code wiki / _hdl_build / nx_layerscan_gate.nx
nx_layerscan_gate.nx source
↩ module page · 247 lines · 9580 B
1// nx_layerscan_gate.nx -- LAYERING-VIOLATION CENSUS: which runtime/ organs import a lib that exists ONLY
2// in _hdl_build/, and are therefore SILENTLY UNBUILDABLE?
3//
4// WHY (three instances found BY CHANCE in one session, each a whole capability):
5// nx_clock.nx -> darkened 174 gguf/f32_llm organs (the sovereign LLM stack, frozen ~Jul 16)
6// nx_bm25.nx -> darkens rights-enforced DMS search (licensed-media consent gating)
7// nx_fft.nx -> darkens nx_fft_f32 -> nx_autograd_tensor -> THE ENTIRE TRAINING CAPABILITY
8// Each was found only because somebody happened to build the right target. Three hits from a handful of
9// attempts means this is a POPULATION, not a coincidence -- and it is mechanically detectable in one pass.
10//
11// THE RULE BEING ENFORCED (banked law, re-confirmed by measurement): **runtime/ CANNOT import _hdl_build/**,
12// while _hdl_build/ CAN import runtime/. Proven both directions: nx_syscalls.nx exists ONLY in runtime/ and
13// every _hdl_build organ imports it and builds; nx_clock.nx existed ONLY in _hdl_build/ and runtime/nx_loop.nx
14// could not see it until a copy was placed in runtime/. The asymmetry is what makes the remedy a MOVE.
15//
16// METHOD, deliberately probe-based rather than table-based: for each flat runtime/*.nx, scan its import lines;
17// for each imported basename X, if runtime/X does NOT exist but _hdl_build/X DOES, that is a violation. No
18// name tables, no hashing -- two openat probes per import, so the scan cannot silently overflow a table.
19//
20// FIX FOR EVERY HIT IS THE SAME AND IT IS A MOVE, NEVER A COPY: relocate the lib _hdl_build/ -> runtime/.
21// Because _hdl_build can still reach runtime/, existing consumers keep resolving it and NO duplicate basename
22// is created. Copy-and-leave manufactures the same-name-two-copies divergence class measured repeatedly.
23//
24// ENVELOPE, declared in output and never silent: FLAT scan of runtime/ (no recursion, so _attic/_retired/
25// _stage_local shadows are excluded); only the first LS_HEADCAP bytes of each file are scanned for imports
26// (imports are declared at the top of every organ in this tree); file and hit counts are capped and the caps
27// are PRINTED with the remainder. A capped scan reports PARTIAL, never a clean total.
28// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
29import "nx_syscalls.nx"
30
31const LS_RUNTIME: *u8 = "buildroot/runtime" as *u8
32const LS_HDL: *u8 = "buildroot/runtime/_hdl_build" as *u8
33const LS_DIRBUF: i64 = 262144
34const LS_PATHBUF: i64 = 1024
35const LS_HEADCAP: i64 = 16384
36// RAISED 4000 -> 40000 on 2026-07-31 because the old cap made this gate LIE BY TRUNCATION. It reported
37// VIOLATIONS=0 with file_cap_hit=1 while a REAL violation existed (runtime/nx_bm25.nx importing the
38// _hdl_build-only nx_research_extract.nx) -- the scan simply ended before reaching it. The PARTIAL
39// verdict was honest, but a zero from a truncated scan is evidence the scan STOPPED, not that the
40// class is clean, and it will be read as GREEN by anyone quoting the number. 40000 exceeds the ~23000
41// files in buildroot with headroom; if file_cap_hit ever returns 1 again the cap must rise again --
42// a census that cannot cover its corpus cannot close its class.
