code wiki / (root) / nx_closurehash_gate.nx
`nx_closurehash_gate.nx` source

↩ module page · 206 lines · 9963 B
1// nx_closurehash_gate.nx -- PROVE nx_closurehash ACTUALLY READS THE CLOSURE (2026-08-07).
2//
3// The organ claims something strong: that its one hash covers every source the compiler will read. That
4// claim has an obvious trivial-wrong implementation -- hash ONLY the target file and print a number --
5// and such a fake would pass every naive test: it resolves, it is deterministic, it emits 64 hex chars.
6// *A TEST THAT THE TRIVIAL WRONG IMPLEMENTATION ALSO PASSES MEASURES NOTHING.*
7//
8// T3 is the tooth that decides it: mutate ONE BYTE of a TRANSITIVE dependency (depth 2, never named by
9// the target) and require the closure hash to CHANGE. A target-only hasher cannot pass that, and neither
10// can a one-level hasher.
11//
12// Fixtures are built on disk under /tmp so the walk is exercised for real -- a fixture held in memory
13// would test the parser and skip the resolver, which is where the last two defects actually were
14// (a scanner matching its own source text, and a resolver blind to a third search path).
15//
16//   nx_closurehash_gate [elf]     elf default ./_build/nx_closurehash.sov.elf
17// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
18import "nx_tool_run.nx"
19import "nx_gate_verdict.nx"
20
21const CG_ROOT: *u8 = "/tmp/chgate"
22const CG_RT: *u8 = "/tmp/chgate/runtime"
23const CG_CAP: i64 = 65536
24const CG_MODE: i64 = 493
25
26func cgp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
27func cgn(v: i64) -> i64 {
  var m: i64 = v
  if m < 0 { cgp("-" as *u8); m = 0 - m }
  let t: *u8 = sys_mmap(32)
  var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  let b: *u8 = sys_mmap(32)
  var i: i64 = 0
  while i < k { b[i] = t[k-1-i]; i = i + 1 }
  sys_write(1, b, k)
  return 0
39}
40func cgwrite(path: *u8, body: *u8) -> i64 {
  let fd: i64 = sys_openat_wr(path, 420)
  if fd < 0 { return 0 - 1 }
  var n: i64 = 0
  while body[n] != (0 as u8) { n = n + 1 }
  sys_write(fd, body, n)
  sys_close(fd)
  return n
48}
49func cgcat(d: *u8, o: i64, s: *u8) -> i64 { var x: i64=o; var i: i64=0; while s[i]!=(0 as u8){d[x]=s[i];x=x+1;i=i+1} return x }
50// pull the 64-hex value after "closure_sha=" out of a capture. Scans every byte: the value is never at
51// offset 0, and a merged stdout+stderr capture moves it again.
52func cg_sha(buf: *u8, n: i64, out: *u8) -> i64 {
  let k: *u8 = "closure_sha=" as *u8
  var i: i64 = 0
  while i + 12 <= n {
      var m: i64 = 0
      var hit: i64 = 1
      while m < 12 { if buf[i+m] != k[m] { hit = 0; m = 12 } else { m = m + 1 } }
      if hit == 1 {
          var s: i64 = i + 12
          var o: i64 = 0
          while o < 64 { if s + o < n { out[o] = buf[s+o]; o = o + 1 } else { o = 64 } }
          out[64] = 0 as u8
          return 1
      }
      i = i + 1
  }
  return 0
69}
70func cg_num_after(buf: *u8, n: i64, key: *u8) -> i64 {
  var ln: i64 = 0
  while key[ln] != (0 as u8) { ln = ln + 1 }
  var i: i64 = 0
  while i + ln < n {
      var m: i64 = 0
      var hit: i64 = 1
      while m < ln { if buf[i+m] != key[m] { hit = 0; m = ln } else { m = m + 1 } }
      if hit == 1 {
          var s: i64 = i + ln
          var v: i64 = 0
          var got: i64 = 0
          while s < n {
              let c: i64 = buf[s] as i64
              if c >= 48 { if c <= 57 { v = v*10 + (c-48); got = 1; s = s + 1 } else { s = n } } else { s = n }
          }
          if got == 1 { return v }
          return 0 - 1
      }
      i = i + 1
  }
  return 0 - 1
92}
93func cg_same(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while i < 64 { if a[i] != b[i] { return 0 } i = i + 1 }
  return 1
97}
98
99// 1 if `p` can be stat'd. Used to RESOLVE THE SUBJECT rather than assume it.
