nx_dependency_audit.nx source

1// nx_dependency_audit.nx -- traces ACTUAL runtime + build deps. 2// 3// module: nishi-core.audit.dependency_audit 4// depends: nishi-core.audit.wired_status, nishi-core.io.syscalls 5// disk_kb: 5 6// capability: CORE_IO 7// wired_status: PARTIAL_WIRED 8// 9// license_tier: PUBLIC_NISHI_SUBSTRATE 10// genealogy_id: nishi_no_false_ok_cardinal_2026 + 11// software_engineering_dependency_analysis + 12// supply_chain_audit_pattern 13// 14// Per cardinal [[feedback-no-false-ok-substrate-honesty-audit]]: 15// substrate dep tracer walks the compile + link + run dep chain for 16// any Nishi program; classifies each transitive dep honestly: 17// 18// NISHI_SUBSTRATE = bits-up `.nx` file in nishi-core / 19// nishi-engine / nishi-library / etc. 20// WHEELER_ANCHOR = C-side bootstrap kept-but-not-extended 21// per cardinal (nxc2/*.c, gcc, GNU 22// binutils, qemu, libc, kernel) — these 23// ARE external deps, we just label them 24// honestly as anchors not "bits-up" 25// EXTERNAL_RUNTIME_REQUIRED = third-party SaaS / Python / npm dep 26// (CARDINAL VIOLATION if found in 27// Nishi family code) 28// PUBLIC_PROTOCOL_OR_GOV = TCP/IP, DNS root, USPS, NACHA, etc. 29// per [[nishi-stack-is-bits-up-sovereign- 30// always-no-third-party]] edge case 31// 32// ===== Why this matters =========================================== 33// 34// I claimed in external prose "we're off C" multiple times during 35// this arc when the verified state is: 36// 37// nxc2.exe gcc-built; WHEELER_ANCHOR 38// nxc2/*.c source kept-but-not-extended; WHEELER_ANCHOR 39// GNU as assembles RV64 .s → ELF; WHEELER_ANCHOR 40// GNU ld links ELF; WHEELER_ANCHOR 41// qemu-riscv64 runs ELF on x86_64 host; WHEELER_ANCHOR 42// libc host syscall wrappers; WHEELER_ANCHOR 43// Linux kernel provides syscalls; WHEELER_ANCHOR 44// Windows / Linux host OS shell + git + filesystem; WHEELER_ANCHOR 45// 46// Per Wheeler-anchor cardinal these are LEGITIMATE; the failure is 47// claiming "off C" when accurate framing is "NishiLang source layer 48// is bits-up; bootstrap+execution chain rests on these Wheeler 49// anchors until NishiOS closes the long arc." 50 51import "nx_syscalls.nx" 52import "nx_wired_status.nx" 53 54// ===== Verdict ==================================================== 55 56const NX_DA_OK: i64 = 1 57const NX_DA_WHEELER_DEPS_PRESENT: i64 = 2 // honest: gcc/binutils/qemu still needed 58const NX_DA_CARDINAL_VIOLATION: i64 = 3 // third-party SaaS or new C/Python dep 59const NX_DA_PUBLIC_PROTOCOL_OK: i64 = 4 // government rail / open RFC 60const NX_DA_SCAN_FAIL: i64 = 5 61 62func nx_da_verdict_name(v: i64) -> *u8 { 63 if v == NX_DA_OK { return "OK" } 64 if v == NX_DA_WHEELER_DEPS_PRESENT { return "WHEELER_DEPS_PRESENT" } 65 if v == NX_DA_CARDINAL_VIOLATION { return "CARDINAL_VIOLATION" } 66 if v == NX_DA_PUBLIC_PROTOCOL_OK { return "PUBLIC_PROTOCOL_OK" } 67 if v == NX_DA_SCAN_FAIL { return "SCAN_FAIL" } 68 return "UNKNOWN" 69} 70 71// ===== Dep classification sealed