nx_gate_build_sweep.nx source

1// nx_gate_build_sweep.nx -- THE UNBUILT-GATE PARTITIONER (2026-07-31, ws=gate-dry-d001). 2// 3// WHY: nx_gatebuilt_gate measures gate_sources=2891 built=232 UNBUILT=2659 (built_permil=80) and states 4// the law -- AN UNBUILT GATE IS INDISTINGUISHABLE FROM A PASSING ONE IN EVERY REPORT THAT MENTIONS IT. 5// But it stops at the COUNT. A count cannot tell you whether those 2659 are merely NEVER-COMPILED (cheap: 6// nobody ran the builder) or GENUINELY BROKEN (real defects hiding behind a number). Those two populations 7// need opposite remedies, and conflating them is the same class of error as a MISSING X vs a WEDGED X. 8// 9// A hand spot-check of 4 (nx_cap_keygen_gate/nx_coindex_gate/nx_anti_slop_gate/nx_warc_index_gate) built 10// 4/4 CLEAN on the first try -- which says the population is probably mostly the cheap kind, but 4 is a 11// spot check and MUST NOT be banked as a measurement (a candidate ruler's output is never a measurement). 12// This organ turns the spot check into a census. 13// 14// WHAT IT IS NOT: it does NOT promote. Compiling proves a gate CAN exist; promoting it into the shared 15// prod root is an outward-facing change to a tree seven sibling sessions are using, and belongs to a 16// deliberate operator-authorised step. This organ ONLY partitions, and says so in its own output. 17// 18// ENVELOPE, declared in-band and never silent: FLAT scan of runtime + runtime/_hdl_build relative to the 19// DISCOVERED buildroot (no recursion -- the _attic/_retired/_stage_local shadow trees stay excluded, same 20// envelope as nx_gatebuilt_gate so the two numbers are comparable); every run is BOUNDED by an explicit 21// max (argv[1]) and resumable by an explicit skip (argv[2]) so it can never run away; every build is 22// deadline-bounded (tr_run_capture_to) because ONE hanging compile must not wedge a 2659-target sweep. 23// 24// IDEMPOTENT (rule 10): a target whose /tmp/<t>.sov.elf already exists is SKIP-EXISTS, not rebuilt. 25// ADDITIVE (rule 13): appends one frame per target to an append-only journal; never rewrites history. 26// 27// ANOMALY class, deliberately its own bucket: builder returns rc=0 but NO artifact appears. That is an 28// instrument claiming success it cannot show, and it must never be silently counted as BUILT. 29// 30// usage: nx_gate_build_sweep <max> [skip] [journal] [timeout_ms] 31// argv[1] max REQUIRED, > 0 -- refuse rather than default to unbounded (no silent runaway) 32// argv[2] skip resume offset into the scan order, default 0 33// argv[3] journal append-only outcome log, default /tmp/gate_build_sweep.jrnl (absolute recommended: 34// this organ chdir's to the buildroot, so a relative path resolves THERE) 35// argv[4] timeout per-build deadline in ms, default 180000 36// license_tier: ORIGINAL No hw writes (Rule 26). 37import "nx_syscalls.nx" 38import "nx_gate_verdict.nx" 39import "nx_tool_run.nx" 40 41const GS_DIRBUF: i64 = 262144 42const GS_PATH: i64 = 512 43const GS_CAP: i64 = 262144 44const GS_SLOT: i64 = 16 45const GS_LINE: i64 = 1024 46const GS_MODE: i64 = 420 47const GS_RECLEN_OFF: i64 = 16 48const GS_NAME_OFF: i64 = 19 49const GS_TAB: i64 = 9 50const GS_NL: i64 = 10 51const GS_ZERO: i64 = 48 52const GS_B10: i64 = 10 53const GS_DEF_TIMEOUT: i64 = 180000 54const GS_SANDBOX: *u8 = "_gatesandbox" 55const GS_NOBUILDER: i64 = 0 - 99 56 57// counter slots -- named because a cross-function index contract written as bare integers is exactly 58// how