nx_autofix_auto_gate_t138.nx source
↩ module page · 264 lines · 19253 B
1// nx_autofix_auto_gate.nx -- TEETH FOR THE FIX LOOP'S M0 RULERS (autodev AD3/AD4/AD5/AD6/AD7, 2026-08-27).
2//
3// SUBJECT: nx_autofix_lib (the rulers nx_autofix_auto composes as af_episode_ledger, af_sandbox_root,
4// af_null_control, af_admit_untrusted, af_intake_board), driven in-process over fixtures built at
5// runtime under /tmp/nx_autofix_auto_gate/<epoch>/ -- a gate must never share a fixture with a
6// production beat, and nothing here opens a production plane for write.
7//
8// END TO END WHERE IT COUNTS: the sandbox teeth really fork the sovereign build runner on a fixture
9// candidate, so a green here means a candidate was compiled and judged INSIDE an isolated root on
10// this host, under a wall deadline and resource limits, with the tree copy provably untouched.
11//
12// TEETH
13// T1 fixture-reached-condition: the seeded bug REPRODUCES in the sandbox (FNRES dbl 0 2)
14// T2 AD7 the tree copy is byte-identical after the sandbox build (never opened for write)
15// T3 AD7 a fix applied INSIDE the sandbox is what the judge sees (all pass after the edit)
16// T4 AD7 neg-control-deadline-kills-the-group: a spinning candidate is killed at the wall
17// T5 AD4 null controls hold on a real bug: empty patch and a replayed foreign fix both stay RED
18// T6 AD4 BITE: on a candidate that cannot fail, the empty patch scores GREEN and the batch is refused
19// T7 AD5 ledger rows append as decided and the newest batch parses to k/n with clusters that SUM
20// T8 AD5 the write path resolves without a literal (estate journal or the stage ledger, named)
21// T9 AD6 a local row is admitted for a sandbox run
22// T10 AD6 a pinned, merged external row is admitted as DATA ONLY
23// T11 AD6 BITE: an unmerged external row is refused BY NAME while the merged one is not
24// T12 AD6 neg-control-unpinned-and-malformed-refused
25// T13 AD3 the intake plane over fixture sources: partition sums, RED gate present, GREEN gate refused
26// T14 AD3 neg-control-green-before-refused: the GREEN-before gate is absent from the plane rows
27// T15 conf: the sandbox bounds come from knowledge/autofix.conf (or the announced defaults) and are > 0
28// license_tier: ORIGINAL Fixtures under /tmp only. No hw writes (Rule 26). expect_exit: 0
29import "nx_syscalls.nx"
30import "nx_gate_verdict.nx"
31import "nx_autofix_lib_t138.nx"
32
33const AG_DIR: *u8 = "/tmp/nx_autofix_auto_gate/"
34const AG_PATH: i64 = 4096
35const AG_CAP: i64 = 65536
36const AG_LINE: i64 = 2048