enum ============================= 72 73const NX_DEP_NISHI_SUBSTRATE: i64 = 1 74const NX_DEP_WHEELER_ANCHOR_COMPILER: i64 = 2 // gcc / clang building nxc2.exe 75const NX_DEP_WHEELER_ANCHOR_BINUTILS: i64 = 3 // GNU as + ld 76const NX_DEP_WHEELER_ANCHOR_QEMU: i64 = 4 // cross-emulator 77const NX_DEP_WHEELER_ANCHOR_LIBC: i64 = 5 78const NX_DEP_WHEELER_ANCHOR_KERNEL: i64 = 6 // Linux syscalls 79const NX_DEP_WHEELER_ANCHOR_HOST_OS: i64 = 7 // Windows / Linux shell + git 80const NX_DEP_PUBLIC_PROTOCOL: i64 = 8 // RFC standard 81const NX_DEP_GOV_RAIL: i64 = 9 // USPS / NACHA / Fedwire / etc. 82const NX_DEP_EXTERNAL_PYTHON_SAAS: i64 = 10 // CARDINAL VIOLATION 83const NX_DEP_EXTERNAL_NPM_NODE: i64 = 11 // CARDINAL VIOLATION 84const NX_DEP_EXTERNAL_CLOUD_SAAS: i64 = 12 // CARDINAL VIOLATION (Stripe / AWS / etc.) 85const NX_DEP_UNKNOWN: i64 = 13 86 87func nx_dep_class_name(c: i64) -> *u8 { 88 if c == NX_DEP_NISHI_SUBSTRATE { return "NISHI_SUBSTRATE" } 89 if c == NX_DEP_WHEELER_ANCHOR_COMPILER { return "WHEELER_ANCHOR_COMPILER" } 90 if c == NX_DEP_WHEELER_ANCHOR_BINUTILS { return "WHEELER_ANCHOR_BINUTILS" } 91 if c == NX_DEP_WHEELER_ANCHOR_QEMU { return "WHEELER_ANCHOR_QEMU" } 92 if c == NX_DEP_WHEELER_ANCHOR_LIBC { return "WHEELER_ANCHOR_LIBC" } 93 if c == NX_DEP_WHEELER_ANCHOR_KERNEL { return "WHEELER_ANCHOR_KERNEL" } 94 if c == NX_DEP_WHEELER_ANCHOR_HOST_OS { return "WHEELER_ANCHOR_HOST_OS" } 95 if c == NX_DEP_PUBLIC_PROTOCOL { return "PUBLIC_PROTOCOL" } 96 if c == NX_DEP_GOV_RAIL { return "GOV_RAIL" } 97 if c == NX_DEP_EXTERNAL_PYTHON_SAAS { return "EXTERNAL_PYTHON_SAAS" } 98 if c == NX_DEP_EXTERNAL_NPM_NODE { return "EXTERNAL_NPM_NODE" } 99 if c == NX_DEP_EXTERNAL_CLOUD_SAAS { return "EXTERNAL_CLOUD_SAAS" } 100 if c == NX_DEP_UNKNOWN { return "UNKNOWN" } 101 return "INVALID" 102} 103 104func nx_dep_is_cardinal_violation(c: i64) -> i64 { 105 if c == NX_DEP_EXTERNAL_PYTHON_SAAS { return 1 } 106 if c == NX_DEP_EXTERNAL_NPM_NODE { return 1 } 107 if c == NX_DEP_EXTERNAL_CLOUD_SAAS { return 1 } 108 return 0 109} 110 111// ===== Dep record ================================================= 112 113struct DepRecord { 114 dep_hk: i64, 115 dep_name_ptr: *u8, // "gcc" / "qemu-riscv64" / "TCP" / etc. 116 dep_class: i64, // NX_DEP_* 117 is_present_today: i64, // 1 = actually used in current build 118 replacement_planned: i64, // 1 = there's a planned NishiLang substitute 119 replacement_eta_arc: i64, // which arc replaces this dep (sessions count) 120 honest_note_ptr: *u8, // free-form ("nxc2.exe built by gcc 11.4 on host") 121} 122 123const NX_DEP_RECORD_BYTES: i64 = 56 // 7 fields * 8 bytes 124 125// ===== Build-chain audit report =================================== 126 127struct DepAuditReport { 128 report_hk: i64, 129 arc_name_ptr: *u8, 130 n_deps_total: i64, 131 n_nishi_substrate: i64, 132 n_wheeler_anchors: i64, 133 n_public_protocols: i64, 134 n_cardinal_violations: i64, 135 honest_off_c_score_q10: i64, // (n_nishi_substrate / n_deps_total) Q10 136 audited_at_unix: i64, 137 verdict: i64, 138} 139 140const NX_DEP_AUDIT_REPORT_BYTES: i64 = 80 // 10 fields * 8 bytes 141 142// ===== Build the Nishi-family canonical dep manifest ============= 143// 144// This primitive returns the HONEST list of what the Nishi build 145// chain actually depends on TODAY. No marketing framing. 