`nx_cwe_scan.nx` source

↩ module page · 515 lines · 26612 B
1// nx_cwe_scan.nx -- SOVEREIGN CISQ / ISO-IEC-5055 STRUCTURAL WEAKNESS SCANNER (eats seq250, the biggest GAP in
2// the industry battery). ISO/IEC 5055 grades software by COUNTING CWE structural weaknesses across four of the
3// ISO-25010 characteristics -- Reliability, Security, Performance Efficiency, Maintainability. Until this existed,
4// our SQALE rating was an A partly BECAUSE NOBODY WAS LOOKING: undetected weakness cannot enter the remediation
5// numerator. This is the detector that makes the letter mean something.
6//
7// The CWE->factor mapping and severity weights live in the NATIVE PLANE knowledge/store/cwerules- (never a .tsv,
8// per the law this session just gave a tooth). Detection is structural and must be code; the STANDARD's taxonomy
9// is data. Fails closed: no rules plane -> RED, no grade without the standard.
10//
11// ★HONEST ENVELOPE, STATED IN THE OUTPUT ITSELF: this is bounded TEXTUAL/heuristic analysis, NOT interprocedural
12// dataflow. It reports CANDIDATE weaknesses -- false positives are possible and expected, and crucially
13// ABSENCE OF FINDINGS IS NOT PROOF OF ABSENCE. A scanner that claimed otherwise would be exactly the
14// navel-gazing the scorecard exists to prevent. Every cap (files, bytes/file, guard window) is DECLARED.
15//   nx_cwe_scan [dir] [maxfiles]      default dir=buildroot/runtime/_hdl_build, maxfiles=1200
16// license_tier: ORIGINAL  expect_exit: 0
17import "nx_store_seed_lib.nx"
18import "nx_seg_store.nx"
19import "nx_syscalls.nx"
20const CW_MAGIC_1024: i64 = 1024
21const CW_MAGIC_65536: i64 = 65536
22const CW_MAGIC_3900: i64 = 3900
23const CW_MAGIC_131072: i64 = 131072
24const CW_MAGIC_1200: i64 = 1200
25const CW_MAGIC_4096: i64 = 4096
26const CW_MAGIC_262144: i64 = 262144
27
28const CW_PLANE:   *u8 = "knowledge/store/cwerules-"
29const CW_LOG:     *u8 = "knowledge/status/cwe_scan.log"
30const CW_CAP:     i64 = 1048576
31const CW_FILECAP: i64 = 262144     // declared: bytes read per organ
32const CW_WINDOW:  i64 = 420        // declared: forward window for a guard, in bytes
33const CW_MAXHIT:  i64 = 10         // declared: offender examples retained
34// The ratchet's per-CWE ceilings are DATA in their own plane, keyed by CWE id -- NOT literals in code
35// and NOT extra columns on the taxonomy plane (the taxonomy states what the STANDARD says; the ratchet
36// states what THIS estate currently tolerates -- two different owners, two different change cadences).
37// Rows: <cwe-id>\t<max-allowed-candidates>. A CWE with no row is UNRATCHETED (reported, never RED), so
38// this can never day-one-cliff a weakness nobody has backfilled yet.
39const CW_RATCHET: *u8 = "knowledge/store/cweratchet-"
40
41func cw_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
42func cw_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
43func cw_cat(o: *u8, at: i64, s: *u8) -> i64 { var i: i64=0; var a: i64=at; while s[i]!=(0 as u8){o[a]=s[i]; a=a+1; i=i+1} return a }
44func cw_catf(o: *u8, at: i64, p: *u8, n: i64) -> i64 { var i: i64=0; var a: i64=at; while i<n { o[a]=p[i]; a=a+1; i=i+1 } return a }
45func cw_catn(o: *u8, at: i64, v: i64) -> i64 {
  var a: i64=at; var x: i64=v
  if x<0 { o[a]=45 as u8; a=a+1; x=0-x }
  let tm: *u8=sys_mmap(24); var k: i64=0
  if x==0 { tm[0]=48 as u8; k=1 }
  while x>0 { tm[k]=(48+x%10) as u8; x=x/10; k=k+1 }
  var j: i64=0
  while j<k { o[a]=tm[k-1-j]; a=a+1; j=j+1 }
  return a
54}
55// does needle occur in buf[from .. from+win) ?
