code wiki / _hdl_build / nx_discocensus.nx
nx_discocensus.nx source
↩ module page · 319 lines · 18901 B
1// nx_discocensus.nx -- DISCOVERABILITY CENSUS (2026-08-06). Measures, on every run, how much of the tool
2// registry is actually USABLE by an agent: does each tool carry a call contract, and is its safety profile
3// derived rather than fabricated?
4//
5// WHY THIS ORGAN EXISTS -- the failure it is built to prevent, with a receipt. Debt 1784549913 filed the
6// missing-col8 gap when the estate had 111 MCP tools and 21 typed contracts. Nobody re-measured. By
7// 2026-08-06 it was 749 of 869 -- the SAME defect, EIGHT TIMES LARGER, sitting open the whole time.
8// ★★★★★★ AN OPEN DEBT WHOSE MEASURED SIZE GREW 8x WHILE NOBODY RE-MEASURED IT *IS* THE DRIVE-THE-PLAN
9// FAILURE. A number that is only ever measured by hand is measured once. This makes it a standing
10// instrument so the PM sees the trend without a human deciding to look.
11// Siblings, deliberately NOT duplicated: nx_adopt answers "which primitives has nobody adopted",
12// nx_wirecensus answers "registered but never called". This answers "discoverable ENOUGH TO CALL".
13//
14// HONEST BY CONSTRUCTION: every figure is a COUNT of rows that exist on disk -- nothing is asserted, and a
15// missing input file is REFUSED, never silently treated as zero coverage (a zero you cannot distinguish
16// from an unreadable file is the bounded-read defect all over again). Floors live in a CONF, not in code
17// (rule 11); with no conf the verdict is UNKNOWN and the census still prints -- it will not invent a bar
18// to grade itself against.
19// nx_discocensus -> JSON census on stdout; exit 0 GREEN/UNKNOWN, 1 RED (a floor was breached)
20// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
21import "nx_mgmt_api.nx"
22import "nx_syscalls.nx"
23const DC_MAGIC_2048: i64 = 2048
24const DC_MAGIC_2047: i64 = 2047
25
26const DC_FCAP: i64 = 1 << 21
27const DC_NAMECAP: i64 = 128
28const DC_CONF: *u8 = "knowledge/discocensus.conf" as *u8
29
30func dcw(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
31func dcn(v: i64) -> i64 {
32 let b: *u8 = sys_mmap(32)
33 var x: i64 = v
34 var i: i64 = 31
35 if x == 0 { b[i] = 48 as u8; i = i - 1 }
36 while x > 0 { b[i] = ((48 + (x - ((x / 10) * 10))) as u8); x = x / 10; i = i - 1 }
37 sys_write(1, ((b as i64) + i + 1) as *u8, 31 - i)
38 return 0
39}
40// idx-th TAB field of buf[ls,le) -> out2=(off,len)
41func dc_field(buf: *u8, ls: i64, le: i64, idx: i64, out2: *i64) -> i64 {
42 var fi: i64 = 0
43 var s: i64 = ls
44 var i: i64 = ls
45 while i <= le {
46 var sep: i64 = 0
47 if i == le { sep = 1 } else { if buf[i] == (9 as u8) { sep = 1 } }
48 if sep == 1 {
49 if fi == idx { out2[0] = s; out2[1] = i - s; return 1 }
50 fi = fi + 1
51 s = i + 1
52 }
53 i = i + 1
54 }
55 return 0
56}
57// Does `buf` hold a row whose field 0 == name, and (if needcol>=0) whose field needcol is non-empty?
