nx_gate_bite_gate.nx source

1// nx_gate_bite_gate.nx -- THE GATE FOR THE MUTATION HARNESS ITSELF (2026-08-25). 2// 3// SUBJECT: the nx_gate_bite ELF, forked for real against a fixture .nx written into a fresh run directory 4// (/tmp/nx_gate_bite_gate/r<usec>/), so this gate is idempotent by construction and nothing it measures was 5// inherited from an earlier run. Substitutable: argv[1] overrides the subject path -- which is exactly the 6// addressing nx_gate_bite's own `subject <target>` mode requires of the gates it bites, so this gate can be 7// bitten by the very capability it proves. 8// 9// WHY THESE TEETH. nx_gate_bite gained a `subject <subject_target>` argument on 2026-08-25 because without 10// it the harness ALWAYS rebuilt the GATE and never the SUBJECT. For the 152 end-to-end gates in the estate 11// that meant every mutant returned NOT-REACHED, and a bite of the gate's own source returned a clean 12// verdict=GREEN that reads exactly like a subject proof and is not one. MEASURED before the fix on 13// nx_communitypulse_gate: 10 mutants, 10 NOT-REACHED, valid_mutants=0. After: valid_mutants=1, killed=1. 14// So this gate holds the NEW grammar to its documented shape and holds the OLD grammar unchanged. 15// 16// EVERY INVOCATION HERE IS BUILD-FREE ON PURPOSE. `aimlist` mutates nothing and builds nothing, and both 17// refusals fire before the baseline build, so this gate runs in milliseconds and can sit on the roster: 18// A GATE THAT OUTLIVES EVERY CALLER'S TIMEOUT IS INDISTINGUISHABLE FROM A GATE THAT EMITS NOTHING. 19// The gate target passed below DELIBERATELY DOES NOT EXIST -- if any of these paths ever started building, 20// this gate would fail loudly here instead of silently costing the roster minutes. 21// 22// license_tier: ORIGINAL 23import "nx_syscalls.nx" 24import "nx_gate_verdict.nx" 25import "nx_gate_green.nx" 26import "nx_tool_run.nx" 27 28const GBG_SUBJECT_DEFAULT: *u8 = "_offc/nx_gate_bite.elf" 29const GBG_DIR: *u8 = "/tmp/nx_gate_bite_gate" 30const GBG_MODE_DIR: i64 = 493 // 0755 31const GBG_CAP: i64 = 262144 32const GBG_PATH_CAP: i64 = 512 33const GBG_ARGV_SLOTS: i64 = 16 34const GBG_WORD: i64 = 8 // sizeof(i64) 35const GBG_LP_BYTES: i64 = 16 // two i64 slots for the capture length out-param 36const GBG_NUM_BYTES: i64 = 32 37const GBG_ASCII_ZERO: i64 = 48 38const GBG_DECIMAL: i64 = 10 39const GBG_DEC_LAST: i64 = 9 40// Generous but BOUNDED: every run below is build-free and returns in milliseconds, so this cap only ever 41// fires if a path that must not build has started building. It is a tripwire, not a budget. 42const GBG_RUN_TIMEOUT_MS: i64 = 60000 43const GBG_EXIT_OK: i64 = 0 44const GBG_EXIT_USAGE: i64 = 2 45const GBG_EXIT_AIM_ABSENT: i64 = 4 46const GBG_SITES_ARG: *u8 = "4" 47// the fixture, as data 48const GBG_FIX_LEAF: *u8 = "nx_gbfixture.nx" 49const GBG_FIX_TARGET: *u8 = "nx_gbfixture" 50const GBG_FIX_FUNC: *u8 = "gbf_pick" 51const GBG_ABSENT_FUNC: *u8 = "gbf_no_such_function" 52const GBG_WRONG_TARGET: *u8 = "nx_not_the_fixture" 53const GBG_FAKE_GATE: *u8 = "nx_gate_bite_gate_absent_probe" 54const GBG_FIXTURE_TEXT: *u8 = "// fixture for nx_gate_bite_gate -- the numeric sites below are DELIBERATE.