nx_ivvbeat.nx
buildroot/runtime/nx_ivvbeat.nx
about
nx_ivvbeat.nx -- the IV+V beat: re-runs the estate's own verification gates and reports DRIFT.
WHY THIS EXISTS. The ivvreg- plane holds four rows of desired independent-verification state and,
measured 2026-08-07 across buildroot/*.nx (51,707 files), _offc/*.sh (12,433) and knowledge/registry
(297) -- every scan marker-confirmed coverage_complete=1 -- NOTHING HAS EVER READ IT. The consumer was
specified in data and never built. So this is not a port of anything; the plane IS the spec.
(STAR)A DATA PLANE WITH NO CONSUMER IS A SPECIFICATION NOBODY IMPLEMENTED -- IT LOOKS LIKE STATE AND
BEHAVES LIKE A TODO. The rows even include a purpose-built negative control, so whoever wrote them knew
exactly what the beat had to do.
WHAT IT ANSWERS: "do the estate's own gates still pass?" That is the same hole board item 7 named for
published surfaces -- nothing was checking -- one level down: nothing checks the CHECKERS.
SAFETY. Every exec and every delete is decided by nx_ivvguard, whose predicates are proven 23/23 by
nx_ivvguard_gate INCLUDING all four live rows. That gate previously passed 12/12 while the predicate was
WRONG, because every fixture in it was fabricated; the four real rows were what exposed it.
THE WIPE IS DELIBERATELY NOT IMPLEMENTED IN v1, and each row says so out loud. The wipe column asks for
a prefix-glob delete; the verification value -- do the gates still pass -- is fully available without it.
(STAR)WHEN THE RISKY HALF OF A CAPABILITY IS NOT REQUIRED FOR ITS VALUE, SHIP THE OTHER HALF FIRST AND
MEASURE WHETHER THE RISKY HALF WAS EVER NEEDED. If gates pass unwiped, the delete is unnecessary; if they
fail, that is evidence the wipe is load-bearing, and its predicates are already proven and waiting.
A row whose wipe spec is UNSAFE is refused outright rather than run dirty -- the author asked for cleaning
this beat will not do, so its result would not mean what the row intended.
v1 IS REPORT-ONLY BY CONSTRUCTION: it files no debt. A detector's first live run must be readable before
it is allowed to write, or its own defects arrive as a pile of authored records.
license_tier: ORIGINAL No hw writes (Rule 26). Deletes nothing.
dependencies 4 imports · 0 importers
imports: nx_syscalls.nxnx_store_seed_lib.nxnx_guarded_run.nxnx_ivvguard.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 34 | const IVB_PLANECAP: i64 = 1048576 |
| 35 | const IVB_FIELDCAP: i64 = 4096 |
| 36 | const IVB_SCRATCH: i64 = 8192 |
| 37 | const IVB_DEADLINE_MS: i64 = 180000 |
| 38 | const IVB_MAXARGS: i64 = 32 |
| 39 | const IVB_TAB: i64 = 9 |
| 40 | const IVB_NL: i64 = 10 |
| 41 | const IVB_SP: i64 = 32 |
| 42 | const IVB_RC_NOTFOUND: i64 = 127 |
| 45 | const IVB_COVERAGE_FLOOR_PERMIL: i64 = 900 |
| 74 | const IVB_CLOCK_DEADLINE_MS: i64 = 900000 |
| 75 | const IVB_SWEEP_MARGIN_MS: i64 = 120000 |
| 76 | const IVB_SWEEP_BUDGET_MS: i64 = IVB_CLOCK_DEADLINE_MS - IVB_SWEEP_MARGIN_MS |
| 77 | const IVB_MODE_644: i64 = 0x1a4 |
functions
| 79 | func ivb_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } |
| 81 | func ivb_putn(v: i64) -> i64 |
| 92 | func ivb_streq(a: *u8, b: *u8) -> i64 called by 1: main |
| 101 | func ivb_field(buf: *u8, s: i64, e: i64, idx: i64, dst: *u8, dcap: i64) -> i64 called by 1: main |
| 130 | func ivb_build_argv(cmd: *u8, scratch: *u8, slot: *i64) -> i64 called by 1: main |
| 155 | func ivb_outpath(idx: i64, dst: *u8) -> i64 |
| 169 | func main() -> i64 |