code wiki / _hdl_build / nx_gate_baseline_harness.nx
`nx_gate_baseline_harness.nx` source

↩ module page · 344 lines · 13378 B
1// nx_gate_baseline_harness.nx -- retrofit a REGRESSION BASELINE onto ANY gate with ZERO gate-source edits.
2//
3// The sensor-gap risk map ([[project-nishi-sensor-gap-census-2026-07-14]]) measured 87% of ~3675 gates with
4// NO regression baseline = they can silently backslide. Hand-editing thousands of gates would be a patch
5// cascade (rule 3) -- so this harness wraps the RUNNER instead: it forks the sovereign build lane on a gate,
6// captures the gate's output + exit code, and banks/guards a per-gate baseline ledger. Wrapping a gate =
7// running one command; the gate's source is never touched.
8//
9//   usage: nx_gate_baseline_harness <gate-name> [--rebase]
10//     first run  -> CAPTURE: bank {rc, int-vector of output} to knowledge/status/gatebase_<gate>.tsv
11//     later runs -> GUARD:   rc must MATCH the banked rc (universal invariant, judged);
12//                            numeric drift is SURFACED per position (informational, NOT judged --
13//                            auto-judging unknown numbers directionally would make a LYING sensor;
14//                            per-gate directional specs are the v2 data-row hook).
15//     --rebase   -> re-bank current state as the new baseline (explicit operator action; refused on rc!=0).
16//
17// LIAR-KILLERS on the harness itself:
18//   * signal-aware exit decode (128+sig, the proven sbr_run idiom) -- a SEGFAULTED gate can never read as GREEN.
19//   * a red run is REFUSED as a baseline -- a broken state can never become "the standard".
20//   * an absent/unreadable output = RED (evidence-grounding: no evidence, no verdict).
21//   * ledger writes are atomic (tmp + renameat); only /tmp/gatebase_*.out + knowledge/status/gatebase_*.tsv
22//     are ever written -- no gate source is touched (never-brick by construction).
23// Sovereign nx_cc->nxasm; forks _offc/nx_sov_build_run.elf (no gcc, no sh). Run with CWD=nxc2 root.
24// license_tier: ORIGINAL
25import "syscalls.nx"
26import "runtime.nx"
27import "nx_handoff_gate.nx"
28const GBH_MAGIC_4096: i64 = 4096
29const GBH_MAGIC_1048576: i64 = 1048576
30
31const GBH_MAX_VALS: i64 = 64
32
33// append NUL-terminated s into dst at off; return new offset (no NUL written) -- the sbr_cat idiom
34func gbh_cat(dst: *u8, off: i64, s: *u8) -> i64 {
  var i: i64 = 0
  while s[i] != (0 as u8) { dst[off+i] = s[i]; i = i + 1 }
  return off + i
38}
39
40// fork + redirect + execve + wait4; returns WEXITSTATUS or 128+signal (signal-aware: a crashed
41// child must NEVER decode as rc=0 -- the proven nx_sov_build_run liar-kill).