two halves of one organ silently drift apart 59const GS_C_SEEN: i64 = 0 60const GS_C_SKIPPED: i64 = 1 61const GS_C_EXISTS: i64 = 2 62const GS_C_BUILT: i64 = 3 63const GS_C_FAILED: i64 = 4 64const GS_C_TIMEOUT: i64 = 5 65const GS_C_ANOMALY: i64 = 6 66const GS_C_ATTEMPT: i64 = 7 67const GS_C_WAITED: i64 = 8 68const GS_C_PAUSED: i64 = 9 69const GS_C_PROMOTED: i64 = 10 70const GS_C_COMPILED_ONLY: i64 = 11 71const GS_C_NEVER: i64 = 12 72// VERDICTS MODE counters (2026-08-06). Running a gate is how you learn what it says; the corpus has 73// 2360 gates that are COMPILED and unreachable, so their verdicts have never been read by anything. 74const GS_C_VGREEN: i64 = 13 75const GS_C_VRED: i64 = 14 76const GS_C_VOTHER: i64 = 15 77const GS_C_EFFSKIP: i64 = 16 78const GS_CN: i64 = 17 79 80// ---- BUILD ADMISSION ------------------------------------------------------------------------ 81// A 2600-target compile sweep on a box seven sibling seats share is EXACTLY the shape that froze 82// every seat once already (nx_skullsdf took 27.7GB in 2m48s and no allocator asked permission). 83// The lesson banked from that incident was not "add a primitive" -- nx_build_admit ALREADY EXISTED 84// and was simply unreachable from inside the thing doing the work. So this sweep is a good citizen 85// BY CONSTRUCTION rather than by an operator remembering to check first. 86// DRY (rule 15): it COMPOSES nx_build_admit and never re-derives its thresholds -- those are rule-11 87// config that belongs to that organ, not duplicated here where the two copies would silently drift. 88// FAIL-CLOSED: if the admission organ cannot be found, this REFUSES to sweep. An ungated sweep is 89// the hazard; "could not check, so proceeded" is how the freeze happened. 90const GS_ADMIT_EVERY: i64 = 8 91const GS_ADMIT_WAIT_MS: i64 = 30000 92const GS_ADMIT_MAX_WAITS: i64 = 20 93const GS_ADMIT_TIMEOUT: i64 = 20000 94const GS_PAUSED: i64 = 0 - 97 95const GS_NOADMIT: i64 = 0 - 96 96 97// config slots 98const GS_K_MAX: i64 = 0 99const GS_K_SKIP: i64 = 1 100const GS_K_TIMEOUT: i64 = 2 101const GS_K_JFD: i64 = 3 102const GS_K_MODE: i64 = 4 // 0 = build sweep (default) | 1 = verdicts sweep 103const GS_KN: i64 = 5 104 105func gs_atoi(s: *u8) -> i64 { 106 var v: i64 = 0 107 var i: i64 = 0 108 while s[i] != (0 as u8) { 109 let c: i64 = s[i] as i64 110 if c < GS_ZERO { return 0 - 1 } 111 if c > GS_ZERO + 9 { return 0 - 1 } 112 v = v * GS_B10 + (c - GS_ZERO) 113 i = i + 1 114 } 115 if i == 0 { return 0 - 1 } 116 return v 117} 118 119// cheap existence probe: openat for read, never a read of contents 120func gs_exists(path: *u8) -> i64 { 121 let fd: i64 = sys_openat_rd(path) 122 if fd < 0 { return 0 } 123 sys_close(fd) 124 return 1 125} 126 127// does name end with "_gate.nx" ? same predicate as nx_gatebuilt_gate so the corpora match 128func gs_is_gate_src(nm: *u8, n: i64) -> i64 { 129 if n < 8 { return 0 } 130 let t: *u8 = "_gate.nx" as *u8 131 var k: i64 = 0 132 while k < 8 { 133 if nm[n - 8 + k] != t[k] { return 0 } 134 k = k + 1 135 } 136 return 1 137} 138 139// discover + enter the buildroot: the ONE place the two-roots-one-name ambiguity is resolved. 140// The toolchain marker _offc/nx_sov_build_run.elf IS the definition of "this is the buildroot". 