nx_accept_candidate_t230.nx source
↩ module page · 507 lines · 26920 B
1// nx_accept.nx -- THE THREE-PARTY ACCEPTANCE LEDGER'S VERBS (2026-08-31). Operator standing order 2026-08-30:
2// "doing it poorly isn't a complete and needs to be shown as that on /compare and your work; it's not complete
3// till you and I and the nishi team agree."
4//
5// COMPLETE means THREE signatures, each in its own sovereign plane. This organ is how the second and third are
6// written and how all three are read; the decision itself lives in nx_accept_lib (one classifier, every consumer):
7// status <subject> -- AGREED or NOT-AGREED with the missing party NAMED
8// list -- every subject any plane or board names, one line each, counters
9// emit -- regenerate buildroot/runtime/nx_accept_decl.nx from the planes:
10// one func ga_accept_<subject> per AGREED subject, sorted, no
11// timestamp, byte-identical while the planes are unchanged
12// attest <subject> <seat> <words> <artifact> -- the SEAT's row: stamp = sha256 of the artifact, never typed
13// referee <subject> <png> <tier> <seat> -- the REFEREE's row: the cjc_panel percept lens is RUN on the
14// capture and its grade recorded; never a hand-typed number
15// THIS ORGAN NEVER WRITES knowledge/store/accept-. The operator's plane has no verb here by construction; the
16// operator's recipe is one nx_store_put call (see the devmgmt board note), and its targets field must carry
17// ga_accept_<subject> or the row governs nothing and is printed as UNMAPPED with that remedy.
18// WRITES COMPOSE THE INCUMBENT WRITER: every referee/attest row goes through nx_store_put.elf (plane lock,
19// shrink guard, hist- provenance). This organ never touches plane bytes itself.
20// THE REFEREE COMPOSES THE PANEL: nx_charjudge_census lens <png> <conf> is the estate's decode -> fit -> NXFH1 ->
21// nx_percept path; this organ reads its cjp_percept= field and compares it with the panel's own per-tier floor.
22// A tier the panel receipt has not admitted is REFUSED (an abstention is not a grade) and a lens that could not
23// see (cjp_percept=-9999 or decoded=0) writes NO row and exits UNOBSERVABLE -- a missing grade must never read
24// as a low one.
25// root=<dir> re-roots every path (planes <dir>/accept- referee- attest-, conf <dir>/cjc_panel.conf, decl
26// <dir>/nx_accept_decl.nx, boards <dir>/compare) for the gate's /tmp fixtures. Production paths are the lib's
27// constants, resolved CWD-first then estate-root, exactly as the lib resolves them.
28// EXIT: 0 AGREED or done | 1 NOT-AGREED | 2 usage | 3 UNKNOWN-SUBJECT | 4 REFUSED (reason named) | 5 io or writer
29// | 6 UNOBSERVABLE (the lens could not see)
30// license_tier: ORIGINAL No hw writes (Rule 26).
31import "nx_syscalls.nx"
32import "nx_tool_run.nx"
33import "nx_accept_lib.nx"
34import "nx_accept_ref_lib.nx"
35import "nx_accept_binding_candidate_t230.nx"
36import "nx_fio.nx"
37
38const ACM_ROOT_KEY: *u8 = "root="
39const ACM_SUF_ACC: *u8 = "/accept-"
40const ACM_SUF_REF: *u8 = "/referee-"
41const ACM_SUF_ATT: *u8 = "/attest-"
42const ACM_SUF_CONF: *u8 = "/cjc_panel.conf"
43const ACM_SUF_DECL: *u8 = "/nx_accept_decl.nx"
44const ACM_SUF_BOARDS: *u8 = "/compare"
45const ACM_STORE_PUT: *u8 = "nx_store_put.elf"
46const ACM_LENS_ELF: *u8 = "nx_charjudge_census.elf"
47const ACM_LENS_VERB: *u8 = "lens"
48const ACM_LENS_KEY: *u8 = "cjp_percept="
