code wiki / _hdl_build / nx_evclass_route.nx
`nx_evclass_route.nx` source

↩ module page · 364 lines · 16716 B
1// nx_evclass_route.nx -- route DERIVED oracle rows to the DOMAINS that actually earned them.
2//
3// THE DEFECT THIS CLOSES (measured 2026-08-01): nx_evoracle_sweep correctly derives third-party oracle
4// rows -- RFC 9807, RFC 7748, RFC 9497, FIPS 180-4 -- and writes them ALL to knowledge/status/
5// evclass_sovereign.conf. But `sovereign` IS NOT A DOMAIN (no sovereign.matrix), while nx_sota_status
6// reads evclass_<domain>.conf per domain. So 7 genuine third-party attestations landed in a file NO
7// CONSUMER READS, and PROVEN stayed 0/41 with the evidence sitting right there.
8//
9// ★★★★★A NEAR-ZERO MATCH MEANS A WRONG JOIN KEY, NOT A MISSING POPULATION. The derivation was never the
10// problem; the rows simply were not addressed to anyone.
11//
12// THE JOIN: every derived row carries `gate=<name>`, and knowledge/compare/<domain>.gates names the gates
13// a domain claims. So gate -> domain is a real, checkable key, not an inference.
14//
15// OUTCOMES ARE NEVER COLLAPSED (the sweep's own law): ROUTED / ALREADY / UNROUTED are counted and named
16// separately -- a row nobody claims and a row already present must never look the same.
17// ⛔CORRECTED 2026-09-03 -- THIS LINE USED TO SAY the rows remain UNSIGNED because at_verify_row refuses
18// them "until an operator-held key exists", and that this organ cannot supply ATTRIBUTION. IT IS WRONG FOR
19// THE TWO CLASSES THIS ORGAN ACTUALLY ROUTES. It was inherited verbatim from nx_evoracle_sweep's header,
20// which was true when IT was written and stopped being true hours later when an agent created
21// knowledge/attest_keys.conf and registered two role=machine keys -- sanctioned there in its own words
22// because for EV_CLASS_ORACLE "independence comes from the REFERENCE, not the signer".
23// PROVEN END TO END 2026-09-03, not argued: a derived oracle row signed with the registered machine key
24// (pub=08fc04ab..4fa8) returned at_verify_row -> OK (rc=0) against the LIVE registry, and
25// nx_attest_ceremony's gate is 10/10 with T6 oracle+machine=OK and T9 experiential+machine=OK. Only T4,
26// class=human, refuses a machine key -- correct, and never to be loosened.
27// ⇒ A RENEWED ORACLE OR EXPERIENTIAL ROW MAY AND SHOULD BE MACHINE-SIGNED. Withholding the signature is
28// what kept PROVEN at 0 while this organ's own header recorded 45 domains holding fresh evidence.
29// ★★★★★★THE COMMENT WAS THE BUG: nothing in the code was wrong, and a stale sentence copied between two
30// organs became an estate-wide belief that only the operator could unblock the honesty ratio.
31//
32// nx_evclass_route [srcfile]    default knowledge/status/evclass_sovereign.conf
33// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
34import "nx_gateorder_lib.nx"
35import "nx_estate_path.nx"   // ep_anchor: the CWD must not decide this organ verdict
36const ER_MAGIC_65536: i64 = 65536
37
38const ER_CAP: i64 = 262144
39const ER_PATH: i64 = 512
40const ER_NAMEW: i64 = 96
41const ER_MAXDOM: i64 = 128
42
43static er_src: *u8
44static er_gates: *u8
45static er_doms: *u8
46static er_ndom: i64
47static er_routed: i64
48static er_already: i64
49static er_unrouted: i64
50static er_rows: i64
51static er_renewed: i64
52
53// RENEWAL (2026-09-02): an attestation expires on the same TTL as a stamp (nx_sota_status, half-life law
54// in nx_evidence_beat), so a routed row that is merely PRESENT is not evidence once it is old -- and until
55// today this organ counted an EXPIRED row as ALREADY and appended nothing. MEASURED: 45 domains carried
56// rows from 2026-08-01..03 against a 604800 s TTL, the sweep re-derived 10 fresh rows, and route reported
57// ROUTED=0 ALREADY=4 -- so the board read PROVEN 0/105 with fresh evidence in hand. Now a present row
58// whose epoch is older than half the policy TTL is RENEWED: the fresh row is APPENDED (additive-only, the
59// loader ORs classes and counts freshness per row), and the outcome is named separately.
