linxisa: upgrade model to PTO ISA 0.58.1

.github/workflows/ci.yml

@@ -75,12 +75,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Check out immutable LinxISA v0.58.1 authority
+        uses: actions/checkout@v4
+        with:
+          repository: LinxISA/linx-isa
+          ref: ea54153b3351c48df306a57189ffb587801b9197
+          path: linxisa-authority
       - name: Install toolchain
-        run: sudo apt-get update && sudo apt-get install -y cmake ninja-build g++
+        run: sudo apt-get update && sudo apt-get install -y clang-format cmake ninja-build g++
       - name: Configure
-        run: cmake -S . -B build-system -G Ninja -DCMAKE_BUILD_TYPE=Debug
+        run: >
+          cmake -S . -B build-system -G Ninja -DCMAKE_BUILD_TYPE=Debug
+          -DLINXISA_AUTHORITY_ROOT=${{ github.workspace }}/linxisa-authority
       - name: Build
         run: cmake --build build-system
+      - name: Check committed codec freshness against immutable authority
+        run: cmake --build build-system --target check-isa-codec
       - name: Run system and checks tests
         run: |
           ctest --test-dir build-system --output-on-failure -L system
@@ -90,14 +100,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Check out immutable LinxISA v0.58.1 authority
+        uses: actions/checkout@v4
+        with:
+          repository: LinxISA/linx-isa
+          ref: ea54153b3351c48df306a57189ffb587801b9197
+          path: linxisa-authority
       - name: Install toolchain
-        run: sudo apt-get update && sudo apt-get install -y cmake ninja-build clang
+        run: sudo apt-get update && sudo apt-get install -y clang-format cmake ninja-build clang
       - name: Configure
         run: >
           cmake -S . -B build-sanitize -G Ninja
           -DCMAKE_BUILD_TYPE=Debug
           -DCMAKE_CXX_COMPILER=clang++
           -DLINX_MODEL_ENABLE_SANITIZERS=ON
+          -DLINXISA_AUTHORITY_ROOT=${{ github.workspace }}/linxisa-authority
       - name: Build
         run: cmake --build build-sanitize
       - name: Run tests under sanitizers

CMakeLists.txt

@@ -16,6 +16,16 @@ set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
 
 option(LINX_MODEL_ENABLE_SANITIZERS "Enable ASan, LSan, and UBSan" OFF)
 option(LINX_MODEL_BUILD_DOCS "Enable Doxygen documentation target" OFF)
+set(LINXISA_AUTHORITY_ROOT "" CACHE PATH "Exact LinxISA checkout containing ISA v0.58.1 authority")
+if(NOT LINXISA_AUTHORITY_ROOT AND
+   EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/../../isa/v0.58/linxisa-v0.58.json")
+  get_filename_component(
+    LINXISA_AUTHORITY_ROOT "${CMAKE_CURRENT_SOURCE_DIR}/../.." ABSOLUTE)
+endif()
+set(LINXISA_AUTHORITY_ARGS)
+if(LINXISA_AUTHORITY_ROOT)
+  list(APPEND LINXISA_AUTHORITY_ARGS --authority-root "${LINXISA_AUTHORITY_ROOT}")
+endif()
 
 add_library(
   linx_model
@@ -42,11 +52,21 @@ add_library(linx::model ALIAS linx_model)
 add_custom_target(
   gen-isa-codec
   COMMAND "${CMAKE_CURRENT_SOURCE_DIR}/tools/isa/gen_minst_codec.py"
-          --spec "${CMAKE_CURRENT_SOURCE_DIR}/../../isa/v0.58/linxisa-v0.58.json"
+          ${LINXISA_AUTHORITY_ARGS}
+          --header "${CMAKE_CURRENT_SOURCE_DIR}/include/linx/model/isa/generated_tables.hpp"
+          --source "${CMAKE_CURRENT_SOURCE_DIR}/src/isa/generated_tables.cpp"
+  WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
+  COMMENT "Regenerating committed LinxISA 0.58.1 Minst codec tables")
+
+add_custom_target(
+  check-isa-codec
+  COMMAND "${CMAKE_CURRENT_SOURCE_DIR}/tools/isa/gen_minst_codec.py"
+          ${LINXISA_AUTHORITY_ARGS}
           --header "${CMAKE_CURRENT_SOURCE_DIR}/include/linx/model/isa/generated_tables.hpp"
           --source "${CMAKE_CURRENT_SOURCE_DIR}/src/isa/generated_tables.cpp"
+          --check
   WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
-  COMMENT "Regenerating committed LinxISA 0.58.0 Minst codec tables")
+  COMMENT "Checking committed LinxISA 0.58.1 Minst codec freshness")
 