37const AG_TS_MAGIC: i64 = 1787000000 // fixture ledger timestamps: two batches, the newer wins
38const AG_FX_MS_FLOOR: i64 = 200 // the spin wall can never be below two poll ticks
39
40func ag_write(path: *u8, text: *u8) -> i64 {
41 let fd: i64 = sys_openat_wr(path, AFL_MODE_0644)
42 if fd < 0 { return 0 - 1 }
43 let n: i64 = afl_slen(text)
44 sys_write(fd, text, n)
45 sys_close(fd)
46 return n
47}
48func ag_join(dst: *u8, dir: *u8, name: *u8) -> i64 { var o: i64 = afl_cat(dst, 0, dir); return afl_cat(dst, o, name) }
49
50func main() -> i64 {
51 let ctr: *i64 = gv_ctr()
52 gv_head("nx_autofix_auto_gate -- sandbox root, null controls, episode ledger, untrusted-input admission and the intake plane, each fired on a fixture and each refused on its neg-control" as *u8)
53 let ep: i64 = sys_now_realtime_sec()
54 sys_mkdir(AG_DIR, AFL_MODE_0755)
55 let dir: *u8 = sys_mmap(AG_PATH)
56 var o: i64 = afl_cat(dir, 0, AG_DIR)
57 o = afl_catn(dir, o, ep)
58 o = afl_cat(dir, o, "/" as *u8)
59 sys_mkdir(dir, AFL_MODE_0755)
60
61 // ---- fixture candidates ----
62 let cand: *u8 = sys_mmap(AG_PATH)
63 ag_join(cand, dir, "fx_cand.nx" as *u8)
64 ag_write(cand, "import \"nx_syscalls.nx\"\nfunc fw(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }\nfunc dbl(x: i64) -> i64 { return x }\nfunc main() -> i64 {\n var f: i64 = 0\n if dbl(2) == 4 { f = f + 1 }\n if dbl(3) == 6 { f = f + 1 }\n if f == 2 { fw(\"FNRES dbl 2 2\\n\" as *u8) } else { if f == 1 { fw(\"FNRES dbl 1 2\\n\" as *u8) } else { fw(\"FNRES dbl 0 2\\n\" as *u8) } }\n return 0\n}\n" as *u8)
65 let snap: *u8 = sys_mmap(AG_PATH)
66 ag_join(snap, dir, "fx_cand.snapshot" as *u8)
67 afl_copyfile(cand, snap)
68 let pass: *u8 = sys_mmap(AG_PATH)
69 ag_join(pass, dir, "fx_pass.nx" as *u8)
70 ag_write(pass, "import \"nx_syscalls.nx\"\nfunc fw(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }\nfunc dbl(x: i64) -> i64 { return x + x }\nfunc main() -> i64 {\n var f: i64 = 0\n if dbl(2) == 4 { f = f + 1 }\n if dbl(3) == 6 { f = f + 1 }\n if f == 2 { fw(\"FNRES dbl 2 2\\n\" as *u8) } else { fw(\"FNRES dbl 0 2\\n\" as *u8) }\n return 0\n}\n" as *u8)
71 let spin: *u8 = sys_mmap(AG_PATH)
72 ag_join(spin, dir, "fx_spin.nx" as *u8)
73 ag_write(spin, "import \"nx_syscalls.nx\"\nfunc main() -> i64 {\n var i: i64 = 1\n while i > 0 { i = i + 1; if i > 1000000000 { i = 1 } }\n return 0\n}\n" as *u8)
74
75 // T15 conf bounds (read before the sandbox uses them)
76 let wall: i64 = afl_conf_int(AFL_KEY_WALL, AFL_WALL_MS_DEFAULT)
77 let asb: i64 = afl_conf_int(AFL_KEY_AS, AFL_AS_BYTES_DEFAULT)
