code wiki / _hdl_build / nx_inputprobe.nx
nx_inputprobe.nx source
↩ module page · 191 lines · 10323 B
1// nx_inputprobe.nx -- WOULD THIS PRODUCER MEASURE A REAL WORLD FROM HERE?
2//
3// ★WHY (earned the hard way 2026-08-08, TWICE IN ONE SESSION, the second time after writing the law
4// down). A producer that reads CWD-RELATIVE resource paths does not fail loudly when run from the wrong
5// context -- it writes a CONFIDENT FALSE MEASUREMENT, and every freshness instrument then certifies that
6// false row as healthy:
7// nx_security_census wrote coverage_permil=87 over a true 456 (security FUNCTIONAL->TOY, 450->442)
8// because sc_have was a bare relative open.
9// nx_game_gen2 wrote types_available=0 verdict=RED over a true 6/GREEN
10// because gg_build_fsm reads knowledge/specs/build_<typ>.spec.
11// Both were caught only AFTER they had appended to the very log the maturity rollup grades from.
12// ★★A STALE-BUT-TRUE ROW IS WORTH MORE THAN A FRESH-BUT-FALSE ONE, AND ONLY A PRECHECK CAN TELL YOU
13// WHICH ONE YOU ARE ABOUT TO WRITE. Refreshing evidence is not automatically an improvement.
14//
15// So: extract every relative path literal from a producer's SOURCE and ask ar_resolve -- the estate's ONE
16// artifact-root resolver -- whether it resolves FROM THIS PROCESS'S WORKING DIRECTORY, which is the same
17// context the producer will run in.
18//
19// ⚠SCOPE, STATED RATHER THAN HIDDEN: this CANNOT distinguish an INPUT the organ must read from an OUTPUT
20// it will create -- an append target legitimately need not exist yet. It therefore reports EVERY relative
21// path with its status and leaves the judgement to the caller. Erring toward flagging is deliberate: the
22// failure it prevents is a false PUBLISHED GRADE; the cost of a false flag is one human read.
23// ⚠It reads the SOURCE, so it sees literals, not computed paths. A path assembled at runtime from pieces
24// is invisible to it. That is a floor on what it can catch, not a claim of completeness.
25//
26// nx_inputprobe <source.nx>
27// exit: 0 ALL-RESOLVE | 1 UNRESOLVED (do not trust a measurement written from here)
28// 2 usage | 3 NO-CONCLUSION (source unreadable, or the literal cap was hit -- never reported clean)
29// license_tier: ORIGINAL No hw writes (Rule 26).
30import "nx_syscalls.nx"
31import "nx_artifact_root.nx"
32
33const IP_SRC_CAP: i64 = 1048576
34const IP_PATH_CAP: i64 = 512
35const IP_MAX_LIT: i64 = 1024
36const IP_EXIT_UNRESOLVED: i64 = 1
37const IP_EXIT_USAGE: i64 = 2
38const IP_EXIT_NOCONCLUDE: i64 = 3
39
40func ip_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
41func ip_putn(v: i64) -> i64 {
42 if v == 0 { sys_write(1, "0" as *u8, 1); return 0 }
43 var m: i64 = v
44 if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m }
45 let t: *u8 = sys_mmap(32)
46 var k: i64 = 0
47 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
48 let o: *u8 = sys_mmap(32)
49 var i: i64 = 0
50 while i < k { o[i] = t[k - 1 - i]; i = i + 1 }
51 sys_write(1, o, k)
52 return 0
53}
54
55// Does this literal look like a RELATIVE resource path? Deliberately conservative in the direction of
56// LOOKING at more things: a missed path is a false clean, which is the failure mode that costs a grade.