56func cw_within(buf: *u8, n: i64, from: i64, win: i64, needle: *u8) -> i64 {
  let nl: i64=cw_slen(needle)
  if nl==0 { return 0 }
  var end: i64=from+win
  if end>n { end=n }
  var i: i64=from
  while i+nl<=end {
      var k: i64=0; var ok: i64=1
      while k<nl { if buf[i+k]!=needle[k] { ok=0; k=nl } else { k=k+1 } }
      if ok==1 { return 1 }
      i=i+1
  }
  return 0
69}
70// does needle occur in the single line [ls,le) ?
71func cw_inline(buf: *u8, ls: i64, le: i64, needle: *u8) -> i64 {
  let nl: i64=cw_slen(needle)
  if nl==0 { return 0 }
  var i: i64=ls
  while i+nl<=le {
      var k: i64=0; var ok: i64=1
      while k<nl { if buf[i+k]!=needle[k] { ok=0; k=nl } else { k=k+1 } }
      if ok==1 { return 1 }
      i=i+1
  }
  return 0
82}
83// how many consecutive digits start at p?
84func cw_digits(buf: *u8, p: i64, le: i64) -> i64 {
  var n: i64=0
  var i: i64=p
  var go: i64=1
  while go==1 {
      if i>=le { go=0 } else {
          let c: i64 = buf[i] as i64
          if c>=48 { if c<=57 { n=n+1; i=i+1 } else { go=0 } } else { go=0 }
      }
  }
  return n
95}
96// ★CWE-798 PRECISION FIX (seq318): match the FULL capability shape <allow>~<exp>~<nonce>.<signature>, not the
97// bare "~18" prefix. v1's loose prefix flagged the scanner's OWN pattern literal -- a self-match that inflated a
98// SECURITY count, which is the one place a false positive is least acceptable. A real cap always carries
99// ~<9+ digits>~<5+ digits>. before its signature; a bare "~18" cannot satisfy that, so the self-match dies and
100// the rule gets strictly more precise at the same time.
101func cw_capshape(buf: *u8, ls: i64, le: i64) -> i64 {
  var i: i64=ls
  while i<le {
      if buf[i]==(126 as u8) {
          let d1: i64 = cw_digits(buf, i+1, le)
          if d1>=9 {
              let p2: i64 = i+1+d1
              if p2<le { if buf[p2]==(126 as u8) {
                  let d2: i64 = cw_digits(buf, p2+1, le)
                  if d2>=5 {
                      let p3: i64 = p2+1+d2
                      if p3<le { if buf[p3]==(46 as u8) { return 1 } }
                  }
              } }
          }
      }
      i=i+1
  }
  return 0
120}
121func cw_isdotdot(nm: *u8) -> i64 { if nm[0]==(46 as u8){ if nm[1]==(0 as u8){return 1} if nm[1]==(46 as u8){ if nm[2]==(0 as u8){return 1} } } return 0 }
122func cw_join(buf: *u8, base_n: i64, name: *u8) -> i64 { buf[base_n]=47 as u8; var o: i64=base_n+1; var i: i64=0; while name[i]!=(0 as u8){buf[o]=name[i];o=o+1;i=i+1} return o }
123
124// ---- LOGIC <-> DATA JOIN ------------------------------------------------------------------------
125// The taxonomy is DATA (the cwerules- plane); detection is LOGIC (the cw_scan_file rules); the two are
126// joined BY CWE ID, never by row position. v1 joined them positionally (`if nrule<4 { cnt=hits[nrule] }`),
127// which welded the two planes together: adding a CWE to the taxonomy REQUIRED a code edit, and reordering
128// the plane silently re-attributed every count to the wrong weakness -- a data change corrupting a
129// security number with no code change and no error. Now a plane row carries its own identity, code
130// declares which id each detector owns, and the join looks one up in the other.
131// A taxonomy row with no detector reports detector:none and candidates:0 -- visible, not silently zero.