58func dc_row_has(buf: *u8, n: i64, name: *u8, nlen: i64, needcol: i64) -> i64 {
59 if (buf as i64) == 0 { return 0 }
60 let f: *i64 = sys_mmap(16) as *i64
61 var ls: i64 = 0
62 var i: i64 = 0
63 while i <= n {
64 var eol: i64 = 0
65 if i == n { eol = 1 } else { if buf[i] == (10 as u8) { eol = 1 } }
66 if eol == 1 {
67 if i > ls { if buf[ls] != (35 as u8) {
68 if dc_field(buf, ls, i, 0, f) == 1 {
69 if f[1] == nlen {
70 var m: i64 = 1
71 var c: i64 = 0
72 while c < nlen { if buf[f[0]+c] != name[c] { m = 0; c = nlen } else { c = c + 1 } }
73 if m == 1 {
74 if needcol < 0 { return 1 }
75 if dc_field(buf, ls, i, needcol, f) == 1 { if f[1] > 0 { return 1 } }
76 return 0
77 }
78 }
79 }
80 } }
81 ls = i + 1
82 }
83 i = i + 1
84 }
85 return 0
86}
87func dc_slurp(path: *u8, szp: *i64) -> *u8 { return sys_read_file(path, szp) }
88// first integer on the conf line whose key matches `key`; -1 if absent
89func dc_conf_int(buf: *u8, n: i64, key: *u8) -> i64 {
90 if (buf as i64) == 0 { return 0 - 1 }
91 var kl: i64 = 0
92 while key[kl] != (0 as u8) { kl = kl + 1 }
93 var ls: i64 = 0
94 var i: i64 = 0
95 while i <= n {
96 var eol: i64 = 0
97 if i == n { eol = 1 } else { if buf[i] == (10 as u8) { eol = 1 } }
98 if eol == 1 {
99 if i > ls { if buf[ls] != (35 as u8) {
100 var m: i64 = 1
101 var c: i64 = 0
102 while c < kl { if ls + c >= i { m = 0; c = kl } else { if buf[ls+c] != key[c] { m = 0; c = kl } else { c = c + 1 } } }
103 if m == 1 {
104 var p: i64 = ls + kl
105 var v: i64 = 0 - 1
106 while p < i {
107 let ch: i64 = buf[p] as i64
108 if ch >= 48 { if ch <= 57 { if v < 0 { v = 0 } v = v * 10 + (ch - 48) } }
109 p = p + 1
110 }
111 if v >= 0 { return v }
112 }
113 } }
114 ls = i + 1
115 }
116 i = i + 1
117 }
118 return 0 - 1
119}
120
121// ---- 2026-08-21: A COUNT WITHOUT A WORKLIST IS NOT ACTIONABLE, AND THIS ORGAN IS THE ENFORCER. -----
122// This census printed ADVERTISED_BUT_UNRUNNABLE=1 against a floor of 0 and never said WHICH ROW. Finding
123// it by hand cost a full read of the 84,658-byte allowlist plus a stat of every .elf.new row it names --
124// work the organ had ALREADY DONE, once per row, and then thrown away. Same for the 24 rows with no
125// schema and the 109 with no call contract: three RED numbers, zero names. The reason is always in hand
126// at measure time; keeping only the verdict bit is what makes a counter unactionable.
127// (The row it could not name was nxcc_wit86011501 -> nx_compile_x86.elf.new, a session-scoped A/B witness
128// stage a promote had consumed.)
129// NO SILENT CAP: each arena is DERIVED from the input, not guessed. Every emitted entry is a name plus at
130// most three punctuation bytes (a comma and two quotes); the names are a strict subset of the allowlist
131// bytes and there can be at most one row per two bytes, so an + 3*(an/2) bounds a list -- DC_LIST_MULT*an
132// is that bound rounded up to whole multiples. The overflow flag is still emitted, because a bound you
133// believe rather than check is the same defect one level up.
134const DC_QUOTE: i64 = 34
135const DC_COMMA: i64 = 44
136const DC_LIST_MULT: i64 = 3
137
138// Append `,"name"` (or `"name"` for the first entry) and return the new offset, or -1 if it would not
139// fit. A -1 is propagated to an overflow flag; it is never silently dropped.
140func dc_app(dst: *u8, off: i64, cap: i64, nm: *u8, nl: i64, first: i64) -> i64 {
141 if off < 0 { return 0 - 1 }
142 if off + nl + 3 >= cap { return 0 - 1 }
143 var o: i64 = off
144 if first == 0 { dst[o] = DC_COMMA as u8; o = o + 1 }
145 dst[o] = DC_QUOTE as u8; o = o + 1
146 var i: i64 = 0
147 while i < nl { dst[o] = nm[i]; o = o + 1; i = i + 1 }
148 dst[o] = DC_QUOTE as u8; o = o + 1
149 return o
150}
151
152// Emit `,"<key>":[<list>]` -- and when the arena overflowed, say so IN THE FIELD rather than printing a
153// prefix that reads like a population. A list that is silently a prefix of its own count is the exact
154// defect this whole block exists to remove.
