nx_kernel_adoption.nx source

1// nx_kernel_adoption.nx -- THE SECOND AXIS: does the feature actually RUN in the live boot? 2// 3// WHY (a measured ruler defect, debt idx 2071): nx_kernel_census computes PRESENT with re_has() 4// substring probes over the CONCATENATED gate logs. A feature proven ONCE by a standalone 5// fixture binary therefore scores IDENTICALLY to a feature wired into the image the pinned 6// BOOTSOV actually boots. Measured 2026-07-31: the census read 382 permil BEFORE and 382 permil 7// AFTER the live boot went from a 72-byte banner exercising ZERO features to a 1480-byte kernel 8// exercising ELEVEN of its eighteen -- the ruler scored the adoption gap as exactly zero movement. 9// A RULER THAT CANNOT DISTINGUISH PROVEN-IN-ISOLATION FROM WIRED-AT-THE-CHOKEPOINT WILL ALWAYS 10// SCORE THE ADOPTION GAP AS ZERO, and this census is the instrument meant to catch it. 11// 12// WHAT THIS DOES: boots the LIVE image in-process (the artifact itself, not a log ABOUT it), 13// captures the serial transcript, and scores every incumbent feature on TWO axes -- 14// evidence : re_has() over the gate logs (what the census already measured) 15// live : its marker appears in the transcript (what the census could not see) 16// Headline = MIN(evidence, live), never the mean and never the max, per the min-not-mean law. 17// ADOPTION GAP = features with evidence but NOT live -- the number the census could not report. 18// Data-driven: the feature->marker table is knowledge/registry/kernel_live_markers.tsv, never 19// hardcoded; a feature with no row there is NOT live, which is the honest default. 20// Self-validating: a positive control must be live, a synthetic marker must NOT be. 21// license_tier: ORIGINAL 22// Shared boot-and-capture: this organ, the gate and the census must agree byte-for-byte on what 23// booting the image means, or the rulers can disagree about the same artifact. 24import "nx_bootcap.nx" 25import "nx_research_extract.nx" 26const KA_MAGIC_2000000: i64 = 2000000 27const KA_MAGIC_80000: i64 = 80000 28const KA_MAGIC_40000: i64 = 40000 29const KA_MAGIC_300000: i64 = 300000 30 31const KA_REF: *u8 = "knowledge/registry/kernel_incumbent_ref.tsv" 32const KA_MARKERS: *u8 = "knowledge/registry/kernel_live_markers.tsv" 33const KA_OUT: *u8 = "knowledge/registry/kernel_adoption.tsv" 34const KA_LOG: *u8 = "knowledge/status/kernel_adoption.log" 35const KA_BIN: *u8 = "runtime/_hdl_build/_boot_nishi_virt.bin" 36const KA_BIN_ALT: *u8 = "_boot_nishi_virt.bin" 37const KA_MAXF: i64 = 256 38 39const KA_E0: *u8 = "knowledge/status/boot_stub.log" 40const KA_E1: *u8 = "knowledge/status/trap_syscall.log" 41const KA_E2: *u8 = "knowledge/status/virtio_blk.log" 42const KA_E3: *u8 = "knowledge/status/virtio_net.log" 43const KA_E4: *u8 = "knowledge/status/hwmap.log" 44const KA_E5: *u8 = "knowledge/status/timer_irq.log" 45const KA_E6: *u8 = "knowledge/status/sched.log" 46const KA_E7: *u8 = "knowledge/status/memalloc.log" 47const KA_E8: *u8 = "knowledge/status/coopsched.log" 48const KA_E9: *u8 = "knowledge/status/driver_spec.log" 49const KA_E10: *u8 = "knowledge/status/driver_bind.log" 50const KA_E11: *u8 = "knowledge/status/nndev.log" 51const KA_E12: *u8 = "knowledge/status/mmu.log" 52const KA_E13: *u8 = "knowledge/status/priv.log" 53 54const KA_MEM_BASE: i64 = 0x80000000 55const KA_MEM_SIZE: i64 = 65536 56const KA_TX_CAP: i64 = 4096 57const KA_MAX_STEPS: i64 = 100000 58 59func ka_w(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 60func ka_n(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m; sys_write(fd,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 61 62func ka_read_into(path: *u8, buf: *u8, off: i64, cap: i64) -> i64 { 63 let fd: i64 = sys_openat_rd(path) 64 if fd < 0 { return off } 65 var tot: i64 = off 66 var r: i64 = 1 67 while r > 0 { 68 let dst: *u8 = ((buf as i64) + tot) as *u8 69 r = sys_read(fd, dst, cap - tot) 70 if r > 0 { tot = tot + r } 71 } 72 sys_close(fd) 73 return tot 74} 75func ka_scan_to(buf: *u8, n: i64, start: i64, delim: i64) -> i64 { 76 var i: i64 = start 77 var s: i64 = 1 78 while s == 1 { if i >= n { s = 0 } else { if buf[i] == (delim as u8) { s = 0 } else { i = i + 1 } } } 79 return i 80} 81func ka_streq(a: *u8, b: *u8) -> i64 { 82 var i: i64 = 0 83 while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } 84 if b[i] != (0 as u8) { return 0 } 85 return 1 86} 87func ka_app(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { dst[off+i] = s[i]; i = i + 1 } return off + i } 88 89// Boot the LIVE artifact in-process and capture its serial. Measuring the image itself, not a 90// log ABOUT the image, is the whole point -- a log can be stale, the artifact cannot. 91func ka_boot(img: *u8, ilen: i64, tx_buf: *u8) -> i64 { 92 let res: *i64 = sys_mmap(8 * BOOTCAP_R_N) as *i64 93 return bootcap_run(img, ilen, tx_buf, KA_TX_CAP, res) 94} 95 96// argv[1] = image to score (defaults to the live one). A ruler you cannot point at a KNOWN-BAD 97// artifact cannot be shown to move, and a ruler that cannot move is the defect this organ exists 98// to fix -- so pointing it at the banked 72-byte banner IS the non-vacuity proof. 99func main(argc: i64, argv: *i64) -> i64 { 100 // 1. boot the live artifact 101 let lenp: *i64 = sys_mmap(16) as *i64 102 var binp: *u8 = KA_BIN 103 if argc >= 2 { binp = argv[1] as *u8 } 104 var img: *u8 = sys_read_file(binp, lenp) 105 var ilen: i64 = lenp[0] 106 if ilen <= 0 { binp = KA_BIN_ALT; img = sys_read_file(binp, lenp); ilen = lenp[0] } 107 if ilen <= 0 { ka_w(1, "KERNELADOPTGATE verdict=RED reason=live-image-missing\n" as *u8); return 1 } 108 let tx: *u8 = sys_mmap(KA_TX_CAP) 109 let txn: i64 = ka_boot(img, ilen, tx) 110 if txn <= 0 { ka_w(1, "KERNELADOPTGATE verdict=RED reason=live-boot-emitted-nothing\n" as *u8); return 1 } 111 112 // 2. evidence corpus = the same gate logs the census reads 113 let ev: *u8 = sys_mmap(KA_MAGIC_2000000) 114 var eo: i64 = 0 115 eo = ka_read_into(KA_E0, ev, eo, KA_MAGIC_2000000) 116 eo = ka_read_into(KA_E1, ev, eo, KA_MAGIC_2000000) 117 eo = ka_read_into(KA_E2, ev, eo, KA_MAGIC_2000000) 118 eo = ka_read_into(KA_E3, ev, eo, KA_MAGIC_2000000) 119 eo = ka_read_into(KA_E4, ev, eo, KA_MAGIC_2000000) 120 eo = ka_read_into(KA_E5, ev, eo, KA_MAGIC_2000000) 121 eo = ka_read_into(KA_E6, ev, eo, KA_MAGIC_2000000) 122 eo = ka_read_into(KA_E7, ev, eo, KA_MAGIC_2000000) 123 eo = ka_read_into(KA_E8, ev, eo, KA_MAGIC_2000000) 124 eo = ka_read_into(KA_E9, ev, eo, KA_MAGIC_2000000) 125 eo = ka_read_into(KA_E10, ev, eo, KA_MAGIC_2000000) 126 eo = ka_read_into(KA_E11, ev, eo, KA_MAGIC_2000000) 127 eo = ka_read_into(KA_E12, ev, eo, KA_MAGIC_2000000) 128 eo = ka_read_into(KA_E13, ev, eo, KA_MAGIC_2000000) 129 let evlen: i64 = eo 130 if evlen <= 0 { ka_w(1, "KERNELADOPTGATE verdict=RED reason=no-evidence\n" as *u8); return 1 } 131 132 // 3. the incumbent feature list (feature \t probe \t incumbent) 133 let rb: *u8 = sys_mmap(KA_MAGIC_80000) 134 let rbn: i64 = ka_read_into(KA_REF, rb, 0, KA_MAGIC_80000) 135 if rbn <= 0 { ka_w(1, "KERNELADOPTGATE verdict=RED reason=ref-unreadable\n" as *u8); return 1 } 136 let feat: *i64 = sys_mmap(8 * KA_MAXF) as *i64 137 let prob: *i64 = sys_mmap(8 * KA_MAXF) as *i64 138 var nf: i64 = 0 139 var p: i64 = 0 140 while p < rbn { 141 if rb[p] == (35 as u8) { let e: i64 = ka_scan_to(rb, rbn, p, 10); p = e + 1 } 142 else { if rb[p] == (10 as u8) { p = p + 1 } 143 else { 144 let a0: i64 = p 145 let t1: i64 = ka_scan_to(rb, rbn, a0, 9); rb[t1] = 0 as u8 146 let a1: i64 = t1 + 1 147 let t2: i64 = ka_scan_to(rb, rbn, a1, 9); rb[t2] = 0 as u8 148 let t3: i64 = ka_scan_to(rb, rbn, t2 + 1, 10); rb[t3] = 0 as u8 149 if nf < KA_MAXF { feat[nf] = (rb as i64) + a0; prob[nf] = (rb as i64) + a1; nf = nf + 1 } 150 p = t3 + 1 151 } } 152 } 153 154 // 4. the feature -> live-marker table (data-driven; absent row = NOT live, the honest default) 155 let mb: *u8 = sys_mmap(KA_MAGIC_40000) 156 let mbn: i64 = ka_read_into(KA_MARKERS, mb, 0, KA_MAGIC_40000) 157 if mbn <= 0 { ka_w(1, "KERNELADOPTGATE verdict=RED reason=markers-unreadable\n" as *u8); return 1 } 158 let mname: *i64 = sys_mmap(8 * KA_MAXF) as *i64 159 let mmark: *i64 = sys_mmap(8 * KA_MAXF) as *i64 160 var nm: i64 = 0 161 var q: i64 = 0 162 while q < mbn { 163 if mb[q] == (35 as u8) { let e: i64 = ka_scan_to(mb, mbn, q, 10); q = e + 1 } 164 else { if mb[q] == (10 as u8) { q = q + 1 } 165 else { 166 let b0: i64 = q 167 let u1: i64 = ka_scan_to(mb, mbn, b0, 9); mb[u1] = 0 as u8 168 let b1: i64 = u1 + 1 169 let u2: i64 = ka_scan_to(mb, mbn, b1, 10); mb[u2] = 0 as u8 170 if nm < KA_MAXF { mname[nm] = (mb as i64) + b0; mmark[nm] = (mb as i64) + b1; nm = nm + 1 } 171 q = u2 + 1 172 } } 173 } 174 175 // 5. score both axes 176 let ob: *u8 = sys_mmap(KA_MAGIC_300000) 177 var o: i64 = 0 178 o = ka_app(ob, o, "# AUTHORED BY nx_kernel_adoption -- TWO axes per feature. evidence = re_has over the gate logs (what nx_kernel_census measures). live = the feature's marker appears in the transcript of a REAL boot of the image BOOTSOV boots. A feature with evidence but NOT live is the ADOPTION GAP: gate-proven, not wired at the chokepoint.\n" as *u8) 179 o = ka_app(ob, o, "# columns: state\tfeature\tevidence\tlive\n" as *u8) 180 var n_ev: i64 = 0 181 var n_live: i64 = 0 182 var n_gap: i64 = 0 183 var n_anom: i64 = 0 184 var i2: i64 = 0 185 while i2 < nf { 186 let fp: *u8 = (feat[i2]) as *u8 187 let e1: i64 = re_has(ev, evlen, (prob[i2]) as *u8) 188 var lv: i64 = 0 189 var j: i64 = 0 190 while j < nm { 191 let mn: *u8 = (mname[j]) as *u8 192 if ka_streq(fp, mn) == 1 { 193 if re_has(tx, txn, (mmark[j]) as *u8) == 1 { lv = 1 } 194 j = nm 195 } else { j = j + 1 } 196 } 197 if e1 == 1 { n_ev = n_ev + 1 } 198 if lv == 1 { n_live = n_live + 1 } 199 var st: *u8 = "ABSENT" as *u8 200 if e1 == 1 { if lv == 1 { st = "WIRED" as *u8 } else { st = "GAP-proven-not-wired" as *u8; n_gap = n_gap + 1 } } 201 if e1 == 0 { if lv == 1 { st = "ANOMALY-live-without-evidence" as *u8; n_anom = n_anom + 1 } } 202 o = ka_app(ob, o, st) 203 o = ka_app(ob, o, "\t" as *u8); o = ka_app(ob, o, fp) 204 o = ka_app(ob, o, "\tevidence=" as *u8); if e1 == 1 { o = ka_app(ob, o, "1" as *u8) } else { o = ka_app(ob, o, "0" as *u8) } 205 o = ka_app(ob, o, "\tlive=" as *u8); if lv == 1 { o = ka_app(ob, o, "1" as *u8) } else { o = ka_app(ob, o, "0" as *u8) } 206 o = ka_app(ob, o, "\n" as *u8) 207 i2 = i2 + 1 208 } 209 let wfd: i64 = sys_openat_wr(KA_OUT, 420) 210 if wfd >= 0 { sys_write(wfd, ob, o); sys_close(wfd) } 211 212 // 6. controls -- a ruler that cannot fail is not a ruler 213 let cpos: i64 = re_has(tx, txn, "NISHI" as *u8) 214 let cneg: i64 = re_has(tx, txn, "ZZNOSUCHMARKER" as *u8) 215 var ev_permil: i64 = 0 216 var live_permil: i64 = 0 217 if nf > 0 { ev_permil = (n_ev * 1000) / nf; live_permil = (n_live * 1000) / nf } 218 var headline: i64 = ev_permil 219 if live_permil < headline { headline = live_permil } 220 var ok: i64 = 1 221 if cpos != 1 { ok = 0 } 222 if cneg != 0 { ok = 0 } 223 if nf <= 0 { ok = 0 } 224 if nm <= 0 { ok = 0 } 225 226 ka_w(1, "=== nx_kernel_adoption -- evidence vs ACTUALLY-RUNS-IN-THE-LIVE-BOOT ===\n" as *u8) 227 ka_w(1, " live image=" as *u8); ka_w(1, binp); ka_w(1, " serial=[" as *u8); sys_write(1, tx, txn); ka_w(1, "]\n" as *u8) 228 ka_w(1, " features=" as *u8); ka_n(1, nf) 229 ka_w(1, " evidence=" as *u8); ka_n(1, n_ev); ka_w(1, " (" as *u8); ka_n(1, ev_permil); ka_w(1, " permil)\n" as *u8) 230 ka_w(1, " LIVE=" as *u8); ka_n(1, n_live); ka_w(1, " (" as *u8); ka_n(1, live_permil); ka_w(1, " permil)\n" as *u8) 231 ka_w(1, " ADOPTION GAP (gate-proven but NOT wired at the live chokepoint)=" as *u8); ka_n(1, n_gap); ka_w(1, "\n" as *u8) 232 ka_w(1, " HEADLINE=MIN(evidence,live)=" as *u8); ka_n(1, headline); ka_w(1, " permil -- never the mean, never the max\n" as *u8) 233 // A feature CANNOT run in the live boot and have no evidence anywhere -- if it does, the 234 // evidence corpus this organ was pointed at is the wrong one (or empty), not the subject. 235 // Saying so LOUDLY is the difference between measuring a lane and mis-reporting it as unbuilt. 236 if n_anom > 0 { 237 ka_w(1, " !! EVIDENCE-ROOT SUSPECT: " as *u8); ka_n(1, n_anom) 238 ka_w(1, " features RUN in the live boot but have NO gate-log evidence here. A feature that\n" as *u8) 239 ka_w(1, " demonstrably executes cannot be unproven -- the gate logs read are the WRONG ROOT\n" as *u8) 240 ka_w(1, " or empty, so adoption_gap is NOT trustworthy from this vantage. Check the other root.\n" as *u8) 241 } 242 ka_w(1, "KERNELADOPTGATE features=" as *u8); ka_n(1, nf) 243 ka_w(1, " evidence_permil=" as *u8); ka_n(1, ev_permil) 244 ka_w(1, " live_permil=" as *u8); ka_n(1, live_permil) 245 ka_w(1, " adoption_gap=" as *u8); ka_n(1, n_gap) 246 ka_w(1, " live_without_evidence=" as *u8); ka_n(1, n_anom) 247 ka_w(1, " headline_permil=" as *u8); ka_n(1, headline) 248 ka_w(1, " control_pos=" as *u8); ka_n(1, cpos) 249 ka_w(1, " control_neg=" as *u8); ka_n(1, cneg) 250 if ok == 1 { ka_w(1, " verdict=GREEN\n" as *u8) } else { ka_w(1, " verdict=RED reason=control-or-empty\n" as *u8) } 251 252 let lf: i64 = sys_openat_append(KA_LOG, 420) 253 if lf >= 0 { 254 ka_w(lf, "KERNELADOPTGATE features=" as *u8); ka_n(lf, nf) 255 ka_w(lf, " evidence_permil=" as *u8); ka_n(lf, ev_permil) 256 ka_w(lf, " live_permil=" as *u8); ka_n(lf, live_permil) 257 ka_w(lf, " adoption_gap=" as *u8); ka_n(lf, n_gap) 258 ka_w(lf, " headline_permil=" as *u8); ka_n(lf, headline) 259 if ok == 1 { ka_w(lf, " verdict=GREEN\n" as *u8) } else { ka_w(lf, " verdict=RED\n" as *u8) } 260 sys_close(lf) 261 } 262 if ok == 1 { return 0 } 263 return 1 264}