132const CW_NRULES: i64 = 5
133func cw_rule_id(idx: i64) -> *u8 {
  if idx==0 { return "CWE-476\x00" as *u8 }
  if idx==1 { return "CWE-252\x00" as *u8 }
  if idx==2 { return "CWE-798\x00" as *u8 }
  if idx==3 { return "CWE-1050\x00" as *u8 }
  if idx==4 { return "CWE-330\x00" as *u8 }
  return "\x00" as *u8
140}
141// exact (not prefix) match of a plane field against a detector id -- CWE-1050 must never match CWE-105
142func cw_id_match(pb: *u8, off: i64, len: i64, id: *u8) -> i64 {
  let n: i64 = cw_slen(id)
  if n != len { return 0 }
  var k: i64 = 0
  while k < n { if pb[off+k] != id[k] { return 0 } k = k + 1 }
  return 1
148}
149// which detector owns this taxonomy row? -1 = the standard names it, we do not detect it yet
150func cw_detector_for(pb: *u8, off: i64, len: i64) -> i64 {
  var i: i64 = 0
  while i < CW_NRULES {
      if cw_id_match(pb, off, len, cw_rule_id(i))==1 { return i }
      i = i + 1
  }
  return 0-1
157}
158// Is this organ a TEST fixture? Deterministic key material is CORRECT in a test (reproducible vectors)
159// and a defect in production. Scoped to the CWE-330 rule ALONE and deliberately so: widening this to
160// every rule would silently drop real findings from test-named files.
161func cw_is_test(path: *u8, pathlen: i64) -> i64 {
  var i: i64 = 0
  while i+5 <= pathlen {
      if path[i]==(95 as u8) { if path[i+1]==(116 as u8) { if path[i+2]==(101 as u8) {
      if path[i+3]==(115 as u8) { if path[i+4]==(116 as u8) { return 1 } } } } }
      i = i + 1
  }
  return 0
169}
170// CWE-330 shape: an index-assignment into KEY-NAMED storage whose value is a hex literal. The live
171// defect this was built for (debt 1785970852) was `priv[i] = (0xA0 + i) as u8` across 21 TLS clients --
172// one X25519 private key shared by every session the fleet ever opened, derivable from any binary, so
173// forward secrecy was absent rather than weak. Deliberately NOT matching `cr[`/plain buffers: a constant
174// client_random is a lesser fault and the false-positive cost lands on a SECURITY count, where it is
175// least acceptable. `pat[i]=(0xA0+i)` (a memory-scan pattern) is a true negative by this shape.
176// PRECISION (the seq318 lesson, reapplied): the index must be a VARIABLE, not a literal. `priv[i]` is a
177// FILL LOOP writing a whole key; `key[0] = 0x30` is a fixed slot -- a DER tag, a table entry, a header
178// byte -- and is not key generation at all. Requiring a named index took the corpus from 133 candidates
179// to a triageable number without losing the real defect, and on a SECURITY count a false positive is
180// least acceptable: it inflates the number the ratchet is set from, and noise is where a real offender hides.
181func cw_keyidx(buf: *u8, ls: i64, le: i64, nm: *u8) -> i64 {
  let n: i64 = cw_slen(nm)
  var i: i64 = ls
  while i+n < le {
      var k: i64=0; var ok: i64=1
      while k<n { if buf[i+k]!=nm[k] { ok=0; k=n } else { k=k+1 } }
      if ok==1 {
          let c: i64 = buf[i+n] as i64
          if c<48 { return 1 }
          if c>57 { return 1 }
      }
      i=i+1
  }
  return 0
195}
196func cw_keyname(buf: *u8, ls: i64, le: i64) -> i64 {
  if cw_keyidx(buf, ls, le, "priv[\x00" as *u8)==1 { return 1 }
  if cw_keyidx(buf, ls, le, "key[\x00" as *u8)==1 { return 1 }
  if cw_keyidx(buf, ls, le, "secret[\x00" as *u8)==1 { return 1 }
  if cw_keyidx(buf, ls, le, "nonce[\x00" as *u8)==1 { return 1 }
  if cw_keyidx(buf, ls, le, "seed[\x00" as *u8)==1 { return 1 }
  return 0
203}
204
205// look this CWE id up in the ratchet plane; returns the allowed ceiling, or -1 when UNRATCHETED
206func cw_ratchet_for(rb: *u8, rn: i64, pb: *u8, off: i64, len: i64) -> i64 {
  if rn<=0 { return 0-1 }
  var i: i64=0
  while i<rn {
      let ls: i64=i
      var le: i64=ls
      var s: i64=1
      while s==1 { if le>=rn { s=0 } else { if rb[le]==(10 as u8) { s=0 } else { le=le+1 } } }
      i=le+1
      if le-ls>2 { if rb[ls]!=(35 as u8) {
          var tb: i64=ls
