nx_build_govern.nx source

1// nx_build_govern.nx -- R-LIVE-1: first LIVE adoption of backend-build governance. Unlike the hermetic 2// gates, this runs against the REAL tree: it (1) registers the organs WE built this session into a 3// PERSISTENT build-registry (knowledge/registry/build_registry.log, the Librarian SSOT; additive framed 4// store, idempotent via latest-wins), and (2) runs a REAL bypass census of runtime/_hdl_build -- total 5// nx_*.nx organs vs how many are registered -> the honest MIGRATION SURFACE (the unregistered ones, exactly 6// like the Publisher's "real bypassers" finding). Reuses br_* from nx_build_registry_lib. 7// Verdict GREEN iff the session organs registered (distinct >= the count we submitted). license_tier: ORIGINAL expect_exit: 0 8import "nx_build_reg_sov.nx" 9import "nx_syscalls.nx" 10const K_MAGIC_8192: i64 = 8192 11const K_MAGIC_65536: i64 = 65536 12 13func gp(s: *u8) -> i64 { let n: i64 = br2_len(s); sys_write(1, s, n); return 0 } 14func gpn(v: i64) -> i64 { 15 let bb: *u8 = sys_mmap(28); var m: i64 = v 16 if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m } 17 let t: *u8 = sys_mmap(28); var k: i64 = 0 18 if m == 0 { t[0] = 48 as u8; k = 1 } 19 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 20 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } 21 sys_write(1, bb, k); return 0 22} 23func gv_getdents(fd: i64, buf: *u8, count: i64) -> i64 { return __syscall(217, fd, buf, count, 0, 0, 0) } 24// starts with "nx_" and ends ".nx" 25func gv_isorgan(name: *u8) -> i64 { 26 if name[0] != (110 as u8) { return 0 } // n 27 if name[1] != (120 as u8) { return 0 } // x 28 if name[2] != (95 as u8) { return 0 } // _ 29 let n: i64 = br2_len(name) 30 if n < 4 { return 0 } 31 if name[n - 3] != (46 as u8) { return 0 } // . 32 if name[n - 2] != (110 as u8) { return 0 } // n 33 if name[n - 1] != (120 as u8) { return 0 } // x 34 return 1 35} 36func in_set(name: *u8, names: *i64, cnt: i64) -> i64 { var k: i64 = 0; while k < cnt { if br2_streq(name, names[k] as *u8) == 1 { return 1 } k = k + 1 } return 0 } 37 38func main() -> i64 { 39 gp("=== nx_build_govern: R-LIVE-1 live adoption (real registry + real bypass census) ===\n" as *u8) 40 let reg: *u8 = "knowledge/store/build_registry" as *u8 41 42 // (1) register the organs WE built this session (idempotent; basename WITH .nx to match the disk walk). 43 br2_submit(reg, "nx_ws_active_board.nx" as *u8, "WMS" as *u8, "BUILT" as *u8) 44 br2_submit(reg, "nx_chaos_logistic_gate.nx" as *u8, "SIM" as *u8, "BUILT" as *u8) 45 br2_submit(reg, "nx_dpendulum_gate.nx" as *u8, "SIM" as *u8, "BUILT" as *u8) 46 br2_submit(reg, "nx_build_gov_census.nx" as *u8, "GOV-PM" as *u8, "BUILT" as *u8) 47 br2_submit(reg, "nx_build_reg_sov.nx" as *u8, "GOV-LIB" as *u8, "BUILT" as *u8) 48 br2_submit(reg, "nx_build_reg_sov_gate.nx" as *u8, "GOV-PM" as *u8, "BUILT" as *u8) 49 br2_submit(reg, "nx_build_bypass_gate.nx" as *u8, "GOV-PM" as *u8, "BUILT" as *u8) 50 br2_submit(reg, "nx_build_role_gate.nx" as *u8, "GOV-PM" as *u8, "BUILT" as *u8) 51 br2_submit(reg, "nx_build_govern.nx" as *u8, "GOV-PM" as *u8, "BUILT" as *u8) 52 br2_submit(reg, "nx_build_lineage_gate.nx" as *u8, "GOV-PM" as *u8, "BUILT" as *u8) 53 br2_submit(reg, "nx_build_nobypass_gate.nx" as *u8, "GOV-PM" as *u8, "BUILT" as *u8) 54 br2_submit(reg, "nx_build_rooted_gate.nx" as *u8, "GOV-PM" as *u8, "BUILT" as *u8) 55 br2_submit(reg, "nx_build_imports_gate.nx" as *u8, "GOV-PM" as *u8, "BUILT" as *u8) 56 br2_submit(reg, "nx_build_autoroot_gate.nx" as *u8, "GOV-PM" as *u8, "BUILT" as *u8) 57 br2_submit(reg, "nx_build_evidence_gate.nx" as *u8, "GOV-PM" as *u8, "BUILT" as *u8) 58 br2_submit(reg, "nx_genealogy_tree.nx" as *u8, "GOV-LIB" as *u8, "BUILT" as *u8) 59 br2_submit(reg, "nx_cap_gap_sov.nx" as *u8, "GOV-PM" as *u8, "BUILT" as *u8) 60 let submitted: i64 = 17 61 62 let d: i64 = br2_distinct(reg) 63 gp(" registered " as *u8); gpn(submitted); gp(" session organs -> distinct in registry = " as *u8); gpn(d) 64 gp(" (persistent: sovereign seg_store knowledge/store/build_registry)\n" as *u8) 65 66 // (2) REAL bypass census of runtime/_hdl_build 67 let dir: *u8 = "runtime/_hdl_build" as *u8 68 let regnames: *i64 = sys_mmap(8 * K_MAGIC_8192) as *i64 69 let regpars: *i64 = sys_mmap(8 * K_MAGIC_8192) as *i64 70 let regn: i64 = br2_enum(reg, regnames, regpars, K_MAGIC_8192) 71 let fd: i64 = sys_openat_rd(dir) 72 var total: i64 = 0 73 var registered: i64 = 0 74 if fd >= 0 { 75 let gbuf: *u8 = sys_mmap(K_MAGIC_65536) 76 var nread: i64 = gv_getdents(fd, gbuf, K_MAGIC_65536) 77 while nread > 0 { 78 var off: i64 = 0 79 while off < nread { 80 let reclen: i64 = (gbuf[off + 16] as i64) | ((gbuf[off + 17] as i64) << 8) 81 if reclen <= 0 { off = nread } else { 82 let name: *u8 = ((gbuf as i64) + off + 19) as *u8 83 if gv_isorgan(name) == 1 { 84 total = total + 1 85 if in_set(name, regnames, regn) == 1 { registered = registered + 1 } 86 } 87 off = off + reclen 88 } 89 } 90 nread = gv_getdents(fd, gbuf, K_MAGIC_65536) 91 } 92 sys_close(fd) 93 } 94 let bypass: i64 = total - registered 95 gp(" runtime/_hdl_build census: total nx organs=" as *u8); gpn(total) 96 gp(" registered=" as *u8); gpn(registered) 97 gp(" BYPASS(unregistered)=" as *u8); gpn(bypass); gp("\n" as *u8) 98 gp(" -> bypass = the honest migration surface; live adoption = each organ's build calls br_submit (coordinated, additive).\n" as *u8) 99 100 gp(" verdict=" as *u8) 101 if d >= submitted { gp("GREEN (session organs are now registered in the live SSOT)\n" as *u8); sys_exit(0); return 0 } 102 gp("RED (registration did not persist)\n" as *u8) 103 sys_exit(1); return 1 104}