nx_autofix_auto_gate.nx source
↩ module page · 246 lines · 17788 B
1// nx_autofix_auto_gate.nx -- TEETH FOR THE FIX LOOP'S M0 RULERS (autodev AD3/AD4/AD5/AD6/AD7, 2026-08-27).
2//
3// SUBJECT: nx_autofix_lib (the rulers nx_autofix_auto composes as af_episode_ledger, af_sandbox_root,
4// af_null_control, af_admit_untrusted, af_intake_board), driven in-process over fixtures built at
5// runtime under /tmp/nx_autofix_auto_gate/<epoch>/ -- a gate must never share a fixture with a
6// production beat, and nothing here opens a production plane for write.
7//
8// END TO END WHERE IT COUNTS: the sandbox teeth really fork the sovereign build runner on a fixture
9// candidate, so a green here means a candidate was compiled and judged INSIDE an isolated root on
10// this host, under a wall deadline and resource limits, with the tree copy provably untouched.
11//
12// TEETH
13// T1 fixture-reached-condition: the seeded bug REPRODUCES in the sandbox (FNRES dbl 0 2)
14// T2 AD7 the tree copy is byte-identical after the sandbox build (never opened for write)
15// T3 AD7 a fix applied INSIDE the sandbox is what the judge sees (all pass after the edit)
16// T4 AD7 neg-control-deadline-kills-the-group: a spinning candidate is killed at the wall
17// T5 AD4 null controls hold on a real bug: empty patch and a replayed foreign fix both stay RED
18// T6 AD4 BITE: on a candidate that cannot fail, the empty patch scores GREEN and the batch is refused
19// T7 AD5 ledger rows append as decided and the newest batch parses to k/n with clusters that SUM
20// T8 AD5 the write path resolves without a literal (estate journal or the stage ledger, named)
21// T9 AD6 a local row is admitted for a sandbox run
22// T10 AD6 a pinned, merged external row is admitted as DATA ONLY
23// T11 AD6 BITE: an unmerged external row is refused BY NAME while the merged one is not
24// T12 AD6 neg-control-unpinned-and-malformed-refused
25// T13 AD3 the intake plane over fixture sources: partition sums, RED gate present, GREEN gate refused
26// T14 AD3 neg-control-green-before-refused: the GREEN-before gate is absent from the plane rows
27// T15 conf: the sandbox bounds come from knowledge/autofix.conf (or the announced defaults) and are > 0
28// license_tier: ORIGINAL Fixtures under /tmp only. No hw writes (Rule 26). expect_exit: 0
29import "nx_syscalls.nx"
30import "nx_gate_verdict.nx"
31import "nx_autofix_lib.nx"
32
33const AG_DIR: *u8 = "/tmp/nx_autofix_auto_gate/"
34const AG_PATH: i64 = 4096
35const AG_CAP: i64 = 65536
36const AG_LINE: i64 = 2048
37const AG_TS_MAGIC: i64 = 1787000000 // fixture ledger timestamps: two batches, the newer wins
38const AG_FX_MS_FLOOR: i64 = 200 // the spin wall can never be below two poll ticks
39
40func ag_write(path: *u8, text: *u8) -> i64 {
41 let fd: i64 = sys_openat_wr(path, AFL_MODE_0644)
42 if fd < 0 { return 0 - 1 }
43 let n: i64 = afl_slen(text)
44 sys_write(fd, text, n)
45 sys_close(fd)
46 return n
47}