78 gv_puts(" sandbox bounds: wall_ms=" as *u8); gv_num(wall); gv_puts(" as_bytes=" as *u8); gv_num(asb); gv_puts(" (knowledge/autofix.conf or the announced defaults)\n" as *u8)
79 var t15: i64 = 0
80 if wall > 0 { if asb > 0 { t15 = 1 } }
81 gv_check("T15 the sandbox bounds resolve from the conf or the announced defaults and are positive" as *u8, t15, ctr)
82
83 // ---- T1/T2/T3: the sandbox, end to end ----
84 let sb: *u8 = sys_mmap(AG_PATH)
85 let copied: i64 = afl_sandbox_make(ep, "fx_cand" as *u8, cand, sb)
86 gv_puts(" sandbox=" as *u8); gv_puts(sb); gv_puts(" closure_files=" as *u8); gv_num(copied); gv_puts("\n" as *u8)
87 let out: *u8 = sys_mmap(AG_CAP)
88 let st: *i64 = sys_mmap(16) as *i64
89 let t0: i64 = sys_now_ms()
90 let n1: i64 = afl_sandbox_run(sb, "fx_cand" as *u8, out, AG_CAP, wall, asb, st)
91 let run_ms: i64 = sys_now_ms() - t0
92 let nm: *u8 = sys_mmap(AFL_NAME)
93 let f1: i64 = afl_fn_failing(out, n1, nm)
94 gv_puts(" first sandbox build+run: bytes=" as *u8); gv_num(n1); gv_puts(" ms=" as *u8); gv_num(run_ms); gv_puts(" killed=" as *u8); gv_num(st[0]); gv_puts(" exit=" as *u8); gv_num(st[1]); gv_puts(" failing=" as *u8); gv_num(f1); gv_puts(" name=" as *u8); gv_puts(nm); gv_puts("\n" as *u8)
95 var t1: i64 = 0
96 if copied >= 1 { if f1 == 1 { if afl_streq(nm, "dbl" as *u8) == 1 { if st[0] == 0 { t1 = 1 } } } }
97 if t1 == 0 {
98 gv_puts(" T1 DIAGNOSTIC -- the sandbox capture (print the values, not just the verdict):
99----8<----
100" as *u8)
101 sys_write(1, out, n1)
102 gv_puts("
103---->8----
104" as *u8)
105 }
106 gv_check("T1 fixture-reached-condition: the seeded bug REPRODUCES inside the sandbox (FNRES dbl 0 2, killed=0)" as *u8, t1, ctr)
107 gv_check("T2 AD7 the tree copy is byte-identical after the sandbox build -- the candidate outside the root was never opened for write" as *u8, afl_bytes_eq(cand, snap), ctr)
108 let sbsrc: *u8 = sys_mmap(AG_PATH)
109 afl_sandbox_src(sb, "fx_cand" as *u8, sbsrc)
110 let ap: i64 = afl_apply_fix(sbsrc, "func dbl(x: i64) -> i64 { return x }" as *u8, "func dbl(x: i64) -> i64 { return x + x }" as *u8)
111 let n2: i64 = afl_sandbox_run(sb, "fx_cand" as *u8, out, AG_CAP, wall, asb, st)
112 let f2: i64 = afl_fn_failing(out, n2, nm)
113 var t3: i64 = 0
114 if ap > 0 { if f2 == 0 { if afl_bytes_eq(cand, snap) == 1 { t3 = 1 } } }
115 gv_check("T3 AD7 a fix applied INSIDE the sandbox is what the judge sees (all functions pass) while the tree copy still reads unchanged" as *u8, t3, ctr)
116 afl_copyfile(snap, sbsrc)
117
118
119 // Exercise the builder's refusal on the SAME sandbox, keeping the candidate unchanged.
