code wiki / (root) / nx_sovereignty_audit.nx

nx_sovereignty_audit.nx

buildroot/runtime/nx_sovereignty_audit.nx

27893 B528 linesdepth 3pulls 3 transitivereach 0 importersview sourcekind tooltopic sovereignty
docsdependenciesstructsconstsfunctions

about

nx_sovereignty_audit.nx -- the team's SOVEREIGNTY-PURITY auditor. module: nishi-core.audit.sovereignty_audit depends: nishi-core.storage.seg_store, nishi-core.io.syscalls capability: AUDIT license_tier: ORIGINAL MISSION: a sovereignty-obsessed operator needs a sovereignty tool that is ITSELF perfectly sovereign. This organ recursively walks the WHOLE repo tree (its OWN bounded getdents64 work-stack -- no find/grep/python/sqlite, no shelling out, pure .nx), classifies EVERY file's sovereignty status with a DATA-DRIVEN policy, PERSISTS every PRODUCT-CONTAMINANT (+ a summary) to the sovereign seg_store so the debt is SEARCHABLE (ss_term later), and SELF-GATES with a positive + negative control liar-kill before printing GREEN. CLASSIFICATION (data-driven; the policy IS the tables below): ext SOVEREIGN = .nx / .md / .nxgate ext CANDIDATE-NONSOV = .py .sh .js .mjs .ts .tsv .conf .toml .json .css .html zone FENCED-REFERENCE = path contains /bench/ /.alelane/ /node_modules/ /_scratch/ /.build/ /.git/ (Law-1 allowed reference) zone PRODUCT = everything else per-file verdict: SOVEREIGN = .nx/.md/.nxgate anywhere FENCED-REFERENCE = candidate-non-sov in a fenced zone (allowed) PRODUCT-CONTAMINANT = candidate-non-sov in PRODUCT zone (the REAL debt) product_purity_permil = (n_product_files - n_product_contaminant)*1000 / n_product_files (files OUTSIDE fenced zones) LANDMINES DODGED (from the ecosystem's own registry): - DOUBLE-IMPORT of syscalls -> nxasm rc6. nx_dir.nx imports "syscalls.nx" (+nx_fcntl+nx_dirent) while nx_seg_store imports "nx_syscalls.nx"; pulling both double-defines sys_* and fails to build. So this organ imports the PROVEN-SAFE pair (nx_seg_store + nx_syscalls, the exact set nx_workstream_ store.nx uses) and does its OWN raw getdents64 walk. - The NxDirent STRUCT path crashes signal-11 under nx_cc_sovereign (nx_nas_book_census.nx header). So we walk struct-free over raw dirent bytes via dirent_reclen/dirent_type/dirent_name -- the proven shape. - JPL bounded-loop discipline: explicit budgets on dirs + files + iters; a cap HIT is reported LOUD (capped=1), never a silent truncation.

dependencies 2 imports · 0 importers

nx_seg_store.nx nx_syscalls.nx nx_sovereignty_audit.nx

imports: nx_seg_store.nxnx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main sav_p sav_w sys_write sys_mmap ss_begin ss_begin_cap sys_mmap ↻ sav_slen sys_openat_rd sys_getdents64 dirent_reclen dirent_name dirent_type sav_classify sav_ext_of sav_lc sav_is_sov_ext sav_streq sav_sov_ext sav_is_cand_ext sav_streq ↻ sav_cand_ext sav_is_fenced sav_has sav_slen ↻ sav_fence sav_is_fenced ↻ sav_cand_ext_idx sav_streq ↻ sav_cand_ext ↻ sav_class_of ss_add ss_add2 ss_w32 ss_len sys_close sav_catnum sys_mmap ↻ sav_catstr

