nx_evidence_verdict.nx source

1// nx_evidence_verdict.nx -- THE EVIDENCE LAW, shared. Operator directive 2026-07-30: "we dont have evidence 2// for most of our systems that real actual proven sota ... triangulation between an llm, mechanistic, and 3// human validated with proven outputs not just navel gazing inputs." 4// 5// ROOT CAUSE THIS LIBRARY EXISTS TO KILL (all three MEASURED on the live system 2026-07-30): 6// D1 QUORUM nx_swcompare_evidence.nx:480 read `liar_green = (green >= 1)`. ONE green gate out of five 7// stamped the whole domain PROVEN. Four RED gates were invisible to the headline number. 8// D2 EXPIRY nx_sota_status.nx read the stamp's ok=1 unconditionally; `epoch=` was parsed for DISPLAY 9// only and never gated the verdict. Oldest live stamp measured at 1183616s = 13.7 days. 10// D3 PROVENANCE ev_stamp wrote no host and no artifact digest, so a verdict produced where the gate 11// binaries exist (the laptop tree) is byte-indistinguishable from one produced where they do 12// not (the NAS, where 0 of the declared medbilling/warden gate elfs resolve). 13// 14// Each defect is the same shape: a VERDICT that outlived, or never contained, the EVIDENCE that earned it. 15// The fix is not a TTL constant bolted onto one reader -- it is ONE law every reader imports, so the 16// optimism cannot be re-introduced per-instrument. Sibling of nx_honesty_grade_lib.nx (which grades what a 17// claim's PROSE earns); this grades what a claim's EXECUTION earns. Import both. 18// 19// THE BAR (a claim is PROVEN only if EVERY clause holds -- fail-closed, downgrades dominate): 20// 1 QUORUM every declared gate ran and every one came back GREEN. Not "at least one". 21// 2 FRESHNESS the stamp is younger than the policy TTL. A verdict has an expiry date or it is a rumor. 22// 3 PROVENANCE the stamp names WHERE it ran and the DIGEST of what ran (the SLSA/in-toto lesson: 23// provenance without builder identity + artifact digest is unverifiable by construction). 24// 4 NON-VACUITY each gate has a RECORDED RED observation, i.e. it has been proven able to FAIL. 25// A gate never observed failing measures nothing. (2026 mutation-testing result: suites 26// at 100% line/branch coverage scoring 4% mutation score -- coverage is not detection.) 27// 5 TRIANGULATION at least TWO distinct method classes agree, and at least one is MECHANISTIC. 28// An LLM-only verdict can NEVER prove: 2026 judge studies measure run-to-run self- 29// agreement at coin-flip rates, and judges over-credit incomplete work by silently 30// supplying the missing premise. A model may CORROBORATE; it may not CONVICT. 31// 32// DISAGREEMENT IS NOT AVERAGED. Two classes that disagree return RED, never a mean. A contradiction is a 33// finding, not a rounding error -- averaging it is how a real defect gets laundered into a passing score. 34// 35// TTL and the required class count are PARAMETERS, never literals here (rule 11: thresholds live in config, 36// not code). The caller reads knowledge/evidence_policy.conf and passes them in. 37// No main, no syscalls -> any grader/census/judge/gate imports it. license_tier: ORIGINAL 38 39// ---- method classes (bitmask; a claim accumulates the classes that independently back it) ---- 40const EV_CLASS_MECH: i64 = 1 41const EV_CLASS_LLM: i64 = 2 42const EV_CLASS_HUMAN: i64 = 4 43// ★ORACLE (2026-07-30): agreement with an INDEPENDENT implementation or external ground truth -- 44// differential/byte-parity against a reference tool, published KAT vectors, metamorphic properties, a 45// second-implementation cross-check. Added because the operator asked the question that exposed the real 46// gap: "what do you mean you need me, I do not see what to validate if it is not an image." He was right: 47// for a mechanical claim there is nothing a human judges better than the gate, so require_human made the 48// top verdict unreachable by ceremony rather than by evidence. But MEASURED: removing the human clause did 49// NOT move any domain to PROVEN, because min_classes=2 still binds and a mechanical domain carries exactly 50// ONE class. The missing thing was never a signature -- it was a SECOND INDEPENDENT METHOD. 