rename (cosmetic): green-eye -> risc-v-gsp-rm-debugger in user-facing names, docs, CLI, launcher and CI workflow; internal greeneye package/module identifiers unchanged (includes in-flight greeneye module edits present in the tree)

1 files changed, 30 insertions, 30 deletions

diff --git a/docs/RUNBOOK.md b/docs/RUNBOOK.md
index 79c1735..4b11dfa 100644
--- a/docs/RUNBOOK.md
+++ b/docs/RUNBOOK.md
@@ -6,7 +6,7 @@
 > coordinating with us; any of them can break the emulation while the others
 > stand still. This runbook is the ordered response.
 >
-> **Related:** [green-eye user guide](05-operations/04-green-eye-user-guide.md)
+> **Related:** [risc-v-gsp-rm-debugger user guide](05-operations/04-risc-v-gsp-rm-debugger-user-guide.md)
 > · [GSP in a RISC-V VM (experimental)](05-operations/03-risc-v-gsp-rm-vm.md)
 > · [Debugging and maintenance workflows](05-operations/02-debugging-and-maintenance-workflows.md)
 > · [Hardware and software matrix](06-portability/hardware-software-matrix.md)
@@ -14,7 +14,7 @@
 > · [Developer onboarding and standards](07-developers/onboarding-and-standards.md)
 > · [Engineering operations](eng-ops.md)
 >
-> **# TOOL IN DEVELOPMENT - NOT READY YET!** The green-eye tooling cited here
+> **# TOOL IN DEVELOPMENT - NOT READY YET!** The risc-v-gsp-rm-debugger tooling cited here
 > is experimental; its interfaces and file formats may change. Nothing in this
 > runbook authorises a product change, a hardware write or work on RM 610.
 
@@ -51,7 +51,7 @@ win.
 | P3 | **Evidence over anecdote.** Every conclusion needs at least an A/B pair and an explicit fidelity level (L0–L3). | A single run, a static reading or a simulator-only delta cannot land a product change. |
 | P4 | **Physical confirmation for behaviour changes.** A simulator observation is evidence about the firmware, not about silicon. | Reproduction on a supervised physical/vfio-mdev cycle is required before a change that alters emulation behaviour. |
 | P5 | **The simulator is a study environment, never a security boundary.** | No confidentiality, side-channel or security claims; never use injection to defeat a hardware security boundary. |
-| P6 | **Development-only tooling.** green-eye is never shipped, never a dependency of the emulation, never in a guest. | Keep the in-development banner on tool docs until the acceptance list passes. |
+| P6 | **Development-only tooling.** risc-v-gsp-rm-debugger is never shipped, never a dependency of the emulation, never in a guest. | Keep the in-development banner on tool docs until the acceptance list passes. |
 | P7 | **No unattended physical-GPU cycles.** Physical work is supervised, with fail-safe release and explicit reboot approval. | Stop and ask; never bind/unbind drivers or claim the GPU as an experiment. |
 | P8 | **RM 610 is a hard human gate.** Until a named human approves in writing, no acquisition, analysis, emulation edit, physical work or support claim for 610. | The gate is enforced in code by `version_diff`/`ci_release`; do not work around it. |
 | P9 | **Fail closed, record honestly.** Unverified host info, unpaired firmware, unexplained deltas and absent references stay open. | "No unexplained deltas" is a claim that must be earned, not a default. |
@@ -65,8 +65,8 @@ affected doc or PR.
 |---|---|---|---|
 | **Anchor maintainer** | guest driver ↔ emulated firmware anchor; version surface | keeps the anchor current; approves anchor bumps; keeps `config/versions/*.yaml` labelled as design targets until read by code | any change to the anchor |
 | **Firmware triage maintainer** | versioned firmware directories; symbol DBs; probe/version-diff runs | acquires and hashes new images; builds symbol DBs with provenance; runs the P1 loop; owns the pairing decision | pairing verdict; "new logic" vs "behaviour moved" |
-| **green-eye tooling maintainer** | `debug/risc-v-gsp-rm-vm/`; test suite; session format | keeps `make test` green; guards format/API stability; keeps the marker and doc map honest; maintains golden sessions | tool status claims; removal of the in-development marker |
-| **CI/release maintainer** | `harness/version_diff.py`, `harness/ci_release.py`, `greeneye.yml`, goldens | runs dry-run before real runs; hashes evidence bundles; diffs seeded corpora; keeps CI paths and budgets bounded | release triage sign-off; RM 610 gate enforcement |
+| **risc-v-gsp-rm-debugger tooling maintainer** | `debug/risc-v-gsp-rm-vm/`; test suite; session format | keeps `make test` green; guards format/API stability; keeps the marker and doc map honest; maintains golden sessions | tool status claims; removal of the in-development marker |
+| **CI/release maintainer** | `harness/version_diff.py`, `harness/ci_release.py`, `risc-v-gsp-rm-debugger.yml`, goldens | runs dry-run before real runs; hashes evidence bundles; diffs seeded corpora; keeps CI paths and budgets bounded | release triage sign-off; RM 610 gate enforcement |
 | **Physical-cycle supervisor** | supervised physical/vfio-mdev cycles | enforces fail-safe release, D0/D3cold handling and reboot approvals; captures reference traces | all physical execution; reboot requests |
 | **Evidence archivist** | session and bundle retention | keeps SHA-256 inventories; enforces provenance (no private paths, no unsanitised host data); applies retention/prune policy | publication of evidence |
 | **Docs steward** | this tree | enforces change notes, link checks and doc-map updates; retires stale claims | docs are part of "done" |
@@ -82,7 +82,7 @@ with a summary alone.
 
