nx_compare_regen.nx source
↩ module page · 170 lines · 12056 B
1// nx_compare_regen.nx -- ON-NAS regeneration of the whole Nishi Compare publish surface (operator 2026-07-09:
2// "no frozen snapshots"). Re-MEASURES every matrix domain against the synced source tree (buildroot/runtime),
3// GATE-CHECKED: for each artifact the generator's liar-kill gate must exit 0 FIRST -- a RED measurement is NEVER
4// published (fail-closed). Then emits json+html per domain + the hub index json/html + the in-code OpenAPI, and
5// hot-swaps each into the LIVE docroot via write-.new + sys_renameat (atomic; a concurrent reader never tears).
6// Because nx_compare_serve reads the SAME docroot files, MCP tools/call and public REST update together, single
7// source. argv: [1]=buildroot dir (default "buildroot"), [2]=docroot prefix (default "../sites/nishifamily/compare/",
8// i.e. the live docroot relative to buildroot). The MCP allowlist row PINS these args (caller argv ignored) so a
9// tools/call caller cannot redirect writes. Targets must already exist (this regenerates, never scaffolds).
10// license_tier: ORIGINAL expect_exit: 0
11import "nx_tool_run.nx"
12const K_MAGIC_1048576: i64 = 1048576
13const K_MAGIC_4096: i64 = 4096
14const K_MAGIC_2000: i64 = 2000
15
16func w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
17func wn(fd: i64, v: i64) -> i64 {
18 var m: i64 = v; if m < 0 { w(fd, "-" as *u8); m = 0 - m }
19 let t: *u8 = sys_mmap(24); var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 }
20 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
21 let o: *u8 = sys_mmap(24); var i: i64 = 0; while i < k { o[i] = t[k-1-i]; i = i + 1 } sys_write(fd, o, k); return 0
22}
23func scopy(dst: *u8, doff: i64, src: *u8) -> i64 { var i: i64 = 0; while src[i] != (0 as u8) { dst[doff+i] = src[i]; i = i + 1 } return doff + i }
24func rg_read(path: *u8, buf: *u8, cap: i64) -> i64 {
25 let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 - 1 }
26 var tot: i64 = 0
27 while tot < cap { let r: i64 = sys_read(fd, (buf as i64 + tot) as *u8, cap - tot); if r <= 0 { break } tot = tot + r }
28 sys_close(fd); return tot
29}
30// atomic publish: write path.new then rename over path (the S-class content-publish primitive).
31func rg_write_atomic(path: *u8, buf: *u8, n: i64) -> i64 {
32 let tmp: *u8 = sys_mmap(600)
33 var o: i64 = scopy(tmp, 0, path)
34 o = scopy(tmp, o, ".new" as *u8); tmp[o] = 0 as u8
35 let fd: i64 = sys_openat_wr(tmp, 420)
36 if fd < 0 { return 0 - 1 }
37 var off: i64 = 0
38 while off < n { let r: i64 = sys_write(fd, (buf as i64 + off) as *u8, n - off); if r <= 0 { sys_close(fd); return 0 - 2 } off = off + r }
39 sys_close(fd)
40 if sys_renameat(tmp, path) != 0 { return 0 - 3 }
41 return 0
42}
43// scaffold: ensure <droot><dom>/ exists before emit (mkdir 0755; EEXIST is harmless). Root-fixes the
44// "never scaffolds" gap that blocked publishing a BRAND-NEW domain (no docroot dir -> WRITE-FAIL). Fail-safe.
45func rg_scaffold(droot: *u8, dom: *u8) -> i64 {
46 let d: *u8 = sys_mmap(600)
47 var o: i64 = scopy(d, 0, droot); o = scopy(d, o, dom); d[o] = 0 as u8
48 sys_mkdir(d, 493)
49 return 0
50}
51// run elf with up to 2 args, capture stdout. returns child exit code; outlen[0]=captured bytes.
52func rg_run(elf: *u8, a1: *u8, a2: *u8, out: *u8, cap: i64, outlen: *i64) -> i64 {
53 let av: *i64 = sys_mmap(64) as *i64
54 av[0] = elf as i64
55 var n: i64 = 1
56 if (a1 as i64) != 0 { av[n] = a1 as i64; n = n + 1 }
57 if (a2 as i64) != 0 { av[n] = a2 as i64; n = n + 1 }
58 av[n] = 0
59 return tr_run_capture(elf, av, out, cap, outlen)
60}
61// generate one artifact: gate already verified by caller; run mode, validate first byte + min size, atomic write.