60const ER_DEF_TTL_SEC: i64 = 604800
61func er_num_after(buf: *u8, n: i64, key: *u8, from: i64) -> i64 {
  var kl: i64 = 0
  while key[kl] != (0 as u8) { kl = kl + 1 }
  var i: i64 = from
  while i + kl <= n {
      if go_match_at(buf, i, n, key) == 1 {
          var p: i64 = i + kl
          var v: i64 = 0
          var got: i64 = 0
          var go: i64 = 1
          while go == 1 {
              if p >= n { go = 0 } else {
                  let c: i64 = buf[p] as i64
                  if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); got = 1; p = p + 1 } else { go = 0 } } else { go = 0 }
              }
          }
          if got == 1 { return v }
          return 0 - 1
      }
      i = i + 1
  }
  return 0 - 1
83}
84// the policy TTL the referee reads (knowledge/evidence_policy.conf ttl_sec=), else the referee's default.
85func er_policy_ttl() -> i64 {
  let lp: *i64 = sys_mmap(16) as *i64
  lp[0] = 0
  let b: *u8 = sys_read_file("knowledge/evidence_policy.conf\x00" as *u8, lp)
  if lp[0] <= 0 { return ER_DEF_TTL_SEC }
  let v: i64 = er_num_after(b, lp[0], "ttl_sec=" as *u8, 0)
  if v <= 0 { return ER_DEF_TTL_SEC }
  return v
93}
94// IDEMPOTENCE (2026-09-02, caught on the second live run): the renewal must read the NEWEST row for a
95// gate, not the first -- go_first lands on the original expired row every time, so each run appended
96// another fresh copy (measured: deploy went 2 -> 4 rows in two runs). Scan every occurrence, keep the
97// max epoch; a row renewed within the half-life is then ALREADY, not RENEWED again.
98func er_newest_epoch(buf: *u8, n: i64, gname: *u8) -> i64 {
  var best: i64 = 0 - 1
  var i: i64 = 0
  while i < n {
      if go_match_at(buf, i, n, gname) == 1 {
          let ep: i64 = er_row_epoch(buf, n, i)
          if ep > best { best = ep }
      }
      i = i + 1
  }
  return best
109}
110// epoch= of the row that starts at (or after) offset `at` in buf, bounded to that row's line.
111func er_row_epoch(buf: *u8, n: i64, at: i64) -> i64 {
  var e: i64 = at
  while e < n { if buf[e] == (10 as u8) { e = n + 1 } else { e = e + 1 } }
  var end: i64 = e
  if end > n { end = e - 1 }
  return er_num_after(buf, end, "epoch=" as *u8, at)
117}
118
119func er_init() {
  er_renewed = 0
  er_src = sys_mmap(ER_CAP + 64) as *u8
  er_gates = sys_mmap(ER_CAP + 64) as *u8
  er_doms = sys_mmap(ER_MAXDOM * ER_NAMEW + 64) as *u8
  er_ndom = 0
  er_routed = 0
  er_already = 0
  er_unrouted = 0
  er_rows = 0
129}
130
131func er_read_into(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var total: i64 = 0
  var done: i64 = 0
  while done == 0 {
      let want: i64 = cap - total
      if want <= 0 { done = 1 }
      else {
          let got: i64 = sys_read(fd, ((buf as i64) + total) as *u8, want)
          if got <= 0 { done = 1 }
          else { total = total + got }
      }
  }
  sys_close(fd)
  buf[total] = 0 as u8
  return total
148}
149
150// Collect domain names from knowledge/compare/*.gates
151func er_collect_domains() {
  let dfd: i64 = sys_openat_rd("knowledge/compare" as *u8)
  if dfd < 0 { return }
  let dbuf: *u8 = sys_mmap(ER_MAGIC_65536 + 64) as *u8
  var looping: i64 = 1
  while looping == 1 {
      let nread: i64 = sys_getdents64(dfd, dbuf, ER_MAGIC_65536)
      if nread <= 0 { looping = 0 }
      else {
          var off: i64 = 0
          while off < nread {
              let lo: i64 = dbuf[off + 16] as i64
              let hi: i64 = dbuf[off + 17] as i64
              let reclen: i64 = lo + hi * 256
              let nm: *u8 = ((dbuf as i64) + off + 19) as *u8
              var nlen: i64 = 0
              while nm[nlen] != (0 as u8) { nlen = nlen + 1 }
              if nlen > 6 {
                  if go_match_at(nm, nlen - 6, nlen, ".gates" as *u8) == 1 {
                      if er_ndom < ER_MAXDOM {
                          var w: i64 = 0
                          let slot: i64 = (er_doms as i64) + er_ndom * ER_NAMEW
                          while w < nlen - 6 {
                              if w < ER_NAMEW - 1 {
                                  let d: *u8 = (slot + w) as *u8
                                  d[0] = nm[w]
                              }
                              w = w + 1
                          }
                          let term: *u8 = (slot + w) as *u8
