nx_catalog_adopt_t75.nx source
↩ module page · 252 lines · 16332 B
1// nx_catalog.nx -- THE GOD-UP CAPABILITY CATALOGUE: one call answers "is <name> there, and is it WIRED?"
2//
3// OPERATOR 2026-08-04: "we have built a significant amount of things that may need cataloguing ... so you
4// can do simple checks if things are there just not adopted and wired ... a full mcp and api, not random
5// grepping." This organ is that check. It is the PER-NAME half the estate never had.
6//
7// WHAT ALREADY EXISTED (asked the corpus first, per standing law -- do NOT rebuild these):
8// S1 defined, zero EXTERNAL callers ............ nx_adopt (BUILT+REGISTERED)
9// S2 in SOURCE but in no shipped BINARY ........ NOBODY <- this organ closes it
10// S3 built/promoted but never REGISTERED ....... NOBODY <- this organ closes it
11// S4 registered but never AUTHORISED or CALLED . nx_wirecensus (BUILT+REGISTERED; 181 DARK / 236permil live)
12// S5 conf row present, no consumer re-read it .. nx_toolreg_reconcile
13// S6 on the NAS but absent from the SSOT tree ... nx_srcdiverge_gate
14// The taxonomy was already named in nx_wirecensus's header; S2/S3 were marked OPEN and stayed open.
15// The REAL gap was never a missing census -- it was that all six answer ESTATE-WIDE and none answers
16// "what about THIS one", so every check degenerated into ad-hoc grepping. That is what this fixes.
17//
18// THE SIX LIFECYCLE STAGES, each a FILE FACT (no prose, no claim-reading):
19// SOURCE buildroot/runtime/<n>.nx | buildroot/runtime/_hdl_build/<n>.nx
20// BUILT buildroot/_build/<n>.sov.elf
21// STAGED <n>.sov.elf.new (a loaded gun aimed at the next deploy -- reported, not hidden)
22// PROMOTED <n>.elf | _offc/<n>.elf
23// REGISTERED tool_allowlist.conf row "<n>\t" (registry = the MCP surface)
24// AUTHORISED cap_consent.log mention (a cap was ever minted for it)
25// INVOKED completed MCP call matched in supplied journal window; no lifetime/quality inference
26//
27// VERDICT LADDER (the first broken link IS the verdict -- a weakest-link rule, never an average):
28// ABSENT . SOURCE-ONLY(S2) . BUILT-UNPROMOTED . PROMOTED-UNREGISTERED(S3) . REGISTERED-DARK(S4) . LIVE
29//
30// nx_catalog <name> [name2 ...] per-name status + verdict exit 0 all LIVE, 1 any gap, 2 usage
31// nx_catalog selftest positive+negative controls exit 0 GREEN, 1 RED
32// A NAME THAT DOES NOT EXIST MUST READ 'ABSENT', NEVER 'fine' -- the selftest proves that with a control.
33// license_tier: ORIGINAL Read-only. No hw writes (Rule 26). expect_exit: 0
34import "nx_syscalls.nx"
35import "nx_estate_path.nx" // ep_anchor: the CWD must not decide this organ's verdict
36// ok_kind_of_path: the estate's ONE reader of the DECLARED organ kind, and already what /api/promote
37// consults to refuse swapping a live daemon. Composed here rather than re-derived -- a second
38// classifier, especially a name-suffix guess, is exactly what misread nx_studio_gate.
39import "nx_organkind.nx"
40// THE LADDER ITSELF LIVES IN nx_catalog_lib (2026-08-23, compare CE2): cl_ladder measures the seven stages into
41// m[] and returns the weakest-link verdict; this organ PRINTS it. The /compare generator and the roadmap
42// ranker import the same classifier, so a board row and this catalogue cannot disagree about what "done" is.
43// Legacy ladder codes and invocation match bit are preserved; coverage and scoped evidence are additive.
44import "nx_catalog_lib.nx"
45const CAT_MAGIC_1024: i64 = 1024
46// ONE number, used by BOTH the printed denominator and the GREEN comparison, so they cannot drift
47// apart when a tooth is added. A hand-rolled denominator in two places is how a suite prints
48// "passed 7/6" -- or worse, keeps saying 6 while a seventh tooth silently stops running.
