debug: green-eye wave 3 - RM harness, local simulator, device map, MCP plugin, value-validation demos, CI pipeline, toolchain docs; add host RM tools rmtool/rmtop

1 files changed, 24 insertions, 2 deletions

diff --git a/debug/risc-v-gsp-rm-vm/README.md b/debug/risc-v-gsp-rm-vm/README.md
index 4017cd4..eab691f 100644
--- a/debug/risc-v-gsp-rm-vm/README.md
+++ b/debug/risc-v-gsp-rm-vm/README.md
@@ -10,6 +10,10 @@ green-eye boots GSP/uproc firmware in `qemu-system-riscv64`, attaches over
 QEMU's gdbstub with a GDB-free Python client, and exposes Frida-like
 instrumentation: hooks, breakpoints, watchpoints, memory dumping, structure
 decoding, snapshot diffing, session recording, plugins and a Ghidra bridge.
+An optional deterministic native RV64IMAC backend (M1) runs the same Session
+in-process: `--backend native` or `ge.launch(..., backend="native")`, with an
+in-process exec/access trace (M1.5/R4) written as a session blob and rendered
+by `analyze` (`--trace`, `--trace-start/--trace-end`, `--trace-exec on|off`).
 
 Start with [`docs/00-OVERVIEW.md`](docs/00-OVERVIEW.md).
 
@@ -20,6 +24,8 @@ cd open-iov/debug/risc-v-gsp-rm-vm
 
 make demo            # build the bundled RV64 uproc demo (clang + lld)
 ./greeneye.sh demo   # boot it, hook handlers, watch counters, record + analyze
+./greeneye.sh demo --backend native   # same run on the deterministic native sim
+./greeneye.sh record --backend native --trace --duration 0.5   # exec/access trace
 ./greeneye.sh info   # environment / tooling check
 ```
 
@@ -49,12 +55,17 @@ Everything else is Python stdlib.
 ```
 greeneye/           Python package: RSP client, session, memory, symbols,
                     structures, recording, analysis, probes, plugins, Ghidra bridge
+sim/                deterministic native RV64IMAC simulator (M1: decode, RAM,
+                    UART; M1.5: exec/access trace in sim/trace.py)
 firmware/uproc_demo/RV64 bare-metal demo "uproc" (mailbox RPC, state machine, trap)
 sdk/                injected-service SDK (position-independent RV64 blobs)
 qemu/               launch helper + optional TCG plugin for full memory tracing
 ghidra/             Ghidra scripts (export symbols, annotate hits, control bridge)
-plugins/            example plugin + authoring guide
+plugins/            example plugin, MCP server, RM-harness plugin + authoring guide
 examples/           Python instrumentation scripts and declarative probe specs
+harness/            automation harness (mutation, portability, version diff,
+                    control discovery/reachability, value-validation demos)
+rmharness/          host RM oracle wrappers + read-only capture harness
 tests/              unit tests + QEMU integration smoke tests
 docs/               full documentation set (design, scripting, plugins, accuracy,
                     portability playbooks, roadmap, service/injection guides)
@@ -81,5 +92,16 @@ dumps/              recorded sessions (gitignored)
 | [13-GHIDRA-CONTROL](docs/13-GHIDRA-CONTROL.md) | driving green-eye from GhidraScripts |
 | [14-ADVERSARIAL-INTEROP-GUIDE](docs/14-ADVERSARIAL-INTEROP-GUIDE.md) | navigating unpredictable/adversarial firmware change |
 | [15-AGENTIC-GSP-IDE](docs/15-AGENTIC-GSP-IDE.md) | agentic workflows and runbooks |
-| [16-CUSTOM-SIMULATOR](docs/16-CUSTOM-SIMULATOR.md) | non-QEMU simulator design (far later) |
+| [16-CUSTOM-SIMULATOR](docs/16-CUSTOM-SIMULATOR.md) | non-QEMU simulator design; M1 native backend + M1.5 trace status/usage |
+| [17-RM-HARNESS](docs/17-RM-HARNESS.md) | host RM oracle harness (`rmharness`, wrappers, capture) |
+| [18-HARNESS-AUTOMATION](docs/18-HARNESS-AUTOMATION.md) | mutation/portability automation harness |
+| [19-CONTROL-DISCOVERY](docs/19-CONTROL-DISCOVERY.md) | unknown-call discovery and reachability |
+| [20-MCP-SERVER](docs/20-MCP-SERVER.md) | bundled MCP server plugin |
+| [21-CI-RELEASE-PIPELINE](docs/21-CI-RELEASE-PIPELINE.md) | release triage pipeline (`harness/ci_release.py`) |
+| [22-PORTING-CUDA-AND-DEVICES](docs/22-PORTING-CUDA-AND-DEVICES.md) | portability playbook for new CUDA/devices |
+| [23-RM610-READINESS](docs/23-RM610-READINESS.md) | RM 610 readiness checklist |
+| [24-DEVICE-MAP](docs/24-DEVICE-MAP.md) | versioned first-touch MMIO device map |
+| [25-VALUE-VALIDATION](docs/25-VALUE-VALIDATION.md) | value-validation demos (s01–s10) |
+| [26-ARCHITECTURE](docs/26-ARCHITECTURE.md) | full architecture/API surface map |
+| [27-TOOL-AUDIT](docs/27-TOOL-AUDIT.md) | tool audit: purpose, tests, usage, status |
 | [GREEN-EYE-ROADMAP](GREEN-EYE-ROADMAP.md) | the long-term program (H1–H7) |