code wiki / _hdl_build / nx_evoracle_sweep.nx
`nx_evoracle_sweep.nx` source

↩ module page · 370 lines · 16887 B
1// nx_evoracle_sweep.nx -- DERIVE ORACLE ROWS ACROSS THE THIRD-PARTY POPULATION, on the host that SERVES
2// the claims, and WRITE the attestation file.
3//
4// Separate organ from the single-subject producer on purpose (rule 9): measuring ONE subject and driving a
5// FLEET are different jobs, and the fleet driver has a failure mode the single-shot one does not --
6// PARTIAL COVERAGE THAT READS AS COMPLETE. So DERIVED / REFUSED / NO-ELF / NOT-GREEN are counted and
7// printed separately and never collapsed. A gate we could not test and a gate that failed must never look
8// the same, or the sweep becomes the thing it audits.
9//
10// PATHS ARE NAS-NATIVE: subjects at buildroot/runtime/_hdl_build/, artifacts at buildroot/_build/. The
11// laptop keeps them at runtime/_hdl_build/ and _build/ -- the artifact-root class this ecosystem has been
12// bitten by five times. Declared here rather than guessed.
13//
14// ⛔THE PARAGRAPH THAT USED TO SIT HERE IS STALE AND IT COST THE ESTATE A MONTH OF PROVEN=0. It said rows
15// must stay unsigned because "knowledge/attest_keys.conf is absent" and "only a key the operator holds
16// supplies the ATTRIBUTION". BOTH HALVES WERE TRUE WHEN WRITTEN and BOTH ARE NOW FALSE, measured
17// 2026-09-03: that file EXISTS (2548 B) and REGISTERS TWO role=machine keys, added later the same day by
18// an agent, and it sanctions them in its own words -- for EV_CLASS_ORACLE "independence comes from the
19// REFERENCE, not the signer". PROVEN END TO END, not argued: nx_attest_ceremony signed a derived oracle
20// row with the registered machine key (pub=08fc04ab..4fa8) and `check` against the LIVE registry returned
21// at_verify_row -> OK (rc=0). Its gate agrees -- T6 oracle+machine=OK, T9 experiential+machine=OK, and
22// only T4 (class=human) refuses a machine key, which is correct and must never be loosened.
23// ★★★★★★A COMMENT THAT WAS TRUE WHEN WRITTEN AND IS NEVER RE-CHECKED BECOMES A LAW THE WHOLE ESTATE
24// OBEYS -- this one propagated into nx_evclass_route's header, into two seat memories, and into a report
25// to the operator naming a key ceremony as the top priority. It was none of those things.
26// WHAT IS ACTUALLY TRUE NOW: this organ supplies the DERIVATION, and for class=oracle and
27// class=experiential the registered MACHINE key legitimately supplies the ATTRIBUTION. A human-class row
28// still needs the operator, and that is the only leg an agent must never supply.
29// MEASURED SIZE OF THE GAP (2026-09-03, corpus_complete=1 over knowledge/status/*.conf): 46 rows carry
30// epoch=1785* and are ~31 days stale against the 604800 s TTL, while 30 fresh rows exist carrying the
31// literal signer=UNSIGNED-operator-key-required -- fresh evidence, derived, one signature from counting.
32// license_tier: ORIGINAL  expect_exit: 0
33import "nx_syscalls.nx"
34import "nx_itoa_lib.nx"   // shared MSB-first emitter (zero-alloc)
35import "nx_sha256_wasm.nx"
36import "nx_evoracle.nx"
37const K_MAGIC_1024: i64 = 1024
38const K_MAGIC_65536: i64 = 65536
39
40func w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
41func wb(b: *u8, n: i64) -> i64 { sys_write(1, b, n); return 0 }
42
43// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer
44// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the
45// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls).
46// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign.
47func nn(v: i64) -> i64 { nxi_out(v); return 0 }
48
49func hexnib(v: i64) -> i64 { if v < 10 { return 48 + v } return 87 + v }
50
51// Read <gate> <subject> lines from a conf and drive one() for each. Comments (#) and blank
52// lines skipped. Bounded: SWEEP_CONF_MAXROWS, so a runaway file cannot spin the sweep.