120 let policy_path: *u8 = sys_mmap(AG_PATH)
121 let policy_saved: *u8 = sys_mmap(AG_PATH)
122 afl_cat(policy_path, 0, sb); afl_cat(policy_path, afl_slen(policy_path), "../knowledge/tree_canon.conf" as *u8)
123 afl_cat(policy_saved, 0, policy_path); afl_cat(policy_saved, afl_slen(policy_saved), ".saved" as *u8)
124 let banked: i64 = sys_renameat(policy_path, policy_saved)
125 let missing_n: i64 = afl_sandbox_run(sb, "fx_cand" as *u8, out, AG_CAP, wall, asb, st)
126 var policy_missing: i64 = 0
127 if banked == 0 { if st[1] == 7 { if afl_find(out, missing_n, "REFUSED-TREE-CANON INPUT" as *u8, 0) >= 0 { policy_missing = 1 } } }
128 if banked == 0 { sys_renameat(policy_saved, policy_path) }
129 gv_check("T16 missing policy cannot launch compiler or discard a proposal" as *u8, policy_missing, ctr)
130 gv_check("T17 infrastructure rc7 remains UNEXAMINED" as *u8, (afl_run_examined(0, 7, 0 - 1) == 0) as i64, ctr)
131 gv_check("T18 genuine failing grader remains examined" as *u8, (afl_run_examined(0, 0, 1) == 1) as i64, ctr)
132 gv_check("T19 genuine equivalent mutant remains examined" as *u8, (afl_run_examined(0, 0, 0) == 1) as i64, ctr)
133 gv_check("T20 empty grader remains UNEXAMINED" as *u8, (afl_run_examined(0, 0, 0 - 1) == 0) as i64, ctr)
134 gv_check("T21 timed out grader remains UNEXAMINED" as *u8, (afl_run_examined(1, 0, 1) == 0) as i64, ctr)
135
136 // ---- T4: the deadline kills a spinning candidate ----
137 let sb2: *u8 = sys_mmap(AG_PATH)
138 afl_sandbox_make(ep, "fx_spin" as *u8, spin, sb2)
139 var spin_wall: i64 = run_ms
140 if spin_wall < AG_FX_MS_FLOOR { spin_wall = AG_FX_MS_FLOOR }
141 let t4a: i64 = sys_now_ms()
142 afl_sandbox_run(sb2, "fx_spin" as *u8, out, AG_CAP, spin_wall, asb, st)
143 let spin_ms: i64 = sys_now_ms() - t4a
144 gv_puts(" spin candidate: wall_ms=" as *u8); gv_num(spin_wall); gv_puts(" elapsed_ms=" as *u8); gv_num(spin_ms); gv_puts(" killed=" as *u8); gv_num(st[0]); gv_puts("\n" as *u8)
145 var t4: i64 = 0
146 if st[0] == 1 { t4 = 1 }
147 gv_check("T4 AD7 neg-control-deadline-kills-the-group: a candidate that never returns is killed at the wall (killed=1) rather than holding the loop" as *u8, t4, ctr)
148 afl_sandbox_reap(sb2, "fx_spin" as *u8)
149
150 // ---- T5/T6: null controls ----
151 let ng: i64 = afl_null_controls(sb, "fx_cand" as *u8, sbsrc, snap, "func dbl(x: i64) -> i64 { return x }" as *u8, "func dbl(x: i64) -> i64 { return 0 - x }" as *u8, out, AG_CAP, wall, asb)
152 var t5: i64 = 0
153 if ng == 0 { t5 = 1 }
154 gv_check("T5 AD4 null controls hold on a real bug: the empty patch and a replayed foreign fix both stay RED (nulls_green=0)" as *u8, t5, ctr)
155 afl_sandbox_reap(sb, "fx_cand" as *u8)
156 let sb3: *u8 = sys_mmap(AG_PATH)
157 afl_sandbox_make(ep, "fx_pass" as *u8, pass, sb3)
158 let sb3src: *u8 = sys_mmap(AG_PATH)
159 afl_sandbox_src(sb3, "fx_pass" as *u8, sb3src)
