code wiki / _hdl_build / nx_intent_gate.nx
nx_intent_gate.nx source
↩ module page · 310 lines · 13455 B
1// nx_intent_gate.nx -- the ENGINEER's gate for CR4 (intent WAL: work interrupted by a
2// crash stops being silently lost). Proves, re-runnably:
3// 1 paired START+DONE -> nothing filed (a finished step is not an orphan)
4// 2 pre-boot START with no DONE -> exactly ONE pm_plan row filed + INTENT-FILED mark
5// 3 idempotent: same WAL again -> nothing refiled (the FILED mark holds)
6// 4 in-flight protection: START from THIS boot (epoch >= boot_epoch) -> never filed
7// 5 live writer: a REAL nx_team_pulse run appends START and matching DONE to the real WAL
8// Fixtures in /tmp (fixture conf has no E/D rows so revive runs them in milliseconds);
9// the real WAL/pm_plan are only touched by row 5's genuine pulse. Durable verdict ->
10// knowledge/status/intent_gate.log. Exit 0 iff 5/5.
11// Sovereign (syscalls only, no .sh). Run from nxc2 root. license_tier: ORIGINAL
12import "nx_syscalls.nx"
13
14const IG_RUN_MS: i64 = 60000 // bound on one fixture revive (no organs -> instant)
15const IG_PULSE_MS: i64 = 600000 // bound on the real pulse run (row 5)
16const IG_SIGKILL: i64 = 9
17
18func _p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
19func _pn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
20func _fp(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
21func _fn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(fd,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 }
22func ig_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
23func ig_cat(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { dst[off+i] = s[i]; i = i + 1 } return off + i }
24func ig_numcat(dst: *u8, off: i64, v: i64) -> i64 {
25 let t: *u8 = sys_mmap(28)
26 var m: i64 = v
27 var k: i64 = 0
28 if m == 0 { t[0] = 48; k = 1 }
29 while m > 0 { t[k] = 48 + (m % 10); m = m / 10; k = k + 1 }
30 var o: i64 = off
31 while k > 0 { k = k - 1; dst[o] = t[k]; o = o + 1 }
32 return o
33}
34func ig_read_all(path: *u8, buf: *u8, cap: i64) -> i64 {
35 let fd: i64 = sys_openat_rd(path)
36 if fd < 0 { return 0 }
37 var n: i64 = 0
38 var go: i64 = 1
39 while go == 1 { let base: i64 = buf as i64; let r: i64 = sys_read(fd, (base + n) as *u8, cap - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap { go = 0 } }
40 sys_close(fd)
41 return n
42}
43func ig_contains(hay: *u8, n: i64, pat: *u8) -> i64 {
44 let pl: i64 = ig_len(pat)
45 if pl == 0 { return 0 }
46 var i: i64 = 0
47 while i + pl <= n {
48 var k: i64 = 0
49 var hit: i64 = 1
50 while k < pl { if hay[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } }
51 if hit == 1 { return 1 }
52 i = i + 1
53 }
54 return 0
55}
56func ig_count_pat(hay: *u8, n: i64, pat: *u8) -> i64 {
57 let pl: i64 = ig_len(pat)
58 if pl == 0 { return 0 }
59 var cnt: i64 = 0
60 var i: i64 = 0
61 while i + pl <= n {
62 var k: i64 = 0
63 var hit: i64 = 1
64 while k < pl { if hay[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } }
65 if hit == 1 { cnt = cnt + 1 }
66 i = i + 1
67 }
68 return cnt
69}
70func ig_last_num_after(hay: *u8, n: i64, pat: *u8) -> i64 {
71 let pl: i64 = ig_len(pat)
72 if pl == 0 { return 0 - 1 }
73 var best: i64 = 0 - 1
74 var i: i64 = 0
75 while i + pl <= n {
76 var k: i64 = 0
77 var hit: i64 = 1
78 while k < pl { if hay[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } }
79 if hit == 1 { best = i + pl }
80 i = i + 1
81 }
82 if best < 0 { return 0 - 1 }
83 var v: i64 = 0
84 var q: i64 = best
85 var any: i64 = 0
86 while q < n {
87 if hay[q] >= (48 as u8) { if hay[q] <= (57 as u8) { v = v * 10 + ((hay[q] as i64) - 48); any = 1; q = q + 1 } else { q = n } } else { q = n }
88 }
89 if any == 0 { return 0 - 1 }
90 return v
91}
92func ig_find_in(buf: *u8, from: i64, to: i64, pat: *u8) -> i64 {
93 let pl: i64 = ig_len(pat)
94 var i: i64 = from
95 while i + pl <= to {
96 var k: i64 = 0
97 var hit: i64 = 1
98 while k < pl { if buf[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } }
99 if hit == 1 { return i + pl }
100 i = i + 1
101 }
102 return 0 - 1
103}
104func ig_digits_at(buf: *u8, pos: i64, to: i64) -> i64 {
105 if pos < 0 { return 0 - 1 }
106 var v: i64 = 0
107 var any: i64 = 0
108 var q: i64 = pos
109 while q < to {
110 if buf[q] >= (48 as u8) { if buf[q] <= (57 as u8) { v = v * 10 + ((buf[q] as i64) - 48); any = 1; q = q + 1 } else { q = to } } else { q = to }
111 }
112 if any == 0 { return 0 - 1 }
113 return v
114}
115// does the region hold a COMPLETE journaled unit (some DONE whose START is also here)?