42func gbh_run(path: *u8, argv: *i64, envp: *i64, redir_out: i64, redir_err: i64) -> i64 {
  let pid: i64 = sys_fork()
  if pid == 0 {
      if redir_out >= 0 { sys_dup3(redir_out, 1, 0) }
      if redir_err >= 0 { sys_dup3(redir_err, 2, 0) }
      sys_execve(path, argv, envp)
      sys_exit(127)
  }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, st, 0)
  let sig: i64 = st[0] & 0x7f
  if sig != 0 { return 128 + sig }
  return (st[0] >> 8) & 0xff
55}
56
57// case-sensitive contains (lane failure markers are exact strings)
58func gbh_has(buf: *u8, len: i64, lit: *u8) -> i64 {
  var nl: i64 = 0
  while lit[nl] != (0 as u8) { nl = nl + 1 }
  if nl == 0 { return 1 }
  var i: i64 = 0
  while i + nl <= len {
      var j: i64 = 0
      var ok: i64 = 1
      while j < nl {
          if buf[i+j] != lit[j] { ok = 0; j = nl } else { j = j + 1 }
      }
      if ok == 1 { return 1 }
      i = i + 1
  }
  return 0
73}
74
75// bounded whole-file read; bytes read, or -1 if unopenable (absent evidence is reported, never invented)
76func gbh_read(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var total: i64 = 0
  var go: i64 = 1
  while go == 1 {
      go = 0
      let tail: *u8 = ((buf as i64) + total) as *u8
      let n: i64 = sys_read(fd, tail, cap - total)
      if n > 0 { total = total + n; if total < cap { go = 1 } }
  }
  sys_close(fd)
  return total
89}
90
91// render non-negative n into dst at off; return new offset (declared BEFORE gbh_bank per the
92// forward-static-ref gotcha: declare before use)
93func gbh_num(dst: *u8, off: i64, n: i64) -> i64 {
  var m: i64 = n
  if m < 0 { m = 0 }
  let t: *u8 = sys_mmap(28)
  var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0
  while i < k { dst[off+i] = t[k-1-i]; i = i + 1 }
  return off + k
103}
104
105// atomically write the ledger line: rc \t count \t v0..v(k-1)
106func gbh_bank(ledger: *u8, ltmp: *u8, rc: i64, count: i64, vals: *i64, k: i64) -> i64 {
  let fd: i64 = sys_openat_wr(ltmp, 0x1a4)
  if fd < 0 { return 0 - 1 }
  let line: *u8 = sys_mmap(GBH_MAGIC_4096)
  var o: i64 = 0
  o = gbh_num(line, o, rc)
  line[o] = 9 as u8
  o = o + 1
  o = gbh_num(line, o, count)
  var i: i64 = 0
  while i < k {
      line[o] = 9 as u8
      o = o + 1
      o = gbh_num(line, o, vals[i])
      i = i + 1
  }
  line[o] = 10 as u8
  o = o + 1
  sys_write(fd, line, o)
  sys_close(fd)
  sys_renameat(ltmp, ledger)
  return 0
128}
129
130func main(argc: i64, argv: *i64) -> i64 {
  if argc < 2 {
      print("usage: nx_gate_baseline_harness <gate-name> [--rebase]\n" as *u8)
      sys_exit(2)
      return 2
  }
  let name: *u8 = argv[1] as *u8
  var rebase: i64 = 0
  if argc >= 3 {
      let fl: *u8 = argv[2] as *u8
      if fl[0] == (45 as u8) { if fl[1] == (45 as u8) { if fl[2] == (114 as u8) { rebase = 1 } } }
  }
142
  print("=== nx_gate_baseline_harness: " as *u8)
  print(name)
  print(" ===\n" as *u8)
146
  // paths
  let outp: *u8 = sys_mmap(512)
  var o: i64 = 0
  o = gbh_cat(outp, o, "/tmp/gatebase_" as *u8)
  o = gbh_cat(outp, o, name)
  o = gbh_cat(outp, o, ".out" as *u8)
  outp[o] = 0 as u8
  let ledger: *u8 = sys_mmap(512)
  o = 0
  o = gbh_cat(ledger, o, "knowledge/status/gatebase_" as *u8)
  o = gbh_cat(ledger, o, name)
  o = gbh_cat(ledger, o, ".tsv" as *u8)
  ledger[o] = 0 as u8
  let ltmp: *u8 = sys_mmap(512)
  o = 0
  o = gbh_cat(ltmp, o, ledger)
  o = gbh_cat(ltmp, o, ".tmp" as *u8)
  ltmp[o] = 0 as u8
165
