add CPU/ZPU Metal-shaped driver layer

[Qubitium]

Summary

This WIP PR adds a Metal-shaped driver layer whose public resources and execution are CPU/ZPU-owned. Apple Metal is used only by host-side oracle tests for behavior and pixel comparison; the adapter does not submit work to native Metal encoders.

Implemented CPU/ZPU slices include:

• Explicit-width C ABI with fail-closed macOS/iOS SDK inventory and selector parity checks.
• Ordered CPU command queues/buffers, completion handlers, shared events, fences, residency, counters, Metal 4 allocators, queues, buffers, and argument tables.
• Top-left Apple pixel-grid rasterization for points, lines, line strips, triangles, and triangle strips with viewport, scissor, cull, winding, fill mode, perspective-correct varyings, depth/stencil, blending, indirect draws, and multiple color targets.
• CPU textures and views for the supported formats, 1D/2D/array/3D levels, cube resources, swizzles, checked transfers, and mipmaps.
• Registered CPU compute, tile, mesh, and factor-one tessellation profiles with direct/indirect dispatch, deferred buffer reads, and Metal 4 bridging.
• CPU-owned sparse buffers and placement-sparse textures, including X/Y tile origins, supported mip/tail layouts, copied/moved mappings, deferred legacy resource-state operations, unmap-to-zero behavior, and page-range aliasing.
• CPU indirect render/compute commands plus mesh-command recording, copy, reset, and fail-closed replay validation.
• CPU Metal 4 compiler/archive metadata, registered-function reflection, I/O decompression, tensors, visibility results, and acceleration-structure resource/metadata operations.

Verification

On the Apple M4 Max host:

• tools/limited-cpus.sh zig build metal-pixel passes exact native-vs-ZPU byte tests for supported rendering, compute, copies, arrays/3D, formats, mipmaps, depth/stencil, views, counters, visibility, indirect commands, sparse X/Y/tail mappings, and deferred legacy sparse mapping order.
• tools/limited-cpus.sh zig build metal-test metal-c-api passes the portable runtime and C API suites.
• tools/limited-cpus.sh zig build metal-install -Dtarget=aarch64-ios -Dxcb=false passes the iOS compile/install target.
• tools/limited-cpus.sh python3 tools/metal_abi_status.py --all-platforms and tools/limited-cpus.sh test/metal_abi.sh pass the macOS/iOS ABI inventory and strict gate.

Remaining explicit fail-closed boundaries

This PR is not claiming arbitrary Metal shader compatibility. Arbitrary MSL compilation and stitched libraries, arbitrary tile/object/mesh/tessellation shader execution, arbitrary ICB mesh and tessellation replay, ray-tracing traversal, machine-learning graph execution, CAMetalLayer drawable acquisition, hardware access-counter semantics, and raw 3D sparse-tail packing remain explicit errors until CPU implementations and oracle coverage exist. The implemented registered profiles are intentionally bounded and deterministic so 1:1 pixel behavior can be tested.

[Qubitium]

All Meta shaders needs to be on cpu within ZPU userspace. Real apple metal execution is only resered for CI and oracle validation.

[Qubitium]

Pushed 37fc203 to the existing PR source ref wip/metal-cpu-layer (and codex/metal-api-layer). This fixes Metal 4 ML runtime dimension constraints: positive extents remain exact, -1 extents are preserved in reflection as per-axis wildcards, and dispatch still requires concrete ZPU-owned tensors with static axes matching. Added deferred CPU/ZPU identity coverage and documented the contract. Validation: limited-cpus zig build metal-test metal-pixel metal-c-api cpu-ml-test cpu-ml-c-api --summary all (168/168 tests, metal pixel pass), metal-install -Dtarget=aarch64-ios -Dxcb=false, cpu_ml_portability_gate, and test/metal_abi.sh all pass.

[Qubitium]

Follow-up pushed as 02b93e8 on the existing wip/metal-cpu-layer PR ref. The range-form ML descriptor regression exposed and fixed an NSNull crash: Apple bulk dimension setters can leave NSNull entries, now normalized to unspecified before CPU/ZPU validation. Added coverage for range setter, per-axis -1 dimensions, descriptor reset, reflection, deferred identity execution, and fail-closed post-reset compilation. Full validation is green again: 168/168 tests, Metal pixel oracle, iOS install build, CPU ML portability gate, and metal ABI gate.

[Qubitium]

Pushed 79d3cd6 to the existing PR refs (codex/metal-api-layer and wip/metal-cpu-layer). This slice adds CPU/ZPU reference and Metal-shaped MTL4 profiles for packed Int4/UInt4 rank-2 matmul, with modulo-4-bit semantics. Native Metal is used only by the independent packed-byte oracle kernels. Validation: cpu-ml-test 16/16 and metal-pixel passed; ML oracle policy remains 2e-3 for inference/matmul/accumulation and 1e-6 for pure math.

[Qubitium]

Pushed e6d9fef to both codex/metal-api-layer and wip/metal-cpu-layer. Fixed Metal-shaped transpose routing so the legacy specialized ZML/cpu provider is attempted before the generic operation/reference path; unsupported providers still fall through exactly. Zero-initialized the adapter transpose ABI record and added a strided dense-staging/scatter regression. Focused gates: cpu-ml-test 17/17 and metal-test 153/153.