116// Robust against concurrent daemon beats whose START predates the snapshot (their stray
117// DONE can land here) -- only a full pair inside the window passes, and our synchronous
118// pulse always contributes one.
119func ig_region_pair(w: *u8, wn: i64) -> i64 {
120 var ci: i64 = 0
121 while ci < wn {
122 var le: i64 = ci
123 var scan: i64 = 1
124 while scan == 1 {
125 if le >= wn { scan = 0 }
126 else { if w[le] == (10 as u8) { scan = 0 } else { le = le + 1 } }
127 }
128 let pd: i64 = ig_find_in(w, ci, le, "INTENT-DONE id=" as *u8)
129 if pd == ci + 15 {
130 let dv: i64 = ig_digits_at(w, pd, le)
131 if dv > 0 {
132 let pat: *u8 = sys_mmap(64)
133 var po: i64 = 0
134 po = ig_cat(pat, po, "INTENT-START id=" as *u8)
135 po = ig_numcat(pat, po, dv); pat[po] = 0 as u8
136 if ig_contains(w, wn, pat) == 1 { return 1 }
137 }
138 }
139 ci = le + 1
140 }
141 return 0
142}
143func ig_unlink(path: *u8) -> i64 { return __syscall(87, path, 0, 0, 0, 0, 0) }
144func ig_write_file(path: *u8, content: *u8) -> i64 {
145 ig_unlink(path)
146 let fd: i64 = sys_openat_wr(path, 0x1a4)
147 if fd < 0 { return 0 - 1 }
148 sys_write(fd, content, ig_len(content))
149 sys_close(fd)
150 return 0
151}
152// run elf with a prebuilt argv under a deadline; mute=1 silences child output
153func ig_run(elf: *u8, argv: *i64, ms: i64, mute: i64) -> i64 {
154 let pid: i64 = sys_fork()
155 if pid == 0 {
156 let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
157 if mute == 1 {
158 let dn: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4)
159 if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) }
160 }
161 sys_execve(elf, argv, envp)
162 sys_exit(127)
163 }
164 let st: *i64 = sys_mmap(16) as *i64
165 let start: i64 = sys_now_ms()
166 var rc: i64 = 0 - 1
167 while rc < 0 {
168 let w: i64 = sys_wait4(pid, st, 1)
169 if w == pid {
170 let sig: i64 = st[0] & 0x7f
171 if sig != 0 { rc = 128 + sig } else { rc = (st[0] >> 8) & 0xff }
172 }
173 if w < 0 { rc = 125 }
174 if rc < 0 {
175 let el: i64 = sys_now_ms() - start
176 if el >= ms { nx_kill(pid, IG_SIGKILL); sys_wait4(pid, st, 0); rc = 124 } else { sys_sleep_ms(50) }
177 }
178 }
179 return rc
180}
181// revive with full fixture overrides (conf log journal wal pm)
182func ig_revive(conf: *u8, lg: *u8, jr: *u8, wal: *u8, pm: *u8) -> i64 {
183 let argv: *i64 = sys_mmap(64) as *i64
184 let revive: *u8 = "/tmp/nx_boot_revive.sov.elf" as *u8
185 argv[0] = revive as i64
186 argv[1] = conf as i64
187 argv[2] = lg as i64
188 argv[3] = jr as i64
189 argv[4] = wal as i64
190 argv[5] = pm as i64
191 argv[6] = 0
192 return ig_run(revive, argv, IG_RUN_MS, 1)
193}
194func ig_row(lfd: i64, idx: i64, name: *u8, ok: i64, acc: *i64) -> i64 {
