nx_gateemit_gate.nx source
↩ module page · 214 lines · 10699 B
1// nx_gateemit_gate.nx -- WHAT FRACTION OF PROMOTED GATES CAN BE READ BY A RULER?
2//
3// R4 of the SOTA plan asks that every gate be non-vacuous: able to fail, and able to prove it looked.
4// That cannot be CLAIMED fleet-wide without being MEASURED fleet-wide -- which is the same mistake the
5// whole coverage taxonomy is about. This measures it.
6//
7// THE EMIT CONTRACT a ruler needs (learned the hard way today, from my own gates being UNPARSED):
8// 1. `passed N/M verdict=` on stdout -- so nx_gateverify can parse a pass ratio
9// 2. a durable line in knowledge/status/ -- because stdout is watched for ten seconds and the LOG is
10// what every ruler reads forever
11// A gate missing either is CORRECT but INVISIBLE, and an invisible gate contributes nothing to any
12// rollup. I shipped four such gates today before noticing.
13//
14// ⚠⚠ THIS IS A STATIC PROXY AND SAYS SO. It greps the promoted BINARY for the emit strings. That proves
15// the gate CAN emit, not that it DOES on every path -- only running it proves that, and running 379
16// gates costs hours (one finance gate alone takes 156s). Binary presence is a LOWER BOUND on capability
17// and an UPPER BOUND on nothing. Cf. the recorded law: BINARY GREP IS VALID ONE WAY ONLY -- a string's
18// PRESENCE is evidence it shipped; a string's ABSENCE is the only thing this can assert about emit.
19// The authoritative per-gate check remains nx_gateverify, which RUNS the gate and compares printed vs
20// logged. This is the cheap sweep that tells you WHERE to point it.
21//
22// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
23// D001 MIGRATE-ON-TOUCH, applied to this gate BY ITS OWN SUBJECT MATTER. The promote chokepoint refused
24// an earlier revision with: "this gate rolls its own verdict instead of inheriting nx_gate_verdict, so
25// nothing can read its outcome" -- i.e. the gate that MEASURES emit-contract adoption was itself only
26// MIMICKING the strings rather than inheriting the lib. Mimicry passes a grep and still leaves no
27// harness.jrnl frame, so flake and erosion stay invisible for it exactly as for the 307 it names.
28// ★★★★★★ EMITTING THE RIGHT STRING IS NOT THE SAME AS INHERITING THE CONTRACT -- one satisfies a
29// reader, the other joins the ledger. The enforcement caught me; that is the enforcement working.
30import "nx_syscalls.nx"
31import "nx_dirent.nx"
32import "nx_gate_verdict.nx"
33
34const GE_LOG: *u8 = "knowledge/status/gateemit_gate.log"
35const GE_MODE: i64 = 420
36const GE_CAP: i64 = 4194304
37
38func ge_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
39func ge_p(s: *u8) -> i64 { let n: i64 = ge_len(s); sys_write(1, s, n); return 0 }
40func ge_wf(fd: i64, s: *u8) -> i64 { let n: i64 = ge_len(s); sys_write(fd, s, n); return 0 }
41func ge_pn(v: i64) -> i64 {
42 let t: *u8 = sys_mmap(32)
43 var m: i64 = v
44 if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m }
45 var k: i64 = 0
46 if m == 0 { t[0] = 48 as u8; k = 1 }
47 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
48 var j: i64 = k - 1
49 while j >= 0 { sys_write(1, ((t as i64) + j) as *u8, 1); j = j - 1 }
50 return 0
51}
52func ge_pnf(fd: i64, v: i64) -> i64 {
53 let t: *u8 = sys_mmap(32)
54 var m: i64 = v
55 var k: i64 = 0
56 if m == 0 { t[0] = 48 as u8; k = 1 }
57 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
58 var j: i64 = k - 1
59 while j >= 0 { sys_write(fd, ((t as i64) + j) as *u8, 1); j = j - 1 }
60 return 0
61}
62
63func ge_has(buf: *u8, n: i64, needle: *u8) -> i64 {
64 let m: i64 = ge_len(needle)
65 if m == 0 { return 0 }
66 if n < m { return 0 }
67 var i: i64 = 0
68 while i + m <= n {
69 var eq: i64 = 1
70 var j: i64 = 0
71 while j < m { if buf[i + j] != needle[j] { eq = 0; j = m } else { j = j + 1 } }
72 if eq == 1 { return 1 }
73 i = i + 1
74 }
75 return 0
76}
77
78// name ends with `_gate.elf`?
