code wiki / _hdl_build / nx_gate_baseline_sweep.nx
`nx_gate_baseline_sweep.nx` source

↩ module page · 364 lines · 17000 B
1// nx_gate_baseline_sweep.nx -- MASS-WRAP orchestrator: roll nx_gate_baseline_harness across the whole
2// gate universe in bounded, resumable batches (the rollout engine for the 87%-no-baseline blind spot,
3// [[project-nishi-sensor-gap-census-2026-07-14]]).
4//
5//   usage: nx_gate_baseline_sweep <budget>     budget = max gates to wrap this run; 0 = DRY RUN (list only)
6//
7// Walks runtime/_hdl_build/*.nx and classifies each file:
8//   NON-GATE     -- no verdict marker (libs/specs) -> never wrapped (running a lib = rc-102 noise)
9//   INFRA        -- the builder / the harness / this sweep itself -> skipped by name
10//   RISKY        -- name has daemon|serve|bench|monitor|watch OR source touches sockets/https:
11//                   blind-running those can HANG (listeners), hit the network, or run for minutes.
12//                   SKIPPED BY POLICY and PRINTED (no silent caps) -- they need supervised wrapping.
13//   DONE         -- ledger knowledge/status/gatebase_<gate>.tsv already exists (resume for free)
14//   WRAP         -- safe + unwrapped: fork _offc/nx_gate_baseline_harness.elf <gate> (which itself forks
15//                   the sovereign lane, captures rc+telemetry, banks the baseline). Harness rc!=0 =>
16//                   REFUSED (a broken gate can't become a baseline) -> reported: the sweep doubles as a
17//                   live BROKEN-GATES census.
18// Never-brick: the sweep itself writes NOTHING (all writes happen inside the harness: /tmp captures +
19// new gatebase_*.tsv ledgers, atomic). Deterministic classification; bounded loops; budget-bounded forks.
20// Sovereign nx_cc->nxasm; run with CWD=nxc2 root. license_tier: ORIGINAL
21import "syscalls.nx"
22import "runtime.nx"
23import "nx_dirent.nx"
24import "nx_fcntl.nx"
25import "nx_handoff_gate.nx"
26const K_MAGIC_16384: i64 = 16384
27const K_MAGIC_1024: i64 = 1024
28const K_MAGIC_1048576: i64 = 1048576
29
30// ---- helpers (census-proven idioms) ----------------------------------
31func slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
32
33func lc(c: i64) -> i64 { if c >= 65 { if c <= 90 { return c + 32 } } return c }
34
35func is_alnum(c: i64) -> i64 {
  if c >= 48 { if c <= 57 { return 1 } }
  if c >= 97 { if c <= 122 { return 1 } }
  if c >= 65 { if c <= 90 { return 1 } }
  if c == 95 { return 1 }
  return 0
41}
42
43func streqz(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
  if b[i] != (0 as u8) { return 0 }
  return 1
48}
49
50func byte_copy(dst: *u8, src: *u8, n: i64) -> i64 {
  var i: i64 = 0
  while i < n { dst[i] = src[i]; i = i + 1 }
  return 0
54}
55
56// case-insensitive substring; ndl lowercase; word==1 -> non-alnum boundaries (the census liar-killed matcher)
57func find_ci(buf: *u8, lo: i64, hi: i64, ndl: *u8, word: i64) -> i64 {
  let nl: i64 = slen(ndl)
  if nl == 0 { return 1 }
  var i: i64 = lo
  while i + nl <= hi {
      var j: i64 = 0
      var ok: i64 = 1
      while j < nl {
          if lc(buf[i+j] as i64) != (ndl[j] as i64) { ok = 0; j = nl } else { j = j + 1 }
      }
      if ok == 1 {
          if word == 0 { return 1 }
          var lb: i64 = 1
          var rb: i64 = 1
          if i > lo { if is_alnum(buf[i-1] as i64) == 1 { lb = 0 } }
          let r: i64 = i + nl
          if r < hi { if is_alnum(buf[r] as i64) == 1 { rb = 0 } }
          if lb == 1 { if rb == 1 { return 1 } }
      }
      i = i + 1
  }
  return 0
79}
80
81// verdict-emitter check (same markers as nx_sensor_gap_census -> the two organs agree on the universe)
82func is_gate(buf: *u8, len: i64) -> i64 {
  if find_ci(buf, 0, len, "verdict" as *u8, 0) == 1 { return 1 }
  if find_ci(buf, 0, len, "expect_exit" as *u8, 0) == 1 { return 1 }
  if find_ci(buf, 0, len, "[pass]" as *u8, 0) == 1 { return 1 }
  if find_ci(buf, 0, len, "[fail]" as *u8, 0) == 1 { return 1 }
