`nx_liblift.nx` source

↩ module page · 414 lines · 16956 B
1// nx_liblift.nx -- BYTE-PRESERVING LIFT of a shared lib from _hdl_build/ into runtime/, the one file
2// operation this ecosystem could not perform and therefore never performed.
3//
4// WHY IT EXISTS (measured 2026-07-31, id 1785474294): nx_layerscan_gate found **8 misplaced libs darkening
5// 26+ organs** -- nx_ingest(5) nx_grep(5) nx_lib_ingest(4, incl the nx_lib_http daemon) nx_fft(3, PLUS the
6// entire training capability via nx_fft_f32 -> nx_autograd_tensor) nx_bm25(3, PLUS rights-enforced DMS search)
7// nx_proc_ctl(3, incl **nx_proc_kill**, the sovereign runaway-process killer) nx_json_emit(2) nx_teacher(1).
8// Each is unbuildable because runtime/ CANNOT import _hdl_build/. The whole remedy is 8 file moves -- and
9// there was NO TOOL THAT COULD MOVE A FILE IN THAT DIRECTION. nx_retire_path only moves into
10// knowledge/retired/ (fixed destination) and nx_dedupe_source moves the WRONG WAY (it deletes the runtime
11// copy and calls _hdl_build canonical, id 1785474494). So the ecosystem could diagnose this class but not
12// fix it, which is why 8 libs sat misplaced long enough to darken a training stack.
13//
14// THE DIRECTION IS NOT A PREFERENCE, IT IS FORCED BY THE ASYMMETRY: _hdl_build/ CAN import runtime/, and
15// runtime/ CANNOT import _hdl_build/. A lib that BOTH trees need therefore has exactly ONE correct home:
16// runtime/. Lifting satisfies every consumer at once and creates no duplicate that could later diverge --
17// which is why this is a LIFT (copy down + retire the original), never a copy-and-leave.
18//
19// SAFETY, all fail-closed and all verified rather than assumed:
20//   - REFUSES if the source is missing (nothing to lift)
21//   - REFUSES if the destination already exists -- NEVER clobbers a runtime/ file, because the whole point
22//     is to stop losing work, and a lift that overwrites is just a faster way to lose it
23//   - BYTE-VERIFIES after writing: re-reads the destination and compares length AND every byte against the
24//     source, reporting VERIFY-FAIL rather than success if they differ (a copy nobody checked is a rumour)
25//   - DOES NOT DELETE THE ORIGINAL. Retiring it is a SEPARATE, reversible act:
26//         nx_retire_path retire buildroot/runtime/_hdl_build/<name>.nx
27//     Two verbs, two decisions -- so a half-finished lift leaves both copies rather than none.
28//
29//   nx_liblift check <name>   -- report src/dst presence + sizes, MUTATES NOTHING
30//   nx_liblift lift  <name>   -- copy _hdl_build/<name>.nx -> runtime/<name>.nx, byte-verified
31//     exit 0 ok | 2 usage | 3 source missing | 4 destination exists | 5 read fail | 6 write fail | 7 verify fail
32// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
33import "nx_syscalls.nx"
34
35const LL_SRCDIR: *u8 = "buildroot/runtime/_hdl_build" as *u8
36const LL_DSTDIR: *u8 = "buildroot/runtime" as *u8
37const LL_PATHBUF: i64 = 1024
38const LL_MODE: i64 = 420
39
40func ll_puts(s: *u8) {
  var n: i64 = 0
  while s[n] != (0 as u8) { n = n + 1 }
  sys_write(1, s, n)
44}
45
46func ll_puti(x: i64) {
  var buf: *u8 = sys_mmap(64) as *u8
  var v: i64 = x
  var neg: i64 = 0
