nx_magicnum_preventer.nx source

1import "nx_gate_gn.nx" 2import "nx_gate_base.nx" 3// nx_magicnum_preventer.nx -- THE PREVENTER: wire the team's magic-number DETECTOR (nx_magicnum_synth, mask 51) 4// into the build pipeline as an ENFORCEMENT GATE. Detection -> prevention: a source with magic numbers above the 5// BUDGET FAILS the gate (blocked) before it can build/register. Demonstrates rule-11 enforcement: a magic literal 6// is BLOCKED; moving it to a `const` makes the SAME code PASS (the exact rule-11 fix). The BUDGET is a NAMED CONST 7// (the preventer eats its own dog food -- no magic threshold). HONEST: the team's first detector is COARSE -- it 8// flags ASCII codes / array indices too (over-flagging on real source); refining the rule (an allowlist) is the 9// next team-growth rung, surfaced measurably (T5). Claude wires the gate; the TEAM authored the detection logic. 10// license_tier: ORIGINAL 11import "nx_syscalls.nx" 12const NX_MAGIC_1048576: i64 = 1048576 13const NX_MAGIC_65536: i64 = 65536 14const NX_MAGIC_1000000: i64 = 1000000 15 16const NX_MAGICNUM_BUDGET: i64 = 0 // zero-tolerance for NEW code (named, not a magic number) 17const NX_MAGICNUM_DET_MASK: i64 = 51 // the team's discovered detector (require>=2, exclude const-line+identifier) 18 19func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw(" 20" as *u8); return ok } 21func slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 22func is_digit(c: u8) -> i64 { if c>=(48 as u8) { if c<=(57 as u8) { return 1 } } return 0 } 23func is_alnum_us(c: u8) -> i64 { 24 if c>=(48 as u8) { if c<=(57 as u8) { return 1 } } 25 if c>=(65 as u8) { if c<=(90 as u8) { return 1 } } 26 if c>=(97 as u8) { if c<=(122 as u8) { return 1 } } 27 if c==(95 as u8) { return 1 } 28 return 0 29} 30func match_at(buf: *u8, i: i64, len: i64, lit: *u8) -> i64 { 31 let nl: i64=slen(lit); if i+nl>len { return 0 } 32 var j: i64=0; while j<nl { let a: *u8=((buf as i64)+i+j) as *u8; if a[0]!=lit[j] { return 0 } j=j+1 } 33 return 1 34} 35func trit_pass(t: i64, pv: i64) -> i64 { if t==0 { return 1 } if t==1 { if pv==1 { return 1 } return 0 } if pv==0 { return 1 } return 0 } 36// the TEAM's detector (mask = the discovered predicate-combination). 37func scan_count(buf: *u8, len: i64, mask: i64) -> i64 { 38 let t0: i64=mask%3; let t1: i64=(mask/3)%3; let t2: i64=(mask/9)%3; let t3: i64=(mask/27)%3 39 var count: i64=0; var i: i64=0; var in_comment: i64=0; var line_const: i64=0 40 while i<len { 41 let c: *u8=((buf as i64)+i) as *u8 42 if c[0]==(10 as u8) { in_comment=0; line_const=0; i=i+1 } 43 else { if in_comment==1 { i=i+1 } 44 else { if match_at(buf,i,len,"//" as *u8)==1 { in_comment=1; i=i+2 } 45 else { if match_at(buf,i,len,"const" as *u8)==1 { line_const=1; i=i+5 } 46 else { if is_digit(c[0])==1 { 47 var prev_alnum: i64=0 48 if i>0 { let pc: *u8=((buf as i64)+i-1) as *u8; if is_alnum_us(pc[0])==1 { prev_alnum=1 } } 49 let start: i64=i; var go: i64=1 50 while go==1 { if i>=len { go=0 } else { let d: *u8=((buf as i64)+i) as *u8; if is_digit(d[0])==1 { i=i+1 } else { go=0 } } } 51 let runlen: i64=i-start 52 var v2: i64=0; if runlen>=2 { v2=1 } else { let sc: *u8=((buf as i64)+start) as *u8; if sc[0]>=(50 as u8) { v2=1 } } 53 var acc: i64=1 54 if trit_pass(t0,in_comment)==0 { acc=0 } 55 if trit_pass(t1,line_const)==0 { acc=0 } 56 if trit_pass(t2,prev_alnum)==0 { acc=0 } 57 if trit_pass(t3,v2)==0 { acc=0 } 58 if acc==1 { count=count+1 } 59 } 60 else { i=i+1 } } } } } 61 } 62 return count 63} 64// THE GATE: a source PASSES the build iff its magic-number count is within BUDGET. returns 1=pass, 0=blocked. 