nx_catalog.nx source
↩ module page · 240 lines · 11726 B
1// nx_catalog.nx -- THE GOD-UP CAPABILITY CATALOGUE: one call answers "is <name> there, and is it WIRED?"
2//
3// OPERATOR 2026-08-04: "we have built a significant amount of things that may need cataloguing ... so you
4// can do simple checks if things are there just not adopted and wired ... a full mcp and api, not random
5// grepping." This organ is that check. It is the PER-NAME half the estate never had.
6//
7// WHAT ALREADY EXISTED (asked the corpus first, per standing law -- do NOT rebuild these):
8// S1 defined, zero EXTERNAL callers ............ nx_adopt (BUILT+REGISTERED)
9// S2 in SOURCE but in no shipped BINARY ........ NOBODY <- this organ closes it
10// S3 built/promoted but never REGISTERED ....... NOBODY <- this organ closes it
11// S4 registered but never AUTHORISED or CALLED . nx_wirecensus (BUILT+REGISTERED; 181 DARK / 236permil live)
12// S5 conf row present, no consumer re-read it .. nx_toolreg_reconcile
13// S6 on the NAS but absent from the SSOT tree ... nx_srcdiverge_gate
14// The taxonomy was already named in nx_wirecensus's header; S2/S3 were marked OPEN and stayed open.
15// The REAL gap was never a missing census -- it was that all six answer ESTATE-WIDE and none answers
16// "what about THIS one", so every check degenerated into ad-hoc grepping. That is what this fixes.
17//
18// THE SIX LIFECYCLE STAGES, each a FILE FACT (no prose, no claim-reading):
19// SOURCE buildroot/runtime/<n>.nx | buildroot/runtime/_hdl_build/<n>.nx
20// BUILT buildroot/_build/<n>.sov.elf
21// STAGED <n>.sov.elf.new (a loaded gun aimed at the next deploy -- reported, not hidden)
22// PROMOTED <n>.elf | _offc/<n>.elf
23// REGISTERED tool_allowlist.conf row "<n>\t" (registry = the MCP surface)
24// AUTHORISED cap_consent.log mention (a cap was ever minted for it)
25// INVOKED knowledge/status/actlog.jrnl (it actually RAN)
26//
27// VERDICT LADDER (the first broken link IS the verdict -- a weakest-link rule, never an average):
28// ABSENT . SOURCE-ONLY(S2) . BUILT-UNPROMOTED . PROMOTED-UNREGISTERED(S3) . REGISTERED-DARK(S4) . LIVE
29//
30// nx_catalog <name> [name2 ...] per-name status + verdict exit 0 all LIVE, 1 any gap, 2 usage
31// nx_catalog selftest positive+negative controls exit 0 GREEN, 1 RED
32// A NAME THAT DOES NOT EXIST MUST READ 'ABSENT', NEVER 'fine' -- the selftest proves that with a control.
33// license_tier: ORIGINAL Read-only. No hw writes (Rule 26). expect_exit: 0
34import "nx_syscalls.nx"
35import "nx_estate_path.nx" // ep_anchor: the CWD must not decide this organ's verdict
36const CAT_MAGIC_65536: i64 = 65536
37const CAT_MAGIC_1024: i64 = 1024
38
39const CAT_BUF: i64 = 4194304 // allowlist/consent/actlog read cap
40const CAT_PATH: i64 = 1024
41
42func c_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
43func c_putn(v: i64) -> i64 {
44 let bb: *u8 = sys_mmap(28); var m: i64 = v
45 if m < 0 { m = 0 - m }
46 let t: *u8 = sys_mmap(28); var k: i64 = 0
47 if m == 0 { t[0] = 48 as u8; k = 1 }
48 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
49 var i: i64 = 0
50 if v < 0 { bb[0] = 45 as u8; i = 1 }
51 var j: i64 = 0
52 while j < k { bb[i] = t[k - 1 - j]; i = i + 1; j = j + 1 }
53 sys_write(1, bb, i); return 0
54}
55
56func slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
57
58// build "<pre><name><suf>" into dst; returns dst
59func cat3(dst: *u8, pre: *u8, name: *u8, suf: *u8) -> i64 {
60 var p: i64 = 0
61 var i: i64 = 0
62 while pre[i] != (0 as u8) { dst[p] = pre[i]; p = p + 1; i = i + 1 }
63 i = 0
64 while name[i] != (0 as u8) { dst[p] = name[i]; p = p + 1; i = i + 1 }
65 i = 0
66 while suf[i] != (0 as u8) { dst[p] = suf[i]; p = p + 1; i = i + 1 }
67 dst[p] = 0 as u8
68 return p
69}
70
71// file exists + size (0-1 if absent). Uses a real open, so it cannot be fooled by a stale listing.
