code wiki / _hdl_build / nx_evidence_beat.nx
`nx_evidence_beat.nx` source

↩ module page · 274 lines · 14981 B
1// nx_evidence_beat.nx -- THE CADENCE. Closes the seq1433 half that turns this workstream from a one-shot
2// into an actual loop.
3//
4// ★WHY THIS IS THE KEYSTONE, NOT A CHORE. Everything built this session expires on purpose: evstamps carry
5// an epoch and are refused past the TTL, bite records likewise. That expiry is the whole point -- a verdict
6// that outlives its evidence is the defect this workstream opened by fixing. But expiry without RENEWAL is
7// just a slower way to reach zero: within one TTL every domain silently falls back to UNPROVEN and the
8// board returns to exactly the state it started in. A measurement you never repeat is a measurement you
9// will eventually be lying about.
10//
11// WHAT IT DOES, per invocation:
12//   for each domain declaring executable evidence (knowledge/compare/<d>.gates)
13//     * if its evstamp is missing or older than the REFRESH threshold -> re-run nx_swcompare_evidence <d>
14//     * if any of its declared gates lacks a fresh bite record       -> re-run nx_bite_sweep <d>
15//
16// ★REFRESH AT HALF THE TTL, not at expiry. Renewing only once a record has already died guarantees a window
17// in which the board reads UNPROVEN for domains that are fine -- the instrument would manufacture its own
18// false negatives on a timer. Half-life renewal means a single missed beat is survivable.
19//
20// ★BOUNDED WORK BY CONSTRUCTION. Each refresh forks real gates and, for a sweep, rebuilds source repeatedly;
21// an unbounded beat would run for hours and get killed mid-flight, leaving a mutated tree behind. maxwork
22// caps the number of refreshes per invocation and the beat reports what it DEFERRED rather than silently
23// truncating -- a cadence that hides its own backlog is how "green" drifts away from "current".
24//
25// usage: nx_evidence_beat [maxwork] [--dry]    (CWD = nxc2 root)
26// exit 0 = nothing overdue, or all attempted work succeeded · 1 = a refresh failed · 2 = usage
27// license_tier: ORIGINAL
28import "nx_syscalls.nx"
29import "nx_artifact_root.nx"
30const EB_MAGIC_4096: i64 = 4096
31const EB_MAGIC_4095: i64 = 4095
32const EB_MAGIC_604800: i64 = 604800
33const EB_MAGIC_1024: i64 = 1024
34
35const EB_DEF_MAXWORK: i64 = 3
36
37func w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
38func wn(v: i64) -> i64 { let t: *u8=sys_mmap(28); var m: i64=v; var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} let b: *u8=sys_mmap(28); var i: i64=0; while i<k{b[i]=t[k-1-i];i=i+1} sys_write(1,b,k); return 0 }
39func wf(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
40func wnf(fd: i64, v: i64) -> i64 { let t: *u8=sys_mmap(28); var m: i64=v; var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} let b: *u8=sys_mmap(28); var i: i64=0; while i<k{b[i]=t[k-1-i];i=i+1} sys_write(fd,b,k); return 0 }
41
42func eb_read(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var tot: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let n: i64 = sys_read(fd, ((buf as i64)+tot) as *u8, cap - tot)
      if n <= 0 { go = 0 } else { tot = tot + n; if tot >= cap { go = 0 } }
  }
  sys_close(fd)
  return tot
53}
54func eb_num_after(buf: *u8, n: i64, key: *u8, kl: i64) -> i64 {
  var i: i64 = 0
