nx_gltf2mesh_units_gate.nx source

1// nx_gltf2mesh_units_gate.nx -- THE GATE FOR UNIT DETERMINATION IN THE glTF INGEST. 2// 3// WHAT IT GUARDS. nx_gltf2mesh used to carry a hardcoded 500-2500mm window and refuse anything 4// outside it. That window was ANTHROPOMETRY -- "the subject is a HUMAN between 0.5 and 2.5 metres" 5// -- welded into a FORMAT CONVERTER. Measured 2026-08-22 over the full 18-file GLB population 6// (corpus_complete=1) it refused 2 of 18 assets, both a legitimate 2.615 m character, for being 7// 115 mm too tall. glTF 2.0 fixes the unit of length as the METRE, so a conformant donor needs no 8// guessing at all; the sniffing exists only for donors authored in another power of 1000. 9// 10// THE SUBJECT IS FORKED FOR REAL. The organ's contract is its EXIT CODE (0 convert, 8 refuse-units, 11// 2 usage) and /api/gate_run derives verdicts from exit codes, so every tooth here asserts an exit 12// code. Output markers are checked only where the exit code alone cannot distinguish two states. 13// 14// THE NEGATIVE CONTROL IS LOAD-BEARING AND IT IS T4. A guard that ACCEPTS EVERYTHING passes every 15// accept-test, so proving "the 2.615 m human now converts" is only half a proof. T4 forces the 16// refusal branch by pointing the organ at a /tmp conf whose floor no scale can clear, and gv_bite 17// judges T1 and T4 together: it must fire on the bad input AND stay silent on the good one. 18// 19// FIXTURES ARE /tmp ONLY. The organ's units_conf= override exists precisely so this gate never 20// edits the production conf -- a gate that shares a fixture with a production beat reports on the 21// fixture rather than on the code, which is how a RED can track scratch state instead of a defect. 22// 23// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0 24import "nx_syscalls.nx" 25import "nx_gate_verdict.nx" 26import "nx_tool_run.nx" 27 28const UG_SUBJECT_DEFAULT: *u8 = "_offc/nx_gltf2mesh.elf" 29 30// the organ's exit contract, restated so a change to it BREAKS THIS GATE loudly rather than quietly 31const UG_EXIT_OK: i64 = 0 32const UG_EXIT_REFUSE_UNIT: i64 = 8 33 34// REAL donors, absolute because nx_sov_build_run anchors CWD to buildroot/ and a relative path 35// would silently resolve to nothing -- which reads as "the organ refused" instead of "the gate 36// pointed at a file that is not there". 37const UG_HUMAN: *u8 = "/volume1/homes/elderwesto/nishihost/sites/nishifamily/synth/human.glb" 38const UG_ELF: *u8 = "/volume1/homes/elderwesto/nishihost/sites/nishifamily/synth/elf.glb" 39 40const UG_DIR: *u8 = "/tmp/nx_gltf2mesh_units_gate" 41const UG_CONF_REAL: *u8 = "/tmp/nx_gltf2mesh_units_gate/real.conf" 42const UG_CONF_ABSURD:*u8 = "/tmp/nx_gltf2mesh_units_gate/absurd.conf" 43const UG_CONF_NONE: *u8 = "/tmp/nx_gltf2mesh_units_gate/no_such_conf_at_all" 44const UG_OUT_HUMAN: *u8 = "/tmp/nx_gltf2mesh_units_gate/human.nxmesh" 45const UG_OUT_ELF: *u8 = "/tmp/nx_gltf2mesh_units_gate/elf.nxmesh" 46const