nx_aliascensus.nx source
↩ module page · 268 lines · 13411 B
1// nx_aliascensus.nx -- THE GUARD FOR THE CATALOGUE IDENTITY FIX, AND THE 99-ROW RE-DERIVATION IT OWED.
2// Built 2026-09-04 to close both halves of sev-8 row 1788487164. That row's done-rule had two parts and the
3// fix only met the first: nx_catalog now reports the REQUESTED name's own source instead of the alias
4// target's. The second part -- "a tooth asserts that for an aliased name the reported SOURCE size equals a
5// direct stat of that name's own source" -- had no organ, and a fix without a guard is a fix that cannot be
6// shown to still hold tomorrow.
7//
8// THE DEFECT THIS EXISTS TO PREVENT, MEASURED. nx_catalog_lib cl_regresolve resolves a tool name through
9// tool_allowlist.conf field 2, takes the BASENAME, strips the .prev/.new/.elf/.sov suffix chain and calls
10// the result the effective organ identity. cl_ladder then keyed SOURCE, BUILT and STAGED on THAT, so the
11// catalogue published another organ's bytes under the name you asked for: four of four figures wrong for
12// nx_https_get, and nx_https_get3 -- which has NO FILES on any candidate path -- published with a complete
13// four-rung lifecycle. 99 of 1586 rows alias; 20 of those own real artifacts that were silently replaced,
14// including nx_fs and nx_fs_write, so the estate's own read and write tools had never been catalogued
15// correctly. FIVE separate lanes built BUILT-vs-PROMOTED drift tables on this instrument in one day.
16//
17// WHAT THIS ORGAN CLASSIFIES, and the partition SUMS to the rows it read:
18// SELF field 2's stripped basename equals the tool name -- no aliasing, nothing to check
19// ALIAS-MASKED the name aliases elsewhere AND has a source of its own -- the sharp class, because the
20// catalogue used to report the target's bytes over a real artifact that exists
21// ALIAS-PURE the name aliases elsewhere and has NO source of its own -- an honest entry point; the
22// correct report is SOURCE absent with a real PROMOTED, never an invented lifecycle
23// UNREADABLE a row this organ could not parse -- its own bucket, never folded into a known one
24//
25// nx_aliascensus census [allowlist] -> per-class counts, a NAMED worklist for ALIAS-MASKED, envelope
26// nx_aliascensus selftest -> teeth, exit 0 GREEN / 1 RED
27// Exit: 0 ok/GREEN | 1 RED | 2 usage | 3 UNREADABLE allowlist. verdict= is the LAST token on the last line.
28// license_tier: ORIGINAL. Reads the allowlist and stats sources. Writes only stdout. No hw writes (Rule 26).
29// ⚠DUPLICATION NAMED, NOT HIDDEN: the line/column/number helpers below are the SECOND copy in this estate
30// (nx_debt_triple has the first). The DRY law fires at three, so extraction is owed at the next use and is
31// recorded here rather than discovered later.
32import "nx_syscalls.nx"
33import "nx_rowparse_lib.nx"
34
35const AC_EXIT_OK: i64 = 0
36const AC_EXIT_RED: i64 = 1
37const AC_EXIT_USAGE: i64 = 2
38const AC_EXIT_UNREAD: i64 = 3
39const AC_SPAN: i64 = 8
40const AC_OUT: i64 = 1048576
41const AC_CONF: i64 = 4194304
42const AC_PATH: i64 = 4096
43const AC_SLASH: i64 = 47
44const AC_DOT: i64 = 46
45const AC_WORKLIST_SHOWN: i64 = 40
46
47// THE EXACT RESOLUTION cl_regresolve PERFORMS: basename of field 2, then strip the suffix CHAIN.
48// Reimplementing it here would be a second ruler, so this mirrors it deliberately and says so; the teeth
49// below pin the behaviour against hand-built fixtures so a drift between the two is a RED, not a surprise.