53const SWEEP_CONF_CAP: i64 = 65536
54const SWEEP_CONF_MAXROWS: i64 = 256
55const SWEEP_TOK_CAP: i64 = 128
56
57// ⚠THIS FUNCTION'S FIRST VERSION SILENTLY IGNORED EVERY ROW. It marked "newline found" with
58// sentinel arithmetic (e = n + n) and then recovered the position as e - n -- which returns n,
59// NOT the newline index, so every line spanned to EOF and parsed as one malformed row. The sweep
60// still printed GREEN and its DERIVED count simply did not move.
61// ★THE ONLY REASON IT WAS CAUGHT: the count was READ BACK and compared (7 before, 7 after) --
62// A FEATURE THAT ADDS NOTHING LOOKS EXACTLY LIKE A FEATURE THAT IS ABSENT, and a green verdict
63// from the surrounding organ says nothing about it. Rewritten with an explicit found-flag.
64func sweep_line_end(src: *u8, from: i64, n: i64) -> i64 {
  var e: i64 = from
  var done: i64 = 0
  while done == 0 {
      if e >= n { done = 1 }
      if done == 0 { if src[e] == (10 as u8) { done = 1 } else { e = e + 1 } }
  }
  return e
72}
73
74func sweep_conf_rows(c: *i64, rb: *u8, rl: *i64, path: *u8) -> i64 {
  let lenp: *i64 = sys_mmap(16) as *i64
  lenp[0] = 0
  let src: *u8 = sys_read_file(path, lenp)
  if (src as i64) == 0 { return 0 }
  var n: i64 = lenp[0]
  if n > SWEEP_CONF_CAP { n = SWEEP_CONF_CAP }
  let gbuf: *u8 = sys_mmap(SWEEP_TOK_CAP)
  let sbuf: *u8 = sys_mmap(SWEEP_TOK_CAP)
  var i: i64 = 0
  var rows: i64 = 0
  while i < n {
      let e: i64 = sweep_line_end(src, i, n)
      // ⚠SCANNING-FLAG, NOT A SENTINEL. Writing `st = e + 1` to mean "found" DESTROYS the
      // position that was the whole point of the scan -- I shipped that bug twice in this one
      // function before a read-back caught it. A loop that must REPORT WHERE it stopped cannot
      // use its own cursor as the stop signal.
      var st: i64 = i
      var scanning: i64 = 1
      while scanning == 1 {
          if st >= e { scanning = 0 }
          if scanning == 1 { if src[st] == (32 as u8) { st = st + 1 } else { scanning = 0 } }
      }
      var skip: i64 = 0
      if st >= e { skip = 1 }
      if skip == 0 { if src[st] == (35 as u8) { skip = 1 } }
      if skip == 0 { if rows >= SWEEP_CONF_MAXROWS { skip = 1 } }
      if skip == 0 {
          var q: i64 = st
          var gl: i64 = 0
          var stop: i64 = 0
          while stop == 0 {
              if q >= e { stop = 1 }
              if stop == 0 { if src[q] == (32 as u8) { stop = 1 } else {
                  if gl < SWEEP_TOK_CAP - 1 { gbuf[gl] = src[q]; gl = gl + 1 }
                  q = q + 1
              } }
          }
          gbuf[gl] = 0 as u8
          var sk2: i64 = 1
          while sk2 == 1 {
              if q >= e { sk2 = 0 }
              if sk2 == 1 { if src[q] == (32 as u8) { q = q + 1 } else { sk2 = 0 } }
          }
          var sl: i64 = 0
          while q < e {
              if src[q] != (13 as u8) { if sl < SWEEP_TOK_CAP - 1 { sbuf[sl] = src[q]; sl = sl + 1 } }
              q = q + 1
          }
          sbuf[sl] = 0 as u8
          if gl > 0 { if sl > 0 { one(c, rb, rl, gbuf, sbuf); rows = rows + 1 } }
      }
      i = e + 1
  }
  return rows
129}
130