UG_OUT_NEG: *u8 = "/tmp/nx_gltf2mesh_units_gate/neg.nxmesh" 47const UG_OUT_DFLT: *u8 = "/tmp/nx_gltf2mesh_units_gate/dflt.nxmesh" 48const UG_BADMAGIC: *u8 = "/tmp/nx_gltf2mesh_units_gate/not_a_glb.bin" 49const UG_OUT_BAD: *u8 = "/tmp/nx_gltf2mesh_units_gate/bad.nxmesh" 50 51const UG_ARG_REAL: *u8 = "units_conf=/tmp/nx_gltf2mesh_units_gate/real.conf" 52const UG_ARG_ABSURD: *u8 = "units_conf=/tmp/nx_gltf2mesh_units_gate/absurd.conf" 53const UG_ARG_NONE: *u8 = "units_conf=/tmp/nx_gltf2mesh_units_gate/no_such_conf_at_all" 54 55// The absurd floor is 100 km in millimetres. It is not a tuned number: it is simply larger than any 56// power-of-1000 division of a real donor can reach, which is exactly what makes the refusal branch 57// reachable on demand. If a future asset could clear it, the tooth would go vacuous -- and T5 would 58// catch that, because T5 asserts the refusal actually happened rather than assuming it. 59const UG_CONF_REAL_TXT: *u8 = "sliver_floor_mm=100\n" 60const UG_CONF_ABSURD_TXT: *u8 = "sliver_floor_mm=100000000\n" 61const UG_BADMAGIC_TXT: *u8 = "this is definitely not a binary glTF container\n" 62 63const UG_CAPTURE_CAP: i64 = 262144 64const UG_ARGV_SLOTS: i64 = 8 65const UG_MODE_DIR: i64 = 493 // 0755 66const UG_WORD: i64 = 8 67const UG_MIN_MESH_BYTES: i64 = 1000 // a real conversion of a 2530-vertex donor is >100 kB; 68 // this only has to exclude an empty or header-only file 69 70func ug_write_text(path: *u8, s: *u8) -> i64 { 71 var n: i64 = 0 72 while s[n] != 0 { n = n + 1 } 73 let fd: i64 = sys_openat_wr(path, MODE_0644) 74 if fd < 0 { return 0 - 1 } 75 let wr: i64 = sys_write(fd, s, n) 76 sys_close(fd) 77 if wr != n { return 0 - 1 } 78 return n 79} 80// file size, or -1 when absent. Used to prove a conversion PRODUCED something, not merely exited 0. 81func ug_size(path: *u8) -> i64 { 82 let lp: *i64 = sys_mmap(UG_WORD*2) as *i64 83 let b: *u8 = sys_read_file(path, lp) 84 if (b as i64) == 0 { return 0 - 1 } 85 return lp[0] 86} 87func ug_unlink(path: *u8) -> i64 { return sys_unlinkat(path) } 88 89// substring search over the captured stdout 90func ug_has(buf: *u8, n: i64, lit: *u8) -> i64 { 91 var m: i64 = 0 92 while lit[m] != (0 as u8) { m = m + 1 } 93 if m == 0 { return 0 } 94 var i: i64 = 0 95 while i + m <= n { 96 var k: i64 = 0 97 var ok: i64 = 1 98 while k < m { if buf[i+k] != lit[k] { ok = 0; k = m } else { k = k + 1 } } 99 if ok == 1 { return 1 } 100 i = i + 1 101 } 102 return 0 103} 104 105// fork the subject with (in, out, opt) and return the child exit code 106func ug_run(subject: *u8, a1: *u8, a2: *u8, a3: *u8, out: *u8, olen: *i64) -> i64 { 107 let av: *i64 = sys_mmap(UG_WORD*UG_ARGV_SLOTS) as *i64 108 av[0] = subject as i64 109 av[1] = a1 as i64 110 av[2] = a2 as i64 111 av[3] = a3 as i64 112 av[4] = 0 113 return tr_run_capture(subject, av, out, UG_CAPTURE_CAP, olen) 114} 115 116func main(argc: i64, argv: *i64) -> i64 { 117 let ctr: *i64 = gv_ctr() 118 gv_head("nx_gltf2mesh units gate -- glTF is metres; height is not a defect" as *u8) 119 var subject: *u8 = UG_SUBJECT_DEFAULT 120 if argc >= 2 { subject = argv[1] as *u8 } 121 gv_puts(" subject: " as *u8) 122 gv_puts(subject) 123 gv_puts("\n\n" as *u8) 124 125 // ---- SETUP. mkdir at setup, never teardown: a teardown does not run when a run crashes. 