nx_compare_ladder_projection_gate.nx source

1// Local-only gate candidate. Requires actual native compilation/run before any claim of correctness. 2import "nx_gate_verdict.nx" 3import "nx_swcompare_ladder_candidate.nx" 4func sg_fixture(plan: *u8) -> *SgPlan { 5 return sg_parse(plan, sg_len(plan), "" as *u8, 0, "matrix" as *u8, 6) 6} 7func main() -> i64 { 8 let ctr: *i64 = gv_ctr() 9 gv_head("compare ladder -- declared graph and byte-bound rank" as *u8) 10 let m0: *SgPlan = sg_fixture("rung|A|Root|symbol_a|assertion|auto|1h|-\nrung|B|Child|symbol_b|assertion|human|2h|A" as *u8) 11 gv_check_eq("two node graph valid" as *u8, sg_valid(m0), 1, ctr) 12 gv_check_eq("edge retained" as *u8, m0.edge_count, 1, ctr) 13 gv_check_eq("unbound rank absent" as *u8, streq(sg_rank_state(m0), "UNAVAILABLE" as *u8), 1, ctr) 14 let m1: *SgPlan = sg_fixture("rung|A|Root|symbol_a|assertion|auto|1h|-\r\nrung|B|Child|symbol_b|assertion|human|2h|A\r\n" as *u8) 15 gv_check_eq("CRLF graph" as *u8, sg_valid(m1), 1, ctr) 16 gv_check_eq("CRLF count" as *u8, m1.count, 2, ctr) 17 let m2: *SgPlan = sg_fixture("rung|A|Root|symbol_a|assertion|auto|1h|-" as *u8) 18 gv_check_eq("no trailing newline" as *u8, sg_valid(m2), 1, ctr) 19 let m3: *SgPlan = sg_fixture("rung|A|Root|symbol_a|assertion|auto|1h|-\nrung|A|Root|symbol_a|assertion|auto|1h|-" as *u8) 20 gv_check_eq("duplicate node" as *u8, m3.duplicate_ids, 1, ctr) 21 let m4: *SgPlan = sg_fixture("rung|A|Root|symbol_a|assertion|auto|1h|-\nrung|B|Child|symbol_b|assertion|human|2h|A,A" as *u8) 22 gv_check_eq("duplicate edge" as *u8, m4.duplicate_edges, 1, ctr) 23 let m5: *SgPlan = sg_fixture("rung|B|Child|symbol_b|assertion|human|2h|A" as *u8) 24 gv_check_eq("missing prerequisite" as *u8, m5.missing_deps, 1, ctr) 25 let m6: *SgPlan = sg_fixture("rung|A|Root|symbol_a|assertion|auto|1h|-\nrung|B|Child|symbol_b|assertion|human|2h|AA" as *u8) 26 gv_check_eq("substring is not ID" as *u8, m6.missing_deps, 1, ctr) 27 let m7: *SgPlan = sg_fixture("rung|A|Root|symbol_a|assertion|auto|1h|A" as *u8) 28 gv_check_eq("self cycle" as *u8, m7.cyclic_nodes, 1, ctr) 29 let m8: *SgPlan = sg_fixture("rung|A|Root|symbol_a|assertion|auto|1h|B\nrung|B|Child|symbol_b|assertion|human|2h|A" as *u8) 30 gv_check_eq("two node cycle" as *u8, m8.cyclic_nodes, 2, ctr) 31 let m9: *SgPlan = sg_fixture("rung|A|Root|symbol_a|assertion|auto|1h|-\nrung|B|Child|symbol_b|assertion|human|2h|../A" as *u8) 32 gv_check_eq("traversal dependency" as *u8, m9.malformed, 1, ctr) 33 let m10: *SgPlan = sg_fixture("rung|../A|Root|symbol_a|assertion|auto|1h|-" as *u8) 34 gv_check_eq("traversal ID" as *u8, m10.malformed, 1, ctr) 35 let m11: *SgPlan = sg_fixture("rung||Root|symbol_a|assertion|auto|1h|-" as *u8) 36 gv_check_eq("empty ID" as *u8, m11.malformed, 1, ctr) 37 let m12: *SgPlan = sg_fixture("rung|A|Root|symbol_a|assertion|auto|1h|-|extra" as *u8) 38 gv_check_eq("extra field not truncated" as *u8, m12.malformed, 1, ctr) 39 let m13: *SgPlan = sg_fixture("rung|A|Root|symbol_a|assertion|auto|1h" as *u8) 40 gv_check_eq("missing field" as *u8, m13.malformed, 1, ctr) 41 let m14: *SgPlan = sg_fixture("rung|A|Root|symbol_a|assertion|auto|1h|-\nrung|B|Child|symbol_b|assertion|human|2h|A," as *u8) 42 gv_check_eq("empty trailing prerequisite" as *u8, m14.malformed, 1, ctr) 43 let m15: *SgPlan = sg_fixture("# rung|comment|not|a|real|node|1h|-\nrung|A|Root|symbol_a|assertion|auto|1h|-" as *u8) 44 gv_check_eq("comment ignored" as *u8, m15.count, 1, ctr) 45 gv_check_eq("decimal overflow" as *u8, sg_decimal("9223372036854775808" as *u8), -1, ctr) 46 gv_check_eq("decimal trailing noise" as *u8, sg_decimal("21x" as *u8), -1, ctr) 47 let nul: *u8 = sys_mmap(3) 48 nul[0] = 65 as u8; nul[1] = 0 as u8; nul[2] = 66 as u8 49 let nm: *SgPlan = sg_parse(nul, 3, "" as *u8, 0, "matrix" as *u8, 6) 50 gv_check_eq("raw NUL invalid" as *u8, sg_valid(nm), 0, ctr) 51 let nullm: *SgPlan = sg_parse(0 as *u8, 3, "" as *u8, 0, "matrix" as *u8, 6) 52 gv_check_eq("null positive-length input" as *u8, sg_valid(nullm), 0, ctr) 53 let p: *u8 = "rung|A|Root|symbol_a|assertion|auto|1h|-\nrung|B|Child|symbol_b|assertion|human|2h|A" as *u8 54 let r: *u8 = "# asof=1788810000 domain=fixture rungs=2\nrank|x|x|A|x|x|x|x|x|symbol_a\n" as *u8 55 let unbound: *SgPlan = sg_parse(p, sg_len(p), r, sg_len(r), "matrix" as *u8, 6) 56 gv_check_eq("counts do not establish binding" as *u8, streq(sg_rank_state(unbound), "UNBOUND" as *u8), 1, ctr) 57 let stamped: *u8 = sys_mmap(1024) 58 var at: i64 = scopy(stamped, 0, "# inputs_v=1 plan_sha256=" as *u8) 59 at = scopy(stamped, at, unbound.plan_sha) 60 at = scopy(stamped, at, " plan_bytes=83 matrix_sha256=" as *u8) 61 at = scopy(stamped, at, unbound.matrix_sha) 62 at = scopy(stamped, at, " matrix_bytes=6\n" as *u8) 63 let binding_bytes: i64 = at 64 at = scopy(stamped, at, r); stamped[at] = 0 as u8 65 let bound: *SgPlan = sg_parse(p, sg_len(p), stamped, at, "matrix" as *u8, 6) 66 gv_check_eq("exact source binding" as *u8, streq(sg_rank_state(bound), "PLAN_MATRIX_BOUND_ONLY" as *u8), 1, ctr) 67 let changed: *SgPlan = sg_parse(p, sg_len(p), stamped, at, "Matrix" as *u8, 6) 68 gv_check_eq("same size matrix changed" as *u8, changed.binding_ok, 0, ctr) 69 let duplicate: *u8 = sys_mmap(at + binding_bytes + 1) 70 var d: i64 = 0 71 while d < at { duplicate[d] = stamped[d]; d = d + 1 } 72 var k: i64 = 0 73 while k < binding_bytes { duplicate[d+k] = stamped[k]; k = k + 1 } 74 duplicate[d+k] = 0 as u8 75 let db: *SgPlan = sg_parse(p, sg_len(p), duplicate, d+k, "matrix" as *u8, 6) 76 gv_check_eq("duplicate bindings refused" as *u8, db.binding_ok, 0, ctr) 77 gv_check_eq("duplicate binding diagnostic" as *u8, streq(sg_rank_state(db), "INVALID_BINDING" as *u8), 1, ctr) 78 let stale16: *u8 = "# asof=1788810000 domain=fixture rungs=1\nrank|x|x|A|x|x|x|x|x|symbol_a\n" as *u8 79 let sm16: *SgPlan = sg_parse(p, sg_len(p), stale16, sg_len(stale16), "matrix" as *u8, 6) 80 gv_check_eq("stale count" as *u8, streq(sg_rank_state(sm16), "STALE_INCONSISTENT" as *u8), 1, ctr) 81 let stale17: *u8 = "# asof=1788810000 domain=fixture rungs=2\nrank|x|x|A|x|x|x|x|x|old_symbol\n" as *u8 82 let sm17: *SgPlan = sg_parse(p, sg_len(p), stale17, sg_len(stale17), "matrix" as *u8, 6) 83 gv_check_eq("stale symbol" as *u8, streq(sg_rank_state(sm17), "STALE_INCONSISTENT" as *u8), 1, ctr) 84 let stale18: *u8 = "# asof=1788810000 domain=fixture rungs=2\nrank|x|x|A|x|x|x|x|x|symbol_a\n# asof=1788810000 domain=fixture rungs=2\n" as *u8 85 let sm18: *SgPlan = sg_parse(p, sg_len(p), stale18, sg_len(stale18), "matrix" as *u8, 6) 86 gv_check_eq("duplicate asof" as *u8, streq(sg_rank_state(sm18), "STALE_INCONSISTENT" as *u8), 1, ctr) 87 let m19: *SgPlan = sg_fixture("rung|DP0|Never-brick deploy|deploy_status|Stage, promote, async health watchdog, auto-rollback -- LANDED and self-applied|Organ|0|-\nrung|DP1|Instant rollback|ma_do_rollback|.prev restore via POST /api/rollback -- LANDED (symbol corrected 2026-09-02: `rollback` was a word, ma_do_rollback is the handler)|Organ|0|DP0\nrung|DP2|Fail-closed target registry|md_upload_target_ok|Every deployable target allowlisted by name -- LANDED|Organ|0|-\nrung|DL1|Blue-green warm slots|bg_slot_switch|Two installed slots per daemon, the idle one warmed by the health probe before the SNI route flips; gate proves a flip under a synthetic request stream drops zero requests and a failed warm-up never flips|Organ|1.5|DP0\nrung|DL2|Weighted canary|dc_weight_shift|Route a declared permil of new connections to the warm slot and advance the weight only while the watchdog stays GREEN; gate proves a RED at 100 permil rolls the weight back to zero and records it|Organ|1.5|DL1\nrung|DL3|Preview per change|dp_preview_spawn|A staged .new binary runs on an ephemeral port behind the operator login with its own route, torn down on promote or expiry; gate proves the preview serves the staged bytes while live serves the promoted bytes, byte-verified both|Organ|1|DP0\nrung|DL4|Declared-state reconciler|go_reconcile_desired|A signed desired-state file (targets, versions by sha, routes) reconciled against the live plane on a beat through the existing promote and deploy doors; drift is REPORTED with the diff and applied only when the file says apply; gate proves a declared sha converges and a tampered file is refused by signature|Organ|2|DP2\nrung|DL5|Secrets rotation|ds_rotate_secret|Secrets referenced by name from the desired state, rotated on a declared schedule with the old value kept readable for the grace window and the rotation recorded; gate proves a daemon keeps serving through a rotation and a revoked secret is refused after the window|Organ|1|DL4\nrung|DL6|Second-node placement|rg_place_service|Place a service on a second sovereign host from the same desired state, with the SNI router fronting both; gate proves a request reaches the second node and a node loss routes back within the watchdog window|Organ|4|DL4\nrung|DL7|Scale to zero|as_scale_to_zero|An always-on daemon declared idle-capable is stopped after a declared idle window and respawned on first connection by the router; gate proves zero process while idle and a first request served within the declared cold-start bound|Organ|2|DL1\nrung|DL8|Reconcile the rollback census with the chain that actually exists|dj_count_prev_chain|REWRITTEN 2026-09-01 WITHIN THE HOUR, BECAUSE ITS FIRST PREMISE WAS WRONG AND READING THE SOURCE REFUTED IT. I filed this as build pre-deploy banking, on the strength of deployjrnl.status reading at_risk=1914 of rollback_slots=1938 against floor=1745 with irreplaceable_evictions=2. THE BANKING ALREADY EXISTS: hc_promote_to_expect has carried a DURABLE ROLLBACK CHAIN since 2026-08-21 -- it rotates .prev to .prev2 before overwriting .prev, so TWO generations survive, and when .prev2 is finally dropped it ANNOUNCES the loss with the artifact size rather than losing it silently. Its own comment cites the same two-deploy measurement I re-derived. Verified against this seat's own two docportal deploys today: the original generation is at .prev2, and the manual hash-verified banks taken beside it were belt-and-braces, not the safety net. SO THE REAL QUESTION IS THE INSTRUMENT, NOT THE MECHANISM: at_risk counts targets with no entry in a separate bank directory (bank_files_scanned=88 bank_size_matched=34) while the mechanism that