141func gs_enter_buildroot() -> i64 { 142 if gs_exists("_offc/nx_sov_build_run.elf" as *u8) == 1 { return 1 } 143 if sys_chdir("buildroot" as *u8) == 0 { 144 if gs_exists("_offc/nx_sov_build_run.elf" as *u8) == 1 { return 1 } 145 } 146 return 0 147} 148 149// WHERE THE ARTIFACT LANDS IS A FACT TO BE DISCOVERED, NOT ASSUMED. nx_buildonly.nx's header says the 150// builder "leaves /tmp/<target>.sov.elf"; the LIVE nx_sov_build_run writes buildroot/_build/<t>.sov.elf. 151// Trusting the header is exactly how this organ's first run scored 5/5 ANOMALY-RC0-NO-ARTIFACT on five 152// builds that had every one of them SUCCEEDED -- the builder was honest and the probe was looking in the 153// wrong place. Same wrong assumption is frozen into nx_gate_migrate's gm_artifact (also /tmp), which is 154// one of the three reasons that verifier cannot run. Probe both; the artifact is wherever it actually is. 155func gs_artifact(target: *u8, out: *u8) -> i64 { 156 var o: i64 = gv_cat(out, 0, "_build/" as *u8) 157 o = gv_cat(out, o, target) 158 o = gv_cat(out, o, ".sov.elf" as *u8) 159 out[o] = 0 as u8 160 return o 161} 162 163func gs_artifact_alt(target: *u8, out: *u8) -> i64 { 164 var o: i64 = gv_cat(out, 0, "/tmp/" as *u8) 165 o = gv_cat(out, o, target) 166 o = gv_cat(out, o, ".sov.elf" as *u8) 167 out[o] = 0 as u8 168 return o 169} 170 171func gs_have_artifact(target: *u8, out: *u8) -> i64 { 172 gs_artifact(target, out) 173 if gs_exists(out) == 1 { return 1 } 174 gs_artifact_alt(target, out) 175 if gs_exists(out) == 1 { return 1 } 176 return 0 177} 178 179// build ONE target, deadline-bounded. Prefers the thin wrapper when it exists, else drives the canonical 180// builder directly -- so a missing nx_buildonly.elf degrades to the real toolchain instead of exec-failing 181// into a 127 that reads like a broken gate. Returns builder rc, or GS_NOBUILDER when NEITHER exists 182// (a distinct value on purpose: no builder is a HARNESS failure, never a verdict about the gate). 183// the PROMOTED location: <name>.elf at the nishihost root, which is the parent of the buildroot we 184// chdir'd into. This is the ONLY location nx_gatebuilt_gate probes -- which is exactly why it reports 185// UNBUILT for gates that are compiled and merely unpromoted. 186func gs_promoted(target: *u8, out: *u8) -> i64 { 187 var o: i64 = gv_cat(out, 0, "../" as *u8) 188 o = gv_cat(out, o, target) 189 o = gv_cat(out, o, ".elf" as *u8) 190 out[o] = 0 as u8 191 return gs_exists(out) 192} 193 194func gs_admit_path(out: *u8) -> i64 { 195 var o: i64 = gv_cat(out, 0, "../nx_build_admit.elf" as *u8) 196 out[o] = 0 as u8 197 if gs_exists(out) == 1 { return 1 } 198 o = gv_cat(out, 0, "nx_build_admit.elf" as *u8) 199 out[o] = 0 as u8 200 if gs_exists(out) == 1 { return 1 } 201 return 0 202} 203 204// 1 = GRANT (an opening exists). ANYTHING else -- QUEUE, REFUSE, a harness error, an unreadable 205// answer -- is treated as CLOSED. An admission check that cannot produce a GRANT must never be read 206// as permission: a check and its own failure mode must not look alike. 207func gs_admit_ok(p: *u8, out: *u8, ol: *i64) -> i64 { 208 let av: *i64 = sys_mmap(32) as *i64 209 av[0] = p as i64 210 av[1] = "check" as *u8 as i64 211 av[2] = 0 212 let rc: i64 = tr_run_capture_to(p, av, out, GS_CAP, ol, GS_ADMIT_TIMEOUT) 213 if rc < 0 { return 0 } 214 return tr_contains(out, ol[0], "VERDICT=GRANT" as *u8) 215} 216 217func gs_build(target: *u8, timeout_ms: i64, out: *u8, outlen: *i64, ctr: *i64) -> i64 { 218 // ADMISSION IS BOUND TO THE ONE ACT THAT CONSUMES THE MACHINE. Checking at call sites means every 219 // future call site has to REMEMBER; checking here means none of them can forget. 