nx_evidence_refresh.nx source

1// nx_evidence_refresh.nx -- THE FRESHNESS AGENT (operator 2026-07-16: "when work takes place it's checking in 2// and flipping this information fresh not just dumping"). ONE sovereign call that: (1) rebuilds the live 3// dependency graph store (fork nx_eco_graph_build), then (2) re-runs the EXECUTED evidence for every backed 4// domain (auto-discovered: any knowledge/compare/<d>.gates), which re-stamps knowledge/status/evstamp_<d>.verdict. 5// After this, nx_sota_status reports the fresh PROVEN count with age~0. Slow (~30s/domain) -> a DELIBERATE / 6// scheduled refresh (Examiner cron), not an inline MCP call. Reports each domain's verdict + the totals. 7// license_tier: ORIGINAL expect_exit:0 8import "nx_syscalls.nx" 9import "nx_estate_path.nx" // ep_anchor: the CWD must not decide this organ's verdict 10 11func rw(s: *u8) -> i64 { var n:i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 12func rn(v: i64) -> i64 { let b:*u8=sys_mmap(24); var m:i64=v; if m<0{sys_write(1,"-" as *u8,1);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var j:i64=0; while j<k{b[j]=t[k-1-j];j=j+1} sys_write(1,b,k); return 0 } 13func rw2(base: *u8, off: i64, len: i64) -> i64 { sys_write(1, ((base as i64)+off) as *u8, len); return 0 } 14// substring in a buffer 15func r_has(buf: *u8, n: i64, needle: *u8, nl: i64) -> i64 { 16 if nl <= 0 { return 0 } 17 var i: i64 = 0 18 while i <= n - nl { var j: i64=0; var m: i64=1; while j<nl { if buf[i+j]!=needle[j] { m=0; j=nl } else { j=j+1 } } if m==1 { return 1 } i=i+1 } 19 return 0 20} 21// fork elf with up to 2 args (a1/a2 = 0 for none), capture stdout to outpath, return exit code 22func r_run(elf: *u8, a1: *u8, a2: *u8, a3: *u8, outpath: *u8) -> i64 { 23 let pid: i64 = sys_fork() 24 if pid == 0 { 25 let ofd: i64 = sys_openat_wr(outpath, 0x1a4) 26 if ofd >= 0 { sys_dup3(ofd, 1, 0); sys_dup3(ofd, 2, 0) } 27 let argv: *i64 = sys_mmap(40) as *i64 28 argv[0] = elf as i64 29 var n: i64 = 1 30 if (a1 as i64) != 0 { argv[n] = a1 as i64; n = n + 1 } 31 if (a2 as i64) != 0 { argv[n] = a2 as i64; n = n + 1 } 32 if (a3 as i64) != 0 { argv[n] = a3 as i64; n = n + 1 } 33 argv[n] = 0 34 let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0 35 sys_execve(elf, argv, envp) 36 sys_exit(127) 37 } 38 let stp: *i64 = sys_mmap(16) as *i64 39 sys_wait4(pid, stp, 0) 40 let sig: i64 = stp[0] & 0x7f 41 if sig != 0 { return 128 + sig } 42 return (stp[0] >> 8) & 0xff 43} 44// name ends ".gates"? 45func ends_gates(name: *u8) -> i64 { 46 var n: i64=0; while name[n]!=(0 as u8){n=n+1} 47 if n < 7 { return 0 } 48 let s: *u8 = ".gates\x00" as *u8 49 var i: i64=0; while i<6 { if name[n-6+i]!=s[i] { return 0 } i=i+1 } 50 return 1 51} 52 53func main() -> i64 { 54 // ANCHOR FIRST (2026-08-04, nx_cwdguard finding): this organ reads a RELATIVE 55 // knowledge/ path, so its answer depended on where it was launched. No-op when 56 // already at the estate root, so the cron/MCP context is unchanged. 57 ep_anchor() 58 rw("=== NX-EVIDENCE-REFRESH: the freshness agent (rebuild graph + re-stamp every backed domain) ===\n" as *u8) 59 let tmp: *u8 = "knowledge/status/_refresh.tmp\x00" as *u8 60 61 // ---- 1. rebuild the live graph store ---- 62 rw("[1] rebuilding dependency graph ...\n" as *u8) 63 let bexit: i64 = r_run("_offc/nx_eco_graph_build.elf\x00" as *u8, "runtime\x00" as *u8, "nx_tier.nx\x00" as *u8, "knowledge/store/ecograph_full\x00" as *u8, tmp) 64 let bl: *i64 = sys_mmap(16) as *i64; bl[0] = 0 65 let bb: *u8 = sys_read_file(tmp, bl) 66 if bl[0] > 0 { if r_has(bb, bl[0], "SAVED" as *u8, 5) == 1 { rw(" graph rebuilt + SAVED\n" as *u8) } else { rw(" WARN graph build did not report SAVED\n" as *u8) } } 67 68 // ---- 2. re-stamp every backed domain (knowledge/compare/*.gates) ---- 69 rw("[2] re-stamping backed domains (fork nx_swcompare_evidence each):\n" as *u8) 70 let fd: i64 = sys_openat_rd("knowledge/compare\x00" as *u8) 71 if fd < 0 { rw("ERROR cannot open knowledge/compare\n" as *u8); return 3 } 72 let dbuf: *u8 = sys_mmap(1 << 16) 73 var backed: i64 = 0 74 var green: i64 = 0 75 var go: i64 = 1 76 while go == 1 { 77 let nr: i64 = sys_getdents64(fd, dbuf, 1 << 16) 78 if nr <= 0 { go = 0 } else { 79 var pos: i64 = 0 80 while pos < nr { 81 let rec: *u8 = ((dbuf as i64) + pos) as *u8 82 let reclen: i64 = dirent_reclen(rec) 83 let name: *u8 = ((rec as i64) + 19) as *u8 84 if ends_gates(name) == 1 { 85 // domain = name without ".gates" -> null-terminated copy 86 var ln: i64 = 0 87 while name[ln] != (0 as u8) { ln = ln + 1 } 88 let dom: *u8 = sys_mmap(128) 89 var c: i64 = 0 90 while c < ln - 6 { dom[c] = name[c]; c = c + 1 } 91 dom[ln-6] = 0 as u8 92 r_run("_offc/nx_swcompare_evidence.elf\x00" as *u8, dom, 0 as *u8, 0 as *u8, tmp) 93 let el: *i64 = sys_mmap(16) as *i64; el[0] = 0 94 let eb: *u8 = sys_read_file(tmp, el) 95 var isg: i64 = 0 96 if el[0] > 0 { if r_has(eb, el[0], "MEASURED-HONEST" as *u8, 15) == 1 { isg = 1 } } 97 rw(" " as *u8); sys_write(1, dom, ln - 6) 98 if isg == 1 { rw(" -> MEASURED-HONEST (stamped)\n" as *u8); green = green + 1 } else { rw(" -> RED (stamped; needs fix)\n" as *u8) } 99 backed = backed + 1 100 } 101 if reclen <= 0 { pos = nr } else { pos = pos + reclen } 102 } 103 } 104 } 105 sys_close(fd) 106 107 rw("\nNX-EVIDENCE-REFRESH done: backed=" as *u8); rn(backed); rw(" PROVEN=" as *u8); rn(green); rw(" RED=" as *u8); rn(backed - green) 108 rw(" -- stamps fresh (age~0); nx_sota_status now reflects this.\n" as *u8) 109 return 0 110}