code wiki / _hdl_build / nx_govern_sweep.nx
`nx_govern_sweep.nx` source

1// nx_govern_sweep.nx -- gov lane (F750). Governance sweep: reads a supervisor log TAIL and counts
2// respawn events = the CRASH-LOOP signature (a job dying instantly and respawned forever with NO
3// backoff) -- the anti-pattern vs the SOTA Kubernetes reconciliation loop (observe->compare-to-desired
4// ->correct with EXPONENTIAL BACKOFF; requeue on repeated failure). Detect-and-report, fail-closed on
5// ungoverned churn. Declares its window (scale-law). No hardware writes (Rule 26).
6//   nx_govern_sweep respawns <logpath> [threshold]
7// exit: 0 GOVERNED | 3 UNGOVERNED (crash-loop: respawns>threshold) | 4 ABSENT | 2 usage.
8// license_tier: ORIGINAL   expect_exit: 0
9import "nx_syscalls.nx"
10import "nx_itoa_lib.nx"   // shared MSB-first emitter (zero-alloc)
11import "nx_logtail.nx"    // shared HONEST TAIL READER. This organ's OWN gv_tail was one of the five
12                          // hand-rolled copies that justified extracting the lib -- and it was the copy
13                          // that CORRECTED the lib twice: it already used sys_lseek to size the file (the
14                          // lib had streamed the whole thing on a rationale I never checked) and it already
15                          // returned -1 for an absent file (the lib had collapsed absent into empty, which
16                          // would have turned this organ's verdict=ABSENT into GOVERNED over zero bytes).
17                          // MATCH THE KNOWN GOOD FIRST -- it is also the thing most likely to correct you.
18const K_MAGIC_262144: i64 = 262144
19
20func gv_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
21// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer
22// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the
23// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls).
24// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign.
25func gv_wn(fd: i64, v: i64) -> i64 { nxi_fd(fd, v); return 0 }
26func gv_atoi(s: *u8) -> i64 { var v: i64 = 0; var i: i64 = 0; while s[i] != (0 as u8) { let c: i64 = s[i]; if c < 48 { i = i + 1 } else { if c > 57 { i = i + 1 } else { v = v * 10 + (c - 48); i = i + 1 } } } return v }
27// gv_tail RETIRED 2026-08-06 -> runtime/nx_logtail.nx lt_read_tail. It was CORRECT about the two things
28// that matter most (seek to sz-win, and -1 for absent) and is the reason the shared lib now does both.
29// What it lacked, and what the caller below now gains for free: a declared envelope, and a record-boundary
30// trim so a tail window starting mid-line cannot split the "-> respawn" needle across the first byte and
31// silently undercount by one.
32func gv_count(buf: *u8, n: i64, pat: *u8) -> i64 {
33    var pl: i64 = 0
34    while pat[pl] != (0 as u8) { pl = pl + 1 }
35    if pl == 0 { return 0 }
36    var c: i64 = 0
37    var i: i64 = 0
38    while i + pl <= n {
39        var k: i64 = 0
40        var m: i64 = 1
41        while k < pl { if buf[i + k] != pat[k] { m = 0; k = pl } else { k = k + 1 } }
42        if m == 1 { c = c + 1; i = i + pl } else { i = i + 1 }
43    }
44    return c
45}
46func main(argc: i64, argv: *i64) -> i64 {
47    if argc < 3 { gv_w(2, "usage: nx_govern_sweep respawns <logpath> [threshold]\n" as *u8); sys_exit(2); return 2 }
48    let logpath: *u8 = argv[2] as *u8
49    var thr: i64 = 20
50    if argc >= 4 { thr = gv_atoi(argv[3] as *u8) }
51    let win: i64 = K_MAGIC_262144
52    let buf: *u8 = sys_mmap(win + 16)
53    let env: *i64 = sys_mmap(64) as *i64
54    let n: i64 = lt_read_tail(logpath, buf, win, env)
55    if n < 0 { gv_w(1, "GOVERN-SWEEP verdict=ABSENT path=" as *u8); gv_w(1, logpath); gv_w(1, "\n" as *u8); sys_exit(4); return 4 }
56    let cnt: i64 = gv_count(buf, n, "-> respawn" as *u8)
57    gv_w(1, "GOVERN-SWEEP respawns=" as *u8); gv_wn(1, cnt)
58    gv_w(1, " threshold=" as *u8); gv_wn(1, thr)
59    // window_bytes KEPT VERBATIM (rule 19 -- something may already parse it) and the real envelope ADDED
60    // beside it. This organ's header claims it "declares its window (scale-law)", and it did print
61    // window_bytes -- but that was the bytes READ, with no file size and no truncation flag, so respawns=N
62    // was a count over an UNDECLARED FRACTION and threshold=20 was calibrated against an unknown
63    // denominator. A GOVERNED verdict taken from the last 256KB of a 50MB supervisor log now reads
64    // differently from one taken over the whole file, which is the entire point of declaring coverage.
65    gv_w(1, " window_bytes=" as *u8); gv_wn(1, n)
66    gv_w(1, " file_bytes=" as *u8); gv_wn(1, env[0])
67    gv_w(1, " scanned=" as *u8); gv_wn(1, env[1])
68    gv_w(1, " dropped_oldest=" as *u8); gv_wn(1, env[2])
69    gv_w(1, " coverage_complete=" as *u8); gv_wn(1, lt_complete(env))
70    if cnt > thr {
71        gv_w(1, " verdict=UNGOVERNED (crash-loop: respawn WITHOUT backoff -- vs K8s reconcile exp-backoff SOTA; add circuit-breaker/quarantine)\n" as *u8)
72        sys_exit(3)
73        return 3
74    }
75    gv_w(1, " verdict=GOVERNED\n" as *u8)
76    sys_exit(0)
77    return 0
78}
nx_govern_sweep.nx source

`nx_govern_sweep.nx` source
