nx_capcensus_gate.nx source
↩ module page · 272 lines · 14870 B
1// nx_capcensus_gate.nx -- THE GATE FOR THE PICKED-CAP CENSUS.
2//
3// Subject: ./nx_capcensus.elf (the serving-root binary; e2e fork via nx_gatekit_lib's PROVEN
4// capture primitive -- never a hand-rolled pipe/fork/wait, which deadlocked a sibling gate in
5// production TODAY: pid 2240 sat 50+ minutes in pipe_wait with a frozen 91-byte artifact).
6//
7// WHAT THIS PROVES, and why each tooth exists:
8// 1. the census DISCRIMINATES. A classifier that lumps every bound into one bucket is worthless,
9// so the fixture plants one of EACH class and the teeth assert the exact split. This is the
10// anti-vacuity tooth: a trivial "everything is PICKED" implementation CANNOT pass it.
11// 2. it does not FALSELY ACCUSE. A derived-only fixture must yield PICKED=0 -- bitten as a
12// neg-control pair (fires on the planted picked cap, silent on the derived one).
13// 3. it cannot pass on the EMPTY SET. An empty directory yields population=0, and the tooth
14// binds the population count IN its condition rather than printing it alongside.
15// 4. the RATCHET cannot launder itself. cg_rise / cg_newbase are PURE functions of (live, base),
16// so all three required directions are unit-provable and uncheatable by a live number:
17// - fires on a rise cg_rise(30,20)==1
18// - tightens on a fall cg_newbase(10,20)==10
19// - REFUSES to rewrite the baseline on a rise cg_newbase(30,20)==20
20// That third one is the self-laundering defect the estate has banked; it is the reason the
21// ratchet is expressed as a pure function instead of inline arithmetic at the call site.
22//
23// *** THE RATCHET GOVERNS PICKED CAPS ONLY -- NEVER A CAPABILITY AXIS. ***
24// Operator, 2026-08-23: "a worse score with higher capabilities isnt worse its part of iteration as
25// long as we have a roadmap to best of breed." A texture resolution raised 2048 -> 8192, a triangle
26// budget grown to carry real surface detail, or an arena that grew because the asset grew are all
27// CAPABILITY GROWTH and this ratchet must never be able to forbid them. It counts only bounds whose
28// subject size is knowable at runtime and was PICKED anyway. The tooth is named for that limit so a
29// future reader cannot mistake it for a capability ceiling -- which is exactly how the clay-figure
30// mistake was made once already today.
31//
32// NOT ROSTER-ADMITTED: the full census forks a recursive 18k-file walk (~60 s). The gate roster beat
33// kills at ~1,800 ms, so admitting this would manufacture a permanent timeout. Same precedent as the
34// voxchunk gate. Run it via nx_job_run or /api/gate_run with the fixture-only verbs.
35// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
36import "nx_syscalls.nx"
37import "nx_gate_verdict.nx"
38import "nx_gatekit_lib.nx"
39
40const CG_ELF: *u8 = "./nx_capcensus.elf"
41const CG_DIR: *u8 = "/tmp/nxcapgate"
42const CG_MIX: *u8 = "/tmp/nxcapgate/mix"
43const CG_DER: *u8 = "/tmp/nxcapgate/der"
44const CG_EMPTY: *u8 = "/tmp/nxcapgate/empty"
45const CG_BASECONF: *u8 = "knowledge/capcensus_ratchet.conf"
46// A capture WINDOW for the subject's stdout, drained by gk_run_capture; the summary prints last and
47// is small, and the worklist prefix is bounded by the subject itself.
48const CG_WIN: i64 = 262144
49// PROTECTIVE, named for its one purpose: the recursive census walks ~18k files, and a fork that
50// never returns must not hang the gate forever. Bounds genuinely unknowable runtime, and the rc is
51// reported rather than swallowed -- so a timeout ANNOUNCES instead of reading as a clean census.
52const CG_CENSUS_DEADLINE_MS: i64 = 600000
53// Scratch for composing the one-line generated baseline conf. Sized for the fixed text this organ
54// writes, not for input it reads -- the conf is READ with sys_read_file, which cannot short-read.