160 let snap3: *u8 = sys_mmap(AG_PATH)
161 ag_join(snap3, dir, "fx_pass.snapshot" as *u8)
162 afl_copyfile(pass, snap3)
163 let ng2: i64 = afl_null_controls(sb3, "fx_pass" as *u8, sb3src, snap3, "func dbl(x: i64) -> i64 { return x + x }" as *u8, "" as *u8, out, AG_CAP, wall, asb)
164 var fires: i64 = 0
165 if ng2 >= 1 { fires = 1 }
166 gv_bite("T6 AD4 BITE-null-control: on a candidate that cannot fail the empty patch scores GREEN and the batch is refused; on the real bug it stays silent" as *u8, fires, 1 - t5, ctr)
167 afl_sandbox_reap(sb3, "fx_pass" as *u8)
168
169 // ---- T7/T8: the episode ledger ----
170 let led: *u8 = sys_mmap(AG_PATH)
171 ag_join(led, dir, "autofix_ledger.jrnl" as *u8)
172 let r1: *u8 = "AUTOFIX-AUTO ts=1787000000 cand=old1 located=dbl attempts=1 maker=GREEN revert=1\n" as *u8
173 let r2: *u8 = "AUTOFIX-AUTO ts=1787000100 cand=c2 located=dbl attempts=1 maker=GREEN revert=1 harness=h123\n" as *u8
174 let r3: *u8 = "AUTOFIX-AUTO ts=1787000100 cand=c3 located=dbl attempts=5 maker=MISS revert=1 harness=h123\n" as *u8
175 let r4: *u8 = "AUTOFIX-AUTO ts=1787000100 cand=c4 located=sgn attempts=1 maker=GREEN revert=1 harness=h123\n" as *u8
176 afl_append(led, r1, afl_slen(r1))
177 afl_append(led, r2, afl_slen(r2))
178 afl_append(led, r3, afl_slen(r3))
179 afl_append(led, r4, afl_slen(r4))
180 let lb: *i64 = sys_mmap(8) as *i64
181 let lbuf: *u8 = sys_read_file(led, lb)
182 let bst: *i64 = sys_mmap(32) as *i64
183 let ck: *i64 = sys_mmap(AFL_CLUSTER_MAX * 8) as *i64
184 let cn: *i64 = sys_mmap(AFL_CLUSTER_MAX * 8) as *i64
185 let names: *u8 = sys_mmap(AFL_CLUSTER_MAX * AFL_NAME)
186 let harness: *u8 = sys_mmap(AFL_HARNESS)
187 var nc: i64 = 0
188 if (lbuf as i64) != 0 { nc = afl_batch_stats(lbuf, lb[0], bst, ck, cn, names, harness) }
189 var sumk: i64 = 0
190 var sumn: i64 = 0
191 var c: i64 = 0
192 while c < nc { sumk = sumk + ck[c]; sumn = sumn + cn[c]; c = c + 1 }
193 gv_puts(" ledger newest batch: ts=" as *u8); gv_num(bst[0]); gv_puts(" total=" as *u8); gv_num(bst[1]); gv_puts(" resolved=" as *u8); gv_num(bst[2]); gv_puts(" clusters=" as *u8); gv_num(nc); gv_puts(" sum_k=" as *u8); gv_num(sumk); gv_puts(" sum_n=" as *u8); gv_num(sumn); gv_puts(" harness=" as *u8); gv_puts(harness); gv_puts("\n" as *u8)
194 var t7: i64 = 0
195 if bst[0] == AG_TS_MAGIC + 100 { if bst[1] == 3 { if bst[2] == 2 { if nc == 2 { if sumk == 2 { if sumn == 3 { if afl_streq(harness, "h123" as *u8) == 1 { t7 = 1 } } } } } } }
196 gv_check("T7 AD5 rows append as decided and the NEWEST batch parses to k=2 n=3 over 2 located clusters that sum to (k,n), carrying the harness token" as *u8, t7, ctr)
197 let wp: *u8 = sys_mmap(AG_PATH)
198 let where: i64 = afl_ledger_write_path(wp)
199 gv_puts(" ledger write path (rung " as *u8); gv_num(where); gv_puts("): " as *u8); gv_puts(wp); gv_puts("\n" as *u8)
200 var t8: i64 = 0