  if find_ci(buf, 0, len, "green" as *u8, 1) == 1 { return 1 }
  if find_ci(buf, 0, len, "red" as *u8, 1) == 1 { return 1 }
  return 0
90}
91
92// blind-run risk policy: listeners hang, network gates fetch, benches run long -> supervised wrapping only
93func is_risky(name: *u8, nlen: i64, buf: *u8, len: i64) -> i64 {
  if find_ci(name, 0, nlen, "daemon" as *u8, 0) == 1 { return 1 }
  if find_ci(name, 0, nlen, "serve" as *u8, 0) == 1 { return 1 }
  if find_ci(name, 0, nlen, "bench" as *u8, 0) == 1 { return 1 }
  if find_ci(name, 0, nlen, "monitor" as *u8, 0) == 1 { return 1 }
  if find_ci(name, 0, nlen, "watch" as *u8, 0) == 1 { return 1 }
  if find_ci(buf, 0, len, "sys_listen" as *u8, 0) == 1 { return 1 }
  if find_ci(buf, 0, len, "sys_bind" as *u8, 0) == 1 { return 1 }
  if find_ci(buf, 0, len, "sys_accept" as *u8, 0) == 1 { return 1 }
  if find_ci(buf, 0, len, "sys_connect" as *u8, 0) == 1 { return 1 }
  if find_ci(buf, 0, len, "https" as *u8, 0) == 1 { return 1 }
  if find_ci(buf, 0, len, "sys_sendto" as *u8, 0) == 1 { return 1 }
  if find_ci(buf, 0, len, "nxsecret" as *u8, 0) == 1 { return 1 }
  return 0
107}
108
109// author-declared build-only artifact (e.g. DLL-export sources whose main is a linker stub never meant
110// to run -- proven: nishi_export_lib SIGSEGVs if executed). Evidence = the author's own "--build-only"
111// marker in the source; running such a file tells us nothing and can crash.
112func is_build_only(buf: *u8, len: i64) -> i64 {
  return find_ci(buf, 0, len, "--build-only" as *u8, 0)
114}
115
116func ends_nx(name: *u8, len: i64) -> i64 {
  if len < 3 { return 0 }
  if name[len-3] != (0x2E as u8) { return 0 }
  if name[len-2] != (0x6E as u8) { return 0 }
  if name[len-1] != (0x78 as u8) { return 0 }
  return 1
122}
123
124// bounded whole-file read into reused buf; -1 if unopenable
125func read_src(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var total: i64 = 0
  var go: i64 = 1
  while go == 1 {
      go = 0
      let tail: *u8 = ((buf as i64) + total) as *u8
      let n: i64 = sys_read(fd, tail, cap - total)
      if n > 0 { total = total + n; if total < cap { go = 1 } }
  }
  sys_close(fd)
  return total
138}
139
140// fork+wait the harness on one gate; returns WEXITSTATUS or 128+sig (signal-aware, proven idiom)
141func run_harness(gname: *u8, envp: *i64) -> i64 {
  let hpath: *u8 = "_offc/nx_gate_baseline_harness.elf" as *u8
  let av: *i64 = sys_mmap(8 * 4) as *i64
  av[0] = hpath as i64
  av[1] = gname as i64
  av[2] = 0
  let pid: i64 = sys_fork()
  if pid == 0 {
      sys_execve(hpath, av, envp)
      sys_exit(127)
  }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, st, 0)
  let sig: i64 = st[0] & 0x7f
  if sig != 0 { return 128 + sig }
  return (st[0] >> 8) & 0xff
157}
158
159func main(argc: i64, argv: *i64) -> i64 {
  var budget: i64 = 8
  if argc >= 2 {
      let a1: *u8 = argv[1] as *u8
      let bl: i64 = slen(a1)
      let bv: *i64 = sys_mmap(8 * 2) as *i64
      let bn: i64 = hg_parse_ints(a1, bl, bv, 1)
      if bn >= 1 { budget = bv[0] }
  }
  print("=== nx_gate_baseline_sweep: budget=" as *u8)
  print_i64(budget)
  if budget == 0 { print(" (DRY RUN)" as *u8) }
  print(" ===\n" as *u8)
172
  let envp: *i64 = sys_mmap(8 * 4) as *i64
  envp[0] = ("PATH=/usr/bin:/bin" as *u8) as i64
  envp[1] = 0
176
  let dirp: *u8 = "runtime/_hdl_build" as *u8
  let dlen: i64 = slen(dirp)
  let dfd: i64 = nx_openat(NX_AT_FDCWD, dirp, NX_O_RDONLY | NX_O_DIRECTORY, 0)
  if dfd < 0 {
      print("  [RED] cannot open runtime/_hdl_build (run from nxc2 root)\n" as *u8)
      sys_exit(1)
      return 1
  }
  let dbuf: *u8 = sys_mmap(K_MAGIC_16384)
  let dr_raw: *u8 = sys_mmap(NX_DIRENT_BYTES)
  let dr: *NxDirent = dr_raw as *NxDirent
  let path: *u8 = sys_mmap(K_MAGIC_1024)
  let gname: *u8 = sys_mmap(256)
  let ledger: *u8 = sys_mmap(K_MAGIC_1024)
  let fbuf: *u8 = sys_mmap(K_MAGIC_1048576 + 16)
192
  var n_nongate: i64 = 0
  var n_infra: i64 = 0
