nx_bodyfit_canon_gate.nx source
↩ module page · 255 lines · 13609 B
1// nx_bodyfit_canon_gate.nx -- DOES CANON MODE ACTUALLY TRANSFORM THE CANON, AND DOES IT REFUSE WHEN THE
2// GENOME DOES NOT DESCRIBE IT? nx_bodyfit grew a second genome decoder (per-part ring scaling), and a
3// decoder that silently COPIED its input would pass every downstream check there is: the body still
4// generates, the renderer still renders, the judge still scores, and the search still reports a
5// best-of-generation. Nothing in the pipeline can tell a working transform from a no-op, which is
6// exactly the shape of defect that survives review and ships.
7//
8// nx_bodyfit_canon_gate (no args)
9//
10// ★★★THE IDENTITY CASE IS THE STRONGEST INVARIANT AVAILABLE: every gene at mid-envelope maps to a
11// per-mille scale of exactly 1000, so the emitted canon must be BYTE-IDENTICAL to the source -- every R
12// row, every negative offset, every P row, or the decoder is lossy somewhere.
13// ★★BUT BYTE-IDENTITY ALONE IS PASSED BY A TRANSFORM THAT DOES NOTHING, so it is paired with a BITE
14// cell: the extreme genome MUST differ from the source while the identity genome MUST match. Either
15// tooth alone is vacuous; only the pair proves the transform both WORKS and IS NOT A COPY.
16// ★IT ADDRESSES THE ARTIFACT BY THE PATH THE ORGAN ANNOUNCES (canon_path=), never by reconstructing the
17// filename from bodyfit.conf's envelope midpoints -- a reconstructed name breaks silently the moment any
18// bound is edited, and a gate that tests the wrong file reports GREEN about nothing.
19// exit 0 GREEN | 1 RED | 3 SKIP
20// license_tier: ORIGINAL. No hw writes (Rule 26).
21import "nx_syscalls.nx"
22import "nx_gate_verdict.nx"
23import "nx_tool_run.nx"
24
25const BG_BODYFIT: *u8 = "/volume1/homes/elderwesto/nishihost/nx_bodyfit.elf"
26const BG_CANON: *u8 = "knowledge/canon_merge2.dat"
27const BG_CANON_PATH: *u8 = "knowledge/bodyfit_canon.path"
28const BG_OUTCAP: i64 = 262144
29// a canon-mode evaluation is generate+render+judge+solve: seconds, not minutes. Past this it is wedged.
30const BG_TIMEOUT_MS: i64 = 300000
31// Canon mode derives its gene count from the selected artifact; no fixed part ceiling is embedded in the gate.
32const BG_MIDGENE: i64 = 500
33
34func bg_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
35func bg_trim_path(b: *u8, n: i64) -> i64 { var k: i64 = n; var done: i64 = 0; while k > 0 { if done == 0 { let c: i64 = b[k-1] as i64; if c == 10 { k = k - 1 } else { if c == 13 { k = k - 1 } else { if c == 32 { k = k - 1 } else { done = 1 } } } } } b[k] = 0 as u8; return k }
36func bg_count_parts(p: *u8) -> i64 { let ln: *i64 = sys_mmap(16) as *i64; let b: *u8 = sys_read_file(p, ln); if (b as i64) == 0 { return 0 - 1 }; var i: i64 = 0; var bol: i64 = 1; var n: i64 = 0; while i < ln[0] { if bol == 1 { if b[i] == (80 as u8) { n = n + 1 } }; if b[i] == (10 as u8) { bol = 1 } else { bol = 0 }; i = i + 1 }; return n }
37
38// decimal into d at off, NUL-terminated; returns bytes written INCLUDING the NUL.
39func bg_num(d: *u8, off: i64, v: i64) -> i64 {
40 let base: i64 = d as i64
41 let s: *u8 = (base + off) as *u8
42 var m: i64 = v
43 var w: i64 = 0
44 if m < 0 { s[0] = 45 as u8; w = 1; m = 0 - m }
45 let t: *u8 = sys_mmap(32)
46 var k: i64 = 0
47 if m == 0 { t[0] = 48 as u8; k = 1 }
48 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
49 while k > 0 { k = k - 1; s[w] = t[k]; w = w + 1 }
50 s[w] = 0 as u8
51 return w + 1
52}
53
54// substring search. ★A SEPARATE FLAG, NOT A CLOBBERED CURSOR: writing the exit condition into the scan
55// index destroys the position the caller needs and cannot report where it stopped.