201 let wl: i64 = afl_slen(wp)
202 if wl > 19 { if afl_streq(((wp as i64) + wl - 19) as *u8, "autofix_ledger.jrnl" as *u8) == 1 { t8 = 1 } }
203 if wl > 18 { if afl_streq(((wp as i64) + wl - 18) as *u8, "autofix_ledger.log" as *u8) == 1 { t8 = 1 } }
204 gv_check("T8 AD5 the ledger write path resolves to the estate journal or the stage ledger by name, never a literal in an organ" as *u8, t8, ctr)
205
206 // ---- T9-T12: admission ----
207 let an: *u8 = sys_mmap(AFL_NAME)
208 let apth: *u8 = sys_mmap(AFL_PATH)
209 let aprov: *u8 = sys_mmap(AFL_HARNESS)
210 let rowL: *u8 = "nx_autofix_candidate2|runtime/nx_autofix_candidate2.nx" as *u8
211 let rowD: *u8 = "ext_ok|https://example.invalid/fix.diff|origin=external|prov=h0123456789abcdef|merged=yes" as *u8
212 let rowU: *u8 = "ext_unmerged|https://example.invalid/fix.diff|origin=external|prov=h0123456789abcdef|merged=no" as *u8
213 let rowP: *u8 = "ext_unpinned|https://example.invalid/fix.diff|origin=external|merged=yes" as *u8
214 let rowM: *u8 = "garbage-without-a-pipe" as *u8
215 let vL: i64 = afl_admit_row(rowL, afl_slen(rowL), an, apth, aprov)
216 let vD: i64 = afl_admit_row(rowD, afl_slen(rowD), an, apth, aprov)
217 let vU: i64 = afl_admit_row(rowU, afl_slen(rowU), an, apth, aprov)
218 let vP: i64 = afl_admit_row(rowP, afl_slen(rowP), an, apth, aprov)
219 let vM: i64 = afl_admit_row(rowM, afl_slen(rowM), an, apth, aprov)
220 gv_puts(" admission: local=" as *u8); gv_puts(afl_admit_name(vL)); gv_puts(" data=" as *u8); gv_puts(afl_admit_name(vD)); gv_puts(" unmerged=" as *u8); gv_puts(afl_admit_name(vU)); gv_puts(" unpinned=" as *u8); gv_puts(afl_admit_name(vP)); gv_puts(" malformed=" as *u8); gv_puts(afl_admit_name(vM)); gv_puts("\n" as *u8)
221 var t9: i64 = 0
222 if vL == AFL_ADMIT_LOCAL { t9 = 1 }
223 gv_check("T9 AD6 a local row is admitted for a sandbox run" as *u8, t9, ctr)
224 var t10: i64 = 0
225 if vD == AFL_ADMIT_DATA_ONLY { t10 = 1 }
226 gv_check("T10 AD6 a provenance-pinned, maintainer-merged external row is admitted as DATA ONLY, never executed" as *u8, t10, ctr)
227 var ub: i64 = 0
228 if vU == AFL_REFUSED_UNMERGED { ub = 1 }
229 gv_bite("T11 AD6 BITE-unmerged-external-refused-by-name: the unmerged row is refused with its reason named, the merged twin is not" as *u8, ub, 1 - t10, ctr)
230 var t12: i64 = 0
231 if vP == AFL_REFUSED_UNPINNED { if vM == AFL_REFUSED_MALFORMED { t12 = 1 } }
232 gv_check("T12 AD6 neg-control-unpinned-and-malformed-refused: no prov=h<sha> and no name|path each refuse by name" as *u8, t12, ctr)
233
234 // ---- T13/T14: the intake plane over fixture sources ----
235 let fxr: *u8 = sys_mmap(AG_PATH); ag_join(fxr, dir, "gateroster.jrnl" as *u8)
236 ag_write(fxr, "1787000001\troster\tfx_a_gate\tGREEN\texit=0\tms=1\tok\n1787000002\troster\tfx_b_gate\tGREEN\texit=0\tms=1\tok\n1787000003\troster\tfx_a_gate\tRED\texit=1\tms=1\tNX-A passed 1/2 verdict=RED\n1787000004\troster\tfx_c_gate\tSKIP\texit=3\tms=1\tskip\n" as *u8)
