code wiki / _hdl_build / nx_lossclass.nx
nx_lossclass.nx source
↩ module page · 208 lines · 11982 B
1// nx_lossclass.nx -- the missing discriminator for nx_stale_check's CAPABILITY-LOSS verdict.
2//
3// WHY THIS EXISTS (root-caused 2026-08-06). nx_stale_check compares a fresh build against the
4// deployed elf and, when a DEPLOYED STRING IS ABSENT FROM THE REBUILD, returns CAPABILITY-LOSS +
5// "DO NOT RESTAGE". That conflates TWO OPPOSITE EVENTS:
6// (a) REGRESSION -- the source genuinely lost the capability. Restaging destroys shipped function.
7// (b) CORRECTION -- someone DELIBERATELY deleted a string because it was a LIE or described a bug
8// that has since been FIXED. Restaging SHIPS THE FIX.
9// Measured cases that provoked this organ, BOTH class (b):
10// nx_https_get lost "BAD_CIPHER ... (0x1302 AES-256-GCM-SHA384)" because R9 (2026-08-05) made
11// 0x1302 REAL -- the diagnostic had become false. Token 0x1302: 41 source hits.
12// nx_page_verify lost "image/avif" from its Accept header because the estate has NO AVIF decoder
13// and advertising it was a lie (nx_codec_caps_gate pins it BY NAME). 17 source hits.
14// CONSEQUENCE: a gauge that reads every deletion as damage BLOCKS EVERY CORRECTION FROM PRODUCTION.
15// In an estate whose doctrine is to delete unfounded claims, that gauge manufactures the staleness it
16// reports (CURRENT=77/1427 measured the same day). ***THE STALENESS GAUGE WAS CAUSING THE STALENESS.***
17//
18// THE DISCRIMINATOR: a capability that was CORRECTED still has its SUBJECT in the tree -- the topic is
19// discussed, gated, re-implemented. A capability genuinely LOST has no trace. So: grep the missing
20// string's most distinctive TOKEN across the source tree.
21// token still present => DELIBERATE-EDIT => restage is SAFE (and is how the fix ships)
22// token absent => GENUINE-LOSS => do NOT restage; recover the source first
23//
24// ***A FAILED SEARCH IS NOT AN ABSENT TOKEN.*** If the fork never ran or the scan was partial, this
25// organ returns UNSCORABLE and REFUSES to classify. Reporting a defeat as "absent" would flip the
26// verdict to GENUINE-LOSS and block a good fix -- the exact laundering nx_ui_audit was caught doing.
27//
28// nx_lossclass classify <token> [srcdir] [ext] (srcdir default buildroot/runtime, ext default nx)
29// nx_lossclass selftest
30// exit: 0 classified | 2 usage | 3 selftest-fail | 5 unscorable
31// license_tier: ORIGINAL expect_exit: 0
32import "nx_tool_run.nx"
33import "nx_syscalls.nx"
34
35const LC_CAP: i64 = 262144
36const LC_EXIT_UNSCORABLE: i64 = 5
37
38func lw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
39func lwe(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(2,s,n); return 0 }
40func lwn(v: i64) -> i64 { var m: i64=v; if m<0{lw("-" as *u8);m=0-m} let t:*u8=sys_mmap(28); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(28); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); sys_munmap(t,28); sys_munmap(o,28); return 0 }
41func lq() -> i64 { let c:*u8=sys_mmap(8); c[0]=34 as u8; sys_write(1,c,1); sys_munmap(c,8); return 0 }
42func lkv(k: *u8) -> i64 { lq(); lw(k); lq(); lw(":" as *u8); return 0 }
43
44func lc_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
45
46func lc_streq(a: *u8, b: *u8) -> i64 {
47 var i: i64 = 0
48 var r: i64 = 2
49 while r == 2 { if a[i] != b[i] { r = 0 } else { if a[i] == (0 as u8) { r = 1 } else { i = i + 1 } } }
50 return r
51}
52
53// find NUL-term pat in buf[0,n); return index or -1
54func lc_find(buf: *u8, n: i64, pat: *u8) -> i64 {
55 let pl: i64 = lc_slen(pat)
56 if pl == 0 { return 0 - 1 }
57 var i: i64 = 0
58 var hit: i64 = 0 - 1
59 while i + pl <= n {
60 var k: i64 = 0
61 var m: i64 = 1
62 while k < pl { if buf[i+k] != pat[k] { m = 0; k = pl } else { k = k + 1 } }
63 if m == 1 { hit = i; i = n + pl } else { i = i + 1 }
64 }
65 return hit
66}
67
68// read the integer that begins at buf[p]
69func lc_num_at(buf: *u8, n: i64, p: i64) -> i64 {
70 var v: i64 = 0
71 var i: i64 = p
72 while i < n {
73 let c: i64 = buf[i]
74 if c < 48 { i = n } else { if c > 57 { i = n } else { v = v*10 + (c - 48); i = i + 1 } } }
75 return v
76}
77
78// run nx_shelltool grep <tok> <dir> <ext> and return matches, or -1 if the SCAN ITSELF failed.