 | Item | Cadence | Procedure | Pass condition |
 |---|---|---|---|
-| Demo golden session | every tool change and weekly | `./greeneye.sh demo` and compare against the archived session/expected events | UART banner and control-block liveness present; hook/watch/breakpoint sequence coherent |
+| Demo golden session | every tool change and weekly | `./risc-v-gsp-rm-debugger.sh demo` and compare against the archived session/expected events | UART banner and control-block liveness present; hook/watch/breakpoint sequence coherent |
 | Portability self-comparison | per PR touching `harness/`, `greeneye/`, `sim/` | `python3 harness/portability_matrix.py --target firmware/uproc_demo/build/uproc_demo.elf --target firmware/uproc_demo/build/uproc_demo.elf --out dumps/matrix-selfcheck` | `all_zero` deltas in `portability-report.json` |
 | Mutation replay | per PR touching mutation/harness code | run `mutation_harness.py` twice with the same seed and budgets | `findings.jsonl` byte-identical |
 | Version-diff self-check | per release-triage change | `version_diff.py` old == new | zero symbol/probe/behavior deltas |
@@ -115,7 +115,7 @@ Golden artifacts are append-only history: never edit a stored golden session
 
 | Dependency | Check | Action |
 |---|---|---|
-| QEMU | `./greeneye.sh info`; run `make test` | install/renew `qemu-system-riscv64` (Ubuntu `qemu-system-misc`); set `GREENEYE_QEMU` if the binary is elsewhere |
+| QEMU | `./risc-v-gsp-rm-debugger.sh info`; run `make test` | install/renew `qemu-system-riscv64` (Ubuntu `qemu-system-misc`); set `GREENEYE_QEMU` if the binary is elsewhere |
 | QEMU plugin API | `make -C qemu` after a QEMU upgrade | rebuild `qemu/greeneye-trace.so` against the vendored `qemu-plugin.h`; re-run a trace smoke |
 | Python | `python3 --version` (3.10+; stdlib only) | no pip packages required; keep plugins/harnesses stdlib-only |
 | clang/lld | `make demo`, `make sdk` | reinstall toolchain if the demo or SDK stops building |
@@ -210,10 +210,10 @@ Scenarios are incidents to run, not roadmap claims.
 cd debug/risc-v-gsp-rm-vm
 
 # 1) symbol DBs, one per version
-./greeneye.sh symbols export --index <export-VER.tsv> --bias 0 -o symbols-<VER>.json
+./risc-v-gsp-rm-debugger.sh symbols export --index <export-VER.tsv> --bias 0 -o symbols-<VER>.json
 
