nx_commons_lib.nx source
↩ module page · 197 lines · 11446 B
1// nx_commons_lib.nx -- NETWORK standing for a neighbour commons. The replacement for the pairwise
2// tolerance-ratio rule in nx_mycorrhiza (nx_my_audit_kind) / nx_hypha (nx_hy_reciprocity_verdict).
3//
4// WHY THE INCUMBENT HAD TO BE REPLACED (measured by nx_commonsbench_gate, not asserted):
5// the pairwise rule scores 1/5 teeth and 190 permil ordering agreement -- WORSE THAN CHANCE.
6// It ranks a 3-identity sybil ring FIRST, ranks the skimmer above every person who works, and
7// FLAGS AS AN EXTRACTOR the most generous member in the population. The reason is structural:
8// AN EXTRACTOR IS BALANCED WITH EVERY COUNTERPARTY AND NET-NEGATIVE ON THE NETWORK.
9// A PAIRWISE AUDIT IS THEREFORE STRUCTURALLY BLIND TO THE CLASS.
10// The rent-extractor always renders each counterparty a fee-justifying service, so every pairwise
11// audit returns BALANCED. And the same ratio test fires on the nurse, because generosity is
12// indistinguishable from imbalance to a ratio.
13//
14// THE KNOWN GOOD WE MATCH INSTEAD (biology, not invention): mycorrhizal networks sanction cheaters
15// by BIDIRECTIONAL PREFERENTIAL ALLOCATION (Kiers et al., Science 2011) -- the fungus routes
16// phosphorus preferentially to roots that delivered more carbon, and the plant routes carbon to
17// fungi that delivered more phosphorus. Cheating is never forbidden; it is made UNPROFITABLE by the
18// allocation gradient. That is the only anti-capture mechanism that survives a powerful adversary:
19// you cannot ban a predator class that can buy the rule-makers, but you can make predation return
20// less than reciprocity BY CONSTRUCTION.
21//
22// FOUR TERMS, each earning its place against a named attack:
23// 1. WITNESS -- only giving attested by a THIRD PARTY (not the counterparty you billed)
24// counts. Kills the sybil ring, which can manufacture volume but not witnesses.
25// 2. FLOW-THROUGH -- what you took and did NOT pass onward is a debt to the commons. Catches the
26// extractor, whose pairwise books are immaculate. A flow is not hoardable.
27// 3. TRUST-FLOW CAP -- standing is bounded by INDEPENDENT counterparties, so an attacker's total
28// claim is capped by the honest edges they must actually earn, NOT by how many
29// identities or how much capital they hold. Money buys identities, hardware and
30// stake; it cannot buy witnessed reciprocal history.
31// 4. DECAY -- standing that stops renewing fades, so year-1 founders never outrank an
32// active member forever. This is the anti-ossification tooth; every co-op that
33// calcified into an oligarchy lacked it.
34//
35// RED-TEAM OF THIS RULE, BY ITS AUTHOR, BEFORE SHIPPING -- one attack changed the design:
36// A. "buy witnesses" -> witness rises but flow-through still convicts. Survives.
37// B. "pass value on to my OWN sybils" -> DEFEATED THE FIRST DRAFT. Flow-through can be faked by
38// circulating inside your own ring. FIX: the term is passed_OUTSIDE, never passed. A transfer
39// to an identity you control is not circulation, it is laundering.
40// C. "ring buys one honest witness" -> the cap converts one bought edge into ONE edge of standing
41// instead of the ring's whole manufactured volume. Bounded, which is the entire point.
42//
43// SIGNED, NOT CLAMPED: raw standing may go negative. A debt to the commons is a real quantity and
44// clamping it at zero is exactly what lets a large extractor hide among small ones -- it is the same
45// defect class as REFUSE, NEVER SILENTLY SHRINK.
46//
47// Integer only, no floats. Thresholds are named consts (law 11), caller-overridable per commons.
