nx_known_issue_seed.nx source

1// nx_known_issue_seed.nx -- SEEDER + GATE: authors the KNOWN-ISSUE catalogue into the SOVEREIGN 2// STORE (knowledge/store/ki-*), the pure-Nishi machine-matchable twin of the human-narrative 3// landmines.tsv / workaround_audit.tsv (operator: "no tsv, nishi ecosystem"). IDEMPOTENT (rule 10): 4// each record is written only if absent-or-changed (additive versions otherwise), then EVERY record 5// is read back and byte-verified -- GREEN only when the store holds exactly what we intended. 6// 7// HONEST SCOPE (rule 4 / BL-003 no-overclaim): only ONE row carries a real diagnostic SIGNATURE in 8// v1 -- LM-021 reserved-keyword, whose signature `reserved keyword '` is VERIFIED + already wired 9// (nx_doctor_fix.doc_offending_kw greps that exact literal; landmines.tsv:26 records the measured 10// diagnostic). The remaining rows are recall-by-id (signature "-"): documented adaptations / 11// disciplines / open-roots, NOT fabricated signatures. The catalogue GROWS one seed line per 12// signature MEASURED (BL-004 measure-first) -- the recall mechanism is already general, no code 13// change needed. Evidence -> knowledge/status/known_issue_store.log. license_tier: ORIGINAL 14import "nx_known_issue_store.nx" 15import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc) 16import "nx_seg_store.nx" 17import "nx_syscalls.nx" 18 19const KIS_LOG: *u8 = "knowledge/status/known_issue_store.log" 20 21func ks_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 22// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer 23// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the 24// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls). 25// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign. 26func ks_wn(fd: i64, v: i64) -> i64 { nxi_fd(fd, v); return 0 } 27func ks_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 28 29// 1 if the store's current value for `key` byte-equals `val` (NUL-terminated). Drives BOTH the 30// idempotent skip-if-unchanged write AND the post-commit verification. 31func ks_streq_store(key: *u8, val: *u8) -> i64 { 32 let pq: *i64 = sys_mmap(16) as *i64 33 let lq: *i64 = sys_mmap(16) as *i64 34 if ki_get(key, pq, lq) != 1 { return 0 } 35 let b: *u8 = pq[0] as *u8 36 let n: i64 = lq[0] 37 let vl: i64 = ks_len(val) 38 if n != vl { return 0 } 39 var i: i64 = 0 40 while i < n { if b[i] != val[i] { return 0 } i = i + 1 } 41 return 1 42} 43 44func ks_emit(fd: i64, nrec: i64, written: i64, verified: i64, ok: i64) -> i64 { 45 ks_w(fd, "KISTORE authored=organ store=knowledge/store/ki- records=" as *u8); ks_wn(fd, nrec) 46 ks_w(fd, " written=" as *u8); ks_wn(fd, written) 47 ks_w(fd, " verified=" as *u8); ks_wn(fd, verified) 48 if ok == 1 { ks_w(fd, " verdict=GREEN\n" as *u8) } else { ks_w(fd, " verdict=RED\n" as *u8) } 49 return 0 50} 51 52func main() -> i64 { 53 let keys: *i64 = sys_mmap(8 * 16) as *i64 54 let vals: *i64 = sys_mmap(8 * 16) as *i64 55 56 // index: the recall walk order (every id below must appear here). 