48func ag_join(dst: *u8, dir: *u8, name: *u8) -> i64 { var o: i64 = afl_cat(dst, 0, dir); return afl_cat(dst, o, name) }
49
50func main() -> i64 {
51 let ctr: *i64 = gv_ctr()
52 gv_head("nx_autofix_auto_gate -- sandbox root, null controls, episode ledger, untrusted-input admission and the intake plane, each fired on a fixture and each refused on its neg-control" as *u8)
53 let ep: i64 = sys_now_realtime_sec()
54 sys_mkdir(AG_DIR, AFL_MODE_0755)
55 let dir: *u8 = sys_mmap(AG_PATH)
56 var o: i64 = afl_cat(dir, 0, AG_DIR)
57 o = afl_catn(dir, o, ep)
58 o = afl_cat(dir, o, "/" as *u8)
59 sys_mkdir(dir, AFL_MODE_0755)
60
61 // ---- fixture candidates ----
62 let cand: *u8 = sys_mmap(AG_PATH)
63 ag_join(cand, dir, "fx_cand.nx" as *u8)
64 ag_write(cand, "import \"nx_syscalls.nx\"\nfunc fw(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }\nfunc dbl(x: i64) -> i64 { return x }\nfunc main() -> i64 {\n var f: i64 = 0\n if dbl(2) == 4 { f = f + 1 }\n if dbl(3) == 6 { f = f + 1 }\n if f == 2 { fw(\"FNRES dbl 2 2\\n\" as *u8) } else { if f == 1 { fw(\"FNRES dbl 1 2\\n\" as *u8) } else { fw(\"FNRES dbl 0 2\\n\" as *u8) } }\n return 0\n}\n" as *u8)
65 let snap: *u8 = sys_mmap(AG_PATH)
66 ag_join(snap, dir, "fx_cand.snapshot" as *u8)
67 afl_copyfile(cand, snap)
68 let pass: *u8 = sys_mmap(AG_PATH)
69 ag_join(pass, dir, "fx_pass.nx" as *u8)
70 ag_write(pass, "import \"nx_syscalls.nx\"\nfunc fw(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }\nfunc dbl(x: i64) -> i64 { return x + x }\nfunc main() -> i64 {\n var f: i64 = 0\n if dbl(2) == 4 { f = f + 1 }\n if dbl(3) == 6 { f = f + 1 }\n if f == 2 { fw(\"FNRES dbl 2 2\\n\" as *u8) } else { fw(\"FNRES dbl 0 2\\n\" as *u8) }\n return 0\n}\n" as *u8)
71 let spin: *u8 = sys_mmap(AG_PATH)
72 ag_join(spin, dir, "fx_spin.nx" as *u8)
73 ag_write(spin, "import \"nx_syscalls.nx\"\nfunc main() -> i64 {\n var i: i64 = 1\n while i > 0 { i = i + 1; if i > 1000000000 { i = 1 } }\n return 0\n}\n" as *u8)
74
75 // T15 conf bounds (read before the sandbox uses them)
76 let wall: i64 = afl_conf_int(AFL_KEY_WALL, AFL_WALL_MS_DEFAULT)
77 let asb: i64 = afl_conf_int(AFL_KEY_AS, AFL_AS_BYTES_DEFAULT)
78 gv_puts(" sandbox bounds: wall_ms=" as *u8); gv_num(wall); gv_puts(" as_bytes=" as *u8); gv_num(asb); gv_puts(" (knowledge/autofix.conf or the announced defaults)\n" as *u8)
79 var t15: i64 = 0
80 if wall > 0 { if asb > 0 { t15 = 1 } }
81 gv_check("T15 the sandbox bounds resolve from the conf or the announced defaults and are positive" as *u8, t15, ctr)
82
83 // ---- T1/T2/T3: the sandbox, end to end ----
84 let sb: *u8 = sys_mmap(AG_PATH)
85 let copied: i64 = afl_sandbox_make(ep, "fx_cand" as *u8, cand, sb)
86 gv_puts(" sandbox=" as *u8); gv_puts(sb); gv_puts(" closure_files=" as *u8); gv_num(copied); gv_puts("\n" as *u8)
87 let out: *u8 = sys_mmap(AG_CAP)
88 let st: *i64 = sys_mmap(16) as *i64
89 let t0: i64 = sys_now_ms()
90 let n1: i64 = afl_sandbox_run(sb, "fx_cand" as *u8, out, AG_CAP, wall, asb, st)