  if v < 0 {
      neg = 1
      v = 0 - v
  }
  var i: i64 = 40
  if v == 0 {
      i = i - 1
      buf[i] = 48 as u8
  }
  while v > 0 {
      let d: i64 = v - (v / 10) * 10
      i = i - 1
      buf[i] = (d + 48) as u8
      v = v / 10
  }
  if neg == 1 {
      i = i - 1
      buf[i] = 45 as u8
  }
  sys_write(1, ((buf as i64) + i) as *u8, 40 - i)
70}
71
72// out = "<dir>/<name>.nx"
73func ll_path(out: *u8, dir: *u8, name: *u8) {
  var w: i64 = 0
  var i: i64 = 0
  while dir[i] != (0 as u8) {
      out[w] = dir[i]
      w = w + 1
      i = i + 1
  }
  out[w] = 47 as u8
  w = w + 1
  i = 0
  while name[i] != (0 as u8) {
      out[w] = name[i]
      w = w + 1
      i = i + 1
  }
  out[w] = 46 as u8
  out[w + 1] = 110 as u8
  out[w + 2] = 120 as u8
  out[w + 3] = 0 as u8
93}
94
95func ll_exists(path: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 }
  sys_close(fd)
  return 1
100}
101
102// ---------------------------------------------------------------------------------------------------
103// CLOSURE WALKER, added 2026-07-31 (id 1785477577). WHY: this tool could MOVE a lib but could not say
104// what the move DRAGGED WITH IT, so it pushed its hardest step onto every caller. Measured cost of that
105// gap: lifting nx_bm25 to runtime/ CREATED a fresh layering violation, because nx_bm25 imports
106// nx_research_extract which was _hdl_build-only. The lift succeeded, byte-verified, and the consumer
107// STILL failed with the identical expand_imports error -- indistinguishable from "the fix did not work".
108// LAW: MOVING A LIB ACROSS A LAYER BOUNDARY MOVES ITS ENTIRE IMPORT CLOSURE INTO THAT LAYER'S
109// CONSTRAINTS. A one-file move is never one file. `deps` computes that set BEFORE any bytes move.
110const LL_MAXQ: i64 = 256
111const LL_NAMELEN: i64 = 64
112
113func ll_nlen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
114
115func ll_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) {
      if a[i] != b[i] { return 0 }
      i = i + 1
  }
  if b[i] != (0 as u8) { return 0 }
  return 1
123}
124
125func ll_slot(tab: *u8, idx: i64) -> *u8 { return ((tab as i64) + idx * LL_NAMELEN) as *u8 }
126
127// Append name into tab only if absent. Writes into slot cnt as scratch FIRST, then dedupes against
128// 0..cnt-1; a duplicate simply returns cnt and the scratch is overwritten next call. Bounded by
129// LL_MAXQ and LL_NAMELEN -- REFUSES rather than truncating, so the closure can never silently shrink.
130func ll_push(tab: *u8, cnt: i64, src: *u8, n: i64) -> i64 {
  if n <= 0 { return cnt }
  if n >= LL_NAMELEN { return cnt }
  if cnt >= LL_MAXQ { return cnt }
  let dstp: *u8 = ll_slot(tab, cnt)
  var i: i64 = 0
  while i < n { dstp[i] = src[i]; i = i + 1 }
  dstp[n] = 0 as u8
  var k: i64 = 0
  while k < cnt {
      if ll_streq(ll_slot(tab, k), dstp) == 1 { return cnt }
      k = k + 1
  }
  return cnt + 1
144}
145
146// Scan buf for `import "NAME.nx"` and push each NAME (with .nx stripped) into tab. The .nx suffix is
147// only stripped when it is actually present, so an unexpected import spelling is kept verbatim and
148// shows up as MISSING-EVERYWHERE rather than being silently mangled into a name that resolves.
