nx_hygiene_prims.nx
buildroot/runtime/nx_hygiene_prims.nx
about
nx_hygiene_prims.nx -- foundational primitives for the
NISHI_CODE_HYGIENE_STANDARD.md (nishi-silicon commit f4cc144).
Provides the building blocks new code MUST use to satisfy
hygiene classes M1 (null safety), M2 (overflow safety), M4
(alloc safety), M5 (index safety). Once this ships, every
commit going forward starts born-clean per the ยง4.1 MUST set.
WINNER-TIER: WINNER-A (preserves the cardinal); paired with
the standards docs that establish the bar
INCUMBENTS: Rust std::option::Option, Rust checked_arithmetic,
Ada SPARK contracts, MISRA C INT30-C rule, CERT
INT32-C, libstd's bounds-checked indexer
NUMBERS: V1 ships the primitives; benchmark vs Rust's
checked_mul + alloc + Option pending paired bench
GAP: Rust's Option<T> is language-built-in; this is a
substrate-level convention. Future M3 milestone
lifts NxOpt into a language-level type.
PLAN: M-next: per-file remediation using these primitives;
ratchet metric tracks count of null-creation +
unchecked-alloc + raw-multiply sites going down per
commit
EXEMPTION REASON: n/a; provisional pending measurement
Status: SEED v0.1.0. 2026-05-27.
dependencies 1 imports · 1 importers
imports: nx_syscalls.nx
imported by: nx_search_query_parser.nx
structs
| 83 | struct NxOptPtr |
| 329 | struct NxLoopBudget |
consts
| 30 | const NX_HYG_OK: i64 = 0 |
| 31 | const NX_HYG_OVERFLOW: i64 = 600 |
| 32 | const NX_HYG_LOOP_BUDGET_EXCEEDED: i64 = 601 |
| 33 | const NX_HYG_BAD_INDEX: i64 = 602 |
| 34 | const NX_HYG_ALLOC_FAILED: i64 = 603 |
| 35 | const NX_HYG_NOT_IMPLEMENTED: i64 = 604 |
| 36 | const NX_HYG_BAD_TRUNCATION: i64 = 605 |
| 37 | const NX_HYG_USE_AFTER_RELEASE: i64 = 606 |
| 38 | const NX_HYG_DOUBLE_RELEASE: i64 = 607 |
| 39 | const NX_HYG_NULL_DEREF: i64 = 608 |
| 40 | const NX_HYG_UNCHECKED_RETURN: i64 = 609 |
| 43 | const NX_INT64_MAX: i64 = 9223372036854775807 |
| 44 | const NX_INT64_MIN: i64 = 0x8000000000000000 |
| 45 | const NX_BYTE_MAX: i64 = 255 |
| 46 | const NX_U16_MAX: i64 = 65535 |
| 47 | const NX_U32_MAX: i64 = 4294967295 |
| 52 | const NX_MAX_SINGLE_ALLOC_BYTES: i64 = 268435456 // 256 MiB |
| 61 | const NX_SIZEOF_NXOPT_T: i64 = 16 // discriminant + value pointer |
| 62 | const NX_SIZEOF_SAFE_INT_OUT: i64 = 8 // single i64 out-param |
functions
| 88 | func nx_opt_none(opt: *NxOptPtr) -> i64 |
| 95 | func nx_opt_some(opt: *NxOptPtr, ptr: *u8) -> i64 called by 1: nx_alloc_checked |
| 103 | func nx_opt_is_some(opt: *NxOptPtr) -> i64 |
| 113 | func nx_opt_unwrap(opt: *NxOptPtr) -> *u8 |
| 121 | func nx_opt_map(opt_in: *NxOptPtr, transform_fn: i64, calls 1: nx_opt_none |
| 146 | func nx_safe_add(a: i64, b: i64, out: *i64) -> i64 called by 1: nx_safe_sub |
| 164 | func nx_safe_sub(a: i64, b: i64, out: *i64) -> i64 calls 1: nx_safe_add |
| 177 | func nx_safe_mul(a: i64, b: i64, out: *i64) -> i64 |
| 212 | func nx_alloc_checked(size: i64, out_opt: *NxOptPtr) -> i64 |
| 240 | func nx_arr_get_i64(arr: *i64, cap: i64, idx: i64, out: *i64) -> i64 |
| 249 | func nx_arr_set_i64(arr: *i64, cap: i64, idx: i64, value: i64) -> i64 |
| 257 | func nx_arr_get_u8(arr: *u8, cap: i64, idx: i64, out: *i64) -> i64 |
| 266 | func nx_arr_set_u8(arr: *u8, cap: i64, idx: i64, value: i64) -> i64 |
| 289 | func nx_truncate_to_u8(v: i64, out: *i64) -> i64 |
| 297 | func nx_truncate_to_u16(v: i64, out: *i64) -> i64 |
| 305 | func nx_truncate_to_u32(v: i64, out: *i64) -> i64 |
| 335 | func nx_loop_budget_init(budget: *NxLoopBudget, max_iter: i64) -> i64 |
| 344 | func nx_loop_budget_step(budget: *NxLoopBudget) -> i64 |