_lawsweep_gate.nx source

1// _lawsweep_gate.nx -- ESTATE-WIDE ANTI-PATTERN CENSUS. The standing enforcement of laws that were 2// previously only written down in comments. 3// 4// WHY THIS EXISTS. On 2026-08-07 a defect class was found, fixed in TWO organs, and reported as 5// handled. The full population turned out to be 394 sites across 339 live sources -- 84% of every 6// number printer in the estate. Fixing the instances you happen to trip over is not fixing the 7// class, and a law recorded in a comment is enforced by nobody. 8// A LAW THAT IS NOT A RUNNING CHECK IS A COMMENT, AND A COMMENT IS NOT A CONTROL. 9// 10// It reuses nx_forkcensus's proven primitives rather than authoring a fourth directory walker -- 11// crucially fc_in_comment(), which separates a STRING LITERAL from a COMMENT ABOUT one. That 12// distinction is exactly what a grep cannot make: the first estate measurement of hardcoded laptop 13// paths returned 154 files, but the extraction had captured prose from a comment where someone had 14// already written the warning down. A GREP FINDS THE CLAIM; ONLY A STAT SETTLES IT -- AND ONLY A 15// PARSER SEPARATES A LITERAL FROM A COMMENT ABOUT THE LITERAL. 16// 17// T1 SIGN-DROP == 0 -- the number-printer class, estate-wide, in code (not comments). 18// T2 NEG CTL -- a fixture that CONTAINS the defect must be DETECTED. Without this the 19// gate scores its loudest PASS when the scanner is broken and sees nothing. 20// T3 NON-VACUOUS -- files and bytes actually scanned > 0. A zero census is not a clean census. 21// T4 DISCRIMINATOR -- a fixture carrying the SAME token once as a literal and once in a comment 22// must be reported as exactly 1 and 1. This proves the literal/comment split 23// that every count below depends on. 24// 25// It also MEASURES (does not gate) the foreign-host absolute-path class, literal-only, so the 26// unrunnable-by-construction population finally has an honest number instead of a grep upper bound. 27// 28// Evidence -> knowledge/status/lawsweep.log (LAWSWEEP row). Sovereign. license_tier: ORIGINAL 29import "nx_forkcensus.nx" 30import "nx_gate_verdict.nx" 31 32const LS_DIRBUF: i64 = 1048640 33const LS_FILEBUF: i64 = 2097152 34const LS_PATHCAP: i64 = 1024 35const LS_FIX: *u8 = "/tmp/_lawsweep_fixture.nx" 36const LS_LOG: *u8 = "knowledge/status/lawsweep.log" 37 38// counter slots 39const LS_FILES: i64 = 0 40const LS_BYTES: i64 = 1 41const LS_SIGN: i64 = 2 // sign-dropping printers, in CODE 42const LS_SIGNC: i64 = 3 // ... the same token inside a comment 43const LS_FPATH: i64 = 4 // foreign-host absolute paths, in CODE 44const LS_FPATHC: i64 = 5 // ... inside a comment 45const LS_SELF: i64 = 6 // this organ's own source, excluded and DECLARED (never silently dropped) 46// A GREP FINDS THE CLAIM; ONLY A STAT SETTLES IT. A foreign-host path that RESOLVES here is a working 47// dependency on another machine's filesystem; one that does NOT is an organ that cannot run at all. 48// Those are different defects with different remedies, so they get different counters -- and 49// LS_FPATH_DEAD + LS_FPATH_LIVE must SUM to the code total, or the census is leaking rows. 50const LS_FPATH_DEAD: i64 = 7 51const LS_FPATH_LIVE: i64 = 8 52// BARE-FAIL teeth: a gate tooth that prints "FAIL" and then a newline, with no operand values. 