43const LS_FILECAP: i64 = 40000
44const LS_MAXSHOW: i64 = 30
45const LS_RECLEN_OFF: i64 = 16
46const LS_NAME_OFF: i64 = 19
47
48func ls_puts(s: *u8) {
49 var n: i64 = 0
50 while s[n] != (0 as u8) { n = n + 1 }
51 sys_write(1, s, n)
52}
53
54func ls_puti(x: i64) {
55 var buf: *u8 = sys_mmap(64) as *u8
56 var v: i64 = x
57 var neg: i64 = 0
58 if v < 0 {
59 neg = 1
60 v = 0 - v
61 }
62 var i: i64 = 40
63 if v == 0 {
64 i = i - 1
65 buf[i] = 48 as u8
66 }
67 while v > 0 {
68 let d: i64 = v - (v / 10) * 10
69 i = i - 1
70 buf[i] = (d + 48) as u8
71 v = v / 10
72 }
73 if neg == 1 {
74 i = i - 1
75 buf[i] = 45 as u8
76 }
77 sys_write(1, ((buf as i64) + i) as *u8, 40 - i)
78}
79
80func ls_ends_nx(nm: *u8, n: i64) -> i64 {
81 if n < 3 { return 0 }
82 if nm[n - 3] != (46 as u8) { return 0 }
83 if nm[n - 2] != (110 as u8) { return 0 }
84 if nm[n - 1] != (120 as u8) { return 0 }
85 return 1
86}
87
88func ls_exists(path: *u8) -> i64 {
89 let fd: i64 = sys_openat_rd(path)
90 if fd < 0 { return 0 }
91 sys_close(fd)
92 return 1
93}
94
95// build "<dir>/<name>" into out
96func ls_join(out: *u8, dir: *u8, name: *u8) {
97 var w: i64 = 0
98 var i: i64 = 0
99 while dir[i] != (0 as u8) {
100 out[w] = dir[i]
101 w = w + 1
102 i = i + 1
103 }
104 out[w] = 47 as u8
105 w = w + 1
106 i = 0
107 while name[i] != (0 as u8) {
108 out[w] = name[i]
109 w = w + 1
110 i = i + 1
111 }
112 out[w] = 0 as u8
113}
114
115func ls_match(b: *u8, at: i64, end: i64, pat: *u8, pl: i64) -> i64 {
116 if at + pl > end { return 0 }
117 var k: i64 = 0
118 while k < pl {
119 if b[at + k] != pat[k] { return 0 }
120 k = k + 1
121 }
122 return 1
123}
124
125// ctr[0]=files scanned ctr[1]=imports seen ctr[2]=VIOLATIONS ctr[3]=shown ctr[4]=capped
126func ls_scan_file(fname: *u8, ctr: *i64) {
127 let fpath: *u8 = sys_mmap(LS_PATHBUF)
128 ls_join(fpath, LS_RUNTIME, fname)
129 let ln: *i64 = sys_mmap(16) as *i64
130 ln[0] = 0
131 let buf: *u8 = sys_read_file(fpath, ln)
132 if buf as i64 == 0 { return }
133 var n: i64 = ln[0]
134 if n > LS_HEADCAP { n = LS_HEADCAP }
135 let rp: *u8 = sys_mmap(LS_PATHBUF)
136 let hp: *u8 = sys_mmap(LS_PATHBUF)
137 let imp: *u8 = sys_mmap(LS_PATHBUF)
138 var i: i64 = 0
139 while i < n {
140 if ls_match(buf, i, n, "import \"" as *u8, 8) == 1 {
141 var j: i64 = i + 8
142 var w: i64 = 0
143 while j < n {
144 if buf[j] == (34 as u8) { j = n }
145 else {
146 if w < LS_PATHBUF - 2 {
147 imp[w] = buf[j]
148 w = w + 1
149 }
150 j = j + 1
151 }
152 }
153 imp[w] = 0 as u8
154 if w > 0 {
155 ctr[1] = ctr[1] + 1
156 ls_join(rp, LS_RUNTIME, imp)
157 if ls_exists(rp) == 0 {
158 ls_join(hp, LS_HDL, imp)
159 if ls_exists(hp) == 1 {
160 ctr[2] = ctr[2] + 1
161 if ctr[3] < LS_MAXSHOW {
162 ls_puts(" VIOLATION runtime/" as *u8)
163 ls_puts(fname)
164 ls_puts(" imports " as *u8)
165 ls_puts(imp)