79func ge_is_gate(nm: *u8) -> i64 {
80 let n: i64 = ge_len(nm)
81 if n < 9 { return 0 }
82 let s: *u8 = ((nm as i64) + n - 9) as *u8
83 let w: *u8 = "_gate.elf" as *u8
84 var i: i64 = 0
85 while i < 9 { if s[i] != w[i] { return 0 } i = i + 1 }
86 return 1
87}
88
89func main() -> i64 {
90 ge_p("=== nx_gateemit_gate -- can a ruler READ the promoted gates? (R4) ===\n" as *u8)
91
92 let buf: *u8 = sys_mmap(GE_CAP)
93 let path: *u8 = sys_mmap(512)
94
95 var seen: i64 = 0
96 var readable: i64 = 0
97 var has_ratio: i64 = 0
98 var has_log: i64 = 0
99 var both: i64 = 0
100 var named: i64 = 0
101
102 let dfd: i64 = sys_openat_rd("." as *u8)
103 if dfd < 0 {
104 ge_p(" VERDICT=RED cannot open cwd -- measured nothing\n" as *u8)
105 return 3
106 }
107 let dbuf: *u8 = sys_mmap(262144)
108 var go: i64 = 1
109 while go == 1 {
110 let n: i64 = sys_getdents64(dfd, dbuf, 262144)
111 if n <= 0 { go = 0 } else {
112 var off: i64 = 0
113 while off < n {
114 // dirent helpers take a RECORD POINTER, not (buffer, offset) -- verified in nx_syscalls.nx
115 // rather than inferred. Guessing a signature is how a build fails for a reason unrelated
116 // to the change being made.
117 let rec: *u8 = ((dbuf as i64) + off) as *u8
118 let rl: i64 = dirent_reclen(rec)
119 let nm: *u8 = dirent_name(rec)
120 if ge_is_gate(nm) == 1 {
121 seen = seen + 1
122 var o: i64 = 0
123 while nm[o] != (0 as u8) { path[o] = nm[o]; o = o + 1 }
124 path[o] = 0 as u8
125 let fd: i64 = sys_openat_rd(path)
126 if fd >= 0 {
127 let rd: i64 = sys_read(fd, buf, GE_CAP - 1)
128 sys_close(fd)
129 if rd > 0 {
130 readable = readable + 1
131 // `verdict=` alone is common prose; the RATIO is what a ruler parses.
132 let r: i64 = ge_has(buf, rd, "passed " as *u8)
133 let l: i64 = ge_has(buf, rd, "knowledge/status/" as *u8)
134 if r == 1 { has_ratio = has_ratio + 1 }
135 if l == 1 { has_log = has_log + 1 }
136 if r == 1 { if l == 1 { both = both + 1 } }
137 // NAME THE NON-CONFORMING GATES. A count of 307 is a statistic; a NAMED LIST
138 // is a worklist someone can start on this afternoon. Capped at 20 so the
139 // output stays readable -- and the cap is DECLARED below, never silent,
140 // because a truncated list that looks complete is its own lie.