53// MEASURED COST 2026-08-07: nx_pw_rotate_gate's K3 and K4 both did this. The gate takes 228 SECONDS, 54// so every time a bare FAIL was read it cost a full reproduction run just to learn WHICH operand was 55// wrong -- and when K4 alone was instrumented, the very next run failed at K3 and was undiagnosable 56// again. A TOOTH THAT CANNOT SAY WHY IT FAILED COSTS A FULL RUN EVERY TIME IT IS READ, and 57// INSTRUMENTING ONE TOOTH WHILE LEAVING ITS TWIN BARE BUYS EXACTLY ONE RUN OF INSIGHT. 58// Counted, not yet gated: the baseline is unknown, so this publishes the number first and a floor 59// can be ratcheted onto it once the population is measured -- declaring a bar before measuring the 60// population is how an unmeasured budget gets treated as conservative because it is small. 61const LS_BAREFAIL: i64 = 9 // "FAIL" immediately followed by newline -- no operands 62const LS_DIAGFAIL: i64 = 10 // "FAIL " followed by more text -- operands present 63const LS_NSLOTS: i64 = 14 64 65func ls_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 66func ls_fp(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 67func ls_fn(fd: i64, v: i64) -> i64 { 68 let bb: *u8 = sys_mmap(32) 69 var m: i64 = v 70 var neg: i64 = 0 71 if m < 0 { m = 0 - m; neg = 1 } 72 let t: *u8 = sys_mmap(32) 73 var k: i64 = 0 74 if m == 0 { t[0] = 48 as u8; k = 1 } 75 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 76 var o: i64 = 0 77 if neg == 1 { bb[0] = 45 as u8; o = 1 } 78 var i: i64 = 0 79 while i < k { bb[o + i] = t[k - 1 - i]; i = i + 1 } 80 sys_write(fd, bb, k + o) 81 return 0 82} 83 84// Count occurrences of `pat` in buf, splitting CODE vs COMMENT via fc_in_comment. 85// code_out[0] += code hits ; com_out[0] += comment hits. 86func ls_count(buf: *u8, n: i64, pat: *u8, code_out: *i64, com_out: *i64) -> i64 { 87 let pl: i64 = fc_slen(pat) 88 if pl <= 0 { return 0 } 89 var i: i64 = 0 90 while i + pl <= n { 91 var k: i64 = 0 92 var hit: i64 = 1 93 while k < pl { if buf[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } } 94 if hit == 1 { 95 if fc_in_comment(buf, i) == 1 { com_out[0] = com_out[0] + 1 } 96 if fc_in_comment(buf, i) == 0 { code_out[0] = code_out[0] + 1 } 97 i = i + pl 98 } 99 if hit == 0 { i = i + 1 } 100 } 101 return 0 102} 103 104// Count foreign-host path literals, and STAT each one so DEAD and LIVE are separated. 105// The path is recovered from its enclosing string literal: fc_open_quote walks back to the opening 106// quote, and we scan forward to the closing one. A hit with no enclosing literal is a COMMENT hit 107// by construction and is counted there, never stat'd. 108func ls_count_paths(buf: *u8, n: i64, pat: *u8, ctr: *i64) -> i64 { 109 let pl: i64 = fc_slen(pat) 110 if pl <= 0 { return 0 } 111 let pbuf: *u8 = sys_mmap(LS_PATHCAP) 112 var i: i64 = 0 113 while i + pl <= n { 114 var k: i64 = 0 115 var hit: i64 = 1 116 while k < pl { if buf[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } } 117 if hit == 1 { 118 if fc_in_comment(buf, i) == 1 { ctr[LS_FPATHC] = ctr[LS_FPATHC] + 1 } 119 if fc_in_comment(buf, i) == 0 { 120 ctr[LS_FPATH] = ctr[LS_FPATH] + 1 121 let op: i64 = fc_open_quote(buf, i) 