@@ -173,15 +173,17 @@ def apply_enumerated_shapes(
     program,
     edge_program: ExportedProgram,
     enumerations: Dict[str, Sequence[int]],
+    *,
+    input_names: Sequence[str],
 ) -> None:
     """Attach enumerated shapes to the coreai program (all delivery modes).
 
     ``enumerations`` is ``{symbol_name: [value, ...]}`` (from
     :func:`resolve_input_enumerations`).  For each of this subgraph's user inputs
     we read its symbolic shape from ``edge_program`` and substitute every
     combination of the enumerated symbol values, then attach the resulting shapes
-    via ``set_static_shape_config``.  Inputs are matched to coreai graph inputs by
-    name (the converter names each coreai input after its edge placeholder).
+    via ``set_static_shape_config``. ``input_names`` are the names the converter
+    was given for the user inputs, in boundary order.
     """
     if not enumerations:
         return
@@ -198,17 +200,17 @@ def apply_enumerated_shapes(
     # (a batch dim, say) would not be held equal.
     boundary_inputs = []
     active_symbols = set()
-    for uname in user_inputs:
-        # Match edge user inputs to coreai graph inputs by name; skip anything
-        # that isn't a coreai tensor input (e.g. a taken-over constant).
-        if not isinstance(uname, str) or uname not in coreai_names:
+    for uname, converted_name in zip(user_inputs, input_names):
+        # Skip anything that isn't a coreai tensor input (e.g. a taken-over
+        # constant).
+        if not isinstance(uname, str) or converted_name not in coreai_names:
             continue
         node = placeholders.get(uname)
         val = node.meta.get("val") if node is not None else None
         if not hasattr(val, "shape"):
             continue
         dims = list(val.shape)
-        boundary_inputs.append((uname, dims))
+        boundary_inputs.append((converted_name, dims))
         active_symbols |= _shape_symbols(dims) & set(enumerations)
 
     if not active_symbols:
 
@@ -13,7 +13,7 @@
 """
 
 import logging
-from typing import Any, List, Sequence, Tuple
+from typing import Any, List, Optional, Sequence, Tuple
 
 import torch
 from executorch.backends.apple.coreai.compiler.constants import MAIN_ENTRYPOINT
@@ -180,7 +180,49 @@ def io_mismatches(
     return errors
 
 
-def assert_io_compatible(program, edge_program: ExportedProgram) -> None:
+def coreai_io_names(program) -> Tuple[List[str], List[str]]:
+    """Boundary I/O names in graph argument/result order, never dictionary order.
+
+    State arguments (marked ``MutableBuffers.buffer_mutation``) and the results
+    they name are skipped: they are not ExecuTorch boundary I/O.
+    """
+    graph = program._get_graph(MAIN_ENTRYPOINT)
+    arg_attrs = list(graph.arg_attrs)
+    res_attrs = list(graph.res_attrs)
+    for kind, attrs, types in (
+        ("input", arg_attrs, graph.function_type.value.inputs),
+        ("output", res_attrs, graph.function_type.value.results),
+    ):
+        if len(attrs) != len(types) or any("coreai.name" not in a for a in attrs):
+            raise ValueError(f"Core AI {kind} names must be complete and unique")
+    state_results = {
+        a["MutableBuffers.buffer_mutation"].value
+        for a in arg_attrs
+        if "MutableBuffers.buffer_mutation" in a
+    }
+    inputs = [
+        a["coreai.name"].value
+        for a in arg_attrs
+        if "MutableBuffers.buffer_mutation" not in a
+    ]
+    outputs = [
+        a["coreai.name"].value
+        for a in res_attrs
+        if a["coreai.name"].value not in state_results
+    ]
+    for kind, names in (("input", inputs), ("output", outputs)):
+        if len(set(names)) != len(names):
+            raise ValueError(f"Core AI {kind} names must be complete and unique")
+    return inputs, outputs
+
+
+def assert_io_compatible(
+    program,
+    edge_program: ExportedProgram,
+    *,
+    input_names: Optional[Sequence[str]] = None,
+    output_names: Optional[Sequence[str]] = None,
+) -> None:
     """Raise if the ``.aimodel`` boundary I/O is incompatible with ExecuTorch."""
     coreai_in, coreai_out = _coreai_io(program)
     edge_in, edge_out = _edge_io(edge_program)
@@ -198,6 +240,17 @@ def assert_io_compatible(program, edge_program: ExportedProgram) -> None:
     errors = io_mismatches(coreai_in, edge_in, "input") + io_mismatches(
         coreai_out, edge_out, "output"
     )
+    if input_names is not None or output_names is not None:
+        actual_inputs, actual_outputs = coreai_io_names(program)
+        for kind, actual, expected in (
+            ("input", actual_inputs, input_names),
+            ("output", actual_outputs, output_names),
+        ):
+            if expected is not None and actual != list(expected):
+                errors.append(
+                    f"{kind} names mismatch: .aimodel has {actual}, "
+                    f"ExecuTorch expects {list(expected)}"
+                )
     if errors:
         raise ValueError(
             "Core AI delegate boundary is incompatible with ExecuTorch:\n  "
 
