nx_buildpath_gate.nx source
↩ module page · 120 lines · 7138 B
1// nx_buildpath_gate.nx -- PROVES nx_buildpath_lib AGREES WITH THE BUILDER THAT ACTUALLY RAN.
2//
3// WHY THIS GATE IS THE POINT OF THE LIB. Extracting the resolver removes 15 hand-rolled copies, but it
4// creates a NEW risk: one more place that BELIEVES it knows where nx_sov_build_run writes. A second
5// copy of a fact is only safe if something FAILS when the two disagree -- otherwise this lib becomes
6// the sixteenth stale copy, and the most authoritative one.
7// *TWO GUARDS FOR ONE INVARIANT IS THE DUPLICATE-RULER DEFECT UNLESS ONE OF THEM IS PROVEN
8// AGAINST THE OTHER ON EVERY RUN.
9//
10// THE BINDING TOOTH COSTS NOTHING AND CANNOT BE FAKED: this gate is itself a build target, so the
11// runner wrote _build/nx_buildpath_gate.sov.elf in order to execute the very process asking the
12// question. Its own artifact IS the builder's answer. No fork, no fixture, no timeout risk -- and if
13// the builder ever moves its output, THIS GATE GOES RED FIRST, which is exactly the alarm the estate
14// did not have when nx_drift_watch drifted for 32h while reporting GREEN.
15//
16// gv_need guards it honestly: run this gate from somewhere the artifact is not, and it SKIPs rather
17// than reporting RED about an environment rather than about the code (the third-state law).
18//
19// BITE-PROVEN 2026-08-16 with three mutants, each killing exactly one tooth and no other:
20// drop-primary-probe-restore -> T4 FAIL | outcap-guard-never-fires -> T2 FAIL |
21// collapse-legacy-into-success -> T6 FAIL. Restored -> 7/7 GREEN.
22// license_tier: ORIGINAL expect_exit: 0 No hw writes (Rule 26).
23import "nx_gate_verdict.nx"
24import "nx_buildpath_lib.nx"
25import "nx_syscalls.nx"
26
27// This gate's own module name -- the one target we KNOW the builder just produced.
28func bg_self() -> *u8 { return "nx_buildpath_gate" as *u8 }
29// A name no build can ever have produced; used as the negative control.
30func bg_absent() -> *u8 { return "nx_buildpath_gate_absent_negative_control" as *u8 }
31// A distinct name for the legacy-root fixture, so it can never collide with a real artifact.
32func bg_tmpfix() -> *u8 { return "nx_buildpath_gate_legacyfixture" as *u8 }
33
34func bg_starts(s: *u8, pre: *u8) -> i64 {
35 var i: i64 = 0
36 while pre[i] != (0 as u8) {
37 if s[i] != pre[i] { return 0 }
38 i = i + 1
39 }
40 return 1
41}
42
43func main() -> i64 {
44 let ctr: *i64 = gv_ctr()
45 gv_head("nx_buildpath_gate -- the extracted build-artifact resolver agrees with the builder that ran" as *u8)
46
47 let selfn: *u8 = bg_self()
48 let cap: i64 = bp_needed(selfn) + bp_needed(bg_absent()) + bp_needed(bg_tmpfix())
49 let out: *u8 = sys_mmap(cap)
50
51 // T1 -- bp_needed is EXACT, not generous. The longest root fills it to exactly cap-1 plus NUL, so
52 // a caller sizing from bp_needed can neither truncate nor over-allocate on a guess.
53 let want: i64 = bp_needed(selfn)
54 let wrote: i64 = bp_compose(bp_root_buildroot(), selfn, out)
55 gv_check("T1 bp_needed is EXACT for the longest root (no guessed ceiling)" as *u8,
56 (wrote == want - 1) as i64, ctr)
57
58 // T2 -- neg-control: an undersized buffer must REFUSE, never truncate a path. A resolver that
59 // truncates hands back a path that resolves to the wrong file or to nothing, silently.