91 let run_ms: i64 = sys_now_ms() - t0
92 let nm: *u8 = sys_mmap(AFL_NAME)
93 let f1: i64 = afl_fn_failing(out, n1, nm)
94 gv_puts(" first sandbox build+run: bytes=" as *u8); gv_num(n1); gv_puts(" ms=" as *u8); gv_num(run_ms); gv_puts(" killed=" as *u8); gv_num(st[0]); gv_puts(" exit=" as *u8); gv_num(st[1]); gv_puts(" failing=" as *u8); gv_num(f1); gv_puts(" name=" as *u8); gv_puts(nm); gv_puts("\n" as *u8)
95 var t1: i64 = 0
96 if copied >= 1 { if f1 == 1 { if afl_streq(nm, "dbl" as *u8) == 1 { if st[0] == 0 { t1 = 1 } } } }
97 if t1 == 0 {
98 gv_puts(" T1 DIAGNOSTIC -- the sandbox capture (print the values, not just the verdict):
99----8<----
100" as *u8)
101 sys_write(1, out, n1)
102 gv_puts("
103---->8----
104" as *u8)
105 }
106 gv_check("T1 fixture-reached-condition: the seeded bug REPRODUCES inside the sandbox (FNRES dbl 0 2, killed=0)" as *u8, t1, ctr)
107 gv_check("T2 AD7 the tree copy is byte-identical after the sandbox build -- the candidate outside the root was never opened for write" as *u8, afl_bytes_eq(cand, snap), ctr)
108 let sbsrc: *u8 = sys_mmap(AG_PATH)
109 afl_sandbox_src(sb, "fx_cand" as *u8, sbsrc)
110 let ap: i64 = afl_apply_fix(sbsrc, "func dbl(x: i64) -> i64 { return x }" as *u8, "func dbl(x: i64) -> i64 { return x + x }" as *u8)
111 let n2: i64 = afl_sandbox_run(sb, "fx_cand" as *u8, out, AG_CAP, wall, asb, st)
112 let f2: i64 = afl_fn_failing(out, n2, nm)
113 var t3: i64 = 0
114 if ap > 0 { if f2 == 0 { if afl_bytes_eq(cand, snap) == 1 { t3 = 1 } } }
115 gv_check("T3 AD7 a fix applied INSIDE the sandbox is what the judge sees (all functions pass) while the tree copy still reads unchanged" as *u8, t3, ctr)
116 afl_copyfile(snap, sbsrc)
117
118 // ---- T4: the deadline kills a spinning candidate ----
119 let sb2: *u8 = sys_mmap(AG_PATH)
120 afl_sandbox_make(ep, "fx_spin" as *u8, spin, sb2)
121 var spin_wall: i64 = run_ms
122 if spin_wall < AG_FX_MS_FLOOR { spin_wall = AG_FX_MS_FLOOR }
123 let t4a: i64 = sys_now_ms()
124 afl_sandbox_run(sb2, "fx_spin" as *u8, out, AG_CAP, spin_wall, asb, st)
125 let spin_ms: i64 = sys_now_ms() - t4a
126 gv_puts(" spin candidate: wall_ms=" as *u8); gv_num(spin_wall); gv_puts(" elapsed_ms=" as *u8); gv_num(spin_ms); gv_puts(" killed=" as *u8); gv_num(st[0]); gv_puts("\n" as *u8)
127 var t4: i64 = 0
128 if st[0] == 1 { t4 = 1 }
129 gv_check("T4 AD7 neg-control-deadline-kills-the-group: a candidate that never returns is killed at the wall (killed=1) rather than holding the loop" as *u8, t4, ctr)
130 afl_sandbox_reap(sb2, "fx_spin" as *u8)
131
132 // ---- T5/T6: null controls ----
133 let ng: i64 = afl_null_controls(sb, "fx_cand" as *u8, sbsrc, snap, "func dbl(x: i64) -> i64 { return x }" as *u8, "func dbl(x: i64) -> i64 { return 0 - x }" as *u8, out, AG_CAP, wall, asb)
134 var t5: i64 = 0
135 if ng == 0 { t5 = 1 }
136 gv_check("T5 AD4 null controls hold on a real bug: the empty patch and a replayed foreign fix both stay RED (nulls_green=0)" as *u8, t5, ctr)