@@ -24,7 +24,11 @@
 from executorch.backends.apple.coreai.compiler.enumerated_shapes import (
     apply_enumerated_shapes,
 )
-from executorch.backends.apple.coreai.compiler.io_compat import assert_io_compatible
+from executorch.backends.apple.coreai.compiler.io_compat import (
+    _edge_io,
+    assert_io_compatible,
+    coreai_io_names,
+)
 from executorch.backends.apple.coreai.passes.replace_copy_ops import (
     ReplaceCopyOpsWithFunctionalPass,
 )
@@ -319,12 +323,22 @@ def _prepare_program_for_conversion(edge_program: ExportedProgram) -> ExportedPr
     return ep
 
 
-def _convert_to_aiprogram(edge_program: ExportedProgram):
+def _convert_to_aiprogram(
+    edge_program: ExportedProgram,
+    *,
+    input_names: Optional[List[str]] = None,
+    output_names: Optional[List[str]] = None,
+):
     from coreai_torch import TorchConverter
 
     aten_program = _prepare_program_for_conversion(edge_program)
     converter = TorchConverter()
-    converter.add_exported_program(aten_program)
+    converter.add_exported_program(
+        aten_program,
+        input_names=input_names,
+        output_names=output_names,
+        entrypoint_name=MAIN_ENTRYPOINT,
+    )
     return converter.to_coreai()
 
 
@@ -558,16 +572,33 @@ def preprocess(
                     "build-time output directory (set it via coreai_sidecar_dir)"
                 )
 
-        program = _convert_to_aiprogram(edge_program)
+        edge_inputs, edge_outputs = _edge_io(edge_program)
+        input_names = [f"input_{i}" for i in range(len(edge_inputs))]
+        output_names = [f"output_{i}" for i in range(len(edge_outputs))]
+        program = _convert_to_aiprogram(
+            edge_program, input_names=input_names, output_names=output_names
+        )
         # Fail fast if the .aimodel boundary I/O won't match what ET feeds/reads.
-        assert_io_compatible(program, edge_program)
+        assert_io_compatible(
+            program, edge_program, input_names=input_names, output_names=output_names
+        )
+        # Enumerated shapes replace ``main`` with renamed clones, so read first.
+        bound_inputs, bound_outputs = coreai_io_names(program)
         raw_enum = _get_compile_spec(
             compile_specs, COMPILE_SPEC_KEYS.INPUT_ENUMERATIONS
         )
         if raw_enum:
             apply_enumerated_shapes(
-                program, edge_program, json.loads(raw_enum.decode())
+                program,
+                edge_program,
+                json.loads(raw_enum.decode()),
+                input_names=input_names,
             )
+        bindings = {
+            "function": MAIN_ENTRYPOINT,
+            "input_names": bound_inputs,
+            "output_names": bound_outputs,
+        }
 
         # min-deployment-version is a single knob applied to whichever artifact
         # ships: for aot-compiled delivery the .aimodelc (via coreai-build
@@ -579,18 +610,19 @@ def preprocess(
             _maybe_warn_sidecar_env_ignored()
         if aot_compiled:
             return CoreAIBackend._preprocess_aot_compiled(
-                program, _aot_compile_options(compile_specs), sidecar_dir
+                program, _aot_compile_options(compile_specs), sidecar_dir, bindings
             )
         return CoreAIBackend._preprocess_portable(
             program,
             _min_os_version(compile_specs),
             sidecar_dir,
+            bindings,
         )
 
     # Portable .aimodel delivery.
     @staticmethod
     def _preprocess_portable(
-        program, min_os, sidecar_dir: Optional[str]
+        program, min_os, sidecar_dir: Optional[str], bindings: Dict[str, Any]
     ) -> PreprocessResult:
         with TemporaryDirectory() as tmp:
             model_hash = _save_and_hash(program, Path(tmp) / "model.aimodel", min_os)
@@ -599,6 +631,7 @@ def _preprocess_portable(
                 model_hash,
                 AssetPackaging.SIDECAR if sidecar_dir else AssetPackaging.INLINE,
                 {
+                    **bindings,
                     # relative path the runtime resolves against its base
                     "path": f"{model_hash}/model.aimodel",
                     "min_deployment_version": _os_version_text(min_os),
@@ -609,7 +642,10 @@ def _preprocess_portable(
     # AOT-compiled .aimodelc delivery (per architecture).
     @staticmethod
     def _preprocess_aot_compiled(
-        program, opts: Dict[str, Any], sidecar_dir: Optional[str]
+        program,
+        opts: Dict[str, Any],
+        sidecar_dir: Optional[str],
+        bindings: Dict[str, Any],
     ) -> PreprocessResult:
         with TemporaryDirectory() as tmp:
             model_hash, out = _compile_aot(program, opts, Path(tmp))
@@ -622,6 +658,7 @@ def _preprocess_aot_compiled(
                     else AssetPackaging.AOT_COMPILED_INLINE
                 ),
                 {
+                    **bindings,
                     "platform": opts["platform"],
                     "min_deployment_version": opts["min_deployment_version"],
                     "archs": {
 