195 _p(" ROW " as *u8); _pn(idx); _p(" " as *u8); _p(name); _p(": " as *u8)
196 if ok == 1 { _p("PASS\n" as *u8) } else { _p("FAIL\n" as *u8) }
197 _fp(lfd, "IGATE-ROW idx=" as *u8); _fn(lfd, idx)
198 _fp(lfd, " name=" as *u8); _fp(lfd, name)
199 _fp(lfd, " ok=" as *u8); _fn(lfd, ok); _fp(lfd, "\n" as *u8)
200 acc[0] = acc[0] + 1
201 if ok == 1 { acc[1] = acc[1] + 1 }
202 return 0
203}
204func main() -> i64 {
205 _p("=== INTENT-WAL GATE (Engineer): crash-interrupted work is FILED, finished work is not ===\n" as *u8)
206 let revive: *u8 = "/tmp/nx_boot_revive.sov.elf" as *u8
207 if sys_openat_rd(revive) < 0 {
208 let argvs: *i64 = sys_mmap(32) as *i64
209 let sbr: *u8 = "_offc/nx_sov_build_run.elf" as *u8
210 argvs[0] = sbr as i64; argvs[1] = "nx_boot_revive" as *u8 as i64; argvs[2] = 0
211 ig_run(sbr, argvs, IG_PULSE_MS, 1)
212 }
213 let lfd: i64 = sys_openat_append("knowledge/status/intent_gate.log" as *u8, 0x1a4)
214 if lfd < 0 { _p(" GATE: log open failed -- RED\n" as *u8); sys_exit(1); return 1 }
215 _fp(lfd, "IGATE-RUN epoch=" as *u8); _fn(lfd, sys_now_realtime_sec()); _fp(lfd, "\n" as *u8)
216 let acc: *i64 = sys_mmap(16) as *i64
217 acc[0] = 0
218 acc[1] = 0
219 let conf: *u8 = "/tmp/ig_conf.conf" as *u8
220 let lg: *u8 = "/tmp/ig_log.log" as *u8
221 let jr: *u8 = "/tmp/ig_journal.log" as *u8
222 let wal: *u8 = "/tmp/ig_wal.log" as *u8
223 let pm: *u8 = "/tmp/ig_pm.log" as *u8
224 ig_unlink(lg); ig_unlink(jr); ig_unlink(wal); ig_unlink(pm)
225 ig_write_file(conf, "B 240\n" as *u8)
226 let lb: *u8 = sys_mmap(1048592)
227 // ROW 1: paired START+DONE -> nothing filed
228 ig_write_file(wal, "INTENT-START id=11111 name=stepA epoch=1000\nINTENT-DONE id=11111 rc=0 epoch=1005\n" as *u8)
229 let rc1: i64 = ig_revive(conf, lg, jr, wal, pm)
230 var ok1: i64 = 0
231 if rc1 == 0 {
232 let n1: i64 = ig_read_all(lg, lb, 1048576)
233 if ig_last_num_after(lb, n1, "intents_orphaned=" as *u8) == 0 {
234 let p1: i64 = ig_read_all(pm, lb, 1048576)
235 if ig_count_pat(lb, p1, "ORPHAN-INTENT" as *u8) == 0 { ok1 = 1 }
236 }
237 }
238 ig_row(lfd, 1, "finished-work-not-filed" as *u8, ok1, acc)
239 // ROW 2: pre-boot START with no DONE -> filed exactly once + FILED mark in the WAL
240 ig_write_file(wal, "INTENT-START id=22222 name=stepB epoch=1000\n" as *u8)
241 let rc2: i64 = ig_revive(conf, lg, jr, wal, pm)
242 var ok2: i64 = 0
243 if rc2 == 0 {
244 let n2: i64 = ig_read_all(lg, lb, 1048576)
245 if ig_last_num_after(lb, n2, "intents_orphaned=" as *u8) == 1 {
246 let p2: i64 = ig_read_all(pm, lb, 1048576)
247 if ig_count_pat(lb, p2, "ORPHAN-INTENT" as *u8) == 1 {
248 let w2: i64 = ig_read_all(wal, lb, 1048576)
249 if ig_contains(lb, w2, "INTENT-FILED id=22222" as *u8) == 1 { ok2 = 1 }