  // run the gate through the sovereign lane, both streams captured
  let envp: *i64 = sys_mmap(8 * 4) as *i64
  envp[0] = ("PATH=/usr/bin:/bin" as *u8) as i64
  envp[1] = 0
  let runner: *u8 = "_offc/nx_sov_build_run.elf" as *u8
  let ofd: i64 = sys_openat_wr(outp, 0x1a4)
  if ofd < 0 {
      print("  [RED] cannot open capture file\n" as *u8)
      sys_exit(1)
      return 1
  }
  let ra: *i64 = sys_mmap(8 * 4) as *i64
  ra[0] = runner as i64
  ra[1] = name as i64
  ra[2] = 0
  let rc: i64 = gbh_run(runner, ra, envp, ofd, ofd)
  sys_close(ofd)
183
  print("  run rc=" as *u8)
  print_i64(rc)
  if rc > 128 { print("  (SIGNAL-DEATH: crashed gate can never read GREEN)" as *u8) }
  print("\n" as *u8)
188
  // extract the numeric telemetry vector from the captured output
  let buf: *u8 = sys_mmap(GBH_MAGIC_1048576 + 16)
  let blen: i64 = gbh_read(outp, buf, GBH_MAGIC_1048576)
  if blen < 0 {
      print("  [RED] no captured output (evidence missing -> no verdict can be banked)\n" as *u8)
      sys_exit(1)
      return 1
  }
  let vals: *i64 = sys_mmap(8 * GBH_MAX_VALS) as *i64
  let count: i64 = hg_parse_ints(buf, blen, vals, GBH_MAX_VALS)
  var stored: i64 = count
  if stored > GBH_MAX_VALS { stored = GBH_MAX_VALS }
  print("  telemetry ints=" as *u8)
  print_i64(count)
  print(" (stored " as *u8)
  print_i64(stored)
  print(") bytes=" as *u8)
  print_i64(blen)
  print("\n" as *u8)
208
  // load / capture / guard the baseline
  let banked: *i64 = sys_mmap(8 * (GBH_MAX_VALS + 8)) as *i64
  let bn: i64 = hg_baseline_load(ledger, banked, GBH_MAX_VALS + 2)
212
  if bn < 0 {
      // CAPTURE MODE -- but NEVER bank a broken state as the standard (liar-kill)
      if rc != 0 {
          // EVIDENCE-GROUNDED refusal class (from the captured lane output, not guessed from rc --
          // rc=4 could be a no-main LIBRARY failing to assemble, NOT a broken gate; conflating them
          // would be a FALSE FINDING): BUILD-COMPILE-FAIL / BUILD-ASM-FAIL(lib?) / NOT-FOUND /
          // GATE-CRASH (ran, died to a signal) / GATE-RED (ran, failed honestly).
          var cls: i64 = ("GATE-RED" as *u8) as i64
          if rc > 128 { cls = ("GATE-CRASH" as *u8) as i64 }
          if gbh_has(buf, blen, "COMPILE-FAIL" as *u8) == 1 { cls = ("BUILD-COMPILE-FAIL" as *u8) as i64 }
          if gbh_has(buf, blen, "NXASM-FAIL" as *u8) == 1 { cls = ("BUILD-ASM-FAIL-LIB?" as *u8) as i64 }
          if gbh_has(buf, blen, "NXASM-CRASHED" as *u8) == 1 { cls = ("BUILD-ASM-CRASH" as *u8) as i64 }
          if gbh_has(buf, blen, "SOURCE-NOT-FOUND" as *u8) == 1 { cls = ("NOT-FOUND" as *u8) as i64 }
          // env-dependent gates (live creds/secrets absent) are QUARANTINED, not "broken" -- calling an
          // un-provisioned live gate broken would be a false finding (proven: nx_acme_dns01_propagation_gate)
          if gbh_has(buf, blen, "creds read FAIL" as *u8) == 1 { cls = ("ENV-MISSING-CREDS" as *u8) as i64 }
          if gbh_has(buf, blen, "nxsecret" as *u8) == 1 { cls = ("ENV-MISSING-CREDS" as *u8) as i64 }
          print("  [RED] first run rc!=0 class=" as *u8)
          print(cls as *u8)
          print(" -> REFUSING to capture a broken state as baseline\n" as *u8)
          // bank the refusal marker so sweeps skip known cases (a later successful capture writes the
          // real .tsv, which SUPERSEDES the marker -- no stale-lie path, no unlink needed)
          let mpath: *u8 = sys_mmap(512)
          var mo: i64 = 0
