nx_eco_scorecard_gate.nx source

1// nx_eco_scorecard_gate.nx -- known-answer gate for the sovereign ecosystem scorecard. Every industry formula is 2// checked against a HAND-COMPUTED expected value in a seeded arena, so a silent formula drift cannot masquerade as 3// a healthy grade: coverage (HAVE=2/GAP=0 over 2n) -> 500; SQALE 1920min/(4 organs x120 LOC x30 min) -> 133permil 4// = rating C (tests the BAND, not just the number); OpenSSF risk-weighted (10x100 + 0x50)/(10x150) -> 666; 5// self-measured organ count via recursive walk with .nx filtering -> 4 (a .txt and a nested dir prove the filter 6// and the recursion); duplication 3/4 -> 750permil = FAIL vs the 30permil SonarQube gate (tests the FAILING 7// direction, the one that matters); and fail-closed RED when the external battery manifest is absent. 8// The arena is seeded as NATIVE SEG-STORE PLANES (not .tsv) because that is what the shipped organ reads -- 9// a gate that fed it a format production no longer uses would be testing a fiction. 10// license_tier: ORIGINAL expect_exit: 0 11import "nx_store_seed_lib.nx" 12import "nx_seg_store.nx" 13import "nx_syscalls.nx" 14 15func eg_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 16func eg_pn(v: i64) -> i64 { let b: *u8=sys_mmap(32) as *u8; var x: i64=v; var ng: i64=0; if x<0{ng=1;x=0-x} var i: i64=31; if x==0{b[i]=48 as u8;i=i-1} while x>0{b[i]=(48+x%10) as u8;x=x/10;i=i-1} if ng==1{b[i]=45 as u8;i=i-1} sys_write(1,(b as i64+i+1) as *u8,31-i); return 0 } 17func eg_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 18func eg_wfile(path: *u8, content: *u8) -> i64 { 19 let fd: i64=sys_openat_wr(path, 0x1a4) 20 if fd<0 { return 0-1 } 21 sys_write(fd, content, eg_slen(content)) 22 sys_close(fd) 23 return 0 24} 25func eg_has(buf: *u8, n: i64, needle: *u8) -> i64 { 26 let nl: i64=eg_slen(needle) 27 if nl==0 { return 0 } 28 var i: i64=0 29 while i+nl<=n { 30 var k: i64=0 31 var ok: i64=1 32 while k<nl { if buf[i+k]!=needle[k] { ok=0; k=nl } else { k=k+1 } } 33 if ok==1 { return 1 } 34 i=i+1 35 } 36 return 0 37} 38func eg_run_in(dir: *u8) -> i64 { 39 let pid: i64=sys_fork() 40 if pid<0 { return 201 } 41 if pid==0 { 42 sys_chdir(dir) 43 let av: *i64=sys_mmap(32) as *i64 44 av[0]="/tmp/nx_eco_scorecard.sov.elf\x00" as *u8 as i64 45 av[1]=0 46 sys_execve("/tmp/nx_eco_scorecard.sov.elf\x00" as *u8, av, 0 as *i64) 47 sys_exit(127) 48 return 127 49 } 50 let stp: *i64=sys_mmap(16) as *i64 51 sys_wait4(pid, stp, 0) 52 return (stp[0]>>8)&255 53} 54 55func main() -> i64 { 56 eg_puts("=== nx_eco_scorecard_gate -- known-answer industry formulas (SQALE / OpenSSF / duplication / coverage) ===\n" as *u8) 57 var fails: i64=0 58 sys_mkdir("/tmp/ecotest\x00" as *u8, 0x1ed) 59 sys_mkdir("/tmp/ecotest/knowledge\x00" as *u8, 0x1ed) 60 sys_mkdir("/tmp/ecotest/knowledge/registry\x00" as *u8, 0x1ed) 61 sys_mkdir("/tmp/ecotest/knowledge/status\x00" as *u8, 0x1ed) 62 sys_mkdir("/tmp/ecotest/buildroot\x00" as *u8, 0x1ed) 63 sys_mkdir("/tmp/ecotest/buildroot/runtime\x00" as *u8, 0x1ed) 64 sys_mkdir("/tmp/ecotest/buildroot/runtime/_hdl_build\x00" as *u8, 0x1ed) 65 sys_mkdir("/tmp/ecotest/knowledge/store\x00" as *u8, 0x1ed) 66 sys_mkdir("/tmp/ecotest_bare\x00" as *u8, 0x1ed) 67 // battery plane: 1 HAVE + 1 GAP -> coverage (2+0)/(2*2) = 500 permil 68 let sB: *u8="STD-A\tmeasA\tthrA\ttoolA\tHAVE\tevA\nSTD-B\tmeasB\tthrB\ttoolB\tGAP\tevB\n\x00" as *u8 69 sts_seed("/tmp/ecotest/knowledge/store/ecobench-\x00" as *u8, sB, eg_slen(sB)) 70 // ricketiness plane: sev8 OPEN -> 8*240 = 1920 remediation minutes; sev4 ROOTED contributes 0 71 let sF: *u8="classA\tworkaround\t8\topen\tseqX\tevA\tfixA\nclassB\tresidue\t4\trooted\tseqY\tevB\tfixB\n\x00" as *u8 72 sts_seed("/tmp/ecotest/knowledge/store/favela-\x00" as *u8, sF, eg_slen(sF)) 73 // openssf plane: (10*100 + 0*50) / (10*(100+50)) = 1000/1500 = 666 permil 74 let sO: *u8="Chk-One\t100\t10\tsovA\nChk-Two\t50\t0\tsovB\n\x00" as *u8 75 sts_seed("/tmp/ecotest/knowledge/store/openssf-\x00" as *u8, sO, eg_slen(sO)) 76 eg_wfile("/tmp/ecotest/knowledge/status/dup_source.log\x00" as *u8, 77 "scan\nDUP basename: a.nx\nDUP basename: b.nx\nDUP basename: c.nx\ndone\n\x00" as *u8) 78 // 4 .nx organs (2 nested = recursion) + 1 .txt (= filter must reject it) 79 eg_wfile("/tmp/ecotest/buildroot/runtime/one.nx\x00" as *u8, "x\n\x00" as *u8) 80 eg_wfile("/tmp/ecotest/buildroot/runtime/two.nx\x00" as *u8, "x\n\x00" as *u8) 81 eg_wfile("/tmp/ecotest/buildroot/runtime/notes.txt\x00" as *u8, "x\n\x00" as *u8) 82 eg_wfile("/tmp/ecotest/buildroot/runtime/_hdl_build/three.nx\x00" as *u8, "x\n\x00" as *u8) 83 eg_wfile("/tmp/ecotest/buildroot/runtime/_hdl_build/four.nx\x00" as *u8, "x\n\x00" as *u8) 84 85 let rc: i64=eg_run_in("/tmp/ecotest\x00" as *u8) 86 let szp: *i64=sys_mmap(16) as *i64 87 let lg: *u8=sys_read_file("/tmp/ecotest/knowledge/status/eco_scorecard.log\x00" as *u8, szp) 88 var n: i64=0 89 if (lg as i64)!=0 { n=szp[0] } 90 // T1 battery coverage 91 var t1: i64=0 92 if rc==0 { if n>0 { if eg_has(lg, n, "\x22benchmark_coverage_permil\x22:500\x00" as *u8)==1 { t1=1 } } } 93 if t1==1 { eg_puts("T1 PASS battery coverage: HAVE+GAP over 2n -> 500 permil (the anti-flattery headline)\n" as *u8) } else { fails=fails+1; eg_puts("T1 FAIL coverage rc="); eg_pn(rc); eg_puts("\n" as *u8) } 94 // T2 SQALE ratio AND band 95 var t2: i64=0 96 if n>0 { if eg_has(lg, n, "\x22td_ratio_permil\x22:133\x00" as *u8)==1 { if eg_has(lg, n, "\x22rating\x22:\x22C\x22\x00" as *u8)==1 { t2=1 } } } 97 if t2==1 { eg_puts("T2 PASS sovereign SQALE: 1920min / (4 organs x 120 LOC x 30 min) = 133 permil -> rating C (band tested)\n" as *u8) } else { fails=fails+1; eg_puts("T2 FAIL sqale\n" as *u8) } 98 // T3 OpenSSF risk-weighted aggregate 99 var t3: i64=0 100 if n>0 { if eg_has(lg, n, "\x22aggregate_permil\x22:666\x00" as *u8)==1 { t3=1 } } 101 if t3==1 { eg_puts("T3 PASS OpenSSF risk-weighted aggregate: (10x100 + 0x50)/(10x150) = 666 permil\n" as *u8) } else { fails=fails+1; eg_puts("T3 FAIL openssf\n" as *u8) } 102 // T4 self-measured scope: recursion + .nx filter 103 var t4: i64=0 104 if n>0 { if eg_has(lg, n, "\x22organs_self_measured\x22:4\x00" as *u8)==1 { t4=1 } } 105 if t4==1 { eg_puts("T4 PASS scope self-measured = 4 organs (recursed into _hdl_build, rejected the .txt)\n" as *u8) } else { fails=fails+1; eg_puts("T4 FAIL organ count\n" as *u8) } 106 // T5 duplication gate FAILING direction 107 var t5: i64=0 108 if n>0 { if eg_has(lg, n, "\x22ratio_permil\x22:750\x00" as *u8)==1 { if eg_has(lg, n, "\x22verdict\x22:\x22FAIL\x22\x00" as *u8)==1 { t5=1 } } } 109 if t5==1 { eg_puts("T5 PASS duplication 3/4 = 750 permil -> FAIL vs the 30 permil SonarQube gate (failing direction proven)\n" as *u8) } else { fails=fails+1; eg_puts("T5 FAIL duplication\n" as *u8) } 110 // T6 evidence colocation 111 var t6: i64=0 112 if n>0 { if eg_has(lg, n, "VERDICT=GREEN benchmarks=2\x00" as *u8)==1 { t6=1 } } 113 if t6==1 { eg_puts("T6 PASS evidence log colocated with a VERDICT line\n" as *u8) } else { fails=fails+1; eg_puts("T6 FAIL verdict line\n" as *u8) } 114 // T7 fail-closed without the external battery manifest 115 let rc7: i64=eg_run_in("/tmp/ecotest_bare\x00" as *u8) 116 var t7: i64=0 117 if rc7==1 { t7=1 } 118 if t7==1 { eg_puts("T7 PASS fail-closed: no external battery manifest = RED exit 1 (no grade without data)\n" as *u8) } else { fails=fails+1; eg_puts("T7 FAIL rc7="); eg_pn(rc7); eg_puts("\n" as *u8) } 119 if fails==0 { eg_puts("ECO-SCORECARD GREEN -- every industry formula matches its hand-computed answer; grading is external-anchored, not self-invented\n" as *u8); sys_exit(0); return 0 } 120 eg_puts("ECO-SCORECARD RED fails="); eg_pn(fails); eg_puts("\n" as *u8) 121 sys_exit(1) 122 return 1 123}