code wiki / _hdl_build / nx_envelope_audit.nx
`nx_envelope_audit.nx` source

↩ module page · 330 lines · 21076 B
1// nx_envelope_audit.nx -- F227 THE SCALE-ENVELOPE SWEEP (operator scale-law: "every tool DECLARES its
2// envelope IN ITS OUTPUT -- silent capping is forbidden BY CONSTRUCTION"; editcover row 3 silent-truncation).
3// A bounded read that never says it was bounded is how a seat (any model) silently believes a partial answer
4// is the whole answer -- the ark v1 lesson and the nx_debt 64KB blind spot were both this class. This organ
5// MEASURES the law across the fleet a seat can actually CALL (the registered tool_allowlist rows -- not all
6// ~15k .nx, that is the honest scope: an unregistered organ cannot mislead an agent).
7// PER ROW: resolve the source from the elf basename -> probe buildroot/runtime/_hdl_build/<base>.nx then
8// buildroot/runtime/<base>.nx -> classify:
9//   DECLARING          = source carries an envelope-declaration marker (envelope | caps: | window_bytes)
10//   SILENT-CAP-CAND    = has bounded-read consts (_CAP / _MAX) but NO declaration  <- the actionable set
11//   UNBOUNDED-OR-NA    = no bounded-read consts found (nothing to declare, or reads are unbounded)
12//   NAME-PROBE-MISS    = no <elfbase>.nx in either probe dir. NOT proof of missing source: a tool's elf and
13//     source names can DIVERGE (verified 07-20: nx_fs_write.elf builds from nx_fsops_write.nx). Treat as
14//     'not found BY NAME PROBE' and verify by content before ever claiming a source is lost.
15// LIAR-KILLED: this is a CANDIDATE detector over source text, never an absolute verdict -- the output says so,
16// and it reports counts + the candidate list so a human/referee adjudicates. Measurement first; a ratchet
17// floor comes only AFTER a measured baseline (never a gate on an unmeasured fleet).
18//
19// 2026-08-20 (lane K, failure-detector census) -- THE SILENT-CAP DETECTOR HAD A SILENT CAP.
20// A row-cap gate wrapped the whole per-row body and the row counter only incremented INSIDE it, so every
21// allowlist row past the cap was dropped with no counter, no flag and no marker -- and the dogfood line
22// then printed the cap as a HAND-TYPED literal, which read as a population. MEASURED: the served binary
23// reported rows=512 against a tool_allowlist.conf of 81243 bytes whose line 906 exists, i.e. it published
24// a distribution over the HEAD of a sorted file and called it the fleet.
25// ***THE ENFORCER COMMITTED THE DEFECT IT ENFORCES, AND ITS OWN OUTPUT WAS THE ALIBI.***
26// FIXED HERE: (1) the row gate is REMOVED -- nothing was indexed by the row counter, so the cap bounded
27// only wall time and bought nothing; (2) every remaining bound is now DERIVED from its own const and
28// printed, never re-typed in prose (a hand-typed copy of a cap is a second copy of that cap's shape and
29// the two drift silently); (3) each capped LIST says it is a prefix of its own count; (4) the partition is
30// printed and reconciled; (5) an incomplete audit exits EA_EXIT_PARTIAL instead of publishing a confident
31// distribution -- the nx_undefscan rule that a zero from an incomplete scan must still exit non-zero.
32// DOGFOOD: declares its OWN envelope in its own output, every field derived from the constant it bounds.
33//   nx_envelope_audit [allowlist] [outpath]
34// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
35import "nx_syscalls.nx"
36
37const EA_ALLOW: *u8 = "tool_allowlist.conf" as *u8
38const EA_OUT: *u8 = "knowledge/status/envelope_audit.log" as *u8
39const EA_D1: *u8 = "buildroot/runtime/_hdl_build/" as *u8
40const EA_D2: *u8 = "buildroot/runtime/" as *u8
41const EA_ALLOWCAP: i64 = 262144
42const EA_SRCCAP: i64 = 262144
43const EA_REPCAP: i64 = 131072
44const EA_MAXLIST: i64 = 64
45// Bytes held back at the tail of the report buffer so that the COVERAGE line -- the one line that says
46// whether anything above it can be trusted -- can never be the thing that gets truncated. Named for this
47// one purpose: a constant serving two unrelated purposes can never be tuned for either.
