nx_build_gate.nx source

1// nx_build_gate.nx -- the team's BUILD-CAPABILITY GATE: honestly know what it CAN and CANNOT build with 2// the toolchain it has, and route the gap (operator: "have the nishi team build it, and if they cant, 3// build the nishi team's capabilities to build it" -- step 0 of that is the team KNOWING it can't, and 4// why). Diagnosed real gap: the file-based TLS daemon needs the server-side TLS-1.3 crypto, which uses 5// the G2 wide-multiply intrinsic __umulhi64; the deployed nx_cc_known_good.elf is PRE-G2 and rejects it 6// ('unhandled __ intrinsic: __umulhi64'). So the daemon is NOT directly buildable. 7// Compiler feature levels: BASE (pre-G2, no __umulhi64) < G2 (knows __umulhi64, needed for x25519 field 8// math). A target needing G2 is BUILDABLE only on a G2 compiler; otherwise NEEDS_BOOTSTRAP (if a G2 9// compiler's source is in the repo AND that source does not itself require G2 -- no chicken-and-egg) or 10// BLOCKED. And bootstrapping+trusting a fresh compiler carries the team's hard-won MISCOMPILE risk, so a 11// pinned/known-good build env is preferred. license_tier: ORIGINAL Pairs with nx_auditor + the Engineer. 12 13import "nx_syscalls.nx" 14 15const BG_FEAT_BASE: i64 = 0 // pre-G2 known-good compiler 16const BG_FEAT_G2: i64 = 1 // knows __umulhi64 (wide multiply) -- required by the TLS crypto 17 18const BG_BLOCKED: i64 = 0 // cannot build with what we have, and cannot bootstrap 19const BG_NEEDS_BOOTSTRAP: i64 = 1 // not directly buildable, but a G2 compiler is bootstrappable 20const BG_BUILDABLE: i64 = 2 // directly buildable with the available compiler 21 22// directly buildable iff the available compiler's feature level meets the target's requirement. 23func bg_directly_buildable(target_needs: i64, available_has: i64) -> i64 { if available_has >= target_needs { return 1 } return 0 } 24 25// bootstrappable iff the higher compiler's source is in the repo AND it does NOT itself require the 26// higher feature (no chicken-and-egg: the available compiler must be able to build the new one). 27func bg_bootstrappable(higher_source_in_repo: i64, higher_source_self_needs_higher: i64) -> i64 { 28 if higher_source_in_repo != 1 { return 0 } 29 if higher_source_self_needs_higher == 1 { return 0 } 30 return 1 31} 32 33// the verdict. 34func bg_verdict(target_needs: i64, available_has: i64, bootstrappable: i64) -> i64 { 35 if bg_directly_buildable(target_needs, available_has) == 1 { return BG_BUILDABLE } 36 if bootstrappable == 1 { return BG_NEEDS_BOOTSTRAP } 37 return BG_BLOCKED 38} 39 40// bootstrapping a fresh compiler to build production carries miscompile risk -> prefer the known-good build env. 41func bg_carries_miscompile_risk(verdict: i64) -> i64 { if verdict == BG_NEEDS_BOOTSTRAP { return 1 } return 0 } 42 43// the recommended unblock when not directly buildable: use the pinned BUILD ENV (the container that has 44// the G2 compiler + the source), rather than bootstrap-and-pray on the live family site. 45const BG_ROUTE_NONE: i64 = 0 46const BG_ROUTE_BUILD_ENV: i64 = 1 // get access to the build container (G2 compiler + source) -- low risk 47const BG_ROUTE_BOOTSTRAP: i64 = 2 // bootstrap a G2 compiler here -- higher risk 48func bg_route(verdict: i64, build_env_reachable: i64) -> i64 { 49 if verdict == BG_BUILDABLE { return BG_ROUTE_NONE } 50 if build_env_reachable == 1 { return BG_ROUTE_BUILD_ENV } 51 return BG_ROUTE_BOOTSTRAP 52}