spec(npu,soc_1): add activation-load path, close BUGS.md A5/A6 (CO-NPU-01)

[claude]

Deliverable manifest

Role: chief-architect-agent-Sonnet5-medium
Issue: #15

Artifacts:

• docs/spec/npu.md — v1.0→v1.1: §2.3a activation-load ingress port (NPU-24..27), §4.5 decision record, NPU-28 (A6 stall bound), §6/§7 updates, §8 change log
• docs/spec/soc_1.md — v1.0→v1.1: SOC1-12 destination field extended to 3 values (weight FIFO / firmware SRAM / NPU activation SRAM), §3.1 block-list note, §8 change log

Gates:

• flow/check_boundaries.sh spec/npu = PASS ("no role restriction" — docs/spec/ only, no hw/rtl or hw/dv touched)
• make lint / make sim / make formal — not applicable, no RTL/DV/formal files changed by this PR

Spec refs:

• Closes hw/dv/npu/BUGS.md A5 (no activation-load path) via new shall-IDs NPU-24, NPU-25, NPU-26, NPU-27, npu.md §2.3a/§4.5
• Closes hw/dv/npu/BUGS.md A6 (undefined group-boundary stall) via new NPU-28
• Extends soc_1.md SOC1-12 (destination field, now 3-way)
• Decision record with numbers in npu.md §4.5: chosen (i) extend weight-stream descriptor destination mode (72 cycles ≈1.44µs for a 288B token-embedding row @ WS_WIDTH=32); rejected (ii) CSR-mapped WB writes standalone (360 cycles ≈7.2µs — both options are ~3-4 orders of magnitude below the ~39ms/token GEMV budget, so speed doesn't decide it; (ii) doesn't solve the sourcing problem — the embedding row lives in flash, not anywhere on-chip the CPU could write from, and going through the CPU reintroduces the CPU-mediated-through-WB pattern soc_1.md §4.2 already rejected for the weight datapath); rejected (iii) both, as unnecessary — DV already drives the weight-stream-class ports directly in its module-level testbench, so (i) alone unblocks the toggle-coverage gate too.

Open items:

• Downstream artifacts this change order invalidates (each needs a follow-on issue filed to the owning role — chief-architect writes no RTL/DV/models per Iron Rule 2), listed in full in npu.md §8:
  • hw/rtl/npu/npu.sv, hw/rtl/npu/npu_act_sram.sv — new port + BUSY-gated write-port mux + wraparound counter + (if needed) an RTL fix to hit NPU-28's 1-cycle bound — rtl-engineer, rtl/npu
  • hw/dv/common/models/npu.py — golden model has no activation-load or group-boundary-stall model today; needs both, from spec text only — verif-architect
  • hw/dv/npu/vplan.md, hw/dv/npu/BUGS.md — new vplan rows for NPU-24–28; A4/A5/A6 close (BUGS.md itself is DV's file, left untouched here per Iron Rule 2 — DV closes its own log when the follow-on work lands) — dv-engineer
  • hw/formal/ — no NPU proofs exist yet; when one lands, NPU-07's proof extends to cover NPU-26 — formal-engineer, no action required now

Friction:

• No existing spec-version-bump or change-log convention in this repo (TEMPLATE.md has no Version:/§8 Change log field) — introduced a lightweight one (Version: header line + ## §8 Change log section) consistent with the "no silent spec edits after v1" rule; flagging in case the integrator wants to standardize it in TEMPLATE.md.
• No spec/<mod> branch-name convention exists in CLAUDE.md's list (rtl/, dv/, formal/, pd/, sw/) for chief-architect's own deliverables; used spec/npu as the closest fit. flow/check_boundaries.sh's default case accepts any unrecognized prefix with no restriction, so this didn't block anything, but it's undefined by convention.

Skill candidates:

• .claude/skills/chief-architect/references/spec-authoring-patterns.md — a "change order" pattern (Version header + §8 Change log + explicit invalidated-artifact list per role) would have saved re-deriving format from scratch; nominate only, integrator gates entry.

[claude]

Integrator review — request changes (1 finding)

Boundary: clean — branch spec/npu, diff touches only docs/spec/npu.md + docs/spec/soc_1.md, both inside chief-architect's docs/spec/ scope. Re-ran flow/check_boundaries.sh on the PR head: boundary check OK (falls to the unrestricted default case, matching the manifest's claim).

Gate integrity: clean — no flow/gates.mk, .sdc, or test file touched; nothing waived or weakened.

Spec conformance: spot-checked the bulk of the new/changed citations against current spec/ADR/profile text — SOC1-08/10/11/12/13, NPU-01/06/07/13/14/16/17, ACT_SRAM_BYTES=2048 (§2.4, $clog2=11 matches NPU-25's ASW), profile.md's dim=288/vocab=32000/lm_head=9,216,000 B (≈9.2 MB), and the "5 cycles/transaction" figure shared with §4.4 all check out — the cited sections say what the PR claims.

One did not:

1. docs/spec/npu.md:496 — §4.5 cites "≈1,953,792-cycle (≈39 ms) GEMV budget for one token (soc_1.md §1, D4)". soc_1.md §1 has no D4 label and no such cycle count. The actual source is docs/adr/0002-npu-architecture.md D4 ("cycles/token (GEMV 1,953,792 + non-GEMM tail 13,292)") — correctly cited as ADR-0002 D4 two paragraphs earlier in this same file (npu.md:378). The number itself is right; the citation location is wrong. Please fix to ADR-0002 D4.

Everything else — the A5/A6 closure mechanism, the rejected-alternatives numbers, NPU-24–28, the SOC1-12 3-way field, the §8 change logs and invalidated-artifact list — is accurate and well-cited. Not merging per this single citation fix; re-push and the review re-triggers.