149func ll_scan_imports(buf: *u8, n: i64, tab: *u8, cnt: i64) -> i64 {
  var c: i64 = cnt
  var i: i64 = 0
  while i + 10 < n {
      var hit: i64 = 0
      if buf[i] == (105 as u8) {
      if buf[i+1] == (109 as u8) {
      if buf[i+2] == (112 as u8) {
      if buf[i+3] == (111 as u8) {
      if buf[i+4] == (114 as u8) {
      if buf[i+5] == (116 as u8) { hit = 1 } } } } } }
      if hit == 1 {
          var j: i64 = i + 6
          var q: i64 = 0 - 1
          var stop: i64 = 0
          while stop == 0 {
              if j >= n { stop = 1 } else {
                  if buf[j] == (34 as u8) { q = j; stop = 1 } else {
                      if buf[j] == (10 as u8) { stop = 1 } else { j = j + 1 }
                  }
              }
          }
          if q >= 0 {
              var e: i64 = q + 1
              var stop2: i64 = 0
              while stop2 == 0 {
                  if e >= n { stop2 = 1 } else {
                      if buf[e] == (34 as u8) { stop2 = 1 } else { e = e + 1 }
                  }
              }
              if e < n {
                  let p: *u8 = ((buf as i64) + q + 1) as *u8
                  var L: i64 = e - (q + 1)
                  if L > 3 {
                      if p[L-3] == (46 as u8) {
                      if p[L-2] == (110 as u8) {
                      if p[L-1] == (120 as u8) { L = L - 3 } } }
                  }
                  c = ll_push(tab, c, p, L)
              }
          }
      }
      i = i + 1
  }
  return c
194}
195// ---------------------------------------------------------------------------------------------------
196
197func main(argc: i64, argv: *i64) -> i64 {
  if argc < 3 {
      ll_puts("usage: nx_liblift check <name> | lift <name>   (name WITHOUT the .nx)\n" as *u8)
      ll_puts("  lifts _hdl_build/<name>.nx -> runtime/<name>.nx, byte-verified, never clobbers.\n" as *u8)
      ll_puts("  retire the original SEPARATELY: nx_retire_path retire buildroot/runtime/_hdl_build/<name>.nx\n" as *u8)
      return 2
  }
  let verb: *u8 = argv[1] as *u8
  let name: *u8 = argv[2] as *u8
206
  let src: *u8 = sys_mmap(LL_PATHBUF)
  let dst: *u8 = sys_mmap(LL_PATHBUF)
  ll_path(src, LL_SRCDIR, name)
  ll_path(dst, LL_DSTDIR, name)
211
  let slen: *i64 = sys_mmap(16) as *i64
  slen[0] = 0
  let sbuf: *u8 = sys_read_file(src, slen)
  let have_src: i64 = ll_exists(src)
  let have_dst: i64 = ll_exists(dst)
217
  ll_puts("NX-LIBLIFT name=" as *u8); ll_puts(name)
  ll_puts(" src_exists=" as *u8); ll_puti(have_src)
  ll_puts(" src_bytes=" as *u8); ll_puti(slen[0])
  ll_puts(" dst_exists=" as *u8); ll_puti(have_dst)
  ll_puts("\n" as *u8)
223
  // revive <artifact-relpath> <dest-basename> -- byte-verified COPY of a RETIRED artifact back into
  // runtime/ under a NEW name.
  //
  // WHY: the 2026-07-21 dedupe treated NAME COLLISIONS as copies and deleted live capabilities. Two are
  // proven -- the nx_http_health /health EMITTER (3 importers) and the nx_teacher LESSON organ (6) --
  // and nx_undefscan dupescan measured 26 candidates across 116 artifacts. Restoring under the OLD name
  // would recreate the very collision that caused the loss, so this verb REQUIRES a distinct
  // destination and REFUSES to clobber. It NEVER deletes or renames: the artifact stays exactly where
  // it is, so a wrong revive costs one file, not the evidence.