56func bg_find(h: *u8, n: i64, needle: *u8) -> i64 {
57 let m: i64 = bg_len(needle)
58 var j: i64 = 0
59 var hit: i64 = 0 - 1
60 while j + m <= n {
61 var k: i64 = 0
62 var ok: i64 = 1
63 var go: i64 = 1
64 while go == 1 {
65 if k >= m { go = 0 } else {
66 if h[j+k] != needle[k] { ok = 0; go = 0 } else { k = k + 1 }
67 }
68 }
69 if ok == 1 { if hit < 0 { hit = j } }
70 j = j + 1
71 }
72 return hit
73}
74
75// read the value following <key> up to the next space or newline.
76func bg_extract(h: *u8, n: i64, key: *u8, dst: *u8, dcap: i64) -> i64 {
77 let at: i64 = bg_find(h, n, key)
78 if at < 0 { dst[0] = 0 as u8; return 0 }
79 var p: i64 = at + bg_len(key)
80 var o: i64 = 0
81 var go: i64 = 1
82 while go == 1 {
83 if p >= n { go = 0 } else {
84 let c: i64 = h[p] as i64
85 if c == 10 { go = 0 } else {
86 if c == 32 { go = 0 } else {
87 if o + 1 < dcap { dst[o] = h[p]; o = o + 1 }
88 p = p + 1
89 }
90 }
91 }
92 }
93 dst[o] = 0 as u8
94 return o
95}
96
97// byte-compare two files. Returns 1 same, 0 different, 0-1 UNREADABLE (the third state: a file we could
98// not open says NOTHING about whether the transform is correct, and must never be scored as either).
99func bg_same(a: *u8, b: *u8) -> i64 {
100 let la: *i64 = sys_mmap(16) as *i64
101 let lb: *i64 = sys_mmap(16) as *i64
102 let ba: *u8 = sys_read_file(a, la)
103 if (ba as i64) == 0 { return 0 - 1 }
104 let bb: *u8 = sys_read_file(b, lb)
105 if (bb as i64) == 0 { return 0 - 1 }
106 if la[0] != lb[0] { return 0 }
107 var i: i64 = 0
108 var same: i64 = 1
109 var go: i64 = 1
110 while go == 1 {
111 if i >= la[0] { go = 0 } else {
112 if ba[i] != bb[i] { same = 0; go = 0 } else { i = i + 1 }
113 }
114 }
115 return same
116}
117
118// ★LOCAL PREDICATES, because gv_eq DOES NOT EXIST IN THE BASE CLASS (proven absent, coverage_complete)
119// and gv_check wants a plain 1/0. Naming them keeps every tooth a readable claim instead of an
120// expression whose truth value the reader has to derive.
121func bg_eq(a: i64, b: i64) -> i64 { if a == b { return 1 } return 0 }
122func bg_ne(a: i64, b: i64) -> i64 { if a != b { return 1 } return 0 }
123func bg_ge0(a: i64) -> i64 { if a >= 0 { return 1 } return 0 }
124func bg_gt0(a: i64) -> i64 { if a > 0 { return 1 } return 0 }
125func bg_exists(p: *u8) -> i64 {
126 let fd: i64 = sys_openat_rd(p)
127 if fd < 0 { return 0 }
128 sys_close(fd)
129 return 1
130}
131
132// run `nx_bodyfit canon <v> x <n>` and capture. Returns the child rc.
133func bg_run_canon(subj: *u8, v: i64, n: i64, out: *u8, olen: *i64) -> i64 {
134 let nums: *u8 = sys_mmap(2048)
135 let av: *i64 = sys_mmap(512) as *i64
136 av[0] = subj as i64
137 av[1] = "canon" as *u8 as i64
138 var o: i64 = 0
139 var i: i64 = 0
140 while i < n {
141 av[2 + i] = (nums as i64) + o
142 o = o + bg_num(nums, o, v)
143 i = i + 1
144 }
145 av[2 + n] = 0
146 olen[0] = 0
147 return tr_run_capture_to(subj, av, out, BG_OUTCAP, olen, BG_TIMEOUT_MS)
148}
149
150func main(argc: i64, argv: *i64) -> i64 {
151 let ctr: *i64 = sys_mmap(64) as *i64
152 gv_head("=== nx_bodyfit_canon_gate -- the canon decoder is not a copy, and it refuses a wrong genome ===" as *u8)
153 // ★★★THE SUBJECT PATH IS OVERRIDABLE, AND THAT IS WHAT MAKES THIS GATE MUTATION-TESTABLE.
