code wiki / _hdl_build / nx_build_admit_gate.nx
nx_build_admit_gate.nx source
↩ module page · 180 lines · 9047 B
1// nx_build_admit_gate.nx -- proves the build-admission verdict ADMITS and REFUSES for the right reason.
2//
3// THE DEFECT THIS GATE EXISTS FOR (measured 2026-07-30): nx_build_admit gated a CPU-bound compile on
4// /proc/loadavg field 1, which on Linux counts tasks in R *and* D state. On this host the OS itself split
5// a load1 of 8.33 into IO=3.75 / CPU=4.58 across 8 cores -- 43% of the CPU idle -- and the build was
6// REFUSED. nx_procchurn agreed independently (procs_blocked>=1 with procs_running 3-6: "I/O or lock bound,
7// NOT compute; more CPU would not help"). Every seat's builds were refused on DISK WAIT, and because the
8// fix for the churn is itself a build, the ecosystem could not repair itself through the mgmt API path.
9//
10// THE FIX: a QUEUE verdict must be CONFIRMED by procs_running from /proc/stat -- the TRUE run queue (R
11// only, D excluded). It can only ever admit MORE builds, never fewer, and only when the run queue itself
12// says the CPUs are free. The memory floor remains the ONE unconditional block: it is the measured
13// 2026-07-20 wedge cause, where userspace could not fork at all.
14//
15// WHY THE POLICY IS MIRRORED RATHER THAN IMPORTED: nx_build_admit.nx carries its own main(), so importing
16// it here would collide. The policy is therefore mirrored, and T9 MECHANICALLY TIES THE MIRROR TO THE REAL
17// SOURCE so silent drift FAILS this gate instead of rotting quietly (the anti-dup-source discipline).
18//
19// T8 is the liar-killer: it replays the ORIGINAL loadavg-only policy against the EXACT case the fix was
20// written for and REQUIRES it to refuse. T2 and T8 are the same inputs through the new and old policies:
21// if the fix is ever reverted, T2 fails; if T8 ever stops refusing, this gate is not testing the defect.
22// A gate that cannot demonstrate it catches its own bug is decoration.
23// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
24import "nx_syscalls.nx"
25
26const BG_SRC: *u8 = "runtime/_hdl_build/nx_build_admit.nx"
27const BG_LOG: *u8 = "knowledge/status/build_admit_gate.log"
28const BG_CAP: i64 = 2097152
29const BG_MODE: i64 = 420
30// Exit codes mirrored from nx_build_admit.nx; T9 ties them back to the real source.
31const BG_GRANT: i64 = 0
32const BG_DENY: i64 = 3
33const BG_QUEUE: i64 = 4
34
35func bg_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
36func bg_w(fd: i64, s: *u8) -> i64 { let n: i64 = bg_len(s); sys_write(fd, s, n); return 0 }
37func bg_p(s: *u8) -> i64 { return bg_w(1, s) }
38func bg_pn(v: i64) -> i64 {
39 let t: *u8 = sys_mmap(32)
40 var m: i64 = v
41 if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m }
42 var k: i64 = 0
43 if m == 0 { t[0] = 48 as u8; k = 1 }
44 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
45 let o: *u8 = sys_mmap(32)
46 var i: i64 = 0
47 while i < k { o[i] = t[k-1-i]; i = i + 1 }
48 sys_write(1, o, k)
49 return 0
50}
51func bg_ck(name: *u8, c: i64) -> i64 {
52 if c == 1 { bg_p(" PASS " as *u8) } else { bg_p(" FAIL " as *u8) }
53 bg_p(name); bg_p("\n" as *u8)
54 return c
55}
56
57// MIRROR of nx_build_admit.nx ba_verdict -- T9 asserts the real file still agrees with this.