72func fsize(path: *u8) -> i64 {
73 let fd: i64 = sys_openat_rd(path)
74 if fd < 0 { return 0 - 1 }
75 let buf: *u8 = sys_mmap(CAT_MAGIC_65536)
76 var n: i64 = 0
77 var go: i64 = 1
78 while go == 1 {
79 let r: i64 = sys_read(fd, buf, CAT_MAGIC_65536)
80 if r <= 0 { go = 0 } else { n = n + r }
81 }
82 sys_close(fd)
83 return n
84}
85
86// does haystack contain needle? (bounded, byte-exact)
87func has_sub(hay: *u8, hn: i64, ned: *u8) -> i64 {
88 let nn: i64 = slen(ned)
89 if nn == 0 { return 0 }
90 if hn < nn { return 0 }
91 var i: i64 = 0
92 let last: i64 = hn - nn
93 while i <= last {
94 var j: i64 = 0
95 var ok: i64 = 1
96 while j < nn {
97 if hay[i + j] != ned[j] { ok = 0; j = nn } else { j = j + 1 }
98 }
99 if ok == 1 { return 1 }
100 i = i + 1
101 }
102 return 0
103}
104
105// read a whole file into a fresh buffer; length into lp[0]
106func slurp(path: *u8, lp: *i64) -> *u8 {
107 lp[0] = 0
108 let fd: i64 = sys_openat_rd(path)
109 if fd < 0 { return 0 as *u8 }
110 let buf: *u8 = sys_mmap(CAT_BUF + 8)
111 var n: i64 = 0
112 var go: i64 = 1
113 while go == 1 {
114 let r: i64 = sys_read(fd, ((buf as i64) + n) as *u8, CAT_BUF - n)
115 if r <= 0 { go = 0 } else { n = n + r }
116 if n >= CAT_BUF { go = 0 }
117 }
118 sys_close(fd)
119 buf[n] = 0 as u8
120 lp[0] = n
121 return buf
122}
123
124// ---- one name, all six stages. Returns 1 if LIVE (fully wired), else 0. ----
125func cat_one(name: *u8, alw: *u8, alwn: i64, cns: *u8, cnsn: i64, act: *u8, actn: i64) -> i64 {
126 let p: *u8 = sys_mmap(CAT_PATH)
127 let tab: *u8 = sys_mmap(64)
128
129 cat3(p, "buildroot/runtime/" as *u8, name, ".nx" as *u8)
130 var src: i64 = fsize(p)
131 if src < 0 {
132 cat3(p, "buildroot/runtime/_hdl_build/" as *u8, name, ".nx" as *u8)
133 src = fsize(p)
134 }
135 cat3(p, "buildroot/_build/" as *u8, name, ".sov.elf" as *u8)
136 let built: i64 = fsize(p)
137 cat3(p, "" as *u8, name, ".sov.elf.new" as *u8)
138 let staged: i64 = fsize(p)
139 cat3(p, "" as *u8, name, ".elf" as *u8)
140 var promoted: i64 = fsize(p)
141 if promoted < 0 {
142 cat3(p, "_offc/" as *u8, name, ".elf" as *u8)
143 promoted = fsize(p)
144 }
145 // REGISTERED: the allowlist row is "<name><TAB>" -- the tab stops nx_adopt matching nx_adopt_lib
146 var t: i64 = 0
147 while name[t] != (0 as u8) { tab[t] = name[t]; t = t + 1 }
148 tab[t] = 9 as u8
149 tab[t + 1] = 0 as u8