51// ★WHAT MAKES THIS INDEPENDENT IS THE REFERENCE, NOT THE SIGNER. A machine key may sign an oracle row 52// (unlike a human row) because the independence comes from having compared against something WE DID NOT 53// WRITE. That is also why an oracle row without a named ref= must be refused: "it matched" is not evidence 54// unless it says what it matched, exactly as scope= is required of every other class. 55const EV_CLASS_ORACLE: i64 = 8 56// ★EXPERIENTIAL (2026-08-01): THE WORLD ANSWERED BACK. Not "a gate returned 0" -- an external party or 57// physical reality responded to something we actually ran: strangers' DHT nodes ACKed our announce, a 58// place-and-route achieved timing closure at a measured frequency, a benchmark raced, a frame rendered. 59// WHY THIS EXISTS: `require_human` was NAMED for WHO supplies evidence and so got BUILT as an Ed25519 60// identity check -- but the operator's stated intent was always WHAT the evidence IS: "human means that 61// the experiential testing happened ... actual live testing ... not some random legal signing ceremony." 62// A clause that cannot be satisfied by the evidence it was meant to demand is ceremony, and ceremony is 63// what pinned this board at 0/41 for fourteen days. 64// ★★★★★★A CLAUSE NAMED FOR *WHO SUPPLIES* EVIDENCE BECOMES AN IDENTITY CHECK; NAMED FOR *WHAT THE 65// EVIDENCE IS* IT BECOMES A LIVE TEST. 66// THIS IS NOT A SOFTER BAR -- IT IS A HARDER ONE. A signature costs a keypress; this class demands that 67// something outside this process observably responded, and that the row say WHAT RAN, WHAT RESPONDED, and 68// WHICH ARTIFACT records it, so any later reader re-derives it. Machine-signable for the same reason as 69// ORACLE: independence lives in the RESPONDENT, not in the signer. Self-reported success is NOT this class 70// -- if the only witness is us, it is MECH. 71const EV_CLASS_EXPERIENTIAL: i64 = 16 72 73// ---- verdicts (ordered: a lower value never upgrades to a higher one) ---- 74const EV_UNPROVEN: i64 = 0 75const EV_VACUOUS: i64 = 1 76const EV_STALE: i64 = 2 77const EV_RED: i64 = 3 78const EV_PROVEN: i64 = 4 79 80// ---- clause 1: QUORUM. Every declared gate ran, and every one was green. ---- 81// This is the exact line that made a 1-of-5 domain PROVEN. `ran` must also be > 0: a domain with zero 82// executable gates has no execution evidence at all and must not pass on an empty conjunction. 83// JUDGED excludes gates that ABSTAINED -- exit 3 (SKIP), meaning a PRECONDITION was absent so the gate 84// examined nothing and proved nothing in either direction. ev_verdict's own doctrine, four clauses below, 85// says RED means a method RAN and reported failure while UNPROVEN means nothing was established; an 86// abstention is the second, and counting it in the quorum returned the first. That convicted a domain of 87// failures nobody measured and blocked deploys on gates whose own output says they must never do so. 88// Expressed HERE, once, because two readers re-derive this quorum and a law fixed in one is half a law. 89func ev_quorum_ok_sk(green: i64, ran: i64, declared: i64, skipped: i64) -> i64 { 90 let judged: i64 = declared - skipped 91 if judged <= 0 { return 0 } // every declared gate abstained => NO execution evidence, never proven 92 if ran != declared { return 0 } // a DROPPED gate (declared but never run) is still a quorum failure 93 if green != judged { return 0 } 94 return 1 95} 96// Back-compatible face (rule 19): skipped=0 reproduces the original arithmetic exactly, so every existing 97// caller keeps its behaviour and there is still only ONE quorum in the estate. 