126 sys_mkdir(UG_DIR, UG_MODE_DIR) 127 // Remove every output this gate's subject might create. A gate that is not idempotent reports 128 // on its first run and lies about every run after -- an output left by an EARLIER run against 129 // an EARLIER binary satisfies an existence check forever. 130 ug_unlink(UG_OUT_HUMAN) 131 ug_unlink(UG_OUT_ELF) 132 ug_unlink(UG_OUT_NEG) 133 ug_unlink(UG_OUT_DFLT) 134 ug_unlink(UG_OUT_BAD) 135 let w1: i64 = ug_write_text(UG_CONF_REAL, UG_CONF_REAL_TXT) 136 let w2: i64 = ug_write_text(UG_CONF_ABSURD, UG_CONF_ABSURD_TXT) 137 let w3: i64 = ug_write_text(UG_BADMAGIC, UG_BADMAGIC_TXT) 138 var setup: i64 = 0 139 if w1 > 0 { if w2 > 0 { if w3 > 0 { setup = 1 } } } 140 gv_check("setup-confs-and-fixtures-written" as *u8, setup, ctr) 141 var clean: i64 = 0 142 if ug_size(UG_OUT_HUMAN) < 0 { if ug_size(UG_OUT_NEG) < 0 { clean = 1 } } 143 gv_check("setup-outputs-absent-before-measuring (gate is idempotent)" as *u8, clean, ctr) 144 // The donors must exist, or every tooth below measures the gate's own bad path. 145 var donors: i64 = 0 146 if ug_size(UG_HUMAN) > 0 { if ug_size(UG_ELF) > 0 { donors = 1 } } 147 gv_check("setup-real-donors-readable (human.glb + elf.glb)" as *u8, donors, ctr) 148 149 let cap: *u8 = sys_mmap(UG_CAPTURE_CAP) 150 let olen: *i64 = sys_mmap(UG_WORD*2) as *i64 151 152 // ---- T1: THE CASE THAT FAILED BEFORE. 2.615 m character must convert. 153 let rc1: i64 = ug_run(subject, UG_HUMAN, UG_OUT_HUMAN, UG_ARG_REAL, cap, olen) 154 gv_puts(" [T1] human.glb (2.615 m) rc=" as *u8) 155 gv_num(rc1) 156 gv_puts("\n" as *u8) 157 var t1: i64 = 0 158 if rc1 == UG_EXIT_OK { t1 = 1 } 159 gv_check("a-2615mm-character-converts (height is not a defect)" as *u8, t1, ctr) 160 161 // ---- T2: ANTI-VACUITY. Exiting 0 is not converting. An organ that returned 0 and wrote 162 // nothing would pass T1 forever; it cannot pass this. 163 let sz1: i64 = ug_size(UG_OUT_HUMAN) 164 gv_puts(" [T2] output bytes=" as *u8) 165 gv_num(sz1) 166 gv_puts("\n" as *u8) 167 var t2: i64 = 0 168 if sz1 >= UG_MIN_MESH_BYTES { t2 = 1 } 169 gv_check("anti-vacuity-conversion-actually-produced-a-mesh" as *u8, t2, ctr) 170 171 // ---- T3: NO REGRESSION. The millimetre-authored donor must still convert at scale_div=1000. 