220 if ctr[GS_C_PAUSED] == 1 { return GS_PAUSED } 221 let ap: *u8 = sys_mmap(GS_PATH) 222 if gs_admit_path(ap) == 0 { return GS_NOADMIT } 223 if ctr[GS_C_ATTEMPT] % GS_ADMIT_EVERY == 0 { 224 var waits: i64 = 0 225 var open: i64 = gs_admit_ok(ap, out, outlen) 226 while open == 0 { 227 if waits >= GS_ADMIT_MAX_WAITS { return GS_PAUSED } 228 waits = waits + 1 229 ctr[GS_C_WAITED] = ctr[GS_C_WAITED] + 1 230 sys_sleep_ms(GS_ADMIT_WAIT_MS) 231 open = gs_admit_ok(ap, out, outlen) 232 } 233 } 234 let av: *i64 = sys_mmap(64) as *i64 235 if gs_exists("_offc/nx_buildonly.elf" as *u8) == 1 { 236 av[0] = "_offc/nx_buildonly.elf" as *u8 as i64 237 av[1] = target as i64 238 av[2] = 0 239 return tr_run_capture_to("_offc/nx_buildonly.elf" as *u8, av, out, GS_CAP, outlen, timeout_ms) 240 } 241 if gs_exists("_offc/nx_sov_build_run.elf" as *u8) == 1 { 242 av[0] = "_offc/nx_sov_build_run.elf" as *u8 as i64 243 av[1] = target as i64 244 av[2] = "--build-only" as *u8 as i64 245 av[3] = 0 246 return tr_run_capture_to("_offc/nx_sov_build_run.elf" as *u8, av, out, GS_CAP, outlen, timeout_ms) 247 } 248 return GS_NOBUILDER 249} 250 251// ---- VERDICTS MODE (2026-08-06) --------------------------------------------------------------- 252// ***A GATE NOBODY RUNS IS A COMMENT.*** The census says 2360 gates are COMPILED and NOT PROMOTED, so 253// their verdicts have never been read by anything. This mode RUNS each compiled artifact IN PLACE from 254// _build and reports what it says. It deliberately does NOT stage, promote, or touch the live tree -- 255// the same signal, none of the mutation. (Doing this by hand on 2026-08-06 meant promoting 51 binaries 256// into the shared prod root to learn the same thing.) 257// ***AND IT HONOURS THE EFFECTFUL DENYLIST.*** Running a gate is not free: nx_cap_grant_e2e_gate is a 258// destructive end-to-end test that rewrites tool_allowlist.conf and the cap signing key, and running it 259// took the whole MCP control plane down. FAIL-CLOSED: an unreadable denylist refuses the sweep, the same 260// stance this organ already takes on build admission. 261func gs_readfile(path: *u8, buf: *u8, cap: i64) -> i64 { 262 let fd: i64 = sys_openat_rd(path) 263 if fd < 0 { return 0 - 1 } 264 var n: i64 = 0 265 var go: i64 = 1 266 while go == 1 { 267 let r: i64 = sys_read(fd, ((buf as i64) + n) as *u8, cap - n) 268 if r <= 0 { go = 0 } else { n = n + r } 269 if n >= cap { go = 0 } 270 } 271 sys_close(fd) 272 return n 273} 274func gs_has(b: *u8, n: i64, pat: *u8) -> i64 { 275 var pl: i64 = 0 276 while pat[pl] != (0 as u8) { pl = pl + 1 } 277 if pl == 0 { return 0 } 278 if pl > n { return 0 } 279 var i: i64 = 0 280 while i + pl <= n { 281 var k: i64 = 0 282 var hit: i64 = 1 283 while k < pl { if b[i + k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } } 284 if hit == 1 { return 1 } 285 i = i + 1 286 } 287 return 0 288} 289// -1 = denylist unreadable (caller MUST refuse) | 1 = listed effectful | 0 = safe to run 290func gs_effectful(target: *u8) -> i64 { 291 let b: *u8 = sys_mmap(GS_CAP) 292 var n: i64 = gs_readfile("../knowledge/gate_effectful.conf" as *u8, b, GS_CAP - 1) 293 if n <= 0 { n = gs_readfile("knowledge/gate_effectful.conf" as *u8, b, GS_CAP - 1) } 294 if n <= 0 { return 0 - 1 } 295 var gl: i64 = 0 296 while target[gl] != (0 as u8) { gl = gl + 1 } 297 var i: i64 = 0 298 var found: i64 = 0 299 while i < n { 300 var e: i64 = i 301 var sc: i64 = 0 302 while sc == 0 { if e >= n { sc = 1 } else { if b[e] == (GS_NL as u8) { sc = 1 } else { e = e + 1 } } } 