          var found: i64=0
          while tb<le { if rb[tb]==(9 as u8) { found=1; tb=le } else { tb=tb+1 } }
          if found==1 {
              var t2: i64=ls
              while rb[t2]!=(9 as u8) { t2=t2+1 }
              // compare the row's id field against the taxonomy row's id field, byte for byte
              if t2-ls==len {
                  var k: i64=0; var ok: i64=1
                  while k<len { if rb[ls+k]!=pb[off+k] { ok=0; k=len } else { k=k+1 } }
                  if ok==1 {
                      var v: i64=0; var d: i64=0
                      var p: i64=t2+1
                      while p<le { let c: i64=rb[p] as i64; if c>=48 { if c<=57 { v=v*10+(c-48); d=1 } } p=p+1 }
                      if d==1 { return v }
                  }
              }
          }
      } }
  }
  return 0-1
237}
238
239// scan ONE organ; bumps hits[0..CW_NRULES-1]; appends up to CW_MAXHIT offender lines to ex/exo
240func cw_scan_file(path: *u8, pathlen: i64, fbuf: *u8, hits: *i64, ex: *u8, exo: *i64, exn: *i64) -> i64 {
  let szp: *i64=sys_mmap(16) as *i64
  let fd: i64=sys_openat_rd(path)
  if fd<0 { return 0 }
  var n: i64=0
  var go: i64=1
  while go==1 {
      if n>=CW_FILECAP { go=0 } else {
          let r: i64=sys_read(fd, (fbuf as i64+n) as *u8, CW_FILECAP-n)
          if r<=0 { go=0 } else { n=n+r }
      }
  }
  sys_close(fd)
  if n<=0 { return 0 }
  let istest: i64=cw_is_test(path, pathlen)
  let wstack: *i64=sys_mmap(CW_MAGIC_1024) as *i64
  var wn: i64=0
  var depth: i64=0
  var i: i64=0
  while i<n {
      let ls: i64=i
      var le: i64=ls
      var s: i64=1
      while s==1 { if le>=n { s=0 } else { if fbuf[le]==(10 as u8) { s=0 } else { le=le+1 } } }
      i=le+1
      // skip comment lines -- a rule firing on prose is a false positive by construction
      var iscomment: i64=0
      if le-ls>=2 { if fbuf[ls]==(47 as u8) { if fbuf[ls+1]==(47 as u8) { iscomment=1 } } }
      if fbuf[ls]==(92 as u8) { iscomment=1 }
      if iscomment==0 {
          // pop loop scopes we have left
          var pop: i64=1
          while pop==1 { if wn<=0 { pop=0 } else { if depth<=wstack[wn-1] { wn=wn-1 } else { pop=0 } } }
          var hit: i64=0-1
          // CWE-476: file/map result used with no null guard in the declared window
          if cw_inline(fbuf, ls, le, "sys_read_file(\x00" as *u8)==1 {
              if cw_within(fbuf, n, ls, CW_WINDOW, "!=0\x00" as *u8)==0 {
              if cw_within(fbuf, n, ls, CW_WINDOW, "==0\x00" as *u8)==0 {
              if cw_within(fbuf, n, ls, CW_WINDOW, "<=0\x00" as *u8)==0 { hits[0]=hits[0]+1; hit=0 } } }
          }
          // CWE-252: fd from openat never compared <0
          if hit<0 {
              var isopen: i64=0
              if cw_inline(fbuf, ls, le, "sys_openat_wr(\x00" as *u8)==1 { isopen=1 }
              if cw_inline(fbuf, ls, le, "sys_openat_rd(\x00" as *u8)==1 { isopen=1 }
              if isopen==1 {
                  if cw_within(fbuf, n, ls, CW_WINDOW, "<0\x00" as *u8)==0 {
                  if cw_within(fbuf, n, ls, CW_WINDOW, ">=0\x00" as *u8)==0 { hits[1]=hits[1]+1; hit=1 } }
              }
          }
          // CWE-798: a capability-token literal pasted into source -- FULL cap shape inside quotes
          if hit<0 {
              if cw_capshape(fbuf, ls, le)==1 {
                  if cw_inline(fbuf, ls, le, "\x22\x00" as *u8)==1 { hits[2]=hits[2]+1; hit=2 }
              }
          }
          // ★CWE-1050 PRECISION FIX (seq318): only a FRESH BINDING inside the loop counts. v1 flagged any
          // sys_mmap textually inside a while -- but mmap is NishiLang's ONLY allocator and reusing a hoisted
          // scratch buffer inside a loop is correct, idiomatic, and everywhere, so v1 returned 25447 candidates
          // (FP-dominated, and it swamped the aggregate). A `let` inside the loop body allocates a NEW region
          // every iteration with no reuse -- that is the actual unbounded-growth defect worth naming.
