nx_debtconfirm.nx source

1// nx_debtconfirm.nx -- THE MECHANICAL DEBT-CLOSURE CONFIRMER (2026-07-31, ws=d001-b). 2// 3// WHY: the debt ledger fills ~5x faster than a seat drains it (open 1523->1586 in one session, +31 filed 4// vs +6 eaten per 25min). Hand-draining cannot converge. nx_debtlive scan already names 356 rows CITED by a 5// fix site, but its check verb correctly says "confirm by ARTIFACT before eating". THIS is that confirmer. 6// 7// I FIRST CLAIMED THIS COULD NOT BE MECHANIZED ("it needs judgement about which string proves a fix"). 8// THAT WAS WRONG: debt rows carry STRUCTURED evidence -- sha256, byte counts, gate names -- so a ladder 9// verifies them with no judgement at all. This organ is the correction. 10// 11// ---------------- THE ASYMMETRY, MEASURED, AND THE WHOLE REASON THIS ORGAN IS SUBTLE ---------------- 12// Debt 1785471390 cites sha256 d7f1316d.. / 35043B for nx_adopt. The LIVE nx_adopt.elf measures 13// sha256 5018513b.. / 36030B -- MISMATCH, because the organ was REBUILT after the row was filed. Yet the 14// fix IS present (calling nx_adopt returns the full report the row said was EMPTY). 15// => A SHA/BYTE CITATION IS A STRONG POSITIVE AND A WEAK NEGATIVE. 16// MATCH => CONFIRMED (definitively that build is live) 17// MISMATCH => INCONCLUSIVE. **NEVER "REFUTED".** 18// A confirmer that read mismatch as "unfixed" would emit FALSE NEGATIVES on every rebuilt organ, i.e. on 19// most of the corpus. Same family as the banked law BINARY GREP IS VALID ONE WAY ONLY. 20// 21// ---------------- HARD CONSTRAINTS (non-negotiable, enforced by construction) ---------------- 22// 1. READ-ONLY. This organ NEVER eats a row and NEVER writes outside its own stdout. A bug here can only 23// MIS-REPORT, never mark an unfixed problem solved. That is why it was safe to build at all. 24// 2. TERNARY verdicts. There is NO refuted rung: absence of evidence is INSUFFICIENT, never a denial. 25// 3. It COMPOSES nx_filehash rather than reimplementing sha256 (rule 15) -- one hasher, one truth. 26// 27// usage: nx_debtconfirm check <organ.elf> [expect-sha|-] [expect-bytes|-] 28// nx_debtconfirm selftest 29// exit 0=CONFIRMED 6=INCONCLUSIVE 7=INSUFFICIENT 2=usage 4=I/O 30// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0 31import "nx_syscalls.nx" 32import "nx_estr.nx" 33import "nx_tool_run.nx" 34 35const DC_CAP: i64 = 65536 36const DC_SLOT: i64 = 64 37const DC_HASHER: *u8 = "nx_filehash.elf" 38const DC_HASH_MS: i64 = 60000 39const DC_USAGE: i64 = 2 40const DC_IOERR: i64 = 4 41const DC_INCONCL: i64 = 6 42const DC_INSUFF: i64 = 7 43 44func dc_at(buf: *u8, n: i64, i: i64, s: *u8, sl: i64) -> i64 { 45 var r: i64 = 1 46 if i + sl > n { r = 0 } else { 47 var k: i64 = 0 48 while k < sl { if buf[i+k] != s[k] { r = 0; k = sl } else { k = k + 1 } } 49 } 50 return r 51} 52 53// find needle in buf; return index or -1 54func dc_find(buf: *u8, n: i64, s: *u8) -> i64 { 55 let sl: i64 = es_len(s) 56 var r: i64 = 0 - 1 57 var i: i64 = 0 58 while i < n { 59 if dc_at(buf, n, i, s, sl) == 1 { r = i; i = n } else { i = i + 1 } 60 } 61 return r 62} 63 64// compare the value that follows key in buf against want; 1=match 0=differ -1=key absent 65func dc_field_eq(buf: *u8, n: i64, key: *u8, want: *u8) -> i64 { 66 let at: i64 = dc_find(buf, n, key) 67 if at < 0 { return 0 - 1 } 68 var p: i64 = at + es_len(key) 69 let wl: i64 = es_len(want) 70 var r: i64 = 1 