48// license_tier: ORIGINAL
49import "nx_syscalls.nx"
50
51const NXC_SCALE: i64 = 1000 // permil scale for witness + recency
52const NXC_CAP_PER_PARTNER: i64 = 100 // trust-flow: standing admitted per INDEPENDENT counterparty
53const NXC_GRACE: i64 = 300 // starter quota: the un-started are NEUTRAL, never zero
54
55// verdict classes
56const NXC_V_PILLAR: i64 = 4 // large witnessed net contributor
57const NXC_V_MEMBER: i64 = 3 // net contributor
58const NXC_V_GRACE: i64 = 2 // newcomer, not yet started -- protected
59const NXC_V_THROTTLE: i64 = 1 // net taker within learning bounds
60const NXC_V_EXTRACTOR: i64 = 0 // takes and does not pass on -- starved by the gradient
61
62const NXC_PILLAR_FLOOR: i64 = 1000
63const NXC_MEMBER_FLOOR: i64 = 1
64
65// ---- term 1+4: witnessed, decayed giving ----------------------------------------------------
66// Only what a third party attests counts, and it fades as it ages. Multiply BEFORE dividing so the
67// integer path keeps its precision.
68func nxc_effective_given(gave: i64, witnessed_permil: i64, recent_permil: i64) -> i64 {
69 if gave <= 0 { return 0 }
70 var w: i64 = witnessed_permil
71 if w < 0 { w = 0 }
72 if w > NXC_SCALE { w = NXC_SCALE }
73 var r: i64 = recent_permil
74 if r < 0 { r = 0 }
75 if r > NXC_SCALE { r = NXC_SCALE }
76 let witnessed: i64 = (gave * w) / NXC_SCALE
77 return (witnessed * r) / NXC_SCALE
78}
79
80// ---- term 2: flow-through --------------------------------------------------------------------
81// What you took and did not pass to an INDEPENDENT party. passed_outside, never passed: a transfer
82// to an identity you control is laundering, not circulation (red-team B).
83func nxc_retained(took: i64, passed_outside: i64) -> i64 {
84 var t: i64 = took
85 if t < 0 { t = 0 }
86 var p: i64 = passed_outside
87 if p < 0 { p = 0 }
88 if p > t { p = t }
89 return t - p
90}
91
92// ---- raw standing (signed) -------------------------------------------------------------------
93func nxc_raw_standing(gave: i64, took: i64, passed_outside: i64,
94 witnessed_permil: i64, recent_permil: i64) -> i64 {
95 let eff: i64 = nxc_effective_given(gave, witnessed_permil, recent_permil)
96 let ret: i64 = nxc_retained(took, passed_outside)
97 return eff - ret
98}
99
100// ---- term 3: trust-flow cap + starter grace ---------------------------------------------------
101// The cap binds ABOVE only -- it never lifts a debtor. An actor who has not started at all gets the
102// grace floor instead: the un-started and the fraudulent must not be confused, and the thing that
103// separates them is ACTIVITY, not connectivity.
104func nxc_standing(gave: i64, took: i64, passed_outside: i64,
105 witnessed_permil: i64, recent_permil: i64,
106 outside_partners: i64) -> i64 {
107 if gave + took == 0 { return NXC_GRACE }
108 var raw: i64 = nxc_raw_standing(gave, took, passed_outside, witnessed_permil, recent_permil)
109 var cap: i64 = outside_partners * NXC_CAP_PER_PARTNER
110 if cap < 0 { cap = 0 }
111 if raw > cap { raw = cap }
112 return raw
113}
114
115// ---- THE CAP IS A RATE, AND A RATE MUST BE DECLARED -------------------------------------------
116// MEASURED 2026-08-07 against the estate's own 2,018-edge import graph (1,233 organs): the fixed
117// NXC_CAP_PER_PARTNER=100 above made the trust-flow cap bind for **0 of 1,233**. nx_syscalls carries
118// 740 partners, so its cap is 74,000 against a standing of 666 -- the bound is 111x the quantity it
119// bounds and can never fire. The constant was calibrated against a fixture whose `gave` was in
120// MAGNITUDE units (900..2000) across 2..40 partners; on COUNT-scale data it is ~100x too loose.
121// ★★★★★★ A BOUND WITH AN UNDECLARED UNIT IS CALIBRATED ONLY FOR THE FIXTURE IT WAS BORN IN.
122// Same defect class as the count-vs-magnitude bug fixed in nx_hypha, and as the vacuous governance
123// guard deleted the same session: three bounds-that-cannot-bind in one day, all of them mine, all of
124// them invisible until real data arrived. FIXTURES PROVE MATH, NEVER SCALE.