49const ACM_LENS_UNDECODED: *u8 = "decoded=0"
50const ACM_PUT_VERB: *u8 = "put"
51const ACM_ACTOR_REFEREE: *u8 = "referee"
52const ACM_INSTRUMENT: *u8 = "cjc_panel-percept-lens"
53const ACM_ID_ATT: *u8 = "att-"
54const ACM_ID_REF: *u8 = "ref-"
55const ACM_GOOD: *u8 = "GOOD"
56const ACM_BAD: *u8 = "BAD"
57
58const ACM_OUTCAP: i64 = 262144
59const ACM_CAPTURE: i64 = 65536
60const ACM_ARGV_SLOTS: i64 = 24
61const ACM_POS_MAX: i64 = 8
62const ACM_IDCAP: i64 = 192
63const ACM_NUMCAP: i64 = 32
64const ACM_LP: i64 = 16
65const ACM_LENS_TMO_MS: i64 = 60000 // nx_charjudge_census CJX_TIMEOUT_MS: the panel's own per-image ceiling
66const ACM_PUT_TMO_MS: i64 = 130000 // nx_seg_store's plane-lock ceiling is 120 s (SS_LOCK_TRIES x SS_LOCK_SLEEP_MS); a writer may legitimately wait it out
67const ACM_CX_WORDS: i64 = 8
68const ACM_CX_ACC: i64 = 0
69const ACM_CX_REF: i64 = 1
70const ACM_CX_ATT: i64 = 2
71const ACM_CX_CONF: i64 = 3
72const ACM_CX_DECL: i64 = 4
73const ACM_CX_BOARDS: i64 = 5
74const ACM_CX_HASROOT: i64 = 6
75const ACM_S_WORDS: i64 = 8
76const ACM_S_BK: i64 = 0
77const ACM_S_CF: i64 = 1
78const ACM_S_DOMS: i64 = 2
79const ACM_S_ORGS: i64 = 3
80const ACM_S_PLANES: i64 = 4
81const ACM_S_BOARDS: i64 = 5
82const ACM_S_OVER: i64 = 6
83const ACM_ATT_FIELDS: i64 = 6
84const ACM_REF_FIELDS: i64 = 9
85
86func acm_p(s: *u8) -> i64 { sys_write(1, s, al_slen(s)); return 0 }
87func acm_pn(v: i64) -> i64 { let t: *u8 = sys_mmap(ACM_NUMCAP); let n: i64 = al_catn(t, 0, v); sys_write(1, t, n); return 0 }
88func acm_join(a: *u8, b: *u8) -> *u8 { let d: *u8 = sys_mmap(AL_PATHCAP); var o: i64 = al_cat(d, 0, a); o = al_cat(d, o, b); d[o] = 0 as u8; return d }
89func acm_numz(v: i64) -> *u8 { let t: *u8 = sys_mmap(ACM_NUMCAP); let n: i64 = al_catn(t, 0, v); t[n] = 0 as u8; return t }
90func acm_dom(s: *i64, si: i64) -> *u8 { return (s[ACM_S_DOMS] + si * AL_NAMEW) as *u8 }
91func acm_org(s: *i64, si: i64) -> *u8 { return (s[ACM_S_ORGS] + si * AL_ORGW) as *u8 }
92
93func acm_usage() -> i64 {
94 acm_p(" nx_accept check-release <subject> <candidate-sha256> <stage> <policy-sha256> <receipt-sha256> <receipt-file> (binding only; no promotion or rights decision)\n")
95 acm_p("usage: nx_accept status <subject> | list | emit | attest <subject> <seat> <words> <artifact> | referee <subject> <png-absolute-path> <tier> <seat> [root=<dir>]\n" as *u8)
96 acm_p(" root=<dir> re-roots planes (<dir>/accept- referee- attest-), conf (<dir>/cjc_panel.conf), decl (<dir>/nx_accept_decl.nx) and boards (<dir>/compare) -- the gate's fixture lane, never production.\n" as *u8)
97 acm_p(" there is deliberately NO verb that writes knowledge/store/accept-: the operator writes that plane.\n" as *u8)
98 return ACR_EXIT_USAGE
99}
100
101// every path this run reads or writes, from the lib's constants or from root=<dir>
102func acm_ctx(root: *u8) -> *i64 {
103 let cx: *i64 = sys_mmap(8 * ACM_CX_WORDS) as *i64
104 var hasroot: i64 = 0
105 if (root as i64) != 0 { if root[0] != (0 as u8) { hasroot = 1 } }
106 if hasroot == 0 {
107 cx[ACM_CX_ACC] = AL_PFX_ACCEPT as i64
108 cx[ACM_CX_REF] = AL_PFX_REFEREE as i64
109 cx[ACM_CX_ATT] = AL_PFX_ATTEST as i64
110 cx[ACM_CX_CONF] = AL_PANEL_CONF as i64
111 let dp: *u8 = sys_mmap(AL_PATHCAP)
112 al_decl_path(dp)
113 cx[ACM_CX_DECL] = dp as i64
114 let bd: *u8 = sys_mmap(AL_PATHCAP)
115 al_boards_dir(bd)
116 cx[ACM_CX_BOARDS] = bd as i64
117 } else {
118 cx[ACM_CX_ACC] = acm_join(root, ACM_SUF_ACC) as i64