172 let rc3: i64 = ug_run(subject, UG_ELF, UG_OUT_ELF, UG_ARG_REAL, cap, olen) 173 let hasdiv: i64 = ug_has(cap, olen[0], "scale_div=1000" as *u8) 174 gv_puts(" [T3] elf.glb rc=" as *u8) 175 gv_num(rc3) 176 gv_puts(" scale_div=1000 seen=" as *u8) 177 gv_num(hasdiv) 178 gv_puts("\n" as *u8) 179 var t3: i64 = 0 180 if rc3 == UG_EXIT_OK { if hasdiv == 1 { t3 = 1 } } 181 gv_check("mm-authored-donor-still-scales-by-1000 (no regression)" as *u8, t3, ctr) 182 183 // ---- T4: THE NEGATIVE CONTROL, paired with T1. Point the organ at a floor no scale can clear 184 // and it MUST refuse. Without this, "everything converts" would score identically to a working 185 // guard, because a guard that accepts everything passes every accept-test. 186 let rc4: i64 = ug_run(subject, UG_HUMAN, UG_OUT_NEG, UG_ARG_ABSURD, cap, olen) 187 gv_puts(" [T4] absurd floor rc=" as *u8) 188 gv_num(rc4) 189 gv_puts("\n" as *u8) 190 var fired_bad: i64 = 0 191 if rc4 == UG_EXIT_REFUSE_UNIT { fired_bad = 1 } 192 var fired_good: i64 = 1 193 if rc1 == UG_EXIT_OK { fired_good = 0 } 194 gv_bite("neg-control-unreachable-floor-refuses-and-real-floor-admits" as *u8, fired_bad, fired_good, ctr) 195 196 // ---- T5: and the refusal must leave NO artifact. A refusal that still wrote a mesh would put 197 // a half-converted oracle on disk for a later reader to trust. 198 var t5: i64 = 0 199 if ug_size(UG_OUT_NEG) < 0 { t5 = 1 } 200 gv_check("refusal-writes-no-output-mesh" as *u8, t5, ctr) 201 202 // ---- T6: PROVENANCE IS ANNOUNCED. A bound whose source is unstated gets trusted as measured 203 // when it may be a built-in fallback. With a real conf it must say conf; with an absent one it 204 // must say builtin-default -- and it must still convert, because a missing conf is not a defect 205 // in the donor. 206 let rc6: i64 = ug_run(subject, UG_HUMAN, UG_OUT_DFLT, UG_ARG_NONE, cap, olen) 207 let saw_default: i64 = ug_has(cap, olen[0], "bounds_src=builtin-default" as *u8) 208 gv_puts(" [T6] absent conf rc=" as *u8) 209 gv_num(rc6) 210 gv_puts(" builtin-default announced=" as *u8) 211 gv_num(saw_default) 212 gv_puts("\n" as *u8) 213 var t6: i64 = 0 214 if rc6 == UG_EXIT_OK { if saw_default == 1 { t6 = 1 } } 215 gv_check("absent-conf-falls-back-AND-announces-builtin-default" as *u8, t6, ctr) 216 217 // ---- T7: the organ has not become permissive. A non-glTF file must still be refused. 218 let rc7: i64 = ug_run(subject, UG_BADMAGIC, UG_OUT_BAD, UG_ARG_REAL, cap, olen) 219 gv_puts(" [T7] bad-magic input rc=" as *u8) 220 gv_num(rc7) 221 gv_puts("\n" as *u8) 222 var t7: i64 = 0 223 if rc7 != UG_EXIT_OK { t7 = 1 } 224 gv_check("neg-control-non-gltf-input-still-refused" as *u8, t7, ctr) 225 226 // ---- T8: the subject actually ran. tr_run_capture returns a negative sentinel on a harness 227 // failure and 127 when execve could not find the ELF; either would make every exit-code tooth 228 // above compare against a number the subject never produced. 229 var ran: i64 = 1 230 if rc1 < 0 { ran = 0 } 231 if rc1 == 127 { ran = 0 } 232 gv_check("neg-control-subject-actually-executed (not 127, not a harness sentinel)" as *u8, ran, ctr) 233 234 let rc: i64 = gv_verdict("GLTF2MESH-UNITS" as *u8, ctr, "glTF is metres; the only bound left is a sliver floor, it is data, and its refusal is bitten" as *u8) 235 sys_exit(rc) 236 return rc 237}