71 var k: i64 = 0 72 while k < wl { 73 if p + k >= n { r = 0; k = wl } else { 74 if buf[p+k] != want[k] { r = 0; k = wl } else { k = k + 1 } 75 } 76 } 77 return r 78} 79 80// run nx_filehash <path>, capture its JSON into out; returns bytes captured or -1 81func dc_hash(path: *u8, out: *u8) -> i64 { 82 let ol: *i64 = sys_mmap(DC_SLOT) as *i64 83 let av: *i64 = sys_mmap(DC_SLOT) as *i64 84 av[0] = DC_HASHER as i64 85 av[1] = path as i64 86 av[2] = 0 87 // BOUNDED: a hasher that hangs must not hang the confirmer (the D001 verifier lesson, 1785524287). 88 let rc: i64 = tr_run_capture_to(DC_HASHER, av, out, DC_CAP, ol, DC_HASH_MS) 89 if rc != 0 { return 0 - 1 } 90 return ol[0] 91} 92 93func dc_check(elf: *u8, wsha: *u8, wbytes: *u8) -> i64 { 94 let out: *u8 = sys_mmap(DC_CAP) 95 let n: i64 = dc_hash(elf, out) 96 if n <= 0 { 97 es_puts("NX-DEBTCONFIRM verdict=INSUFFICIENT reason=hash-unavailable organ=" as *u8) 98 es_puts(elf); es_puts("\n" as *u8) 99 return DC_INSUFF 100 } 101 var have_claim: i64 = 0 102 // ---- RUNG 2: sha256. STRONG POSITIVE, WEAK NEGATIVE. ---- 103 if wsha[0] != (45 as u8) { 104 have_claim = 1 105 let e: i64 = dc_field_eq(out, n, "\"sha256\":\"" as *u8, wsha) 106 if e == 1 { 107 es_puts("NX-DEBTCONFIRM verdict=CONFIRMED rung=sha256 organ=" as *u8) 108 es_puts(elf); es_puts("\n" as *u8) 109 return 0 110 } 111 } 112 // ---- RUNG 3: byte count. Same asymmetry. ---- 113 if wbytes[0] != (45 as u8) { 114 have_claim = 1 115 let b: i64 = dc_field_eq(out, n, "\"bytes\":" as *u8, wbytes) 116 if b == 1 { 117 es_puts("NX-DEBTCONFIRM verdict=CONFIRMED rung=bytes organ=" as *u8) 118 es_puts(elf); es_puts("\n" as *u8) 119 return 0 120 } 121 } 122 if have_claim == 0 { 123 es_puts("NX-DEBTCONFIRM verdict=INSUFFICIENT reason=no-citation-supplied organ=" as *u8) 124 es_puts(elf); es_puts("\n" as *u8) 125 return DC_INSUFF 126 } 127 // A CITATION WAS SUPPLIED AND DID NOT MATCH. THIS IS **NOT** A DENIAL. 128 es_puts("NX-DEBTCONFIRM verdict=INCONCLUSIVE rung=sha/bytes organ=" as *u8) 129 es_puts(elf) 130 es_puts(" -- the citation names a DIFFERENT BUILD, which is NOT evidence the fix is absent (the organ was\n" as *u8) 131 es_puts(" almost certainly rebuilt since the row was filed). Fall through: run its gate, or call the organ,\n" as *u8) 132 es_puts(" or grep the deployed binary for a literal the fix INTRODUCED. NEVER read this as REFUTED.\n" as *u8) 133 es_puts(" live: " as *u8); sys_write(1, out, n) 134 return DC_INCONCL 135} 136 137// ---------------- RUNG 5: SCOPE CHECK. THE FIX MY OWN NEAR-MISS PROVED NECESSARY. ---------------- 138// I nearly ate sev-9 1785453431 on a CLEAN rung-4 hit: `plock` / `STS-LOCK` really ARE in the deployed 139// nx_debt.elf, so the seg-store lock genuinely shipped. The artifact evidence was CORRECT and the close 140// would still have been WRONG -- the row is a BUILD-half record that explicitly carries an open remainder: 141// "52 writers still call the raw load/append/sts_seed shape and are still losing rows under concurrency". 142// Closing it would have marked an ACTIVE data-loss defect solved. Only a transport 503 stopped me, and 143// luck is not a guard. 144// LAW: ARTIFACT CONFIRMATION PROVES WHAT SHIPPED, NOT WHAT THE ROW STILL ASKS FOR. 145// A row can have a DEPLOYED fix and an OPEN remainder, so CONFIRMED must be GATED on scope, not just bytes. 