          if hit<0 {
              if wn>0 { if cw_inline(fbuf, ls, le, "sys_mmap(\x00" as *u8)==1 {
                  if cw_inline(fbuf, ls, le, "let \x00" as *u8)==1 { hits[3]=hits[3]+1; hit=3 }
              } }
          }
          // CWE-330: key material from a CONSTANT instead of a CSPRNG (test fixtures excluded)
          if hit<0 {
              if istest==0 {
                  if cw_keyname(fbuf, ls, le)==1 {
                      if cw_inline(fbuf, ls, le, "0x\x00" as *u8)==1 { hits[4]=hits[4]+1; hit=4 }
                  }
              }
          }
          if hit>=0 { if exn[0]<CW_MAXHIT {
              var o: i64=exo[0]
              if o+pathlen+80<CW_MAGIC_65536 {
                  o=cw_cat(ex, o, "CWE-idx\x00" as *u8); o=cw_catn(ex, o, hit); ex[o]=32 as u8; o=o+1
                  o=cw_catf(ex, o, path, pathlen); ex[o]=10 as u8; o=o+1
                  exo[0]=o; exn[0]=exn[0]+1
              }
          } }
          // update brace depth, then record any loop opened on this line
          var b: i64=ls
          var opens: i64=0
          while b<le { if fbuf[b]==(123 as u8) { opens=opens+1 } if fbuf[b]==(125 as u8) { depth=depth-1 } b=b+1 }
          if opens>0 {
              if cw_inline(fbuf, ls, le, "while \x00" as *u8)==1 { if wn<120 { wstack[wn]=depth; wn=wn+1 } }
              depth=depth+opens
          }
      }
  }
  return 1
333}
334
335// recursive walk; returns files scanned (bounded by maxfiles), counts total seen in fseen
336func cw_walk(p: *u8, pn: i64, depth: i64, maxf: i64, fbuf: *u8, hits: *i64, ex: *u8, exo: *i64, exn: *i64, fseen: *i64) -> i64 {
  if depth>6 { return 0 }
  if pn>CW_MAGIC_3900 { return 0 }
  p[pn]=0 as u8
  let fd: i64=sys_openat_rd(p)
  if fd<0 { return 0 }
  let dbuf: *u8=sys_mmap(CW_MAGIC_131072)
  var done: i64=0
  var go: i64=1
  while go==1 {
      let nr: i64=sys_getdents64(fd, dbuf, CW_MAGIC_131072)
      if nr<=0 { go=0 } else {
          var off: i64=0
          while off<nr {
              let rec: *u8=(dbuf as i64+off) as *u8
              let ty: i64=dirent_type(rec)
              let nm: *u8=dirent_name(rec)
              if cw_isdotdot(nm)==0 {
                  let cs: i64=cw_join(p, pn, nm)
                  if ty==4 { done=done+cw_walk(p, cs, depth+1, maxf, fbuf, hits, ex, exo, exn, fseen) }
                  else {
                      if cs>=3 { if p[cs-3]==(46 as u8) { if p[cs-2]==(110 as u8) { if p[cs-1]==(120 as u8) {
                          fseen[0]=fseen[0]+1
                          if fseen[0]<=maxf { p[cs]=0 as u8; done=done+cw_scan_file(p, cs, fbuf, hits, ex, exo, exn) }
                      } } } }
                  }
              }
              off=off+dirent_reclen(rec)
          }
      }
  }
  sys_close(fd)
  return done
369}
370
371func main(argc: i64, argv: *i64) -> i64 {
  var dir: *u8 = "buildroot/runtime/_hdl_build\x00" as *u8