303 if e > i { if b[i] != (35 as u8) { 304 var le: i64 = e 305 var trim: i64 = 1 306 while trim == 1 { 307 trim = 0 308 if le > i { 309 let c: i64 = b[le - 1] as i64 310 if c == 13 { le = le - 1; trim = 1 } 311 if c == 32 { le = le - 1; trim = 1 } 312 if c == 9 { le = le - 1; trim = 1 } 313 } 314 } 315 if le - i == gl { 316 var k: i64 = 0 317 var same: i64 = 1 318 while k < gl { if b[i + k] != target[k] { same = 0; k = gl } else { k = k + 1 } } 319 if same == 1 { found = 1; i = n } 320 } 321 } } 322 if found == 0 { i = e + 1 } 323 } 324 return found 325} 326func gs_artpath(target: *u8, out: *u8) -> i64 { 327 var o: i64 = 0 328 let p: *u8 = "../_build/" 329 var i: i64 = 0 330 while p[i] != (0 as u8) { out[o] = p[i]; o = o + 1; i = i + 1 } 331 i = 0 332 while target[i] != (0 as u8) { out[o] = target[i]; o = o + 1; i = i + 1 } 333 let s: *u8 = ".sov.elf" 334 i = 0 335 while s[i] != (0 as u8) { out[o] = s[i]; o = o + 1; i = i + 1 } 336 out[o] = 0 as u8 337 return o 338} 339// 1 = GREEN | 0 = RED | -1 = could not run (never conflated with a RED subject) 340func gs_runverdict(target: *u8, timeout_ms: i64, out: *u8, outlen: *i64) -> i64 { 341 let ap: *u8 = sys_mmap(GS_PATH) 342 gs_artpath(target, ap) 343 let av: *i64 = sys_mmap(64) as *i64 344 av[0] = ap as i64 345 av[1] = 0 346 outlen[0] = 0 347 // ***SANDBOXED.*** cwd becomes _gatesandbox, one level under buildroot, so a gate reaching for 348 // ../tool_allowlist.conf -- the exact path that took the control plane down on 2026-08-06 -- lands 349 // in the buildroot scratch tree instead of nishihost. Composes with the denylist, does not replace 350 // it: an ABSOLUTE path still escapes, and nothing short of a namespace stops that. 351 let rc: i64 = tr_run_capture_cwd(ap, av, out, GS_CAP, outlen, timeout_ms, GS_SANDBOX) 352 if rc == 0 - 6 { return 0 - 1 } 353 let n: i64 = outlen[0] 354 if n <= 0 { return 0 - 1 } 355 if gs_has(out, n, "verdict=GREEN" as *u8) == 1 { return 1 } 356 if gs_has(out, n, "VERDICT=GREEN" as *u8) == 1 { return 1 } 357 if gs_has(out, n, "verdict=RED" as *u8) == 1 { return 0 } 358 if gs_has(out, n, "VERDICT=RED" as *u8) == 1 { return 0 } 359 if rc == 0 { return 1 } 360 return 0 361} 362 363// one append-only frame: ts TAB sweep TAB target TAB status TAB rc 364func gs_frame(jfd: i64, target: *u8, status: *u8, rc: i64) -> i64 { 365 if jfd < 0 { return 0 } 366 let ln: *u8 = sys_mmap(GS_LINE) 367 var o: i64 = gv_catn(ln, 0, sys_now_realtime_sec()) 368 ln[o] = GS_TAB as u8; o = o + 1 369 o = gv_cat(ln, o, "gatesweep" as *u8) 370 ln[o] = GS_TAB as u8; o = o + 1 371 o = gv_cat(ln, o, target) 372 ln[o] = GS_TAB as u8; o = o + 1 373 o = gv_cat(ln, o, status) 374 ln[o] = GS_TAB as u8; o = o + 1 375 o = gv_catn(ln, o, rc) 376 ln[o] = GS_NL as u8; o = o + 1 377 sys_write(jfd, ln, o) 378 return 0 379} 380 381// scan ONE dir flat and sweep the gate sources in it 382func gs_scan(dir: *u8, ctr: *i64, cfg: *i64) -> i64 { 383 let fd: i64 = sys_openat_rd(dir) 384 if fd < 0 { return 0 - 1 } 385 let dbuf: *u8 = sys_mmap(GS_DIRBUF) 386 let target: *u8 = sys_mmap(GS_PATH) 387 let art: *u8 = sys_mmap(GS_PATH) 388 let out: *u8 = sys_mmap(GS_CAP) 389 let ol: *i64 = sys_mmap(GS_SLOT) as *i64 390 var n: i64 = sys_getdents64(fd, dbuf, GS_DIRBUF) 391 while n > 0 { 392 var p: i64 = 0 393 while p < n { 394 let reclen: i64 = (dbuf[p + GS_RECLEN_OFF] as i64) + ((dbuf[p + GS_RECLEN_OFF + 1] as i64) * 256) 395 if reclen <= 0 { p = n } 396 else { 397 let nm: *u8 = ((dbuf as i64) + p + GS_NAME_OFF) as *u8 398 var ln: i64 = 0 399 while nm[ln] != (0 as u8) { ln = ln + 1 } 400 if gs_is_gate_src(nm, ln) == 1 { 401 ctr[GS_C_SEEN] = ctr[GS_C_SEEN] + 1 402 // CENSUS MODE (max=0): classify every gate against BOTH locations and build nothing. 