nx_code_review.nx source

1// nx_code_review.nx -- THE SOVEREIGN AUTOMATED CODE REVIEW COORDINATOR. 2// 3// Operator 2026-07-06: "make sure our nishi ecosystem has [en.wikipedia.org/wiki/Automated_code_review] 4// as part of its state-of-the-art evaluator that is running." This organ answers that, prove-not-assert. 5// 6// GROUNDING (Rule 4, from the article itself): Automated code review = software tools that assist or fully 7// automate reviewing SOURCE for defects, style/convention violations, security vulnerabilities, and 8// maintainability -- overlapping static analysis / linting, enforcing coding conventions and architecture 9// constraints, run in the IDE and in CI, COMPLEMENTING (not replacing) manual review. THIS organ maps every 10// one of those axes to the Nishi organ that already implements it, PROVES each backing organ exists on disk 11// (opens the real file), then RUNS a live review (fork+exec the installed mechanical scanner) and requires its 12// own can-fail self-test to hold. So "we have automated code review, running" is DEMONSTRATED, not claimed. 13// 14// COMPOSES, does not rebuild (Cardinal 15 / no-tool-proliferation): every axis points at an existing organ; 15// this is a thin COORDINATOR + census (the nx_standards_contract pattern: map -> enforcing organ, opened on 16// disk), NOT a new scanner. Emits the shared EVAL-COORD line (coverage=CODE-REVIEW) so the full-coverage 17// evaluator aggregator composes it beside nx_rung_eval (BOTTOM-UP), the top-down/UX evaluators, and the 18// deep-middle graders. license_tier: ORIGINAL expect_exit: 0 19// 20// SOVEREIGN: syscalls only (nx_cc->nxasm), no gcc/bash/curl. The only bootstrap-tolerated dep is /dev/null as 21// a stdout sink for the silenced child (like /proc: fine until NishiOS ships a sovereign sink). Run from the 22// nxc2 root so the relative organ paths + the installed _offc/ scanner resolve. 23import "nx_syscalls.nx" 24import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc) 25const K_MAGIC_65536: i64 = 65536 26const K_MAGIC_2097152: i64 = 2097152 27 28func cr_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 29// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer 30// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the 31// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls). 32// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign. 33func cr_putn(v: i64) -> i64 { nxi_out(v); return 0 } 34 35// PROVE-NOT-ASSERT presence: open the REAL organ file and read one byte. Returns 1 iff it exists and is 36// non-empty. Never reads back a claim -- opens the artifact (the discipline the whole evaluator system exists 37// to enforce, applied to itself). 38func cr_present(path: *u8) -> i64 { 39 let fd: i64 = sys_openat_rd(path) 40 if fd < 0 { return 0 } 41 let b: *u8 = sys_mmap(8) 42 let r: i64 = sys_read(fd, b, 1) 43 sys_close(fd) 44 if r >= 1 { return 1 } 45 return 0 46} 47 48// One AXIS row: the industry code-review axis, the Nishi organ that implements it, and a PRESENT/ABSENT 49// verdict from opening that organ on disk. Data-driven -- add a row to extend coverage (Cardinal 11). 50// Returns 1 if the backing organ is present. 51func cr_axis(axis: *u8, organ: *u8, note: *u8) -> i64 { 52 let p: i64 = cr_present(organ) 53 cr_puts(" [" as *u8) 54 if p == 1 { cr_puts("PRESENT" as *u8) } else { cr_puts("ABSENT " as *u8) } 55 cr_puts("] " as *u8); cr_puts(axis) 56 cr_puts(" -> " as *u8); cr_puts(organ) 57 cr_puts("\n " as *u8); cr_puts(note); cr_puts("\n" as *u8) 58 return p 59} 60 61// Read a whole file into buf (cap bytes); return byte count (0 if missing/empty). 