50func ac_basename(b: *u8, s: i64, l: i64, out: *i64) -> i64 {
51 var st: i64 = s
52 var i: i64 = s
53 let e: i64 = s + l
54 while i < e {
55 if b[i] == (AC_SLASH as u8) { st = i + 1 }
56 i = i + 1
57 }
58 var en: i64 = e
59 // strip trailing dotted suffixes: .prev .new .elf .sov -- repeatedly, as the incumbent does
60 var go: i64 = 1
61 while go == 1 {
62 var d: i64 = 0 - 1
63 var j: i64 = st
64 while j < en {
65 if b[j] == (AC_DOT as u8) { d = j }
66 j = j + 1
67 }
68 if d < 0 { go = 0 } else { en = d }
69 if en <= st { go = 0 }
70 }
71 out[0] = st
72 out[1] = en - st
73 if out[1] <= 0 { return 0 }
74 return 1
75}
76func ac_cat3(p: *u8, a: *u8, b: *u8, s: i64, l: i64, c: *u8) -> i64 {
77 var o: i64 = 0
78 o = rp_put(p, o, a)
79 o = rp_putspan(p, o, b, s, l)
80 o = rp_put(p, o, c)
81 p[o] = 0 as u8
82 return o
83}
84// size of a file, or -1. A DIRECT STAT: this is the independent measurement the whole gate rests on, so it
85// must never consult the catalogue it is checking.
86// SEEK_END. Named because a bare 2 in a seek is the magic number the estate keeps removing.
87const AC_SEEK_END: i64 = 2
88func ac_fsize(path: *u8) -> i64 {
89 let fd: i64 = sys_openat_rd(path)
90 if fd < 0 { return 0 - 1 }
91 let n: i64 = sys_lseek(fd, 0, AC_SEEK_END)
92 sys_close(fd)
93 if n < 0 { return 0 - 1 }
94 return n
95}
96// does this NAME have a source of its own, on either root the builder probes?
97func ac_own_src(nm: *u8, s: i64, l: i64) -> i64 {
98 let p: *u8 = sys_mmap(AC_PATH)
99 ac_cat3(p, "buildroot/runtime/_hdl_build/" as *u8, nm, s, l, ".nx" as *u8)
100 let a: i64 = ac_fsize(p)
101 if a >= 0 { return a }
102 ac_cat3(p, "buildroot/runtime/" as *u8, nm, s, l, ".nx" as *u8)
103 return ac_fsize(p)
104}
105
106func main(argc: i64, argv: **u8) -> i64 {
107 var mode: i64 = 0 - 1
108 if argc > 1 {
109 if rp_lit_eq(argv[1] as *u8, 0, rp_slen(argv[1] as *u8), "census" as *u8) == 1 { mode = 0 }
110 if rp_lit_eq(argv[1] as *u8, 0, rp_slen(argv[1] as *u8), "selftest" as *u8) == 1 { mode = 1 }
111 }
112 if mode < 0 {
113 sys_write(2, "usage: nx_aliascensus {census [allowlist] | selftest}\n" as *u8, 53)
114 sys_exit(AC_EXIT_USAGE)
115 return AC_EXIT_USAGE
116 }
117 let out: *u8 = sys_mmap(AC_OUT)
118 var o: i64 = 0
119 if mode == 1 {
120 var pass: i64 = 0
121 var tot: i64 = 0
122 let fx: *u8 = sys_mmap(4096)
123 var fn: i64 = 0
124 fn = rp_put(fx, fn, "nx_https_get\t/volume1/homes/x/nishihost/nx_https_get_cli2.elf\tGREEN\n" as *u8)
125 fn = rp_put(fx, fn, "nx_selfsame\t/volume1/homes/x/nishihost/nx_selfsame.elf\tGREEN\n" as *u8)
126 fn = rp_put(fx, fn, "nx_chain\t/a/b/nx_chain.sov.elf.new\tGREEN\n" as *u8)
127 let c1: *i64 = sys_mmap(AC_SPAN * 2) as *i64
128 let c2: *i64 = sys_mmap(AC_SPAN * 2) as *i64
129 let bn: *i64 = sys_mmap(AC_SPAN * 2) as *i64
130 // T1 the basename+suffix-strip resolution must reproduce the incumbent's answer on an ALIAS
131 let e1: i64 = rp_le(fx, 0, fn)
132 tot = tot + 1
133 if rp_col_tab(fx, 0, e1, 1, c2) == 1 { if ac_basename(fx, c2[0], c2[1], bn) == 1 {
134 if rp_lit_eq(fx, bn[0], bn[1], "nx_https_get_cli2" as *u8) == 1 { pass = pass + 1 } } }
135 // T2 a row whose field 2 basename EQUALS the name is SELF -- the negative side of the same test
136 let s2: i64 = e1 + 1
137 let e2: i64 = rp_le(fx, s2, fn)
138 tot = tot + 1
139 if rp_col_tab(fx, s2, e2, 0, c1) == 1 { if rp_col_tab(fx, s2, e2, 1, c2) == 1 {
140 if ac_basename(fx, c2[0], c2[1], bn) == 1 {
141 if rp_span_eq(fx, c1[0], c1[1], fx, bn[0], bn[1]) == 1 { pass = pass + 1 } } } }
142 // T3 THE SUFFIX CHAIN, not one suffix: .sov.elf.new must strip to the bare organ name.