146func dc_has_remainder(buf: *u8, n: i64) -> i64 { 147 var r: i64 = 0 148 if dc_find(buf, n, "REMAINING" as *u8) >= 0 { r = 1 } 149 if dc_find(buf, n, "ADOPTION HALF" as *u8) >= 0 { r = 1 } 150 if dc_find(buf, n, "AWAITING DEPLOY" as *u8) >= 0 { r = 1 } 151 // GENERALIZED from "NOT yet ported" after a LIVE near-miss (2026-08-03): the FIRST row the staleconfirm 152 // sweep marked MECH-EATABLE (1785562295) carried a matching sha AND an open mystery -- "the 6.1-day 153 // staleness cause is UNDETERMINED ... Candidates not yet discriminated" -- phrasing both marker lists 154 // missed. A remainder is written in prose, not a keyword grammar; "not yet" catches the class. 155 if dc_find(buf, n, "NOT yet" as *u8) >= 0 { r = 1 } 156 if dc_find(buf, n, "not yet" as *u8) >= 0 { r = 1 } 157 if dc_find(buf, n, "UNDETERMINED" as *u8) >= 0 { r = 1 } 158 if dc_find(buf, n, "DEPLOY PENDING" as *u8) >= 0 { r = 1 } 159 if dc_find(buf, n, "deploy pending" as *u8) >= 0 { r = 1 } 160 if dc_find(buf, n, "owner rung" as *u8) >= 0 { r = 1 } 161 if dc_find(buf, n, "NEXT RUNG" as *u8) >= 0 { r = 1 } 162 if dc_find(buf, n, "still open" as *u8) >= 0 { r = 1 } 163 if dc_find(buf, n, "DO NOT close" as *u8) >= 0 { r = 1 } 164 if dc_find(buf, n, "do not close" as *u8) >= 0 { r = 1 } 165 return r 166} 167 168// scope <rowfile>: read a debt row's TEXT and report whether it carries an open remainder. 169// exit 0 = CLEAN (no remainder marker) | 6 = PARTIAL (remainder present, DO NOT EAT) | 4 = unreadable 170func dc_scope(path: *u8) -> i64 { 171 let b: *u8 = sys_mmap(DC_CAP) 172 let fd: i64 = sys_openat_rd(path) 173 if fd < 0 { 174 es_puts("NX-DEBTCONFIRM verdict=INSUFFICIENT reason=rowfile-unreadable\n" as *u8) 175 return DC_IOERR 176 } 177 var n: i64 = 0 178 var go: i64 = 1 179 while go == 1 { 180 if n >= DC_CAP { go = 0 } else { 181 let r: i64 = sys_read(fd, ((b as i64) + n) as *u8, DC_CAP - n) 182 if r <= 0 { go = 0 } else { n = n + r } 183 } 184 } 185 sys_close(fd) 186 if n <= 0 { 187 es_puts("NX-DEBTCONFIRM verdict=INSUFFICIENT reason=rowfile-empty\n" as *u8) 188 return DC_IOERR 189 } 190 if dc_has_remainder(b, n) == 1 { 191 es_puts("NX-DEBTCONFIRM verdict=PARTIAL scope=REMAINDER-PRESENT -- the row carries an OPEN remainder.\n" as *u8) 192 es_puts(" A shipped fix does NOT satisfy it. DO NOT EAT even on a clean sha/bytes/marker hit.\n" as *u8) 193 return DC_INCONCL 194 } 195 es_puts("NX-DEBTCONFIRM verdict=CLEAN scope=NO-REMAINDER-MARKER (artifact evidence may close this row)\n" as *u8) 196 return 0 197} 198 199func dc_t(got: i64, want: i64, name: *u8, pass: *i64, tot: *i64) -> i64 { 200 tot[0] = tot[0] + 1 201 var ok: i64 = 0 202 if got == want { ok = 1; pass[0] = pass[0] + 1; es_puts(" [PASS] " as *u8) } else { es_puts(" [FAIL] " as *u8) } 203 es_puts(name); es_puts("\n" as *u8) 204 return ok 205} 206 207// Hermetic: pure comparator teeth on synthetic buffers -- no forks, no files, no shared state. 208func dc_selftest() -> i64 { 209 let pass: *i64 = sys_mmap(DC_SLOT) as *i64 210 let tot: *i64 = sys_mmap(DC_SLOT) as *i64 211 pass[0] = 0 212 tot[0] = 0 213 es_puts("nx_debtconfirm selftest -- the closure ladder comparator\n\n" as *u8) 214 let j: *u8 = "{\"organ\":\"nx_filehash\",\"sha256\":\"abc123\",\"bytes\":36030}" as *u8 215 let n: i64 = es_len(j) 216 dc_t(dc_field_eq(j, n, "\"sha256\":\"" as *u8, "abc123" as *u8), 1, "T1 sha MATCH is detected" as *u8, pass, tot) 217 dc_t(dc_field_eq(j, n, "\"sha256\":\"" as *u8, "d7f131" as *u8), 0, "T2 NEG sha MISMATCH is detected (must NOT read as match)" as *u8, pass, tot) 218 dc_t(dc_field_eq(j, n, "\"bytes\":" as *u8, "36030" as *u8), 1, "T3 bytes MATCH is detected" as *u8, pass, tot) 219 dc_t(dc_field_eq(j, n, "\"bytes\":" as *u8, "35043" as *u8), 0, "T4 NEG bytes MISMATCH is detected" as *u8, pass, tot) 220 dc_t(dc_field_eq(j, n, "\"nosuch\":" as *u8, "x" as *u8), 0 - 1, "T5 ABSENT key reports -1, never a match (INSUFFICIENT not CONFIRMED)" as *u8, pass, tot) 221 dc_t(dc_find(j, n, "nx_filehash" as *u8) >= 0, 1, "T6 NON-VACUITY: the finder really scans this buffer" as *u8, pass, tot) 222 // RUNG-5 teeth. T7 is the REAL sentence from sev-9 1785453431 that I nearly closed on clean artifact 223 // evidence -- if this tooth ever goes RED, the confirmer has regained the ability to certify a row whose 224 // fix shipped while 52 writers are still losing rows. 225 let rw: *u8 = "BUILT + GATE-PROVEN. WHAT SHIPPED: sts_append_row. REMAINING AND IT IS THE ADOPTION HALF: 52 writers still call the raw shape" as *u8 226 dc_t(dc_has_remainder(rw, es_len(rw)), 1, "T7 a row with an OPEN REMAINDER is caught (the 1785453431 near-miss, verbatim)" as *u8, pass, tot) 227 // T7b: the 1785562295 near-miss VERBATIM -- the first row staleconfirm marked MECH-EATABLE carried a 228 // genuinely matching sha AND this open mystery. If this tooth goes RED the confirmer can again certify 229 // a row whose artifact shipped while its actual subject is still an undiagnosed defect. 230 let rw2: *u8 = "NEW CAPABILITY SHIPPED REGARDLESS: gate LIVE 127264B sha b233b008, GREEN 3/3. the 6.1-day staleness cause is UNDETERMINED. Candidates not yet discriminated." as *u8 231 dc_t(dc_has_remainder(rw2, es_len(rw2)), 1, "T7b an UNDETERMINED-cause / not-yet row is caught (the 1785562295 near-miss, live-calibrated)" as *u8, pass, tot) 232 let cl: *u8 = "ROOT-FIXED AND DEPLOYED. gate 6/6 GREEN. sha256 abc123 live and proven in production." as *u8 233 dc_t(dc_has_remainder(cl, es_len(cl)), 0, "T8 NEG-CONTROL: a genuinely COMPLETE row is NOT flagged (the scan is not a catch-all)" as *u8, pass, tot) 234 es_puts("\nNX-DEBTCONFIRM-GATE passed " as *u8) 235 es_putn(pass[0]); es_puts("/" as *u8); es_putn(tot[0]) 236 var rc: i64 = 1 237 if pass[0] == tot[0] { rc = 0; es_puts(" verdict=GREEN (match, mismatch and absent-key are three DISTINCT answers)\n" as *u8) } else { es_puts(" verdict=RED\n" as *u8) } 238 return rc 239} 240 241func main(argc: i64, argv: *i64) -> i64 { 242 if argc < 2 { 243 es_puts("usage: nx_debtconfirm check <organ.elf> [expect-sha|-] [expect-bytes|-] | selftest\n" as *u8) 244 sys_exit(DC_USAGE) 245 return DC_USAGE 246 } 247 let v: *u8 = argv[1] as *u8 248 if dc_at(v, es_len(v), 0, "selftest" as *u8, 8) == 1 { 249 let r: i64 = dc_selftest() 250 sys_exit(r) 251 return r 252 } 253 if dc_at(v, es_len(v), 0, "scope" as *u8, 5) == 1 { 254 if argc < 3 { es_puts("scope needs <rowfile>\n" as *u8); sys_exit(DC_USAGE); return DC_USAGE } 255 let rs: i64 = dc_scope(argv[2] as *u8) 256 sys_exit(rs) 257 return rs 258 } 259 if argc < 3 { 260 es_puts("check needs <organ.elf>\n" as *u8) 261 sys_exit(DC_USAGE) 262 return DC_USAGE 263 } 264 var sha: *u8 = "-" as *u8 265 var byt: *u8 = "-" as *u8 266 if argc > 3 { sha = argv[3] as *u8 } 267 if argc > 4 { byt = argv[4] as *u8 } 268 let rc2: i64 = dc_check(argv[2] as *u8, sha, byt) 269 sys_exit(rc2) 270 return rc2 271}