nx_compliance.nx source

1// nx_compliance.nx -- the COMPLIANCE & STANDARDS organ (PM's chosen #2; the team member that owns standards, 2// distinct from the PM and feeding the Auditor). It holds the STANDARDS REGISTRY per workstream (legal + 3// engineering) + a measured CONFORMANCE %, and enforces the S-CLASS GATE: conformance CAPS maturity, so the 4// Auditor cannot grade a layer S-class while it fails its governing standard. It also emits, per workstream, 5// the conformance TARGET required to unlock the next maturity grade -- the actionable link from a standard to 6// the roadmap. Pure policy + data; the Auditor calls comp_gate() before promoting a grade. license_tier: ORIGINAL 7import "nx_syscalls.nx" 8import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc) 9 10func cp_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 11// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer 12// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the 13// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls). 14// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign. 15func cp_n(v: i64) -> i64 { nxi_out(v); return 0 } 16func cp_fw(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 17// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer 18// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the 19// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls). 20// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign. 21func cp_fn(fd: i64, v: i64) -> i64 { nxi_fd(fd, v); return 0 } 22 23// maturity ladder 0..5; the conformance thresholds (DATA) that GATE each grade. 24func grade_label(g: i64) -> *u8 { if g==0 {return "ABSENT" as *u8} if g==1 {return "TOY" as *u8} if g==2 {return "FUNCTIONAL" as *u8} if g==3 {return "PRODUCTION" as *u8} if g==4 {return "S-CLASS" as *u8} return "EXCEED" as *u8 } 25// minimum conformance % required to be ALLOWED at each grade. 26func grade_min_conf(g: i64) -> i64 { if g<=1 {return 0} if g==2 {return 40} if g==3 {return 60} if g==4 {return 80} return 90 } 27 28// the GATE: the highest grade conformance permits (the cap the Auditor must respect). 29func comp_gate(conf: i64) -> i64 { 30 if conf >= 90 { return 5 } 31 if conf >= 80 { return 4 } 32 if conf >= 60 { return 3 } 33 if conf >= 40 { return 2 } 34 if conf >= 20 { return 1 } 35 return 0 36} 37// the conformance % needed to unlock the next grade above `cur` (0 if already maxed). 38func comp_next_target(cur: i64) -> i64 { if cur >= 5 { return 0 } return grade_min_conf(cur + 1) } 39 40const NW: i64 = 10 41 42func main() -> i64 { 43 let name:*i64=sys_mmap(8*NW) as *i64; let std:*i64=sys_mmap(8*NW) as *i64; let conf:*i64=sys_mmap(8*NW) as *i64; let grade:*i64=sys_mmap(8*NW) as *i64 44 name[0]="Compiler" as *u8 as i64; std[0]="IEEE 754 + codegen correctness" as *u8 as i64; conf[0]=40; grade[0]=1 45 name[1]="Toolchain/Linker" as *u8 as i64; std[1]="ELF / System V x86-64 ABI" as *u8 as i64; conf[1]=85; grade[1]=3 46 name[2]="Crypto" as *u8 as i64; std[2]="NIST FIPS 180/198; RFC 6979; OWASP Argon2id" as *u8 as i64; conf[2]=55; grade[2]=2 47 name[3]="TLS/HTTPS" as *u8 as i64; std[3]="RFC 8446 (TLS 1.3); RFC 9110" as *u8 as i64; conf[3]=80; grade[3]=3 48 name[4]="SSH" as *u8 as i64; std[4]="RFC 4251-4254" as *u8 as i64; conf[4]=60; grade[4]=2 49 name[5]="Hosting" as *u8 as i64; std[5]="RFC 9110 HTTP; atomic rename(2) deploy" as *u8 as i64; conf[5]=82; grade[5]=3 50 name[6]="andelinwest Site" as *u8 as i64; std[6]="Utah Bar advertising + ADA + WCAG 2.2 AA" as *u8 as i64; conf[6]=58; grade[6]=2 51 name[7]="CMS/WYSIWYG" as *u8 as i64; std[7]="OWASP ASVS/Top10; CSRF; Argon2id; sanitize-LAST; WCAG 2.2" as *u8 as i64; conf[7]=25; grade[7]=1 52 name[8]="Onsite Search" as *u8 as i64; std[8]="IR ranking (BM25); per-tenant isolation" as *u8 as i64; conf[8]=50; grade[8]=2 53 name[9]="Team/Process" as *u8 as i64; std[9]="WSJF/SAFe; RACI separation of duties" as *u8 as i64; conf[9]=70; grade[9]=3 54 55 cp_puts("=== COMPLIANCE & STANDARDS organ -- conformance gates maturity (feeds the Auditor) ===\n\n" as *u8) 56 let lfd: i64 = sys_openat_append("/tmp/nishi_compliance.log" as *u8, 0x1a4) 57 cp_fw(lfd, "\n# COMPLIANCE 2026-06-06 (standard conformance gates the Auditor grade)\n" as *u8) 58 59 var blocked: i64 = 0; var i: i64 = 0 60 while i < NW { 61 let cap: i64 = comp_gate(conf[i]) 62 var gated: i64 = grade[i]; if cap < gated { gated = cap } 63 cp_puts(" " as *u8); cp_puts(name[i] as *u8); cp_puts(": Auditor=" as *u8); cp_puts(grade_label(grade[i])) 64 cp_puts(" conformance=" as *u8); cp_n(conf[i]); cp_puts("% (" as *u8); cp_puts(std[i] as *u8); cp_puts(")\n" as *u8) 65 if cap < grade[i] { 66 cp_puts(" >> STANDARD-BLOCKED: capped to " as *u8); cp_puts(grade_label(gated)); cp_puts(" until conformance meets the bar.\n" as *u8) 67 blocked = blocked + 1 68 } else { 69 let nt: i64 = comp_next_target(grade[i]) 70 if nt > 0 { cp_puts(" -> to reach " as *u8); cp_puts(grade_label(grade[i]+1)); cp_puts(", needs conformance >= " as *u8); cp_n(nt); cp_puts("%\n" as *u8) } 71 } 72 cp_fw(lfd, "WS " as *u8); cp_fw(lfd, name[i] as *u8); cp_fw(lfd, " conf=" as *u8); cp_fn(lfd, conf[i]); cp_fw(lfd, " gated=" as *u8); cp_fw(lfd, grade_label(gated)); cp_fw(lfd, "\n" as *u8) 73 i = i + 1 74 } 75 sys_close(lfd) 76 77 cp_puts("\n>>> Over-graded (standard-blocked) workstreams: " as *u8); cp_n(blocked) 78 cp_puts(" (0 = the Auditor's grades are HONEST -- none claim S-class while failing a standard).\n" as *u8) 79 cp_puts(">>> The GATE is now the guard: as a layer's maturity rises, comp_gate() blocks S-class until conformance\n" as *u8) 80 cp_puts(">>> meets the bar. Each workstream's conformance TARGET is the actionable next rung on the roadmap.\n" as *u8) 81 sys_exit(0); return 0 82}