154 // MEASURED 2026-08-14: nx_gate_bite ran 9 valid mutants against this gate and killed ZERO. The cause
155 // was NOT weak teeth -- the harness rebuilds a mutated subject into buildroot/_build/ and CORRECTLY
156 // refuses to clobber the live binary, while this gate hardcoded the DEPLOYED path. Every mutant
157 // therefore ran against the pristine binary and survived BY CONSTRUCTION (proven: the deployed sha
158 // was byte-identical before and after the whole sweep).
159 // ★★★AN END-TO-END GATE THAT HARDCODES ITS SUBJECT'S DEPLOYED PATH CANNOT BE MUTATION-TESTED, AND ITS
160 // INCONCLUSIVE IS A PROPERTY OF ITS ADDRESSING, NOT OF ITS ASSERTIONS. Taking the subject as argv[1]
161 // lets a harness aim this gate at the artifact it actually built.
162 var subj: *u8 = BG_BODYFIT
163 if argc >= 2 { subj = argv[1] as *u8 }
164
165 let out: *u8 = sys_mmap(BG_OUTCAP)
166 let olen: *i64 = sys_mmap(16) as *i64
167 let pid: *u8 = sys_mmap(4096)
168 let pex: *u8 = sys_mmap(4096)
169
170 // ★PRECONDITIONS FIRST. A missing evaluator or a missing canon means this run produced NO EVIDENCE
171 // about the decoder, which is SKIP -- not a failure of the system under test.
172 let have_elf: i64 = gv_need("subject evaluator present" as *u8, bg_exists(subj), ctr)
173 let cpl: *i64 = sys_mmap(16) as *i64
174 let cp: *u8 = sys_read_file(BG_CANON_PATH, cpl)
175 var canon_path: *u8 = BG_CANON
176 if (cp as i64) != 0 { let cpn: i64 = bg_trim_path(cp, cpl[0]); if cpn > 0 { canon_path = cp } }
177 let part_count: i64 = bg_count_parts(canon_path)
178 let have_canon: i64 = gv_need("selected canon present" as *u8, bg_exists(canon_path), ctr)
179 let have_parts: i64 = gv_need("selected canon declares parts" as *u8, bg_ge0(part_count), ctr)
180 if have_elf == 0 { sys_exit(gv_verdict("BODYFIT-CANON-GATE" as *u8, ctr, "preconditions" as *u8)); return 3 }
181 if have_canon == 0 { sys_exit(gv_verdict("BODYFIT-CANON-GATE" as *u8, ctr, "preconditions" as *u8)); return 3 }
182 if have_parts == 0 { sys_exit(gv_verdict("BODYFIT-CANON-GATE" as *u8, ctr, "preconditions" as *u8)); return 3 }
183
184 // ---- IDENTITY: mid-envelope genes => scale exactly 1000 => canon must round-trip byte-for-byte ----
185 let rc_id: i64 = bg_run_canon(subj, BG_MIDGENE, part_count, out, olen)
186 gv_check("identity-genome-evaluates-rc0" as *u8, bg_eq(rc_id, 0), ctr)
187 bg_extract(out, olen[0], "canon_path=" as *u8, pid, 4096)
188 gv_check("organ-announces-canon-path" as *u8, bg_gt0(bg_len(pid)), ctr)
189 gv_check("organ-announces-wsum" as *u8, bg_ge0(bg_find(out, olen[0], "wsum=" as *u8)), ctr)
190 gv_check("identity-emits-FITNESS" as *u8, bg_ge0(bg_find(out, olen[0], "FITNESS=" as *u8)), ctr)
191
192 var id_same: i64 = 0 - 1
193 if bg_len(pid) > 0 { id_same = bg_same(pid, canon_path) }
194 // ★★THE CENTRAL TOOTH, AND IT IS BOUND TO ITS EVIDENCE: -1 means we could not read one of the files,
195 // which must not be scored as a pass OR a fail -- it is counted as a failure to observe, so a gate
196 // that cannot see the artifact can never report GREEN about it.