79func lc_grep_count(tok: *u8, dir: *u8, ext: *u8, partial: *i64) -> i64 {
80 let ST: *u8 = "/volume1/homes/elderwesto/nishihost/nx_shelltool.elf" as *u8
81 let buf: *u8 = sys_mmap(LC_CAP + 16)
82 let olen: *i64 = sys_mmap(16) as *i64
83 let av: *i64 = sys_mmap(16*8) as *i64
84 av[0] = ST as i64
85 av[1] = "grep" as i64
86 av[2] = tok as i64
87 av[3] = dir as i64
88 av[4] = ext as i64
89 av[5] = 0
90 var frc: i64 = tr_run_capture(ST, av, buf, LC_CAP, olen)
91 var n: i64 = olen[0]
92 // ONE bounded retry: a fork-capture that returns empty under load is not an absent token.
93 if n <= 0 { if frc != 127 { olen[0] = 0; frc = tr_run_capture(ST, av, buf, LC_CAP, olen); n = olen[0] } }
94 if frc == 127 { return 0 - 1 }
95 if n <= 0 { return 0 - 1 }
96 // BUDGET-EXCEEDED means the scan did not cover the tree -- a low count is then NOT evidence.
97 if lc_find(buf, n, "BUDGET-EXCEEDED" as *u8) >= 0 { partial[0] = 1 }
98 let mp: i64 = lc_find(buf, n, "matches=" as *u8)
99 if mp < 0 { return 0 - 1 }
100 return lc_num_at(buf, n, mp + 8)
101}
102
103func lc_classify(tok: *u8, dir: *u8, ext: *u8) -> i64 {
104 let partial: *i64 = sys_mmap(16) as *i64
105 partial[0] = 0
106 let hits: i64 = lc_grep_count(tok, dir, ext, partial)
107 if hits < 0 {
108 lw("NX-LOSSCLASS verdict=UNSCORABLE reason=scan-did-not-run -- REFUSING to classify. A failed search is NOT an absent token; calling it GENUINE-LOSS would block a good fix.\n" as *u8)
109 sys_exit(LC_EXIT_UNSCORABLE)
110 return LC_EXIT_UNSCORABLE
111 }
112 if hits == 0 { if partial[0] == 1 {
113 lw("NX-LOSSCLASS verdict=UNSCORABLE reason=partial-scan-zero-hits -- the scan hit its budget BEFORE covering the tree, so zero is not evidence of absence.\n" as *u8)
114 sys_exit(LC_EXIT_UNSCORABLE)
115 return LC_EXIT_UNSCORABLE
116 } }
117 lw("{" as *u8)
118 lkv("organ" as *u8); lq(); lw("nx_lossclass" as *u8); lq(); lw("," as *u8)
119 lkv("token" as *u8); lq(); lw(tok); lq(); lw("," as *u8)
120 lkv("srcdir" as *u8); lq(); lw(dir); lq(); lw("," as *u8)
121 lkv("source_hits" as *u8); lwn(hits); lw("," as *u8)
122 lkv("partial_scan" as *u8); lwn(partial[0]); lw("," as *u8)
123 lkv("verdict" as *u8); lq()
124 if hits > 0 { lw("DELIBERATE-EDIT" as *u8) } else { lw("GENUINE-LOSS" as *u8) }
125 lq(); lw("," as *u8)
126 lkv("restage" as *u8); lq()
127 if hits > 0 { lw("SAFE -- the subject is still live in source; the string was rewritten or retired on purpose, and restaging is how that correction ships" as *u8) } else { lw("BLOCK -- no trace of the subject in source; recover it before any rebuild" as *u8) }
128 lq(); lw("," as *u8)
129 lkv("envelope" as *u8); lq(); lw("token presence is EVIDENCE OF INTENT, not proof; a token that survives only in a comment still means a human touched the subject. Pair with nx_stale_check, never replace it." as *u8); lq()
130 lw("}\n" as *u8)
131 return 0
132}
133
134func lc_selftest() -> i64 {
135 lw("=== nx_lossclass selftest (each tooth carries its opposite) ===\n" as *u8)
136 var pass: i64 = 0
137 var total: i64 = 0
138 let partial: *i64 = sys_mmap(16) as *i64
139 let dir: *u8 = "buildroot/runtime" as *u8
140 let ext: *u8 = "nx" as *u8
141
142 // T1 a token that certainly EXISTS must count > 0. It must ALSO be a token whose match set is
143 // SMALL: the first draft used "func main", which floods 2068 lines past the capture so the
144 // trailing summary never parses and the organ correctly answers UNSCORABLE. The organ was right
145 // and THE TOOTH WAS WRONG -- a test can encode the bug. Envelope: this classifier is for SPECIFIC
146 // strings lifted out of a MISSING-FROM-REBUILD line, never for floods.
147 partial[0] = 0
148 let h_present: i64 = lc_grep_count("AES-256-GCM-SHA384" as *u8, dir, ext, partial)
149 total=total+1; if h_present > 0 { pass=pass+1; lw(" [PASS] " as *u8) } else { lw(" [FAIL] " as *u8) }
150 lw("T1 present token 'AES-256-GCM-SHA384' hits=" as *u8); lwn(h_present); lw(" (want >0)\n" as *u8)
151
152 // T2 OPPOSITE: a token that cannot exist must count exactly 0 -- and must NOT be -1 (that would
153 // mean the scan failed, which is a different thing entirely).