250 }
251 }
252 }
253 ig_row(lfd, 2, "orphan-filed-with-mark" as *u8, ok2, acc)
254 // ROW 3: idempotent -- the FILED mark prevents refiling
255 let rc3: i64 = ig_revive(conf, lg, jr, wal, pm)
256 var ok3: i64 = 0
257 if rc3 == 0 {
258 let n3: i64 = ig_read_all(lg, lb, 1048576)
259 if ig_last_num_after(lb, n3, "intents_orphaned=" as *u8) == 0 {
260 let p3: i64 = ig_read_all(pm, lb, 1048576)
261 if ig_count_pat(lb, p3, "ORPHAN-INTENT" as *u8) == 1 { ok3 = 1 }
262 }
263 }
264 ig_row(lfd, 3, "filed-mark-idempotent" as *u8, ok3, acc)
265 // ROW 4: in-flight (THIS boot) is never filed
266 let wb: *u8 = sys_mmap(256)
267 var wo: i64 = 0
268 wo = ig_cat(wb, wo, "INTENT-START id=33333 name=stepC epoch=" as *u8)
269 wo = ig_numcat(wb, wo, sys_now_realtime_sec())
270 wo = ig_cat(wb, wo, "\n" as *u8); wb[wo] = 0 as u8
271 ig_write_file(wal, wb)
272 let rc4: i64 = ig_revive(conf, lg, jr, wal, pm)
273 var ok4: i64 = 0
274 if rc4 == 0 {
275 let n4: i64 = ig_read_all(lg, lb, 1048576)
276 if ig_last_num_after(lb, n4, "intents_orphaned=" as *u8) == 0 {
277 let w4: i64 = ig_read_all(wal, lb, 1048576)
278 if ig_contains(lb, w4, "INTENT-FILED id=33333" as *u8) == 0 { ok4 = 1 }
279 }
280 }
281 ig_row(lfd, 4, "in-flight-never-filed" as *u8, ok4, acc)
282 // ROW 5: live writer -- a REAL pulse run appends START + matching DONE to the real WAL
283 let realwal: *u8 = "knowledge/status/intent_wal.log" as *u8
284 let pre_n: i64 = ig_read_all(realwal, lb, 1048576)
285 let argvp: *i64 = sys_mmap(32) as *i64
286 let sbr2: *u8 = "_offc/nx_sov_build_run.elf" as *u8
287 argvp[0] = sbr2 as i64; argvp[1] = "nx_team_pulse" as *u8 as i64; argvp[2] = 0
288 _p(" (row5: running a REAL pulse -- this takes a few minutes and refreshes all evidence)\n" as *u8)
289 ig_run(sbr2, argvp, IG_PULSE_MS, 1)
290 let n5: i64 = ig_read_all(realwal, lb, 1048576)
291 var ok5: i64 = 0
292 if n5 > pre_n {
293 let rbase: i64 = (lb as i64) + pre_n
294 let region: *u8 = rbase as *u8
295 let rn: i64 = n5 - pre_n
296 ok5 = ig_region_pair(region, rn)
297 }
298 ig_row(lfd, 5, "live-pulse-writes-wal" as *u8, ok5, acc)
299 // verdict
300 _fp(lfd, "IGATE epoch=" as *u8); _fn(lfd, sys_now_realtime_sec())
301 _fp(lfd, " rows=" as *u8); _fn(lfd, acc[0])
302 _fp(lfd, " pass=" as *u8); _fn(lfd, acc[1])
303 if acc[1] == acc[0] { _fp(lfd, " verdict=GREEN\n" as *u8) } else { _fp(lfd, " verdict=RED\n" as *u8) }
304 sys_close(lfd)
305 _p(" INTENT-WAL GATE: " as *u8); _pn(acc[1]); _p("/" as *u8); _pn(acc[0])
306 if acc[1] == acc[0] { _p(" GREEN -- crash-interrupted work can no longer vanish silently\n" as *u8); sys_exit(0); return 0 }
307 _p(" RED\n" as *u8)
308 sys_exit(1)
309 return 1
310}