Core-1 Compute Preview

Status: normative preview; scalar and Apple CPU SIMD materializers implemented

C1-COMPUTE-001 — Surface. The canonical surface is Kernel<Signature>, capability-bearing Device, Tensor<Element,Rank,Layout>, TensorView<Element,Rank,Layout>, Shape<Rank>, and synchronous Device.run(kernel, inputs) -> Result<output, DeviceError>.

C1-COMPUTE-002 — Shape facts. Rank and layout are type facts. Extents are Shape<Rank> values refined by contracts. Proven constant extents may become specialization facts but do not introduce unrestricted dependent types.

C1-COMPUTE-003 — One checked IR. Tensor expressions cover elementwise operations, broadcasting, views, and explicit reductions; structured index-space iteration covers custom kernels. Both lower to one checked dataflow/index region.

Direct calls between compute messages are composed at checked-region lowering: the callee’s acyclic dataflow is inlined with canonical argument substitution. The same rule is applied after package linking, when imported targets have closure-wide identities. Recursive compute call graphs reject because they cannot produce a finite kernel region.

C1-COMPUTE-004 — Strict numerics. Strict is the default: no implicit reassociation or contraction, reductions have fixed logical order, explicit FMA differs from multiply-plus-add, and NaN plus signed-zero behavior is fixed. A relaxed profile explicitly binds reassociation, approximation, tolerance, and reproducibility permissions.

The source spellings Compute.fma(lhs, rhs, addend) and Compute.reduce_sum(input) are closed compute-only intrinsics. They survive in the semantic AST as compute-fma and compute-reduce-sum, and lower directly to their distinct checked dataflow operations; neither is desugared to ordinary multiply-plus-add or an implementation-selected reduction.

C1-COMPUTE-005 — Materializers. Conformance starts with a scalar reference executor and an independent Apple CPU SIMD materializer with masks and tail handling. Metal and MLX are follow-on providers. CUDA and OpenCL-style devices use a later provider ABI and add no vendor syntax. Async launch requires owned leases or lifetime-bounded tasks and follows synchronous conformance.

The preview embedding API issues an opaque zl_compute_device_v2 only from zl_compute_device_open_v2. Both explicit kernels and source-backed compute messages borrow that handle; selecting a provider name never substitutes for live device authority.

The bounded source adapter is an interpreted, non-portable algorithm message whose body is exactly Device.run(Type.kernel, inputs...). Its tensor-view parameters and owned tensor result must exactly match the referenced public compute message. The checked AST retains device-run; a private structural carrier preserves and relocates the target through complete-package linking. Execution occurs only through zl_compute_device_run_module_f64_v2 with a live device, and the scalar algorithm interpreter does not pretend to carry tensor values. In this first adapter, the C status and DeviceError out-parameter are the concrete Result representation; first-class source Result<Tensor, DeviceError> construction remains a later surface expansion.