119 cx[ACM_CX_REF] = acm_join(root, ACM_SUF_REF) as i64
120 cx[ACM_CX_ATT] = acm_join(root, ACM_SUF_ATT) as i64
121 cx[ACM_CX_CONF] = acm_join(root, ACM_SUF_CONF) as i64
122 cx[ACM_CX_DECL] = acm_join(root, ACM_SUF_DECL) as i64
123 cx[ACM_CX_BOARDS] = acm_join(root, ACM_SUF_BOARDS) as i64
124 }
125 cx[ACM_CX_HASROOT] = hasroot
126 return cx
127}
128// load the three planes, the panel conf, and the boards into ONE book
129func acm_open(cx: *i64) -> *i64 {
130 let s: *i64 = sys_mmap(8 * ACM_S_WORDS) as *i64
131 let bk: *i64 = al_bk_new()
132 let planes: i64 = al_load(bk, cx[ACM_CX_ACC] as *u8, cx[ACM_CX_REF] as *u8, cx[ACM_CX_ATT] as *u8)
133 let cf: *i64 = al_conf_load(cx[ACM_CX_CONF] as *u8)
134 let doms: *u8 = sys_mmap(AL_NAMEW * AL_MAX_SUBJ)
135 let orgs: *u8 = sys_mmap(AL_ORGW * AL_MAX_SUBJ)
136 let over: *i64 = sys_mmap(ACM_LP) as *i64
137 over[0] = 0
138 var bn: i64 = 0 - 1
139 let bd: *u8 = cx[ACM_CX_BOARDS] as *u8
140 if bd[0] != (0 as u8) { bn = acr_boards(bk, bd, doms, orgs, over) }
141 s[ACM_S_BK] = bk as i64
142 s[ACM_S_CF] = cf as i64
143 s[ACM_S_DOMS] = doms as i64
144 s[ACM_S_ORGS] = orgs as i64
145 s[ACM_S_PLANES] = planes
146 s[ACM_S_BOARDS] = bn
147 s[ACM_S_OVER] = over[0]
148 return s
149}
150// header line shared by every read verb
151func acm_head(tag: *u8, cx: *i64, s: *i64, out: *u8, o0: i64) -> i64 {
152 var o: i64 = al_cat(out, o0, tag)
153 o = acr_catfn(out, o, " planes=" as *u8, s[ACM_S_PLANES])
154 o = al_cat(out, o, "/3" as *u8)
155 o = acr_catfn(out, o, " board_rows=" as *u8, s[ACM_S_BOARDS])
156 o = acr_catfn(out, o, " board_rows_over_cap=" as *u8, s[ACM_S_OVER])
157 let hb: *i64 = s[ACM_S_BK] as *i64
158 o = acr_catf(out, o, " accept_plane=" as *u8, hb[AL_B_ACC_PATH] as *u8)
159 o = acr_catf(out, o, " conf=" as *u8, cx[ACM_CX_CONF] as *u8)
160 let cf: *i64 = s[ACM_S_CF] as *i64
161 o = acr_catfn(out, o, " conf_ok=" as *u8, cf[AL_C_CONF_OK])
162 o = acr_catfn(out, o, " receipt_ok=" as *u8, cf[AL_C_RCPT_OK])
163 o = acr_catfn(out, o, " panel_admitted=" as *u8, cf[AL_C_ADMITTED])
164 o = acr_catf(out, o, " tiers_admitted=" as *u8, cf[AL_C_TADM] as *u8)
165 out[o] = AL_NL as u8
166 o = o + 1
167 return o
168}
169// sorted status lines, then the UNMAPPED rows, then the summary; returns the new offset
170func acm_ledger(s: *i64, out: *u8, o0: i64) -> i64 {
171 let bk: *i64 = s[ACM_S_BK] as *i64
172 let cf: *i64 = s[ACM_S_CF] as *i64
173 let ord: *i64 = sys_mmap(8 * AL_MAX_SUBJ) as *i64
174 let n: i64 = acr_order(bk, ord)
175 var o: i64 = o0
176 var i: i64 = 0
177 while i < n {
178 let si: i64 = ord[i]
179 let o2: i64 = acr_status_line(bk, cf, si, acm_dom(s, si), acm_org(s, si), out, o, ACM_OUTCAP)
180 if o2 > 0 { o = o2 }
181 i = i + 1
182 }
183 let oo: *i64 = sys_mmap(ACM_LP) as *i64
184 oo[0] = o
185 let un: i64 = acr_unmapped(bk[AL_B_ACC_PATH] as *u8, out, oo, ACM_OUTCAP)
186 o = oo[0]
187 let o3: i64 = acr_summary(bk, cf, s[ACM_S_PLANES], un, out, o, ACM_OUTCAP)
188 if o3 > 0 { o = o3 }
189 return o
190}
191
192// ---- status ---------------------------------------------------------------------------------------------------
193func acm_status(cx: *i64, s: *i64, subject: *u8) -> i64 {
194 let bk: *i64 = s[ACM_S_BK] as *i64
195 let cf: *i64 = s[ACM_S_CF] as *i64
196 let out: *u8 = sys_mmap(ACM_OUTCAP)
197 var o: i64 = acm_head("ACCEPT-STATUS" as *u8, cx, s, out, 0)
198 let si: i64 = al_bk_find_z(bk, subject)