  if verb[0] == (114 as u8) {
      if argc < 4 {
          ll_puts("REVIVE: need <artifact-relpath> <dest-basename>  (dest WITHOUT .nx)\n" as *u8)
          return 2
      }
      let apath: *u8 = argv[2] as *u8
      let dname: *u8 = argv[3] as *u8
      let dpath: *u8 = sys_mmap(LL_PATHBUF)
      ll_path(dpath, LL_DSTDIR, dname)
      if ll_exists(dpath) == 1 {
          ll_puts("REVIVE REFUSED: destination EXISTS at " as *u8); ll_puts(dpath)
          ll_puts(" -- never clobbers.\n" as *u8)
          return 4
      }
      let al: *i64 = sys_mmap(16) as *i64
      al[0] = 0
      let ab: *u8 = sys_read_file(apath, al)
      if al[0] <= 0 {
          ll_puts("REVIVE REFUSED: artifact unreadable or empty at " as *u8); ll_puts(apath)
          ll_puts("\n" as *u8)
          return 3
      }
      let rfd: i64 = sys_openat_wr(dpath, LL_MODE)
      if rfd < 0 {
          ll_puts("REVIVE FAIL: cannot open destination for write.\n" as *u8)
          return 6
      }
      sys_write(rfd, ab, al[0])
      sys_close(rfd)
      let vl: *i64 = sys_mmap(16) as *i64
      vl[0] = 0
      let vb: *u8 = sys_read_file(dpath, vl)
      if vl[0] != al[0] {
          ll_puts("REVIVE FAIL: read-back size mismatch -- destination NOT trustworthy.\n" as *u8)
          return 7
      }
      var vi: i64 = 0
      while vi < al[0] {
          if ab[vi] != vb[vi] {
              ll_puts("REVIVE FAIL: read-back BYTE mismatch at offset " as *u8); ll_puti(vi)
              ll_puts("\n" as *u8)
              return 7
          }
          vi = vi + 1
      }
      ll_puts("REVIVED bytes=" as *u8); ll_puti(al[0])
      ll_puts(" -> runtime/" as *u8); ll_puts(dname)
      ll_puts(".nx  (byte-verified; artifact left untouched)\n" as *u8)
      return 0
  }
283
  if verb[0] == (99 as u8) {
      if have_src == 0 { ll_puts("CHECK: source ABSENT -- nothing to lift.\n" as *u8); return 0 }
      if have_dst == 1 { ll_puts("CHECK: destination ALREADY EXISTS -- lift would REFUSE (never clobbers).\n" as *u8); return 0 }
      ll_puts("CHECK: liftable. runtime/ consumers currently CANNOT import this lib.\n" as *u8)
      return 0
  }
290
  if verb[0] == (100 as u8) {
      if have_src == 0 { ll_puts("DEPS: source ABSENT -- nothing to walk.\n" as *u8); return 0 }
      let tab: *u8 = sys_mmap(LL_MAXQ * LL_NAMELEN)
      let imp: *u8 = sys_mmap(LL_MAXQ * LL_NAMELEN)
      let fp: *u8 = sys_mmap(LL_PATHBUF)
      let rp: *u8 = sys_mmap(LL_PATHBUF)
      let hp: *u8 = sys_mmap(LL_PATHBUF)
      let ln: *i64 = sys_mmap(16) as *i64
      var cnt: i64 = ll_push(tab, 0, name, ll_nlen(name))
      var head: i64 = 0
      var missing: i64 = 0
      while head < cnt {
          let cur: *u8 = ll_slot(tab, head)
          ll_path(fp, LL_SRCDIR, cur)
          ln[0] = 0
          let b: *u8 = sys_read_file(fp, ln)
          if ln[0] > 0 {
              let icnt: i64 = ll_scan_imports(b, ln[0], imp, 0)
              var k: i64 = 0
              while k < icnt {
                  let dep: *u8 = ll_slot(imp, k)
                  ll_path(rp, LL_DSTDIR, dep)
                  ll_path(hp, LL_SRCDIR, dep)
                  if ll_exists(rp) == 0 {
                      if ll_exists(hp) == 1 {
                          cnt = ll_push(tab, cnt, dep, ll_nlen(dep))
                      } else {
                          missing = missing + 1
                          ll_puts("  MISSING-EVERYWHERE " as *u8); ll_puts(dep)
