strict ASLRef warning rejection; the assembled model passes strict checking with zero warnings.
• PTO-owned 16/32/48/64-bit fetch/length, unique instruction dispatch, precise faults, memory semantics, scalar body entry, and a default-false service-request intercept hook; generated-model reset/PE0 initialization and request state remain outside PTO architecture.
• ADR-0115 now owns only scalar body entry and the portable default-false ACRC hook. The exact request_type=1, a7=94, a0=status convention is hosted ABI in the SuperscalarModel model NDF; nonmatching ACRC always retains PTO service-request behavior.
• ADR-0116 separates PTO architecture from model architecture, model ABI, hosted ABI, and implementation. PTO ASL/NDF contains no lifecycle/step/token/exit NDF; model state uses a PTO-STATE-MODEL-* inventory identity and model reset is called only by model initialization.
• Deterministic full typed-AST inventory, pto-mir-v1, executable MIR, fail-closed unsupported-node handling, and generated runtime image.
• Installable PTOASLModel 0.4.0 package with opaque C ABI, per-instance state, exact descriptor negotiation, generated reset/step/host completion, C/C++ consumers, 1,000-step isolation/concurrency coverage, Werror, and sanitizer tests.
• Deterministic snapshot/restore uses a versioned little-endian envelope, exact descriptor compatibility, payload SHA-256, atomic restore, no callbacks, and no host-memory capture. It serializes the model-owned projection of all ASL globals without exposing C++ object layout or lazy-page allocation.
• Each successful step exports a non-architectural pto-bundle-tile-state-sha256-v1 observation. The selected state comes from generated ASL global bindings; the digest does not enter PTO architectural state or affect execution.
• Each successful step now exports the exact ordered committed-byte log, write count, and a domain-separated SHA-256. Copy-out fails closed and a failed atomic commit exposes no writes or digest as committed evidence.
• Descriptor identity covers PTO commit/tree, ASLRef pin, encoding ABI/fingerprint, profile, generator/MIR inputs, and normalized hashes. CMake now invalidates the descriptor when only the producer commit/tree changes, closing a stale-identity cache bug.
• Content-addressed checked corpus with 64 KiB bounds, PT_LOAD/BSS/stack contract, exact expected PC/BPC/raw/length/sequence/request/write traces, independent golden bytes, tool hashes, and PTO 0.58.5 identity.
• Corpus manifests separate PTO requirements/avs_ids from SuperscalarModel SSM-MODEL-* and SSM-ABI-* requirements.
• Four real ELFs:
  • scalar mixed-width execution;
  • 32/64-bit block-control execution;
  • TLOAD(U32) -> TADD -> TSTORE, result 50;
  • exit_group(94), full argument 7 and process status 7.
• ASLRef, standalone libpto_asl_model, and gfrun emit one schema and compare every exported step field plus result bytes.

SuperscalarModel gfrun and model NDF branch

The canonical consumer is pushed at codex/pto-asl-model-ndf, head 411ae88e, without opening another PR. Its positive model NDF lives in docs/pto-asl-functional-model-ndf-v1.json with separate model-architecture, model-ABI, hosted-ABI, and implementation clauses:

• ASL is the only gfrun engine; --engine is removed and fails closed.
• gfrun no longer links soft_core, isa_blockisa, or softfloat; the symbol/link canary rejects legacy functional reachability.
• Independent permission-aware memory, strict ELF64 ET_EXEC/PT_LOAD policy, BSS, stack/SP, result export, and atomic output publication.
• Before reset or first instruction, gfrun requires exactly one .note.pto.isa and compares its ABI/fingerprint with the loaded model descriptor. Missing, malformed, duplicate, or mismatched identities fail closed.
• Host request 94 is completed only through the generated C ABI; gfrun records exit_group, the full XLEN argument, the low-eight-bit process status, and returns that status.
• gfrun copy-outs the library's committed write log after every successful step, checks count consistency, and records the ordered writes plus SHA-256 in the versioned run manifest.
• gfrun records the library's Bundle/Tile state digest; standalone library and gfrun digests must match at every step, while ASLRef comparison remains restricted to architecture-visible fields.
• The checked corpus resolves every SSM-* requirement against that model NDF.
• gfsim remains separately buildable with legacy timing-model dependencies; DPI is separately scoped and is not linked into gfrun.