 # 2) bounded probe of each image (records a session)
-./greeneye.sh probe <gsp-<VER>.fwimage.bin> --symbols symbols-<VER>.json --record
+./risc-v-gsp-rm-debugger.sh probe <gsp-<VER>.fwimage.bin> --symbols symbols-<VER>.json --record
 
 # 3) full old-vs-new triage (shape, symbols, corpus, probe, behavior, M1-M6)
 python3 harness/version_diff.py \
@@ -223,8 +223,8 @@ python3 harness/version_diff.py \
     --out dumps/vdiff-<OLD>-<NEW>
 
 # 4) behaviour compare and canonical report
-./greeneye.sh compare dumps/<old-run> dumps/<new-run> --symbols
-./greeneye.sh analyze dumps/<new-run> --symbols symbols-<NEW>.json
+./risc-v-gsp-rm-debugger.sh compare dumps/<old-run> dumps/<new-run> --symbols
+./risc-v-gsp-rm-debugger.sh analyze dumps/<new-run> --symbols symbols-<NEW>.json
 ```
 
 ### S2 — New kernel driver / open-kernel-modules release
@@ -301,7 +301,7 @@ python3 harness/control_discovery.py --out dumps/discovery-<VER> --seed <seed>
 python3 harness/reach.py --target <symbol> --method auto --out dumps/reach-<symbol>
 
 # symbol-attributed A/B
-./greeneye.sh compare dumps/<old-run> dumps/<new-run> --symbols
+./risc-v-gsp-rm-debugger.sh compare dumps/<old-run> dumps/<new-run> --symbols
 ```
 
 ### S4 — New CUDA userspace / toolkit interacting unexpectedly with the GSP
@@ -319,7 +319,7 @@ python3 harness/reach.py --target <symbol> --method auto --out dumps/reach-<symb
 
 1. Cheap triage first (minutes): `info` + `delta`; classify the port.
 2. Measure name transfer before copying anything (`fdematch`).
-3. Build the green-eye symbol DB for the new version so runtime addresses
+3. Build the risc-v-gsp-rm-debugger symbol DB for the new version so runtime addresses
    resolve; spot-check transferred addresses.
 4. Confirm dynamically: `cdt` with the ioctl tracer, then `ab.sh all`, against
    the **same** emulated firmware profile (anchor discipline).
@@ -337,11 +337,11 @@ tools/cudatool.py fdematch <old>/run/libcuda.so.<old> <new>/run/libcuda.so.<new>
 tools/cudatool.py wrappers <new>/run/libcuda.so.<new>
 
 cd ../../debug/risc-v-gsp-rm-vm
-./greeneye.sh symbols export \
+./risc-v-gsp-rm-debugger.sh symbols export \
     --names ../../userspace/cuda/<new>/annotations/names.tsv \
     --index ../../userspace/cuda/<new>/run/analysis/decompiled/decompiled_index.tsv \
     --bias 0x100000 -o symbols-<new>.json
-./greeneye.sh symbols resolve --db symbols-<new>.json 0x<transferred-addr>
+./risc-v-gsp-rm-debugger.sh symbols resolve --db symbols-<new>.json 0x<transferred-addr>
 