98func ev_quorum_ok(green: i64, ran: i64, declared: i64) -> i64 { 99 return ev_quorum_ok_sk(green, ran, declared, 0) 100} 101 102// ---- clause 2: FRESHNESS. A verdict older than the policy TTL is STALE, not PROVEN. ---- 103// epoch<=0 means the stamp carried no time at all -> refuse. now<epoch means clock skew -> refuse. 104func ev_fresh_ok(stamp_epoch: i64, now: i64, ttl_sec: i64) -> i64 { 105 if stamp_epoch <= 0 { return 0 } 106 if ttl_sec <= 0 { return 0 } 107 if now < stamp_epoch { return 0 } 108 let age: i64 = now - stamp_epoch 109 if age > ttl_sec { return 0 } 110 return 1 111} 112 113// ---- clause 3: PROVENANCE. The stamp must name where it ran and the digest of what ran. ---- 114// A v1 stamp (no host, no digest) is legacy and fails CLOSED -- it does not get grandfathered into PROVEN, 115// because the whole point of the finding is that we could not tell those two situations apart. 116func ev_prov_ok(host_len: i64, digest_len: i64) -> i64 { 117 if host_len <= 0 { return 0 } 118 if digest_len <= 0 { return 0 } 119 return 1 120} 121 122// ---- clause 4: NON-VACUITY. A gate never observed RED has not been shown to measure anything. ---- 123// red_seen = the count of gates for which a RED observation is on record (from a mutation/negative-control 124// run). It must cover every declared gate; a partially-proven suite leaves untested gates able to be 125// permanently, silently green. 126func ev_nonvacuous_ok(red_seen: i64, declared: i64) -> i64 { 127 if declared <= 0 { return 0 } 128 if red_seen < declared { return 0 } 129 return 1 130} 131 132// ---- clause 5: TRIANGULATION. >=min_classes distinct classes, at least one MECHANISTIC. ---- 133func ev_class_count(mask: i64) -> i64 { 134 var n: i64 = 0 135 if (mask & EV_CLASS_MECH) != 0 { n = n + 1 } 136 if (mask & EV_CLASS_LLM) != 0 { n = n + 1 } 137 if (mask & EV_CLASS_HUMAN) != 0 { n = n + 1 } 138 if (mask & EV_CLASS_ORACLE) != 0 { n = n + 1 } 139 if (mask & EV_CLASS_EXPERIENTIAL) != 0 { n = n + 1 } 140 return n 141} 142func ev_triangulated_ok(mask: i64, min_classes: i64) -> i64 { 143 if min_classes <= 0 { return 0 } 144 if (mask & EV_CLASS_MECH) == 0 { return 0 } 145 let n: i64 = ev_class_count(mask) 146 if n < min_classes { return 0 } 147 return 1 148} 149 150// ---- clause 5b: THE HUMAN LEG CANNOT BE SELF-GRANTED. ---- 151// The operator asked for triangulation between an LLM, a mechanistic method, AND a human. Two of those 152// three can be produced by the same agent in the same session: the machine that runs the gate can also 153// write the model's attestation. That is not independence, it is one opinion wearing two hats -- and it is 154// precisely the failure mode the whole apparatus exists to prevent. So the human class is REQUIRED for the 155// top verdict by default, and no automated actor can supply it. An agent that could sign the human leg 156// would be able to certify its own work, which is the definition of the problem. 157// ★AMENDED 2026-08-01 per the operator's own correction. The leg is SATISFIED, never deleted: an 158// EXPERIENTIAL row counts here because it is the thing the clause was always asking for -- contact with 159// reality rather than a countersignature. A HUMAN row still counts, unchanged, and remains the ONLY way 160// to satisfy this leg where a human really is the competent instrument (rendered output, product fit, a 161// safety call). What is NOT accepted is MECH or LLM: an agent still cannot certify its own work, so the 162// self-certification this clause exists to prevent stays structurally impossible. 163// ⛔The alternative -- setting require_human=0 per domain -- would have shown a bigger number in one line 164// and proved nothing. Deleting a clause is not passing it. 165func ev_human_ok(mask: i64, require_human: i64) -> i64 { 166 if require_human == 0 { return 1 } 167 if (mask & EV_CLASS_HUMAN) != 0 { return 1 } 168 if (mask & EV_CLASS_EXPERIENTIAL) != 0 { return 1 } 169 return 0 170} 171 172// ---- disagreement: two classes that contradict each other return RED. Never averaged. ---- 173// agree_mask = classes that reported PASS. dissent_mask = classes that reported FAIL. Any overlap-free 174// dissent at all is a contradiction: some independent method says this claim is false. 