code wiki / _hdl_build / nx_janitor_sprawl_gate.nx
nx_janitor_sprawl_gate.nx source
↩ module page · 142 lines · 8570 B
1// nx_janitor_sprawl_gate.nx -- proves the JANITOR sprawl/junk-cleanup organ (nx_janitor_sprawl):
2// an orphaned-registry-.tsv detector + REVERSIBLE quarantiner, with the cardinal NO-FALSE-POSITIVE law.
3//
4// Builds a hermetic /tmp fixture (a scan tree + a registry of 6 .tsv files) and calls js_run directly,
5// so the gate never touches the real registry. The fixture is designed to DISCRIMINATE:
6// - 3 PROTECTED tsvs: one referenced by a real path const, one named as a substring of a referenced
7// longer name (boundary-protected), one mentioned ONLY in a // comment (over-protect law).
8// - 3 ORPHAN tsvs: two plain unreferenced, plus bcensus.tsv -- which is a SUBSTRING of the referenced
9// fix_bcensus.tsv and MUST STILL be quarantined (the left word-boundary must reject that shielding).
10//
11// NEGATIVE CONTROLS (load-bearing): the referenced/comment/boundary-protected files MUST stay put -- a
12// false positive (quarantining a used file) flips the gate RED; the boundary orphan MUST move -- an
13// over-broad substring-protect flips it RED. Plus idempotency (a second run moves nothing new).
14// GREEN iff all 11 checks hold. Reversible: the action is rename(2) into quarantine, never delete.
15// Sovereign: imports nx_janitor_sprawl + nx_syscalls (nx_cc->nxasm, no gcc). license_tier: ORIGINAL
16import "nx_janitor_sprawl.nx"
17import "nx_syscalls.nx"
18import "nx_gate_verdict.nx"
19
20func jg_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != 0 as u8 { n = n + 1 } sys_write(1, s, n); return 0 }
21func jg_putn(v: i64) -> i64 {
22 if v == 0 { sys_write(1, "0" as *u8, 1); return 0 }
23 var m: i64 = v; if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m }
24 let d: *u8 = sys_mmap(24); var k: i64 = 0
25 while m > 0 { d[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
26 var j: i64 = k - 1
27 while j >= 0 { sys_write(1, ((d as i64)+j) as *u8, 1); j = j - 1 }
28 return 0
29}
30func jg_cat(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != 0 as u8 { dst[off + i] = s[i]; i = i + 1 } return off + i }
31func jg_catn(dst: *u8, off: i64, v: i64) -> i64 {
32 var m: i64 = v; var o: i64 = off
33 let t: *u8 = sys_mmap(28); var k: i64 = 0
34 if m == 0 { t[0] = 48 as u8; k = 1 }
35 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
36 var i: i64 = 0; while i < k { dst[o + i] = t[k - 1 - i]; i = i + 1 }
37 return o + k
38}
39func jg_join(out: *u8, a: *u8, b: *u8) -> i64 { var o: i64 = jg_cat(out, 0, a); o = jg_cat(out, o, b); out[o] = 0 as u8; return o }
40func jg_mkdir(path: *u8) -> i64 { return sys_mkdir(path, 0x1ed) }
41func jg_write(path: *u8, content: *u8) -> i64 {
42 let fd: i64 = sys_openat_wr(path, 0x1a4)
43 if fd < 0 { return 0 - 1 }
44 var n: i64 = 0; while content[n] != 0 as u8 { n = n + 1 }
45 sys_write(fd, content, n); sys_close(fd); return 0
46}
47func jg_exists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 }
48// write `content` to dir/leaf (leaf begins with '/')
49func jg_write_reg(dir: *u8, leaf: *u8, content: *u8) -> i64 {
50 let p: *u8 = sys_mmap(512); jg_join(p, dir, leaf); return jg_write(p, content)
51}
52// does dir/leaf exist?
53func jg_exists_in(dir: *u8, leaf: *u8) -> i64 {
54 let p: *u8 = sys_mmap(512); jg_join(p, dir, leaf); return jg_exists(p)
55}
56func jg_assert(label: *u8, cond: i64) -> i64 {
57 if cond != 0 { jg_puts(" [PASS] "); jg_puts(label); jg_puts("\n"); return 1 }
58 jg_puts(" [FAIL] "); jg_puts(label); jg_puts("\n"); return 0
59}
60
61func main() -> i64 {
62 jg_puts("=== nx_janitor_sprawl_gate: orphan-tsv detector + reversible quarantiner (fixtures + neg-control) ===\n")
63 let epoch: i64 = sys_now_realtime_sec()
64 let root: *u8 = sys_mmap(512)
65 var ro: i64 = jg_cat(root, 0, "/tmp/jsg-" as *u8); ro = jg_catn(root, ro, epoch); root[ro] = 0 as u8
66 let scan: *u8 = sys_mmap(512); jg_join(scan, root, "/scan\x00" as *u8)
67 let reg: *u8 = sys_mmap(512); jg_join(reg, root, "/registry\x00" as *u8)
68 let quar: *u8 = sys_mmap(512); jg_join(quar, root, "/quar\x00" as *u8)
69 let logp: *u8 = sys_mmap(512); jg_join(logp, root, "/sprawl.log\x00" as *u8)
70
71 jg_mkdir(root); jg_mkdir(scan); jg_mkdir(reg)
72
73 // scan fixture: one .nx referencing 3 of the registry tsvs (2 path-reads + 1 comment-only mention).