137 afl_sandbox_reap(sb, "fx_cand" as *u8)
138 let sb3: *u8 = sys_mmap(AG_PATH)
139 afl_sandbox_make(ep, "fx_pass" as *u8, pass, sb3)
140 let sb3src: *u8 = sys_mmap(AG_PATH)
141 afl_sandbox_src(sb3, "fx_pass" as *u8, sb3src)
142 let snap3: *u8 = sys_mmap(AG_PATH)
143 ag_join(snap3, dir, "fx_pass.snapshot" as *u8)
144 afl_copyfile(pass, snap3)
145 let ng2: i64 = afl_null_controls(sb3, "fx_pass" as *u8, sb3src, snap3, "func dbl(x: i64) -> i64 { return x + x }" as *u8, "" as *u8, out, AG_CAP, wall, asb)
146 var fires: i64 = 0
147 if ng2 >= 1 { fires = 1 }
148 gv_bite("T6 AD4 BITE-null-control: on a candidate that cannot fail the empty patch scores GREEN and the batch is refused; on the real bug it stays silent" as *u8, fires, 1 - t5, ctr)
149 afl_sandbox_reap(sb3, "fx_pass" as *u8)
150
151 // ---- T7/T8: the episode ledger ----
152 let led: *u8 = sys_mmap(AG_PATH)
153 ag_join(led, dir, "autofix_ledger.jrnl" as *u8)
154 let r1: *u8 = "AUTOFIX-AUTO ts=1787000000 cand=old1 located=dbl attempts=1 maker=GREEN revert=1\n" as *u8
155 let r2: *u8 = "AUTOFIX-AUTO ts=1787000100 cand=c2 located=dbl attempts=1 maker=GREEN revert=1 harness=h123\n" as *u8
156 let r3: *u8 = "AUTOFIX-AUTO ts=1787000100 cand=c3 located=dbl attempts=5 maker=MISS revert=1 harness=h123\n" as *u8
157 let r4: *u8 = "AUTOFIX-AUTO ts=1787000100 cand=c4 located=sgn attempts=1 maker=GREEN revert=1 harness=h123\n" as *u8
158 afl_append(led, r1, afl_slen(r1))
159 afl_append(led, r2, afl_slen(r2))
160 afl_append(led, r3, afl_slen(r3))
161 afl_append(led, r4, afl_slen(r4))
162 let lb: *i64 = sys_mmap(8) as *i64
163 let lbuf: *u8 = sys_read_file(led, lb)
164 let bst: *i64 = sys_mmap(32) as *i64
165 let ck: *i64 = sys_mmap(AFL_CLUSTER_MAX * 8) as *i64
166 let cn: *i64 = sys_mmap(AFL_CLUSTER_MAX * 8) as *i64
167 let names: *u8 = sys_mmap(AFL_CLUSTER_MAX * AFL_NAME)
168 let harness: *u8 = sys_mmap(AFL_HARNESS)
169 var nc: i64 = 0
170 if (lbuf as i64) != 0 { nc = afl_batch_stats(lbuf, lb[0], bst, ck, cn, names, harness) }
171 var sumk: i64 = 0
172 var sumn: i64 = 0
173 var c: i64 = 0
174 while c < nc { sumk = sumk + ck[c]; sumn = sumn + cn[c]; c = c + 1 }
175 gv_puts(" ledger newest batch: ts=" as *u8); gv_num(bst[0]); gv_puts(" total=" as *u8); gv_num(bst[1]); gv_puts(" resolved=" as *u8); gv_num(bst[2]); gv_puts(" clusters=" as *u8); gv_num(nc); gv_puts(" sum_k=" as *u8); gv_num(sumk); gv_puts(" sum_n=" as *u8); gv_num(sumn); gv_puts(" harness=" as *u8); gv_puts(harness); gv_puts("\n" as *u8)
176 var t7: i64 = 0
177 if bst[0] == AG_TS_MAGIC + 100 { if bst[1] == 3 { if bst[2] == 2 { if nc == 2 { if sumk == 2 { if sumn == 3 { if afl_streq(harness, "h123" as *u8) == 1 { t7 = 1 } } } } } } }
178 gv_check("T7 AD5 rows append as decided and the NEWEST batch parses to k=2 n=3 over 2 located clusters that sum to (k,n), carrying the harness token" as *u8, t7, ctr)
179 let wp: *u8 = sys_mmap(AG_PATH)