166 ls_puts(" (exists ONLY in _hdl_build)\n" as *u8)
167 ctr[3] = ctr[3] + 1
168 }
169 }
170 }
171 }
172 i = i + 8
173 } else { i = i + 1 }
174 }
175}
176
177func main(argc: i64, argv: *i64) -> i64 {
178 var ctr: *i64 = sys_mmap(64) as *i64
179 ctr[0] = 0
180 ctr[1] = 0
181 ctr[2] = 0
182 ctr[3] = 0
183 ctr[4] = 0
184
185 ls_puts("=== nx_layerscan_gate -- which runtime/ organs import an _hdl_build-ONLY lib? ===\n" as *u8)
186 ls_puts(" runtime/ CANNOT import _hdl_build/. Every hit below is a SILENTLY UNBUILDABLE subtree.\n" as *u8)
187
188 let fd: i64 = sys_openat_rd(LS_RUNTIME)
189 if fd < 0 {
190 ls_puts("VERDICT=RED cannot open buildroot/runtime -- a census that cannot read its corpus must refuse.\n" as *u8)
191 return 1
192 }
193 let dbuf: *u8 = sys_mmap(LS_DIRBUF)
194 var n: i64 = sys_getdents64(fd, dbuf, LS_DIRBUF)
195 while n > 0 {
196 var p: i64 = 0
197 while p < n {
198 let reclen: i64 = (dbuf[p + LS_RECLEN_OFF] as i64) + ((dbuf[p + LS_RECLEN_OFF + 1] as i64) * 256)
199 if reclen <= 0 { p = n }
200 else {
201 let nm: *u8 = ((dbuf as i64) + p + LS_NAME_OFF) as *u8
202 var l: i64 = 0
203 while nm[l] != (0 as u8) { l = l + 1 }
204 if ls_ends_nx(nm, l) == 1 {
205 if ctr[0] < LS_FILECAP {
206 ctr[0] = ctr[0] + 1
207 ls_scan_file(nm, ctr)
208 } else { ctr[4] = 1 }
209 }
210 p = p + reclen
211 }
212 }
213 n = sys_getdents64(fd, dbuf, LS_DIRBUF)
214 }
215 sys_close(fd)
216
217 if ctr[2] > LS_MAXSHOW {
218 ls_puts(" ... " as *u8)
219 ls_puti(ctr[2] - LS_MAXSHOW)
220 ls_puts(" more VIOLATIONS not shown (cap " as *u8)
221 ls_puti(LS_MAXSHOW)
222 ls_puts(" declared, not silent)\n" as *u8)
223 }
224
225 ls_puts("\nNX-LAYERSCAN files=" as *u8); ls_puti(ctr[0])
226 ls_puts(" imports=" as *u8); ls_puti(ctr[1])
227 ls_puts(" VIOLATIONS=" as *u8); ls_puti(ctr[2])
228 ls_puts(" file_cap_hit=" as *u8); ls_puti(ctr[4])
229 ls_puts("\nenvelope: FLAT runtime/ scan (shadow trees excluded); first " as *u8); ls_puti(LS_HEADCAP)
230 ls_puts(" bytes per file scanned for imports;\n two openat probes per import, no name tables so nothing can silently overflow.\n" as *u8)
231 ls_puts(" FIX EVERY HIT BY MOVING THE LIB _hdl_build/ -> runtime/ (NEVER copy: _hdl_build can still reach\n runtime/, so a move satisfies both trees and creates no duplicate basename).\n" as *u8)
232
233 if ctr[0] == 0 {
234 ls_puts("VERDICT=RED scanned ZERO files -- a census that finds nothing has failed, not passed.\n" as *u8)
235 return 1
236 }
237 if ctr[4] == 1 {
238 ls_puts("VERDICT=PARTIAL file cap hit -- count is a FLOOR, not a total.\n" as *u8)
239 return 1
240 }
241 if ctr[2] == 0 {
242 ls_puts("VERDICT=GREEN no runtime/ organ imports an _hdl_build-only lib.\n" as *u8)
243 return 0
244 }
245 ls_puts("VERDICT=RED silently-unbuildable subtrees exist.\n" as *u8)
246 return 1
247}