74 let usenx: *u8 = sys_mmap(512); jg_join(usenx, scan, "/use.nx\x00" as *u8)
75 jg_write(usenx, "// nx fixture organ for the janitor sprawl gate\n// reads registry/fix_read.tsv and registry/fix_bcensus.tsv\n// comment-only mention of fix_comment.tsv (over-protect law: a comment still protects)\nfunc main() { return 0 }\n\x00" as *u8)
76
77 // registry: 3 PROTECTED + 3 ORPHANS (incl. bcensus.tsv, the boundary case inside fix_bcensus.tsv).
78 jg_write_reg(reg, "/fix_read.tsv\x00" as *u8, "x\n\x00" as *u8) // protected: real path reference
79 jg_write_reg(reg, "/fix_bcensus.tsv\x00" as *u8, "x\n\x00" as *u8) // protected: real path reference
80 jg_write_reg(reg, "/fix_comment.tsv\x00" as *u8, "x\n\x00" as *u8) // protected: comment-only mention
81 jg_write_reg(reg, "/bcensus.tsv\x00" as *u8, "x\n\x00" as *u8) // ORPHAN (boundary: substring of fix_bcensus.tsv)
82 jg_write_reg(reg, "/fix_orphan1.tsv\x00" as *u8, "x\n\x00" as *u8) // ORPHAN
83 jg_write_reg(reg, "/fix_orphan2.tsv\x00" as *u8, "x\n\x00" as *u8) // ORPHAN
84
85 let outs: *i64 = sys_mmap(64) as *i64
86 outs[0] = 0; outs[1] = 0; outs[2] = 0
87 let rc: i64 = js_run(scan, reg, quar, logp, outs)
88
89 jg_puts(" js_run -> total_tsv="); jg_putn(outs[0]); jg_puts(" protected="); jg_putn(outs[1]); jg_puts(" quarantined="); jg_putn(outs[2]); jg_puts("\n")
90
91 var pass: i64 = 0
92 var total: i64 = 0
93 var c: i64 = 0
94
95 c = 0; if rc >= 0 { c = 1 }
96 total = total + 1; pass = pass + jg_assert("T1 js_run ok (rc>=0)", c)
97
98 c = 0; if outs[0] == 6 { c = 1 }
99 total = total + 1; pass = pass + jg_assert("T2 total_tsv == 6", c)
100
101 c = 0; if outs[1] == 3 { c = 1 }
102 total = total + 1; pass = pass + jg_assert("T3 protected == 3 (read + comment + boundary)", c)
103
104 c = 0; if outs[2] == 3 { c = 1 }
105 total = total + 1; pass = pass + jg_assert("T4 quarantined == 3 (real orphans moved)", c)
106
107 c = 0; if jg_exists_in(quar, "/fix_orphan1.tsv\x00" as *u8) == 1 { if jg_exists_in(reg, "/fix_orphan1.tsv\x00" as *u8) == 0 { c = 1 } }
108 total = total + 1; pass = pass + jg_assert("T5 orphan1 moved to quarantine (reversible, gone from registry)", c)
109
110 c = 0; if jg_exists_in(quar, "/fix_orphan2.tsv\x00" as *u8) == 1 { if jg_exists_in(reg, "/fix_orphan2.tsv\x00" as *u8) == 0 { c = 1 } }
111 total = total + 1; pass = pass + jg_assert("T6 orphan2 moved to quarantine", c)
112
113 c = 0; if jg_exists_in(quar, "/bcensus.tsv\x00" as *u8) == 1 { if jg_exists_in(reg, "/bcensus.tsv\x00" as *u8) == 0 { c = 1 } }
114 total = total + 1; pass = pass + jg_assert("T7[boundary] bcensus.tsv quarantined (NOT shielded by fix_bcensus.tsv substring)", c)
115
116 c = 0; if jg_exists_in(reg, "/fix_read.tsv\x00" as *u8) == 1 { if jg_exists_in(quar, "/fix_read.tsv\x00" as *u8) == 0 { c = 1 } }
117 total = total + 1; pass = pass + jg_assert("T8[neg] fix_read.tsv NOT quarantined (real reference protects)", c)
118
119 c = 0; if jg_exists_in(reg, "/fix_bcensus.tsv\x00" as *u8) == 1 { c = 1 }
120 total = total + 1; pass = pass + jg_assert("T9[neg] fix_bcensus.tsv NOT quarantined (referenced)", c)
121
122 c = 0; if jg_exists_in(reg, "/fix_comment.tsv\x00" as *u8) == 1 { c = 1 }
123 total = total + 1; pass = pass + jg_assert("T10[neg] fix_comment.tsv NOT quarantined (comment mention over-protects)", c)
124
125 // idempotency: re-run finds nothing new to move
126 let outs2: *i64 = sys_mmap(64) as *i64
127 outs2[0] = 0; outs2[1] = 0; outs2[2] = 0
128 js_run(scan, reg, quar, logp, outs2)
129 c = 0; if outs2[2] == 0 { c = 1 }
130 total = total + 1; pass = pass + jg_assert("T11 idempotent (second run quarantines 0)", c)
131
132 jg_puts("\n---- nx_janitor_sprawl gate: passed "); jg_putn(pass); jg_puts(" / "); jg_putn(total); jg_puts(" ----\n")
133 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check
134 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled
135 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify.
136 let ctr__dry: *i64 = gv_ctr()
137 ctr__dry[0] = pass
138 ctr__dry[1] = total
139 let rc__dry: i64 = gv_verdict("JANITOR-SPRAWL-GATE" as *u8, ctr__dry, "teeth unchanged; verdict emission migrated onto the shared base class" as *u8)
140 sys_exit(rc__dry)
141 return rc__dry
142}