48const EA_TAILRESERVE: i64 = 1024
49// A scan that could not cover its own input must not publish a confident distribution. Same contract as
50// nx_undefscan's US_EXIT_PARTIAL: the count is a FLOOR, and the exit code says so out loud.
51const EA_EXIT_PARTIAL: i64 = 5
52const EA_NL: i64 = 10
53const EA_TAB: i64 = 9
54const EA_HASH: i64 = 35
55const EA_SLASH: i64 = 47
56const EA_DOT: i64 = 46
57const EA_MODE: i64 = 0x1a4
58const EA_STDOUT: i64 = 1
59const EA_STDERR: i64 = 2
60const EA_PATHCAP: i64 = 512
61const EA_NAMECAP: i64 = 256
62
63func ea_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
64func ea_werr(s: *u8) -> i64 { sys_write(EA_STDERR, s, ea_slen(s)); return 0 }
65func ea_puts(b: *u8, off: i64, s: *u8) -> i64 { var o: i64 = off; var j: i64 = 0; while s[j] != (0 as u8) { if o < EA_REPCAP - 8 { b[o] = s[j]; o = o + 1 } j = j + 1 } return o }
66func ea_puti(b: *u8, off: i64, v: i64) -> i64 {
  var o: i64 = off
  var m: i64 = v
  if m < 0 { b[o] = 45 as u8; o = o + 1; m = 0 - m }
  let t: *u8 = sys_mmap(28)
  var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0
  while i < k { if o < EA_REPCAP - 8 { b[o] = t[k - 1 - i]; o = o + 1 } i = i + 1 }
  return o
77}
78func ea_read(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var n: i64 = 0
  var go: i64 = 1
  while go == 1 { let r: i64 = sys_read(fd, (buf as i64 + n) as *u8, cap - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap { go = 0 } }
  sys_close(fd)
  return n
86}
87func ea_has(buf: *u8, n: i64, needle: *u8) -> i64 {
  let m: i64 = ea_slen(needle)
  if m == 0 { return 0 }
  if m > n { return 0 }
  var i: i64 = 0
  while i + m <= n {
      var j: i64 = 0
      var ok: i64 = 1
      while j < m { if buf[i+j] != needle[j] { ok = 0; j = m } else { j = j + 1 } }
      if ok == 1 { return 1 }
      i = i + 1
  }
  return 0
100}
101// ***A MARKER IN A COMMENT IS DOCUMENTATION; A MARKER IN AN EMITTED STRING IS A DECLARATION.*** ea_has
102// above cannot tell them apart, and that difference is exactly the gap between a tool that DOCUMENTS an
103// envelope and one that PRINTS one.
104// MEASURED 2026-08-06 (ws=resume-surface-rearm): nx_shelltool.nx carries the word "envelope" ONLY inside a
105// comment about its out= feature -- "results to disk, envelope on the wire" -- so this audit counted it
106// DECLARING, while its grep verb silently capped EVERY file at 1048575 bytes read from offset 0 with no
107// per-file declaration anywhere. That undeclared cap left 55pc of knowledge/status unsearchable and
108// returned matches=0 for content that was demonstrably present (debt 1786057862). The audit had the right
109// tool in front of it and no way to see the defect.
110// A DETECTOR THAT READS SOURCE TEXT CANNOT ENFORCE A CONTRACT DEFINED ON RUNTIME OUTPUT -- the same root
111// as the D001 generator skipping any gate whose "verdict=GREEN" is split across two puts (1786058313).
