nx_evidence_verdict.nx source
↩ module page · 221 lines · 13822 B
1// nx_evidence_verdict.nx -- THE EVIDENCE LAW, shared. Operator directive 2026-07-30: "we dont have evidence
2// for most of our systems that real actual proven sota ... triangulation between an llm, mechanistic, and
3// human validated with proven outputs not just navel gazing inputs."
4//
5// ROOT CAUSE THIS LIBRARY EXISTS TO KILL (all three MEASURED on the live system 2026-07-30):
6// D1 QUORUM nx_swcompare_evidence.nx:480 read `liar_green = (green >= 1)`. ONE green gate out of five
7// stamped the whole domain PROVEN. Four RED gates were invisible to the headline number.
8// D2 EXPIRY nx_sota_status.nx read the stamp's ok=1 unconditionally; `epoch=` was parsed for DISPLAY
9// only and never gated the verdict. Oldest live stamp measured at 1183616s = 13.7 days.
10// D3 PROVENANCE ev_stamp wrote no host and no artifact digest, so a verdict produced where the gate
11// binaries exist (the laptop tree) is byte-indistinguishable from one produced where they do
12// not (the NAS, where 0 of the declared medbilling/warden gate elfs resolve).
13//
14// Each defect is the same shape: a VERDICT that outlived, or never contained, the EVIDENCE that earned it.
15// The fix is not a TTL constant bolted onto one reader -- it is ONE law every reader imports, so the
16// optimism cannot be re-introduced per-instrument. Sibling of nx_honesty_grade_lib.nx (which grades what a
17// claim's PROSE earns); this grades what a claim's EXECUTION earns. Import both.
18//
19// THE BAR (a claim is PROVEN only if EVERY clause holds -- fail-closed, downgrades dominate):
20// 1 QUORUM every declared gate ran and every one came back GREEN. Not "at least one".
21// 2 FRESHNESS the stamp is younger than the policy TTL. A verdict has an expiry date or it is a rumor.
22// 3 PROVENANCE the stamp names WHERE it ran and the DIGEST of what ran (the SLSA/in-toto lesson:
23// provenance without builder identity + artifact digest is unverifiable by construction).
24// 4 NON-VACUITY each gate has a RECORDED RED observation, i.e. it has been proven able to FAIL.
25// A gate never observed failing measures nothing. (2026 mutation-testing result: suites
26// at 100% line/branch coverage scoring 4% mutation score -- coverage is not detection.)
27// 5 TRIANGULATION at least TWO distinct method classes agree, and at least one is MECHANISTIC.
28// An LLM-only verdict can NEVER prove: 2026 judge studies measure run-to-run self-
29// agreement at coin-flip rates, and judges over-credit incomplete work by silently
30// supplying the missing premise. A model may CORROBORATE; it may not CONVICT.
31//
32// DISAGREEMENT IS NOT AVERAGED. Two classes that disagree return RED, never a mean. A contradiction is a
33// finding, not a rounding error -- averaging it is how a real defect gets laundered into a passing score.
34//
35// TTL and the required class count are PARAMETERS, never literals here (rule 11: thresholds live in config,
36// not code). The caller reads knowledge/evidence_policy.conf and passes them in.
37// No main, no syscalls -> any grader/census/judge/gate imports it. license_tier: ORIGINAL
38
39// ---- method classes (bitmask; a claim accumulates the classes that independently back it) ----
40const EV_CLASS_MECH: i64 = 1
41const EV_CLASS_LLM: i64 = 2
42const EV_CLASS_HUMAN: i64 = 4
43// ★ORACLE (2026-07-30): agreement with an INDEPENDENT implementation or external ground truth --
44// differential/byte-parity against a reference tool, published KAT vectors, metamorphic properties, a
45// second-implementation cross-check. Added because the operator asked the question that exposed the real
46// gap: "what do you mean you need me, I do not see what to validate if it is not an image." He was right:
47// for a mechanical claim there is nothing a human judges better than the gate, so require_human made the
48// top verdict unreachable by ceremony rather than by evidence. But MEASURED: removing the human clause did
49// NOT move any domain to PROVEN, because min_classes=2 still binds and a mechanical domain carries exactly
50// ONE class. The missing thing was never a signature -- it was a SECOND INDEPENDENT METHOD.
51// ★WHAT MAKES THIS INDEPENDENT IS THE REFERENCE, NOT THE SIGNER. A machine key may sign an oracle row
52// (unlike a human row) because the independence comes from having compared against something WE DID NOT
53// WRITE. That is also why an oracle row without a named ref= must be refused: "it matched" is not evidence
54// unless it says what it matched, exactly as scope= is required of every other class.
55const EV_CLASS_ORACLE: i64 = 8
56// ★EXPERIENTIAL (2026-08-01): THE WORLD ANSWERED BACK. Not "a gate returned 0" -- an external party or
57// physical reality responded to something we actually ran: strangers' DHT nodes ACKed our announce, a
58// place-and-route achieved timing closure at a measured frequency, a benchmark raced, a frame rendered.