57 keys[0] = "ki:ids" as *u8 as i64 58 vals[0] = "LM-021\tLM-009\tLM-014\tLM-005\tRC6\tLM-001\tCC-UNDEFFN\tCC-EXPIMP\tLM-026\tSEC-CT-001\tSEC-CT-002\tLM-027\tTEST-STALE-EXPECTED\tTEST-STRICT-SUBRES" as *u8 as i64 59 60 // LM-021 reserved-keyword-as-identifier: the ONE verified AUTO row. signature is the exact 61 // literal the parser emits + nx_doctor_fix already keys on; remedy is the wired auto-fix. 62 keys[1] = "ki:LM-021" as *u8 as i64 63 vals[1] = "LM-021\tDIALECT\tAUTO\treserved keyword '\tnx_doctor_fix:doc_heal_token" as *u8 as i64 64 65 // LM-009 WSL /tmp dies post-crash: an ENVIRONMENT fact we ADAPT to (durable-runner re-arms); 66 // no crisp text signature -> recall-by-id (signature "-"). 67 keys[2] = "ki:LM-009" as *u8 as i64 68 vals[2] = "LM-009\tENV\tADAPT\t-\tdurable-runner-rearm" as *u8 as i64 69 70 // LM-014 shared-worktree concurrency: a DISCIPLINE (check mtimes before editing). 71 keys[3] = "ki:LM-014" as *u8 as i64 72 vals[3] = "LM-014\tENV\tDISCIPLINE\t-\tcheck-mtimes-before-edit" as *u8 as i64 73 74 // LM-005 arithmetic >> sign-extends: a DOMAIN DISCIPLINE (mask after shift). 75 keys[4] = "ki:LM-005" as *u8 as i64 76 vals[4] = "LM-005\tMATH\tDISCIPLINE\t-\tmask-after-shift" as *u8 as i64 77 78 // RC6 = nxasm exits 6 when openat(outpath) fails (nxasm_x86_main.nx:40-41). 2026-06-14 evidence 79 // RETIRES both old hypotheses: (1) ctx-x-output-path uninit-read -> Doctor dataflow proved nxasm's 80 // outpath codegen CLEAN (store dominates read, 0/40 main slots read-before-write); (2) "21+ same-fn 81 // calls" -> swept 21..120 tp_step-pattern calls, all assemble rc=0. NON-REPRODUCIBLE on the current 82 // (post-2026-06-09 cl-shift) nxasm (old assembler had it). Now nxasm LOUD-fails rc=6 (names path+errno) 83 // + _rc6_gate is a standing guard (knowledge/status/rc6_gate.log). Kept GATED (recalled, never re-chased). 84 keys[5] = "ki:RC6" as *u8 as i64 85 vals[5] = "RC6\tTOOLCHAIN\tGATED\t-\tNONrepro-2026-06-14-codegen-clean-nxasm-loud-fail-_rc6_gate-guards" as *u8 as i64 86 87 // LM-001 no &&/|| eager short-circuit: a DIALECT DISCIPLINE (flag idiom). 88 keys[6] = "ki:LM-001" as *u8 as i64 89 vals[6] = "LM-001\tDIALECT\tDISCIPLINE\t-\tflag-idiom-no-andor" as *u8 as i64 90 91 // CC-UNDEFFN call-to-undefined-function: the SECOND verified signature (measured 2026-06-14 by 92 // running _offc/nx_cc_sovereign.elf on a bad source -> `main:nx_parse: call to undefined 93 // function: <name>`, exit 2). NOT the reserved-keyword class, so it genuinely reaches the 94 // give-up->recall path (doc_offending_kw misses it). OPEN: usually a missing import or typo; 95 // no auto-resolver yet -> recall-and-report the documented response (not a fabricated auto-fix). 96 // CC-UNDEFFN now AUTO: the missing-import sub-case is auto-fixed by nx_doctor_import:di_heal, 97 // PROVEN end-to-end by nx_doctor_import_gate (G4 healed-source compiles). Unresolvable names 98 // (typo / non-sys_ symbol) fall back to recall-and-report -- di_resolve returns 0, no false fix. 99 keys[7] = "ki:CC-UNDEFFN" as *u8 as i64 100 vals[7] = "CC-UNDEFFN\tTOOLCHAIN\tAUTO\tcall to undefined function:\tnx_doctor_import:di_heal" as *u8 as i64 101 102 // CC-EXPIMP expand-imports failure: the THIRD verified signature (measured 2026-06-14, exit 12). 103 // TWO roots, same diagnostic: (a) nx_cc_sovereign run DIRECT does NOT resolve imports -- use 104 // nx_sov_build_run for anything with imports (direct-cc is diagnostics-only); (b) the ROOT source 105 // is unreadable (e.g. a WSL binary cannot read a Git-Bash /tmp path -- LM-009). Recall-and-report. 