60 let too_small: i64 = bp_artifact(selfn, out, want - 1)
61 gv_check("T2 neg-control-undersized-buffer-REFUSES-rather-than-truncating" as *u8,
62 (too_small == BP_OUTCAP_TOO_SMALL) as i64, ctr)
63
64 // T3 -- neg-control: a name nothing ever built must be NOT FOUND. Without this a resolver that
65 // returned "found" for everything would pass every other tooth here.
66 let absent: i64 = bp_artifact(bg_absent(), out, cap)
67 gv_check("T3 neg-control-never-built-name-resolves-to-NOTFOUND" as *u8,
68 (absent == BP_NOTFOUND) as i64, ctr)
69
70 // T4 -- on failure `out` must name the PRIMARY probe, not whichever root was tried last. A guard
71 // whose failure message names the legacy path sends the next reader to the wrong place -- which is
72 // how this whole class stayed hidden across three lanes.
73 gv_check("T4 failure path NAMES the primary probe (_build/), not the legacy root" as *u8,
74 bg_starts(out, bp_root_build()), ctr)
75
76 // ---- T5: THE BINDING TOOTH. The builder wrote this gate's own artifact to run it. ----
77 // PRECONDITION, honestly declared: if this process was not launched from its build root, the
78 // artifact is legitimately elsewhere and the gate must SKIP, not accuse the code.
79 let selfcode: i64 = bp_artifact(selfn, out, cap)
80 var seen: i64 = 0
81 if selfcode == BP_AT_BUILD { seen = 1 }
82 if selfcode == BP_AT_BUILDROOT { seen = 1 }
83 if selfcode == BP_AT_TMP { seen = 1 }
84 if gv_need("this gate's own build artifact is reachable from the run directory" as *u8, seen, ctr) == 1 {
85 // The builder has not written /tmp since 2026-07-30, so resolving our OWN artifact via the
86 // legacy root would mean the lib and the builder disagree -- the exact drift this gate exists
87 // to catch. Anything but a legacy resolve is agreement.
88 var agrees: i64 = 0
89 if selfcode == BP_AT_BUILD { agrees = 1 }
90 if selfcode == BP_AT_BUILDROOT { agrees = 1 }
91 gv_check("T5 the resolver finds THIS GATE'S OWN artifact where the builder actually wrote it" as *u8,
92 agrees, ctr)
93 }
94
95 // ---- T6: the legacy root is a DISTINCT state, not folded into success. ----
96 // Fixture assembled AT RUNTIME under a name no real target can have, then removed. A gate that
97 // shares a fixture with a production path measures the production path.
98 bp_compose(bp_root_tmp(), bg_tmpfix(), out)
99 let fd: i64 = sys_openat_wr(out, MODE_0644)
100 var planted: i64 = 0
101 if fd >= 0 { sys_write(fd, "x" as *u8, 1); sys_close(fd); planted = 1 }
102 if gv_need("the legacy-root fixture could be created under /tmp" as *u8, planted, ctr) == 1 {
103 let legacy: i64 = bp_artifact(bg_tmpfix(), out, cap)
104 // BOTH SIGNALS AT ONCE: it must resolve (so the legacy root is still probed at all) AND it must
105 // report BP_AT_TMP specifically. Testing only "did it resolve" cannot tell the third state from
106 // a healthy one, and that collapse is what made the original defect invisible.
107 gv_check("T6 an artifact present ONLY in legacy /tmp reports BP_AT_TMP, distinct from success" as *u8,
108 (legacy == BP_AT_TMP) as i64, ctr)
109 bp_compose(bp_root_tmp(), bg_tmpfix(), out)
110 sys_unlinkat(out)
111 // The restore is part of the experiment, not its cleanup: a fixture left behind would make the
112 // next run resolve a name that no longer has a subject.
113 let gone: i64 = bp_artifact(bg_tmpfix(), out, cap)
114 gv_check("T6b the runtime fixture is REMOVED, so the next run cannot inherit it" as *u8,
115 (gone == BP_NOTFOUND) as i64, ctr)
116 }
117
118 return gv_verdict("BUILDPATH" as *u8, ctr,
119 "the extracted resolver resolves this gate's own artifact where the builder wrote it, refuses undersized buffers, and reports the legacy root as its own state" as *u8)
120}