\nfunc gbf_pick(a: i64) -> i64 {\n if a > 37 { return 4211 }\n if a > 11 { return 909 }\n return 5\n}\nfunc gbf_other(b: i64) -> i64 { return b + 77 }\n" 55const GBG_MARK_SITES: *u8 = "total_numeric_sites=" 56const GBG_MARK_SUBJ: *u8 = "subject_target=" 57const GBG_MARK_MISMATCH: *u8 = "NOTE subject-source-is-not-the-target" 58const GBG_MARK_USAGE: *u8 = "usage: nx_gate_bite" 59const GBG_MARK_GRAMMAR: *u8 = "[subject <subject_target>]" 60const GBG_MARK_AIMABSENT: *u8 = "AIM-ABSENT" 61 62static gbg_cap_g: *u8 63static gbg_len_g: *i64 64 65func gbg_cat(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { dst[off + i] = s[i]; i = i + 1 } return off + i } 66func gbg_catn(dst: *u8, off: i64, v: i64) -> i64 { 67 var o: i64 = off 68 var m: i64 = v 69 let t: *u8 = sys_mmap(GBG_NUM_BYTES) 70 var k: i64 = 0 71 if m == 0 { t[0] = GBG_ASCII_ZERO as u8; k = 1 } 72 while m > 0 { t[k] = (GBG_ASCII_ZERO + (m % GBG_DECIMAL)) as u8; m = m / GBG_DECIMAL; k = k + 1 } 73 while k > 0 { k = k - 1; dst[o] = t[k]; o = o + 1 } 74 return o 75} 76func gbg_path(dir: *u8, leaf: *u8) -> *u8 { 77 let p: *u8 = sys_mmap(GBG_PATH_CAP) 78 var o: i64 = gbg_cat(p, 0, dir) 79 o = gbg_cat(p, o, "/" as *u8) 80 o = gbg_cat(p, o, leaf) 81 p[o] = 0 as u8 82 return p 83} 84func gbg_write_text(path: *u8, s: *u8) -> i64 { 85 var n: i64 = 0 86 while s[n] != (0 as u8) { n = n + 1 } 87 let fd: i64 = sys_openat_wr(path, MODE_0644) 88 if fd < 0 { return 0 - 1 } 89 let wr: i64 = sys_write(fd, s, n) 90 sys_close(fd) 91 if wr != n { return 0 - 1 } 92 return n 93} 94func gbg_nil() -> *u8 { return 0 as *u8 } 95// Fork the harness with up to seven arguments (0 = end of list). Capture stdout+stderr into gbg_cap_g and 96// return its exit code. Composes tr_run_capture_to rather than re-implementing fork/wait: there is exactly 97// one exec-and-capture primitive in this estate and this gate is not going to be the second. 98func gbg_run(subject: *u8, a1: *u8, a2: *u8, a3: *u8, a4: *u8, a5: *u8, a6: *u8, a7: *u8) -> i64 { 99 let av: *i64 = sys_mmap(GBG_WORD * GBG_ARGV_SLOTS) as *i64 100 var n: i64 = 0 101 av[n] = subject as i64; n = n + 1 102 if (a1 as i64) != 0 { av[n] = a1 as i64; n = n + 1 } 103 if (a2 as i64) != 0 { av[n] = a2 as i64; n = n + 1 } 104 if (a3 as i64) != 0 { av[n] = a3 as i64; n = n + 1 } 105 if (a4 as i64) != 0 { av[n] = a4 as i64; n = n + 1 } 106 if (a5 as i64) != 0 { av[n] = a5 as i64; n = n + 1 } 107 if (a6 as i64) != 0 { av[n] = a6 as i64; n = n + 1 } 108 if (a7 as i64) != 0 { av[n] = a7 as i64; n = n + 1 } 109 av[n] = 0 110 gbg_len_g[0] = 0 111 return tr_run_capture_to(subject, av, gbg_cap_g, GBG_CAP, gbg_len_g, GBG_RUN_TIMEOUT_MS) 112} 113func gbg_has(needle: *u8) -> i64 { return tr_contains(gbg_cap_g, gbg_len_g[0], needle) } 114// The integer that follows <needle> in the capture, or -1 when the marker or its number is absent. 