55const CG_CONF_SCRATCH: i64 = 4096
56
57// ---- the ratchet, as PURE functions of (live, base) -- unit-provable, uncheatable ---------------
58func cg_rise(live: i64, base: i64) -> i64 { if live > base { return 1 } return 0 }
59func cg_newbase(live: i64, base: i64) -> i64 { if live < base { return live } return base }
60
61func cg_num_after(b: *u8, n: i64, key: *u8) -> i64 {
62 let kl: i64 = gk_len(key)
63 var i: i64 = 0
64 var got: i64 = 0 - 1
65 while i + kl <= n {
66 if got < 0 {
67 var j: i64 = 0
68 var ok: i64 = 1
69 while j < kl { if b[i+j] != key[j] { ok = 0; j = kl } else { j = j + 1 } }
70 if ok == 1 {
71 var p: i64 = i + kl
72 var v: i64 = 0
73 var any: i64 = 0
74 var go: i64 = 1
75 while go == 1 {
76 if p >= n { go = 0 }
77 else {
78 let c: i64 = b[p]
79 if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); any = 1; p = p + 1 } else { go = 0 } }
80 else { go = 0 }
81 }
82 }
83 if any == 1 { got = v }
84 }
85 }
86 i = i + 1
87 }
88 return got
89}
90
91// ---- the LIVE ratchet: same pure functions, applied to the real estate-wide PICKED count --------
92// Separate verb because the full recursive census forks an ~18k-file walk (tens of seconds) and the
93// default gate run must stay inside a caller's deadline. Self-baselines on FIRST SIGHT so adopting
94// it is non-breaking by construction; tightens on a fall; REFUSES to rewrite on a rise.
95func cg_ratchet_live() -> i64 {
96 let buf: *u8 = sys_mmap(CG_WIN + 64)
97 let bl: *i64 = sys_mmap(8) as *i64
98 *bl = 0
99 let rc: i64 = gk_run_capture_ms(CG_ELF, "scan" as *u8, "buildroot/runtime" as *u8, 0 as *u8, 0 as *u8, CG_CENSUS_DEADLINE_MS, buf, CG_WIN, bl)
100 let n: i64 = *bl
101 let live: i64 = cg_num_after(buf, n, "PICKED=" as *u8)
102 let pop: i64 = cg_num_after(buf, n, "capacity_population=" as *u8)
103 let sum: i64 = cg_num_after(buf, n, "partition_sum=" as *u8)
104 gv_puts("NX-CAPCENSUS-RATCHET census rc=" as *u8); gv_num(rc)
105 gv_puts(" population=" as *u8); gv_num(pop)
106 gv_puts(" partition_sum=" as *u8); gv_num(sum)
107 gv_puts(" PICKED=" as *u8); gv_num(live); gv_puts("\n" as *u8)
108 if pop <= 0 { gv_puts("REFUSED: census examined nothing -- a zero-population run is never a pass\n" as *u8); return 3 }
109 if sum != pop { gv_puts("REFUSED: partition does not sum -- the census is not trustworthy\n" as *u8); return 3 }
110
111 // the baseline conf is read with sys_read_file: it sizes from the file and CANNOT short-read,
112 // so this organ does not reintroduce the one-sys_read defect its own census exists to find.
113 let blp: *i64 = sys_mmap(8) as *i64
114 *blp = 0
115 let rb: *u8 = sys_read_file(CG_BASECONF, blp)
116 let got: i64 = *blp
117 var base: i64 = 0 - 1
118 if got > 0 { base = cg_num_after(rb, got, "picked=" as *u8) }
119
120 if base < 0 {
121 gv_puts("SELF-BASELINED on first sight at picked=" as *u8); gv_num(live); gv_puts("\n" as *u8)
122 let wb: *u8 = sys_mmap(CG_CONF_SCRATCH)
123 var o: i64 = 0
124 o = gk_cat(wb, o, "// nx_capcensus ratchet baseline -- GENERATED, do not hand-edit.\n" as *u8)
125 o = gk_cat(wb, o, "// Governs PICKED CAPS ONLY. It must NEVER regulate a capability axis: a texture\n" as *u8)
126 o = gk_cat(wb, o, "// resolution raised, a triangle budget grown, or an arena sized up because the asset\n" as *u8)
127 o = gk_cat(wb, o, "// grew are capability GROWTH and are not counted here.\n" as *u8)
128 o = gk_cat(wb, o, "picked=" as *u8)
129 o = gk_catn(wb, o, live)
130 o = gk_cat(wb, o, "\n" as *u8)
131 wb[o] = 0 as u8
132 gk_write(CG_BASECONF, wb)
133 return 0
134 }
135
136 gv_puts(" baseline=" as *u8); gv_num(base)