62func rg_emit(elf: *u8, a1: *u8, mode: *u8, firstbyte: i64, minbytes: i64, target: *u8, out: *u8, cap: i64) -> i64 {
63 let ol: *i64 = sys_mmap(16) as *i64
64 let rc: i64 = rg_run(elf, a1, mode, out, cap, ol)
65 if rc != 0 { w(1, " EMIT-FAIL rc nonzero: " as *u8); w(1, target); w(1, "\n" as *u8); return 0 - 1 }
66 if ol[0] < minbytes { w(1, " EMIT-FAIL too small: " as *u8); w(1, target); w(1, "\n" as *u8); return 0 - 2 }
67 if (out[0] as i64) != firstbyte { w(1, " EMIT-FAIL wrong leading byte: " as *u8); w(1, target); w(1, "\n" as *u8); return 0 - 3 }
68 let wr: i64 = rg_write_atomic(target, out, ol[0])
69 if wr != 0 { w(1, " WRITE-FAIL " as *u8); wn(1, wr); w(1, ": " as *u8); w(1, target); w(1, "\n" as *u8); return 0 - 4 }
70 w(1, " published " as *u8); w(1, target); w(1, " (" as *u8); wn(1, ol[0]); w(1, " bytes)\n" as *u8)
71 return 0
72}
73func main(argc: i64, argv: *i64) -> i64 {
74 var broot: *u8 = "buildroot" as *u8
75 var droot: *u8 = "../sites/nishifamily/compare/" as *u8
76 if argc >= 2 { broot = argv[1] as *u8 }
77 if argc >= 3 { droot = argv[2] as *u8 }
78 w(1, "=== NX-COMPARE-REGEN -- re-measure + atomically republish the compare surface (gate-checked) ===\n" as *u8)
79 if sys_chdir(broot) != 0 { w(1, "FAIL: cannot chdir buildroot\n" as *u8); sys_exit(1); return 1 }
80 let MATRIX: *u8 = "_offc/nx_swcompare_matrix.elf" as *u8
81 let SOTA: *u8 = "_offc/nx_swcompare_sota.elf" as *u8
82 let HUB: *u8 = "_offc/nx_swcompare_hub.elf" as *u8
83 let sprobe: *u8 = sys_mmap(600)
84 let cap: i64 = K_MAGIC_1048576
85 let out: *u8 = sys_mmap(cap)
86 let lst: *u8 = sys_mmap(K_MAGIC_4096)
87 let ln: i64 = rg_read("knowledge/compare/regen.list" as *u8, lst, K_MAGIC_4096)
88 if ln <= 0 { w(1, "FAIL: regen.list missing\n" as *u8); sys_exit(1); return 1 }
89 let target: *u8 = sys_mmap(600)
90 let ol: *i64 = sys_mmap(16) as *i64
91 var fails: i64 = 0
92 var pubs: i64 = 0
93 var p: i64 = 0
94 while p < ln {
95 var e: i64 = p
96 while e < ln { if lst[e] == (10 as u8) { break } e = e + 1 }
97 lst[e] = 0 as u8
98 let dom: *u8 = (lst as i64 + p) as *u8
99 p = e + 1
100 if dom[0] == (0 as u8) { } else { if dom[0] == (35 as u8) { } else {
101 w(1, " domain " as *u8); w(1, dom); w(1, ":\n" as *u8)
102 // a <dom>.sota file promotes the domain to the SOTA generator (N competitors, quantitative,
103 // categorized); otherwise the 4-column matrix generator. Same CLI shape, same gate contract.
104 var gen: *u8 = MATRIX
105 var so: i64 = scopy(sprobe, 0, "knowledge/compare/" as *u8); so = scopy(sprobe, so, dom); so = scopy(sprobe, so, ".sota" as *u8); sprobe[so] = 0 as u8
106 let sfd: i64 = sys_openat_rd(sprobe)
107 if sfd >= 0 { sys_close(sfd); gen = SOTA; w(1, " (sota-class: N-competitor quantitative)\n" as *u8) }
108 let grc: i64 = rg_run(gen, dom, 0 as *u8, out, cap, ol)
109 if grc != 0 { w(1, " GATE RED -- refusing to publish this domain\n" as *u8); fails = fails + 1 } else {
110 rg_scaffold(droot, dom)
111 var o: i64 = scopy(target, 0, droot); o = scopy(target, o, dom); o = scopy(target, o, "/api.json" as *u8); target[o] = 0 as u8
112 if rg_emit(gen, dom, "json" as *u8, 123, 400, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
113 o = scopy(target, 0, droot); o = scopy(target, o, dom); o = scopy(target, o, "/index.html" as *u8); target[o] = 0 as u8
114 if rg_emit(gen, dom, "html" as *u8, 60, K_MAGIC_2000, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
115 // FRONTIER door (2026-08-05, debt 1785937893): a <dom>.axes file promotes the domain to ALSO
116 // publish its researcher-fed frontier radar via the gapmap generator -- same gate contract as
117 // matrix/sota. FAIL-SAFE by design: a RED frontier gate (banks absent / vacuous momentum) skips
118 // LOUDLY without failing the core publish; the radar is additive, its gate is its own.