 cd ../..
 tools/cuda-ab/ab.sh all      # host oracle + guest run + compare
@@ -352,7 +352,7 @@ tools/cuda-ab/ab.sh all      # host oracle + guest run + compare
 | Attribute | Detail |
 |---|---|
 | **Symptoms** | Probe first-touch addresses differ from the reference device; a firmware family/partition-manifest mismatch; ISA string differs (RV64GC vs RV64IMAC); aarch64 host reports `qemu-system-riscv64 not found`; PMU/SOE provisioning assumptions break. |
-| **Detection** | `file`/`readelf` image shape; pairing check (family, FMC partition manifest, version string); probe first-touch diff; host tooling check (`./greeneye.sh info`); `rmtool` host-oracle inventory. |
+| **Detection** | `file`/`readelf` image shape; pairing check (family, FMC partition manifest, version string); probe first-touch diff; host tooling check (`./risc-v-gsp-rm-debugger.sh info`); `rmtool` host-oracle inventory. |
 | **Evidence** | Device profile fields (PCI IDs, BARs, FB geometry, engine inventory, interrupt topology, ROM quirks); pairing notes; reference vs candidate first-touch maps; portability matrix report; physical validation record before any support claim. |
 | **Decision criteria** | Changed first-touch on profile registers → profile data, not logic. New firmware family/partition model → new family inputs, not a re-badged image. RV64GC or new CSRs → ISA/decoder work (S6). No physical validation → status stays Target/Experimental, never Supported. |
 | **Rollback** | Keep the reference device/firmware directories untouched; revert the candidate profile; a support claim is only removed with a matrix change note. |
@@ -376,8 +376,8 @@ tools/cuda-ab/ab.sh all      # host oracle + guest run + compare
 ```bash
 file <device-fwimage> && readelf -h <device-elf> && readelf -l <device-elf>
 cd debug/risc-v-gsp-rm-vm
-./greeneye.sh info
-./greeneye.sh probe <device-fwimage> --symbols symbols-<device>.json --record
+./risc-v-gsp-rm-debugger.sh info
+./risc-v-gsp-rm-debugger.sh probe <device-fwimage> --symbols symbols-<device>.json --record
 python3 harness/portability_matrix.py \
     --target <reference-fwimage> --target <device-fwimage> \
     --out dumps/matrix-<device>
@@ -412,7 +412,7 @@ python3 harness/portability_matrix.py \
 
 ```bash
 cd debug/risc-v-gsp-rm-vm
-./greeneye.sh probe <fwimage> --instructions <budget> --record
+./risc-v-gsp-rm-debugger.sh probe <fwimage> --instructions <budget> --record
 python3 examples/scripts/sim_diff.py        # requires QEMU; prints PARITY: OK on agreement
 make test
 ```
@@ -451,7 +451,7 @@ tools/rmtool/rmtool engine list
 cd debug/risc-v-gsp-rm-vm
 # snapshot the identity/static-config region before and after
 # (schema decode from the bundled/demo schema; real regions are version-keyed)
-./greeneye.sh compare dumps/<old-run> dumps/<new-run> --symbols
+./risc-v-gsp-rm-debugger.sh compare dumps/<old-run> dumps/<new-run> --symbols
 ```
 
 ### S8 — Encrypted/protected memory or protected instructions (measurement plan; non-claims)
@@ -528,11 +528,11 @@ python3 -m greeneye.device_map show dumps/<ver>-device-map.json
 
 ```bash
 cd debug/risc-v-gsp-rm-vm
-./greeneye.sh probe <fwimage> --record
+./risc-v-gsp-rm-debugger.sh probe <fwimage> --record
 python3 -m greeneye.device_map harvest dumps/<probe-session> --out dumps/<ver>-device-map.json
 python3 -m greeneye.device_map merge dumps/<ref>-device-map.json dumps/<ver>-device-map.json \
     --out dumps/merged-device-map.json
-./greeneye.sh compare dumps/<last-good-run> dumps/<stall-run> --symbols
+./risc-v-gsp-rm-debugger.sh compare dumps/<last-good-run> dumps/<stall-run> --symbols
 ```
 
 ### S10 — Multi-version matrix operations and CI (RM 610 requires explicit human approval)
@@ -635,7 +635,7 @@ Failure / new input observed
 |     YES -> simulator evidence is a hypothesis only (P3/P4/P5); record the
 |            fidelity gap; product change requires physical reproduction
 |
-+- Does it reproduce under a fixed stimulus in green-eye?
++- Does it reproduce under a fixed stimulus in risc-v-gsp-rm-debugger?
 |     NO  -> widen the stimulus / capture the real trace before theorising;
 |            absence of a hit is not proof of dead code
 |     YES -> classify with the S1 decision table (code changed vs behaviour moved)
@@ -668,20 +668,20 @@ Stop conditions (do not proceed, do not "temporarily" work around):
 | The input has not been hashed/versioned/paired | Every later claim is contaminated | S1 steps 1–3 |
 | RM 610 has no written approval | Hard gate | request approval with the readiness checklist |
 | The physical GPU is held by another job | Shared-oracle safety and fail-safe discipline | host-side read-only oracle (`rmtool gpu list`, `harness.sh`) |
-| You need type recovery or decompilation | green-eye is dynamic ground truth, not a decompiler | Ghidra corpus and symbol tooling |
-| You need guest-driver behaviour | green-eye observes firmware, not the guest | `tools/guest-diag/`, ioctl tracer |
+| You need type recovery or decompilation | risc-v-gsp-rm-debugger is dynamic ground truth, not a decompiler | Ghidra corpus and symbol tooling |
+| You need guest-driver behaviour | risc-v-gsp-rm-debugger observes firmware, not the guest | `tools/guest-diag/`, ioctl tracer |
 | A one-line question can be answered by `analyze` on an existing session | Do not produce new runs for no reason | reuse recorded sessions and `compare` |
 