115// It ABSTAINS with -1 rather than returning 0: a missing marker and a genuine zero demand opposite 116// readings, and 0 is precisely the value the site-count teeth below refuse. A CHECK THAT CANNOT OBSERVE 117// MUST NOT ANSWER WITH THE VALUE IT IS TESTING FOR. 118func gbg_num_after(needle: *u8) -> i64 { 119 let n: i64 = gbg_len_g[0] 120 let at: i64 = gg_last(gbg_cap_g, n, needle) 121 if at < 0 { return 0 - 1 } 122 var nn: i64 = 0 123 while needle[nn] != (0 as u8) { nn = nn + 1 } 124 var i: i64 = at + nn 125 var v: i64 = 0 126 var seen: i64 = 0 127 var go: i64 = 1 128 while go == 1 { 129 if i >= n { go = 0 } else { 130 let d: i64 = (gbg_cap_g[i] as i64) - GBG_ASCII_ZERO 131 if d < 0 { go = 0 } else { 132 if d > GBG_DEC_LAST { go = 0 } else { v = v * GBG_DECIMAL + d; seen = 1; i = i + 1 } 133 } 134 } 135 } 136 if seen == 0 { return 0 - 1 } 137 return v 138} 139 140func main(argc: i64, argv: *i64) -> i64 { 141 let ctr: *i64 = gv_ctr() 142 gv_head("nx_gate_bite gate -- the mutation harness can name a SUBJECT, names an off-target source without refusing it, and its classic grammar is unchanged" as *u8) 143 var subject: *u8 = GBG_SUBJECT_DEFAULT 144 if argc >= 2 { subject = argv[1] as *u8 } 145 gv_puts(" subject: " as *u8); gv_puts(subject); gv_puts("\n\n" as *u8) 146 gbg_cap_g = sys_mmap(GBG_CAP) 147 gbg_len_g = sys_mmap(GBG_LP_BYTES) as *i64 148 149 // ---- SETUP: a fresh run dir per run, so a crash cannot leave state that flatters the next one ---- 150 sys_mkdir(GBG_DIR, GBG_MODE_DIR) 151 let rundir: *u8 = sys_mmap(GBG_PATH_CAP) 152 var ro: i64 = gbg_cat(rundir, 0, GBG_DIR) 153 ro = gbg_cat(rundir, ro, "/r" as *u8) 154 ro = gbg_catn(rundir, ro, sys_now_us()) 155 rundir[ro] = 0 as u8 156 sys_mkdir(rundir, GBG_MODE_DIR) 157 let src: *u8 = gbg_path(rundir, GBG_FIX_LEAF) 158 let wrote: i64 = gbg_write_text(src, GBG_FIXTURE_TEXT) 159 var t0: i64 = 0 160 if wrote > 0 { t0 = 1 } 161 gv_puts(" fixture: " as *u8); gv_puts(src); gv_puts(" bytes=" as *u8); gv_num(wrote); gv_puts("\n" as *u8) 162 gv_check("fixture-reached-the-condition-a-real-nx-subject-written-non-empty-before-anything-is-measured" as *u8, t0, ctr) 163 164 // ---- R1 CLASSIC: the historical 3-arg + aimlist form, called exactly as it always has been ---- 165 let rc1: i64 = gbg_run(subject, GBG_FAKE_GATE, src, GBG_SITES_ARG, "aimlist" as *u8, GBG_FIX_FUNC, gbg_nil(), gbg_nil()) 166 let sites1: i64 = gbg_num_after(GBG_MARK_SITES) 167 let subj_in_classic: i64 = gbg_has(GBG_MARK_SUBJ) 168 var t1: i64 = 0 169 if rc1 == GBG_EXIT_OK { if sites1 > 0 { t1 = 1 } } 170 gv_puts(" classic rc=" as *u8); gv_num(rc1); gv_puts(" total_numeric_sites=" as *u8); gv_num(sites1); gv_puts("\n" as *u8) 171 // ANTI-VACUITY: a harness that refused everything would pass every refusal tooth below. This one 172 // demands a clean exit AND a non-zero count, so the trivial always-refuse implementation cannot pass. 173 gv_check("classic-grammar-unchanged-aimlist-still-exits-0-and-enumerates-a-NON-ZERO-site-count" as *u8, t1, ctr) 174 175 // ---- R2 SUBJECT MODE: the new keyword, before aimlist ---- 176 let rc2: i64 = gbg_run(subject, GBG_FAKE_GATE, src, GBG_SITES_ARG, "subject" as *u8, GBG_FIX_TARGET, "aimlist" as *u8, GBG_FIX_FUNC) 177 let sites2: i64 = gbg_num_after(GBG_MARK_SITES) 178 let subj_in_subject_mode: i64 = gbg_has(GBG_MARK_SUBJ) 179 let mismatch_on_good: i64 = gbg_has(GBG_MARK_MISMATCH) 180 var t2: i64 = 0 181 if rc2 == GBG_EXIT_OK { if subj_in_subject_mode == 1 { t2 = 1 } } 182 gv_puts(" subject-mode rc=" as *u8); gv_num(rc2); gv_puts(" total_numeric_sites=" as *u8); gv_num(sites2); gv_puts("\n" as *u8) 183 gv_check("subject-keyword-is-PARSED-and-ANNOUNCED-subject_target-reaches-the-report" as *u8, t2, ctr) 184 // Both signals present at once: the announcement must appear when the argument is given and must NOT 185 // appear when it is not. A tool that printed it unconditionally would be indistinguishable otherwise. 186 gv_bite("neg-control-subject_target-announced-ONLY-when-the-argument-is-given" as *u8, subj_in_subject_mode, subj_in_classic, ctr) 187 188 // ---- R3 REVERSE ORDER: proves the parser is a SCAN, not a slot. The pre-2026-08-25 parser read 189 // argv[4] and only argv[4], so this arrangement could not be expressed at all. 190 let rc3: i64 = gbg_run(subject, GBG_FAKE_GATE, src, GBG_SITES_ARG, "aimlist" as *u8, GBG_FIX_FUNC, "subject" as *u8, GBG_FIX_TARGET) 191 let sites3: i64 = gbg_num_after(GBG_MARK_SITES) 192 let subj_in_reverse: i64 = gbg_has(GBG_MARK_SUBJ) 193 var t3: i64 = 0 194 if rc3 == GBG_EXIT_OK { if subj_in_reverse == 1 { t3 = 1 } } 195 gv_puts(" reverse-order rc=" as *u8); gv_num(rc3); gv_puts(" total_numeric_sites=" as *u8); gv_num(sites3); gv_puts("\n" as *u8) 196 gv_check("keyword-scan-is-ORDER-INDEPENDENT-aimlist-then-subject-parses-as-well-as-subject-then-aimlist" as *u8, t3, ctr) 197 198 // Bound to the VALUE, not to a boolean: naming a subject must not move the answer, and the shared 199 // answer must not be zero (a zero would make all three agree vacuously). 200 var t4: i64 = 0 201 if sites1 > 0 { if sites1 == sites2 { if sites2 == sites3 { t4 = 1 } } } 202 gv_check("naming-a-subject-does-not-change-the-answer-all-three-runs-report-the-SAME-non-zero-site-count" as *u8, t4, ctr) 203 204 // ---- R4 THE LOAD-BEARING NEG-CONTROL: an OFF-TARGET source must be NAMED and must still PROCEED ---- 205 // The first draft of this tooth demanded a REFUSAL, and that was wrong -- corrected the same day, after 206 // reading debt 1785787638. Mutating a file that is not <subject_target>.nx is LEGITIMATE, and it is the 207 // highest-value use of this mode, whenever the file is a LIBRARY INSIDE the subject's build closure: that 208 // row is exactly that case (nx_intlog's arithmetic inside nx_beir_eval). Refusing would have blocked it, 209 // and it would have duplicated a check the harness already makes SOUNDLY -- a source outside the closure 210 // yields a byte-identical artifact and is excluded as NOT-REACHED. So the tooth asserts the honest 211 // behaviour: SAY SO, and CARRY ON with an unchanged answer. 