49const CAT_SELFTEST_TEETH: i64 = 8
50
51func c_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
52func c_putn(v: i64) -> i64 {
53 let bb: *u8 = sys_mmap(28); var m: i64 = v
54 if m < 0 { m = 0 - m }
55 let t: *u8 = sys_mmap(28); var k: i64 = 0
56 if m == 0 { t[0] = 48 as u8; k = 1 }
57 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
58 var i: i64 = 0
59 if v < 0 { bb[0] = 45 as u8; i = 1 }
60 var j: i64 = 0
61 while j < k { bb[i] = t[k - 1 - j]; i = i + 1; j = j + 1 }
62 sys_write(1, bb, i); return 0
63}
64
65func cat_one(name: *u8, alw: *u8, alwn: i64, cns: *u8, cnsn: i64, act: *u8, actn: i64) -> i64 {
66 // the ONE classifier (nx_catalog_lib): every stage measured into m[], verdict weakest-link-first
67 let m: *i64 = sys_mmap(CLM_N * 8) as *i64
68 let code: i64 = cl_ladder(name, alw, alwn, cns, cnsn, act, actn, m)
69 let src: i64 = m[CLM_SRC]
70 let lib: i64 = m[CLM_LIB]
71 let built: i64 = m[CLM_BUILT]
72 let staged: i64 = m[CLM_STAGED]
73 let promoted: i64 = m[CLM_PROMOTED]
74 let reg: i64 = m[CLM_REG]
75 let auth: i64 = m[CLM_AUTH]
76 let inv: i64 = m[CLM_INV]
77 let dkind: i64 = m[CLM_DKIND]
78 let resolved: i64 = m[CLM_RESOLVED]
79
80 c_puts(" " as *u8); c_puts(name); c_puts("
81" as *u8)
82 c_puts(" SOURCE " as *u8)
83 if src >= 0 { c_puts("yes " as *u8); c_putn(src); c_puts("B
84" as *u8) } else { c_puts("NO
85" as *u8) }
86 if lib == 1 { c_puts(" KIND LIB (no top-level main() -- a binary is NOT expected for this one)
87" as *u8) }
88 if lib < 0 { if src >= 0 { c_puts(" KIND UNKNOWN (source present but unreadable here -- not classified)
89" as *u8) } }
90 if dkind == OK_DAEMON { c_puts(" KIND DAEMON (declared in organ_kind.conf -- it SERVES a port; it is not a tool the MCP surface calls)
91" as *u8) }
92 if dkind == OK_FIXTURE { c_puts(" KIND FIXTURE (declared in organ_kind.conf -- a runnable witness its gate compiles per run; a promoted binary is NOT expected)
93" as *u8) }
94 c_puts(" BUILT " as *u8)
95 if built >= 0 { c_puts("yes " as *u8); c_putn(built); c_puts("B
96" as *u8) } else { c_puts("NO
97" as *u8) }
98 if staged >= 0 { c_puts(" STAGED yes " as *u8); c_putn(staged); c_puts("B (unpromoted .new -- aimed at the next deploy)
99" as *u8) }
100 c_puts(" PROMOTED " as *u8)
101 if promoted >= 0 { c_puts("yes " as *u8); c_putn(promoted); c_puts("B
102" as *u8) } else { c_puts("NO
103" as *u8) }
104 c_puts(" REGISTERED " as *u8)
105 if reg == 1 { c_puts("yes (on the MCP surface)
106" as *u8) } else { c_puts("NO (not on the MCP surface)
107" as *u8) }
108 c_puts(" AUTHORISED " as *u8)
109 if auth == 1 { c_puts("yes (a cap was minted)
110" as *u8) } else { c_puts("NO
111" as *u8) }
112 c_puts(" INVOKED " as *u8)
113 if inv == 1 { c_puts("yes (completed MCP call observed in scanned window; not quality)
114" as *u8) } else { c_puts("NO (legacy window-match bit; read failure is unknown; see INVOCATION_EVIDENCE)
115" as *u8) }
116 // WHERE DID THE LADDER LOOK? (2026-09-03) A resolver that returns a verdict without saying WHERE IT
117 // LOOKED reproduces the original defect one layer up, so this prints on EVERY path INCLUDING the miss.