  while i <= n - kl {
      var j: i64 = 0
      var m: i64 = 1
      while j < kl { if buf[i+j] != key[j] { m = 0; j = kl } else { j = j + 1 } }
      if m == 1 {
          var p: i64 = i + kl
          var v: i64 = 0
          var got: i64 = 0
          while p < n { let c: i64 = buf[p] as i64; if c >= 48 { if c <= 57 { v = v*10 + (c-48); got = 1; p = p + 1 } else { p = n } } else { p = n } }
          if got == 1 { return v }
          return 0 - 1
      }
      i = i + 1
  }
  return 0 - 1
71}
72func eb_cat(dst: *u8, off: i64, s: *u8) -> i64 {
  var o: i64 = off
  var i: i64 = 0
  while s[i] != (0 as u8) { dst[o] = s[i]; o = o + 1; i = i + 1 }
  return o
77}
78func eb_catn(dst: *u8, off: i64, domain: *u8, dl: i64) -> i64 {
  var o: i64 = off
  var i: i64 = 0
  while i < dl { dst[o] = domain[i]; o = o + 1; i = i + 1 }
  return o
83}
84
85// fork <elf> <arg1> [arg2]; return exit code
86func eb_run2(elf: *u8, a1: *u8, a2: *u8, outpath: *u8) -> i64 {
  let pid: i64 = sys_fork()
  if pid == 0 {
      let ofd: i64 = sys_openat_wr(outpath, 0x1a4)
      if ofd >= 0 { sys_dup3(ofd, 1, 0); sys_dup3(ofd, 2, 0) }
      let argv: *i64 = sys_mmap(48) as *i64
      argv[0] = elf as i64
      argv[1] = a1 as i64
      if (a2 as i64) == 0 { argv[2] = 0 } else { argv[2] = a2 as i64; argv[3] = 0 }
      let envp: *i64 = sys_mmap(16) as *i64
      envp[0] = 0
      sys_execve(elf, argv, envp)
      sys_exit(127)
  }
  let stp: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, stp, 0)
  let sig: i64 = stp[0] & 0x7f
  if sig != 0 { return 128 + sig }
  return (stp[0] >> 8) & 0xff
105}
106
107func main(argc: i64, argv: *i64) -> i64 {
  var maxwork: i64 = EB_DEF_MAXWORK
  var dry: i64 = 0
  if argc > 1 {
      let a: *u8 = argv[1] as *u8
      if a[0] == (45 as u8) { dry = 1 } else {
          maxwork = 0
          var i: i64 = 0
          while a[i] != (0 as u8) { maxwork = maxwork*10 + ((a[i] as i64) - 48); i = i + 1 }
          if maxwork <= 0 { maxwork = EB_DEF_MAXWORK }
      }
  }
  if argc > 2 { let b: *u8 = argv[2] as *u8; if b[0] == (45 as u8) { dry = 1 } }
120
  let now: i64 = sys_now_realtime_sec()
  // ONE policy, read from the same file every other consumer reads (rule 17).
  let pb: *u8 = sys_mmap(EB_MAGIC_4096)
  let pn: i64 = eb_read("knowledge/evidence_policy.conf" as *u8, pb, EB_MAGIC_4095)
  var ttl: i64 = EB_MAGIC_604800
  if pn > 0 { let v: i64 = eb_num_after(pb, pn, "ttl_sec=" as *u8, 8); if v > 0 { ttl = v } }
  let refresh: i64 = ttl / 2
128
  w("=== nx_evidence_beat -- renew what is about to expire (half-life refresh) ===\n")
  w("  ttl="); wn(ttl); w("s refresh_at="); wn(refresh); w("s maxwork="); wn(maxwork)
  if dry == 1 { w(" MODE=dry-run") }
  w("\n")
133
  let evelf: *u8 = sys_mmap(512)
  let swelf: *u8 = sys_mmap(512)
  let haveev: i64 = ar_resolve("_offc/nx_swcompare_evidence.elf" as *u8, evelf)
  let havesw: i64 = ar_resolve("_offc/nx_bite_sweep.elf" as *u8, swelf)
  if haveev == 0 { w("  CANNOT RESOLVE nx_swcompare_evidence.elf -- promote it first\n"); sys_exit(2); return 2 }
139
  let dbuf: *u8 = sys_mmap(1 << 16)
  let fd: i64 = sys_openat_rd("knowledge/compare\x00" as *u8)
  if fd < 0 { w("  cannot open knowledge/compare\n"); sys_exit(2); return 2 }
  let outp: *u8 = "knowledge/status/evidence_beat_run.out\x00" as *u8