62func cr_read_file(path: *u8, buf: *u8, cap: i64) -> i64 { 63 let fd: i64 = sys_openat_rd(path) 64 if fd < 0 { return 0 } 65 var total: i64 = 0 66 var go: i64 = 1 67 while go == 1 { 68 let r: i64 = sys_read(fd, ((buf as i64) + total) as *u8, cap - total) 69 if r <= 0 { go = 0 } else { total = total + r; if total >= cap { go = 0 } } 70 } 71 sys_close(fd) 72 return total 73} 74 75// Find `needle` in buf[0..n) and parse the unsigned integer that follows it (skipping one space). Returns the 76// parsed value, or -1 if the needle is absent. Used to read the scanner's own "files = N" finding count out of 77// its captured report -- so the review count is READ FROM THE REAL TOOL OUTPUT, not recomputed here (Cardinal 15). 78func cr_int_after(buf: *u8, n: i64, needle: *u8) -> i64 { 79 var nl: i64 = 0 80 while needle[nl] != (0 as u8) { nl = nl + 1 } 81 var i: i64 = 0 82 while i + nl <= n { 83 var m: i64 = 0 84 var hit: i64 = 1 85 while m < nl { if buf[i + m] != needle[m] { hit = 0; m = nl } else { m = m + 1 } } 86 if hit == 1 { 87 // skip any non-digits (e.g. the space) until digits begin, then accumulate until a non-digit 88 var q: i64 = i + nl 89 var val: i64 = 0 90 var seen: i64 = 0 91 var done: i64 = 0 92 while q < n { 93 if done == 1 { q = n } else { 94 let c: i64 = buf[q] & 0xff 95 if c >= 48 { if c <= 57 { val = val * 10 + (c - 48); seen = 1 } else { if seen == 1 { done = 1 } } } 96 else { if seen == 1 { done = 1 } } 97 q = q + 1 98 } 99 } 100 if seen == 1 { return val } 101 return 0 - 1 102 } 103 i = i + 1 104 } 105 return 0 - 1 106} 107 108// String equality for argv dispatch. 109func cr_streq(a: *u8, b: *u8) -> i64 { 110 var i: i64 = 0 111 while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } 112 if b[i] != (0 as u8) { return 0 } 113 return 1 114} 115 116// Run the INSTALLED scanner (_offc/nx_antipattern_catalog.elf) in `scan` mode on `target`, capturing its report 117// into buf (cap bytes) via the child-stdout->tmp idiom (proven pd_beat). Returns byte count, or -1 if the 118// scanner did not run. This is the ONE place the real reviewer executes; every metric the coordinator reports is 119// READ FROM this captured tool output -- no detection logic is duplicated here (Cardinal 15). 120// General: fork+exec the installed scanner as `_offc/nx_antipattern_catalog.elf <mode> <arg>`, redirect its 121// stdout to scratch `tmp`, then read the report into buf (cap bytes). Returns byte count, or -1 if it never 122// execed. `scan`/`sweep`/`leaksweep` all exit 0, so the metric is read from the captured output, not the code. 123func cr_cat_run(mode: *u8, arg: *u8, tmp: *u8, buf: *u8, cap: i64) -> i64 { 124 let pid: i64 = sys_fork() 125 if pid == 0 { 126 let ofd: i64 = sys_openat_wr(tmp, 0x1a4) 127 if ofd >= 0 { sys_dup3(ofd, 1, 0); sys_dup3(ofd, 2, 0) } 128 let elf: *u8 = "_offc/nx_antipattern_catalog.elf\x00" as *u8 129 let argv: *i64 = sys_mmap(32) as *i64 130 argv[0] = elf as i64; argv[1] = mode as i64; argv[2] = arg as i64; argv[3] = 0 131 let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0 132 sys_execve(elf, argv, envp) 133 sys_exit(127) 134 } 135 let st: *i64 = sys_mmap(16) as *i64 136 sys_wait4(pid, st, 0) 137 if (st[0] % 128) != 0 { return 0 - 1 } 138 return cr_read_file(tmp, buf, cap) 139} 140func cr_scan_capture(target: *u8, tmp: *u8, buf: *u8, cap: i64) -> i64 { 141 return cr_cat_run("scan\x00" as *u8, target, tmp, buf, cap) 142} 143 144// Total findings the scanner reported for `target` (its own "files = N" line), or -1 on failure. 