118 c_puts(" RESOLVED resolved_by=" as *u8); c_puts(cl_resolved_name(resolved))
119 if resolved == CLR_PATH { c_puts(" (field 2 of the tool_allowlist.conf row stat'd AS GIVEN -- the row is the contract and it holds)
120" as *u8) }
121 if resolved == CLR_REGBASE { c_puts(" (field 2 did NOT stat -- its basename answered instead, so THE ROW IS MISPOINTED)
122" as *u8) }
123 if resolved == CLR_NAME { c_puts(" (no registry row at all -- the <name>.nx / <name>.elf convention answered)
124" as *u8) }
125 // weakest-link verdict: the FIRST broken link, never an average -- the sentence is the lib's, verbatim
126 c_puts(" VERDICT " as *u8)
127 c_puts(cl_verdict_text(code))
128 if cl_gap(code) == 1 { return 0 }
129 return 1
130}
131
132func cat_coverage(c:*i64)->i64 {
133 c_puts("ACTLOG_COVERAGE state=");c_puts(cl_tail_state_name(c[CLC_STATE]))
134 c_puts(" extent=");c_putn(c[CLC_EXTENT]);c_puts(" final_extent=");c_putn(c[CLC_FINAL])
135 c_puts(" window_start=");c_putn(c[CLC_START]);c_puts(" window_end=");c_putn(c[CLC_END])
136 c_puts(" read_bytes=");c_putn(c[CLC_READ]);c_puts(" discarded_head=");c_putn(c[CLC_HEAD])
137 c_puts(" discarded_tail=");c_putn(c[CLC_TAIL]);c_puts(" errno=");c_putn(c[CLC_ERRNO])
138 c_puts(" observed_at_epoch=");c_putn(c[CLC_OBSERVED])
139 c_puts(" lifetime_coverage=unknown source=knowledge/status/actlog.jrnl scope=completed-mcp-call-window\n")
140 return 0
141}
142func cat_recent(name:*u8,act:*u8,n:i64,c:*i64)->i64 {
143 c_puts(" INVOCATION_EVIDENCE recent_completed_mcp_call=")
144 if c[CLC_STATE]!=CLC_OK{c_puts("unknown-read-failed")}
145 else{if cl_actlog_completed(act,n,name)==1{c_puts("observed")}else{c_puts("not-observed-in-scanned-window")}}
146 c_puts(" lifetime_invocation=")
147 if c[CLC_STATE]==CLC_OK&&cl_actlog_completed(act,n,name)==1{c_puts("observed-in-this-window")}else{c_puts("unknown")}
148 c_puts(" outcome_scope=completed-mcp-call-not-capability-quality\n")
149 return 0
150}
151
152func main(argc: i64, argv: *i64) -> i64 {
153 // ANCHOR FIRST (2026-08-04, nx_cwdguard finding): this organ reads a RELATIVE
154 // knowledge/ path, so its answer depended on where it was launched. No-op when
155 // already at the estate root, so the cron/MCP context is unchanged.