actually protects rollback is the .prev and .prev2 chain, which that count appears not to read. A RED that measures a different subject from the property it names is the estate's own wrong-subject defect, and it is worse than no metric because 1914 of 1938 reads as catastrophe and gets ignored. DONE-RULE: nx_deployjrnl classifies a target by the chain it actually has -- PREV-ONLY, PREV-PLUS-PREV2, or NEITHER -- the partition SUMS to rollback_slots, the floor is re-derived against the corrected subject rather than kept from the old one, and a target with a live .prev2 is NOT counted at risk. Only then is a genuine residual a worklist|Organ|1.5|-\nrung|DL9|The build queue dedupes by target|bq_dedupe_target|CORRECTED 2026-09-02 by a whole-plane measurement: 231 deployq- rows, 231 distinct ids, zero duplicate BQ rows -- the enqueue is ALREADY idempotent by id (nx_store_put re-puts by id), so the claim that a well-behaved caller multiplies the queue was wrong; the 2026-09-01 pileup (procs_running=31) was concurrent SYNC re-issues under separate per-target leases. The half that stands is the done-rule's second clause, re-scoped: a sync build that succeeds CLOSES any queued BQ row for its target, proven by a gate that enqueues one target twice, asserts one row and one fire, and proves a sync success leaves no live queued row behind. The runner-refusal half of the pileup is closed on the loadgov board (LV10 ma_runner_refused, 2026-09-02)|Organ|0.5|-\nrung|DL10|Resumable artifact upload that survives a dropped chunk|cc_resume_from_status|MEASURED 2026-09-04: a 410443 byte ship lost chunk 7 of 9 to a transient on a degraded array and discarded the WHOLE transfer, because the client restarts rather than resumes. The server ALREADY exposes the resume source as nx_content_put status id and the client never calls it, so this is a client gap and not a protocol gap. Industry bar is the OCI Distribution Spec chunked blob upload which resumes from the last accepted byte range, and S3 multipart per-part retry. DONE-RULE: nx_content_put_client queries status before sending, sends only the missing indices, and a gate proves it by interrupting a transfer mid-chunk and showing the retry sends STRICTLY FEWER chunks than the first attempt while the committed whole-file sha still matches|Organ|2|-\nrung|DL11|Abandoned upload staging is reaped on a declared TTL|cp_reap_stale|MEASURED 2026-09-04: knowledge/contentput held 82 entries, roughly 40 of them bare meta files from begins that never received a chunk, the oldest about eleven days back, with no reaper anywhere. A failed put leaves server-side state and announces nothing, so the leak is invisible until someone lists the directory. The INFLOW cause is now fixed (the transport ceiling that made large chunks impossible), so what remains is historical debt plus whatever future transients leave. Industry bar is the S3 lifecycle rule AbortIncompleteMultipartUpload and the OCI upload session timeout. DONE-RULE: the reaper removes only transfers whose meta is older than a TTL READ FROM CONF and which hold no committed chunks, the reaped count is announced, and a neg-control proves an in-flight transfer is NEVER reaped|Organ|1.5|DL10\nrung|DL12|The shared HTTPS post path follows an async job pointer so every caller inherits it|hp_follow_job|Census 2026-09-04: of 89 organs that post a tools call, 8 follow the JOB-STARTED pointer and 81 do not. That 81 is a CEILING