106 keys[8] = "ki:CC-EXPIMP" as *u8 as i64 107 vals[8] = "CC-EXPIMP\tTOOLCHAIN\tOPEN\texpand_imports failed\tuse-sov-build-run-for-imports-OR-src-unreadable-LM-009" as *u8 as i64 108 109 // LM-026 stale-_offc artifact: nx_sov_build_run writes /tmp/<name>.sov.elf but does NOT install to 110 // _offc/<name>.elf, so gates fork a STALE binary (cost a full session on the MMU instruction-fetch 111 // rung). The THIRD AUTO row: signature STALE-OFFC-ARTIFACT (emitted by nx_offc_install when it 112 // detects the _offc-vs-/tmp mismatch) routes to the wired guardrail nx_offc_install:oi_install 113 // (atomic copy + verify), PROVEN end-to-end by _offc_install_gate (T5 production-recall + T1/T2). 114 keys[9] = "ki:LM-026" as *u8 as i64 115 vals[9] = "LM-026\tTOOLCHAIN\tAUTO\tSTALE-OFFC-ARTIFACT\tnx_offc_install:oi_install" as *u8 as i64 116 117 // SEC-CT-001 ECDSA P-256 nonce comb timing leak (CWE-208): secret-dependent branch + secret-indexed 118 // table load on the ECDSA sign nonce (nx_p256_comb.nx:102-103, live via nx_ecdsa_p256_sign.nx:175). 119 // Recall-by-id (signature "-": no live diagnostic until the C3 dudect harness emits one); FIX-MODE 120 // OPEN -- filed constant-time recipe (masked scan + complete-add); engineer authors+gates. 121 keys[10] = "ki:SEC-CT-001" as *u8 as i64 122 vals[10] = "SEC-CT-001\tCRYPTO\tOPEN\t-\tconstant-time-scalarmul-masked-scan:specs/2026-06-14-ecdsa-nonce-comb-timing-leak.md" as *u8 as i64 123 124 // SEC-CT-002 Ed25519 sign scalar-mul timing leak (CWE-208): secret-bit branch in double-and-add 125 // (nx_ed25519_scalar.nx:216), live across the whole signing surface incl TLS1.3 CertificateVerify 126 // (nx_ed25519_signature.nx:230,243). Recall-by-id; FIX-MODE OPEN -- filed recipe (always-add + 127 // fe_cswap masked select); engineer authors+gates. SIBLING of SEC-CT-001 = one CT-scalarmul capability. 128 keys[11] = "ki:SEC-CT-002" as *u8 as i64 129 vals[11] = "SEC-CT-002\tCRYPTO\tFIXED\t-\tge_scalar_mul-always-add+ge_p3_cmov-LANDED-2026-06-14-gated(_ed25519_ct_gate+RFC8032-byte-identical)" as *u8 as i64 130 131 // LM-027 stale EXTERNAL-ORACLE artifact: a gate that compiles buyer-runtime source straight into 132 // _offc/<x>.elf then runs it (lang-export oracle gate: gcc lg_c.c -> lg_c.elf) can fork a STALE 133 // binary -- DISTINCT from LM-026 (no /tmp/<name>.sov.elf twin, so oi_install/oi_stale can't cover it; 134 // no stat/mtime syscall to detect reactively). DISCIPLINE: the proactive wired remedy oi_fresh(path) 135 // removes the artifact before recompile so a stale binary can never run; recall-by-id (signature "-") 136 // until a source-vs-artifact freshness detector exists. Locked by _offc_install_gate T7. 137 // UPGRADED 2026-06-14 (X-HEAL-OFFC-003): a REACTIVE source-vs-artifact freshness detector now exists 138 // -- nx_offc_install:oi_src_stale(artifact,source) via the new sys_fstatat(262)/sys_utimensat(280) 139 // mtime channel -- so a compile-then-run gate can DETECT "artifact older than source" with no /tmp 140 // twin and fail LOUD, not just proactively oi_fresh before compile. Gated by _freshness_gate (T1..T5). 