180 let where: i64 = afl_ledger_write_path(wp)
181 gv_puts(" ledger write path (rung " as *u8); gv_num(where); gv_puts("): " as *u8); gv_puts(wp); gv_puts("\n" as *u8)
182 var t8: i64 = 0
183 let wl: i64 = afl_slen(wp)
184 if wl > 19 { if afl_streq(((wp as i64) + wl - 19) as *u8, "autofix_ledger.jrnl" as *u8) == 1 { t8 = 1 } }
185 if wl > 18 { if afl_streq(((wp as i64) + wl - 18) as *u8, "autofix_ledger.log" as *u8) == 1 { t8 = 1 } }
186 gv_check("T8 AD5 the ledger write path resolves to the estate journal or the stage ledger by name, never a literal in an organ" as *u8, t8, ctr)
187
188 // ---- T9-T12: admission ----
189 let an: *u8 = sys_mmap(AFL_NAME)
190 let apth: *u8 = sys_mmap(AFL_PATH)
191 let aprov: *u8 = sys_mmap(AFL_HARNESS)
192 let rowL: *u8 = "nx_autofix_candidate2|runtime/nx_autofix_candidate2.nx" as *u8
193 let rowD: *u8 = "ext_ok|https://example.invalid/fix.diff|origin=external|prov=h0123456789abcdef|merged=yes" as *u8
194 let rowU: *u8 = "ext_unmerged|https://example.invalid/fix.diff|origin=external|prov=h0123456789abcdef|merged=no" as *u8
195 let rowP: *u8 = "ext_unpinned|https://example.invalid/fix.diff|origin=external|merged=yes" as *u8
196 let rowM: *u8 = "garbage-without-a-pipe" as *u8
197 let vL: i64 = afl_admit_row(rowL, afl_slen(rowL), an, apth, aprov)
198 let vD: i64 = afl_admit_row(rowD, afl_slen(rowD), an, apth, aprov)
199 let vU: i64 = afl_admit_row(rowU, afl_slen(rowU), an, apth, aprov)
200 let vP: i64 = afl_admit_row(rowP, afl_slen(rowP), an, apth, aprov)
201 let vM: i64 = afl_admit_row(rowM, afl_slen(rowM), an, apth, aprov)
202 gv_puts(" admission: local=" as *u8); gv_puts(afl_admit_name(vL)); gv_puts(" data=" as *u8); gv_puts(afl_admit_name(vD)); gv_puts(" unmerged=" as *u8); gv_puts(afl_admit_name(vU)); gv_puts(" unpinned=" as *u8); gv_puts(afl_admit_name(vP)); gv_puts(" malformed=" as *u8); gv_puts(afl_admit_name(vM)); gv_puts("\n" as *u8)
203 var t9: i64 = 0
204 if vL == AFL_ADMIT_LOCAL { t9 = 1 }
205 gv_check("T9 AD6 a local row is admitted for a sandbox run" as *u8, t9, ctr)
206 var t10: i64 = 0
207 if vD == AFL_ADMIT_DATA_ONLY { t10 = 1 }
208 gv_check("T10 AD6 a provenance-pinned, maintainer-merged external row is admitted as DATA ONLY, never executed" as *u8, t10, ctr)
209 var ub: i64 = 0
210 if vU == AFL_REFUSED_UNMERGED { ub = 1 }
211 gv_bite("T11 AD6 BITE-unmerged-external-refused-by-name: the unmerged row is refused with its reason named, the merged twin is not" as *u8, ub, 1 - t10, ctr)
212 var t12: i64 = 0
213 if vP == AFL_REFUSED_UNPINNED { if vM == AFL_REFUSED_MALFORMED { t12 = 1 } }
214 gv_check("T12 AD6 neg-control-unpinned-and-malformed-refused: no prov=h<sha> and no name|path each refuse by name" as *u8, t12, ctr)
215
216 // ---- T13/T14: the intake plane over fixture sources ----
217 let fxr: *u8 = sys_mmap(AG_PATH); ag_join(fxr, dir, "gateroster.jrnl" as *u8)