199 var rc: i64 = ACR_EXIT_UNKNOWN
200 if si < 0 {
201 o = acr_catf(out, o, "subject=" as *u8, subject)
202 o = al_cat(out, o, " verdict=UNKNOWN-SUBJECT missing=ALL -- no plane row carries the token ga_accept_" as *u8)
203 o = al_cat(out, o, subject)
204 o = al_cat(out, o, " and no board watch row names it" as *u8)
205 out[o] = AL_NL as u8
206 o = o + 1
207 } else {
208 let o2: i64 = acr_status_line(bk, cf, si, acm_dom(s, si), acm_org(s, si), out, o, ACM_OUTCAP)
209 if o2 > 0 { o = o2 }
210 let why: *i64 = sys_mmap(8 * ACR_WHY_WORDS) as *i64
211 if acr_party(bk, cf, si, why) == ACR_P_AGREED { rc = ACR_EXIT_AGREED } else { rc = ACR_EXIT_NOT_AGREED }
212 }
213 let oo: *i64 = sys_mmap(ACM_LP) as *i64
214 oo[0] = o
215 acr_unmapped(bk[AL_B_ACC_PATH] as *u8, out, oo, ACM_OUTCAP)
216 o = oo[0]
217 if rc == ACR_EXIT_AGREED { o = al_cat(out, o, "verdict=AGREED\n" as *u8) } else {
218 if rc == ACR_EXIT_NOT_AGREED { o = al_cat(out, o, "verdict=NOT-AGREED\n" as *u8) } else { o = al_cat(out, o, "verdict=UNKNOWN-SUBJECT\n" as *u8) }
219 }
220 sys_write(1, out, o)
221 return rc
222}
223
224// ---- list -----------------------------------------------------------------------------------------------------
225func acm_list(cx: *i64, s: *i64) -> i64 {
226 let bk: *i64 = s[ACM_S_BK] as *i64
227 let cf: *i64 = s[ACM_S_CF] as *i64
228 let out: *u8 = sys_mmap(ACM_OUTCAP)
229 var o: i64 = acm_head("ACCEPT-LIST" as *u8, cx, s, out, 0)
230 o = acm_ledger(s, out, o)
231 let a: i64 = al_count_accepted(bk, cf)
232 o = acr_catfn(out, o, "verdict=LISTED agreed=" as *u8, a)
233 o = acr_catfn(out, o, " not_agreed=" as *u8, bk[AL_B_N] - a)
234 out[o] = AL_NL as u8
235 o = o + 1
236 sys_write(1, out, o)
237 if bk[AL_B_OVERFLOW] > 0 { return ACR_EXIT_IO }
238 return ACR_EXIT_AGREED
239}
240
241// ---- emit -----------------------------------------------------------------------------------------------------
242func acm_emit(cx: *i64, s: *i64) -> i64 {
243 let bk: *i64 = s[ACM_S_BK] as *i64
244 let cf: *i64 = s[ACM_S_CF] as *i64
245 let decl: *u8 = cx[ACM_CX_DECL] as *u8
246 let out: *u8 = sys_mmap(ACM_OUTCAP)
247 var o: i64 = acm_head("ACCEPT-EMIT" as *u8, cx, s, out, 0)
248 if decl[0] == (0 as u8) {
249 o = al_cat(out, o, "ACCEPT-EMIT REFUSED decl-path-unresolved: nx_accept_lib.nx was found beside no root, so the declaration file has no home. Nothing written.\nverdict=REFUSED\n" as *u8)
250 sys_write(1, out, o)
251 return ACR_EXIT_IO
252 }
253 let buf: *u8 = sys_mmap(AL_DECL_CAP)
254 let n: i64 = al_emit_buf(bk, cf, buf, AL_DECL_CAP)
255 if n < 0 {
256 o = al_cat(out, o, "ACCEPT-EMIT REFUSED cap-exceeded: the derivation does not fit AL_DECL_CAP; nothing written rather than a truncated declaration file.\nverdict=REFUSED\n" as *u8)
257 sys_write(1, out, o)
258 return ACR_EXIT_IO
259 }
260 let before: i64 = al_decl_verify(bk, cf, decl)
261 var wrote: i64 = 0
262 if before != AL_DV_IDENTICAL {
263 let wr: i64 = al_write_atomic(decl, buf, n)
264 if wr < 0 {
265 o = acr_catf(out, o, "ACCEPT-EMIT FAIL cannot write " as *u8, decl)
266 o = acr_catfn(out, o, " rc=" as *u8, wr)
267 o = al_cat(out, o, "\nverdict=FAIL\n" as *u8)
268 sys_write(1, out, o)
269 return ACR_EXIT_IO
270 }
271 wrote = 1
272 }
273 let after: i64 = al_decl_verify(bk, cf, decl)
274 let hex: *u8 = sys_mmap(ACR_HEXCAP)
275 acr_sha256_buf(buf, n, hex)