  if argc>=2 { dir = argv[1] as *u8 }
  var maxf: i64 = CW_MAGIC_1200
  if argc>=3 {
      let a: *u8=argv[2] as *u8
      var v: i64=0; var k: i64=0
      while a[k]!=(0 as u8) { let c: i64=a[k] as i64; if c>=48 { if c<=57 { v=v*10+(c-48) } } k=k+1 }
      if v>0 { maxf=v }
  }
  // ---- the STANDARD's taxonomy, from the native plane (fail-closed)
  let pb: *u8=sys_mmap(CW_CAP)
  let pn: i64=sts_load(CW_PLANE, pb, CW_CAP-CW_MAGIC_4096)
  if pn<=0 {
      cw_w("CWE-SCAN RED -- native plane knowledge/store/cwerules- ABSENT or EMPTY (fail-closed: no ISO-5055 grade without the standard's taxonomy)\n" as *u8)
      sys_exit(1)
      return 1
  }
  // the RATCHET ceilings (own plane, own owner). ABSENT is legal and means UNRATCHETED everywhere --
  // a missing ratchet must never be read as "zero tolerated", which would cliff the whole estate RED.
  let rb: *u8=sys_mmap(CW_CAP)
  let rn: i64=sts_load(CW_RATCHET, rb, CW_CAP-CW_MAGIC_4096)
  let hits: *i64=sys_mmap(128) as *i64
  var hi: i64=0
  while hi<CW_NRULES { hits[hi]=0; hi=hi+1 }
  let ex: *u8=sys_mmap(CW_MAGIC_65536)
  let exo: *i64=sys_mmap(16) as *i64
  let exn: *i64=sys_mmap(16) as *i64
  let fseen: *i64=sys_mmap(16) as *i64
  exo[0]=0; exn[0]=0; fseen[0]=0
  let fbuf: *u8=sys_mmap(CW_FILECAP+16)
  let pbuf: *u8=sys_mmap(CW_MAGIC_4096)
  var dn: i64=0
  while dir[dn]!=(0 as u8) { pbuf[dn]=dir[dn]; dn=dn+1 }
  let scanned: i64=cw_walk(pbuf, dn, 0, maxf, fbuf, hits, ex, exo, exn, fseen)
  ex[exo[0]]=0 as u8
  // ---- emit, joining counts to the plane taxonomy in row order
  let jb: *u8=sys_mmap(CW_MAGIC_262144)
  var j: i64=0
  j=cw_cat(jb, j, "{\x22v\x22:1,\x22domain\x22:\x22cwe-iso5055\x22,\x22standard\x22:\x22ISO/IEC 5055 (CISQ) automated source code quality measures -- CWE weakness counts across 4 of the ISO-25010 characteristics\x22,\x22rules\x22:[" as *u8)
  var total: i64=0; var weighted: i64=0
  var nrule: i64=0
  var ndet: i64=0
  var ratchet_red: i64=0
  var first: i64=1
  var i: i64=0
  while i<pn {
      let ls: i64=i
      var le: i64=ls
      var s: i64=1
      while s==1 { if le>=pn { s=0 } else { if pb[le]==(10 as u8) { s=0 } else { le=le+1 } } }
      i=le+1
      if le-ls>5 { if pb[ls]!=(35 as u8) {
          // split 4 tab fields
          let fs: *i64=sys_mmap(64) as *i64
          let fl: *i64=sys_mmap(64) as *i64
          var nf: i64=0
          var p2: i64=ls
          var fstart: i64=ls
          while p2<le { if pb[p2]==(9 as u8) { if nf<4 { fs[nf]=fstart; fl[nf]=p2-fstart; nf=nf+1 } fstart=p2+1 } p2=p2+1 }
          if nf<4 { fs[nf]=fstart; fl[nf]=le-fstart; nf=nf+1 }
          if nf==4 {
              var wt: i64=0
              var k2: i64=0
              while k2<fl[3] { let c: i64=pb[fs[3]+k2] as i64; if c>=48 { if c<=57 { wt=wt*10+(c-48) } } k2=k2+1 }
              // KEYED join: this row's own id decides which detector's count it carries.