 ## 9. One-page quick-reference decision tree
 
 | Symptom (first sign) | First command | Decision | Scenario |
 |---|---|---|---|
-| New image/version appears | `./greeneye.sh symbols export ...` + `probe --record` | hash+pair first, then version diff | S1 |
+| New image/version appears | `./risc-v-gsp-rm-debugger.sh symbols export ...` + `probe --record` | hash+pair first, then version diff | S1 |
 | OpenRM build breaks, `Unknown symbol` | `./scripts/build_nvidia_openrm.sh`; `dmesg` | glue-only vs interface change | S2 |
 | Control/ioctl inventory shifts | `python3 harness/control_discovery.py` | moved vs new logic | S3 |
 | `libcuda` bump / context failure | `tools/cudatool.py delta` + `fdematch` | patch / feature / reshuffle | S4 |
 | New device/architecture | `file`/`readelf`, `probe` | profile vs logic; physical validation for support | S5 |
-| Illegal/unknown instruction | `./greeneye.sh probe --instructions N` | ISA/decoder; fidelity gap if native-only | S6 |
+| Illegal/unknown instruction | `./risc-v-gsp-rm-debugger.sh probe --instructions N` | ISA/decoder; fidelity gap if native-only | S6 |
 | Identity/ROM fields differ | guest `lspci -vvv`, snapshot diff | consumed field → profile; else record | S7 |
 | Protected/encrypted state blocks | device map + lenient `mmio_log` | record fidelity gap; no extraction; no claims | S8 |
 | Early stall on PMU/SEC2/ACR/SOE | `probe --record` + device map | stub the missing exchange; gate security semantics | S9 |
@@ -692,15 +692,15 @@ and never let the last step touch anything we do not own.
 
 ## 10. Related documentation
 
-Green-eye suite (experimental, in development):
+Risc-V GSP-RM debugger suite (experimental, in development):
 
-* [green-eye user guide](05-operations/04-green-eye-user-guide.md) — what it
+* [risc-v-gsp-rm-debugger user guide](05-operations/04-risc-v-gsp-rm-debugger-user-guide.md) — what it
   is, quickstart, tool chooser and troubleshooting;
 * [GSP in a RISC-V VM](05-operations/03-risc-v-gsp-rm-vm.md) — project-level
   purpose, status and limits;
 * [`debug/risc-v-gsp-rm-vm/docs/00-OVERVIEW.md`](../debug/risc-v-gsp-rm-vm/docs/00-OVERVIEW.md)
   — tool status and doc map;
-* [`debug/risc-v-gsp-rm-vm/GREEN-EYE-ROADMAP.md`](../debug/risc-v-gsp-rm-vm/GREEN-EYE-ROADMAP.md)
+* [`debug/risc-v-gsp-rm-vm/RISC-V-GSP-RM-DEBUGGER-ROADMAP.md`](../debug/risc-v-gsp-rm-vm/RISC-V-GSP-RM-DEBUGGER-ROADMAP.md)
   — H1–H7 program;
 * [`debug/risc-v-gsp-rm-vm/docs/06-ACCURACY.md`](../debug/risc-v-gsp-rm-vm/docs/06-ACCURACY.md)
   — fidelity levels and the M1–M6 contract;