276 if wrote == 1 { o = al_cat(out, o, "ACCEPT-EMIT WRITTEN" as *u8) } else { o = al_cat(out, o, "ACCEPT-EMIT UNCHANGED" as *u8) }
277 o = acr_catf(out, o, " path=" as *u8, decl)
278 o = acr_catfn(out, o, " bytes=" as *u8, n)
279 o = acr_catfn(out, o, " decls=" as *u8, al_count_decls(buf, n))
280 o = acr_catfn(out, o, " shape=" as *u8, acr_decl_shape(buf, n))
281 o = acr_catf(out, o, " sha256=" as *u8, hex)
282 o = acr_catf(out, o, " prev=" as *u8, al_dvname(before))
283 o = acr_catf(out, o, " readback=" as *u8, al_dvname(after))
284 out[o] = AL_NL as u8
285 o = o + 1
286 o = acm_ledger(s, out, o)
287 if after != AL_DV_IDENTICAL {
288 o = al_cat(out, o, "verdict=FAIL readback does not reproduce the derivation\n" as *u8)
289 sys_write(1, out, o)
290 return ACR_EXIT_IO
291 }
292 o = acr_catfn(out, o, "verdict=EMITTED decls=" as *u8, al_count_decls(buf, n))
293 out[o] = AL_NL as u8
294 o = o + 1
295 sys_write(1, out, o)
296 return ACR_EXIT_AGREED
297}
298
299// ---- the one writer path: fork nx_store_put put <actor> <id> <fields...> against <prefix> ----------------------
300func acm_store_put(prefix: *u8, actor: *u8, id: *u8, fields: *i64, nf: i64) -> i64 {
301 let elf: *u8 = sys_mmap(AL_PATHCAP)
302 if ep_artifact_path(elf, ACM_STORE_PUT) == 0 {
303 acm_p("ACCEPT-WRITE REFUSED writer-absent: nx_store_put.elf resolves at no root (cwd, .., estate root, buildroot) -- no row written\n" as *u8)
304 return 0 - 1
305 }
306 let av: *i64 = sys_mmap(8 * ACM_ARGV_SLOTS) as *i64
307 var n: i64 = 0
308 av[n] = elf as i64; n = n + 1
309 av[n] = prefix as i64; n = n + 1
310 av[n] = ACM_PUT_VERB as i64; n = n + 1
311 av[n] = actor as i64; n = n + 1
312 av[n] = id as i64; n = n + 1
313 var i: i64 = 0
314 while i < nf { av[n] = fields[i]; n = n + 1; i = i + 1 }
315 av[n] = 0
316 let out: *u8 = sys_mmap(ACM_CAPTURE)
317 let ol: *i64 = sys_mmap(ACM_LP) as *i64
318 let tr: *i64 = sys_mmap(ACM_LP) as *i64
319 let rc: i64 = tr_run_capture_tr(elf, av, out, ACM_CAPTURE, ol, ACM_PUT_TMO_MS, tr)
320 acm_p(" writer=" as *u8); acm_p(elf); acm_p(" plane=" as *u8); acm_p(prefix); acm_p(" rc=" as *u8); acm_pn(rc); acm_p(" receipt: " as *u8)
321 if ol[0] > 0 { sys_write(1, out, ol[0]) } else { acm_p("(no output)\n" as *u8) }
322 return rc
323}
324func acm_mkid(pfx: *u8, subject: *u8, epoch: i64) -> *u8 {
325 let id: *u8 = sys_mmap(ACM_IDCAP)
326 var o: i64 = al_cat(id, 0, pfx)
327 o = al_cat(id, o, subject)
328 id[o] = AL_MINUS as u8
329 o = o + 1
330 o = al_catn(id, o, epoch)
331 id[o] = 0 as u8
332 return id
333}
334
335// ---- attest ---------------------------------------------------------------------------------------------------
336func acm_attest(cx: *i64, s: *i64, subject: *u8, seat: *u8, words: *u8, artifact: *u8) -> i64 {
337 let bk: *i64 = s[ACM_S_BK] as *i64
338 if al_ident_ok(subject, 0, al_slen(subject)) == 0 { acm_p("ACCEPT-ATTEST REFUSED subject-not-an-identifier: a subject becomes part of func ga_accept_<subject>, so it must be [a-z0-9_]+ not starting with a digit\nverdict=REFUSED\n" as *u8); return ACR_EXIT_REFUSED }
339 if al_slen(seat) == 0 { acm_p("ACCEPT-ATTEST REFUSED seat-empty: an attestation nobody signs is not an attestation\nverdict=REFUSED\n" as *u8); return ACR_EXIT_REFUSED }
340 if al_slen(words) == 0 { acm_p("ACCEPT-ATTEST REFUSED words-empty: say what was shipped and how it was proven\nverdict=REFUSED\n" as *u8); return ACR_EXIT_REFUSED }
341 let hex: *u8 = sys_mmap(ACR_HEXCAP)