156 ep_anchor()
157 if argc < 2 {
158 c_puts("usage: nx_catalog <name> [name2 ...] | nx_catalog selftest\n" as *u8)
159 c_puts(" answers SOURCE/BUILT/STAGED/PROMOTED/REGISTERED/AUTHORISED/INVOKED + a weakest-link VERDICT\n" as *u8)
160 sys_exit(2); return 2
161 }
162 let lp: *i64 = sys_mmap(64) as *i64
163 let alw: *u8 = cl_slurp("tool_allowlist.conf" as *u8, lp)
164 let alwn: i64 = lp[0]
165 let cns: *u8 = cl_slurp("cap_consent.log" as *u8, lp)
166 let cnsn: i64 = lp[0]
167 let coverage:*i64=sys_mmap(CLC_N*8) as *i64
168 let act: *u8 = cl_slurp_tail_covered("knowledge/status/actlog.jrnl" as *u8, lp, coverage)
169 let actn: i64 = lp[0]
170
171 // REFUSE rather than bless: a catalogue computed from an empty registry reads clean and guarantees nothing
172 if alwn <= 0 {
173 c_puts("NX-CATALOG REFUSED: tool_allowlist.conf unreadable/empty -- every answer would be a false NO.\n" as *u8)
174 sys_exit(3); return 3
175 }
176 c_puts("=== NX-CATALOG (registry " as *u8); c_putn(alwn)
177 c_puts("B, consent " as *u8); c_putn(cnsn)
178 c_puts("B, actlog " as *u8); c_putn(actn); c_puts("B) ===\n" as *u8)
179
180 cat_coverage(coverage)
181 let a1: *u8 = argv[1] as *u8
182 if clb_eq(a1, "selftest" as *u8) == 1 {
183 var teeth: i64 = 0
184 c_puts("T1 POSITIVE CONTROL -- a known-live organ must not read ABSENT:\n" as *u8)
185 let pos: i64 = cat_one("nx_wirecensus" as *u8, alw, alwn, cns, cnsn, act, actn)
186 cl_cat3(sys_mmap(CL_PATH), "" as *u8, "" as *u8, "" as *u8)
187 let pth: *u8 = sys_mmap(CL_PATH)
188 cl_cat3(pth, "buildroot/_build/" as *u8, "nx_wirecensus" as *u8, ".sov.elf" as *u8)
189 if cl_fsize(pth) >= 0 { teeth = teeth + 1; c_puts(" T1 PASS (its binary is really on disk)\n" as *u8) }
190 else { c_puts(" T1 FAIL\n" as *u8) }
191 c_puts("T2 NEGATIVE CONTROL -- a fabricated name MUST read ABSENT:\n" as *u8)
192 let neg: i64 = cat_one("nx_definitely_not_a_real_organ_zzz" as *u8, alw, alwn, cns, cnsn, act, actn)
193 if neg == 0 { teeth = teeth + 1; c_puts(" T2 PASS (refused to bless a name that does not exist)\n" as *u8) }
194 else { c_puts(" T2 FAIL -- blessed a fabricated organ\n" as *u8) }
195 c_puts("T3 REGISTRY NON-VACUITY -- the allowlist must be a real, non-empty surface:\n" as *u8)
196 if alwn > CAT_MAGIC_1024 { teeth = teeth + 1; c_puts(" T3 PASS\n" as *u8) } else { c_puts(" T3 FAIL\n" as *u8) }
197 // T4/T5 ADDED 2026-08-16 with the LIB verdict. BOTH DIRECTIONS OR NEITHER: a classifier proven
198 // only on the case that motivated it is unproven. T4 is the library it MUST recognise; T5 is a
199 // program it must NOT -- and without T5 an is_lib that answered 1 for everything scores 100%.
200 c_puts("T4 LIB CLASSIFICATION -- a main()-less library must NOT be told to Build it:\n" as *u8)
201 let libp: *u8 = sys_mmap(CL_PATH)
202 cl_cat3(libp, "buildroot/runtime/_hdl_build/" as *u8, "nx_inventory" as *u8, ".nx" as *u8)
203 var l4: i64 = cl_is_lib(libp)
204 if l4 < 0 { cl_cat3(libp, "buildroot/runtime/" as *u8, "nx_inventory" as *u8, ".nx" as *u8); l4 = cl_is_lib(libp) }
205 if l4 == 1 { teeth = teeth + 1; c_puts(" T4 PASS (nx_inventory reads LIB, not SOURCE-ONLY)\n" as *u8) } else { c_puts(" T4 FAIL\n" as *u8) }
206 c_puts("T5 neg-control-a-program-must-not-read-LIB:\n" as *u8)
207 let progp: *u8 = sys_mmap(CL_PATH)
208 cl_cat3(progp, "buildroot/runtime/" as *u8, "nx_catalog" as *u8, ".nx" as *u8)
209 if cl_is_lib(progp) == 0 { teeth = teeth + 1; c_puts(" T5 PASS (this organ has a top-level main and reads PROGRAM)\n" as *u8) } else { c_puts(" T5 FAIL -- classified a program as a library\n" as *u8) }
210 // T6 guards the widened source roots. ITS NEGATIVE CONTROL IS T2 ABOVE, WHICH NOW COSTS MORE THAN
211 // IT DID: a fabricated name must STILL read ABSENT after the search widened from two roots to six,
212 // so T2 is what stops "probe more places" from degrading into "find something everywhere".