218 ag_write(fxr, "1787000001\troster\tfx_a_gate\tGREEN\texit=0\tms=1\tok\n1787000002\troster\tfx_b_gate\tGREEN\texit=0\tms=1\tok\n1787000003\troster\tfx_a_gate\tRED\texit=1\tms=1\tNX-A passed 1/2 verdict=RED\n1787000004\troster\tfx_c_gate\tSKIP\texit=3\tms=1\tskip\n" as *u8)
219 let fxd: *u8 = sys_mmap(AG_PATH); ag_join(fxd, dir, "drift.txt" as *u8)
220 ag_write(fxd, "# comment\nnx_fx_one | promote after contentdiff | BEHIND 120 B | none\nnx_fx_two | rebuild then compare | BEHIND 8 B | lease\n" as *u8)
221 let fxl: *u8 = sys_mmap(AG_PATH); ag_join(fxl, dir, "drift.log" as *u8)
222 ag_write(fxl, "epoch=1786000000 distinct=1 stale=1\nepoch=1787000005 distinct=2 stale=2\n" as *u8)
223 let fxm: *u8 = sys_mmap(AG_PATH); ag_join(fxm, dir, "magicbase" as *u8)
224 sys_mkdir(fxm, AFL_MODE_0755)
225 let fxm1: *u8 = sys_mmap(AG_PATH); ag_join(fxm1, fxm, "/nx_fx_clean.cnt" as *u8); ag_write(fxm1, "0\n" as *u8)
226 let fxm2: *u8 = sys_mmap(AG_PATH); ag_join(fxm2, fxm, "/nx_fx_dirty.cnt" as *u8); ag_write(fxm2, "5\n" as *u8)
227 let fxu: *u8 = sys_mmap(AG_PATH); ag_join(fxu, dir, "unwired.baseline" as *u8)
228 ag_write(fxu, "# corpus=3\nfx_never_called\nfx_also_never\n" as *u8)
229 let plane: *u8 = sys_mmap(AG_PATH); ag_join(plane, dir, "autodev_intake.jrnl" as *u8)
230 let total: i64 = afl_intake_emit(plane, fxr, fxd, fxl, fxm, fxu, 0)
231 let pb: *i64 = sys_mmap(8) as *i64
232 let pbuf: *u8 = sys_read_file(plane, pb)
233 var t13: i64 = 0
234 var t14: i64 = 0
235 if (pbuf as i64) != 0 {
236 let pn: i64 = pb[0]
237 if total == 6 { if afl_find(pbuf, pn, "INTAKE total=6 gates_red=1 drift=2 magic=1 unwired=2 debt_refused_no_oracle=0 refused_green_before=2" as *u8, 0) >= 0 { if afl_find(pbuf, pn, "gate|fx_a_gate|oracle=./fx_a_gate.elf" as *u8, 0) >= 0 { if afl_find(pbuf, pn, "red_before=roster:RED@1787000003" as *u8, 0) >= 0 { if afl_find(pbuf, pn, "magic|nx_fx_dirty|" as *u8, 0) >= 0 { if afl_find(pbuf, pn, "partition=RECONCILES" as *u8, 0) >= 0 { t13 = 1 } } } } } }
238 if afl_find(pbuf, pn, "gate|fx_b_gate|" as *u8, 0) < 0 { if afl_find(pbuf, pn, "gate|fx_c_gate|" as *u8, 0) < 0 { if afl_find(pbuf, pn, "magic|nx_fx_clean|" as *u8, 0) < 0 { t14 = 1 } } }
239 }
240 gv_check("T13 AD3 the intake plane over fixture sources: 1 RED gate + 2 drift rows + 1 dirty magic count + 2 unwired names = 6, the partition line sums and every task carries its oracle and a RED-before receipt" as *u8, t13, ctr)
241 gv_check("T14 AD3 neg-control-green-before-refused: the GREEN gate, the SKIP gate and the zero magic count are absent from the plane (unreproduced tasks never enter the resolve rate)" as *u8, t14, ctr)
242
243 let rc: i64 = gv_verdict("AUTOFIX-AUTO-GATE" as *u8, ctr, "every candidate builds and is judged inside an isolated root under a deadline, null controls refuse an oracle that cannot fail, the ledger appends as decided and parses to a partition that sums, untrusted rows are data-only or refused by name, and the intake plane carries an oracle and a receipt per task" as *u8)
244 sys_exit(rc)
245 return rc
246}