  let dom: *u8 = sys_mmap(256)
  let path: *u8 = sys_mmap(512)
  var scanned: i64 = 0
  var refreshed: i64 = 0
  var swept: i64 = 0
  var deferred: i64 = 0
  var failed: i64 = 0
  var work: i64 = 0
152
  var go: i64 = 1
  while go == 1 {
      let nr: i64 = sys_getdents64(fd, dbuf, 1 << 16)
      if nr <= 0 { go = 0 } else {
          var pos: i64 = 0
          while pos < nr {
              let rec: *u8 = ((dbuf as i64) + pos) as *u8
              let reclen: i64 = dirent_reclen(rec)
              let name: *u8 = ((rec as i64) + 19) as *u8
              var ln: i64 = 0
              while name[ln] != (0 as u8) { ln = ln + 1 }
              // only domains that DECLARE executable evidence: <d>.gates
              var isg: i64 = 0
              if ln > 6 {
                  let g: *u8 = ".gates\x00" as *u8
                  var m: i64 = 1
                  var q: i64 = 0
                  while q < 6 { if name[ln-6+q] != g[q] { m = 0; q = 6 } else { q = q + 1 } }
                  isg = m
              }
              if isg == 1 {
                  let dl: i64 = ln - 6
                  var c: i64 = 0
                  while c < dl { dom[c] = name[c]; c = c + 1 }
                  dom[dl] = 0 as u8
                  scanned = scanned + 1
                  // age of this domain's evstamp
                  var o: i64 = eb_cat(path, 0, "knowledge/status/evstamp_" as *u8)
                  o = eb_catn(path, o, dom, dl)
                  o = eb_cat(path, o, ".verdict" as *u8)
                  path[o] = 0 as u8
                  let sb: *u8 = sys_mmap(EB_MAGIC_1024)
                  let sn: i64 = eb_read(path, sb, 1023)
                  var age: i64 = ttl + 1
                  if sn > 0 { let ep: i64 = eb_num_after(sb, sn, "epoch=" as *u8, 6); if ep > 0 { if now >= ep { age = now - ep } } }
                  if age > refresh {
                      // ★THE DRY RUN MUST SPEND THE SAME BUDGET. The first cut incremented the work
                      // counter only on the real path, so --dry listed EVERY overdue domain as if it
                      // would all be done in one pass -- a preview that disagrees with the run it is
                      // previewing is worse than no preview, because it is trusted.
                      if work >= maxwork {
                          deferred = deferred + 1
                          w("  DEFER  "); w(dom); w("  age="); wn(age); w("s (budget spent)\n")
                      } else {
                          work = work + 1
                          w("  REFRESH "); w(dom); w("  age="); wn(age); w("s -> ")
                          if dry == 1 { w("(dry)\n") } else {
                              let rc: i64 = eb_run2(evelf, dom, 0 as *u8, outp)
                              if rc == 0 { w("MEASURED-HONEST\n") } else { w("RED (exit "); wn(rc); w(")\n"); failed = failed + 1 }
                              refreshed = refreshed + 1
                              // NON-VACUITY RENEWAL: re-read the stamp we just wrote. If fewer gates have
                              // a live bite record than the domain declares, its non-vacuity has aged out
                              // and the sweep must run -- otherwise the beat renews the cheap half of the
                              // evidence and quietly lets the expensive half expire.