403 // This is the mode that answers the question nx_gatebuilt_gate gets wrong -- it reports 404 // one axis (promoted) under a name that claims another (built) -- and it costs three 405 // openat probes per gate instead of a 33-hour recompile of a corpus that is already compiled. 406 if cfg[GS_K_MAX] == 0 { 407 var w2: i64 = 0 408 while w2 < ln - 3 { target[w2] = nm[w2]; w2 = w2 + 1 } 409 target[w2] = 0 as u8 410 if gs_promoted(target, art) == 1 { ctr[GS_C_PROMOTED] = ctr[GS_C_PROMOTED] + 1 } 411 else { 412 if gs_have_artifact(target, art) == 1 { ctr[GS_C_COMPILED_ONLY] = ctr[GS_C_COMPILED_ONLY] + 1 } 413 else { ctr[GS_C_NEVER] = ctr[GS_C_NEVER] + 1 } 414 } 415 } 416 if cfg[GS_K_MAX] == 0 { ctr[GS_C_SKIPPED] = ctr[GS_C_SKIPPED] + 0 } 417 else { 418 if ctr[GS_C_SEEN] <= cfg[GS_K_SKIP] { ctr[GS_C_SKIPPED] = ctr[GS_C_SKIPPED] + 1 } 419 else { 420 if ctr[GS_C_ATTEMPT] >= cfg[GS_K_MAX] { ctr[GS_C_SKIPPED] = ctr[GS_C_SKIPPED] + 1 } 421 else { 422 var w: i64 = 0 423 while w < ln - 3 { target[w] = nm[w]; w = w + 1 } 424 target[w] = 0 as u8 425 if gs_have_artifact(target, art) == 1 { 426 if cfg[GS_K_MODE] == 1 { 427 // VERDICTS: the artifact already exists, so RUN it and read what it 428 // says. Nothing is staged, promoted or written to the live tree. 429 let ef: i64 = gs_effectful(target) 430 if ef != 0 { 431 ctr[GS_C_EFFSKIP] = ctr[GS_C_EFFSKIP] + 1 432 gs_frame(cfg[GS_K_JFD], target, "SKIP-EFFECTFUL" as *u8, ef) 433 } else { 434 ctr[GS_C_ATTEMPT] = ctr[GS_C_ATTEMPT] + 1 435 let vv: i64 = gs_runverdict(target, cfg[GS_K_TIMEOUT], out, ol) 436 if vv == 1 { ctr[GS_C_VGREEN] = ctr[GS_C_VGREEN] + 1; gs_frame(cfg[GS_K_JFD], target, "GREEN" as *u8, 0) } 437 if vv == 0 { ctr[GS_C_VRED] = ctr[GS_C_VRED] + 1; gs_frame(cfg[GS_K_JFD], target, "RED" as *u8, 1) } 438 if vv < 0 { ctr[GS_C_VOTHER] = ctr[GS_C_VOTHER] + 1; gs_frame(cfg[GS_K_JFD], target, "COULD-NOT-RUN" as *u8, vv) } 439 } 440 } else { 441 ctr[GS_C_EXISTS] = ctr[GS_C_EXISTS] + 1 442 gs_frame(cfg[GS_K_JFD], target, "SKIP-EXISTS" as *u8, 0) 443 } 444 } else { 445 let rc: i64 = gs_build(target, cfg[GS_K_TIMEOUT], out, ol, ctr) 446 if rc == GS_PAUSED { 447 ctr[GS_C_PAUSED] = 1 448 ctr[GS_C_SKIPPED] = ctr[GS_C_SKIPPED] + 1 449 gs_frame(cfg[GS_K_JFD], target, "PAUSED-ADMISSION" as *u8, rc) 450 } 451 if rc == GS_NOADMIT { 452 ctr[GS_C_PAUSED] = 1 453 ctr[GS_C_SKIPPED] = ctr[GS_C_SKIPPED] + 1 454 gs_frame(cfg[GS_K_JFD], target, "NO-ADMISSION-ORGAN" as *u8, rc) 455 } 456 if rc != GS_PAUSED { if rc != GS_NOADMIT { 457 ctr[GS_C_ATTEMPT] = ctr[GS_C_ATTEMPT] + 1 458 if rc == GS_NOBUILDER { 459 gs_frame(cfg[GS_K_JFD], target, "NO-BUILDER" as *u8, rc) 460 ctr[GS_C_ANOMALY] = ctr[GS_C_ANOMALY] + 1 461 } else { 462 if rc == 0 - 5 { 463 ctr[GS_C_TIMEOUT] = ctr[GS_C_TIMEOUT] + 1 464 gs_frame(cfg[GS_K_JFD], target, "TIMEOUT" as *u8, rc) 465 } else { 466 if rc == 0 { 467 if gs_have_artifact(target, art) == 1 { 468 ctr[GS_C_BUILT] = ctr[GS_C_BUILT] + 1 469 gs_frame(cfg[GS_K_JFD], target, "BUILT" as *u8, 0) 470 } else { 471 ctr[GS_C_ANOMALY] = ctr[GS_C_ANOMALY] + 1 472 gs_frame(cfg[GS_K_JFD], target, "ANOMALY-RC0-NO-ARTIFACT" as *u8, 0) 473 } 474 } else { 475 ctr[GS_C_FAILED] = ctr[GS_C_FAILED] + 1 476 gs_frame(cfg[GS_K_JFD], target, "FAILED" as *u8, rc) 477 } 478 } 479 } 480 } } 481 } 482 } 483 } 484 } 485 } 486 p = p + reclen 487 } 488 } 489 n = sys_getdents64(fd, dbuf, GS_DIRBUF) 490 } 491 sys_close(fd) 492 return 0 493} 494 495func main(argc: i64, argv: *i64) -> i64 { 496 gv_puts("=== nx_gate_build_sweep -- are the unbuilt gates BROKEN, or merely NEVER COMPILED? ===\n" as *u8) 497 if argc < 2 { 498 gv_puts("REFUSED: <max> is required. An unbounded sweep over ~2900 targets is a runaway, not a default.