150 let reg: i64 = has_sub(alw, alwn, tab)
151 let auth: i64 = has_sub(cns, cnsn, name)
152 let inv: i64 = has_sub(act, actn, name)
153
154 c_puts(" " as *u8); c_puts(name); c_puts("\n" as *u8)
155 c_puts(" SOURCE " as *u8)
156 if src >= 0 { c_puts("yes " as *u8); c_putn(src); c_puts("B\n" as *u8) } else { c_puts("NO\n" as *u8) }
157 c_puts(" BUILT " as *u8)
158 if built >= 0 { c_puts("yes " as *u8); c_putn(built); c_puts("B\n" as *u8) } else { c_puts("NO\n" as *u8) }
159 if staged >= 0 { c_puts(" STAGED yes " as *u8); c_putn(staged); c_puts("B (unpromoted .new -- aimed at the next deploy)\n" as *u8) }
160 c_puts(" PROMOTED " as *u8)
161 if promoted >= 0 { c_puts("yes " as *u8); c_putn(promoted); c_puts("B\n" as *u8) } else { c_puts("NO\n" as *u8) }
162 c_puts(" REGISTERED " as *u8)
163 if reg == 1 { c_puts("yes (on the MCP surface)\n" as *u8) } else { c_puts("NO (built but NOT callable over MCP)\n" as *u8) }
164 c_puts(" AUTHORISED " as *u8)
165 if auth == 1 { c_puts("yes (a cap was minted)\n" as *u8) } else { c_puts("NO\n" as *u8) }
166 c_puts(" INVOKED " as *u8)
167 if inv == 1 { c_puts("yes (it has actually RUN)\n" as *u8) } else { c_puts("NO\n" as *u8) }
168
169 // weakest-link verdict: report the FIRST broken link, never an average
170 c_puts(" VERDICT " as *u8)
171 if src < 0 { if built < 0 { c_puts("ABSENT -- no source, no binary. It was never built.\n" as *u8); return 0 } }
172 if built < 0 { c_puts("SOURCE-ONLY (S2) -- source exists, no shipped binary. Build it.\n" as *u8); return 0 }
173 if promoted < 0 { c_puts("BUILT-UNPROMOTED -- compiled but not promoted to the serving root.\n" as *u8); return 0 }
174 if reg == 0 { c_puts("PROMOTED-UNREGISTERED (S3) -- a real binary NOBODY CAN CALL. Register it.\n" as *u8); return 0 }
175 if auth == 0 { c_puts("REGISTERED-UNAUTHORISED (S4) -- registered, no cap ever minted.\n" as *u8); return 0 }
176 if inv == 0 { c_puts("REGISTERED-DARK (S4) -- callable, authorised, NEVER RUN.\n" as *u8); return 0 }
177 c_puts("LIVE -- source, binary, promoted, registered, authorised, invoked.\n" as *u8)
178 return 1
179}
180
181func main(argc: i64, argv: *i64) -> i64 {
182 // ANCHOR FIRST (2026-08-04, nx_cwdguard finding): this organ reads a RELATIVE
183 // knowledge/ path, so its answer depended on where it was launched. No-op when
184 // already at the estate root, so the cron/MCP context is unchanged.