112// THIS DOES NOT FULLY CLOSE THAT GAP and the envelope below now says so: the honest end state is probing
113// each tool's EMITTED bytes, which needs a per-tool read-only probe manifest because this allowlist
114// contains WRITERS (nx_fs_write, nx_store_put) that must never be invoked speculatively. What this fixes is
115// the half a text scanner CAN decide: comment-only markers no longer count as declarations.
116func ea_has_code(buf: *u8, n: i64, needle: *u8) -> i64 {
  let m: i64 = ea_slen(needle)
  if m == 0 { return 0 }
  if m > n { return 0 }
  var i: i64 = 0
  while i + m <= n {
      var j: i64 = 0
      var ok: i64 = 1
      while j < m { if buf[i+j] != needle[j] { ok = 0; j = m } else { j = j + 1 } }
      if ok == 1 {
          // walk back to this line's start, then look for a "//" that precedes the hit on the same line
          var ls: i64 = i
          var go: i64 = 1
          while go == 1 { if ls == 0 { go = 0 } else { if buf[ls-1] == (10 as u8) { go = 0 } else { ls = ls - 1 } } }
          var cmt: i64 = 0
          var k: i64 = ls
          while k + 1 <= i { if buf[k] == (47 as u8) { if buf[k+1] == (47 as u8) { cmt = 1; k = i } } k = k + 1 }
          if cmt == 0 { return 1 }
      }
      i = i + 1
  }
  return 0
138}
139func main(argc: i64, argv: *i64) -> i64 {
  var allow: *u8 = EA_ALLOW
  var outp: *u8 = EA_OUT
  if argc > 1 { allow = argv[1] as *u8 }
  if argc > 2 { outp = argv[2] as *u8 }
  let ab: *u8 = sys_mmap(EA_ALLOWCAP)
  let an: i64 = ea_read(allow, ab, EA_ALLOWCAP)
  if an <= 0 { ea_werr("ENVELOPE-AUDIT READ-FAIL: tool_allowlist unreadable\n" as *u8); sys_exit(4); return 4 }
  let src: *u8 = sys_mmap(EA_SRCCAP)
  let rep: *u8 = sys_mmap(EA_REPCAP)
  let cand: *u8 = sys_mmap(EA_REPCAP)
  let miss: *u8 = sys_mmap(EA_REPCAP)
  let base: *u8 = sys_mmap(EA_NAMECAP)
  let name: *u8 = sys_mmap(EA_NAMECAP)
  let path: *u8 = sys_mmap(EA_PATHCAP)
  var co: i64 = 0
  var mo: i64 = 0
  var rows: i64 = 0
  var declaring: i64 = 0
  var silent: i64 = 0
  var na: i64 = 0
  var missing: i64 = 0
  var listed: i64 = 0
  var mlisted: i64 = 0
  var srccapped: i64 = 0
  var i: i64 = 0
  while i < an {
      var le: i64 = i
      var s: i64 = 1
      while s == 1 { if le >= an { s = 0 } else { if ab[le] == (EA_NL as u8) { s = 0 } else { le = le + 1 } } }
      if le > i { if ab[i] != (EA_HASH as u8) {
              var ne: i64 = i
              var s2: i64 = 1
              while s2 == 1 { if ne >= le { s2 = 0 } else { if ab[ne] == (EA_TAB as u8) { s2 = 0 } else { ne = ne + 1 } } }
              if ne > i { if ne < le {
                  var k: i64 = 0
                  while i + k < ne { if k < EA_NAMECAP - 2 { name[k] = ab[i + k] } k = k + 1 }
                  name[k] = 0 as u8
                  var ps: i64 = ne + 1
                  var pe: i64 = ps
                  var s3: i64 = 1
                  while s3 == 1 { if pe >= le { s3 = 0 } else { if ab[pe] == (EA_TAB as u8) { s3 = 0 } else { pe = pe + 1 } } }
                  var bs: i64 = ps
                  var scan: i64 = ps
                  while scan < pe { if ab[scan] == (EA_SLASH as u8) { bs = scan + 1 } scan = scan + 1 }
                  var be: i64 = pe
                  if be - bs > 4 { if ab[be-4] == (EA_DOT as u8) { be = be - 4 } }
                  var bk: i64 = 0
                  while bs + bk < be { if bk < EA_NAMECAP - 2 { base[bk] = ab[bs + bk] } bk = bk + 1 }
                  base[bk] = 0 as u8
                  if bk > 0 {
                      rows = rows + 1
                      var po: i64 = ea_puts(path, 0, EA_D1)
                      po = ea_puts(path, po, base)
                      po = ea_puts(path, po, ".nx" as *u8)
                      path[po] = 0 as u8
                      var sn: i64 = ea_read(path, src, EA_SRCCAP)
                      if sn <= 0 {
                          po = ea_puts(path, 0, EA_D2)
                          po = ea_puts(path, po, base)
                          po = ea_puts(path, po, ".nx" as *u8)
                          path[po] = 0 as u8
                          sn = ea_read(path, src, EA_SRCCAP)
                      }
                      if sn <= 0 {