\n" as *u8) 499 gv_puts("usage: nx_gate_build_sweep <max> [skip] [journal] [timeout_ms]\n" as *u8) 500 return 2 501 } 502 let mx: i64 = gs_atoi(argv[1] as *u8) 503 if mx < 0 { 504 gv_puts("REFUSED: <max> must be 0 (CENSUS: classify only, build nothing) or a positive integer.\n" as *u8) 505 return 2 506 } 507 var sk: i64 = 0 508 if argc > 2 { 509 sk = gs_atoi(argv[2] as *u8) 510 if sk < 0 { gv_puts("REFUSED: <skip> must be a non-negative integer.\n" as *u8); return 2 } 511 } 512 var jpath: *u8 = "/tmp/gate_build_sweep.jrnl" as *u8 513 if argc > 3 { jpath = argv[3] as *u8 } 514 var tmo: i64 = GS_DEF_TIMEOUT 515 if argc > 4 { 516 tmo = gs_atoi(argv[4] as *u8) 517 if tmo <= 0 { gv_puts("REFUSED: <timeout_ms> must be positive.\n" as *u8); return 2 } 518 } 519 520 if gs_enter_buildroot() == 0 { 521 gv_puts("REFUSED: cannot find the buildroot (no _offc/nx_sov_build_run.elf at . or ./buildroot).\n" as *u8) 522 gv_puts(" A sweep that cannot locate its toolchain must refuse, never report zero built.\n" as *u8) 523 return 4 524 } 525 526 let ctr: *i64 = sys_mmap(GS_CN * 8) as *i64 527 var i: i64 = 0 528 while i < GS_CN { ctr[i] = 0; i = i + 1 } 529 let cfg: *i64 = sys_mmap(GS_KN * 8) as *i64 530 cfg[GS_K_MAX] = mx 531 cfg[GS_K_SKIP] = sk 532 cfg[GS_K_TIMEOUT] = tmo 533 cfg[GS_K_JFD] = sys_openat_append(jpath, GS_MODE) 534 cfg[GS_K_MODE] = 0 535 if argc > 5 { 536 let mv: *u8 = argv[5] as *u8 537 var mlen: i64 = 0 538 while mv[mlen] != (0 as u8) { mlen = mlen + 1 } 539 if gs_has(mv, mlen, "verdicts" as *u8) == 1 { cfg[GS_K_MODE] = 1 } 540 } 541 542 let r1: i64 = gs_scan("runtime" as *u8, ctr, cfg) 543 let r2: i64 = gs_scan("runtime/_hdl_build" as *u8, ctr, cfg) 544 if cfg[GS_K_JFD] >= 0 { sys_close(cfg[GS_K_JFD]) } 545 546 if r1 < 0 { 547 gv_puts("REFUSED: cannot open runtime -- a census that cannot read its corpus must refuse.\n" as *u8) 548 return 4 549 } 550 if r2 < 0 { 551 gv_puts("REFUSED: cannot open runtime/_hdl_build -- a census that cannot read its corpus must refuse.\n" as *u8) 552 return 4 553 } 554 555 if cfg[GS_K_MODE] == 1 { 556 gv_puts("NX-GATEVERDICTS seen=" as *u8); gv_num(ctr[GS_C_SEEN]) 557 gv_puts(" ran=" as *u8); gv_num(ctr[GS_C_ATTEMPT]) 558 gv_puts(" GREEN=" as *u8); gv_num(ctr[GS_C_VGREEN]) 559 gv_puts(" RED=" as *u8); gv_num(ctr[GS_C_VRED]) 560 gv_puts(" COULD-NOT-RUN=" as *u8); gv_num(ctr[GS_C_VOTHER]) 561 gv_puts(" skip-effectful=" as *u8); gv_num(ctr[GS_C_EFFSKIP]) 562 gv_puts(" not-reached=" as *u8); gv_num(ctr[GS_C_SKIPPED]) 563 var gpm: i64 = 0 564 if ctr[GS_C_ATTEMPT] > 0 { gpm = ctr[GS_C_VGREEN] * 1000 / ctr[GS_C_ATTEMPT] } 565 gv_puts(" green_permil=" as *u8); gv_num(gpm) 566 gv_puts("\n" as *u8) 567 gv_puts("envelope: RAN each COMPILED artifact IN PLACE from _build with cwd=buildroot. NOTHING was\n" as *u8) 568 gv_puts(" staged, promoted or written to the live tree -- the same signal as promoting, none of the\n" as *u8) 569 gv_puts(" mutation. A gate needing a nishihost fixture reads RED here for an ENVIRONMENTAL reason:\n" as *u8) 570 gv_puts(" A RED FROM A NEVER-RUN GATE IS THREE CLAIMS WEARING ONE COLOUR (subject broken / fixture\n" as *u8) 571 gv_puts(" absent / instrument could not measure) -- TRIAGE BEFORE COUNTING. Gates listed in\n" as *u8) 572 gv_puts(" knowledge/gate_effectful.conf are SKIPPED, never run: one of them took the whole MCP\n" as *u8) 573 gv_puts(" control plane down on 2026-08-06. COULD-NOT-RUN is its own bucket, never folded into RED.