237 let fxd: *u8 = sys_mmap(AG_PATH); ag_join(fxd, dir, "drift.txt" as *u8)
238 ag_write(fxd, "# comment\nnx_fx_one | promote after contentdiff | BEHIND 120 B | none\nnx_fx_two | rebuild then compare | BEHIND 8 B | lease\n" as *u8)
239 let fxl: *u8 = sys_mmap(AG_PATH); ag_join(fxl, dir, "drift.log" as *u8)
240 ag_write(fxl, "epoch=1786000000 distinct=1 stale=1\nepoch=1787000005 distinct=2 stale=2\n" as *u8)
241 let fxm: *u8 = sys_mmap(AG_PATH); ag_join(fxm, dir, "magicbase" as *u8)
242 sys_mkdir(fxm, AFL_MODE_0755)
243 let fxm1: *u8 = sys_mmap(AG_PATH); ag_join(fxm1, fxm, "/nx_fx_clean.cnt" as *u8); ag_write(fxm1, "0\n" as *u8)
244 let fxm2: *u8 = sys_mmap(AG_PATH); ag_join(fxm2, fxm, "/nx_fx_dirty.cnt" as *u8); ag_write(fxm2, "5\n" as *u8)
245 let fxu: *u8 = sys_mmap(AG_PATH); ag_join(fxu, dir, "unwired.baseline" as *u8)
246 ag_write(fxu, "# corpus=3\nfx_never_called\nfx_also_never\n" as *u8)
247 let plane: *u8 = sys_mmap(AG_PATH); ag_join(plane, dir, "autodev_intake.jrnl" as *u8)
248 let total: i64 = afl_intake_emit(plane, fxr, fxd, fxl, fxm, fxu, 0)
249 let pb: *i64 = sys_mmap(8) as *i64
250 let pbuf: *u8 = sys_read_file(plane, pb)
251 var t13: i64 = 0
252 var t14: i64 = 0
253 if (pbuf as i64) != 0 {
254 let pn: i64 = pb[0]
255 if total == 6 { if afl_find(pbuf, pn, "INTAKE total=6 gates_red=1 drift=2 magic=1 unwired=2 debt_refused_no_oracle=0 refused_green_before=2" as *u8, 0) >= 0 { if afl_find(pbuf, pn, "gate|fx_a_gate|oracle=./fx_a_gate.elf" as *u8, 0) >= 0 { if afl_find(pbuf, pn, "red_before=roster:RED@1787000003" as *u8, 0) >= 0 { if afl_find(pbuf, pn, "magic|nx_fx_dirty|" as *u8, 0) >= 0 { if afl_find(pbuf, pn, "partition=RECONCILES" as *u8, 0) >= 0 { t13 = 1 } } } } } }
256 if afl_find(pbuf, pn, "gate|fx_b_gate|" as *u8, 0) < 0 { if afl_find(pbuf, pn, "gate|fx_c_gate|" as *u8, 0) < 0 { if afl_find(pbuf, pn, "magic|nx_fx_clean|" as *u8, 0) < 0 { t14 = 1 } } }
257 }
258 gv_check("T13 AD3 the intake plane over fixture sources: 1 RED gate + 2 drift rows + 1 dirty magic count + 2 unwired names = 6, the partition line sums and every task carries its oracle and a RED-before receipt" as *u8, t13, ctr)
259 gv_check("T14 AD3 neg-control-green-before-refused: the GREEN gate, the SKIP gate and the zero magic count are absent from the plane (unreproduced tasks never enter the resolve rate)" as *u8, t14, ctr)
260
261 let rc: i64 = gv_verdict("AUTOFIX-AUTO-GATE" as *u8, ctr, "every candidate builds and is judged inside an isolated root under a deadline, null controls refuse an oracle that cannot fail, the ledger appends as decided and parses to a partition that sums, untrusted rows are data-only or refused by name, and the intake plane carries an oracle and a receipt per task" as *u8)
262 sys_exit(rc)
263 return rc
264}