131func bcat(buf: *u8, at: i64, s: *u8) -> i64 {
  var i: i64 = 0
  while s[i] != (0 as u8) { buf[at + i] = s[i]; i = i + 1 }
  return at + i
135}
136func bcatb(buf: *u8, at: i64, s: *u8, n: i64) -> i64 {
  var i: i64 = 0
  while i < n { buf[at + i] = s[i]; i = i + 1 }
  return at + n
140}
141func bcatn(buf: *u8, at: i64, v: i64) -> i64 {
  var m: i64 = v
  let t: *u8 = sys_mmap(32)
  var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var j: i64 = 0
  while j < k { buf[at + j] = t[k - 1 - j]; j = j + 1 }
  return at + k
150}
151
152func extract_ref(b: *u8, n: i64, out: *u8, cap: i64) -> i64 {
  var at: i64 = 0 - 1
  if at < 0 { at = evo_find(b, n, "RFC " as *u8) }
  if at < 0 { at = evo_find(b, n, "RFC7" as *u8) }
  if at < 0 { at = evo_find(b, n, "FIPS" as *u8) }
  if at < 0 { at = evo_find(b, n, "NIST" as *u8) }
  if at < 0 { at = evo_find(b, n, "IEEE" as *u8) }
  if at < 0 { at = evo_find(b, n, "ISO/IEC" as *u8) }
  if at < 0 { at = evo_find(b, n, "BIP-39" as *u8) }
  if at < 0 { at = evo_find(b, n, "BIP39" as *u8) }
  if at < 0 { at = evo_find(b, n, "Unicode" as *u8) }
  if at < 0 { at = evo_find(b, n, "canonical reference" as *u8) }
  if at < 0 { at = evo_find(b, n, "reference vector" as *u8) }
  if at < 0 { at = evo_find(b, n, "OpenSSL" as *u8) }
  if at < 0 { return 0 }
  var k: i64 = 0
  var p: i64 = at
  while p < n {
      if k >= cap - 1 { p = n }
      else {
          let c: i64 = b[p] as i64
          var keep: i64 = 0
          if c >= 48 { if c <= 57 { keep = 1 } }
          if c >= 65 { if c <= 90 { keep = 1 } }
          if c >= 97 { if c <= 122 { keep = 1 } }
          if c == 46 { keep = 1 }
          if c == 45 { keep = 1 }
          if c == 32 { if k > 0 { if k < 9 { keep = 1 } } }
          if keep == 0 { p = n }
          else { out[k] = b[p] as u8; k = k + 1; p = p + 1 }
      }
  }
  var done: i64 = 0
  while done == 0 {
      if k <= 0 { done = 1 }
      else { if out[k - 1] == (32 as u8) { k = k - 1 } else { done = 1 } }
  }
  out[k] = 0 as u8
  return k
191}
192
193func run_gate(elf: *u8) -> i64 {
  let pid: i64 = sys_fork()
  if pid == 0 {
      let av: *i64 = sys_mmap(64) as *i64
      av[0] = elf as i64
      av[1] = 0
      let ev: *i64 = sys_mmap(16) as *i64
      ev[0] = 0
      sys_execve(elf, av, ev)
      sys_exit(127)
      return 127
  }
  if pid < 0 { return 0 - 1 }
  let st: *i64 = sys_mmap(16) as *i64
  st[0] = 0
  sys_wait4(pid, st, 0)
  let raw: i64 = st[0]
  if (raw & 127) != 0 { return 0 - 2 }
  return (raw / 256) & 255
212}
213
214func one(c: *i64, rb: *u8, rl: *i64, name: *u8, scope: *u8) -> i64 {
  // ⚠SUBJECTS LIVE IN TWO DIRECTORIES. This resolver knew only _hdl_build/, so every oracle
  // subject authored in runtime/ was reported "unreadable subject" -- indistinguishable from a
  // subject that does not exist. Same class as the compiler's one-way import resolver fixed
  // earlier today: ★A RESOLVER THAT KNOWS ONE DIRECTORY MISSES EVERY SUBJECT IN THE OTHER, and
  // reports it as absence. _hdl_build/ is tried FIRST (unchanged behaviour for every existing
  // subject); runtime/ is a pure ADDITION, so nothing that resolved yesterday resolves differently.