@@ -22,9 +22,13 @@
     get_default_compile_config,
     get_default_passes,
 )
-from executorch.backends.apple.coreai.compiler.io_compat import io_mismatches
+from executorch.backends.apple.coreai.compiler.io_compat import (
+    assert_io_compatible,
+    io_mismatches,
+)
+from executorch.backends.apple.coreai.compiler.preprocess import _convert_to_aiprogram
 from executorch.backends.apple.coreai.partition.partitioner import CoreAIPartitioner
-from executorch.exir import to_edge_transform_and_lower
+from executorch.exir import to_edge, to_edge_transform_and_lower
 from executorch.exir.lowered_backend_module import executorch_call_delegate
 from torch.export import Dim
 
@@ -33,6 +37,28 @@ class _Sym:
     """Stand-in for a symbolic (dynamic) edge dim."""
 
 
+class OrderedNamesTest(unittest.TestCase):
+    def test_same_shaped_reordered_names_are_rejected(self):
+        """Dtype and shape checks can't tell same-shaped I/O apart; names can."""
+
+        class Subtract(nn.Module):
+            def forward(self, z, a):
+                return z - a, a - z
+
+        edge = to_edge(
+            torch.export.export(Subtract(), (torch.ones(2, 4), torch.zeros(2, 4)))
+        ).exported_program()
+        inputs = ["input_0", "input_1"]
+        outputs = ["output_0", "output_1"]
+        program = _convert_to_aiprogram(
+            edge, input_names=inputs[::-1], output_names=outputs
+        )
+        with self.assertRaisesRegex(ValueError, "input names mismatch"):
+            assert_io_compatible(
+                program, edge, input_names=inputs, output_names=outputs
+            )
+
+
 class IoMismatchesTest(unittest.TestCase):
     def test_io_mismatches(self):
         # (name, coreai_io, edge_io, expected substring or None if compatible)
 
@@ -238,6 +238,21 @@ def test_end_to_end_sidecar(self):
             self.assertTrue((bundles[0] / "main.mlirb").exists())
 
 
+class ManifestBindingsTest(unittest.TestCase):
+    def test_names_follow_boundary_order_past_single_digits(self):
+        class ManyInputs(nn.Module):
+            def forward(self, *args):
+                return tuple(x - float(i) for i, x in enumerate(args))
+
+        edge = to_edge(
+            torch.export.export(ManyInputs(), tuple(torch.ones(2) for _ in range(12)))
+        ).exported_program()
+        manifest = json.loads(CoreAIBackend.preprocess(edge, []).processed_bytes)
+        self.assertEqual(manifest["function"], "main")
+        self.assertEqual(manifest["input_names"], [f"input_{i}" for i in range(12)])
+        self.assertEqual(manifest["output_names"], [f"output_{i}" for i in range(12)])
+
+
 def _lower_with_break(partitioner):
     """Lower a model whose middle op is tagged, forcing two delegates."""
     from executorch.backends.apple.coreai import get_default_passes
 
@@ -294,7 +294,9 @@ def test_inputs_sharing_a_symbol_are_enumerated_together(self):
         for key, shapes in entries.items():
             with self.subTest(key):
                 self.assertEqual(
-                    set(shapes), {"x", "y"}, f"{key} leaves an input unconstrained"
+                    set(shapes),
+                    {"input_0", "input_1"},
+                    f"{key} leaves an input unconstrained",
                 )
                 self.assertEqual(len({tuple(s) for s in shapes.values()}), 1)
 
@@ -329,7 +331,7 @@ def test_every_boundary_input_is_named(self):
         for cfg in captured:
             for key, shapes in cfg.items():
                 with self.subTest(key):
-                    self.assertEqual(set(shapes), {"x", "y"})
+                    self.assertEqual(set(shapes), {"input_0", "input_1"})
 
 
 class SubgraphBoundaryTest(unittest.TestCase):
@@ -356,7 +358,12 @@ def _lower_split(self):
             len(captured), 2, "expected a graph break into exactly 2 delegates"
         )
         # Identify by content rather than order, which preprocess does not fix.
-        model_input = next(c for c in captured if "x" in next(iter(c.values())))
+        model_input = next(
+            c
+            for c in captured
+            if sorted(tuple(s) for v in c.values() for s in v.values())
+            == [(4, 8), (16, 8)]
+        )
         intermediate = next(c for c in captured if c is not model_input)
         return model_input, intermediate