119 var ax: i64 = scopy(sprobe, 0, "knowledge/compare/" as *u8); ax = scopy(sprobe, ax, dom); ax = scopy(sprobe, ax, ".axes" as *u8); sprobe[ax] = 0 as u8
120 let axfd: i64 = sys_openat_rd(sprobe)
121 if axfd >= 0 { sys_close(axfd)
122 // promoted-elf path (nishihost root, CWD is buildroot): /api/build + /api/promote place it -- API-pure staging
123 let GAPMAP: *u8 = "../nx_swcompare_gapmap.elf" as *u8
124 let gfd2: i64 = sys_openat_rd(GAPMAP)
125 if gfd2 < 0 { w(1, " frontier SKIPPED (nx_swcompare_gapmap.elf not promoted -- /api/build + /api/promote it)\n" as *u8) } else { sys_close(gfd2)
126 let frc: i64 = rg_run(GAPMAP, dom, 0 as *u8, out, cap, ol)
127 if frc != 0 { w(1, " frontier gate RED (corpus banks absent or vacuous) -- skipping frontier, core artifacts stand\n" as *u8) } else {
128 var fo: i64 = scopy(target, 0, droot); fo = scopy(target, fo, dom); fo = scopy(target, fo, "/frontier" as *u8); target[fo] = 0 as u8
129 sys_mkdir(target, 493)
130 fo = scopy(target, 0, droot); fo = scopy(target, fo, dom); fo = scopy(target, fo, "/frontier/index.html" as *u8); target[fo] = 0 as u8
131 if rg_emit(GAPMAP, dom, "html" as *u8, 60, K_MAGIC_2000, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
132 }
133 }
134 }
135 }
136 } }
137 }
138 w(1, " hub:\n" as *u8)
139 // The hub/openapi regenerate FROM the registry. On the NAS the registry is DELIBERATELY not synced
140 // (it is multi-session contended on the laptop; regenerating from a stale snapshot would clobber
141 // parallel additions) -> absent registry = SKIP hub cleanly, matrices-only regen. Laptop publishes hub.
142 let regchk: i64 = sys_openat_rd("knowledge/compare/registry" as *u8)
143 if regchk < 0 {
144 w(1, " SKIPPED (registry not synced here; hub + openapi are laptop-published by design)\n" as *u8)
145 } else { sys_close(regchk)
146 let hrc: i64 = rg_run(HUB, 0 as *u8, 0 as *u8, out, cap, ol)
147 if hrc != 0 { w(1, " HUB GATE RED -- refusing to publish hub\n" as *u8); fails = fails + 1 } else {
148 var o2: i64 = scopy(target, 0, droot); o2 = scopy(target, o2, "api.json" as *u8); target[o2] = 0 as u8
149 if rg_emit(HUB, "json" as *u8, 0 as *u8, 123, 400, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
150 o2 = scopy(target, 0, droot); o2 = scopy(target, o2, "index.html" as *u8); target[o2] = 0 as u8
151 if rg_emit(HUB, "html" as *u8, 0 as *u8, 60, K_MAGIC_2000, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
152 o2 = scopy(target, 0, droot); o2 = scopy(target, o2, "openapi.json" as *u8); target[o2] = 0 as u8
153 if rg_emit(HUB, "openapi" as *u8, 0 as *u8, 123, 800, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
154 } }
155 // MATURITY BOARD (2026-07-16, operator "the high scores are liars without a maturity analysis"):
156 // every regen re-grades ALL matrix domains with the evidence-capped census and republishes
157 // /compare/maturity (presence vs honest maturity + inflation ratio). The board writes atomically
158 // itself (same .nxnew+rename discipline) and FAILS CLOSED below 10 graded domains.
159 w(1, " maturity board:\n" as *u8)
160 let BOARD: *u8 = "_offc/nx_maturity_board.elf" as *u8
161 let bfd: i64 = sys_openat_rd(BOARD)
162 if bfd < 0 { w(1, " SKIPPED (board organ not staged in this buildroot)\n" as *u8) } else { sys_close(bfd)
163 let brc: i64 = rg_run(BOARD, 0 as *u8, 0 as *u8, out, cap, ol)
164 if brc != 0 { w(1, " MATURITY-BOARD RED -- refusing\n" as *u8); fails = fails + 1 }
165 else { w(1, " published /compare/maturity (evidence-capped census over every matrix domain)\n" as *u8); pubs = pubs + 1 }
166 }
167 w(1, "REGEN published=" as *u8); wn(1, pubs); w(1, " fails=" as *u8); wn(1, fails)
168 if fails == 0 { w(1, " verdict=GREEN (measured fresh from source; atomic hot-swap; MCP+REST single source)\n" as *u8); sys_exit(0); return 0 }
169 w(1, " verdict=RED\n" as *u8); sys_exit(1); return 1
170}