                          missing = missing + 1
                          if mlisted < EA_MAXLIST { mo = ea_puts(miss, mo, base); mo = ea_puts(miss, mo, " " as *u8); mlisted = mlisted + 1 }
                      } else {
                          // A source read that FILLED the buffer was bounded, so this row's verdict rests
                          // on a partial read: a declaration living past the cap reads as absent and the
                          // tool is wrongly accused. Counted, printed, never silent.
                          if sn >= EA_SRCCAP { srccapped = srccapped + 1 }
                          // ea_has_code, not ea_has: a marker inside a COMMENT documents an envelope, it
                          // does not emit one. Applied to the bound consts too -- a _CAP mentioned only in
                          // prose would otherwise mark a tool BOUNDED and manufacture a candidate.
                          var decl: i64 = 0
                          if ea_has_code(src, sn, "envelope" as *u8) == 1 { decl = 1 }
                          if ea_has_code(src, sn, "caps:" as *u8) == 1 { decl = 1 }
                          if ea_has_code(src, sn, "window_bytes" as *u8) == 1 { decl = 1 }
                          // ALIGNED WITH LAW L011 (2026-08-06). nx_law_warden enforces L011 as "corpus
                          // scanners that walk a directory but HIDE their coverage (no scanned/
                          // coverage_complete/capped honesty flag)" -- yet this audit recognised NONE of
                          // those three tokens, so a tool declaring coverage in the vocabulary the WARDEN
                          // mandates still counted as silent here. TWO INSTRUMENTS MUST NOT CARRY TWO
                          // DEFINITIONS OF THE SAME PROPERTY: a scanner cannot be simultaneously L011-
                          // compliant and an envelope-audit candidate for the same output line.
                          // This is deliberately NOT arbitrary vocabulary-widening -- every token added
                          // here is one an existing law already requires, which is the difference between
                          // matching a known good and moving a cliff.
                          if ea_has_code(src, sn, "coverage_complete" as *u8) == 1 { decl = 1 }
                          if ea_has_code(src, sn, "scanned=" as *u8) == 1 { decl = 1 }
                          if ea_has_code(src, sn, "capped=" as *u8) == 1 { decl = 1 }
                          var bounded: i64 = 0
                          if ea_has_code(src, sn, "_CAP" as *u8) == 1 { bounded = 1 }
                          if ea_has_code(src, sn, "_MAX" as *u8) == 1 { bounded = 1 }
                          if decl == 1 { declaring = declaring + 1 }
                          else {
                              if bounded == 1 {
                                  silent = silent + 1
                                  if listed < EA_MAXLIST { co = ea_puts(cand, co, name); co = ea_puts(cand, co, " " as *u8); listed = listed + 1 }
                              } else { na = na + 1 }
                          }
                      }
                  }
              } }
      } }
      i = le + 1
  }
  var o: i64 = 0
  o = ea_puts(rep, o, "ENVELOPE-AUDIT (F227 scale-law sweep) rows=" as *u8)
  o = ea_puti(rep, o, rows)
  o = ea_puts(rep, o, " declaring=" as *u8)
  o = ea_puti(rep, o, declaring)
  o = ea_puts(rep, o, " silent_cap_candidates=" as *u8)
  o = ea_puti(rep, o, silent)
  o = ea_puts(rep, o, " unbounded_or_na=" as *u8)
  o = ea_puti(rep, o, na)
  o = ea_puts(rep, o, " name_probe_miss=" as *u8)
  o = ea_puti(rep, o, missing)
  var idx: i64 = 0
  let denom: i64 = declaring + silent
  if denom > 0 { idx = (declaring * 1000) / denom }
  o = ea_puts(rep, o, " declare_index_permille=" as *u8)
  o = ea_puti(rep, o, idx)
  o = ea_puts(rep, o, " (of the bounded set: declaring vs declaring+candidates)\n" as *u8)
  // A PARTITION IS A CLAIM: CHECK THAT THE PARTS SUM, AND PRINT THE SUM. An unexplained residual is a
  // leak; an explained one is a decision. Printed every run so a future edit that adds a class without
  // adding it here cannot pass unnoticed.