58func bg_verdict(avail_mb: i64, floor_mb: i64, load1: i64, max_load: i64, procs_run: i64, ncpu: i64) -> i64 {
59 if avail_mb < floor_mb { return BG_DENY }
60 if load1 <= max_load { return BG_GRANT }
61 if procs_run >= 0 { if procs_run < ncpu { return BG_GRANT } }
62 return BG_QUEUE
63}
64// The ORIGINAL pre-fix policy (loadavg only, no run-queue confirmation), kept ONLY so T8 can prove that
65// this gate detects the defect it was written for.
66func bg_verdict_old(avail_mb: i64, floor_mb: i64, load1: i64, max_load: i64) -> i64 {
67 if avail_mb < floor_mb { return BG_DENY }
68 if load1 > max_load { return BG_QUEUE }
69 return BG_GRANT
70}
71
72func bg_read(path: *u8, buf: *u8) -> i64 {
73 let fd: i64 = sys_openat_rd(path)
74 if fd < 0 { return 0 - 1 }
75 var tot: i64 = 0
76 var go: i64 = 1
77 while go == 1 {
78 let rem: i64 = BG_CAP - tot
79 if rem <= 0 { go = 0 }
80 if go == 1 {
81 let q: *u8 = buf + tot
82 let r: i64 = sys_read(fd, q, rem)
83 if r <= 0 { go = 0 }
84 if r > 0 { tot = tot + r }
85 }
86 }
87 sys_close(fd)
88 return tot
89}
90func bg_find(buf: *u8, n: i64, pat: *u8) -> i64 {
91 let pl: i64 = bg_len(pat)
92 if pl <= 0 { return 0 }
93 var i: i64 = 0
94 while i + pl <= n {
95 var k: i64 = 0
96 var hit: i64 = 1
97 while k < pl { if buf[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } }
98 if hit == 1 { return 1 }
99 i = i + 1
100 }
101 return 0
102}
103
104func main() -> i64 {
105 bg_p("=== nx_build_admit_gate -- does admission refuse for CPU saturation and NOT for disk wait? ===\n" as *u8)
106 var pass: i64 = 0
107 var total: i64 = 0
108
109 // T1 healthy: load under the ceiling admits regardless of anything else.
110 var t1: i64 = 0
111 if bg_verdict(28302, 512, 400, 800, 3, 8) == BG_GRANT { t1 = 1 }
112 pass = pass + bg_ck("T1 load under ceiling -> GRANT (healthy host still builds)" as *u8, t1); total = total + 1
113
114 // T2 THE FIX, with the REAL measured numbers from the false refusal: load1 8.33 (833 centi) over an
115 // 800 ceiling, but a run queue of 4 on 8 cores. The load was disk wait; the CPUs were half idle.
116 var t2: i64 = 0
117 if bg_verdict(28302, 512, 833, 800, 4, 8) == BG_GRANT { t2 = 1 }
118 pass = pass + bg_ck("T2 load OVER ceiling but run queue 4/8 (I/O-driven) -> GRANT (the fix)" as *u8, t2); total = total + 1
119
120 // T3 the refuse arm, also with real measured numbers: load1 14.58 with procs_running 17 on 8 cores.
121 var t3: i64 = 0
122 if bg_verdict(28035, 512, 1458, 800, 17, 8) == BG_QUEUE { t3 = 1 }
123 pass = pass + bg_ck("T3 load OVER ceiling AND run queue 17/8 -> QUEUE (real saturation still refused)" as *u8, t3); total = total + 1
124
125 // T4 ORDERING: the memory floor outranks everything -- a short run queue must NOT admit below it.
126 var t4: i64 = 0
127 if bg_verdict(100, 512, 100, 800, 1, 8) == BG_DENY { t4 = 1 }
128 pass = pass + bg_ck("T4 below the memory floor -> DENY even with an idle run queue (floor outranks)" as *u8, t4); total = total + 1
129
130 // T5 FAIL-CLOSED: an unreadable /proc/stat yields procs_run = -1 and must NOT unlock the gate.