 target_include_directories(
   linx_model
@@ -124,6 +144,17 @@ add_test(
     --fixture
     ${CMAKE_CURRENT_SOURCE_DIR}/tests/fixtures/pto_v058_shared_state.json)
 set_tests_properties(linx_model_check_pto_v058_shared_fixture PROPERTIES LABELS "checks")
+add_test(
+  NAME linx_model_check_gen_minst_codec
+  COMMAND
+    ${Python3_EXECUTABLE}
+    ${CMAKE_CURRENT_SOURCE_DIR}/tests/checks/test_gen_minst_codec.py -v)
+set_tests_properties(linx_model_check_gen_minst_codec PROPERTIES LABELS "checks")
+if(LINXISA_AUTHORITY_ROOT)
+  set_tests_properties(
+    linx_model_check_gen_minst_codec
+    PROPERTIES ENVIRONMENT "LINXISA_AUTHORITY_ROOT=${LINXISA_AUTHORITY_ROOT}")
+endif()
 
 add_executable(linx_model_cli src/linx_model_cli.cpp)
 target_link_libraries(linx_model_cli PRIVATE linx_model)

README.md

@@ -11,7 +11,7 @@ state.
 - `SimQueue<T>` models latency-aware, cycle-visible FIFO movement for value
   payloads, `std::unique_ptr<T>`, and `std::shared_ptr<T>`.
 - `isa::Minst` is the single in-flight uop payload. Fetch allocates
-  `MinstPtr`, decode populates generated LinxISA 0.58.0 fields, and retire/flush
+  `MinstPtr`, decode populates generated LinxISA 0.58.1 fields, and retire/flush
   or DFX consumes the same object.
 - `ProgramImage` plus the ELF/raw loader and ISA disassembler let the model CLI
   load a binary, decode instructions, and print assembly directly from the
@@ -71,7 +71,7 @@ ctest --test-dir build-sanitize --output-on-failure
   semantics
 - [`docs/testing.md`](./docs/testing.md) UT / ST / checks / sanitizers
 - [`docs/logging.md`](./docs/logging.md) structured log format and packet dump
-- [`docs/isa.md`](./docs/isa.md) generated LinxISA 0.58.0 codec and `Minst`
+- [`docs/isa.md`](./docs/isa.md) generated LinxISA 0.58.1 codec and `Minst`
   packet contract
 
 Doxygen can be generated locally with:
@@ -85,4 +85,23 @@ To regenerate the committed LinxISA codec tables after updating the source JSON:
 
 ```bash
 cmake --build build --target gen-isa-codec
+cmake --build build --target check-isa-codec
 ```
+
+Generation fails closed unless the root lock matches the exact PTO ISA 0.58.1
+release, ABI, projection, source commit/tree, catalog hashes/counts, and the
+765-form codec cardinality. The freshness target regenerates into a temporary
+directory and byte-compares both committed outputs.
+
+For a standalone checkout, configure with an immutable LinxISA authority:
+
+```bash
+cmake -S . -B build -G Ninja \
+  -DLINXISA_AUTHORITY_ROOT=/path/to/linx-isa-at-ea54153b3351c48df306a57189ffb587801b9197
+cmake --build build --target check-isa-codec
+```
+
+Hosted CI checks out that exact LinxISA commit and runs the freshness target.
+The generator authenticates the complete catalog, lock, and release-manifest
+bytes before interpreting their declared identities, so same-count semantic or
+encoding mutations fail closed.

docs/architecture.md

@@ -41,7 +41,7 @@ Within each `Module`, `WorkSelf()` is event-driven:
 repository.
 