                              if havesw == 1 {
                                  let s2: *u8 = sys_mmap(EB_MAGIC_1024)
                                  let n2: i64 = eb_read(path, s2, 1023)
                                  if n2 > 0 {
                                      let rs: i64 = eb_num_after(s2, n2, "redseen=" as *u8, 8)
                                      let dc: i64 = eb_num_after(s2, n2, "declared=" as *u8, 9)
                                      if dc > 0 { if rs < dc {
                                          if work < maxwork {
                                              work = work + 1
                                              w("  SWEEP   "); w(dom); w("  redseen="); wn(rs); w("/"); wn(dc); w(" -> ")
                                              // 6 -> 16, MEASURED 2026-08-01, not guessed. nx_x25519_kat_gate
                                              // returned INCONCLUSIVE at 4 sites and again at 6-equivalent
                                              // depth; the KILL landed at site 4 of the NUMERIC-CONSTANT
                                              // operator only once the cap allowed 14. Constant-time crypto
                                              // exposes few mutable comparisons and its early numeric literals
                                              // are structural (array sizes -> uncompilable), so the first
                                              // handful of sites are systematically barren for exactly the
                                              // KAT/ORACLE class this beat most needs to score.
                                              // ★A SITE CAP IS A SAMPLING DECISION: TOO SMALL AND THE SWEEP
                                              // MANUFACTURES "INCONCLUSIVE" AND CALLS IT A MEASUREMENT.
                                              // Cost is bounded -- the sweep stops at the FIRST kill, so a
                                              // gate that bites early still costs the same 1-2 rebuilds.
                                              let rc2: i64 = eb_run2(swelf, dom, "16\x00" as *u8, outp)
                                              if rc2 == 0 { w("all gates BITE\n") } else { w("not all proven (exit "); wn(rc2); w(")\n") }
                                              swept = swept + 1
                                          } else { deferred = deferred + 1; w("  DEFER  "); w(dom); w(" sweep (budget spent)\n") }
                                      } }
                                  }
                              }
                          }
                      }
                  }
              }
              if reclen <= 0 { pos = nr } else { pos = pos + reclen }
          }
      }
  }
  sys_close(fd)
245
  w("  scanned="); wn(scanned); w(" refreshed="); wn(refreshed); w(" deferred="); wn(deferred); w(" failed="); wn(failed); w("\n")
  if havesw == 0 { w("  NOTE nx_bite_sweep.elf unresolved -- non-vacuity records will not be renewed by this beat\n") }
248
  let lfd: i64 = sys_openat_wr("knowledge/status/evidence_beat.log\x00" as *u8, 0x1a4)
  if lfd >= 0 {
      wf(lfd, "NX-EVIDENCE-BEAT scanned=" as *u8); wnf(lfd, scanned)
      wf(lfd, " refreshed=" as *u8); wnf(lfd, refreshed)
      wf(lfd, " deferred=" as *u8); wnf(lfd, deferred)
      wf(lfd, " failed=" as *u8); wnf(lfd, failed)
      wf(lfd, " ttl=" as *u8); wnf(lfd, ttl)
      // ts= is the DEAD-MAN'S-SWITCH marker knowledge/registry/cron_heartbeats.tsv looks for. Emitting
      // only `epoch=` would leave the watch permanently stale even while the beat ran perfectly -- the
      // heartbeat would report a dead cadence that is actually alive, which is the same false-negative
      // class as every other reader/writer dialect mismatch this session. Both are written: ts= for the
      // watch, epoch= for anything reading this log the way the stamps are read.
      wf(lfd, " ts=" as *u8); wnf(lfd, now)
      wf(lfd, " epoch=" as *u8); wnf(lfd, now)
      wf(lfd, "\n" as *u8)
      // DEFERRED WORK IS NOT A FAILURE, but it must be VISIBLE: a beat that silently drops its backlog
      // lets the board age out one domain at a time while every log line still reads GREEN.
      if failed == 0 { wf(lfd, "VERDICT=GREEN evidence renewed within its half-life\n" as *u8) } else { wf(lfd, "VERDICT=RED a refresh failed -- a domain's evidence could not be re-measured\n" as *u8) }
      sys_close(lfd)
  }
269
  if failed == 0 { w("VERDICT: verdict=GREEN (nothing overdue, or all attempted refreshes succeeded)\n"); sys_exit(0); return 0 }
  w("VERDICT: verdict=RED (a refresh failed)\n")
  sys_exit(1)
  return 1
274}
nx_evidence_beat.nx source

`nx_evidence_beat.nx` source