  let src: *u8 = sys_mmap(256)
  var so: i64 = bcat(src, 0, "buildroot/runtime/_hdl_build/" as *u8)
  so = bcat(src, so, name)
  so = bcat(src, so, ".nx" as *u8)
  src[so] = 0 as u8
226
  let elf: *u8 = sys_mmap(256)
  var eo: i64 = bcat(elf, 0, "buildroot/_build/" as *u8)
  eo = bcat(elf, eo, name)
  eo = bcat(elf, eo, ".sov.elf" as *u8)
  elf[eo] = 0 as u8
232
  let lp: *i64 = sys_mmap(16) as *i64
  lp[0] = 0
  var b: *u8 = sys_read_file(src, lp)
  if lp[0] <= 0 {
      let src2: *u8 = sys_mmap(256)
      var s2: i64 = bcat(src2, 0, "buildroot/runtime/" as *u8)
      s2 = bcat(src2, s2, name)
      s2 = bcat(src2, s2, ".nx" as *u8)
      src2[s2] = 0 as u8
      lp[0] = 0
      b = sys_read_file(src2, lp)
  }
  if lp[0] <= 0 { c[1] = c[1] + 1; w("  REFUSED   " as *u8); w(name); w("  (unreadable subject in BOTH _hdl_build/ and runtime/)\n" as *u8); return 0 }
246
  let party: i64 = evo_classify(b, lp[0])
  if party != EVO_P_THIRD {
      c[1] = c[1] + 1
      w("  REFUSED   " as *u8); w(name)
      if party == EVO_P_FIRST { w("  party=FIRST (its answers are ours)\n" as *u8) }
      else { w("  party=UNRESOLVED (no external authority named)\n" as *u8) }
      return 0
  }
255
  let refbuf: *u8 = sys_mmap(64) as *u8
  let rn: i64 = extract_ref(b, lp[0], refbuf, 40)
  if rn <= 0 { c[1] = c[1] + 1; w("  REFUSED   " as *u8); w(name); w("  (no quotable ref)\n" as *u8); return 0 }
259
  let ctx: *u8 = sys_mmap(K_MAGIC_1024) as *u8
  let dig: *u8 = sys_mmap(64) as *u8
  nx_sha256_one_shot(b, lp[0], ctx, dig)
  let hx: *u8 = sys_mmap(64) as *u8
  var i: i64 = 0
  while i < 8 {
      hx[i * 2] = hexnib(((dig[i] as i64) / 16) & 15) as u8
      hx[i * 2 + 1] = hexnib((dig[i] as i64) & 15) as u8
      i = i + 1
  }
270
  let ep: *i64 = sys_mmap(16) as *i64
  ep[0] = 0
  let probe: *u8 = sys_read_file(elf, ep)
  if ep[0] <= 0 {
      c[2] = c[2] + 1
      w("  NO-ELF    " as *u8); w(name); w("  party=THIRD ref=" as *u8); wb(refbuf, rn)
      w("  (build it; UNTESTED, not evidence)\n" as *u8)
      return 0
  }
280
  let rc: i64 = run_gate(elf)
  if rc != 0 {
      c[3] = c[3] + 1
      w("  NOT-GREEN " as *u8); w(name); w("  rc=" as *u8); nn(rc); w("\n" as *u8)
      return 0
  }
287
  let ts: *i64 = sys_mmap(32) as *i64
  ts[0] = 0
  sys_clock_gettime_real(ts)
291
  var o: i64 = rl[0]
  o = bcat(rb, o, "class=oracle verdict=pass scope=" as *u8)
  o = bcat(rb, o, scope)
  o = bcat(rb, o, " ref=" as *u8)
  o = bcatb(rb, o, refbuf, rn)
  o = bcat(rb, o, " refdig=" as *u8)
  o = bcatb(rb, o, hx, 16)
  o = bcat(rb, o, " gate=" as *u8)
  o = bcat(rb, o, name)
  o = bcat(rb, o, " host=west_nas signer=nx_evoracle_sweep epoch=" as *u8)
  o = bcatn(rb, o, ts[0])
  o = bcat(rb, o, "\n" as *u8)
  rl[0] = o
305
  c[0] = c[0] + 1
  w("  DERIVED   " as *u8); w(name); w("  ref=" as *u8); wb(refbuf, rn)
  w(" refdig=" as *u8); wb(hx, 16); w("\n" as *u8)
  return 0
310}
311
312func main() -> i64 {
  let c: *i64 = sys_mmap(64) as *i64
  c[0] = 0
  c[1] = 0
  c[2] = 0
  c[3] = 0
  let rb: *u8 = sys_mmap(K_MAGIC_65536)
  let rl: *i64 = sys_mmap(16) as *i64
  rl[0] = 0
321
  w("nx_evoracle_sweep -- derive oracle rows, ON THE HOST THAT SERVES THE CLAIMS\n\n" as *u8)