100func cg_exists(p: *u8) -> i64 {
  let sb: *u8 = sys_mmap(256)
  let r: i64 = sys_fstatat(p, sb)
  sys_munmap(sb, 256)
  if r < 0 { return 0 }
  return 1
106}
107
108func main(argc: i64, argv: *i64) -> i64 {
  // SUBJECT RESOLUTION (fixed 2026-08-08). The default used to be the AUTHOR'S LAPTOP ABSOLUTE
  // PATH, so this gate scored 4/4 on that one machine and could only ever fork-fail (rc=127)
  // anywhere else -- and it did, 1/4 RED, the first time it ever ran on the NAS.
  // *A GATE THAT HARDCODES ITS AUTHOR'S ABSOLUTE PATH IS PROVEN ONLY ON ITS AUTHOR'S MACHINE.*
  // Probe deployed locations first, build tree last; literals are hoisted to `let` because an
  // inline-cast string literal indexed directly never compares equal (banked NishiLang trap).
  let c1: *u8 = "./_offc/nx_closurehash.elf" as *u8
  let c2: *u8 = "../nx_closurehash.elf" as *u8
  let c3: *u8 = "./nx_closurehash.elf" as *u8
  let c4: *u8 = "./_build/nx_closurehash.sov.elf" as *u8
  let c5: *u8 = "/mnt/c/Users/elder/nishi-core/nxc2/_build/nx_closurehash.sov.elf" as *u8
  var elf: *u8 = c5
  var found: i64 = 0
  if cg_exists(c5) == 1 { found = 1 }
  if cg_exists(c4) == 1 { elf = c4; found = 1 }
  if cg_exists(c3) == 1 { elf = c3; found = 1 }
  if cg_exists(c2) == 1 { elf = c2; found = 1 }
  if cg_exists(c1) == 1 { elf = c1; found = 1 }
  if argc >= 2 { let e: *u8 = argv[1] as *u8; if e[0] != (0 as u8) { elf = e; found = cg_exists(e) } }
  // PRINT THE SUBJECT. An absent subject must be visible as "I could not look", never silently
  // scored as four failing teeth -- rc=127 read as a RED verdict is a diagnosis nobody made.
  cgp("# subject=" as *u8); cgp(elf)
  if found == 0 { cgp("  *** ABSENT -- teeth below measure NOTHING ***" as *u8) }
  cgp("\n" as *u8)
133
  sys_mkdir(CG_ROOT, CG_MODE)
  sys_mkdir(CG_RT, CG_MODE)
136
  let pa: *u8 = sys_mmap(256); var x: i64 = cgcat(pa, 0, CG_RT); x = cgcat(pa, x, "/cg_a.nx" as *u8); pa[x] = 0 as u8
  let pb: *u8 = sys_mmap(256); var y: i64 = cgcat(pb, 0, CG_RT); y = cgcat(pb, y, "/cg_b.nx" as *u8); pb[y] = 0 as u8
  let pc: *u8 = sys_mmap(256); var z: i64 = cgcat(pc, 0, CG_RT); z = cgcat(pc, z, "/cg_c.nx" as *u8); pc[z] = 0 as u8
140
  // depth-2 chain: a -> b -> c. `c` is NEVER named by `a`, which is the whole point of T3.