 - fetch allocates `MinstPtr`
-- decode fills generated LinxISA 0.58.0 form metadata and canonical decoded fields
+- decode fills generated LinxISA 0.58.1 form metadata and canonical decoded fields
 - middle pipeline stages inspect or extend typed views on the same packet
 - retire, flush, or DFX consumes and destroys the packet, or converts it to
   shared ownership only at terminal boundaries
@@ -65,6 +65,24 @@ The default CLI helpers accept:
 - `--disasm` to print assembly before simulation
 - `--disasm-only` to print assembly and exit
 
+## Release differential evidence
+
+Trace agreement is diagnostic only. A release-strict cross-model report must
+bind the compiler, linker, one ELF, QEMU, model binary, case manifest, and
+independent golden bytes by SHA-256 before execution and verify them again
+before every consumer and after the run. Each participating model must export
+its own architecture-visible result memory, match the independent golden data,
+and pass every available pairwise comparison. A trace-prefix-only report fails
+closed and cannot promote a release.
+
+The strict consumer set for this model is exactly QEMU, the reference executor
+(`ref`), and the cycle-accurate comparison lane (`compare`). Promotion reopens
+and rehashes every tool, ELF, manifest, golden file, and result file; resolves
+`cross_model_result` plus the absolute `cross_model_result_size` from the ELF;
+requires the manifest and every file length to match that size; compares bytes
+itself; and verifies that comparison records bind both consumer-binary and
+result hashes. Reported `pass` fields are never accepted as proof by themselves.
+
 ## Module Contract
 
 Every queue-wired module derives from `Module<Derived, PortT>`.

docs/isa.md

@@ -2,10 +2,10 @@
 
 ## Scope
 
-`linx-model` ships a committed generated LinxISA 0.58.0 codec for `isa::Minst`.
+`linx-model` ships a committed generated LinxISA 0.58.1 codec for `isa::Minst`.
 The source of truth is:
 
-- `isa/v0.58/linxisa-v0.58.json` from the LinxISA 0.58.0 projection, generated
+- `isa/v0.58/linxisa-v0.58.json` from the LinxISA 0.58.1 projection, generated
   from the locked PTO-ISA/pto-spec release
 
 The generated C++ tables are committed under:
@@ -48,7 +48,8 @@ Decoder behavior:
 - chooses the unique most-specific form by fixed-bit count
 - validates field constraints
 - populates `Minst` metadata and typed views
-- exposes exactly 766 current LinxISA forms and rejects retired `B.ARG`,
+- exposes exactly 765 current LinxISA forms, including `B.FPATR` and
+  `BSTART.ICALL`, and rejects retired `B.ARG`,
   `C.B.IOS`, `BSTART.FIXP`, and generic `BSTART.CUBE`/`BSTART.TMA` spellings
 
 ## PTO 0.58 Shared state
@@ -102,8 +103,24 @@ After updating the source JSON, regenerate the committed tables with:
 
 ```bash
 cmake --build build --target gen-isa-codec
+cmake --build build --target check-isa-codec
 ```
 
+The generator validates the exact root PTO ISA 0.58.1 lock identity, source
+commit/tree, catalog hashes/counts, and the generated 765/2661/3401/780
+form/field/piece/constraint cardinalities before writing. `check-isa-codec`
+also rejects stale committed output without modifying it.
+
+It additionally authenticates the complete authority bytes against the
+immutable LinxISA v0.58.1 release: compiled catalog
+`c1750250ec295e690bd22c20fd7c7f350db5e1bb4ce2417493dc094d7f007878`, PTO
+lock `fec69d22b2757ebb8da3876b16e1d5845af188f107f06d05422af15513309dfd`,
+and release manifest
+`3f8f746b52aa14ad39c6be83d0ebf3bc260c992c4d3e932b10cef612d0217f6c`.
+Standalone builds must provide that checkout through
+`LINXISA_AUTHORITY_ROOT`; missing authority is an error for generation and
+freshness checks.
+
 Then rebuild and rerun tests:
 
 ```bash