[Qubitium]

Pushed 2fee412 to both PR refs. Hardened the host-neutral CPU/ZML callback boundary: operation, named v2, and named v3 providers are now checked for mutation of operation metadata, tensor-view arrays, type arrays, output arrays, and permutation metadata; output data writes remain allowed. Added regressions for operation, v2 input-view, and v3 output-view redirection. metal-pixel, cpu-ml-test (18/18), and cpu-ml-c-api pass.

[Qubitium]

Full post-2fee412 validation is green: 21/21 build steps, 172/172 tests; metal-pixel Apple-oracle suite passed; metal C API passed; cpu-ml-test and cpu-ml-c-api passed; aarch64-ios install/compile passed; CPU-ML portability passed for x86_64-linux-gnu, aarch64-linux-gnu, aarch64-macos, and aarch64-ios; strict metal_abi.sh passed. PR remains open at the same source ref.

[Qubitium]

Pushed ccb57dc to the same PR refs. Fixed the GitHub core Formatting check by running the repository Zig formatter over the touched CPU-ML file and the pre-existing unformatted runtime line. Focused gates remain green: cpu-ml-test 18/18 and metal-test 154/154.

[Qubitium]

Pushed 368e9d7 to the existing PR #52 refs (codex/metal-api-layer and wip/metal-cpu-layer). Added CPU/ZPU-owned batched Metal ML matmul: rank-2 behavior is preserved; equal axes 2..rank-1 are batch dimensions. Added portable CPU unit coverage and a native-Metal-oracle rank-3 Float32 test using the 2e-3 inference tolerance. Native Metal remains oracle-only.

[Qubitium]

Pushed 56bcf1d to the existing PR #52 refs (codex/metal-api-layer and wip/metal-cpu-layer). Added CPU/ZPU-owned bounded Float32 unary Metal source profiles (sin/cos/exp/log/sqrt/tanh), 1e-6 native-oracle tests, reflection, indirect dispatch, and docs. No native Metal execution is used by the implementation.

[Qubitium]

Pushed ded30eb to the existing PR #52 refs. Metal 4 named one-input/one-output transpose providers whose name contains transpose now receive a uniquely shape-inferred permutation; ambiguous repeated extents remain provider-owned. The external zml_cpu_transpose_f32 oracle test now validates this metadata. CPU/ZPU remains the implementation; native Metal remains oracle-only.

[Qubitium]

Pushed 2eac649 to the existing PR #52 refs. This adds a reusable CPU/ZPU Float32 MSL expression compiler and deferred interpreter (operators, composed pure math, selected unary/binary/ternary calls) instead of another hard-coded intrinsic profile. Native Metal is oracle-only: the new sin(x)*0.5+cos(x) test passes at the required 1e-6 pure-math tolerance, unsupported valid MSL fails closed, and source bounds remain enforced. Metal tests: 158/158; pixel oracle, C ABI, and generic CPU/ZML portability gates pass.

[Qubitium]

Pushed e39dd73 to the existing PR #52 refs. The portable Float32 expression ABI now supports one- and two-input CPU/ZPU programs (x or x/y), with output buffer selection, source-bound enforcement, reflection parity, and cross-buffer pure-math oracle coverage at 1e-6. Focused Metal tests: 160/160; native Metal oracle, ABI, and CPU/ZML portability gates pass. Unsupported MSL remains fail-closed.

[Qubitium]

Checkpoint 4cd039c pushed to both existing refs (codex/metal-api-layer and wip/metal-cpu-layer).

• v3 ZML/cpu provider binding-type arrays are copied into staging before callbacks, preventing provider mutation of caller metadata.
• Added regression coverage for mutation rejection, untouched outputs, and caller metadata preservation.
• MTL4 identity operation now uses the generic CPU ML operation entry point.
• Verified on Apple host: cpu-ml-test 18/18, metal-test 160/160, metal-pixel oracle pass, metal-abi PASS, CPU ML portability PASS, fmt/diff clean.

The implementation remains CPU/ZPU-owned; native Metal is oracle-only. Arbitrary ML graphs remain fail-closed.

[Qubitium]

Checkpoint d0bddc7 pushed to both existing refs. Fixed Metal 4 ML execution now has one CPU/ZPU implementation: removed 979 lines of adapter-local identity/transpose/elementwise/matmul execution, retained only matmul shape validation, and routed supported profiles through zpu_cpu_ml_operation. Named graph providers still fail closed when declined.

Verified before push: metal-test 160/160, metal-pixel native-oracle pass, cpu-ml-test 18/18, cpu-ml-c-api pass, metal-abi PASS, CPU ML portability PASS, fmt/diff clean.

[Qubitium]

Checkpoint cfda9df pushed to both existing refs. Fixed canonical Metal transpose routing: the Apple adapter now probes a registered v3 ZML/cpu provider first, then v2/v1, before the generic fixed-operation/reference path. Added a padded/deferred native-oracle test requiring the v3 provider to execute.

Verified: metal-test 160/160, metal-pixel oracle pass, cpu-ml-test 18/18, cpu-ml-c-api pass, metal-abi PASS, CPU ML portability PASS, fmt/diff clean.

[Qubitium]

Checkpoint 29db854: canonical fixed Metal 4 ML profiles now probe the host-neutral ZML/cpu named v3 ABI (then v2/v1) before the fixed operation/reference path. This covers identity, transpose, elementwise, and matmul name/type mappings while keeping all resource execution CPU/ZPU-owned. Added native-oracle coverage where canonical zpu_cpu_ml_div_f32 is intercepted by v3, proving the named provider runs once and the operation provider is bypassed. Local gates: metal-pixel pass, cpu-ml-test 18/18, cpu-ml-c-api pass, CPU portability gate pass.