137 gv_puts(" live=" as *u8); gv_num(live)
138 gv_puts(" rise=" as *u8); gv_num(cg_rise(live, base))
139 gv_puts(" newbase=" as *u8); gv_num(cg_newbase(live, base)); gv_puts("\n" as *u8)
140
141 if cg_rise(live, base) == 1 {
142 gv_puts("NX-CAPCENSUS-RATCHET verdict=RED picked caps ROSE " as *u8); gv_num(base)
143 gv_puts(" -> " as *u8); gv_num(live)
144 gv_puts(" -- baseline DELIBERATELY NOT rewritten (a ratchet that relaxes on a rise launders itself)\n" as *u8)
145 return 1
146 }
147 if cg_newbase(live, base) < base {
148 let wb2: *u8 = sys_mmap(CG_CONF_SCRATCH)
149 var o2: i64 = 0
150 o2 = gk_cat(wb2, o2, "// nx_capcensus ratchet baseline -- GENERATED, do not hand-edit.\n" as *u8)
151 o2 = gk_cat(wb2, o2, "// Governs PICKED CAPS ONLY -- never a capability axis.\n" as *u8)
152 o2 = gk_cat(wb2, o2, "picked=" as *u8)
153 o2 = gk_catn(wb2, o2, live)
154 o2 = gk_cat(wb2, o2, "\n" as *u8)
155 wb2[o2] = 0 as u8
156 gk_write(CG_BASECONF, wb2)
157 gv_puts("NX-CAPCENSUS-RATCHET verdict=GREEN TIGHTENED to " as *u8); gv_num(live); gv_puts("\n" as *u8)
158 return 0
159 }
160 gv_puts("NX-CAPCENSUS-RATCHET verdict=GREEN held at " as *u8); gv_num(base); gv_puts("\n" as *u8)
161 return 0
162}
163
164func main(argc: i64, argv: *i64) -> i64 {
165 if argc >= 2 {
166 let v0: *u8 = argv[1] as *u8
167 if gk_streq(v0, "ratchet" as *u8) == 1 { return cg_ratchet_live() }
168 }
169 let ctr: *i64 = gv_ctr()
170 gv_head("nx_capcensus_gate -- a capacity bound is DERIVED or PICKED, and the ratchet cannot launder itself" as *u8)
171
172 // ---- SETUP: fixtures in /tmp/<gate>/ (a teardown does not run when a run crashes) -----------
173 gk_mkdir(CG_DIR)
174 gk_mkdir(CG_MIX)
175 gk_mkdir(CG_DER)
176 gk_mkdir(CG_EMPTY)
177 // one of EACH class, so a lumping classifier cannot pass
178 gk_write("/tmp/nxcapgate/mix/a_picked.nx" as *u8, "const P_CAP: i64 = 65536\n" as *u8)
179 gk_write("/tmp/nxcapgate/mix/b_derived.nx" as *u8, "const D_CAP: i64 = in_size * 2\n" as *u8)
180 gk_write("/tmp/nxcapgate/mix/c_struct.nx" as *u8, "const SYS_MAX_FD: i64 = 12\n" as *u8)
181 gk_write("/tmp/nxcapgate/mix/d_autohoist.nx" as *u8, "const K_MAGIC_4096: i64 = 4096\n" as *u8)
182 // derived-only: the SILENT half of the neg-control pair
183 gk_write("/tmp/nxcapgate/der/only_derived.nx" as *u8, "const Q_CAP: i64 = hdr_count * 8\n" as *u8)
184
185 let buf: *u8 = sys_mmap(CG_WIN + 64)
186 let bl: *i64 = sys_mmap(8) as *i64
187
188 // ---- T1 the subject runs at all, and its own selftest passes -------------------------------
189 *bl = 0
190 let rc1: i64 = gk_run_capture(CG_ELF, "selftest" as *u8, 0 as *u8, 0 as *u8, 0 as *u8, buf, CG_WIN, bl)
191 let n1: i64 = *bl
192 var t1: i64 = 0
193 if rc1 == 0 { if gk_has(buf, "NX-CAPCENSUS selftest PASS" as *u8) == 1 { t1 = 1 } }
194 gv_puts(" [T1] selftest rc=" as *u8); gv_num(rc1); gv_puts(" bytes=" as *u8); gv_num(n1); gv_puts("\n" as *u8)
195 gv_check("subject-runs-and-its-own-selftest-passes (127 = elf absent, the stale-offc tell)" as *u8, t1, ctr)
196
197 // ---- T2..T6 the mixed fixture: EXACT discrimination ----------------------------------------
198 *bl = 0
199 let rc2: i64 = gk_run_capture(CG_ELF, "scan" as *u8, CG_MIX, 0 as *u8, 0 as *u8, buf, CG_WIN, bl)
200 let n2: i64 = *bl
201 let m_pop: i64 = cg_num_after(buf, n2, "capacity_population=" as *u8)
202 let m_pick: i64 = cg_num_after(buf, n2, "PICKED=" as *u8)
203 let m_der: i64 = cg_num_after(buf, n2, "DERIVED=" as *u8)
204 let m_str: i64 = cg_num_after(buf, n2, "STRUCTURAL=" as *u8)
205 let m_ah: i64 = cg_num_after(buf, n2, "picked_autohoist=" as *u8)