213 c_puts("T6 SOURCE ROOT COVERAGE -- an organ under runtime/bin must not read ABSENT:\n" as *u8)
214 let binp: *u8 = sys_mmap(CL_PATH)
215 if cl_src(binp, "nx_sites_daemon" as *u8) >= 0 { teeth = teeth + 1; c_puts(" T6 PASS (nx_sites_daemon source resolves)\n" as *u8) } else { c_puts(" T6 FAIL -- the daemon serving the estate websites still reads as nonexistent\n" as *u8) }
216 // T7/T8 ADDED 2026-08-16 with the LIVE-DAEMON verdict, under the SAME law T4/T5 states above:
217 // BOTH DIRECTIONS OR NEITHER. T7 is the declared daemon it MUST recognise; T8 is a non-daemon it
218 // must NOT -- and without T8 an ok_kind_of_path that answered DAEMON for everything would score
219 // 100% here while SILENTLY RETIRING EVERY REAL S3/S4 GAP IN THE ESTATE, because this verdict
220 // returns 1 (not-a-gap) and feeds the adoption numbers.
221 c_puts("T7 DAEMON CLASSIFICATION -- a declared daemon must NOT be told to Register it:\n" as *u8)
222 // NAME WHICH REASON. ok_kind_of_path returns UNKNOWN both when the conf is ABSENT and when the
223 // name is simply undeclared -- two causes with OPPOSITE remedies (ship the conf vs add a row).
224 // Collapsing them into one FAIL is how a tooth reports on its own environment while naming its
225 // subject; measured on a laptop tree with no knowledge/ dir, where this read as a classifier bug.
226 let okconf: *u8 = "knowledge/status/organ_kind.conf" as *u8
227 if cl_fsize(okconf) < 0 {
228 c_puts(" T7 FAIL [PRECONDITION] organ_kind.conf is UNREADABLE from here -- this says NOTHING about the classifier, only that its INPUT is absent (normal on an authoring tree; the estate has it).\n" as *u8)
229 } else {
230 if ok_kind_of_path(okconf, "nx_tools_api_serve" as *u8) == OK_DAEMON { teeth = teeth + 1; c_puts(" T7 PASS (reads DAEMON from the DECLARATION, not from a name suffix)\n" as *u8) } else { c_puts(" T7 FAIL -- the conf IS readable and the MCP transport still does not read as a daemon\n" as *u8) }
231 }
232 c_puts("T8 neg-control-a-non-daemon-must-not-read-DAEMON:\n" as *u8)
233 if ok_kind_of_path("knowledge/status/organ_kind.conf" as *u8, "nx_catalog" as *u8) != OK_DAEMON { teeth = teeth + 1; c_puts(" T8 PASS (this organ is not misread as a daemon)\n" as *u8) } else { c_puts(" T8 FAIL -- a non-daemon read as DAEMON would hide every real registration gap\n" as *u8) }
234 c_puts("NX-CATALOG SELFTEST teeth=" as *u8); c_putn(teeth); c_puts("of" as *u8); c_putn(CAT_SELFTEST_TEETH); c_puts(" " as *u8)
235 if teeth == CAT_SELFTEST_TEETH { c_puts("verdict=GREEN\n" as *u8); sys_exit(0); return 0 }
236 c_puts("verdict=RED\n" as *u8); sys_exit(1); return 1
237 }
238
239 var gaps: i64 = 0
240 var i: i64 = 1
241 while i < argc {
242 let nm: *u8 = argv[i] as *u8
243 if cat_one(nm, alw, alwn, cns, cnsn, act, actn) == 0 { gaps = gaps + 1 }
244 cat_recent(nm,act,actn,coverage)
245 i = i + 1
246 }
247 c_puts("=== names=" as *u8); c_putn(argc - 1)
248 c_puts(" with_gaps=" as *u8); c_putn(gaps); c_puts(" ===\n" as *u8)
249 if gaps > 0 { sys_exit(1); return 1 }
250 sys_exit(0); return 0
251}
252