155func dc_emit_list(key: *u8, buf: *u8, off: i64, n: i64) -> i64 {
156 dcw(",\"" as *u8); dcw(key); dcw("\":" as *u8)
157 if off < 0 {
158 dcw("\"LIST-OVERFLOWED-THIS-IS-NOT-A-POPULATION\"" as *u8)
159 return 0
160 }
161 dcw("[" as *u8)
162 if n > 0 { sys_write(1, buf, off) }
163 dcw("]" as *u8)
164 return 0
165}
166
167func main() -> i64 {
168 let azp: *i64 = sys_mmap(16) as *i64
169 let al: *u8 = dc_slurp("tool_allowlist.conf" as *u8, azp)
170 if (al as i64) == 0 { dcw("{\"organ\":\"nx_discocensus\",\"refused\":\"tool_allowlist.conf unreadable\"}\n" as *u8); sys_exit(2); return 2 }
171 let an: i64 = azp[0]
172 let szp: *i64 = sys_mmap(16) as *i64
173 let sb: *u8 = dc_slurp("knowledge/tool_schemas.conf" as *u8, szp)
174 if (sb as i64) == 0 { dcw("{\"organ\":\"nx_discocensus\",\"refused\":\"knowledge/tool_schemas.conf unreadable -- a zero you cannot distinguish from an unreadable file is not a measurement\"}\n" as *u8); sys_exit(2); return 2 }
175 let sn: i64 = szp[0]
176 let gzp: *i64 = sys_mmap(16) as *i64
177 let gb: *u8 = dc_slurp("knowledge/tool_grammar.conf" as *u8, gzp)
178 var gn: i64 = 0
179 if (gb as i64) != 0 { gn = gzp[0] }
180 let fzp: *i64 = sys_mmap(16) as *i64
181 let fb: *u8 = dc_slurp("knowledge/tool_flags.conf" as *u8, fzp)
182 var fn: i64 = 0
183 if (fb as i64) != 0 { fn = fzp[0] }
184
185 var tools: i64 = 0
186 var has_schema: i64 = 0
187 var has_grammar: i64 = 0
188 var has_flags: i64 = 0
189 var runnable: i64 = 0
190 var unrunnable: i64 = 0
191 // THE WORKLISTS. Same pass, same evidence, no second scan -- the names were already in hand.
192 let lcap: i64 = an * DC_LIST_MULT
193 let ur_buf: *u8 = sys_mmap(lcap)
194 let ns_buf: *u8 = sys_mmap(lcap)
195 let nc_buf: *u8 = sys_mmap(lcap)
196 var ur_off: i64 = 0
197 var ns_off: i64 = 0
198 var nc_off: i64 = 0
199 var ns_n: i64 = 0
200 var nc_n: i64 = 0
201 let nm: *u8 = sys_mmap(DC_NAMECAP)
202 var i: i64 = 0
203 while i < an {
204 var le: i64 = i
205 var sc: i64 = 1
206 while sc == 1 { if le >= an { sc = 0 } else { if al[le] == (10 as u8) { sc = 0 } else { le = le + 1 } } }
207 var ok: i64 = 1
208 if le <= i { ok = 0 }
209 if ok == 1 { if al[i] == (35 as u8) { ok = 0 } }
210 if ok == 1 {
211 var nl: i64 = 0
212 var p: i64 = i
213 var s2: i64 = 1
214 while s2 == 1 {
215 if p >= le { s2 = 0 } else {
216 if al[p] == (9 as u8) { s2 = 0 } else {
217 if nl < DC_NAMECAP - 1 { nm[nl] = al[p]; nl = nl + 1 }
218 p = p + 1
219 }
220 }
221 }
222 nm[nl] = 0 as u8
223 if nl > 0 {
224 tools = tools + 1
225 // RUNNABLE? The census measured whether a tool could be DESCRIBED, never whether it could
226 // be CALLED. MEASURED 2026-08-07: 16 of 883 rows point at a STAGED .elf.new, and 4 of
227 // those stages had ALREADY BEEN CONSUMED BY A PROMOTE -- nx_skullsdf_staged,
228 // nx_meshmerge_staged, nx_mhbench_staged, nx_skinwrap_staged are advertised in tools/list
229 // and return exit 127 NOT-FOUND. Proven by calling one, not inferred from the filesystem.