              let det: i64=cw_detector_for(pb, fs[0], fl[0])
              var cnt: i64=0
              if det>=0 { cnt=hits[det]; ndet=ndet+1 }
              let allowed: i64=cw_ratchet_for(rb, rn, pb, fs[0], fl[0])
              if allowed>=0 { if cnt>allowed { ratchet_red=ratchet_red+1 } }
              total=total+cnt
              weighted=weighted+cnt*wt
              if first==0 { j=cw_cat(jb, j, "," as *u8) }
              first=0
              j=cw_cat(jb, j, "{\x22cwe\x22:\x22" as *u8);    j=cw_catf(jb, j, (pb as i64+fs[0]) as *u8, fl[0])
              j=cw_cat(jb, j, "\x22,\x22factor\x22:\x22" as *u8); j=cw_catf(jb, j, (pb as i64+fs[1]) as *u8, fl[1])
              j=cw_cat(jb, j, "\x22,\x22name\x22:\x22" as *u8);   j=cw_catf(jb, j, (pb as i64+fs[2]) as *u8, fl[2])
              j=cw_cat(jb, j, "\x22,\x22weight\x22:" as *u8);      j=cw_catn(jb, j, wt)
              j=cw_cat(jb, j, ",\x22candidates\x22:" as *u8);      j=cw_catn(jb, j, cnt)
              // detector:false = the STANDARD names this weakness and we do not look for it. Saying so
              // out loud is the point: a silent 0 reads as "clean", which is the lie this organ exists
              // to prevent. ratchet_allowed:-1 = UNRATCHETED (reported, never RED).
              j=cw_cat(jb, j, ",\x22detector\x22:" as *u8)
              if det>=0 { j=cw_cat(jb, j, "true" as *u8) } else { j=cw_cat(jb, j, "false" as *u8) }
              j=cw_cat(jb, j, ",\x22ratchet_allowed\x22:" as *u8); j=cw_catn(jb, j, allowed)
              j=cw_cat(jb, j, "}" as *u8)
              nrule=nrule+1
          }
      } }
  }
  j=cw_cat(jb, j, "]" as *u8)
  var density: i64=0
  if scanned>0 { density=(total*1000)/scanned }
  var trunc: i64=0
  if fseen[0]>scanned { trunc=1 }
  j=cw_cat(jb, j, ",\x22scan\x22:{\x22dir\x22:\x22" as *u8); j=cw_cat(jb, j, dir)
  j=cw_cat(jb, j, "\x22,\x22organs_scanned\x22:" as *u8); j=cw_catn(jb, j, scanned)
  j=cw_cat(jb, j, ",\x22organs_present\x22:" as *u8); j=cw_catn(jb, j, fseen[0])
  j=cw_cat(jb, j, ",\x22truncated\x22:" as *u8); j=cw_catn(jb, j, trunc)
  j=cw_cat(jb, j, ",\x22maxfiles\x22:" as *u8); j=cw_catn(jb, j, maxf)
  j=cw_cat(jb, j, ",\x22bytes_per_organ_cap\x22:" as *u8); j=cw_catn(jb, j, CW_FILECAP)
  j=cw_cat(jb, j, ",\x22guard_window_bytes\x22:" as *u8); j=cw_catn(jb, j, CW_WINDOW)
  j=cw_cat(jb, j, "}" as *u8)
  j=cw_cat(jb, j, ",\x22candidates_total\x22:" as *u8); j=cw_catn(jb, j, total)
  j=cw_cat(jb, j, ",\x22weighted_score\x22:" as *u8); j=cw_catn(jb, j, weighted)
  j=cw_cat(jb, j, ",\x22density_per_1000_organs\x22:" as *u8); j=cw_catn(jb, j, density)
  j=cw_cat(jb, j, ",\x22iso5055_factors\x22:{\x22covered\x22:[\x22Reliability\x22,\x22Security\x22,\x22Performance\x22],\x22gap\x22:[\x22Maintainability -- needs cyclomatic/Halstead complexity, filed seq251\x22],\x22covered_of_4\x22:3}" as *u8)