57func ip_is_relpath(s: *u8, n: i64) -> i64 {
58 if n < 3 { return 0 }
59 if s[0] == (47 as u8) { return 0 } // absolute -- not CWD-dependent
60 var slash: i64 = 0
61 var i: i64 = 0
62 while i < n {
63 let c: i64 = s[i] as i64
64 if c == 47 { slash = 1 }
65 if c == 32 { return 0 } // prose, not a path
66 if c == 37 { return 0 } // format string
67 if c < 32 { return 0 }
68 i = i + 1
69 }
70 if slash == 0 { return 0 }
71 // a URL is not a CWD-relative path
72 let h: *u8 = "http"
73 if n >= 4 { if s[0] == h[0] { if s[1] == h[1] { if s[2] == h[2] { if s[3] == h[3] { return 0 } } } } }
74 return 1
75}
76
77func main(argc: i64, argv: *i64) -> i64 {
78 if argc < 2 {
79 ip_puts("usage: nx_inputprobe <source.nx> -- do this producer's relative paths resolve FROM HERE?\n" as *u8)
80 sys_exit(IP_EXIT_USAGE); return IP_EXIT_USAGE
81 }
82 let src: *u8 = argv[1] as *u8
83 let buf: *u8 = sys_mmap(IP_SRC_CAP)
84 let n: i64 = ar_read(src, buf, IP_SRC_CAP - 1)
85 ip_puts("=== nx_inputprobe -- would this producer measure a real world FROM THIS WORKING DIRECTORY? ===\n source: " as *u8)
86 ip_puts(src); ip_puts("\n" as *u8)
87 if n <= 0 {
88 ip_puts(" SOURCE UNREADABLE -- NO CONCLUSION IS AVAILABLE, in either direction.\n verdict=NO-CONCLUSION\n" as *u8)
89 sys_exit(IP_EXIT_NOCONCLUDE); return IP_EXIT_NOCONCLUDE
90 }
91
92 let lit: *u8 = sys_mmap(IP_PATH_CAP)
93 let res: *u8 = sys_mmap(IP_PATH_CAP)
94 var resolved: i64 = 0
95 var cwddep: i64 = 0
96 var unresolved: i64 = 0
97 var seen: i64 = 0
98 var capped: i64 = 0
99 var i: i64 = 0
100 while i < n {
101 if buf[i] == (34 as u8) {
102 // copy until the closing quote, honouring backslash escapes
103 var k: i64 = 0
104 var j: i64 = i + 1
105 var open: i64 = 1
106 while open == 1 {
107 if j >= n { open = 0 }
108 if j < n {
109 let c: i64 = buf[j] as i64
110 // ⚠ESCAPE TAIL LEAK -- FOUND BY MY OWN PROBE'S FIRST FALSE POSITIVE (2026-08-08).
111 // A blanket j+=2 is right for \n \t \\ \" but WRONG for \xNN, which is FOUR source
112 // characters. Skipping 2 left the "00" of \x00 in the literal, so
113 // data/mozilla_certdata.txt was reported as data/mozilla_certdata.txt00 and read
114 // UNRESOLVED -- a path that plainly exists (nx_research_fetch loads 167 CA roots from
115 // it). ★A DETECTOR WITH FALSE POSITIVES IS WORSE THAN NONE: it teaches the reader to
116 // skip the list, which is the one behaviour this organ exists to prevent.
117 if c == 92 {
118 var adv: i64 = 2
119 if j + 1 < n { if buf[j+1] == (120 as u8) { adv = 4 } } // \xNN
120 j = j + adv
121 }
122 if c == 34 { open = 0 }
123 if c != 92 { if c != 34 {
124 if k < IP_PATH_CAP - 1 { lit[k] = buf[j]; k = k + 1 }
125 j = j + 1
126 } }
127 }
128 }
129 lit[k] = 0 as u8
130 if ip_is_relpath(lit, k) == 1 {
131 seen = seen + 1
132 if seen > IP_MAX_LIT { capped = 1 }
133 if capped == 0 {
134 // ★THREE STATES, NOT TWO -- AND THE MIDDLE ONE IS THE WHOLE POINT.
135 // Asking only "can ar_resolve find it?" would have MISSED the incident that motivated
136 // this organ: nx_security_census used a BARE relative open, and ar_resolve finds
137 // runtime/nx_tls13.nx under root=buildroot/ -- so a two-state probe reports RESOLVES
138 // and hands back a FALSE CLEAN while the bare open still reads GAP from here.
