test: authenticate first-use ISA authority

.github/workflows/ci.yml

@@ -79,7 +79,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: LinxISA/linx-isa
-          ref: ea54153b3351c48df306a57189ffb587801b9197
+          ref: e8aa0e2179184df6b3d410163baaa566b92d392e
           path: linxisa-authority
       - name: Install toolchain
         run: sudo apt-get update && sudo apt-get install -y clang-format cmake ninja-build g++
@@ -104,7 +104,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: LinxISA/linx-isa
-          ref: ea54153b3351c48df306a57189ffb587801b9197
+          ref: e8aa0e2179184df6b3d410163baaa566b92d392e
           path: linxisa-authority
       - name: Install toolchain
         run: sudo apt-get update && sudo apt-get install -y clang-format cmake ninja-build clang

docs/isa.md

@@ -113,7 +113,7 @@ also rejects stale committed output without modifying it.
 
 It additionally authenticates the complete authority bytes against the
 immutable LinxISA v0.58.1 release: compiled catalog
-`c1750250ec295e690bd22c20fd7c7f350db5e1bb4ce2417493dc094d7f007878`, PTO
+`4e8a7e96ebc2710d70bb17b77bc181b9613ca87b9f38a368217d596522d4bbf8`, PTO
 lock `fec69d22b2757ebb8da3876b16e1d5845af188f107f06d05422af15513309dfd`,
 and release manifest
 `3f8f746b52aa14ad39c6be83d0ebf3bc260c992c4d3e932b10cef612d0217f6c`.

tests/checks/test_gen_minst_codec.py

@@ -66,6 +66,30 @@ def test_same_count_nonrequired_encoding_mutation_fails_content_authentication(s
                     spec_path, lock_path, manifest_path
                 )
 
+    def test_first_use_exception_mutation_fails_content_authentication(self) -> None:
+        mutated = copy.deepcopy(self.spec)
+        first_use = mutated["state"]["system_registers"]["trapno_encoding"][
+            "first_use_exception"
+        ]
+        first_use["cause_value"] = 5
+
+        with tempfile.TemporaryDirectory() as td:
+            spec_path = Path(td) / "linxisa-v0.58.json"
+            lock_path = Path(td) / "pto-spec.lock.json"
+            manifest_path = Path(td) / "release_manifest.json"
+            spec_path.write_text(json.dumps(mutated), encoding="utf-8")
+            lock_path.write_bytes(
+                (SUPERPROJECT_ROOT / "isa/v0.58/pto-spec.lock.json").read_bytes()
+            )
+            manifest_path.write_bytes(
+                (SUPERPROJECT_ROOT / "isa/v0.58/release_manifest.json").read_bytes()
+            )
+
+            with self.assertRaisesRegex(ValueError, r"catalog content hash mismatch"):
+                gen_minst_codec.load_and_validate_authority(
+                    spec_path, lock_path, manifest_path
+                )
+
     def test_explicit_authority_root_supports_standalone_freshness(self) -> None:
         checked = subprocess.run(
             [
@@ -123,7 +147,7 @@ def test_every_ctest_job_uses_exact_immutable_authority(self) -> None:
             with self.subTest(job=job_name):
                 self.assertIn("repository: LinxISA/linx-isa", body)
                 self.assertIn(
-                    "ref: ea54153b3351c48df306a57189ffb587801b9197", body
+                    "ref: e8aa0e2179184df6b3d410163baaa566b92d392e", body
                 )
                 self.assertIn("path: linxisa-authority", body)
                 self.assertIn(

tools/isa/gen_minst_codec.py

@@ -42,7 +42,7 @@
     "pieces": 3401,
     "constraints": 780,
 }
-EXPECTED_CATALOG_CONTENT_SHA256 = "c1750250ec295e690bd22c20fd7c7f350db5e1bb4ce2417493dc094d7f007878"
+EXPECTED_CATALOG_CONTENT_SHA256 = "4e8a7e96ebc2710d70bb17b77bc181b9613ca87b9f38a368217d596522d4bbf8"
 EXPECTED_LOCK_CONTENT_SHA256 = "fec69d22b2757ebb8da3876b16e1d5845af188f107f06d05422af15513309dfd"
 EXPECTED_RELEASE_MANIFEST_CONTENT_SHA256 = (
     "3f8f746b52aa14ad39c6be83d0ebf3bc260c992c4d3e932b10cef612d0217f6c"