  let partsum: i64 = declaring + silent + na + missing
  o = ea_puts(rep, o, "PARTITION declaring+silent_cap_candidates+unbounded_or_na+name_probe_miss=" as *u8)
  o = ea_puti(rep, o, partsum)
  o = ea_puts(rep, o, " vs rows=" as *u8)
  o = ea_puti(rep, o, rows)
  if partsum == rows { o = ea_puts(rep, o, " RECONCILES\n" as *u8) }
  else { o = ea_puts(rep, o, " LEAKS -- do not trust these numbers\n" as *u8) }
  var allow_complete: i64 = 1
  if an >= EA_ALLOWCAP { allow_complete = 0 }
  o = ea_puts(rep, o, "ENVELOPE (own, dogfood -- every field DERIVED from the const it bounds, because a hand-typed copy of a cap is a second copy of that cap's shape and the two drift silently): allow_bytes=" as *u8)
  o = ea_puti(rep, o, an)
  o = ea_puts(rep, o, " allow_cap=" as *u8)
  o = ea_puti(rep, o, EA_ALLOWCAP)
  o = ea_puts(rep, o, " coverage_complete=" as *u8)
  o = ea_puti(rep, o, allow_complete)
  o = ea_puts(rep, o, " rows_scanned=" as *u8)
  o = ea_puti(rep, o, rows)
  o = ea_puts(rep, o, " row_cap=NONE (EVERY data row is scanned; until 2026-08-20 a row-cap gate dropped every row past the cap with no counter and printed the cap itself as the population) src_cap=" as *u8)
  o = ea_puti(rep, o, EA_SRCCAP)
  o = ea_puts(rep, o, " src_reads_capped=" as *u8)
  o = ea_puti(rep, o, srccapped)
  o = ea_puts(rep, o, " list_cap=" as *u8)
  o = ea_puti(rep, o, EA_MAXLIST)
  o = ea_puts(rep, o, "; scope = REGISTERED tools only (an unregistered organ cannot mislead a seat).\n" as *u8)
  o = ea_puts(rep, o, "METHOD (liar-killed): CANDIDATE detector over source text -- declaration markers (envelope | caps: | window_bytes | coverage_complete | scanned= | capped=) vs bounded-read consts (_CAP | _MAX), each counted ONLY when it occurs OUTSIDE a comment (2026-08-06). The last three markers were added to ALIGN WITH LAW L011, which nx_law_warden enforces as 'no scanned/coverage_complete/capped honesty flag' -- this audit previously recognised none of them, so a scanner declaring coverage in the vocabulary the WARDEN mandates still counted as silent here. TWO INSTRUMENTS MUST NOT CARRY TWO DEFINITIONS OF THE SAME PROPERTY: a marker in a comment DOCUMENTS an envelope, it does not EMIT one. That refinement moves tools whose only marker was prose from DECLARING to CANDIDATE, so this index reads LOWER than before and is MORE TRUE -- do not compare it against a pre-2026-08-06 figure. WORKED CASE: nx_shelltool carried 'envelope' only in a comment and counted as DECLARING while its grep verb capped every file at 1048575B from offset 0 undeclared, leaving 55pc of a directory unsearchable (1786057862). STILL NOT AN ABSOLUTE VERDICT, and the residual is now named precisely: this measures SOURCE