230 // A perfectly documented tool that cannot execute is still a discoverability failure.
231 // p sits ON the tab that ended the NAME field, so the elf begins at p+1. Reading from p
232 // made the field empty and both counters sat at a FABRICATED ZERO -- the exact defect class
233 // this session removed elsewhere, shipped by me into the very organ that measures it.
234 var ep: i64 = p + 1
235 var eend: i64 = ep
236 var eg: i64 = 1
237 while eg == 1 { if eend >= le { eg = 0 } else { if al[eend] == (9 as u8) { eg = 0 } else { eend = eend + 1 } } }
238 if eend > ep {
239 let epath: *u8 = sys_mmap(DC_MAGIC_2048)
240 var ec: i64 = 0
241 while ec < eend - ep { if ec < DC_MAGIC_2047 { epath[ec] = al[ep + ec] } ec = ec + 1 }
242 epath[eend - ep] = 0 as u8
243 let efd: i64 = sys_openat_rd(epath)
244 if efd < 0 {
245 // NAME IT. The stat that decides this counter is right here; the name costs nothing
246 // to keep and everything to re-derive by hand.
247 ur_off = dc_app(ur_buf, ur_off, lcap, nm, nl, unrunnable)
248 unrunnable = unrunnable + 1
249 } else { sys_close(efd); runnable = runnable + 1 }
250 } if dc_row_has(sb, sn, nm, nl, 0 - 1) == 1 { has_schema = has_schema + 1 } else { ns_off = dc_app(ns_buf, ns_off, lcap, nm, nl, ns_n); ns_n = ns_n + 1 }
251 // a CALL CONTRACT is authored col8 (field 7) OR a derived grammar row
252 var g: i64 = 0
253 if dc_row_has(sb, sn, nm, nl, 7) == 1 { g = 1 }
254 if g == 0 { if gn > 0 { if dc_row_has(gb, gn, nm, nl, 1) == 1 { g = 1 } } }
255 if g == 1 { has_grammar = has_grammar + 1 } else { nc_off = dc_app(nc_buf, nc_off, lcap, nm, nl, nc_n); nc_n = nc_n + 1 }
256 if fn > 0 { if dc_row_has(fb, fn, nm, nl, 1) == 1 { has_flags = has_flags + 1 } }
257 }
258 }
259 i = le + 1
260 }
261
262 var schema_pm: i64 = 0
263 var grammar_pm: i64 = 0
264 var flags_pm: i64 = 0
265 if tools > 0 {
266 schema_pm = (has_schema * 1000) / tools
267 grammar_pm = (has_grammar * 1000) / tools
268 flags_pm = (has_flags * 1000) / tools
269 }
270 let czp: *i64 = sys_mmap(16) as *i64
271 let cb: *u8 = dc_slurp(DC_CONF, czp)
272 var cn: i64 = 0
273 if (cb as i64) != 0 { cn = czp[0] }
274 let gf: i64 = dc_conf_int(cb, cn, "grammar_floor_permil" as *u8)
275 let ff: i64 = dc_conf_int(cb, cn, "flags_floor_permil" as *u8)
276 let sf: i64 = dc_conf_int(cb, cn, "schema_floor_permil" as *u8)
277
278 var red: i64 = 0
279 var known: i64 = 0
280 if gf >= 0 { known = 1; if grammar_pm < gf { red = 1 } }
281 // A tool that cannot EXECUTE is a discoverability failure however well documented -- its own floor.
282 // unrunnable_max absent = -1 = UNCONFIGURED = UNKNOWN, never a silent pass.