143 // This is the exact behaviour that made a STAGED alias resolve onto another organ.
144 let s3: i64 = e2 + 1
145 let e3: i64 = rp_le(fx, s3, fn)
146 tot = tot + 1
147 if rp_col_tab(fx, s3, e3, 1, c2) == 1 { if ac_basename(fx, c2[0], c2[1], bn) == 1 {
148 if rp_lit_eq(fx, bn[0], bn[1], "nx_chain" as *u8) == 1 { pass = pass + 1 } } }
149 // T4 neg-control: the resolution must NOT return the tool name for an aliased row. If it did, every
150 // alias would read SELF and this census would report a clean board while the defect stood.
151 tot = tot + 1
152 if rp_col_tab(fx, 0, e1, 0, c1) == 1 { if rp_col_tab(fx, 0, e1, 1, c2) == 1 {
153 if ac_basename(fx, c2[0], c2[1], bn) == 1 {
154 if rp_span_eq(fx, c1[0], c1[1], fx, bn[0], bn[1]) == 1 { } else { pass = pass + 1 } } } }
155 // T5 fixture-reached-the-condition: three rows parsed, not one read three times
156 tot = tot + 1
157 if e1 < e2 { if e2 < e3 { pass = pass + 1 } }
158 // T6 THE LOAD-BEARING TOOTH. For a name that aliases elsewhere AND owns a source, that source must
159 // be found by a DIRECT STAT under its OWN name. This is the assertion sev-8 row 1788487164 asked
160 // for: if it ever fails, the catalogue is once again free to publish the alias target's bytes.
161 tot = tot + 1
162 let own_fs: i64 = ac_own_src("nx_fs" as *u8, 0, 5)
163 if own_fs > 0 { pass = pass + 1 }
164 // T7 neg-control: a name that exists nowhere must stat as ABSENT, never as some other organ's size.
165 tot = tot + 1
166 if ac_own_src("nx_definitely_not_a_real_organ_name" as *u8, 0, 35) < 0 { pass = pass + 1 }
167 o = rp_put(out, o, "NX-ALIASCENSUS-SELFTEST passed " as *u8)
168 o = rp_putn(out, o, pass)
169 o = rp_put(out, o, "/" as *u8)
170 o = rp_putn(out, o, tot)
171 if pass == tot { o = rp_put(out, o, " verdict=GREEN\n" as *u8) } else { o = rp_put(out, o, " verdict=RED\n" as *u8) }
172 sys_write(1, out, o)
173 if pass == tot { sys_exit(AC_EXIT_OK); return AC_EXIT_OK }
174 sys_exit(AC_EXIT_RED)
175 return AC_EXIT_RED
176 }
177 var conf: *u8 = "tool_allowlist.conf" as *u8
178 if argc > 2 { conf = argv[2] as *u8 }
179 let buf: *u8 = sys_mmap(AC_CONF)
180 let fd: i64 = sys_openat_rd(conf)
181 if fd < 0 {
182 sys_write(2, "NX-ALIASCENSUS UNREADABLE: the allowlist did not open -- no census is published from nothing\n" as *u8, 92)
183 sys_exit(AC_EXIT_UNREAD)
184 return AC_EXIT_UNREAD
185 }
186 let n: i64 = sys_read(fd, buf, AC_CONF - 4)
187 sys_close(fd)
188 if n <= 0 {
189 sys_write(2, "NX-ALIASCENSUS UNREADABLE: the allowlist read 0 bytes\n" as *u8, 53)
190 sys_exit(AC_EXIT_UNREAD)
191 return AC_EXIT_UNREAD
192 }
193 let c1: *i64 = sys_mmap(AC_SPAN * 2) as *i64
194 let c2: *i64 = sys_mmap(AC_SPAN * 2) as *i64
195 let bn: *i64 = sys_mmap(AC_SPAN * 2) as *i64
196 var rows: i64 = 0