VOCABULARY, not emitted bytes, so a tool that builds its declaration from concatenated pieces still reads as silent, and a tool that prints a marker while capping elsewhere still reads as declaring. THE HONEST END STATE IS PROBING EACH TOOL'S OUTPUT, which needs a per-tool read-only probe manifest because this allowlist contains WRITERS that must never be invoked speculatively. Referee adjudicates; ratchet floor only AFTER this baseline is reviewed.\n" as *u8)
  o = ea_puts(rep, o, "SILENT-CAP CANDIDATES (bounded, no declaration) listed=" as *u8)
  o = ea_puti(rep, o, listed)
  o = ea_puts(rep, o, " of " as *u8)
  o = ea_puti(rep, o, silent)
  if silent > listed { o = ea_puts(rep, o, " <== THIS LIST IS A PREFIX OF ITS OWN COUNT, never republish it as the population" as *u8) }
  o = ea_puts(rep, o, ": " as *u8)
  o = ea_puts(rep, o, cand)
  o = ea_puts(rep, o, "\nNAME-PROBE MISS (no <elfbase>.nx in the probe dirs -- NOT proof of a lost source: elf and source names can diverge, verified nx_fs_write.elf builds from nx_fsops_write.nx; verify BY CONTENT before claiming loss. A genuine miss means the tool cannot be rebuilt on the NAS via /api/build) listed=" as *u8)
  o = ea_puti(rep, o, mlisted)
  o = ea_puts(rep, o, " of " as *u8)
  o = ea_puti(rep, o, missing)
  if missing > mlisted { o = ea_puts(rep, o, " <== THIS LIST IS A PREFIX OF ITS OWN COUNT, never republish it as the population" as *u8) }
  o = ea_puts(rep, o, ": " as *u8)
  o = ea_puts(rep, o, miss)
  // THE COVERAGE LINE IS LAST BY POSITION, because gv_last_line and every positional reader in the
  // estate anchor on the final line and a textual anchor can be matched by data quoted above it.
  var report_complete: i64 = 1
  if o >= EA_REPCAP - EA_TAILRESERVE { report_complete = 0 }
  var rc: i64 = 0
  if allow_complete == 0 { rc = EA_EXIT_PARTIAL }
  if report_complete == 0 { rc = EA_EXIT_PARTIAL }
  o = ea_puts(rep, o, "\nENVELOPE-AUDIT COVERAGE allow_complete=" as *u8)
  o = ea_puti(rep, o, allow_complete)
  o = ea_puts(rep, o, " report_complete=" as *u8)
  o = ea_puti(rep, o, report_complete)
  o = ea_puts(rep, o, " exit=" as *u8)
  o = ea_puti(rep, o, rc)
  if rc == 0 { o = ea_puts(rep, o, " verdict=COMPLETE\n" as *u8) }
  else { o = ea_puts(rep, o, " verdict=PARTIAL -- the counts above are a FLOOR, not a population\n" as *u8) }
  sys_write(EA_STDOUT, rep, o)
  let tmp: *u8 = sys_mmap(EA_PATHCAP)
  var t: i64 = ea_puts(tmp, 0, outp)
  t = ea_puts(tmp, t, ".tmp" as *u8)
  tmp[t] = 0 as u8
  let fd: i64 = sys_openat_wr(tmp, EA_MODE)
  if fd >= 0 { sys_write(fd, rep, o); sys_close(fd); sys_renameat(tmp, outp) }
  sys_exit(rc)
  return rc
330}
nx_envelope_audit.nx source

`nx_envelope_audit.nx` source