139 // VERBATIM = ar_exists(lit): ANY organ finds it, bare open included.
140 // CWD-DEPENDENT = only ar_resolve finds it: an organ using a bare open WILL NOT, and
141 // that is precisely how a confident false measurement gets published.
142 // UNRESOLVED = nowhere reachable at all.
143 let verb: i64 = ar_exists(lit)
144 var ok: i64 = 0
145 if verb == 0 { ok = ar_resolve(lit, res) }
146 ip_puts(" " as *u8)
147 if verb == 1 { ip_puts("VERBATIM " as *u8); resolved = resolved + 1 }
148 if verb == 0 { if ok == 1 { ip_puts("CWD-DEPENDENT " as *u8); cwddep = cwddep + 1 } }
149 if verb == 0 { if ok != 1 { ip_puts("UNRESOLVED " as *u8); unresolved = unresolved + 1 } }
150 ip_puts(lit)
151 if verb == 0 { if ok == 1 { ip_puts(" (only via ar_resolve -> " as *u8); ip_puts(res); ip_puts(")" as *u8) } }
152 ip_puts("\n" as *u8)
153 }
154 }
155 i = j + 1
156 }
157 if buf[i] != (34 as u8) { i = i + 1 }
158 }
159
160 // NO SILENT CAPS: a truncated scan must never be reported as clean.
161 if capped == 1 {
162 ip_puts(" ⚠LITERAL CAP HIT -- the scan is PARTIAL, so absence of an unresolved path proves nothing.\n verdict=NO-CONCLUSION\n" as *u8)
163 sys_exit(IP_EXIT_NOCONCLUDE); return IP_EXIT_NOCONCLUDE
164 }
165 ip_puts("\n relative paths: " as *u8); ip_putn(seen)
166 ip_puts(" verbatim=" as *u8); ip_putn(resolved)
167 ip_puts(" cwd_dependent=" as *u8); ip_putn(cwddep)
168 ip_puts(" unresolved=" as *u8); ip_putn(unresolved)
169 let sum: i64 = resolved + cwddep + unresolved
170 ip_puts(" partition: " as *u8); ip_putn(sum); ip_puts(" of " as *u8); ip_putn(seen)
171 if sum == seen { ip_puts(" -- SUMS\n" as *u8) }
172 if sum != seen { ip_puts(" -- ⚠DOES NOT SUM (a literal went uncounted)\n" as *u8) }
173 if unresolved > 0 {
174 ip_puts(" ★UNRESOLVED: reachable from NOWHERE. An organ that scores absence will read these as absent\n" as *u8)
175 ip_puts(" and publish a confident false number. This is the nx_game_gen2 case (knowledge/specs/*).\n" as *u8)
176 }
177 if cwddep > 0 {
178 ip_puts(" ★CWD-DEPENDENT: found ONLY through ar_resolve. An organ using a BARE relative open will NOT\n" as *u8)
179 ip_puts(" find these from here and will score them absent. This is the nx_security_census case, and\n" as *u8)
180 ip_puts(" it is invisible to any probe that asks only whether the file exists somewhere.\n" as *u8)
181 }
182 if unresolved + cwddep > 0 {
183 ip_puts(" ⚠Some entries may be OUTPUT paths the organ creates -- this probe cannot tell. Read the list.\n" as *u8)
184 ip_puts(" ★A STALE-BUT-TRUE ROW BEATS A FRESH-BUT-FALSE ONE: fix the paths or change directory before\n" as *u8)
185 ip_puts(" letting this organ append to an evidence log anything grades from.\n" as *u8)
186 ip_puts(" verdict=UNRESOLVED\n" as *u8)
187 sys_exit(IP_EXIT_UNRESOLVED); return IP_EXIT_UNRESOLVED
188 }
189 ip_puts(" verdict=ALL-RESOLVE\n" as *u8)
190 sys_exit(0); return 0
191}