197 var self_n: i64 = 0
198 var masked: i64 = 0
199 var pure: i64 = 0
200 var unread: i64 = 0
201 var shown: i64 = 0
202 var i: i64 = 0
203 while i < n {
204 let e: i64 = rp_le(buf, i, n)
205 if e > i {
206 if buf[i] != (35 as u8) {
207 rows = rows + 1
208 var ok: i64 = 0
209 if rp_col_tab(buf, i, e, 0, c1) == 1 { if rp_col_tab(buf, i, e, 1, c2) == 1 {
210 if ac_basename(buf, c2[0], c2[1], bn) == 1 { ok = 1 } } }
211 if ok == 0 { unread = unread + 1 } else {
212 if rp_span_eq(buf, c1[0], c1[1], buf, bn[0], bn[1]) == 1 { self_n = self_n + 1 } else {
213 let own: i64 = ac_own_src(buf, c1[0], c1[1])
214 if own >= 0 {
215 masked = masked + 1
216 if shown < AC_WORKLIST_SHOWN {
217 o = rp_put(out, o, "ALIAS-MASKED name=" as *u8)
218 o = rp_putspan(out, o, buf, c1[0], c1[1])
219 o = rp_put(out, o, " own_source_bytes=" as *u8)
220 o = rp_putn(out, o, own)
221 o = rp_put(out, o, " but_row_resolves_to=" as *u8)
222 o = rp_putspan(out, o, buf, bn[0], bn[1])
223 o = rp_put(out, o, "\n" as *u8)
224 shown = shown + 1
225 }
226 } else { pure = pure + 1 }
227 }
228 }
229 }
230 }
231 i = e + 1
232 }
233 if masked > shown {
234 o = rp_put(out, o, " <== THIS LIST IS A PREFIX OF ITS OWN COUNT: shown " as *u8)
235 o = rp_putn(out, o, shown)
236 o = rp_put(out, o, " of " as *u8)
237 o = rp_putn(out, o, masked)
238 o = rp_put(out, o, " -- raise AC_WORKLIST_SHOWN to see the rest, and do NOT publish this prefix as the population\n" as *u8)
239 }
240 o = rp_put(out, o, "ENVELOPE rows=" as *u8)
241 o = rp_putn(out, o, rows)
242 o = rp_put(out, o, " self=" as *u8)
243 o = rp_putn(out, o, self_n)
244 o = rp_put(out, o, " alias_masked=" as *u8)
245 o = rp_putn(out, o, masked)
246 o = rp_put(out, o, " alias_pure=" as *u8)
247 o = rp_putn(out, o, pure)
248 o = rp_put(out, o, " unreadable=" as *u8)
249 o = rp_putn(out, o, unread)
250 o = rp_put(out, o, " sum=" as *u8)
251 o = rp_putn(out, o, self_n + masked + pure + unread)
252 o = rp_put(out, o, " conf_bytes=" as *u8)
253 o = rp_putn(out, o, n)
254 o = rp_put(out, o, " worklist_shown=" as *u8)
255 o = rp_putn(out, o, shown)
256 o = rp_put(out, o, "\n" as *u8)
257 // THE PARTITION IS A CLAIM: it is checked here and the verdict carries the answer, because a census
258 // whose parts do not sum is a leak wearing a total.
259 var green: i64 = 0
260 if self_n + masked + pure + unread == rows { green = 1 }
261 if rows == 0 { green = 0 }
262 if green == 1 { o = rp_put(out, o, "NX-ALIASCENSUS partition RECONCILES verdict=GREEN\n" as *u8) }
263 if green == 0 { o = rp_put(out, o, "NX-ALIASCENSUS partition DOES-NOT-SUM or zero rows verdict=RED\n" as *u8) }
264 sys_write(1, out, o)
265 if green == 1 { sys_exit(AC_EXIT_OK); return AC_EXIT_OK }
266 sys_exit(AC_EXIT_RED)
267 return AC_EXIT_RED
268}