  rl[0] = bcat(rb, rl[0], "# knowledge/status/evclass_sovereign.conf -- DERIVED by nx_evoracle_sweep on west_nas.\n" as *u8)
  rl[0] = bcat(rb, rl[0], "# Each row: subject classified THIRD-party (external authority), authority QUOTED from the\n" as *u8)
  rl[0] = bcat(rb, rl[0], "# source, sha256 of the exact bytes, THEN the gate forked and required to exit 0.\n" as *u8)
  rl[0] = bcat(rb, rl[0], "# UNSIGNED ON PURPOSE: at_verify_row refuses these until an operator-held key is registered.\n" as *u8)
327
  one(c, rb, rl, "nx_sha256_native_kat_gate\x00" as *u8, "sha256-native\x00" as *u8)
  one(c, rb, rl, "nx_md5_kat\x00" as *u8, "md5\x00" as *u8)
  one(c, rb, rl, "nx_xxhash_kat\x00" as *u8, "xxhash64\x00" as *u8)
  one(c, rb, rl, "nx_bip39_kat\x00" as *u8, "bip39-mnemonic\x00" as *u8)
  one(c, rb, rl, "nx_bip39_wordlist_kat\x00" as *u8, "bip39-wordlist\x00" as *u8)
  one(c, rb, rl, "nx_x509_pubkey_ed_kat\x00" as *u8, "x509-ed25519-pubkey\x00" as *u8)
  one(c, rb, rl, "nx_voprf_rfc_kat\x00" as *u8, "voprf\x00" as *u8)
  one(c, rb, rl, "nx_opaque_rfc_kat\x00" as *u8, "opaque\x00" as *u8)
  one(c, rb, rl, "nx_x25519_kat_gate\x00" as *u8, "x25519\x00" as *u8)
  one(c, rb, rl, "nx_lex_kat\x00" as *u8, "lex\x00" as *u8)
  one(c, rb, rl, "nx_x86_kat_gate\x00" as *u8, "x86-emit\x00" as *u8)
339
  // ---- DATA-DRIVEN EXTENSION (2026-08-01) ------------------------------------------------
  // The roster above is HARDCODED, which is exactly the design cause the SOTA rung plan names
  // for stalled coverage: WHEN EXTENDING COVERAGE COSTS CODE, COVERAGE STOPS AT THE LAST
  // URGENT THING. Adding an oracle subject required editing and rebuilding this organ, so the
  // third-party population could only grow when someone was already in this file.
  // Now it also costs DATA: one line per subject in the conf below, no rebuild.
  // ADDITIVE BY CONSTRUCTION -- the hardcoded seed above is untouched, so this can add
  // subjects and can never remove one. Format per line: <gate-name><space><subject>
  // A missing/empty conf is a NO-OP, not an error (absence of extensions is not a failure).
  sweep_conf_rows(c, rb, rl, "knowledge/status/evoracle_subjects.conf\x00" as *u8)
350
  let outp: *u8 = "knowledge/status/evclass_sovereign.conf\x00" as *u8
  let fd: i64 = sys_openat_wr(outp, 0x1a4)
  var wrote: i64 = 0
  if fd >= 0 {
      var off: i64 = 0
      while off < rl[0] {
          let k: i64 = sys_write(fd, ((rb as i64) + off) as *u8, rl[0] - off)
          if k <= 0 { off = rl[0] } else { off = off + k; wrote = off }
      }
      sys_close(fd)
  }
362
  w("\n-- SWEEP RESULT (each outcome named separately; none collapsed) --\n" as *u8)
  w("  DERIVED   (third-party + green run) : " as *u8); nn(c[0]); w("\n" as *u8)
  w("  REFUSED   (not third-party)         : " as *u8); nn(c[1]); w("\n" as *u8)
  w("  NO-ELF    (untested, NOT evidence)  : " as *u8); nn(c[2]); w("\n" as *u8)
  w("  NOT-GREEN (ran, failed)             : " as *u8); nn(c[3]); w("\n" as *u8)
  w("  evclass_sovereign.conf bytes        : " as *u8); nn(wrote); w("\n" as *u8)
  return 0
370}
nx_evoracle_sweep.nx source

`nx_evoracle_sweep.nx` source