                          term[0] = 0 as u8
                          er_ndom = er_ndom + 1
                      }
                  }
              }
              if reclen <= 0 { off = nread }
              else { off = off + reclen }
          }
      }
  }
  sys_close(dfd)
192}
193
194func er_path_for(pre: *u8, dom: *u8, suf: *u8, out: *u8) {
  var w: i64 = 0
  var i: i64 = 0
  while pre[i] != (0 as u8) {
      out[w] = pre[i]
      w = w + 1
      i = i + 1
  }
  var j: i64 = 0
  while dom[j] != (0 as u8) {
      if w < ER_PATH - 12 {
          out[w] = dom[j]
          w = w + 1
      }
      j = j + 1
  }
  var k: i64 = 0
  while suf[k] != (0 as u8) {
      out[w] = suf[k]
      w = w + 1
      k = k + 1
  }
  out[w] = 0 as u8
217}
218
219func main(argc: i64, argv: *i64) -> i64 {
  // ANCHOR FIRST (2026-08-04, nx_cwdguard finding): this organ reads a RELATIVE
  // knowledge/ path, so its answer depended on where it was launched. No-op when
  // already at the estate root, so the cron/MCP context is unchanged.
  ep_anchor()
  er_init()
  var src: *u8 = "knowledge/status/evclass_sovereign.conf" as *u8
  if argc > 1 { src = argv[1] as *u8 }
  go_puts("=== NX-EVCLASS-ROUTE: address derived oracle rows to the domains that earned them ===\n\n" as *u8)
  let sn: i64 = er_read_into(src, er_src, ER_CAP)
  if sn <= 0 {
      go_puts("no derived rows to route (run nx_evoracle_sweep first)\n" as *u8)
      return 0
  }
  er_collect_domains()
  go_kv("domains_with_gates" as *u8, er_ndom)
  go_puts("\n\n" as *u8)
236
  let gpath: *u8 = sys_mmap(ER_PATH + 64) as *u8
  let opath: *u8 = sys_mmap(ER_PATH + 64) as *u8
  let gname: *u8 = sys_mmap(ER_NAMEW + 64) as *u8
240
  var ls: i64 = 0
  var i: i64 = 0
  while i <= sn {
      var eol: i64 = 0
      if i == sn { eol = 1 }
      else { if er_src[i] == (10 as u8) { eol = 1 } }
      if eol == 1 {
          var skip: i64 = 0
          if ls >= i { skip = 1 }
          else { if er_src[ls] == (35 as u8) { skip = 1 } }
          if skip == 0 {
              // pull gate=<name> out of the row -- the join key
              var gp: i64 = 0 - 1
              var s: i64 = ls
              while s < i {
                  if go_match_at(er_src, s, i, "gate=" as *u8) == 1 {
                      gp = s + 5
                      s = i
                  } else { s = s + 1 }
              }
              if gp > 0 {
                  er_rows = er_rows + 1
                  var w: i64 = 0
                  var q: i64 = gp
                  var stop: i64 = 0
                  while stop == 0 {
                      if q >= i { stop = 1 }
                      else {
                          if er_src[q] == (32 as u8) { stop = 1 }
                          else {
                              if w < ER_NAMEW - 1 {
                                  gname[w] = er_src[q]
                                  w = w + 1
                              }
                              q = q + 1
                          }
                      }
                  }
                  gname[w] = 0 as u8
                  var hit: i64 = 0
                  var d: i64 = 0
                  while d < er_ndom {
                      let dom: *u8 = ((er_doms as i64) + d * ER_NAMEW) as *u8
                      er_path_for("knowledge/compare/" as *u8, dom, ".gates" as *u8, gpath)
                      let gn: i64 = er_read_into(gpath, er_gates, ER_CAP)
                      if gn > 0 {
                          if go_first(er_gates, gn, gname) >= 0 {
                              hit = 1
                              er_path_for("knowledge/status/evclass_" as *u8, dom, ".conf" as *u8, opath)
                              // ALREADY vs ROUTED must not look the same
                              let existing: i64 = er_read_into(opath, er_gates, ER_CAP)
                              var dup: i64 = 0
                              var renew: i64 = 0
                              if existing > 0 {
                                  let at: i64 = go_first(er_gates, existing, gname)
                                  if at >= 0 {
                                      dup = 1
                                      // RENEWAL: a present row older than half the policy TTL is not
                                      // evidence for long -- append the fresh derivation beside it.