154 // ***THE PROBE MUST NOT BE FINDABLE IN THE PROBE.*** The first draft wrote the improbable token as
155 // a LITERAL, so this organ's own source -- which lives under the tree it scans -- matched it and
156 // the tooth read 1. That is the self-reference trap nx_adopt excludes BY DESIGN. Assemble the
157 // token at RUNTIME from two halves so no contiguous copy exists anywhere in the corpus.
158 let tokbuf: *u8 = sys_mmap(64)
159 var ti: i64 = 0
160 let p1: *u8 = "zzq_absent_" as *u8
161 let p2: *u8 = "tok_91827364" as *u8
162 var z: i64 = 0
163 while p1[z] != (0 as u8) { tokbuf[ti] = p1[z]; ti = ti + 1; z = z + 1 }
164 z = 0
165 while p2[z] != (0 as u8) { tokbuf[ti] = p2[z]; ti = ti + 1; z = z + 1 }
166 tokbuf[ti] = 0 as u8
167 partial[0] = 0
168 let h_absent: i64 = lc_grep_count(tokbuf, dir, ext, partial)
169 total=total+1; if h_absent == 0 { pass=pass+1; lw(" [PASS] " as *u8) } else { lw(" [FAIL] " as *u8) }
170 lw("T2 runtime-assembled absent token hits=" as *u8); lwn(h_absent); lw(" (want exactly 0, NOT -1; assembled at runtime so the probe is not findable in the probe) -- OPPOSITE of T1\n" as *u8)
171
172 // T3 the two real cases that provoked this organ must both classify DELIBERATE-EDIT
173 partial[0] = 0
174 let h_1302: i64 = lc_grep_count("0x1302" as *u8, dir, ext, partial)
175 total=total+1; if h_1302 > 0 { pass=pass+1; lw(" [PASS] " as *u8) } else { lw(" [FAIL] " as *u8) }
176 lw("T3 nx_https_get case: token '0x1302' hits=" as *u8); lwn(h_1302); lw(" => DELIBERATE-EDIT (R9 made the suite real, the diagnostic became false)\n" as *u8)
177 partial[0] = 0
178 let h_avif: i64 = lc_grep_count("image/avif" as *u8, dir, ext, partial)
179 total=total+1; if h_avif > 0 { pass=pass+1; lw(" [PASS] " as *u8) } else { lw(" [FAIL] " as *u8) }
180 lw("T4 nx_page_verify case: token 'image/avif' hits=" as *u8); lwn(h_avif); lw(" => DELIBERATE-EDIT (no AVIF decoder; advertising it was a lie)\n" as *u8)
181
182 // T5 A FAILED SCAN MUST NOT READ AS ABSENCE -- point at a directory that does not exist.
183 partial[0] = 0
184 let h_bad: i64 = lc_grep_count("func main" as *u8, "buildroot/zzq_no_such_dir_91827" as *u8, ext, partial)
185 total=total+1; if h_bad < 0 { pass=pass+1; lw(" [PASS] " as *u8) } else { lw(" [FAIL] " as *u8) }
186 lw("T5 unreadable dir returns " as *u8); lwn(h_bad); lw(" (want -1 = UNSCORABLE, NEVER 0) -- a failed search is not an absent token\n" as *u8)
187
188 lw("NX-LOSSCLASS selftest " as *u8); lwn(pass); lw("/" as *u8); lwn(total)
189 if pass == total { lw(" verdict=GREEN\n" as *u8); return 0 }
190 lw(" verdict=RED\n" as *u8)
191 sys_exit(3)
192 return 3
193}
194
195func main(argc: i64, argv: *i64) -> i64 {
196 if argc < 2 { lwe("usage: nx_lossclass classify <token> [srcdir] [ext] | selftest\n" as *u8); sys_exit(2); return 2 }
197 let verb: *u8 = argv[1] as *u8
198 if lc_streq(verb, "selftest" as *u8) == 1 { return lc_selftest() }
199 if lc_streq(verb, "classify" as *u8) == 0 { lwe("usage: nx_lossclass classify <token> [srcdir] [ext] | selftest\n" as *u8); sys_exit(2); return 2 }
200 if argc < 3 { lwe("usage: nx_lossclass classify <token> [srcdir] [ext]\n" as *u8); sys_exit(2); return 2 }
201 let tok: *u8 = argv[2] as *u8
202 if lc_slen(tok) == 0 { lwe("NX-LOSSCLASS REFUSED: empty token matches everything and would always read DELIBERATE-EDIT\n" as *u8); sys_exit(2); return 2 }
203 var dir: *u8 = "buildroot/runtime" as *u8
204 var ext: *u8 = "nx" as *u8
205 if argc >= 4 { dir = argv[3] as *u8 }
206 if argc >= 5 { ext = argv[4] as *u8 }
207 return lc_classify(tok, dir, ext)
208}