145func cr_scan_findings(target: *u8, tmp: *u8) -> i64 { 146 let buf: *u8 = sys_mmap(K_MAGIC_65536) 147 let n: i64 = cr_scan_capture(target, tmp, buf, K_MAGIC_65536) 148 if n <= 0 { return 0 - 1 } 149 return cr_int_after(buf, n, "files =\x00" as *u8) 150} 151 152// treat a -1 (field absent in the report) as 0 when summing blocking classes 153func cr_nn(v: i64) -> i64 { if v < 0 { return 0 } return v } 154 155// PRE-COMMIT GATE mode: `nx_code_review gate <file>...` -- run automated code review on each target and BLOCK 156// (exit nonzero) if any file has a blocking finding, so a build lane / engaging agent enforces it with one call 157// (`... gate <f> || reject`). BLOCKING = INCOMPLETE_WORK (unfinished code) + SOVEREIGNTY 3rd-party-exec (a 158// non-sovereign dep) + RESOURCE_WASTE mmap-in-loop (a GC-free leak). MAGIC_NUMBERS is ADVISORY (often legit RFC 159// consts) -> reported, never blocking. Each file is scanned individually so its counts are unambiguous. This is 160// the CI/pre-commit chokepoint made RUNNABLE (the axis that was mapped-only), composing the installed scanner. 161func cr_gate(argc: i64, argv: *i64) -> i64 { 162 cr_puts("=== nx_code_review GATE -- pre-commit automated review (block on incomplete / non-sovereign / leak) ===\n" as *u8) 163 let buf: *u8 = sys_mmap(K_MAGIC_65536) 164 var any_red: i64 = 0 165 var i: i64 = 2 166 while i < argc { 167 let target: *u8 = argv[i] as *u8 168 let n: i64 = cr_scan_capture(target, "/tmp/cr_gate_scan.txt\x00" as *u8, buf, K_MAGIC_65536) 169 if n <= 0 { 170 cr_puts(" [ERROR] scanner did not run on " as *u8); cr_puts(target); cr_puts("\n" as *u8) 171 any_red = 1 172 } else { 173 let incomplete: i64 = cr_nn(cr_int_after(buf, n, "markers=\x00" as *u8)) 174 let sov: i64 = cr_nn(cr_int_after(buf, n, "3rd-party-exec=\x00" as *u8)) 175 let res: i64 = cr_nn(cr_int_after(buf, n, "Cardinal 21)=\x00" as *u8)) 176 let magic: i64 = cr_nn(cr_int_after(buf, n, "Cardinal 11)=\x00" as *u8)) 177 let blocking: i64 = incomplete + sov + res 178 if blocking > 0 { 179 cr_puts(" [RED] " as *u8); cr_puts(target) 180 cr_puts(" blocking=" as *u8); cr_putn(blocking) 181 cr_puts(" (incomplete=" as *u8); cr_putn(incomplete); cr_puts(" sovereignty=" as *u8); cr_putn(sov); cr_puts(" leak=" as *u8); cr_putn(res) 182 cr_puts(") advisory magic=" as *u8); cr_putn(magic); cr_puts("\n" as *u8) 183 any_red = 1 184 } else { 185 cr_puts(" [GREEN] " as *u8); cr_puts(target); cr_puts(" no blocking findings advisory magic=" as *u8); cr_putn(magic); cr_puts("\n" as *u8) 186 } 187 } 188 i = i + 1 189 } 190 if any_red == 1 { cr_puts("NX-CODE-REVIEW GATE RED: blocking findings -- reject the submission (Cardinal 25: route to completion, never silently delete)\n" as *u8); sys_exit(1); return 1 } 191 cr_puts("NX-CODE-REVIEW GATE GREEN: no blocking findings -- submission may proceed\n" as *u8) 192 sys_exit(0); return 0 193} 194 195// AUDIT mode: `nx_code_review audit [dir]` (default runtime) -- the ecosystem SOTA scorecard. Composes the 196// installed scanner's own tree-sweeps (sweep = sovereignty hard-blockers; leaksweep = GC-free mmap leaks), 197// reads their per-file worklists + summary counts, and computes a CONSERVATIVE code-review clean floor. This 198// answers "audit what is already written, can we get it to SOTA" without forking per-file at 9k-file scale -- 199// the sweeps are inline in the scanner (fast). HONEST: the mechanical tier is a high-recall CANDIDATE generator 200// (verified false positives: PEM literals, vault-sourced passwords, 'vs ffmpeg' test labels) so the true clean 201// rate is HIGHER; the semantic (LLM-auditor) tier confirms. Emits EVAL-COORD for the aggregator. 