                                      let ep: i64 = er_newest_epoch(er_gates, existing, gname)
                                      let now: i64 = sys_now_realtime_sec()
                                      let half: i64 = er_policy_ttl() / 2
                                      if ep <= 0 { renew = 1 } else { if now - ep > half { renew = 1 } }
                                  }
                              }
                              if renew == 1 { dup = 0 }
                              if dup == 1 {
                                  er_already = er_already + 1
                              } else {
                                  if renew == 1 {
                                      er_renewed = er_renewed + 1
                                      go_puts("  RENEWED  " as *u8)
                                      go_puts(gname)
                                      go_puts("  (present row older than half the policy TTL -- fresh derivation appended)\n" as *u8)
                                  }
                                  let fd: i64 = sys_openat_append(opath, 0x1A4)
                                  if fd >= 0 {
                                      if existing <= 0 {
                                          sys_write(fd, "# DERIVED by nx_evoracle_sweep, ADDRESSED here by nx_evclass_route.\n" as *u8, 68)
                                          sys_write(fd, "# Join key: the row's gate= is cited by this domain's .gates. UNSIGNED -- at_verify_row\n" as *u8, 88)
                                          sys_write(fd, "# refuses these until an operator-held key is registered. Derivation, not attribution.\n" as *u8, 87)
                                      }
                                      sys_write(fd, ((er_src as i64) + ls) as *u8, i - ls)
                                      sys_write(fd, "\n" as *u8, 1)
                                      sys_close(fd)
                                      er_routed = er_routed + 1
                                      go_puts("  ROUTED   " as *u8)
                                      go_puts(gname)
                                      go_puts("  -> " as *u8)
                                      go_puts(dom)
                                      go_puts("\n" as *u8)
                                  }
                              }
                          }
                      }
                      d = d + 1
                  }
                  if hit == 0 {
                      er_unrouted = er_unrouted + 1
                      go_puts("  UNROUTED " as *u8)
                      go_puts(gname)
                      go_puts("  (no domain's .gates cites this gate -- real evidence with no claimant)\n" as *u8)
                  }
              }
          }
          ls = i + 1
      }
      i = i + 1
  }
350
  go_puts("\n-- RESULT (outcomes named separately, never collapsed) --\n" as *u8)
  go_kv("rows_read" as *u8, er_rows)
  go_kv("ROUTED" as *u8, er_routed)
  go_kv("ALREADY" as *u8, er_already)
  go_kv("RENEWED" as *u8, er_renewed)
  go_kv("UNROUTED" as *u8, er_unrouted)
  go_puts("\n\n" as *u8)
  go_puts("  UNROUTED is not a failure of derivation -- it is a gate whose third-party evidence NO\n" as *u8)
  go_puts("  domain currently claims. Wiring it into a <domain>.gates converts it into countable\n" as *u8)
  go_puts("  evidence; leaving it means a real external attestation benefits nobody.\n" as *u8)
  go_puts("  ⚠ROUTED rows are UNSIGNED and will be REFUSED by at_verify_row until an operator-held\n" as *u8)
  go_puts("  key is registered. This organ supplies ADDRESSING; only that key supplies ATTRIBUTION.\n" as *u8)
  return 0
364}
nx_evclass_route.nx source

`nx_evclass_route.nx` source