59// WHY THIS EXISTS: `require_human` was NAMED for WHO supplies evidence and so got BUILT as an Ed25519
60// identity check -- but the operator's stated intent was always WHAT the evidence IS: "human means that
61// the experiential testing happened ... actual live testing ... not some random legal signing ceremony."
62// A clause that cannot be satisfied by the evidence it was meant to demand is ceremony, and ceremony is
63// what pinned this board at 0/41 for fourteen days.
64// ★★★★★★A CLAUSE NAMED FOR *WHO SUPPLIES* EVIDENCE BECOMES AN IDENTITY CHECK; NAMED FOR *WHAT THE
65// EVIDENCE IS* IT BECOMES A LIVE TEST.
66// THIS IS NOT A SOFTER BAR -- IT IS A HARDER ONE. A signature costs a keypress; this class demands that
67// something outside this process observably responded, and that the row say WHAT RAN, WHAT RESPONDED, and
68// WHICH ARTIFACT records it, so any later reader re-derives it. Machine-signable for the same reason as
69// ORACLE: independence lives in the RESPONDENT, not in the signer. Self-reported success is NOT this class
70// -- if the only witness is us, it is MECH.
71const EV_CLASS_EXPERIENTIAL: i64 = 16
72
73// ---- verdicts (ordered: a lower value never upgrades to a higher one) ----
74const EV_UNPROVEN: i64 = 0
75const EV_VACUOUS: i64 = 1
76const EV_STALE: i64 = 2
77const EV_RED: i64 = 3
78const EV_PROVEN: i64 = 4
79
80// ---- clause 1: QUORUM. Every declared gate ran, and every one was green. ----
81// This is the exact line that made a 1-of-5 domain PROVEN. `ran` must also be > 0: a domain with zero
82// executable gates has no execution evidence at all and must not pass on an empty conjunction.
83func ev_quorum_ok(green: i64, ran: i64, declared: i64) -> i64 {
84 if declared <= 0 { return 0 }
85 if ran != declared { return 0 }
86 if green != ran { return 0 }
87 return 1
88}
89
90// ---- clause 2: FRESHNESS. A verdict older than the policy TTL is STALE, not PROVEN. ----
91// epoch<=0 means the stamp carried no time at all -> refuse. now<epoch means clock skew -> refuse.
92func ev_fresh_ok(stamp_epoch: i64, now: i64, ttl_sec: i64) -> i64 {
93 if stamp_epoch <= 0 { return 0 }
94 if ttl_sec <= 0 { return 0 }
95 if now < stamp_epoch { return 0 }
96 let age: i64 = now - stamp_epoch
97 if age > ttl_sec { return 0 }
98 return 1
99}
100
101// ---- clause 3: PROVENANCE. The stamp must name where it ran and the digest of what ran. ----
102// A v1 stamp (no host, no digest) is legacy and fails CLOSED -- it does not get grandfathered into PROVEN,
103// because the whole point of the finding is that we could not tell those two situations apart.
104func ev_prov_ok(host_len: i64, digest_len: i64) -> i64 {
105 if host_len <= 0 { return 0 }
106 if digest_len <= 0 { return 0 }
107 return 1
108}
109
110// ---- clause 4: NON-VACUITY. A gate never observed RED has not been shown to measure anything. ----
111// red_seen = the count of gates for which a RED observation is on record (from a mutation/negative-control
112// run). It must cover every declared gate; a partially-proven suite leaves untested gates able to be
113// permanently, silently green.
114func ev_nonvacuous_ok(red_seen: i64, declared: i64) -> i64 {
115 if declared <= 0 { return 0 }
116 if red_seen < declared { return 0 }
117 return 1
118}
119
120// ---- clause 5: TRIANGULATION. >=min_classes distinct classes, at least one MECHANISTIC. ----
121func ev_class_count(mask: i64) -> i64 {
122 var n: i64 = 0
123 if (mask & EV_CLASS_MECH) != 0 { n = n + 1 }
124 if (mask & EV_CLASS_LLM) != 0 { n = n + 1 }
125 if (mask & EV_CLASS_HUMAN) != 0 { n = n + 1 }
126 if (mask & EV_CLASS_ORACLE) != 0 { n = n + 1 }
127 if (mask & EV_CLASS_EXPERIENTIAL) != 0 { n = n + 1 }
128 return n
129}
130func ev_triangulated_ok(mask: i64, min_classes: i64) -> i64 {
131 if min_classes <= 0 { return 0 }
132 if (mask & EV_CLASS_MECH) == 0 { return 0 }
133 let n: i64 = ev_class_count(mask)
134 if n < min_classes { return 0 }
135 return 1
136}
137
138// ---- clause 5b: THE HUMAN LEG CANNOT BE SELF-GRANTED. ----
139// The operator asked for triangulation between an LLM, a mechanistic method, AND a human. Two of those
140// three can be produced by the same agent in the same session: the machine that runs the gate can also
141// write the model's attestation. That is not independence, it is one opinion wearing two hats -- and it is
142// precisely the failure mode the whole apparatus exists to prevent. So the human class is REQUIRED for the
143// top verdict by default, and no automated actor can supply it. An agent that could sign the human leg
144// would be able to certify its own work, which is the definition of the problem.