202func cr_audit(argc: i64, argv: *i64) -> i64 { 203 var dir: *u8 = "runtime\x00" as *u8 204 if argc >= 3 { dir = argv[2] as *u8 } 205 cr_puts("=== nx_code_review AUDIT -- ecosystem code-review scorecard (installed-scanner sweeps of " as *u8); cr_puts(dir); cr_puts(") ===\n" as *u8) 206 let buf: *u8 = sys_mmap(K_MAGIC_2097152) // 2MB: holds the per-file worklist lines + the summary at the end 207 let ns: i64 = cr_cat_run("sweep\x00" as *u8, dir, "/tmp/cr_audit_sweep.txt\x00" as *u8, buf, K_MAGIC_2097152) 208 let total: i64 = cr_int_after(buf, ns, "scanned \x00" as *u8) 209 let sov: i64 = cr_int_after(buf, ns, "files, \x00" as *u8) 210 let nl: i64 = cr_cat_run("leaksweep\x00" as *u8, dir, "/tmp/cr_audit_leak.txt\x00" as *u8, buf, K_MAGIC_2097152) 211 let leak: i64 = cr_int_after(buf, nl, "files, \x00" as *u8) 212 if total <= 0 { 213 cr_puts(" AUDIT FAILED: could not read the sweep scan count (scanner not installed, or dir empty)\n" as *u8) 214 sys_exit(1); return 1 215 } 216 let sovc: i64 = cr_nn(sov) 217 let leakc: i64 = cr_nn(leak) 218 var dirty_ceiling: i64 = sovc + leakc 219 if dirty_ceiling > total { dirty_ceiling = total } 220 let clean_floor: i64 = total - dirty_ceiling 221 let permille: i64 = clean_floor * 1000 / total 222 cr_puts(" files scanned: " as *u8); cr_putn(total); cr_puts("\n" as *u8) 223 cr_puts(" SOVEREIGNTY candidates: " as *u8); cr_putn(sovc); cr_puts(" (3rd-party-exec hard blockers -> pure-NishiOS migration worklist -> /tmp/cr_audit_sweep.txt)\n" as *u8) 224 cr_puts(" RESOURCE-WASTE candidates: " as *u8); cr_putn(leakc); cr_puts(" (mmap-in-loop = GC-free leak-by-construction; daemons first -> /tmp/cr_audit_leak.txt)\n" as *u8) 225 cr_puts(" code-review clean FLOOR: " as *u8); cr_putn(clean_floor); cr_puts("/" as *u8); cr_putn(total); cr_puts(" = " as *u8); cr_putn(permille); cr_puts(" permille (CONSERVATIVE -- candidates over-report, so true SOTA rate is HIGHER)\n" as *u8) 226 cr_puts(" HONEST: mechanical tier = high-recall CANDIDATE generator (verified false positives: PEM literals, vault-sourced pw, 'vs ffmpeg' test labels). Semantic (LLM-auditor) tier confirms. INCOMPLETE-WORK at tree scale belongs in a catalog markersweep mode (DRY; inline here would self-flag this scanner file).\n" as *u8) 227 cr_puts(" EVAL-COORD name=nx_code_review_audit coverage=CODE-REVIEW-AUDIT files=" as *u8); cr_putn(total); cr_puts(" sov=" as *u8); cr_putn(sovc); cr_puts(" leak=" as *u8); cr_putn(leakc); cr_puts(" clean_floor_permille=" as *u8); cr_putn(permille); cr_puts("\n" as *u8) 228 cr_puts("NX-CODE-REVIEW-AUDIT GREEN: ecosystem swept, per-file worklists emitted for owner routing\n" as *u8) 229 sys_exit(0); return 0 230} 231 232// fork+exec an installed elf with NO args, stdout->tmp, return WEXITSTATUS (or -1 if killed/never-execed). A 233// PATH is passed so a child that shells out to the bootstrap assembler/linker (as/ld) resolves them. 234func cr_run_elf(elf: *u8, tmp: *u8) -> i64 { 235 let pid: i64 = sys_fork() 236 if pid == 0 { 237 let ofd: i64 = sys_openat_wr(tmp, 0x1a4) 238 if ofd >= 0 { sys_dup3(ofd, 1, 0); sys_dup3(ofd, 2, 0) } 239 let argv: *i64 = sys_mmap(16) as *i64 240 argv[0] = elf as i64; argv[1] = 0 241 let envp: *i64 = sys_mmap(16) as *i64 242 envp[0] = "PATH=/usr/bin:/bin\x00" as *u8 as i64; envp[1] = 0 243 sys_execve(elf, argv, envp) 244 sys_exit(127) 245 } 246 let st: *i64 = sys_mmap(16) as *i64 247 sys_wait4(pid, st, 0) 248 if (st[0] % 128) != 0 { return 0 - 1 } 249 return (st[0] >> 8) & 0xff 250} 251 252// NISHISAFETY mode: `nx_code_review nishisafety` -- LIVE-EXECUTE the NishiLang compile-safety axis (axis 12). 