212 let rc4: i64 = gbg_run(subject, GBG_FAKE_GATE, src, GBG_SITES_ARG, "subject" as *u8, GBG_WRONG_TARGET, "aimlist" as *u8, GBG_FIX_FUNC) 213 let sites4: i64 = gbg_num_after(GBG_MARK_SITES) 214 var mismatch_fired: i64 = 0 215 if rc4 == GBG_EXIT_OK { 216 if gbg_has(GBG_MARK_MISMATCH) == 1 { 217 if sites4 > 0 { if sites4 == sites1 { mismatch_fired = 1 } } 218 } 219 } 220 gv_puts(" off-target-source rc=" as *u8); gv_num(rc4); gv_puts(" total_numeric_sites=" as *u8); gv_num(sites4); gv_puts("\n" as *u8) 221 gv_bite("neg-control-off-target-source-is-NAMED-and-still-PROCEEDS-with-an-unchanged-answer-on-target-source-stays-silent" as *u8, mismatch_fired, mismatch_on_good, ctr) 222 223 // ---- R5 the aim lane's ABSENT path still abstains. Same tool, present vs absent function, two 224 // different CORRECT answers -- which is what separates a working tool from one stuck on one reply. 225 let rc5: i64 = gbg_run(subject, GBG_FAKE_GATE, src, GBG_SITES_ARG, "aimlist" as *u8, GBG_ABSENT_FUNC, gbg_nil(), gbg_nil()) 226 var t5: i64 = 0 227 if rc5 == GBG_EXIT_AIM_ABSENT { if gbg_has(GBG_MARK_AIMABSENT) == 1 { t5 = 1 } } 228 gv_puts(" absent-aim rc=" as *u8); gv_num(rc5); gv_puts("\n" as *u8) 229 gv_check("absent-aim-function-ABSTAINS-exit-4-and-names-AIM-ABSENT-never-acquits" as *u8, t5, ctr) 230 231 // ---- R6 THE DOCTRINE TOOTH. The whole defect being fixed was a documented argument the shipped 232 // binary did not have, so the standing instruction was not executable and every seat that followed it 233 // proved nothing. This tooth fails the day the shipped usage and the documented grammar drift apart. 234 let rc6: i64 = gbg_run(subject, GBG_FAKE_GATE, gbg_nil(), gbg_nil(), gbg_nil(), gbg_nil(), gbg_nil(), gbg_nil()) 235 var t6: i64 = 0 236 if rc6 == GBG_EXIT_USAGE { if gbg_has(GBG_MARK_GRAMMAR) == 1 { t6 = 1 } } 237 gv_puts(" usage rc=" as *u8); gv_num(rc6); gv_puts("\n" as *u8) 238 gv_check("shipped-usage-string-NAMES-the-subject-argument-so-doctrine-and-binary-cannot-drift-silently" as *u8, t6, ctr) 239 240 // ---- R7 the deliberate non-numeric max_sites refusal is UNCHANGED. It is what stops a misplaced 241 // keyword decoding as a five-thousand-site sweep, and it is why keywords come after the budget. 242 let rc7: i64 = gbg_run(subject, GBG_FAKE_GATE, src, "subject" as *u8, gbg_nil(), gbg_nil(), gbg_nil(), gbg_nil()) 243 var t7: i64 = 0 244 if rc7 == GBG_EXIT_USAGE { if gbg_has(GBG_MARK_USAGE) == 1 { t7 = 1 } } 245 gv_puts(" non-numeric-budget rc=" as *u8); gv_num(rc7); gv_puts("\n" as *u8) 246 gv_check("non-numeric-max_sites-still-REFUSES-the-pre-existing-guard-is-intact" as *u8, t7, ctr) 247 248 return gv_verdict("gate_bite" as *u8, ctr, "the subject argument is parsed, announced, order-independent, answer-preserving and pair-checked; the classic grammar and both of its refusals are unchanged; every invocation is build-free" as *u8) 249}