code wiki / _hdl_build / nx_ims_batch1.nx
nx_ims_batch1.nx source
↩ module page · 77 lines · 10777 B
1// nx_ims_batch1.nx -- INGEST batch #1: 4 REAL active-arc pages, each rendered through
2// the ONE reusable generator nx_ims_page (NOT a per-page cloned emitter). This is the
3// proof that real Nishi content becomes walkable typed wiki pages AT SCALE: 4 distinct
4// pages, 1 generator, 0 furniture re-written. Summaries are GENUINE (from the live arc
5// memory files); each page's nav relationships come from its wiki_links.tsv row so it
6// is part of the walkable tree. Writes web_assets/{genesis_genealogy,access_wall,
7// formats_uxf,media_studio}.html. Publish is a SEPARATE guarded+versioned step
8// (nx_ims_batch1_publish via vpub). license_tier: ORIGINAL
9import "nx_ims_page.nx"
10import "nx_syscalls.nx"
11
12func b_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
13func b_num(v: i64) -> i64 {
14 let bb: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m }
15 let t: *u8 = sys_mmap(28); var k: i64 = 0
16 if m == 0 { t[0] = 48 as u8; k = 1 }
17 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
18 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 }
19 sys_write(1, bb, k); return 0
20}
21
22func b_emit(slug: *u8, doc_type: *u8, title: *u8, body: *u8) -> i64 {
23 let w: i64 = ims_page(slug, doc_type, title, body)
24 b_w(" ims_page("); b_w(slug); b_w(", "); b_w(doc_type); b_w(") -> bytes="); b_num(w); b_w("\n")
25 if w > 0 { return 0 }
26 return 0 - 1
27}
28
29func main() -> i64 {
30 b_w("=== IMS BATCH #1: 4 real arc pages via the ONE reusable generator ===\n")
31 var ok: i64 = 0
32
33 // ---------- 1) GENESIS GENEALOGY (explanation) ----------
34 let genesis_body: *u8 =
35"<p>The <strong>genesis genealogy</strong> is the Nishi tech-tree's spine: a single unbroken lineage from <strong>god</strong> (origination — <em>any</em> hardware, not one chip) down through ISA, toolchain, organs, OS, math, AI and apps to the <strong>IO endpoint</strong> (the app⇄IO loop closed with a human or machine). adam=1 / eve=0; <strong>fragmentation</strong> axes are the vendor-lock points (driver, accel, firmware, simd, math, ai, crypto, wire, format); <strong>unification</strong> layers span them so a capability runs on every machine. No node is an orphan, floater, or purposeless — both directions are whole.</p>\n"
36"<p>It is computed, not asserted. The data lives in <code>genesis_lineage.tsv</code> (47+ nodes across 11 fragmentation axes) and the tracer <code>nx_genesis_trace</code> walks it; the gate runs <strong>GREEN 9/9</strong> (chain-whole + at-least-one-axis-unified + zero never-brick violations). <code>nx_genesis_live</code> re-derives a per-host driver-sovereignty census from the live PCI probe, so coverage is measured per machine.</p>\n"
37"<h3>Never-brick (Rule 26, absolute, brand-critical)</h3>\n"
38"<p>No Nishi capability may EVER brick electronics — no firmware/UEFI/CMOS/SPI-flash corruption, no Red-Ring-of-Death. Any operation that writes persistent hardware state must be read-only, reversible, or fail-safe <em>by construction</em>, and proven mechanically (the genesis gate flags any firmware-axis node lacking a never-brick guarantee → VERDICT RED). The whole never-brick chain was EXECUTED end-to-end on a real artifact: A/B banks + immutable factory + atomic-commit selector, ed25519-signed UEFI capsules (forgery-resistant, not just checksum), fault-injected at every step, recovering the real <code>nx_boot_uefi.efi</code> byte-exact and booting it (rc=0) in the emulator. Honest limit: the capsule auth is sovereign ed25519, not UEFI PKCS7/SecureBoot, and the bench is an emulator, not silicon.</p>\n"
39"<p>See the <a href=\"/wiki/charter.html\">Graceful Evolution Charter</a> for why the tree exists (telos = multiply & replenish), and the related substrate arcs below.</p>\n"
40 if b_emit("genesis_genealogy" as *u8, "explanation" as *u8, "Genesis Genealogy — god to IO endpoint" as *u8, genesis_body) == 0 { ok = ok + 1 }
41
42 // ---------- 2) ACCESS WALL (howto) ----------
43 let access_body: *u8 =
44"<p>The <strong>access-provisioning wall</strong> is one unified, deny-by-default decision point for identity + network-context + device/IP provisioning + DDoS resistance, per site-area. It is a layered <strong>zero-trust</strong> design grounded in real sourced research (NIST SP 800-207, Google BeyondCorp, RFC 8446 mTLS, WireGuard, RFC 4987 SYN-cookies, OWASP, Cloudflare): the sovereign researcher confirmed 14 gap-tasks and refuted perimeter-trust, ip-allowlist-only, and security-by-obscurity. <strong>10 access gates run GREEN.</strong></p>\n"
45"<h3>How to admit a request (the layers, in order)</h3>\n"
46"<ol>\n"
47"<li><strong>L0 flood control</strong> — SYN-cookies + per-IP connection cap (<code>nx_conn_cap</code>, fail-closed on saturation).</li>\n"
48"<li><strong>L1 network tier</strong> — classify the peer IP as PUBLIC / LAN / VPN by CIDR (<code>nx_cidr</code> + <code>nx_nettier</code>); trust is deny-by-default.</li>\n"
49"<li><strong>L2 identity</strong> — authenticate (<code>nx_cms_admin</code>); elderly-friendly passkey + social-recovery path available.</li>\n"
50"<li><strong>L3 device</strong> — ed25519 challenge-response device certificate (<code>nx_device_cert</code>, RFC 8032 KAT) so you can provision a device over the internet, spoof-proof.</li>\n"