145// ★AMENDED 2026-08-01 per the operator's own correction. The leg is SATISFIED, never deleted: an
146// EXPERIENTIAL row counts here because it is the thing the clause was always asking for -- contact with
147// reality rather than a countersignature. A HUMAN row still counts, unchanged, and remains the ONLY way
148// to satisfy this leg where a human really is the competent instrument (rendered output, product fit, a
149// safety call). What is NOT accepted is MECH or LLM: an agent still cannot certify its own work, so the
150// self-certification this clause exists to prevent stays structurally impossible.
151// ⛔The alternative -- setting require_human=0 per domain -- would have shown a bigger number in one line
152// and proved nothing. Deleting a clause is not passing it.
153func ev_human_ok(mask: i64, require_human: i64) -> i64 {
154 if require_human == 0 { return 1 }
155 if (mask & EV_CLASS_HUMAN) != 0 { return 1 }
156 if (mask & EV_CLASS_EXPERIENTIAL) != 0 { return 1 }
157 return 0
158}
159
160// ---- disagreement: two classes that contradict each other return RED. Never averaged. ----
161// agree_mask = classes that reported PASS. dissent_mask = classes that reported FAIL. Any overlap-free
162// dissent at all is a contradiction: some independent method says this claim is false.
163func ev_dissent(dissent_mask: i64) -> i64 {
164 if dissent_mask != 0 { return 1 }
165 return 0
166}
167
168// ---- the EVIDENCE RECORD and the POLICY, as slot-indexed vectors ----
169// Passed by pointer, not as a parameter list. Two reasons, both deliberate: a twelve-parameter signature is
170// a design smell (rule 22 -- compose, do not accumulate flags), and it is additive-extensible (rule 19) --
171// a new clause claims the next slot without changing a single call site or breaking any consumer.
172const EV_R_GREEN: i64 = 0
173const EV_R_RAN: i64 = 1
174const EV_R_DECLARED: i64 = 2
175const EV_R_EPOCH: i64 = 3
176const EV_R_HOSTLEN: i64 = 4
177const EV_R_DIGLEN: i64 = 5
178const EV_R_REDSEEN: i64 = 6
179const EV_R_CLASSMASK: i64 = 7
180const EV_R_DISSENT: i64 = 8
181const EV_R_SLOTS: i64 = 9
182
183const EV_P_TTL: i64 = 0
184const EV_P_MINCLASSES: i64 = 1
185const EV_P_REQHUMAN: i64 = 2
186const EV_P_SLOTS: i64 = 3
187
188// ---- THE GATE: return the honest verdict. Every clause must hold; the first failure decides. ----
189// Ordered so the returned verdict names the MOST actionable defect: a contradiction outranks a failed
190// quorum, which outranks missing provenance, which outranks vacuity, which outranks mere staleness.
191func ev_verdict(r: *i64, p: *i64, now: i64) -> i64 {
192 if ev_dissent(r[EV_R_DISSENT]) == 1 { return EV_RED }
193 // RED and UNPROVEN are different claims about the world and must not be conflated. RED means a method
194 // RAN and reported failure. UNPROVEN means nothing was established either way. Collapsing them sends a
195 // reader hunting for a failing gate that does not exist -- which is exactly what the first cut of this
196 // function did to seven legacy-stamped domains. A diagnostic that misnames the defect is a defect.
197 if r[EV_R_DECLARED] <= 0 { return EV_UNPROVEN }
198 if ev_quorum_ok(r[EV_R_GREEN], r[EV_R_RAN], r[EV_R_DECLARED]) == 0 { return EV_RED }
199 if ev_prov_ok(r[EV_R_HOSTLEN], r[EV_R_DIGLEN]) == 0 { return EV_UNPROVEN }
200 if ev_triangulated_ok(r[EV_R_CLASSMASK], p[EV_P_MINCLASSES]) == 0 { return EV_UNPROVEN }
201 if ev_human_ok(r[EV_R_CLASSMASK], p[EV_P_REQHUMAN]) == 0 { return EV_UNPROVEN }
202 if ev_nonvacuous_ok(r[EV_R_REDSEEN], r[EV_R_DECLARED]) == 0 { return EV_VACUOUS }
203 if ev_fresh_ok(r[EV_R_EPOCH], now, p[EV_P_TTL]) == 0 { return EV_STALE }
204 return EV_PROVEN
205}
206
207// ---- naming, so every surface prints the same word for the same state ----
208func ev_verdict_name(v: i64) -> *u8 {
209 if v == EV_PROVEN { return "PROVEN" as *u8 }
210 if v == EV_RED { return "RED" as *u8 }
211 if v == EV_STALE { return "STALE" as *u8 }
212 if v == EV_VACUOUS { return "VACUOUS" as *u8 }
213 return "UNPROVEN" as *u8
214}
215
216// ---- honesty ratio: PROVEN over TOTAL, per-mille. The denominator is every domain, never just the
217// ones that happened to be measured -- an honest ratio cannot shrink its own denominator. ----
218func ev_honesty_permil(proven: i64, total: i64) -> i64 {
219 if total <= 0 { return 0 }
220 return (proven * 1000) / total
221}