283 let umax: i64 = dc_conf_int(cb, cn, "unrunnable_max" as *u8)
284 if umax >= 0 { known = 1; if unrunnable > umax { red = 1 } }
285 if ff >= 0 { known = 1; if flags_pm < ff { red = 1 } }
286 if sf >= 0 { known = 1; if schema_pm < sf { red = 1 } }
287
288 dcw("{\"organ\":\"nx_discocensus\",\"tools\":" as *u8); dcn(tools)
289 dcw(",\"with_schema_row\":" as *u8); dcn(has_schema)
290 dcw(",\"with_call_contract\":" as *u8); dcn(has_grammar)
291 dcw(",\"with_derived_flags\":" as *u8); dcn(has_flags)
292 dcw(",\"runnable\":" as *u8); dcn(runnable)
293 dcw(",\"ADVERTISED_BUT_UNRUNNABLE\":" as *u8); dcn(unrunnable)
294 dcw(",\"schema_permil\":" as *u8); dcn(schema_pm)
295 dcw(",\"contract_permil\":" as *u8); dcn(grammar_pm)
296 dcw(",\"flags_permil\":" as *u8); dcn(flags_pm)
297 dcw(",\"floors\":{\"schema\":" as *u8); dcn(sf)
298 dcw(",\"contract\":" as *u8); dcn(gf)
299 dcw(",\"flags\":" as *u8); dcn(ff)
300 dcw(",\"unrunnable_max\":" as *u8); dcn(umax)
301 dcw("}" as *u8)
302 // A PARTITION IS A CLAIM: CHECK THE PARTS SUM, AND PRINT THE SUM. Each list is the exact complement
303 // of its counter, so with + without must equal tools. If either sum disagrees the lists are not the
304 // populations they claim to be, and that is visible here rather than inferred later.
305 dcw(",\"schema_partition_sum\":" as *u8); dcn(has_schema + ns_n)
306 dcw(",\"contract_partition_sum\":" as *u8); dcn(has_grammar + nc_n)
307 // THE WORKLISTS TRAVEL WITH THE COUNTS. Each list is the POPULATION of its counter, never a prefix:
308 // an overflowed arena prints a marker instead of a truncated list, so a short list can never be read
309 // as a small problem.
310 dc_emit_list("ADVERTISED_BUT_UNRUNNABLE_names" as *u8, ur_buf, ur_off, unrunnable)
311 dc_emit_list("no_schema_row_names" as *u8, ns_buf, ns_off, ns_n)
312 dc_emit_list("no_call_contract_names" as *u8, nc_buf, nc_off, nc_n)
313 dcw(",\"verdict\":\"" as *u8)
314 if known == 0 { dcw("UNKNOWN" as *u8) } else { if red == 1 { dcw("RED" as *u8) } else { dcw("GREEN" as *u8) } }
315 dcw("\",\"note\":\"SCOPE: every figure here is measured over tool_allowlist.conf, which governs CALLABILITY. tools/list is served from the toolreg- REGISTRY plane, which governs ADVERTISEMENT, and the two diverge (measured 2026-08-07: ~909 advertised vs ~887 allowlisted. That gap is NOT the same as broken: a tool with an HTTP BACKEND (nishi_search, nishi_doc) is reached in-process over loopback and needs NO allowlist row at all, so ABSENCE FROM ONE REGISTRY IS NOT ABSENCE FROM THE SYSTEM. Use nx_toolreg_reconcile drift for that axis; it knows both execution kinds). So ADVERTISED_BUT_UNRUNNABLE=0 means no ALLOWLISTED row lacks its elf; it does NOT mean tools/list is clean. A CENSUS THAT READS A DIFFERENT REGISTRY THAN THE CONSUMER CANNOT SEE THE CONSUMER-S DEFECT -- nx_toolreg_reconcile drift is the measure for that axis. A call contract is an AUTHORED tool_schemas col8 or a DERIVED tool_grammar row; -1 floor = not configured = UNKNOWN, never a pass. Regenerate inputs with nx_toolgrammar + nx_toolflags.\"}\n" as *u8)
316 if red == 1 { sys_exit(1); return 1 }
317 sys_exit(0)
318 return 0
319}