342 let an: i64 = acr_sha256_file(artifact, hex)
343 if an < 0 { acm_p("ACCEPT-ATTEST REFUSED artifact-unreadable: " as *u8); acm_p(artifact); acm_p(" -- the stamp is the sha256 of the artifact, and an artifact nobody can read cannot be attested to\nverdict=REFUSED\n" as *u8); return ACR_EXIT_REFUSED }
344 let now: i64 = sys_now_realtime_sec()
345 let date: *u8 = sys_mmap(AL_DATECAP)
346 al_civil_date(now, date)
347 let id: *u8 = acm_mkid(ACM_ID_ATT, subject, now)
348 // row = id subject seat stamp words date artifact (the lib reads subject=1 seat=2 stamp=3 date=5)
349 let f: *i64 = sys_mmap(8 * ACM_ATT_FIELDS) as *i64
350 f[0] = subject as i64
351 f[1] = seat as i64
352 f[2] = hex as i64
353 f[3] = words as i64
354 f[4] = date as i64
355 f[5] = artifact as i64
356 acm_p("ACCEPT-ATTEST subject=" as *u8); acm_p(subject); acm_p(" seat=" as *u8); acm_p(seat); acm_p(" stamp=sha256:" as *u8); acm_p(hex)
357 acm_p(" artifact_bytes=" as *u8); acm_pn(an); acm_p(" date=" as *u8); acm_p(date); acm_p(" id=" as *u8); acm_p(id); acm_p("\n" as *u8)
358 let rc: i64 = acm_store_put(bk[AL_B_ATT_PATH] as *u8, seat, id, f, ACM_ATT_FIELDS)
359 if rc != 0 { acm_p("verdict=FAIL writer rc nonzero -- the row may not have landed; read the plane before retrying\n" as *u8); return ACR_EXIT_IO }
360 acm_p("verdict=ATTESTED\n" as *u8)
361 return ACR_EXIT_AGREED
362}
363
364// ---- referee --------------------------------------------------------------------------------------------------
365func acm_referee(cx: *i64, s: *i64, subject: *u8, png: *u8, tier: *u8, seat: *u8) -> i64 {
366 let bk: *i64 = s[ACM_S_BK] as *i64
367 let cf: *i64 = s[ACM_S_CF] as *i64
368 if al_ident_ok(subject, 0, al_slen(subject)) == 0 { acm_p("ACCEPT-REFEREE REFUSED subject-not-an-identifier\nverdict=REFUSED\n" as *u8); return ACR_EXIT_REFUSED }
369 if al_slen(seat) == 0 { acm_p("ACCEPT-REFEREE REFUSED seat-empty: name who ran the referee\nverdict=REFUSED\n" as *u8); return ACR_EXIT_REFUSED }
370 let fo: *i64 = sys_mmap(ACM_LP) as *i64
371 let adm: i64 = acr_ref_admit(cf, tier, fo)
372 if adm != ACR_REF_OK {
373 acm_p("ACCEPT-REFEREE REFUSED " as *u8); acm_p(acr_ref_admit_name(adm)); acm_p(" tier=" as *u8); acm_p(tier)
374 acm_p(" conf=" as *u8); acm_p(cx[ACM_CX_CONF] as *u8); acm_p(" tiers_admitted=" as *u8); acm_p(cf[AL_C_TADM] as *u8)
375 acm_p(" -- the panel abstains on this tier (its receipt admits no floor for it); an abstention is not a grade, so no row is written. Grow the corpus and recalibrate; never widen a floor onto a tier it was not measured on.\nverdict=REFUSED\n" as *u8)
376 return ACR_EXIT_REFUSED
377 }
378 let floor: i64 = fo[0]
379 if (png[0] as i64) != AL_SLASH { acm_p("ACCEPT-REFEREE REFUSED png-path-must-be-absolute: the lens runs from the estate root, so a relative path would name a different file there\nverdict=REFUSED\n" as *u8); return ACR_EXIT_REFUSED }
380 let hex: *u8 = sys_mmap(ACR_HEXCAP)
381 let pn: i64 = acr_sha256_file(png, hex)
382 if pn < 0 { acm_p("ACCEPT-REFEREE REFUSED capture-unreadable: " as *u8); acm_p(png); acm_p(" -- no frame, no grade, no row\nverdict=REFUSED\n" as *u8); return ACR_EXIT_REFUSED }
383 let elf: *u8 = acm_join(EP_ROOT, ACM_LENS_ELF)
384 let efd: i64 = sys_openat_rd(elf)
385 if efd < 0 { acm_p("ACCEPT-REFEREE REFUSED lens-absent: " as *u8); acm_p(elf); acm_p(" is not readable -- the referee IS the panel lens; without it there is no grade\nverdict=REFUSED\n" as *u8); return ACR_EXIT_IO }