197 gv_check("identity-canon-is-byte-identical-to-source" as *u8, bg_eq(id_same, 1), ctr)
198
199 // ★THE MESH IS RECLAIMED. A 6 MB scratch mesh per evaluation strands gigabytes across a real search,
200 // and an evaluator that fills the disk is a defect even when its number is correct.
201 let mpath: *u8 = sys_mmap(4096)
202 var mi: i64 = 0
203 while mi < bg_len(pid) { mpath[mi] = pid[mi]; mi = mi + 1 }
204 // swap the trailing ".dat" for ".nxmesh"
205 if mi >= 4 {
206 mi = mi - 4
207 mpath[mi] = 46 as u8; mi = mi + 1
208 mpath[mi] = 110 as u8; mi = mi + 1
209 mpath[mi] = 120 as u8; mi = mi + 1
210 mpath[mi] = 109 as u8; mi = mi + 1
211 mpath[mi] = 101 as u8; mi = mi + 1
212 mpath[mi] = 115 as u8; mi = mi + 1
213 mpath[mi] = 104 as u8; mi = mi + 1
214 }
215 mpath[mi] = 0 as u8
216 // ★★BOUND TO ITS DENOMINATOR. This tooth asserts an ABSENCE, and an absence is trivially true when no
217 // evaluation ever produced a mesh -- CAUGHT BY THE WRONG-SUBJECT RED RUN, where it PASSED against a
218 // binary that had not written a single file. A TOOTH THAT PASSES ON THE EMPTY SET IS NOT A TOOTH, so
219 // the precondition (the eval ran AND named its artifact) is now part of the CONDITION, not just of
220 // the prose beside it.
221 var mesh_ok: i64 = 0
222 if rc_id == 0 { if bg_len(pid) > 0 { if bg_exists(mpath) == 0 { mesh_ok = 1 } } }
223 gv_check("scratch-mesh-reclaimed-after-eval" as *u8, mesh_ok, ctr)
224
225 // ---- EXTREME: every part at the bottom of the scale => the canon MUST change ----
226 let rc_ex: i64 = bg_run_canon(subj, 0, part_count, out, olen)
227 gv_check("extreme-genome-evaluates-rc0" as *u8, bg_eq(rc_ex, 0), ctr)
228 bg_extract(out, olen[0], "canon_path=" as *u8, pex, 4096)
229 var ex_same: i64 = 0 - 1
230 if bg_len(pex) > 0 { ex_same = bg_same(pex, canon_path) }
231
232 // ★★★THE ANTI-VACUITY PAIR. `bad` = the extreme genome DID change the canon; `good` = the identity
233 // genome did NOT. A transform that copies its input fails `bad`; a transform that corrupts every
234 // canon fails `good`. Only a real decoder satisfies both, and gv_bite PRINTS which half failed so a
235 // vacuous pass is SEEN rather than counted.
236 var bad_fires: i64 = 0
237 if ex_same == 0 { bad_fires = 1 }
238 var good_quiet: i64 = 1
239 if id_same == 1 { good_quiet = 0 }
240 gv_bite("neg-control-transform-is-not-a-copy" as *u8, bad_fires, good_quiet, ctr)
241
242 // ---- REFUSAL: a genome that does not describe the canon must be REFUSED, not silently truncated ----
243 // ★A DECODER THAT SCALED THE FIRST 3 PARTS AND LEFT 13 AT 1.0 WOULD STILL RENDER AND STILL SCORE.
244 // The wrong-arity case has no failure mode downstream, so the refusal is the only thing that catches it.
245 let rc_short: i64 = bg_run_canon(subj, BG_MIDGENE, 3, out, olen)
246 // ★"NON-ZERO" IS SATISFIED BY ANY BROKEN BINARY -- the wrong-subject RED run passed this tooth while
247 // failing eight others, which means it was measuring "something went wrong" rather than "the organ
248 // refused for THIS reason". Assert the SPECIFIC refusal code (3 = conf/contract refusal) so a crash,
249 // a usage error and a deliberate refusal stop being the same observation.
250 gv_check("neg-control-gene-count-mismatch-REFUSES" as *u8, bg_eq(rc_short, 3), ctr)
251 gv_check("neg-control-refusal-names-the-mismatch" as *u8, bg_ge0(bg_find(out, olen[0], "one gene per part" as *u8)), ctr)
252
253 sys_exit(gv_verdict("BODYFIT-CANON-GATE" as *u8, ctr, "canon decoder identity + non-copy + arity refusal" as *u8))
254 return 0
255}