65func preventer_gate(buf: *u8, len: i64) -> i64 { 66 let mn: i64=scan_count(buf,len,NX_MAGICNUM_DET_MASK) 67 if mn<=NX_MAGICNUM_BUDGET { return 1 } 68 return 0 69} 70func read_file(path: *u8, lenbox: *i64) -> i64 { 71 let fd: i64=sys_openat_rd(path); if fd<0 { lenbox[0]=0; return 0 } 72 let buf: *u8=sys_mmap(NX_MAGIC_1048576); var off: i64=0; var go: i64=1 73 while go==1 { let r: i64=sys_read(fd, ((buf as i64)+off) as *u8, NX_MAGIC_65536); if r<=0 { go=0 } else { off=off+r } if off>=NX_MAGIC_1000000 { go=0 } } 74 sys_close(fd); lenbox[0]=off; return buf as i64 75} 76 77func main() -> i64 { 78 gw("=== nx_magicnum_preventer: the team's detector wired as a BUILD-GATE -- block magic numbers before they land ===\n" as *u8) 79 var pass: i64=0; var total: i64=0 80 81 // T1: CLEAN code (the magic number is named via const) -> PASSES the gate. 82 let clean: *u8="const BUDGET: i64 = 300000\nlet x = BUDGET + 1\n" as *u8 83 let g_clean: i64=preventer_gate(clean, slen(clean)) 84 let c_clean: i64=scan_count(clean, slen(clean), NX_MAGICNUM_DET_MASK) 85 total=total+1; if g_clean==1 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) } 86 gw("T1 CLEAN PASSES: 'const BUDGET = 300000; x = BUDGET + 1' -> magic=" as *u8); gn(c_clean); gw(" gate=" as *u8); gn(g_clean); gw(" (1=build allowed)\n" as *u8) 87 88 // T2: DIRTY code (a raw magic literal) -> BLOCKED. 89 let dirty: *u8="let budget: i64 = 300000\nlet x = budget + 1\n" as *u8 90 let g_dirty: i64=preventer_gate(dirty, slen(dirty)) 91 let c_dirty: i64=scan_count(dirty, slen(dirty), NX_MAGICNUM_DET_MASK) 92 total=total+1; if g_dirty==0 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) } 93 gw("T2 DIRTY BLOCKED: 'let budget = 300000' (raw literal) -> magic=" as *u8); gn(c_dirty); gw(" gate=" as *u8); gn(g_dirty); gw(" (0=BUILD BLOCKED)\n" as *u8) 94 95 // T3: the ENFORCEMENT is the rule-11 fix: the SAME number, moved to a const, flips BLOCKED -> PASS. 96 total=total+1; if g_dirty==0 { if g_clean==1 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) } } else { gw(" [FAIL] " as *u8) } 97 gw("T3 ENFORCES RULE 11: the SAME 300000 -- raw=BLOCKED, named-const=ALLOWED -> the gate forces magic numbers to be named\n" as *u8) 98 99 // T4: dog-food on a REAL file -- honest: real source has many numeric literals (incl. ASCII codes). 100 let lenbox: *i64=sys_mmap(16) as *i64 101 let rb: i64=read_file("runtime/_hdl_build/nx_magicnum_benchmark.nx" as *u8, lenbox) 102 var real_count: i64=0 103 if rb!=0 { real_count=scan_count(rb as *u8, lenbox[0], NX_MAGICNUM_DET_MASK) } 104 total=total+1; if lenbox[0]>0 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) } 105 gw("T4 DOG-FOOD (real file nx_magicnum_benchmark.nx, " as *u8); gn(lenbox[0]); gw(" bytes): detector flags " as *u8); gn(real_count); gw(" numeric literals\n" as *u8) 106 107 // T5: HONEST GAP -- the coarse rule OVER-FLAGS (ASCII codes 48/57, array indices count as 'magic'). A production 108 // preventer needs an ALLOWLIST (ASCII in char-classifiers, small loop/index bounds) -> the next team-growth rung. 109 total=total+1; if real_count>10 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) } 110 gw("T5 HONEST GAP: the team's FIRST detector is COARSE -- it counts ASCII codes (48/57) + array indices as 'magic' (" as *u8); gn(real_count); gw(" on a benchmark file that is mostly legitimate) -> REFINEMENT (an allowlist) = the next team-capability to grow\n" as *u8) 111 112 gw("\n PREVENTION IS WIRED: the team's detector is now a BUILD-GATE -- a raw magic literal is BLOCKED, the rule-11 fix (name it via\n" as *u8) 113 gw(" const) makes it PASS. Wired into nx_sov_build_run / nx_build_pipeline, magic numbers fail BEFORE landing. HONEST: the first\n" as *u8) 114 gw(" detector over-flags (ASCII/indices); the NEXT team rung = synthesize a refined rule (allowlist) against an expanded benchmark.\n" as *u8) 115 gw(" Detection (team) -> prevention (gate) -> refinement (next) = the capability maturing like AI bad->realistic->growing.\n" as *u8) 116 gw("MAGICNUM-PREVENTER verdict=" as *u8) 117 if pass==total { gw("GREEN passes=" as *u8); gn(pass); gw("/" as *u8); gn(total); gw(" -- magic-number PREVENTER live (blocks raw literals, enforces rule 11); honest coarse-rule gap named\n" as *u8); sys_exit(0); return 0 } 118 gw("RED passes=" as *u8); gn(pass); gw("/" as *u8); gn(total); gw("\n" as *u8); sys_exit(1); return 1 119}