\n" as *u8) 574 return 0 575 } 576 if mx == 0 { 577 gv_puts("\nNX-GATECENSUS gate_sources=" as *u8); gv_num(ctr[GS_C_SEEN]) 578 gv_puts(" PROMOTED=" as *u8); gv_num(ctr[GS_C_PROMOTED]) 579 gv_puts(" COMPILED-NOT-PROMOTED=" as *u8); gv_num(ctr[GS_C_COMPILED_ONLY]) 580 gv_puts(" NEVER-COMPILED=" as *u8); gv_num(ctr[GS_C_NEVER]) 581 var cpm: i64 = 0 582 if ctr[GS_C_SEEN] > 0 { cpm = (ctr[GS_C_PROMOTED] + ctr[GS_C_COMPILED_ONLY]) * 1000 / ctr[GS_C_SEEN] } 583 gv_puts(" compiled_permil=" as *u8); gv_num(cpm) 584 var ppm: i64 = 0 585 if ctr[GS_C_SEEN] > 0 { ppm = ctr[GS_C_PROMOTED] * 1000 / ctr[GS_C_SEEN] } 586 gv_puts(" promoted_permil=" as *u8); gv_num(ppm) 587 gv_puts("\n" as *u8) 588 gv_puts("THREE POPULATIONS, NOT TWO. nx_gatebuilt_gate probes ONLY the promoted location and calls\n" as *u8) 589 gv_puts(" everything else UNBUILT, so it charges the COMPILED-NOT-PROMOTED column -- whose remedy is a\n" as *u8) 590 gv_puts(" cheap promote -- to the NEVER-COMPILED column, whose remedy is a full recompile. Only the\n" as *u8) 591 gv_puts(" NEVER-COMPILED figure supports the claim 'authored gates with NO binary exist'.\n" as *u8) 592 gv_puts("envelope: FLAT scan of runtime + runtime/_hdl_build under the DISCOVERED buildroot, same corpus\n" as *u8) 593 gv_puts(" as nx_gatebuilt_gate so the counts are directly comparable; compiled = _build/<t>.sov.elf OR\n" as *u8) 594 gv_puts(" /tmp/<t>.sov.elf; promoted = ../<t>.elf; classification only, NOTHING was built or promoted.\n" as *u8) 595 return 0 596 } 597 gv_puts("\nNX-GATESWEEP seen=" as *u8); gv_num(ctr[GS_C_SEEN]) 598 gv_puts(" attempted=" as *u8); gv_num(ctr[GS_C_ATTEMPT]) 599 gv_puts(" BUILT=" as *u8); gv_num(ctr[GS_C_BUILT]) 600 gv_puts(" FAILED=" as *u8); gv_num(ctr[GS_C_FAILED]) 601 gv_puts(" TIMEOUT=" as *u8); gv_num(ctr[GS_C_TIMEOUT]) 602 gv_puts(" ANOMALY=" as *u8); gv_num(ctr[GS_C_ANOMALY]) 603 gv_puts(" skip-existing=" as *u8); gv_num(ctr[GS_C_EXISTS]) 604 gv_puts(" not-reached=" as *u8); gv_num(ctr[GS_C_SKIPPED]) 605 gv_puts(" admission-waits=" as *u8); gv_num(ctr[GS_C_WAITED]) 606 if ctr[GS_C_PAUSED] == 1 { gv_puts(" PAUSED=yes(admission-closed;resume-with-same-args-the-journal-makes-it-idempotent)" as *u8) } 607 var permil: i64 = 0 608 if ctr[GS_C_ATTEMPT] > 0 { permil = ctr[GS_C_BUILT] * 1000 / ctr[GS_C_ATTEMPT] } 609 gv_puts(" compile_permil=" as *u8); gv_num(permil) 610 if cfg[GS_K_MODE] == 1 { gv_puts(" (unused in verdicts mode)" as *u8) } 611 gv_puts("\n" as *u8) 612 gv_puts("envelope: FLAT scan of runtime + runtime/_hdl_build under the DISCOVERED buildroot (no recursion,\n" as *u8) 613 gv_puts(" shadow trees excluded -- same corpus as nx_gatebuilt_gate so the counts are comparable);\n" as *u8) 614 gv_puts(" bounded by max, resumable by skip, every build deadline-bounded; COMPILE ONLY -- nothing was\n" as *u8) 615 gv_puts(" promoted, so this moves no gate from UNBUILT to built in the nx_gatebuilt_gate census.\n" as *u8) 616 gv_puts(" compile_permil is over ATTEMPTED, not over the corpus -- a partial sweep never implies the whole.\n" as *u8) 617 return 0 618}