                          ll_puts("  (in NEITHER tree -- a lift cannot fix this one)\n" as *u8)
                      }
                  }
                  k = k + 1
              }
          }
          head = head + 1
      }
      ll_puts("NX-LIBLIFT-DEPS name=" as *u8); ll_puts(name)
      ll_puts(" closure=" as *u8); ll_puti(cnt)
      ll_puts(" must_lift=" as *u8); ll_puti(cnt - 1)
      ll_puts(" missing=" as *u8); ll_puti(missing)
      ll_puts("\n" as *u8)
      var z: i64 = 1
      while z < cnt {
          ll_puts("  LIFT-ALSO " as *u8); ll_puts(ll_slot(tab, z)); ll_puts("\n" as *u8)
          z = z + 1
      }
      if cnt >= LL_MAXQ {
          ll_puts("VERDICT=OVERFLOW closure hit LL_MAXQ -- this count is a FLOOR, raise the cap and re-run\n" as *u8)
          return 5
      }
      if cnt == 1 {
          ll_puts("VERDICT=CLEAN lift this file alone; every import it needs already resolves in runtime/\n" as *u8)
          return 0
      }
      ll_puts("VERDICT=MUST-LIFT-CLOSURE lift every LIFT-ALSO name too, or the move trades one dark subtree for another\n" as *u8)
      return 0
  }
349
  if have_src == 0 {
      ll_puts("REFUSED: source missing at " as *u8); ll_puts(src); ll_puts("\n" as *u8)
      return 3
  }
  if have_dst == 1 {
      ll_puts("REFUSED: destination EXISTS at " as *u8); ll_puts(dst)
      ll_puts(" -- a lift that overwrites is a faster way to lose work. Reconcile deliberately.\n" as *u8)
      return 4
  }
  if sbuf as i64 == 0 {
      ll_puts("REFUSED: source unreadable.\n" as *u8)
      return 5
  }
  if slen[0] <= 0 {
      ll_puts("REFUSED: source is EMPTY -- refusing to create an empty lib.\n" as *u8)
      return 5
  }
367
  let fd: i64 = sys_openat_wr(dst, LL_MODE)
  if fd < 0 {
      ll_puts("REFUSED: cannot open destination for write.\n" as *u8)
      return 6
  }
  let wrote: i64 = sys_write(fd, sbuf, slen[0])
  sys_close(fd)
  if wrote != slen[0] {
      ll_puts("WRITE-SHORT wrote=" as *u8); ll_puti(wrote)
      ll_puts(" of " as *u8); ll_puti(slen[0]); ll_puts("\n" as *u8)
      return 6
  }
380
  // BYTE-VERIFY: a copy nobody checked is a rumour.
  let vlen: *i64 = sys_mmap(16) as *i64
  vlen[0] = 0
  let vbuf: *u8 = sys_read_file(dst, vlen)
  if vbuf as i64 == 0 {
      ll_puts("VERIFY-FAIL: destination unreadable after write.\n" as *u8)
      return 7
  }
  if vlen[0] != slen[0] {
      ll_puts("VERIFY-FAIL length src=" as *u8); ll_puti(slen[0])
      ll_puts(" dst=" as *u8); ll_puti(vlen[0]); ll_puts("\n" as *u8)
      return 7
  }
  var i: i64 = 0
  var bad: i64 = 0 - 1
  while i < slen[0] {
      if sbuf[i] != vbuf[i] {
          bad = i
          i = slen[0]
      } else { i = i + 1 }
  }
  if bad >= 0 {
      ll_puts("VERIFY-FAIL first differing byte at offset " as *u8); ll_puti(bad); ll_puts("\n" as *u8)
      return 7
  }
406
  ll_puts("LIFTED bytes=" as *u8); ll_puti(slen[0])
  ll_puts(" VERIFIED byte-for-byte -> " as *u8); ll_puts(dst); ll_puts("\n" as *u8)
  ll_puts("  ORIGINAL LEFT IN PLACE ON PURPOSE. Retire it deliberately and reversibly with:\n" as *u8)
  ll_puts("    nx_retire_path retire " as *u8); ll_puts(src); ll_puts("\n" as *u8)
  ll_puts("  Until then BOTH copies exist; _hdl_build resolves its own first, so nothing regresses today,\n" as *u8)
  ll_puts("  but leaving both is the divergence class -- finish the move.\n" as *u8)
  return 0
414}
nx_liblift.nx source

`nx_liblift.nx` source