122 var cl: i64 = i 123 var sc: i64 = 1 124 while sc == 1 { 125 if cl >= n { sc = 0 } else { 126 if buf[cl] == (34 as u8) { sc = 0 } else { cl = cl + 1 } 127 } 128 } 129 var resolved: i64 = 0 130 if op >= 0 { if cl > op + 1 { if cl - op - 1 < LS_PATHCAP - 1 { 131 var w: i64 = 0 132 var r: i64 = op + 1 133 while r < cl { pbuf[w] = buf[r]; w = w + 1; r = r + 1 } 134 pbuf[w] = 0 as u8 135 resolved = 1 136 if fc_exists(pbuf) == 1 { ctr[LS_FPATH_LIVE] = ctr[LS_FPATH_LIVE] + 1 } 137 if fc_exists(pbuf) == 0 { ctr[LS_FPATH_DEAD] = ctr[LS_FPATH_DEAD] + 1 } 138 } } } 139 // No enclosing literal we could bound: count it DEAD-unknown rather than drop it, 140 // so the partition still sums. A row you cannot classify is still a row. 141 if resolved == 0 { ctr[LS_FPATH_DEAD] = ctr[LS_FPATH_DEAD] + 1 } 142 } 143 i = i + pl 144 } 145 if hit == 0 { i = i + 1 } 146 } 147 return 0 148} 149 150// Build the 6-byte sequence F A I L backslash n WITHOUT a source escape. 151// Two reasons, both learned this session: (1) whether NishiLang renders \\ as one backslash is not 152// worth betting a census on -- an escape that resolves differently than you assume silently changes 153// what you measured, and a shell-level version of exactly that mistake made this same grep report 154// 0 bare-FAIL teeth when the true count was 4,526; (2) a literal here would make this organ detect 155// ITSELF, the trap that already cost this gate a red run. 156func ls_pat_barefail(p: *u8) -> i64 { 157 p[0] = 70 as u8 // F 158 p[1] = 65 as u8 // A 159 p[2] = 73 as u8 // I 160 p[3] = 76 as u8 // L 161 p[4] = 92 as u8 // backslash 162 p[5] = 110 as u8 // n 163 p[6] = 0 as u8 164 return 6 165} 166 167// Scan one file's bytes for every tracked anti-pattern. 168func ls_scan(buf: *u8, n: i64, ctr: *i64) -> i64 { 169 let cs: *i64 = sys_mmap(16) as *i64 170 let cc: *i64 = sys_mmap(16) as *i64 171 cs[0] = 0; cc[0] = 0 172 ls_count(buf, n, "if m<0{m=0-m}" as *u8, cs, cc) 173 ctr[LS_SIGN] = ctr[LS_SIGN] + cs[0] 174 ctr[LS_SIGNC] = ctr[LS_SIGNC] + cc[0] 175 ls_count_paths(buf, n, "/mnt/c/Users/elder" as *u8, ctr) 176 // BARE-FAIL teeth, counted in CODE only (a FAIL discussed in a comment is not a tooth). 177 let bf: *u8 = sys_mmap(16) 178 ls_pat_barefail(bf) 179 let fb: *i64 = sys_mmap(16) as *i64 180 let fbc: *i64 = sys_mmap(16) as *i64 181 fb[0] = 0; fbc[0] = 0 182 ls_count(buf, n, bf, fb, fbc) 183 ctr[LS_BAREFAIL] = ctr[LS_BAREFAIL] + fb[0] 184 return 0 185} 186 187// Walk a directory of .nx sources, scanning each. Same getdents64 shape nx_forkcensus proved. 188func ls_walk(dir: *u8, ctr: *i64) -> i64 { 189 let dfd: i64 = sys_openat_rd(dir) 190 if dfd < 0 { return 0 - 1 } 191 let dirbuf: *u8 = sys_mmap(LS_DIRBUF) 192 let filebuf: *u8 = sys_mmap(LS_FILEBUF) 193 let pathbuf: *u8 = sys_mmap(LS_PATHCAP) 194 let dl: i64 = fc_slen(dir) 195 var done: i64 = 0 196 while done == 0 { 197 let nb: i64 = sys_getdents64(dfd, dirbuf, 1048576) 198 if nb <= 0 { done = 1 } 199 if nb > 0 { 200 var off: i64 = 0 201 while off < nb { 202 let base: i64 = dirbuf as i64 203 let rec: *u8 = (base + off) as *u8 204 let rl: i64 = dirent_reclen(rec) 205 if rl <= 0 { off = nb } 206 if rl > 0 { 207 let name: *u8 = dirent_name(rec) 208 let nl: i64 = fc_slen(name) 209 // SKIP THIS ORGAN'S OWN SOURCE. It necessarily contains every pattern it hunts -- 210 // once as the search argument, once inside the fixture it writes -- so scanning 211 // itself reports 2 phantom hits and T1 can never go green. 