131 var t5: i64 = 0
132 if bg_verdict(28302, 512, 833, 800, 0 - 1, 8) == BG_QUEUE { t5 = 1 }
133 pass = pass + bg_ck("T5 run-queue sensor unreadable (-1) -> QUEUE (fail-closed, never fail-open)" as *u8, t5); total = total + 1
134
135 // T6 BOUNDARY: procs_running exactly == ncpu is saturation (the test is >=, not >).
136 var t6: i64 = 0
137 if bg_verdict(28302, 512, 833, 800, 8, 8) == BG_QUEUE { t6 = 1 }
138 pass = pass + bg_ck("T6 boundary procs_running == ncpu -> QUEUE (saturation is >=)" as *u8, t6); total = total + 1
139
140 // T7 BOUNDARY: load exactly AT the ceiling is not ABOVE it, so it admits.
141 var t7: i64 = 0
142 if bg_verdict(28302, 512, 800, 800, 99, 8) == BG_GRANT { t7 = 1 }
143 pass = pass + bg_ck("T7 boundary load1 == max_centiload -> GRANT (ceiling is >, not >=)" as *u8, t7); total = total + 1
144
145 // T8 LIAR-KILLER / NEG-CONTROL: the OLD loadavg-only policy, given T2's exact inputs, must REFUSE.
146 // Same inputs, both policies: this is the mutation proof that T2 measures a real change.
147 var t8: i64 = 0
148 if bg_verdict_old(28302, 512, 833, 800) == BG_QUEUE { t8 = 1 }
149 pass = pass + bg_ck("T8 NEG-CONTROL: old loadavg-only policy REFUSES T2's inputs (proves the bug was real)" as *u8, t8); total = total + 1
150
151 // T9 SOURCE CONSISTENCY: tie this mirror to the real detector. Drift is RED, not rot.
152 let buf: *u8 = sys_mmap(BG_CAP)
153 let n: i64 = bg_read(BG_SRC, buf)
154 var t9: i64 = 0
155 if n > 0 {
156 var ok: i64 = 1
157 if bg_find(buf, n, "ba_verdict" as *u8) == 0 { ok = 0 }
158 if bg_find(buf, n, "procs_running" as *u8) == 0 { ok = 0 }
159 if bg_find(buf, n, "BA_PROCSRUN_OFF" as *u8) == 0 { ok = 0 }
160 if bg_find(buf, n, "procs_run < ncpu" as *u8) == 0 { ok = 0 }
161 t9 = ok
162 }
163 pass = pass + bg_ck("T9 nx_build_admit.nx still carries ba_verdict + procs_running + the run-queue confirm" as *u8, t9); total = total + 1
164
165 // T10 NEG-CONTROL on the scanner itself -- a string that must NOT be found.
166 var t10: i64 = 0
167 if n > 0 { if bg_find(buf, n, "zzz_not_in_build_admit_zzz" as *u8) == 0 { t10 = 1 } }
168 pass = pass + bg_ck("T10 NEG-CONTROL: source scanner does not report an absent string" as *u8, t10); total = total + 1
169
170 bg_p("---- nx_build_admit_gate " as *u8); bg_pn(pass); bg_p(" / " as *u8); bg_pn(total); bg_p(" ----\n" as *u8)
171 if pass == total {
172 let lg: i64 = sys_openat_append(BG_LOG, BG_MODE)
173 if lg >= 0 { bg_w(lg, "NX-BUILD-ADMIT verdict=GREEN run-queue confirmation admits I/O-driven load and still refuses real CPU saturation\n" as *u8); sys_close(lg) }
174 bg_p("verdict=GREEN (admission now refuses for CPU saturation, not for disk wait)\n" as *u8)
175 return 0
176 }
177 bg_p("verdict=RED\n" as *u8)
178 sys_exit(1)
179 return 1
180}