code wiki / _hdl_build / nx_council_gate.nx

nx_council_gate.nx

buildroot/runtime/_hdl_build/nx_council_gate.nx

19753 B294 linesdepth 3pulls 4 transitivereach 1 importersview sourcekind gate/proof
docsdependenciesstructsconstsfunctions

about

nx_council_gate.nx -- THE HIGH-BLAST-RADIUS COUNCIL-APPROVAL GATE: self-preservation so no single LLM can "delete it all / drop everything / break things." Operator 2026-07-04: "an LLM can PROPOSE things and upon COUNCIL APPROVAL (multiple Nishi team-member reviews) it can submit the highest-blast-radius actions, signaled via a UI." Balances quantity (an LLM proposes freely + fast) with quality (heavy actions need quorum). GROUNDED (nishi researcher): two-person rule / four-eyes (gov_twoperson.raw), quorum = threshold of a body required for a decision to be valid (gov_quorum.raw), engineering change-management CAB (gov_changemgmt.raw). COMPOSES, does not fork (Cardinal 15): the Warden (nx_warden_lib) already DENIES W_DELETE/W_OVERWRITE_SRC BY CONSTRUCTION (the self-preservation FLOOR -- an LLM cannot autonomously destroy). This adds the ESCALATION PATH the Warden lacked: those DENY-by-default actions become ALLOW *only* with a quorum-approved proposal by DISTINCT Nishi team roles (from the RACI). Sovereign seg-store, no TSV. Emits a UI-readable status line. FLOW: propose(action,target,rationale)->id[PENDING] -> review(id, role, APPROVE|REJECT) x N -> council_verdict(id): APPROVED iff (>=QUORUM distinct-role APPROVEs) AND (0 REJECTs); else PENDING/REJECTED -> warden_council_authorize(kind,target): ALLOW iff an APPROVED proposal exists for this exact action. license_tier: ORIGINAL genealogy_id: international-research-sources/{two_person_rule,quorum,change_management} lineage_id: nishi_council_gate_v1 expect_exit: 0

dependencies 3 imports · 1 importers

nx_syscalls.nx nx_seg_store.nx nx_warden_lib.nx nx_council_gate.nx nx_unified_conductor.nx

imports: nx_syscalls.nxnx_seg_store.nxnx_warden_lib.nx

imported by: nx_unified_conductor.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main cg_cli cg_streq cg_w sys_write cg_len nx_council_propose sys_mmap cg_cat cg_put sys_mmap ↻ cg_len ↻ ss_get sys_mmap ↻ ss_scan sys_mmap ↻ ss_manifest_dyn ss_scan_seglist ss_begin ss_begin_cap sys_mmap ↻ ss_add ss_add2 ss_w32 ss_len cg_seg_next ss_next_segid sys_mmap ↻ ss_cat ss_readall ss_segid_ok ss_commit ss_segid_ok ↻ sys_mmap ↻ ss_cat ↻ ss_catn sys_mmap ↻ sys_write ↻ ss_write_seg ss_segid_ok ↻

structs

none

consts

24const CG_STATUS_LOG: *u8 = "knowledge/status/council_gate.log\x00" // the UI-readable signal
25const CG_QUORUM: i64 = 3 // M-of-N: >=3 distinct-role APPROVEs (majority of the 5-role council) + 0 REJECTs
83const CG_ROLES: i64 = 5

functions

23func CG_PREFIX() -> *u8 { return "knowledge/store/council-\x00" as *u8 }
called by 3: nx_council_proposenx_council_reviewcg_tally
27func cg_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
calls 1: sys_write
28func cg_putn(v: i64) -> i64
called by 2: cg_climain calls 2: sys_writesys_mmap
35func cg_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
called by 3: cg_putcg_variantcg_w
36func cg_cat(dst: *u8, off: i64, src: *u8) -> i64 { var i: i64 = 0; while src[i] != (0 as u8) { dst[off + i] = src[i]; i = i + 1 } dst[off + i] = 0 as u8; return off + i }
called by 5: cg_signalnx_council_proposenx_council_reviewcg_tallycg_runid
37func cg_eq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } if b[i] != (0 as u8) { return 0 } return 1 }
43func cg_seg_next(prefix: *u8) -> i64 { let n: i64 = ss_next_segid(prefix); if n < 0 { return 1 } return n }
called by 1: cg_put calls 1: ss_next_segid
46func cg_put(prefix: *u8, key: *u8, val: *u8) -> i64
called by 2: nx_council_proposenx_council_review calls 7: sys_mmapcg_lenss_getss_beginss_addcg_seg_next+1
54func cg_signal(id: *u8, state: *u8, action: *u8, target: *u8) -> i64
called by 3: nx_council_proposenx_council_reviewnx_warden_council_authorize calls 5: sys_openat_appendsys_mmapcg_catsys_writesys_close
64func nx_council_propose(id: *u8, action: *u8, target: *u8, rationale: *u8) -> i64
called by 2: cg_climain calls 5: sys_mmapcg_catcg_putCG_PREFIXcg_signal
76func cg_role(n: i64) -> *u8
called by 1: cg_tally
87func nx_council_review(id: *u8, role: *u8, decision: *u8) -> i64
called by 3: nx_council_review_autocg_climain calls 5: sys_mmapcg_catcg_putCG_PREFIXcg_signal
96func cg_tally(id: *u8, out_approve: *i64, out_reject: *i64) -> i64
called by 1: nx_council_verdict calls 5: cg_rolesys_mmapcg_catss_getCG_PREFIX
113func nx_council_verdict(id: *u8) -> i64
called by 2: nx_warden_council_authorizecg_cli calls 2: sys_mmapcg_tally
126func cg_exists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 }
called by 1: nx_council_review_auto calls 2: sys_openat_rdsys_close
129func cg_variant(target: *u8, suffix: *u8, out: *u8) -> i64
called by 1: nx_council_review_auto calls 1: cg_len
144func nx_council_review_auto(id: *u8, target: *u8) -> i64
called by 2: cg_climain calls 4: sys_mmapcg_existsnx_council_reviewcg_variant
159func nx_warden_council_authorize(kind: i64, target: *u8, proposal_id: *u8) -> i64
called by 3: cg_climainmain calls 4: warden_authorizenx_council_verdictcg_signalw_kind_name
172func cg_w(s: *u8) -> i64 { sys_write(1, s, cg_len(s)); return 0 }
called by 3: cg_rowcg_climain calls 2: sys_writecg_len
173func cg_row(name: *u8, ok: i64) -> i64 { if ok == 1 { cg_w(" PASS " as *u8) } else { cg_w(" FAIL " as *u8) } cg_w(name); cg_w("\n" as *u8); return ok }
called by 1: main calls 1: cg_w
177func cg_runid(base: *u8, out: *u8) -> i64
called by 1: main calls 3: cg_catsys_now_realtime_secsys_mmap
190func cg_streq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } if b[i] != (0 as u8) { return 0 } return 1 }
called by 1: cg_cli
201func cg_cli(argc: i64, argv: *i64) -> i64
called by 1: main calls 8: cg_streqcg_wnx_council_proposenx_council_reviewnx_council_review_autocg_putn+2
239func main(argc: i64, argv: *i64) -> i64
calls 11: cg_clicg_wsys_mmapcg_runidnx_council_proposenx_warden_council_authorize+5