structs

none

consts

42const SAV_MAGIC_8192: i64 = 8192
44const SAV_PREFIX: *u8 = "knowledge/store/sovaudit-"
45const SAV_LOG: *u8 = "knowledge/status/sovereignty_audit.log"
48const SAV_MAX_DIRS: i64 = 60000 // pending-dir stack ceiling
49const SAV_MAX_FILES: i64 = 400000 // classified-file ceiling
50const SAV_ITER_CAP: i64 = 2000000 // hard dir-pop ceiling (symlink-loop guard)
51const SAV_DIRBUF: i64 = 1048576 // getdents64 batch buffer (1 MiB)
52const SAV_DIR_ARENA: i64 = 268435456 // 256 MiB of dir-path bytes
53const SAV_TOPK: i64 = 15 // contaminant paths echoed to stdout
101const SAV_NSOV: i64 = 3
109const SAV_NCAND: i64 = 11
125const SAV_NFENCE: i64 = 18

functions

56func sav_w(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
called by 2: sav_psav_w2 calls 1: sys_write
57func sav_wn(fd: i64, buf: *u8, n: i64) -> i64 { sys_write(fd, buf, n); return 0 }
calls 1: sys_write
58func sav_n(fd: i64, v: i64) -> i64
called by 2: sav_pnsav_n2 calls 2: sys_mmapsys_write
64func sav_p(s: *u8) -> i64 { sav_w(1, s); return 0 }
called by 1: main calls 1: sav_w
65func sav_pn(v: i64) -> i64 { sav_n(1, v); return 0 }
called by 1: main calls 1: sav_n
67func sav_w2(lfd: i64, s: *u8) -> i64 { sav_w(1, s); if lfd >= 0 { sav_w(lfd, s) } return 0 }
called by 1: main calls 1: sav_w
68func sav_n2(lfd: i64, v: i64) -> i64 { sav_n(1, v); if lfd >= 0 { sav_n(lfd, v) } return 0 }
called by 1: main calls 1: sav_n
70func sav_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
called by 2: sav_hasmain
73func sav_lc(c: i64) -> i64 { if c >= 65 { if c <= 90 { return c + 32 } } return c }
called by 1: sav_ext_of
76func sav_streq(a: *u8, b: *u8) -> i64
called by 3: sav_is_sov_extsav_is_cand_extsav_cand_ext_idx
84func sav_has(hay: *u8, needle: *u8) -> i64
called by 1: sav_is_fenced calls 1: sav_slen
102func sav_sov_ext(i: i64) -> *u8
called by 1: sav_is_sov_ext
110func sav_cand_ext(i: i64) -> *u8
called by 3: sav_is_cand_extsav_cand_ext_idxmain
126func sav_fence(i: i64) -> *u8
called by 1: sav_is_fenced
155func sav_ext_of(name: *u8, extbuf: *u8) -> i64
called by 1: sav_classify calls 1: sav_lc
168func sav_is_sov_ext(extlc: *u8) -> i64
called by 1: sav_classify calls 2: sav_streqsav_sov_ext
174func sav_is_cand_ext(extlc: *u8) -> i64
called by 1: sav_classify calls 2: sav_streqsav_cand_ext
180func sav_cand_ext_idx(extlc: *u8) -> i64
called by 1: main calls 2: sav_streqsav_cand_ext
189func sav_class_of(ei: i64) -> i64
called by 1: main
205func sav_is_fenced(path: *u8) -> i64
called by 2: sav_classifymain calls 2: sav_hassav_fence
215func sav_classify(path: *u8, name: *u8, extbuf: *u8) -> i64
called by 1: main calls 4: sav_ext_ofsav_is_sov_extsav_is_cand_extsav_is_fenced
226func sav_vname(v: i64) -> *u8
235func sav_catstr(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){ dst[off+i]=s[i]; i=i+1 } return off+i }
called by 1: main
236func sav_catnum(dst: *u8, off: i64, v: i64) -> i64
called by 1: main calls 1: sys_mmap
246func main() -> i64
calls 25: sav_psys_mmapss_beginsav_slensys_openat_rdsys_getdents64+19