  j=cw_cat(jb, j, ",\x22method\x22:\x22bounded TEXTUAL/heuristic pattern analysis over .nx source; comment lines excluded; a guard counts if it appears within the declared forward window\x22" as *u8)
  j=cw_cat(jb, j, ",\x22honest\x22:\x22These are CANDIDATES, not confirmed defects. This is NOT interprocedural dataflow: false positives are expected (a guard outside the window, or a deliberate infallible-by-construction call), and -- the part that matters -- ABSENCE OF FINDINGS IS NOT PROOF OF ABSENCE. Real ISO-5055 spans ~140 CWEs; we implement 4. Treat this as a floor on known weakness, never a clean bill of health.\x22" as *u8)
  j=cw_cat(jb, j, ",\x22rules_implemented\x22:" as *u8); j=cw_catn(jb, j, ndet)
  j=cw_cat(jb, j, ",\x22rules_in_plane\x22:" as *u8); j=cw_catn(jb, j, nrule)
  j=cw_cat(jb, j, ",\x22ratchet\x22:{\x22plane\x22:\x22knowledge/store/cweratchet-\x22,\x22present\x22:" as *u8)
  if rn>0 { j=cw_cat(jb, j, "true" as *u8) } else { j=cw_cat(jb, j, "false" as *u8) }
  j=cw_cat(jb, j, ",\x22breached\x22:" as *u8); j=cw_catn(jb, j, ratchet_red)
  j=cw_cat(jb, j, ",\x22semantics\x22:\x22a CWE with a ceiling row may never EXCEED it; a CWE with no row is unratcheted. Ceilings are DATA -- tighten one by editing the plane, not this organ.\x22}" as *u8)
  j=cw_cat(jb, j, ",\x22rules_in_standard_approx\x22:140" as *u8)
  j=cw_cat(jb, j, ",\x22examples\x22:\x22see the colocated log knowledge/status/cwe_scan.log\x22}" as *u8)
  sys_write(1, jb, j)
  sys_write(1, "\n" as *u8, 1)
  let lf: i64=sys_openat_wr(CW_LOG, 0x1a4)
  if lf>=0 {
      sys_write(lf, jb, j)
      let tail: *u8=sys_mmap(256)
      var t: i64=0
      if ratchet_red>0 { t=cw_cat(tail, t, "\nVERDICT=RED ratchet_breached=" as *u8); t=cw_catn(tail, t, ratchet_red); t=cw_cat(tail, t, " candidates=" as *u8) }
      else { t=cw_cat(tail, t, "\nVERDICT=GREEN candidates=" as *u8) }
      t=cw_catn(tail, t, total)
      t=cw_cat(tail, t, " weighted=" as *u8); t=cw_catn(tail, t, weighted)
      t=cw_cat(tail, t, " organs=" as *u8); t=cw_catn(tail, t, scanned)
      t=cw_cat(tail, t, "\nexamples (capped):\n" as *u8)
      sys_write(lf, tail, t)
      if exo[0]>0 { sys_write(lf, ex, exo[0]) }
      sys_close(lf)
  }
  // ENFORCE. exit 2 = a ratchet ceiling was EXCEEDED, deliberately distinct from exit 1 = fail-closed
  // (no taxonomy plane), so a caller can tell "the standard is missing" from "the estate regressed".
  // A sweep with no enforcer regrows; this is the tooth that makes the CWE-330 backfill stay bought.
  if ratchet_red>0 {
      cw_w("CWE-SCAN RED -- a ratchet ceiling was EXCEEDED; see knowledge/status/cwe_scan.log\n" as *u8)
      sys_exit(2)
      return 2
  }
  return 0
515}
nx_cwe_scan.nx source

`nx_cwe_scan.nx` source