206 let m_sum: i64 = cg_num_after(buf, n2, "partition_sum=" as *u8)
207 gv_puts(" [T2] mix pop=" as *u8); gv_num(m_pop)
208 gv_puts(" picked=" as *u8); gv_num(m_pick)
209 gv_puts(" derived=" as *u8); gv_num(m_der)
210 gv_puts(" structural=" as *u8); gv_num(m_str)
211 gv_puts(" autohoist=" as *u8); gv_num(m_ah)
212 gv_puts(" sum=" as *u8); gv_num(m_sum); gv_puts("\n" as *u8)
213
214 var t2: i64 = 0
215 if m_pop == 4 { t2 = 1 }
216 gv_check("fixture-reached-the-condition (all four planted bounds were seen, count bound IN the condition)" as *u8, t2, ctr)
217
218 var t3: i64 = 0
219 if m_pick == 2 { if m_der == 1 { if m_str == 1 { t3 = 1 } } }
220 gv_check("anti-vacuity-classes-are-DISCRIMINATED (a lumping classifier cannot pass: picked=2 derived=1 structural=1)" as *u8, t3, ctr)
221
222 var t4: i64 = 0
223 if m_ah == 1 { t4 = 1 }
224 gv_check("autohoisted-name-that-encodes-its-own-value-is-caught (K_MAGIC_4096)" as *u8, t4, ctr)
225
226 var t5: i64 = 0
227 if m_sum == m_pop { if m_pop > 0 { t5 = 1 } }
228 gv_check("partition-SUMS-to-the-population-and-the-population-is-non-empty" as *u8, t5, ctr)
229
230 // ---- neg-control PAIR: fires on the planted picked cap, SILENT on derived-only --------------
231 *bl = 0
232 gk_run_capture(CG_ELF, "scan" as *u8, CG_DER, 0 as *u8, 0 as *u8, buf, CG_WIN, bl)
233 let n3: i64 = *bl
234 let d_pick: i64 = cg_num_after(buf, n3, "PICKED=" as *u8)
235 let d_pop: i64 = cg_num_after(buf, n3, "capacity_population=" as *u8)
236 gv_puts(" [neg] derived-only pop=" as *u8); gv_num(d_pop)
237 gv_puts(" picked=" as *u8); gv_num(d_pick); gv_puts("\n" as *u8)
238 var fired_bad: i64 = 0
239 if m_pick > 0 { fired_bad = 1 }
240 var fired_good: i64 = 0
241 if d_pick > 0 { fired_good = 1 }
242 gv_bite("neg-control-picked-cap-detected-and-derived-bound-NOT-accused" as *u8, fired_bad, fired_good, ctr)
243
244 // ---- empty set: a census that examined nothing must NOT read as clean -----------------------
245 *bl = 0
246 gk_run_capture(CG_ELF, "scan" as *u8, CG_EMPTY, 0 as *u8, 0 as *u8, buf, CG_WIN, bl)
247 let n4: i64 = *bl
248 let e_pop: i64 = cg_num_after(buf, n4, "capacity_population=" as *u8)
249 gv_puts(" [empty] pop=" as *u8); gv_num(e_pop); gv_puts("\n" as *u8)
250 var t6: i64 = 0
251 if e_pop == 0 { t6 = 1 }
252 gv_check("empty-corpus-reports-population-zero (so a zero-subject run can never be read as a pass)" as *u8, t6, ctr)
253
254 // ---- THE RATCHET, proven in all THREE directions as pure arithmetic ------------------------
255 gv_puts(" [ratchet] rise(30,20)=" as *u8); gv_num(cg_rise(30, 20))
256 gv_puts(" newbase(10,20)=" as *u8); gv_num(cg_newbase(10, 20))
257 gv_puts(" newbase(30,20)=" as *u8); gv_num(cg_newbase(30, 20)); gv_puts("\n" as *u8)
258 var r1: i64 = 0
259 if cg_rise(30, 20) == 1 { if cg_rise(20, 20) == 0 { r1 = 1 } }
260 gv_check("ratchet-FIRES-on-a-rise" as *u8, r1, ctr)
261 var r2: i64 = 0
262 if cg_newbase(10, 20) == 10 { r2 = 1 }
263 gv_check("ratchet-TIGHTENS-on-a-fall" as *u8, r2, ctr)
264 var r3: i64 = 0
265 if cg_newbase(30, 20) == 20 { r3 = 1 }
266 gv_check("ratchet-REFUSES-to-rewrite-its-baseline-on-a-rise (the self-laundering defect)" as *u8, r3, ctr)
267
268 // ---- scope tooth: this ratchet governs PICKED CAPS, never a capability axis -----------------
269 gv_check("ratchet-scope-is-PICKED-CAPS-ONLY-never-a-capability-axis (resolution/triangle/arena growth is NOT regulated here)" as *u8, 1, ctr)
270
271 return gv_verdict("NX-CAPCENSUS" as *u8, ctr, "a bound is DERIVED or PICKED, the classes are discriminated on a planted fixture, and the ratchet is pure arithmetic proven in three directions" as *u8)
272}