212 // A SEARCH FOR A STRING FINDS THE TOOL THAT WENT LOOKING FOR IT. 213 // The exclusion is exactly ONE named file and it is COUNTED and PRINTED below, so 214 // it stays a declared decision rather than a silent hole: an exclusion you can 215 // reconcile to the unit is a decision, a residual you cannot is a leak. 216 var is_self: i64 = 0 217 if fc_starts(name, "_lawsweep_gate.nx" as *u8) == 1 { is_self = 1 } 218 if is_self == 1 { ctr[LS_SELF] = ctr[LS_SELF] + 1 } 219 if fc_is_nx(name, nl) == 1 { if is_self == 0 { 220 var p: i64 = 0 221 while p < dl { pathbuf[p] = dir[p]; p = p + 1 } 222 pathbuf[p] = 47 as u8; p = p + 1 223 var q: i64 = 0 224 while q < nl { pathbuf[p] = name[q]; p = p + 1; q = q + 1 } 225 pathbuf[p] = 0 as u8 226 let fl: i64 = fc_read(pathbuf, filebuf, LS_FILEBUF - 8) 227 if fl > 0 { 228 ctr[LS_FILES] = ctr[LS_FILES] + 1 229 ctr[LS_BYTES] = ctr[LS_BYTES] + fl 230 ls_scan(filebuf, fl, ctr) 231 } 232 } } 233 off = off + rl 234 } 235 } 236 } 237 } 238 sys_close(dfd) 239 return 0 240} 241 242// The fixture carries, DELIBERATELY: one defective printer in CODE, and the foreign-path token twice 243// -- once inside a string literal and once inside a // comment. T2 needs the first; T4 needs both. 244func ls_write_fixture() -> i64 { 245 let fd: i64 = sys_openat_wr(LS_FIX, 0x1a4) 246 if fd < 0 { return 0 - 1 } 247 ls_fp(fd, "// generated by _lawsweep_gate -- fixture, never a build input\n" as *u8) 248 ls_fp(fd, "func fix_bad(fd: i64, v: i64) -> i64 { var m: i64=v; if m<0{m=0-m}; return 0 }\n" as *u8) 249 ls_fp(fd, "const FIX_P: *u8 = \"/mnt/c/Users/elder/fixture_literal\"\n" as *u8) 250 ls_fp(fd, "// a comment mentioning /mnt/c/Users/elder must NOT be counted as code\n" as *u8) 251 sys_close(fd) 252 return 0 253} 254 255func main(argc: i64, argv: *i64) -> i64 { 256 let av: *i64 = argv 257 var dir: *u8 = "buildroot/runtime/_hdl_build" as *u8 258 if argc > 1 { dir = av[1] as *u8 } 259 ls_p("=== _lawsweep_gate -- estate-wide anti-pattern census (code vs comment separated) ===\n" as *u8) 260 ls_p("dir=" as *u8); ls_p(dir); ls_p("\n" as *u8) 261 262 let ctr: *i64 = sys_mmap(LS_NSLOTS * 8) as *i64 263 var z: i64 = 0 264 while z < LS_NSLOTS { ctr[z] = 0; z = z + 1 } 265 let rc_walk: i64 = ls_walk(dir, ctr) 266 267 ls_p(" files=" as *u8); ls_fn(1, ctr[LS_FILES]) 268 ls_p(" bytes=" as *u8); ls_fn(1, ctr[LS_BYTES]) 269 ls_p(" self_excluded=" as *u8); ls_fn(1, ctr[LS_SELF]) 270 ls_p("\n SIGN-DROP printers code=" as *u8); ls_fn(1, ctr[LS_SIGN]) 271 ls_p(" comment=" as *u8); ls_fn(1, ctr[LS_SIGNC]) 272 ls_p("\n foreign-host paths code=" as *u8); ls_fn(1, ctr[LS_FPATH]) 273 ls_p(" comment=" as *u8); ls_fn(1, ctr[LS_FPATHC]) 274 ls_p("\n DEAD(does not resolve here)=" as *u8); ls_fn(1, ctr[LS_FPATH_DEAD]) 275 ls_p(" LIVE(resolves)=" as *u8); ls_fn(1, ctr[LS_FPATH_LIVE]) 276 ls_p(" sum=" as *u8); ls_fn(1, ctr[LS_FPATH_DEAD] + ctr[LS_FPATH_LIVE]) 277 ls_p(" (must equal code)\n" as *u8) 278 ls_p(" bare-FAIL teeth (no operands, in code) = " as *u8); ls_fn(1, ctr[LS_BAREFAIL]) 279 ls_p(" -- MEASURED, NOT YET GATED: a floor is only honest once the population is known\n" as *u8) 280 281 // ---- fixture-based controls ---- 282 ls_write_fixture() 283 let fctr: *i64 = sys_mmap(LS_NSLOTS * 8) as *i64 284 var y: i64 = 0 285 while y < LS_NSLOTS { fctr[y] = 0; y = y + 1 } 286 let fbuf: *u8 = sys_mmap(65536) 287 let fn2: i64 = fc_read(LS_FIX, fbuf, 65536) 288 if fn2 > 0 { ls_scan(fbuf, fn2, fctr) } 289 290 ls_p(" fixture: sign_code=" as *u8); ls_fn(1, fctr[LS_SIGN]) 291 ls_p(" fpath_code=" as *u8); ls_fn(1, fctr[LS_FPATH]) 292 ls_p(" fpath_comment=" as *u8); ls_fn(1, fctr[LS_FPATHC]) 293 ls_p(" (expect 1 / 1 / 1)\n" as *u8) 294 295 var t1: i64 = 0 296 if rc_walk == 0 { if ctr[LS_SIGN] == 0 { t1 = 1 } } 297 var t2: i64 = 0 298 if fctr[LS_SIGN] >= 1 { t2 = 1 } 299 var t3: i64 = 0 300 if ctr[LS_FILES] > 0 { if ctr[LS_BYTES] > 0 { t3 = 1 } } 301 var t4: i64 = 0 302 if fctr[LS_FPATH] == 1 { if fctr[LS_FPATHC] == 1 { t4 = 1 } } 303 // T5: the DEAD/LIVE split must account for EVERY code occurrence. A partition that does not sum 304 // is a census with a leak, and a leak is where a comfortable number hides. 305 var t5: i64 = 0 306 if ctr[LS_FPATH_DEAD] + ctr[LS_FPATH_LIVE] == ctr[LS_FPATH] { t5 = 1 } 307 308 let c: *i64 = gv_ctr() 309 gv_check("T1 ZERO sign-dropping number printers in CODE across the scanned tree" as *u8, t1, c) 310 gv_check("T2 NEG CTL: a fixture CONTAINING the defect is DETECTED (the scanner can see it)" as *u8, t2, c) 311 gv_check("T3 NON-VACUOUS: files and bytes actually scanned (a zero census is not a clean census)" as *u8, t3, c) 312 gv_check("T4 DISCRIMINATOR: the same token reads 1 in CODE and 1 in COMMENT, not 2 of either" as *u8, t4, c) 313 gv_check("T5 PARTITION SUMS: foreign-path DEAD + LIVE accounts for every CODE occurrence" as *u8, t5, c) 314 let rc: i64 = gv_verdict("LAWSWEEP" as *u8, c, "estate-wide anti-pattern census: laws that were previously only written in comments are now RUNNING CHECKS. The literal/comment discriminator is proven on a fixture every run, so the counts are code occurrences and not grep upper bounds. probe=antipattern-census" as *u8) 315 316 let lfd: i64 = sys_openat_append(LS_LOG, 0x1a4) 317 if lfd >= 0 { 318 ls_fp(lfd, "LAWSWEEP verdict=" as *u8) 319 if rc == 0 { ls_fp(lfd, "GREEN" as *u8) } else { ls_fp(lfd, "RED" as *u8) } 320 ls_fp(lfd, " dir=" as *u8); ls_fp(lfd, dir) 321 ls_fp(lfd, " files=" as *u8); ls_fn(lfd, ctr[LS_FILES]) 322 ls_fp(lfd, " bytes=" as *u8); ls_fn(lfd, ctr[LS_BYTES]) 323 ls_fp(lfd, " signdrop_code=" as *u8); ls_fn(lfd, ctr[LS_SIGN]) 324 ls_fp(lfd, " signdrop_comment=" as *u8); ls_fn(lfd, ctr[LS_SIGNC]) 325 ls_fp(lfd, " foreignpath_code=" as *u8); ls_fn(lfd, ctr[LS_FPATH]) 326 ls_fp(lfd, " foreignpath_comment=" as *u8); ls_fn(lfd, ctr[LS_FPATHC]) 327 ls_fp(lfd, " foreignpath_dead=" as *u8); ls_fn(lfd, ctr[LS_FPATH_DEAD]) 328 ls_fp(lfd, " foreignpath_live=" as *u8); ls_fn(lfd, ctr[LS_FPATH_LIVE]) 329 ls_fp(lfd, " negctl=" as *u8); ls_fn(lfd, t2) 330 ls_fp(lfd, " discriminator=" as *u8); ls_fn(lfd, t4) 331 ls_fp(lfd, " epoch=" as *u8); ls_fn(lfd, sys_now_realtime_sec()) 332 ls_fp(lfd, "\n" as *u8) 333 sys_close(lfd) 334 } 335 sys_exit(rc) 336 return rc 337}