175func ev_dissent(dissent_mask: i64) -> i64 { 176 if dissent_mask != 0 { return 1 } 177 return 0 178} 179 180// ---- the EVIDENCE RECORD and the POLICY, as slot-indexed vectors ---- 181// Passed by pointer, not as a parameter list. Two reasons, both deliberate: a twelve-parameter signature is 182// a design smell (rule 22 -- compose, do not accumulate flags), and it is additive-extensible (rule 19) -- 183// a new clause claims the next slot without changing a single call site or breaking any consumer. 184const EV_R_GREEN: i64 = 0 185const EV_R_RAN: i64 = 1 186const EV_R_DECLARED: i64 = 2 187const EV_R_EPOCH: i64 = 3 188const EV_R_HOSTLEN: i64 = 4 189const EV_R_DIGLEN: i64 = 5 190const EV_R_REDSEEN: i64 = 6 191const EV_R_CLASSMASK: i64 = 7 192const EV_R_DISSENT: i64 = 8 193const EV_R_SKIPPED: i64 = 9 // gates that ABSTAINED: declared and run, but examined nothing 194const EV_R_SLOTS: i64 = 10 195 196const EV_P_TTL: i64 = 0 197const EV_P_MINCLASSES: i64 = 1 198const EV_P_REQHUMAN: i64 = 2 199const EV_P_SLOTS: i64 = 3 200 201// ---- THE GATE: return the honest verdict. Every clause must hold; the first failure decides. ---- 202// Ordered so the returned verdict names the MOST actionable defect: a contradiction outranks a failed 203// quorum, which outranks missing provenance, which outranks vacuity, which outranks mere staleness. 204func ev_verdict(r: *i64, p: *i64, now: i64) -> i64 { 205 if ev_dissent(r[EV_R_DISSENT]) == 1 { return EV_RED } 206 // RED and UNPROVEN are different claims about the world and must not be conflated. RED means a method 207 // RAN and reported failure. UNPROVEN means nothing was established either way. Collapsing them sends a 208 // reader hunting for a failing gate that does not exist -- which is exactly what the first cut of this 209 // function did to seven legacy-stamped domains. A diagnostic that misnames the defect is a defect. 210 if r[EV_R_DECLARED] <= 0 { return EV_UNPROVEN } 211 // Every declared gate ABSTAINED: nothing was established either way, which is the definition of 212 // UNPROVEN given three lines above -- NOT a method reporting failure. Returning RED here would be the 213 // very conflation this function's own comment forbids, and it must come BEFORE the quorum, whose 214 // zero-denominator refusal cannot tell "all abstained" from "all failed". 215 if r[EV_R_DECLARED] - r[EV_R_SKIPPED] <= 0 { return EV_UNPROVEN } 216 if ev_quorum_ok_sk(r[EV_R_GREEN], r[EV_R_RAN], r[EV_R_DECLARED], r[EV_R_SKIPPED]) == 0 { return EV_RED } 217 if ev_prov_ok(r[EV_R_HOSTLEN], r[EV_R_DIGLEN]) == 0 { return EV_UNPROVEN } 218 if ev_triangulated_ok(r[EV_R_CLASSMASK], p[EV_P_MINCLASSES]) == 0 { return EV_UNPROVEN } 219 if ev_human_ok(r[EV_R_CLASSMASK], p[EV_P_REQHUMAN]) == 0 { return EV_UNPROVEN } 220 if ev_nonvacuous_ok(r[EV_R_REDSEEN], r[EV_R_DECLARED]) == 0 { return EV_VACUOUS } 221 if ev_fresh_ok(r[EV_R_EPOCH], now, p[EV_P_TTL]) == 0 { return EV_STALE } 222 return EV_PROVEN 223} 224 225// ---- naming, so every surface prints the same word for the same state ---- 226func ev_verdict_name(v: i64) -> *u8 { 227 if v == EV_PROVEN { return "PROVEN" as *u8 } 228 if v == EV_RED { return "RED" as *u8 } 229 if v == EV_STALE { return "STALE" as *u8 } 230 if v == EV_VACUOUS { return "VACUOUS" as *u8 } 231 return "UNPROVEN" as *u8 232} 233 234// ---- honesty ratio: PROVEN over TOTAL, per-mille. The denominator is every domain, never just the 235// ones that happened to be measured -- an honest ratio cannot shrink its own denominator. ---- 236func ev_honesty_permil(proven: i64, total: i64) -> i64 { 237 if total <= 0 { return 0 } 238 return (proven * 1000) / total 239}