51"<li><strong>L4 rate</strong> — token-bucket rate limit + L7 hashcash proof-of-work (<code>nx_pow_challenge</code>).</li>\n"
52"<li><strong>L5 policy decision</strong> — the PDP (<code>nx_access_wall</code>) composes the ACL evaluator + tier + device verdict, fail-closed, with per-layer deny codes.</li>\n"
53"<li><strong>L6 audit</strong> — every decision is appended to a tamper-evident hash-chained log (<code>nx_access_audit</code>); editing/reordering breaks the chain.</li>\n"
54"</ol>\n"
55"<p>The enforcement glue <code>nx_access_pep</code> composes classify + device-verify + decide into one call. Measured exceed vs Cloudflare Access / Tailscale / AWS-WAF = <strong>sovereign</strong> (auth never leaves your hardware), zero-trust correctness 5/5 vs perimeter 2/5 (referee-computed). <strong>Honest behind:</strong> Tbps volumetric DDoS needs an upstream — a home NAS cannot absorb it, and we say so. Only the production cutover (the live daemon calling <code>pep_decide</code> per request) remains. Built on the same substrate as the <a href=\"/wiki/genesis_genealogy.html\">genesis genealogy</a>.</p>\n"
56 if b_emit("access_wall" as *u8, "howto" as *u8, "Access Wall — zero-trust provisioning" as *u8, access_body) == 0 { ok = ok + 1 }
57
58 // ---------- 3) FORMATS / UXF (explanation) ----------
59 let uxf_body: *u8 =
60"<p>The <strong>Unified Extensible Format family (UXF)</strong> aims to replace the project's TSVs and, more ambitiously, <em>all</em> formats (data, media, document, config, archive) with ONE envelope. The thesis is retrieval-first and <strong>content-addressed</strong> (IPLD-style CIDs): self-describing immutable blocks + capability-negotiated views + a separately-versioned codec/transform registry. That single mechanism delivers four properties at once — <strong>endpoint-adaptive</strong> (Chrome can't play MKV → remux losslessly), <strong>translatable</strong> (no walled garden — lossless export targets), <strong>extensible</strong> (data and functionality are decoupled), and <strong>upgrade-safe</strong> (a tolerant reader, so no fragile house of cards).</p>\n"
61"<h3>What is proven</h3>\n"
62"<p>~8 UXF gates run GREEN sovereign (known-answer tests + negative controls). The foundation reuses the existing content-addressed store (<code>canon_cid</code> CID + <code>seg_store</code>) rather than reinventing it. Demonstrated end-to-end across a DATA profile and a MEDIA profile: self-describing multicodec CIDs, a tolerant reader (the house-of-cards fix), TSV migration, persist-and-retrieve-by-CID <strong>byte-faithful 18/18</strong>, a measured store (~752k records/s, ~474 ns get), endpoint-adaptive negotiation (MKV→Chrome remux, lossless), and a media asset carried through the envelope.</p>\n"
63"<p>The exceed goal is measured (never self-graded) vs Windows / Ubuntu / Apple / Google formats, toward a physics-optimum via the genealogist. <strong>Honest next (heavier):</strong> real remux/transcode execution, production scale + wiring to the durable knowledge store, and the doc/config/archive profiles. Content-addressing also means no link-rot — the same anchor the <a href=\"/wiki/access_wall.html\">access wall</a>'s versioned records rely on.</p>\n"
64 if b_emit("formats_uxf" as *u8, "explanation" as *u8, "UXF — the Unified Extensible Format family" as *u8, uxf_body) == 0 { ok = ok + 1 }
65
66 // ---------- 4) MEDIA STUDIO (explanation) ----------
67 let media_body: *u8 =
68"<p>The <strong>Nishi Media Studio</strong> arc brings camera recording into Nishi natively and adds S-class video analysis and editing: position/pose analysis, TiVo-style dead-air / recording-flag trimming, multi-recording stitching with transitions, subtitling, and voice-PRESERVING real-time translation. It is built methodically, one hardware-rung at a time.</p>\n"
69"<h3>Where it is (measured, honest)</h3>\n"
70"<p><strong>Video</strong> rungs R0–R3 are GREEN: dead-air frame-activity detection; a recording loop that REUSED the existing perceptual-hash organ (dHash+aHash, zero new code); presence/skin detection (Kovac + bbox concentration); and a non-destructive TiVo trim-plan (bridge + drop). <strong>Audio</strong> A0 (ASR) is the missing keystone — the current stack is text→speech only, so speech→text is a research gap before subtitle (A1) and voice-preserving machine translation (A2); the output side (g2p, voice-read, voiceprint) already exists. Four organs are registered.</p>\n"
71"<p><strong>Operator boundary (explicit):</strong> BUILD a preference scorer over the user's OWN media + shareable preference-profiles + a soft-hide floor; DECLINE automatic camera/Reddit monitoring and cross-site person re-identification. The remaining integration gap is real-video DECODE→frames. Pose/preference scoring is general-purpose (including medical and NSFW), gated by that boundary. Shares the family-video product line with <a href=\"/wiki/products.html\">the catalog</a> and the <a href=\"/wiki/econsim.html\">econsim</a> publish loop.</p>\n"
72 if b_emit("media_studio" as *u8, "explanation" as *u8, "Media Studio — cam recording + S-class video" as *u8, media_body) == 0 { ok = ok + 1 }
73
74 b_w("=== emitted "); b_num(ok); b_w("/4 real arc pages via nx_ims_page ===\n")
75 if ok == 4 { sys_exit(0); return 0 }
76 sys_exit(1); return 1
77}