253// Runs the differential compile witness nx_cc_health (generates a 1000-function program, compiles it with nx_cc, 254// runs it, verifies the fall-through marker). exit 0 = nx_cc is emitting CORRECT code at scale; nonzero = a 255// silent-miscompile regression (the worst 'garbage' -- code that looks fine but the compiler mistranslates). 256// This upgrades axis 12 from mapped (present-on-disk) to rung-4 EXECUTING -- the honest compile-CORRECTNESS 257// check that static lint provably cannot do (verified: the documented footguns do not reproduce statically). 258func cr_nishisafety() -> i64 { 259 cr_puts("=== nx_code_review NISHISAFETY -- live NishiLang compile-safety (differential witness nx_cc_health) ===\n" as *u8) 260 let ec: i64 = cr_run_elf("_offc/nx_cc_health.elf\x00" as *u8, "/tmp/cr_nishisafety.txt\x00" as *u8) 261 cr_puts(" nx_cc_health (build + run a 1000-function program, verify correctness) -> exit " as *u8); cr_putn(ec); cr_puts("\n" as *u8) 262 if ec == 0 { 263 cr_puts("NX-CODE-REVIEW-NISHISAFETY GREEN: nx_cc emits CORRECT code at 1000-function scale -- no silent miscompile (axis 12 EXECUTING)\n" as *u8) 264 sys_exit(0); return 0 265 } 266 cr_puts("NX-CODE-REVIEW-NISHISAFETY RED: compiler regression (silent-miscompile risk) -- route to the NishiLang compiler owner; do NOT ship NishiLang until GREEN\n" as *u8) 267 sys_exit(1); return 1 268} 269 270func main(argc: i64, argv: *i64) -> i64 { 271 // MODES: `gate <file>...` = pre-commit chokepoint; `audit [dir]` = ecosystem SOTA scorecard. 272 if argc >= 2 { 273 if cr_streq(argv[1] as *u8, "gate\x00" as *u8) == 1 { 274 if argc < 3 { cr_puts("usage: nx_code_review gate <file>...\n" as *u8); sys_exit(2); return 2 } 275 return cr_gate(argc, argv) 276 } 277 if cr_streq(argv[1] as *u8, "audit\x00" as *u8) == 1 { return cr_audit(argc, argv) } 278 if cr_streq(argv[1] as *u8, "nishisafety\x00" as *u8) == 1 { return cr_nishisafety() } 279 } 280 cr_puts("=== nx_code_review -- Automated Code Review coordinator (industry definition -> sovereign organs, proven live) ===\n" as *u8) 281 cr_puts(" grounding: en.wikipedia.org/wiki/Automated_code_review -- tools that review SOURCE for defects, style/convention\n" as *u8) 282 cr_puts(" violations, security vulnerabilities and maintainability; static-analysis/linting; run in IDE + CI;\n" as *u8) 283 cr_puts(" enforce architecture constraints; COMPLEMENT manual review. Each axis below maps to a Nishi organ.\n\n" as *u8) 284 285 cr_puts(" ---- AXIS MAP (each industry code-review axis -> the Nishi organ that implements it; verdict = organ opened on disk) ----\n" as *u8) 286 var axes: i64 = 0 287 var present: i64 = 0 288 var r: i64 = 0 289 r = cr_axis("LINTING / STATIC ANALYSIS (the core: Lint/SonarJ-class scanner)" as *u8, "runtime/nx_antipattern_catalog.nx" as *u8, "mechanical scanner: markers(TODO/STUB), magic-numbers, mmap-leak, sovereignty; 162-pattern catalog" as *u8); axes = axes + 1; present = present + r 290 r = cr_axis("CODING CONVENTIONS / MAINTAINABILITY (SonarQube S138/S134/S109, clippy)" as *u8, "runtime/nx_quality_grade.nx" as *u8, "triangulated grader: SonarQube + clippy + Elm + NASA