386 sys_close(efd)
387 let av: *i64 = sys_mmap(8 * ACM_ARGV_SLOTS) as *i64
388 av[0] = elf as i64
389 av[1] = ACM_LENS_VERB as i64
390 av[2] = png as i64
391 av[3] = cf[AL_C_PATH]
392 av[4] = 0
393 let out: *u8 = sys_mmap(ACM_CAPTURE)
394 let ol: *i64 = sys_mmap(ACM_LP) as *i64
395 let lrc: i64 = tr_run_capture_cwd(elf, av, out, ACM_CAPTURE, ol, ACM_LENS_TMO_MS, EP_ROOT)
396 acm_p(" lens=" as *u8); acm_p(elf); acm_p(" rc=" as *u8); acm_pn(lrc); acm_p(" bytes=" as *u8); acm_pn(ol[0]); acm_p("\n" as *u8)
397 if ol[0] > 0 { sys_write(1, out, ol[0]) }
398 var percept: i64 = acr_kvint(out, ol[0], ACM_LENS_KEY, ACR_UNOBS)
399 if tr_contains(out, ol[0], ACM_LENS_UNDECODED) == 1 { percept = ACR_UNOBS }
400 if percept == ACR_UNOBS {
401 acm_p("ACCEPT-REFEREE UNOBSERVABLE: the lens could not see this capture (cjp_percept absent, -9999, or decoded=0). No row written -- a missing grade must never read as a low one.\nverdict=UNOBSERVABLE\n" as *u8)
402 return ACR_EXIT_UNOBS
403 }
404 let good: i64 = acr_composite(percept, floor)
405 var comp: *u8 = ACM_BAD
406 if good == 1 { comp = ACM_GOOD }
407 let now: i64 = sys_now_realtime_sec()
408 let date: *u8 = sys_mmap(AL_DATECAP)
409 al_civil_date(now, date)
410 let id: *u8 = acm_mkid(ACM_ID_REF, subject, now)
411 // row = id subject sha composite percept tier date seat instrument capture (lib: subject=1 sha=2 comp=3 percept=4 tier=5 date=6 seat=7)
412 let f: *i64 = sys_mmap(8 * ACM_REF_FIELDS) as *i64
413 f[0] = subject as i64
414 f[1] = hex as i64
415 f[2] = comp as i64
416 f[3] = acm_numz(percept) as i64
417 f[4] = tier as i64
418 f[5] = date as i64
419 f[6] = seat as i64
420 f[7] = ACM_INSTRUMENT as i64
421 f[8] = png as i64
422 acm_p("ACCEPT-REFEREE subject=" as *u8); acm_p(subject); acm_p(" percept=" as *u8); acm_pn(percept); acm_p(" floor=" as *u8); acm_pn(floor)
423 acm_p(" tier=" as *u8); acm_p(tier); acm_p(" composite=" as *u8); acm_p(comp); acm_p(" frame=sha256:" as *u8); acm_p(hex)
424 acm_p(" capture_bytes=" as *u8); acm_pn(pn); acm_p(" date=" as *u8); acm_p(date); acm_p(" id=" as *u8); acm_p(id); acm_p("\n" as *u8)
425 let rc: i64 = acm_store_put(bk[AL_B_REF_PATH] as *u8, ACM_ACTOR_REFEREE, id, f, ACM_REF_FIELDS)
426 if rc != 0 { acm_p("verdict=FAIL writer rc nonzero -- the row may not have landed; read the plane before retrying\n" as *u8); return ACR_EXIT_IO }
427 acm_p("verdict=REFEREED composite=" as *u8); acm_p(comp); acm_p("\n" as *u8)
428 return ACR_EXIT_AGREED
429}
430
431
432 // Read-only release receipt binding. Policy identity must cover intended use and audience.
433 // Technical and rights evidence remain distinct requirements owned by the release workflow.
434func acm_release_result(rc:i64)->i64{
435 var state:*u8="invalid"
436 if rc==ARB_ACCEPTED{state="accepted"}
437 if rc==ARB_INCOMPLETE{state="incomplete"}
438 if rc==ARB_REJECTED{state="rejected"}
439 if rc==ARB_IDENTITY{state="identity-mismatch"}
440 if rc==ARB_IO{state="io-error"}
441 acm_p("{\"schema\":\"accept-release-check/v1\",\"scope\":\"receipt-binding-only\",\"state\":\"")
442 acm_p(state);acm_p("\",\"code\":");acm_pn(rc)
443 acm_p(",\"evaluator_authority\":\"not-evaluated\",\"rights_authorization\":\"not-evaluated\",\"promotion\":\"not-performed\"}\n")
444 return rc
445}
446// NxFileReadRegion is nine native pointer/i64 fields in nx_fio; object layout, not a policy cap.