146 147const NX_DEP_MANIFEST_SIZE: i64 = 8 148 149func nx_dep_audit_canonical_today() -> i64 { 150 // Returns count of Wheeler-anchored deps currently present. 151 // Per session memory verified state: 152 // 1. gcc (compiles nxc2.exe one-time) 153 // 2. nxc2/*.c source (Wheeler kept; not extended) 154 // 3. GNU as (assembles RV64 .s → ELF) 155 // 4. GNU ld (links ELF) 156 // 5. qemu-riscv64 (executes RV64 ELF on host) 157 // 6. libc (host syscall wrappers behind nx_syscalls) 158 // 7. Linux kernel (syscalls) 159 // 8. host OS (Windows shell / Linux shell / git / filesystem) 160 return NX_DEP_MANIFEST_SIZE 161} 162 163// ===== Honest off-C report ======================================== 164// 165// The truth about "off C": 166// 167// - NishiLang SOURCE layer: 90+ `.nx` files; bits-up 168// - Nishi COMPILER: nxc2.exe + nxc.elf; nxc2.exe built by gcc; 169// nxc.elf is RV64 ELF produced by the NishiLang self-host compiler 170// - Nishi RUNTIME: emitted RV64 assembly assembled+linked by GNU 171// binutils; executed via qemu-riscv64 on x86_64 host 172// - Nishi HOST: Linux or Windows; not yet NishiOS 173// 174// "Off C" framing is incorrect. Accurate framing: "NishiLang source 175// layer is bits-up + sovereign; build+execution layer is Wheeler- 176// anchored on gcc+binutils+qemu+libc+kernel+host-OS; the long arc 177// closes when nxc2/*.c retires (replaced by nxc2/self_host/*.nx), 178// when nxasm replaces GNU as+ld, when NishiOS replaces host kernel." 179 180func nx_dep_audit_off_c_score(report: *DepAuditReport) -> i64 { 181 if report == 0 as *DepAuditReport { return 0 } 182 if report.n_deps_total == 0 { return 0 } 183 return report.honest_off_c_score_q10 184} 185 186const NX_OFF_C_HONEST_SCORE_TODAY: i64 = 0 // 0% off-C: every build path passes through a Wheeler anchor 187 // (Once nxc2/self_host completes + nxasm ships, this rises) 188 189// ===== Anchor-replacement roadmap ================================= 190// 191// Per cardinal: every Wheeler anchor has a planned replacement. The 192// substrate tracks each + reports honestly which anchors still 193// remain. 194 195const NX_ANCHOR_REPLACE_NXC2_C: i64 = 1 // → nxc2/self_host/*.nx (queued ~33 sessions) 196const NX_ANCHOR_REPLACE_GNU_AS: i64 = 2 // → nxasm_v2 (substrate work; partial) 197const NX_ANCHOR_REPLACE_GNU_LD: i64 = 3 // → nx_elf_writer (substrate work) 198const NX_ANCHOR_REPLACE_QEMU: i64 = 4 // → native execution (depends on target ISA) 199const NX_ANCHOR_REPLACE_LIBC: i64 = 5 // → nx_syscalls direct (mostly done) 200const NX_ANCHOR_REPLACE_LINUX_KERNEL: i64 = 6 // → NishiOS (long arc; ~years) 201const NX_ANCHOR_REPLACE_HOST_OS: i64 = 7 // → NishiOS (long arc; ~years)