nx_osattest.nx

nx_osattest.nx -- LR6: NISHIOS + NISHI BROWSER LANGUAGE-RING INHERITANCE ATTESTATION. WHAT IT ANSWERS. Chromium's Rule of 2 forbids combining untrustworthy input, an unsafe language and high privilege; the incumbents discharge it by SANDBOXING AROUND their language. A kernel-up single-language stack can discharge the unsafe-language leg directly -- but only if that is MEASURED, not asserted. This organ rebuilds the NishiOS kernel closure and the Nishi Browser closure under each DECLARED safety mode of a named compiler and writes a receipt both compare pages cite. IT IS A MEASUREMENT ORGAN. It never edits the compiler, the kernel or the browser; it never assembles, never runs a produced binary, and never promotes anything. Its only writes are the receipt and its own scratch under the conf's scratch_dir. A REFUSAL IS A FINDING, NOT A FAILURE OF THIS ORGAN. A closure that will not compile under an enforcing mode is exactly the Rule-of-2 evidence the rung exists to produce, so REFUSED cells are DATA and leave the exit code at 0. What DOES move the exit code is an attestation that cannot be trusted: a subject whose source does not resolve (3), or one that will not build under the DEFAULT mode (1), in which case nothing measured under a mode is attributable to that mode. THE HAZARD THAT SHAPES THE WHOLE DESIGN. nx_compile_x86's long-flag dispatch keys on ONE BYTE (arg[2]). An unrecognised long flag is therefore SILENTLY IGNORED and the compile still returns 0 -- so an attester that trusted a flag NAME would publish ATTESTED for a mode enforcing nothing, and its green would be indistinguishable from a real one. Every axis is therefore proven LIVE first, from BOTH sides, against the compiler under test: for a refuse-kind mode the hazard fixture must be REFUSED with the DECLARED rule slug in stderr while a clean fixture is still ACCEPTED; for the emit-kind crash guard the marker must appear by default and vanish under the opt-out. An axis that cannot be proven live is UNOBSERVABLE -- neither clean nor refused -- and is NAMED in the receipt beside the denominator, because an abstention nobody reads is a lie nobody told. COMPOSED, NOT RE-IMPLEMENTED: nx_ccgate_lib (the ONE compiler-spawn driver), nx_incclosure_lib (the ONE name->path resolver and hex encoder), nx_lineconf_lib (the ONE line-anchored conf reader), nx_closurehash (the ONE closure enumerator, FORKED for provenance). Every path, flag, fixture and rule slug is a row in knowledge/lang_attest.conf (rule 11). RESOURCE ENVELOPE. Allocations are mmap'd once and live for the process (arena doctrine, no free): tables sized from the conf's own counts, one receipt buffer DERIVED from those counts, one digit scratch. Per run it spawns 4 compiles per refuse-axis and 2 per emit-axis (all on sub-2 KB fixtures), plus 1 baseline + one-per-live-refuse-axis compiles per closure and one nx_closurehash fork per closure. The emit axis costs NO extra compile: it reads the baseline assembly already produced. Scratch .s files are REUSED in place (sys_openat_wr is O_TRUNC), so peak scratch is one baseline .s plus one mode .s, never one per cell.