447const ACM_RELEASE_REGION_BYTES:i64=9*8
448func acm_check_release(argc:i64,argv:*i64)->i64{
449 // Eight slots are this verb's exact schema, not a variable input-size ceiling.
450 if argc!=8{return acm_release_result(ARB_INVALID)}
451 let region:*NxFileReadRegion=sys_mmap(ACM_RELEASE_REGION_BYTES) as *NxFileReadRegion
452 if (region as i64)<=0{return acm_release_result(ARB_IO)}
453 fio_region_init(region)
454 let opened:i64=fio_region_open(argv[7] as *u8,region)
455 if opened!=0{
456 sys_munmap(region as *u8,ACM_RELEASE_REGION_BYTES)
457 if opened==(0-2){return acm_release_result(ARB_INCOMPLETE)}
458 return acm_release_result(ARB_IO)
459 }
460 let n:i64=region.total
461 if n==0{
462 let closed:i64=fio_region_close(region)
463 sys_munmap(region as *u8,ACM_RELEASE_REGION_BYTES)
464 if closed!=0{return acm_release_result(ARB_IO)}
465 return acm_release_result(ARB_INCOMPLETE)
466 }
467 let body:*u8=sys_mmap(n)
468 if (body as i64)<=0{
469 fio_region_close(region);sys_munmap(region as *u8,ACM_RELEASE_REGION_BYTES)
470 return acm_release_result(ARB_IO)
471 }
472 let read:i64=fio_region_next(region,body,n)
473 var rc:i64=ARB_IO
474 if read==n&®ion.code==0&®ion.close_code==0{
475 rc=arb_receipt(argv[2] as *u8,argv[3] as *u8,argv[4] as *u8,argv[5] as *u8,argv[6] as *u8,body,n)
476 }
477 if fio_region_close(region)!=0{rc=ARB_IO}
478 if sys_munmap(body,n)!=0{rc=ARB_IO}
479 if sys_munmap(region as *u8,ACM_RELEASE_REGION_BYTES)!=0{rc=ARB_IO}
480 return acm_release_result(rc)
481}
482
483func main(argc: i64, argv: *i64) -> i64 {
484 if argc>=2{if al_streq(argv[1] as *u8,"check-release")==1{return acm_check_release(argc,argv)}}
485 if argc < 2 { let u: i64 = acm_usage(); sys_exit(u); return u }
486 let verb: *u8 = argv[1] as *u8
487 var root: *u8 = 0 as *u8
488 let pos: *i64 = sys_mmap(8 * ACM_POS_MAX) as *i64
489 var np: i64 = 0
490 var i: i64 = 2
491 while i < argc {
492 let a: *u8 = argv[i] as *u8
493 if al_starts(a, ACM_ROOT_KEY) == 1 { root = ((a as i64) + al_slen(ACM_ROOT_KEY)) as *u8 } else { if np < ACM_POS_MAX { pos[np] = a as i64; np = np + 1 } }
494 i = i + 1
495 }
496 let cx: *i64 = acm_ctx(root)
497 var rc: i64 = ACR_EXIT_USAGE
498 var handled: i64 = 0
499 if al_streq(verb, "status" as *u8) == 1 { handled = 1; if np < 1 { rc = acm_usage() } else { let s: *i64 = acm_open(cx); rc = acm_status(cx, s, pos[0] as *u8) } }
500 if al_streq(verb, "list" as *u8) == 1 { handled = 1; let s: *i64 = acm_open(cx); rc = acm_list(cx, s) }
501 if al_streq(verb, "emit" as *u8) == 1 { handled = 1; let s: *i64 = acm_open(cx); rc = acm_emit(cx, s) }
502 if al_streq(verb, "attest" as *u8) == 1 { handled = 1; if np < 4 { rc = acm_usage() } else { let s: *i64 = acm_open(cx); rc = acm_attest(cx, s, pos[0] as *u8, pos[1] as *u8, pos[2] as *u8, pos[3] as *u8) } }
503 if al_streq(verb, "referee" as *u8) == 1 { handled = 1; if np < 4 { rc = acm_usage() } else { let s: *i64 = acm_open(cx); rc = acm_referee(cx, s, pos[0] as *u8, pos[1] as *u8, pos[2] as *u8, pos[3] as *u8) } }
504 if handled == 0 { rc = acm_usage() }
505 sys_exit(rc)
506 return rc
507}