ON EXPOSURE, not a defect count, because a blind caller only breaks when the edge actually promotes its call. Fixing 81 sites by hand is 81 chances to drift; putting the follow inside hp_post_json makes it structural, which is the same reason nx_jobfollow_lib is one shared follower rather than a copy in each content client. The open question is CAPABILITY not code: the follower needs a read cap for the job artifact and most callers hold none. DONE-RULE: hp_post_json follows when a read capability is resolvable and returns the RAW response unchanged when it is not, never a silent zero, proven by a gate exercising both branches plus a neg-control showing an existing capless caller is byte-identical to today|Organ|2|-\nrung|DL13|Destructive operations are rate-limited against the store's own history and refused above the band|ds_destruction_breaker|DONE-RULE PRE-DECLARED 2026-09-04. Counts deletes, withdrawals and retires per unit time against a band derived from history [@cf-outage-feb26]; REFUSES above it naming the rule and stamping to an argument-derived path. Bite: a planted burst must be refused; a planted trickle must pass.|Organ|2|-\nrung|DL14|A target is built twice in one lane and the promote is refused if the artifacts differ|ds_build_twice|DONE-RULE PRE-DECLARED 2026-09-04. Two builds, byte compare, refusal names the first differing offset [@debian-repro-gate26]. Positive control: a known-deterministic target promotes; negative control: a planted timestamp in the source must be refused.|Organ|2|-\nrung|DL15|A promote is refused for any artifact whose closure root is unrecorded|ch_promote_refuse|DONE-RULE PRE-DECLARED 2026-09-04. The build record's single committed digest must exist beside the artifact [@repro-not-enough26] [@kettle26]; a planted artifact with the record deleted must be refused; the same artifact with the record present must promote.|Organ|2|DL14\nrung|DL16|The registry verifier refuses a signature under an unauthorised key, by name|rs_unauth_key_bite|DONE-RULE PRE-DECLARED 2026-09-04. A signature valid under a key the policy does not authorise is refused with the rule named [@cosign-releases]; a signature under an authorised key still verifies. The refusal is the tooth; acceptance alone proves nothing.|Organ|1|-\nrung|DL17|The rollback action's dependency chain is resolved and refused if it traverses the subject|dr_rollback_chain|DONE-RULE PRE-DECLARED 2026-09-04. Chain resolved from proxy_routes.conf and daemons.reg [@cp-sovereignty26]; a planted rollback whose path crosses the subject must be refused; one that does not must pass. Run before every deploy on the request path.|Organ|3|-\nrung|DL18|Every conf reader holds its last-known-good and stamps LKG-HELD on a rejected file|hc_lkg_conf|DONE-RULE PRE-DECLARED 2026-09-04. On parse or validation failure the organ continues on the banked conf and stamps LKG-HELD with the rejected hash [@azure-ykyn]; a planted corrupt conf must leave serving unchanged and the stamp present.|Organ|2|-" as *u8) 88 gv_check_eq("captured deploy rung count" as *u8, m19.count, 21, ctr) 89 gv_check_eq("captured deploy dependencies valid" as *u8, sg_valid(m19), 1, ctr) 90 gv_check_eq("captured DL2 found" as *u8, sg_find(m19, "DL2" as *u8, 3) >= 0, 1, ctr) 91 let rc: i64 = gv_verdict("COMPARE-LADDER", ctr, "native declaration and binding fixtures; no live readiness or visual quality claim" as *u8) 92 sys_exit(rc) 93 return rc 94}