141 var conform: i64 = 0
142 if r == 1 { if l == 1 { conform = 1 } }
143 if conform == 0 {
144 if named < 20 {
145 ge_p(" NO-EMIT " as *u8); ge_p(nm)
146 if r == 0 { ge_p(" (no pass ratio)" as *u8) }
147 if l == 0 { ge_p(" (no status log)" as *u8) }
148 ge_p("\n" as *u8)
149 named = named + 1
150 }
151 }
152 }
153 }
154 }
155 if rl <= 0 { off = n } else { off = off + rl }
156 }
157 }
158 }
159 sys_close(dfd)
160
161 ge_p(" promoted *_gate.elf seen = " as *u8); ge_pn(seen); ge_p("\n" as *u8)
162 ge_p(" readable = " as *u8); ge_pn(readable); ge_p("\n" as *u8)
163 ge_p(" carry a pass RATIO = " as *u8); ge_pn(has_ratio); ge_p("\n" as *u8)
164 ge_p(" carry a status LOG path = " as *u8); ge_pn(has_log); ge_p("\n" as *u8)
165 ge_p(" carry BOTH (ruler-readable) = " as *u8); ge_pn(both); ge_p(" <-- the R4 number\n" as *u8)
166 if readable > 0 {
167 ge_p(" EMIT COVERAGE = " as *u8); ge_pn((both * 1000) / readable); ge_p(" permil of readable gates\n" as *u8)
168 }
169
170 // NON-VACUITY: finding zero gates on a host with hundreds means the SCAN failed, not that the fleet
171 // is empty -- the failure mode this whole rung exists to make impossible.
172 if seen <= 0 {
173 ge_p(" VERDICT=RED zero *_gate.elf found -- the scan is broken, not the fleet empty\n" as *u8)
174 return 1
175 }
176 if readable <= 0 {
177 ge_p(" VERDICT=RED found gates but read NONE -- measured nothing\n" as *u8)
178 return 2
179 }
180
181 ge_p("\n STATIC PROXY, STATED PLAINLY: this greps the BINARY, so it proves a gate CAN emit, not that\n" as *u8)
182 ge_p(" it DOES on every path. Running 379 gates costs hours (one finance gate alone takes 156s).\n" as *u8)
183 ge_p(" Absence here is the strong signal; presence is a lower bound. nx_gateverify is the\n" as *u8)
184 ge_p(" authoritative per-gate check -- it RUNS the gate and compares printed against logged.\n" as *u8)
185 // The subject numbers stay in this gate's own durable log (they are a MEASUREMENT, not teeth), while
186 // the VERDICT goes through nx_gate_verdict so nx_gate_green can judge it and a harness.jrnl frame
187 // exists for flake and erosion tracking.
188 let lg: i64 = sys_openat_append(GE_LOG, GE_MODE)
189 if lg >= 0 {
190 ge_wf(lg, "NX-GATEEMIT-GATE gates=" as *u8); ge_pnf(lg, seen)
191 ge_wf(lg, " readable=" as *u8); ge_pnf(lg, readable)
192 ge_wf(lg, " ratio=" as *u8); ge_pnf(lg, has_ratio)
193 ge_wf(lg, " log=" as *u8); ge_pnf(lg, has_log)
194 ge_wf(lg, " both=" as *u8); ge_pnf(lg, both)
195 ge_wf(lg, "\n" as *u8)
196 sys_close(lg)
197 }
198
199 // TEETH via the LIB: the scan reached real gates, and it read at least one. Both are assertions about
200 // THIS instrument, never about the fleet's coverage -- a low emit-coverage number is a BACKLOG.
201 let ctr: *i64 = gv_ctr()
202 gv_head("nx_gateemit_gate -- can a ruler READ the promoted gates?" as *u8)
203 // gv_check takes a BOOLEAN, not a count -- passing the raw 414 read as FAIL because it is not 1.
204 // Verified against the exemplar (which passes a cg_eq comparison), not inferred from the name.
205 var t1: i64 = 0
206 if seen > 0 { t1 = 1 }
207 var t2: i64 = 0
208 if readable > 0 { t2 = 1 }
209 gv_check("T1 the scan reached real *_gate.elf binaries (zero would mean the scan broke, not the fleet empty)" as *u8, t1, ctr)
210 gv_check("T2 at least one was readable (found-but-unreadable measures nothing)" as *u8, t2, ctr)
211 let rc: i64 = gv_verdict("GATEEMIT-GATE" as *u8, ctr, "emit coverage is REPORTED, not graded -- the fleet number is a backlog, the teeth are about the scan" as *u8)
212 sys_exit(rc)
213 return rc
214}