185 ep_anchor()
186 if argc < 2 {
187 c_puts("usage: nx_catalog <name> [name2 ...] | nx_catalog selftest\n" as *u8)
188 c_puts(" answers SOURCE/BUILT/STAGED/PROMOTED/REGISTERED/AUTHORISED/INVOKED + a weakest-link VERDICT\n" as *u8)
189 sys_exit(2); return 2
190 }
191 let lp: *i64 = sys_mmap(64) as *i64
192 let alw: *u8 = slurp("tool_allowlist.conf" as *u8, lp)
193 let alwn: i64 = lp[0]
194 let cns: *u8 = slurp("cap_consent.log" as *u8, lp)
195 let cnsn: i64 = lp[0]
196 let act: *u8 = slurp("knowledge/status/actlog.jrnl" as *u8, lp)
197 let actn: i64 = lp[0]
198
199 // REFUSE rather than bless: a catalogue computed from an empty registry reads clean and guarantees nothing
200 if alwn <= 0 {
201 c_puts("NX-CATALOG REFUSED: tool_allowlist.conf unreadable/empty -- every answer would be a false NO.\n" as *u8)
202 sys_exit(3); return 3
203 }
204 c_puts("=== NX-CATALOG (registry " as *u8); c_putn(alwn)
205 c_puts("B, consent " as *u8); c_putn(cnsn)
206 c_puts("B, actlog " as *u8); c_putn(actn); c_puts("B) ===\n" as *u8)
207
208 let a1: *u8 = argv[1] as *u8
209 if has_sub(a1, slen(a1), "selftest" as *u8) == 1 {
210 var teeth: i64 = 0
211 c_puts("T1 POSITIVE CONTROL -- a known-live organ must not read ABSENT:\n" as *u8)
212 let pos: i64 = cat_one("nx_wirecensus" as *u8, alw, alwn, cns, cnsn, act, actn)
213 cat3(sys_mmap(CAT_PATH), "" as *u8, "" as *u8, "" as *u8)
214 let pth: *u8 = sys_mmap(CAT_PATH)
215 cat3(pth, "buildroot/_build/" as *u8, "nx_wirecensus" as *u8, ".sov.elf" as *u8)
216 if fsize(pth) >= 0 { teeth = teeth + 1; c_puts(" T1 PASS (its binary is really on disk)\n" as *u8) }
217 else { c_puts(" T1 FAIL\n" as *u8) }
218 c_puts("T2 NEGATIVE CONTROL -- a fabricated name MUST read ABSENT:\n" as *u8)
219 let neg: i64 = cat_one("nx_definitely_not_a_real_organ_zzz" as *u8, alw, alwn, cns, cnsn, act, actn)
220 if neg == 0 { teeth = teeth + 1; c_puts(" T2 PASS (refused to bless a name that does not exist)\n" as *u8) }
221 else { c_puts(" T2 FAIL -- blessed a fabricated organ\n" as *u8) }
222 c_puts("T3 REGISTRY NON-VACUITY -- the allowlist must be a real, non-empty surface:\n" as *u8)
223 if alwn > CAT_MAGIC_1024 { teeth = teeth + 1; c_puts(" T3 PASS\n" as *u8) } else { c_puts(" T3 FAIL\n" as *u8) }
224 c_puts("NX-CATALOG SELFTEST teeth=" as *u8); c_putn(teeth); c_puts("of3 " as *u8)
225 if teeth == 3 { c_puts("verdict=GREEN\n" as *u8); sys_exit(0); return 0 }
226 c_puts("verdict=RED\n" as *u8); sys_exit(1); return 1
227 }
228
229 var gaps: i64 = 0
230 var i: i64 = 1
231 while i < argc {
232 let nm: *u8 = argv[i] as *u8
233 if cat_one(nm, alw, alwn, cns, cnsn, act, actn) == 0 { gaps = gaps + 1 }
234 i = i + 1
235 }
236 c_puts("=== names=" as *u8); c_putn(argc - 1)
237 c_puts(" with_gaps=" as *u8); c_putn(gaps); c_puts(" ===\n" as *u8)
238 if gaps > 0 { sys_exit(1); return 1 }
239 sys_exit(0); return 0
240}