  cgwrite(pa, "import \"cg_b.nx\"\nfunc cg_a() -> i64 { return 1 }\n" as *u8)
  cgwrite(pb, "import \"cg_c.nx\"\nfunc cg_b() -> i64 { return 2 }\n" as *u8)
  cgwrite(pc, "func cg_c() -> i64 { return 3 }\n" as *u8)
145
  let out: *u8 = sys_mmap(CG_CAP)
  let ol: *i64 = sys_mmap(16) as *i64
  let av: *i64 = sys_mmap(64) as *i64
  let h1: *u8 = sys_mmap(80)
  let h2: *u8 = sys_mmap(80)
  let h3: *u8 = sys_mmap(80)
  var pass: i64 = 0
  var total: i64 = 0
154
  // ---- T1: the depth-2 closure resolves completely and counts 3 files
  av[0] = elf as i64; av[1] = "cg_a" as *u8 as i64; av[2] = CG_ROOT as i64; av[3] = 0
  ol[0] = 0
  tr_run_capture_to(elf, av, out, CG_CAP, ol, 60000)
  let f1: i64 = cg_num_after(out, ol[0], "files=" as *u8)
  let u1: i64 = cg_num_after(out, ol[0], "unresolved=" as *u8)
  let g1: i64 = cg_sha(out, ol[0], h1)
  total = total + 1
  var t1: i64 = 0
  if f1 == 3 { if u1 == 0 { if g1 == 1 { t1 = 1 } } }
  if t1 == 1 { pass = pass + 1; cgp("T1 GREEN depth-2 closure complete (files=3 unresolved=0)\n" as *u8) } else { cgp("T1 RED files=" as *u8); cgn(f1); cgp(" unresolved=" as *u8); cgn(u1); cgp("\n" as *u8) }
166
  // ---- T2: DETERMINISM -- unchanged tree must give the identical hash
  ol[0] = 0
  tr_run_capture_to(elf, av, out, CG_CAP, ol, 60000)
  cg_sha(out, ol[0], h2)
  total = total + 1
  if cg_same(h1, h2) == 1 { pass = pass + 1; cgp("T2 GREEN deterministic across runs\n" as *u8) } else { cgp("T2 RED hash changed with no edit\n" as *u8) }
173
  // ---- T3: ANTI-VACUITY. One byte in the DEPTH-2 dependency must move the closure hash.
  // A hasher that reads only the target -- or only its direct imports -- passes T1, T2 and T4 and
  // FAILS HERE. This is the tooth that makes the organ's claim mean anything.
  cgwrite(pc, "func cg_c() -> i64 { return 4 }\n" as *u8)
  ol[0] = 0
  tr_run_capture_to(elf, av, out, CG_CAP, ol, 60000)
  cg_sha(out, ol[0], h3)
  total = total + 1
  if cg_same(h1, h3) == 0 { pass = pass + 1; cgp("T3 GREEN one byte at DEPTH 2 changed the closure hash -- a target-only hasher cannot pass this\n" as *u8) } else { cgp("T3 RED transitive edit did NOT change the hash: the closure is not being read\n" as *u8) }
183
  // ---- T4: a missing import must be COUNTED and must exit non-zero, never silently dropped.
  // *A PROVENANCE RECORD THAT DROPS WHAT IT COULD NOT FIND IS A FORGERY* -- and a clean exit on an
  // incomplete closure is exactly how a caller gating a promote would be misled.
  cgwrite(pb, "import \"cg_missing_zz.nx\"\nfunc cg_b() -> i64 { return 2 }\n" as *u8)
  ol[0] = 0
  let rc: i64 = tr_run_capture_to(elf, av, out, CG_CAP, ol, 60000)
  let u4: i64 = cg_num_after(out, ol[0], "unresolved=" as *u8)
  total = total + 1
  var t4: i64 = 0
  if u4 >= 1 { if rc != 0 { t4 = 1 } }
  if t4 == 1 { pass = pass + 1; cgp("T4 GREEN missing import COUNTED (unresolved=" as *u8); cgn(u4); cgp(") and exit non-zero\n" as *u8) } else { cgp("T4 RED unresolved=" as *u8); cgn(u4); cgp(" rc=" as *u8); cgn(rc); cgp(" -- an incomplete closure must not exit clean\n" as *u8) }
195
  cgp("nx_closurehash_gate " as *u8); cgn(pass); cgp("/" as *u8); cgn(total); cgp("\n" as *u8)
  // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check
  // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled
  // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify.
  let ctr__dry: *i64 = gv_ctr()
  ctr__dry[0] = pass
  ctr__dry[1] = total
  let rc__dry: i64 = gv_verdict("CLOSUREHASH-GATE" as *u8, ctr__dry, "teeth unchanged; verdict emission migrated onto the shared base class" as *u8)
  sys_exit(rc__dry)
  return rc__dry
206}
nx_closurehash_gate.nx source

`nx_closurehash_gate.nx` source