Power-of-10 + CERT -> A..F card" as *u8); axes = axes + 1; present = present + r 291 r = cr_axis("BUGS / DEFECTS / CORRECTNESS (defect detection)" as *u8, "runtime/nx_rung_eval.nx" as *u8, "prove-not-assert: opens the real artifact + checks it, hardware rung up; never reads back a claim" as *u8); axes = axes + 1; present = present + r 292 r = cr_axis("SECURITY VULNERABILITIES (SAST in CI/CD)" as *u8, "runtime/_hdl_build/nx_security_audit.nx" as *u8, "security posture audit; pairs with the secret-leak scanner below" as *u8); axes = axes + 1; present = present + r 293 r = cr_axis("SECRET / CREDENTIAL LEAK (SAST)" as *u8, "runtime/_hdl_build/nx_secret_scan_gate.nx" as *u8, "plaintext-credential detector with KATs; catches keys/passwords committed to source" as *u8); axes = axes + 1; present = present + r 294 r = cr_axis("ARCHITECTURE CONSTRAINTS (Structure101-class: circular deps)" as *u8, "runtime/hub/nx_dep_graph.nx" as *u8, "dependency graph + SCC -> circular-dependency / layering-violation enforcement" as *u8); axes = axes + 1; present = present + r 295 r = cr_axis("MAGIC NUMBERS / ARBITRARY CAPS (the 20fps-hard-cap class)" as *u8, "runtime/_hdl_build/nx_magicnum_benchmark.nx" as *u8, "Cardinal-11 detector: numeric literal not in a named const/config = a flag" as *u8); axes = axes + 1; present = present + r 296 r = cr_axis("EVIDENCE-NOT-ASSERTION (claim vs metric alignment)" as *u8, "runtime/nx_claim_metric_audit.nx" as *u8, "a quality/exceed claim is grounded only with a real reference AND a can-fail control; else flagged" as *u8); axes = axes + 1; present = present + r 297 r = cr_axis("LICENSE / PROVENANCE (our sovereignty axis, beyond the industry def)" as *u8, "runtime/nx_license_wall_audit.nx" as *u8, "3rd-party/patent/license contamination wall -- code review for independence, not just correctness" as *u8); axes = axes + 1; present = present + r 298 r = cr_axis("PRE-COMMIT / CI GATE (block bad code before it merges/ships)" as *u8, "runtime/nx_deploy_guard.nx" as *u8, "adversarial deploy CI -- nothing ships past RED; the far-end chokepoint of the review pipeline" as *u8); axes = axes + 1; present = present + r 299 r = cr_axis("CONTINUOUS / ON-CADENCE (review runs automatically, every beat)" as *u8, "runtime/_hdl_build/nx_team_pulse.nx" as *u8, "the Conductor loop re-runs the graders (quality/security/audit/census) each beat -- the 'running' part" as *u8); axes = axes + 1; present = present + r 300 r = cr_axis("NISHILANG COMPILE-SAFETY (silent-miscompile / differential oracle -- SOTA for the nishi language, beyond the industry def)" as *u8, "runtime/nx_cc_equiv_gate.nx" as *u8, "differential/EMI oracle (baseline-cc vs challenger: byte-equal stdout + self-host stage) catches SHAPE-dependent silent miscompiles that static lint provably cannot (verified: 17-arg + call-in-store footguns do NOT reproduce statically); regression witness = nx_cc_health" as *u8); axes = axes + 1; present = present + r 301 r = cr_axis("BINARY SOVEREIGNTY (the SHIPPED ELF has 0 dynamic deps -- beyond the industry def)" as *u8, "runtime/nx_elf_inspect.nx" as *u8, "sovereign ELF inspector parses program headers for PT_INTERP + DT_NEEDED (no file/readelf shell tools): source-scan proves no lib REFERENCES, this proves the artifact has no lib DEPENDENCIES; verified vs the readelf oracle (nishi organ STATIC / glibc binary DYNAMIC)" as *u8); axes = axes + 1; present = present + r 302 r = cr_axis("RESOURCE UTILIZATION / PARALLELISM (single-threaded vs full-core -- the codec-catch)" as *u8, "runtime/nx_parallelism_probe.nx" as *u8, "measures CPU-time/wall-time = effective cores used (via wait4 rusage): catches a silently SINGLE-THREADED compute hot path (the wasted-months-on-a-serial-codec failure) in seconds -- verified serial=1.00. NOTE 2026-07-06: ecosystem THREAD-parallelism is toolchain-blocked (3 layers: func-types / nxasm trampoline / clone segfault); process-parallelism via fork WORKS (8x proven)" as *u8); axes = axes + 1; present = present + r 303 304 let permille: i64 = present * 1000 / axes 305 cr_puts("\n coverage: " as *u8); cr_putn(present); cr_puts("/" as *u8); cr_putn(axes) 306 cr_puts(" axes backed by a real organ on disk (" as *u8); cr_putn(permille); cr_puts(" permille)\n" as *u8) 307 308 cr_puts("\n ---- LIVE REVIEW (prove it RUNS + discriminates: drive the installed scanner on real controls) ----\n" as *u8) 309 let dirty: i64 = cr_scan_findings("runtime/nx_ml_dsa_65.nx\x00" as *u8, "/tmp/cr_scan_dirty.txt\x00" as *u8) 310 let clean: i64 = cr_scan_findings("runtime/nx_ecdsa_p256.nx\x00" as *u8, "/tmp/cr_scan_clean.txt\x00" as *u8) 311 cr_puts(" scan dirty control (nx_ml_dsa_65, a skeleton) -> findings=" as *u8); cr_putn(dirty) 312 cr_puts("\n scan clean control (nx_ecdsa_p256, a primitive) -> findings=" as *u8); cr_putn(clean); cr_puts("\n" as *u8) 313 var runs: i64 = 0 314 if dirty > 0 { if clean == 0 { runs = 1 } } 315 if runs == 1 { cr_puts(" RUNS + DISCRIMINATES (dirty trips findings, clean scores 0 = the can-fail control held)\n" as *u8) } else { cr_puts(" DID NOT DISCRIMINATE (review plane down, scanner not installed, or controls changed)\n" as *u8) } 316 317 // ---- LIAR-KILL (self-verification, prove-not-assert on THIS organ): the presence scan must find real 318 // organs AND must NOT fabricate a hit for a file that does not exist; and the live review must have run. If 319 // any control fails, this coordinator declares ITSELF broken (exit 1) rather than print a trusted verdict. 320 let ghost: i64 = cr_present("runtime/nx_does_not_exist_cr_zzz9.nx\x00" as *u8) 321 var ok: i64 = 1 322 if present < 1 { ok = 0 } // must open at least one real organ (scanner reads disk) 323 if ghost != 0 { ok = 0 } // a nonexistent file must read ABSENT (no fabricated presence) 324 if runs != 1 { ok = 0 } // the automated review must actually execute + self-can 325 326 cr_puts("\n ---- COORDINATION (full-coverage evaluator system) ----\n" as *u8) 327 cr_puts(" EVAL-COORD name=nx_code_review coverage=CODE-REVIEW axes=" as *u8); cr_putn(axes) 328 cr_puts(" present=" as *u8); cr_putn(present); cr_puts(" permille=" as *u8); cr_putn(permille) 329 cr_puts(" live_review=" as *u8); if runs == 1 { cr_puts("RUNS" as *u8) } else { cr_puts("DOWN" as *u8) } 330 cr_puts("\n" as *u8) 331 332 if ok == 1 { 333 cr_puts(" liar-kill PASS: real organs opened (" as *u8); cr_putn(present); cr_puts("), ghost file read ABSENT, live scan discriminated dirty vs clean -> coordinator PROVEN honest\n" as *u8) 334 cr_puts("NX-CODE-REVIEW GREEN: automated code review present (" as *u8); cr_putn(present); cr_puts("/" as *u8); cr_putn(axes) 335 cr_puts(" axes on real organs) AND running (installed scanner executes + discriminates findings on real source)\n" as *u8) 336 sys_exit(0); return 0 337 } 338 cr_puts("NX-CODE-REVIEW RED: controls failed (present=" as *u8); cr_putn(present); cr_puts(" ghost=" as *u8); cr_putn(ghost); cr_puts(" runs=" as *u8); cr_putn(runs); cr_puts(") -- fix before trusting the verdict\n" as *u8) 339 sys_exit(1); return 1 340}