125// So the cap is a RATE -- standing admitted per independent partner -- and an undeclared rate REFUSES
126// rather than defaulting to a flattering number, exactly as nx_commons_price refuses an undeclared
127// exchange rate. The legacy nxc_standing is left untouched (law 19); new callers take this.
128const NXC_RATE_UNDECLARED: i64 = 0 - 1
129
130func nxc_standing_rated(gave: i64, took: i64, passed_outside: i64,
131 witnessed_permil: i64, recent_permil: i64,
132 outside_partners: i64, cap_per_partner: i64) -> i64 {
133 if cap_per_partner == NXC_RATE_UNDECLARED { return NXC_RATE_UNDECLARED }
134 if cap_per_partner < 0 { return NXC_RATE_UNDECLARED }
135 if gave + took == 0 { return NXC_GRACE }
136 var raw: i64 = nxc_raw_standing(gave, took, passed_outside, witnessed_permil, recent_permil)
137 var cap: i64 = outside_partners * cap_per_partner
138 if cap < 0 { cap = 0 }
139 if raw > cap { raw = cap }
140 return raw
141}
142
143// Did the cap actually bind? A bound nobody can reach is not a bound, and the only way to know is to
144// ask. Exposed so a caller can MEASURE vacuity instead of assuming the guard works.
145func nxc_cap_bound(gave: i64, took: i64, passed_outside: i64,
146 witnessed_permil: i64, recent_permil: i64,
147 outside_partners: i64, cap_per_partner: i64) -> i64 {
148 if cap_per_partner < 0 { return 0 }
149 let raw: i64 = nxc_raw_standing(gave, took, passed_outside, witnessed_permil, recent_permil)
150 let cap: i64 = outside_partners * cap_per_partner
151 if raw > cap { return 1 }
152 return 0
153}
154
155// ---- extractor predicate ----------------------------------------------------------------------
156// Not a ratio. You are an extractor when what you kept exceeds what you are attested to have given.
157// A huge net GIVER can never trip this, which is the property the pairwise rule lacked.
158func nxc_is_extractor(gave: i64, took: i64, passed_outside: i64,
159 witnessed_permil: i64, recent_permil: i64) -> i64 {
160 if gave + took == 0 { return 0 }
161 let eff: i64 = nxc_effective_given(gave, witnessed_permil, recent_permil)
162 let ret: i64 = nxc_retained(took, passed_outside)
163 if ret > eff { return 1 }
164 return 0
165}
166
167// ---- verdict ------------------------------------------------------------------------------------
168func nxc_verdict(gave: i64, took: i64, passed_outside: i64,
169 witnessed_permil: i64, recent_permil: i64,
170 outside_partners: i64) -> i64 {
171 if gave + took == 0 { return NXC_V_GRACE }
172 let s: i64 = nxc_standing(gave, took, passed_outside, witnessed_permil, recent_permil, outside_partners)
173 if nxc_is_extractor(gave, took, passed_outside, witnessed_permil, recent_permil) == 1 {
174 if s < 0 { return NXC_V_EXTRACTOR }
175 return NXC_V_THROTTLE
176 }
177 if s >= NXC_PILLAR_FLOOR { return NXC_V_PILLAR }
178 if s >= NXC_MEMBER_FLOOR { return NXC_V_MEMBER }
179 return NXC_V_THROTTLE
180}
181
182// ---- THE INCUMBENT, kept as a NEGATIVE CONTROL --------------------------------------------------
183// Kept in the library on purpose, exactly as nx_connect_match_lib keeps the arithmetic mean beside
184// the harmonic mean: the gate must be able to prove WHICH rule does the work. Delete this and the
185// next author cannot reproduce the comparison that justified the replacement.
186func nxc_incumbent_pairwise_standing(worst_pair_ratio_q10: i64) -> i64 {
187 var r: i64 = worst_pair_ratio_q10
188 if r < 1024 { r = 1024 }
189 var s: i64 = (1024 * 1000) / r
190 if s > 1000 { s = 1000 }
191 return s
192}
193
194func nxc_incumbent_pairwise_flags(worst_pair_ratio_q10: i64) -> i64 {
195 if worst_pair_ratio_q10 > 2048 { return 1 }
196 return 0
197}