141 keys[12] = "ki:LM-027" as *u8 as i64 142 vals[12] = "LM-027\tTOOLCHAIN\tDISCIPLINE\t-\tnx_offc_install:oi_src_stale-reactive-detect-OR-oi_fresh-proactive-remove" as *u8 as i64 143 144 // TEST-STALE-EXPECTED: a test asserts a hand-APPROXIMATED expected CONSTANT that disagrees with the 145 // exact integer computation (e.g. nx_flash_attention_test savings 15.75*1024=16128 vs exact 146 // (1048576*1024)/66560=16131). The production fn is correct; the TEST constant is stale. FIXED 147 // 2026-06-14 (16128->16131). DISCIPLINE: recompute the expected from the formula, never hand-round. 148 keys[13] = "ki:TEST-STALE-EXPECTED" as *u8 as i64 149 vals[13] = "TEST-STALE-EXPECTED\tTEST\tDISCIPLINE\t-\trecompute-exact-expected-from-formula-not-hand-round" as *u8 as i64 150 151 // TEST-STRICT-SUBRES: a test asserts STRICT ordering (>) on values below the kernel's quantized 152 // RESOLUTION (e.g. Q10 softmax on near-tied logits 2-vs-0 rounds both probs to 341, so ps[0]>ps[1] 153 // is unachievable -- correct behaviour, too-strict test). FIXED 2026-06-14 (nx_attention_test 24/25/27 154 // -> assert monotonic >= where unresolvable, strict where resolvable). DISCIPLINE: below resolution 155 // assert >= (a real inversion still fails); reserve strict > for resolvable separations. 156 keys[14] = "ki:TEST-STRICT-SUBRES" as *u8 as i64 157 vals[14] = "TEST-STRICT-SUBRES\tTEST\tDISCIPLINE\t-\tassert-monotonic-ge-below-resolution-strict-only-where-resolvable" as *u8 as i64 158 159 // provenance breadcrumb (machine-visible verified-vs-staging status). 160 keys[15] = "ki:provenance" as *u8 as i64 161 vals[15] = "authored=organ 2026-06-13/14; 4 VERIFIED signatures; 3 AUTO-fix (LM-021->doc_heal_token reserved-keyword; CC-UNDEFFN->nx_doctor_import:di_heal missing-import; LM-026->nx_offc_install:oi_install stale-_offc, all gated end-to-end); CC-EXPIMP report; SEC-CT-001/002 CWE-208 constant-time-scalarmul recall-by-id (OPEN, filed recipe); LM-027 stale-oracle-artifact->nx_offc_install:oi_fresh (DISCIPLINE, gated _offc_install_gate T7); TEST-STALE-EXPECTED + TEST-STRICT-SUBRES test-correctness disciplines FIXED 2026-06-14; others recall-by-id; grow one seed line per signature MEASURED" as *u8 as i64 162 let nrec: i64 = 16 163 164 // write only absent-or-changed records (idempotent / additive). 165 let w: *i64 = ss_begin() 166 var towrite: i64 = 0 167 var i: i64 = 0 168 while i < nrec { 169 let key: *u8 = keys[i] as *u8 170 let val: *u8 = vals[i] as *u8 171 if ks_streq_store(key, val) == 0 { ss_add(w, 1, key, val, ks_len(val)); towrite = towrite + 1 } 172 i = i + 1 173 } 174 var committed: i64 = 0 175 if towrite > 0 { 176 let segid: i64 = ki_seg_next_p(KI_PREFIX) 177 let rc: i64 = ss_commit(KI_PREFIX, w, segid) 178 if rc == 0 { committed = 1 } 179 } 180 181 // verify EVERY record reads back exactly (the gate). 182 var verified: i64 = 0 183 i = 0 184 while i < nrec { if ks_streq_store(keys[i] as *u8, vals[i] as *u8) == 1 { verified = verified + 1 } i = i + 1 } 185 186 var ok: i64 = 1 187 if verified != nrec { ok = 0 } 188 if towrite > 0 { if committed == 0 { ok = 0 } } 189 190 ks_emit(1, nrec, towrite, verified, ok) 191 let lf: i64 = sys_openat_append(KIS_LOG, 420) 192 if lf >= 0 { ks_emit(lf, nrec, towrite, verified, ok); sys_close(lf) } 193 194 if ok == 1 { return 0 } 195 return 1 196}