          mo = gbh_cat(mpath, mo, ledger)
          mo = gbh_cat(mpath, mo, ".refused" as *u8)
          mpath[mo] = 0 as u8
          let mtmp: *u8 = sys_mmap(512)
          mo = 0
          mo = gbh_cat(mtmp, mo, mpath)
          mo = gbh_cat(mtmp, mo, ".tmp" as *u8)
          mtmp[mo] = 0 as u8
          let mfd: i64 = sys_openat_wr(mtmp, 0x1a4)
          if mfd >= 0 {
              let ml: *u8 = sys_mmap(256)
              var o2: i64 = 0
              o2 = gbh_cat(ml, o2, cls as *u8)
              ml[o2] = 9 as u8
              o2 = o2 + 1
              o2 = gbh_cat(ml, o2, "rc" as *u8)
              ml[o2] = 9 as u8
              o2 = o2 + 1
              o2 = gbh_num(ml, o2, rc)
              ml[o2] = 10 as u8
              o2 = o2 + 1
              sys_write(mfd, ml, o2)
              sys_close(mfd)
              sys_renameat(mtmp, mpath)
              print("  refusal marker banked -> " as *u8)
              print(mpath)
              print("\n" as *u8)
          }
          sys_exit(1)
          return 1
      }
      gbh_bank(ledger, ltmp, rc, count, vals, stored)
      print("  BASELINE CAPTURED -> " as *u8)
      print(ledger)
      print("\n=== verdict: GREEN (rc=0; baseline banked; future runs are guarded) ===\n" as *u8)
      sys_exit(0)
      return 0
  }
275
  // GUARD MODE
  let brc: i64 = banked[0]
  let bcount: i64 = banked[1]
  var red: i64 = 0
  if rc != brc { red = 1 }
  print("  guard: rc=" as *u8)
  print_i64(rc)
  print(" vs banked rc=" as *u8)
  print_i64(brc)
  if rc == brc { print("  MATCH\n" as *u8) } else { print("  MISMATCH -> RED\n" as *u8) }
286
  // drift sensor (surfaced, not judged): which telemetry positions moved
  var bstored: i64 = bcount
  if bstored > GBH_MAX_VALS { bstored = GBH_MAX_VALS }
  var ncmp: i64 = stored
  if bstored < ncmp { ncmp = bstored }
  var ndiff: i64 = 0
  var shown: i64 = 0
  var i: i64 = 0
  while i < ncmp {
      if vals[i] != banked[2+i] {
          ndiff = ndiff + 1
          if shown < 5 {
              print("    drift[" as *u8)
              print_i64(i)
              print("] " as *u8)
              print_i64(banked[2+i])
              print(" -> " as *u8)
              print_i64(vals[i])
              print("\n" as *u8)
              shown = shown + 1
          }
      }
      i = i + 1
  }
  if count != bcount {
      print("    drift: telemetry count " as *u8)
      print_i64(bcount)
      print(" -> " as *u8)
      print_i64(count)
      print("\n" as *u8)
      ndiff = ndiff + 1
  }
  if ndiff == 0 { print("  telemetry STABLE (bit-identical int vector)\n" as *u8) }
  if ndiff > 0 {
      print("  telemetry DRIFT positions=" as *u8)
      print_i64(ndiff)
      print(" (informational; promote to a directional per-gate spec to judge)\n" as *u8)
  }
325
  // explicit rebase (refused on a red run -- never bank broken)
  if rebase == 1 {
      if rc == 0 {
          gbh_bank(ledger, ltmp, rc, count, vals, stored)
          print("  REBASED baseline from current run (operator-explicit)\n" as *u8)
      } else {
          print("  [refused] --rebase with rc!=0 (never bank a broken state)\n" as *u8)
      }
  }
335
  if red == 0 {
      print("=== verdict: GREEN (exit invariant held; drift surfaced above) ===\n" as *u8)
      sys_exit(0)
      return 0
  }
  print("=== verdict: RED (exit-code regression vs banked baseline) ===\n" as *u8)
  sys_exit(1)
  return 1
344}
nx_gate_baseline_harness.nx source

`nx_gate_baseline_harness.nx` source