  var n_risky: i64 = 0
  var n_done: i64 = 0
  var n_att: i64 = 0
  var n_wrapped: i64 = 0
  var n_refused: i64 = 0
  var n_known: i64 = 0
  var n_bonly: i64 = 0
  var n_remaining: i64 = 0
  var shown_risky: i64 = 0
  var shown_known: i64 = 0
  var shown_bonly: i64 = 0
  var shown_would: i64 = 0
207
  var batch: i64 = nx_dirent_read(dfd, dbuf, K_MAGIC_16384)
  while batch > 0 {
      var off: i64 = 0
      while off < batch {
          let next_off: i64 = nx_dirent_iter(dbuf, off, batch, dr)
          if next_off <= 0 { off = batch + 1 }
          if off <= batch {
              let nmlen: i64 = nx_dirent_name_len(dr)
              if ends_nx(dr.name, nmlen) == 1 {
                  // full path + bare gate name (strip .nx)
                  byte_copy(path, dirp, dlen)
                  path[dlen] = 47 as u8
                  byte_copy(((path as i64) + dlen + 1) as *u8, dr.name, nmlen)
                  path[dlen + 1 + nmlen] = 0 as u8
                  byte_copy(gname, dr.name, nmlen - 3)
                  gname[nmlen - 3] = 0 as u8
224
                  var infra: i64 = 0
                  if streqz(gname, "nx_gate_baseline_sweep" as *u8) == 1 { infra = 1 }
                  if streqz(gname, "nx_gate_baseline_harness" as *u8) == 1 { infra = 1 }
                  if streqz(gname, "nx_sov_build_run" as *u8) == 1 { infra = 1 }
229
                  let flen: i64 = read_src(path, fbuf, K_MAGIC_1048576)
                  if flen >= 0 {
                      var bonly: i64 = 0
                      if infra == 0 { bonly = is_build_only(fbuf, flen) }
                      if bonly == 1 {
                          n_bonly = n_bonly + 1
                          if shown_bonly < 6 {
                              print("  [build-only-skip] " as *u8)
                              print(gname)
                              print("\n" as *u8)
                              shown_bonly = shown_bonly + 1
                          }
                      }
                      if infra == 1 { n_infra = n_infra + 1 }
                      var live: i64 = 0
                      if infra == 0 { if bonly == 0 { live = 1 } }
                      if live == 1 {
                          if is_gate(fbuf, flen) == 0 { n_nongate = n_nongate + 1 }
                          if is_gate(fbuf, flen) == 1 {
                              if is_risky(dr.name, nmlen, fbuf, flen) == 1 {
                                  n_risky = n_risky + 1
                                  if shown_risky < 10 {
                                      print("  [risky-skip] " as *u8)
                                      print(gname)
                                      print("\n" as *u8)
                                      shown_risky = shown_risky + 1
                                  }
                              }
                              if is_risky(dr.name, nmlen, fbuf, flen) == 0 {
                                  // ledger present? (resume)
                                  var lo: i64 = 0
                                  lo = 0
                                  let pre: *u8 = "knowledge/status/gatebase_" as *u8
                                  var pi: i64 = 0
                                  while pre[pi] != (0 as u8) { ledger[lo] = pre[pi]; lo = lo + 1; pi = pi + 1 }
                                  var gi: i64 = 0
                                  while gname[gi] != (0 as u8) { ledger[lo] = gname[gi]; lo = lo + 1; gi = gi + 1 }
                                  let suf: *u8 = ".tsv" as *u8
                                  var si: i64 = 0
                                  while suf[si] != (0 as u8) { ledger[lo] = suf[si]; lo = lo + 1; si = si + 1 }
                                  ledger[lo] = 0 as u8
                                  let has_l: i64 = hg_evidence_file(ledger)
                                  // known-broken marker (harness-banked on refusal): skip, count, stay visible.