Passing evidence

• Hosted PR checks at 82f21ec3 all pass: source-contract, tooling-tests, validate, and Site validate.
• make pr-check: 769 script tests passed, 2 expected skips; 3,742 architecture ASL points closed. Model lifecycle/ABI evidence moved to SuperscalarModel tests instead of being counted as PTO AVS.
• make repo-check: repository closure passed; 542 encoded forms.
• make check: strict ASLRef check passed with zero warnings.
• Exact-head Release PTO package at 82f21ec3: CTest 5/5 passed; installed descriptor reports commit 82f21ec39cedf11600670c1ec131aae05bdf6053, tree 8177612afaf19e9cbf8281ef18f770fcafa82f52, ABI 262144, snapshot v1, summary v1, and descriptor SHA-256 4abe82abd25853c566e23c41690c8cc0b405df31f7265f1b3d2f9295cef9c073.
• Exact-head PTO ASan+UBSan package: CTest 5/5 passed, including the 190-second runtime/isolation case and install-consumer test.
• SuperscalarModel clean ASL gfrun build: model-NDF, four-ELF corpus, and memory CTests passed 3/3; the independent gfsim target also builds successfully.
• SuperscalarModel ASan+UBSan gfrun shell: model-NDF, corpus, and memory CTests passed 3/3.
• Final exact-head three-way differential: all four cases passed with identical architecture-visible manifests and result.bin across ASLRef, standalone library, and gfrun, including memory-write count/log/SHA fields. Standalone library and gfrun additionally match Bundle/Tile digests at every step.
• Scalar commit evidence: sequence 8 writes 0x200..0x203 = 19 00 00 00; Tile commit evidence: sequence 20 writes 0xF00..0xF03 = 32 00 00 00. All three models report identical ordered logs and digests.
• Tile case: 18 steps, TLOAD -> TADD -> TSTORE, result 32 00 00 00.
• Exit case: 4 steps, request type 94, token 1, argument 7, final TPC 0x10e, exit status 7.
• Identity negative cases cover missing and mismatched ELF notes; exact package-root descriptor mismatch also fails closed.

LLVM and G7 review-only precursors

An LLVM branch is pushed at codex/pto-v0585-sync, head fe1a663d5511, without opening another PR. It consumes the generated 0.58.5 codec exactly, updates the canonical ELF identity, B.FPATR's tenth field, B.ASSEMBLE/B.SUBVIEW round-trip support, Shared S0..S63, and the current 85 TEPL operations. The focused LLVM evidence passes: 57/57 LinxISA MC plus LLD identity tests, 3/3 directly affected CodeGen tests, exact generated-codec comparison, and fresh Clang/LLD linx64 plus linx32 object/ELF production with the exact 0.58.5 note. The broader LLVM CodeGen/Clang directory is not claimed fully green: untouched SIMT-autovec and inline-asm expectation tests still expose existing failures outside this PTO synchronization slice.

A LinxISA branch is pushed at codex/asl-functional-model-g7, head 209e37ec, without opening another PR. It pins tools/pto-spec to PTO 82f21ec3/tree 8177612a and adds the correct tools/SuperScalarModel gitlink at 411ae88e. isa/v0.58/pto-functional-model.lock.json binds both gitlinks, the PTO lock/release manifest, model NDF, ABI/snapshot/summary schemas, descriptor 4abe82…, and corpus 92a15d…; mismatch canaries fail closed. Existing LLVM and LinxCoreModel reviewed pins remain unchanged.

Remaining review blockers

• Exact-head make release-verify reaches the Reader Guide release gate and stops because eight architecture Reader Guides remain pending owner acceptance: six functional-model/fetch/hook pages and two indexed-memory lane-choice pages. English and zh-CN drafts contain the required reader roles and documentation/publication checks pass; evidence remains pending. Do not label the exact release lane successful yet.
• The LLVM 0.58.5 predecessor now exists and passes the focused production/AVS gates, but it is deliberately not pinned into G7 while it is an unreviewed topic head. The canonical C-CodeGen evidence generator correctly rejects the external build path until a reviewed LLVM leaf SHA is pinned; this protection has not been bypassed.
• G7 completion still requires reviewed LLVM and SuperscalarModel leaf pins plus hosted clean-checkout CI; the descriptor/consumer/model-NDF lock is now present and passes locally against exact artifacts.
• Broader hosted startup/TLS/fd/barrier/multi-PE runtime remains follow-on scope. Snapshot/restore and Bundle/Tile model observations are complete and explicitly remain outside PTO architecture.
• No SuperscalarModel or LinxISA PR has been opened, preserving the requested single visible PR.

Review order

1. Review the PTO architecture/model boundary, default-false hook, and scalar body-entry delta (ADRs 0111/0115/0116).
2. Review MIR/runtime/C ABI and exact descriptor invalidation.
3. Review the four checked corpus cases and three-way evidence.
4. Review SuperscalarModel branch 411ae88e for the model NDF, ASL-only cutover, identity enforcement, hosted exit, memory-write trace copy-out, and model-summary recording.
5. Review LLVM branch fe1a663d5511, then decide the leaf-review and final superproject pin path without creating an unreviewed topic-head lock.
6. Complete Reader Guide owner acceptance and the final clean-checkout G7/model lock audit.

Do not merge this PR yet.

[zhoubot]

Superseded by #188. The new draft keeps the ASL-owned fetch/step architecture and AVS evidence, removes PTO-owned model lifecycle/custom MIR runtime, and will link the public asl-model and downstream consumer PRs.