                                  // a later successful capture writes the .tsv which supersedes the marker.
                                  var known: i64 = 0
                                  if has_l == 0 {
                                      let msuf: *u8 = ".refused" as *u8
                                      var mi: i64 = 0
                                      while msuf[mi] != (0 as u8) { ledger[lo] = msuf[mi]; lo = lo + 1; mi = mi + 1 }
                                      ledger[lo] = 0 as u8
                                      if hg_evidence_file(ledger) == 1 { known = 1 }
                                  }
                                  if has_l == 1 { n_done = n_done + 1 }
                                  if known == 1 {
                                      n_known = n_known + 1
                                      if shown_known < 10 {
                                          print("  [known-broken-skip] " as *u8)
                                          print(gname)
                                          print("\n" as *u8)
                                          shown_known = shown_known + 1
                                      }
                                  }
                                  if has_l == 0 { if known == 0 {
                                      if n_att < budget {
                                          // budget bounds ATTEMPTS (gate executions) = bounded wall-clock per run
                                          n_att = n_att + 1
                                          print("  [attempt " as *u8)
                                          print_i64(n_att)
                                          print("/" as *u8)
                                          print_i64(budget)
                                          print("] " as *u8)
                                          print(gname)
                                          print(" -> " as *u8)
                                          let hrc: i64 = run_harness(gname, envp)
                                          print("harness rc=" as *u8)
                                          print_i64(hrc)
                                          print("\n" as *u8)
                                          if hrc == 0 { n_wrapped = n_wrapped + 1 }
                                          if hrc != 0 {
                                              n_refused = n_refused + 1
                                              print("    [REFUSED/BROKEN-GATE] " as *u8)
                                              print(gname)
                                              print(" (gate rc!=0 -> not banked; fix or supervise)\n" as *u8)
                                          }
                                      } else {
                                          n_remaining = n_remaining + 1
                                          if budget == 0 {
                                              if shown_would < 16 {
                                                  print("  [would-wrap] " as *u8)
                                                  print(gname)
                                                  print("\n" as *u8)
                                                  shown_would = shown_would + 1
                                              }
                                          }
                                      }
                                  }
                                  }
                              }
                          }
                      }
                  }
              }
              off = next_off
          }
      }
      batch = nx_dirent_read(dfd, dbuf, K_MAGIC_16384)
  }
  sys_close(dfd)
338
  print("---- sweep tally ----\n" as *u8)
  print("  non-gate files       = " as *u8)
  print_i64(n_nongate)
  print("\n  infra (self/builder) = " as *u8)
  print_i64(n_infra)
  print("\n  RISKY skipped        = " as *u8)
  print_i64(n_risky)
  print("  (listeners/network/bench -> supervised wrapping only)\n" as *u8)
  print("  build-only artifacts = " as *u8)
  print_i64(n_bonly)
  print("  (author-declared; running tells nothing, can crash)\n" as *u8)
  print("  already DONE         = " as *u8)
  print_i64(n_done)
  print("\n  wrapped this run     = " as *u8)
  print_i64(n_wrapped)
  print("\n  REFUSED this run     = " as *u8)
  print_i64(n_refused)
  print("\n  known-broken (marked)= " as *u8)
  print_i64(n_known)
  print("  (see gatebase_*.tsv.refused for class; re-test = run harness directly)\n" as *u8)
  print("  remaining unwrapped  = " as *u8)
  print_i64(n_remaining)
  print("\n=== verdict: GREEN (sweep mechanics; refusals above are FINDINGS, not sweep failures) ===\n" as *u8)
  sys_exit(0)
  return 0
364}
nx_gate_baseline_sweep.nx source

`nx_gate_baseline_sweep.nx` source
