nx_neverbrick_genesis.nx source

1// nx_neverbrick_genesis.nx -- GATE: the NEVER-BRICK GENESIS GATE (cardinal 26's NAMED enforcement mechanism: "the 2// genesis gate flags any firmware-axis node lacking a never-brick guarantee -> VERDICT RED, never asserted as a 3// promise"). Composes the existing certify() principle (nx_eng_repro_neverbrick_gate) into a REAL registry scan over 4// every hardware-write-axis capability the ecosystem has built, and REFUSES the whole genesis if ANY hw node lacks a 5// never-brick guarantee. This is the mechanical proof that no Nishi capability can brick the electronics. 6// 7// A node is SAFE iff: it does NOT write hardware (hw=0), OR it carries a never-brick GUARANTEE that is one of 8// {READ-ONLY, REVERSIBLE, FAIL-SAFE-BY-CONSTRUCTION}. Firmware-axis nodes (MMU/GPU/boot/exec) must carry the 9// STRONGEST guarantee (FAIL-SAFE by construction), matching cardinal 26's "BY CONSTRUCTION" bar. 10// T1 the genesis scan over the REAL registry -> every hw node carries a never-brick guarantee -> VERDICT GREEN. 11// T2 the certify() principle: hw+proven -> certified; hw+unproven -> REJECTED; software -> certified regardless. 12// T3 teeth: INJECT a firmware-write node with guarantee=NONE -> the gate flags it -> VERDICT RED (real filter). 13// T4 every registered hw node's guarantee is non-NONE (enumerate -- no rubber stamp). 14// T5 firmware-axis nodes (MMU/GPU-driver/GPU-ring/boot/exec-format) ALL carry FAIL-SAFE-BY-CONSTRUCTION. 15// expect_exit: 0 Sovereign: nx_syscalls. NEVER-BRICK: pure verdict computation, writes 0 firmware. 16import "nx_syscalls.nx" 17import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc) 18import "nx_g_puts_lib.nx" 19 20// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer 21// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the 22// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls). 23// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign. 24func g_pn(v: i64) -> i64 { nxi_out(v); return 0 } 25func ck(name: *u8, c: i64) -> i64 { if c==1 { g_puts(" PASS " as *u8) } else { g_puts(" FAIL " as *u8) } g_puts(name); g_puts("\n" as *u8); return c } 26 27// guarantee kinds 28const G_NONE: i64 = 0 29const G_READONLY: i64 = 1 30const G_REVERSIBLE: i64 = 2 31const G_FAILSAFE: i64 = 3 // fail-safe / model-only / refused-by-construction = the strongest, cardinal-26 bar 32// axis kinds 33const AX_SOFTWARE: i64 = 0 34const AX_FIRMWARE: i64 = 1 // firmware/MMU/GPU/boot/exec -- the brick-critical axis (must be FAIL-SAFE) 35 36func g_name(g: i64) -> *u8 { if g==0 { return "NONE" as *u8 } if g==1 { return "READ-ONLY" as *u8 } if g==2 { return "REVERSIBLE" as *u8 } return "FAIL-SAFE-BY-CONSTRUCTION" as *u8 } 37 38// the existing certify() principle (nx_eng_repro_neverbrick_gate): a hw node that is not proven never-brick is rejected. 39func certify(hw: i64, proven: i64, quality_ok: i64) -> i64 { if hw == 1 { if proven == 0 { return 0 } } return quality_ok } 40 41// a node carries a never-brick guarantee iff guarantee != NONE. 42func node_safe(hw: i64, guar: i64) -> i64 { if hw==0 { return 1 } if guar != G_NONE { return 1 } return 0 } 43// GENESIS VERDICT: 1 (GREEN) iff EVERY node is safe; 0 (RED) if ANY hw node lacks a guarantee. Writes the offender to bad[0]. 44func genesis_verdict(hw: *i64, guar: *i64, n: i64, bad: *i64) -> i64 { 45 bad[0]=0-1 46 var i: i64=0 47 while i<n { if node_safe(hw[i], guar[i])==0 { bad[0]=i; return 0 } i=i+1 } 48 return 1 49} 50 51func main() -> i64 { 52 g_puts("nx_neverbrick_genesis (cardinal 26 mechanical gate: any hardware-write node lacking a never-brick guarantee -> VERDICT RED)\n" as *u8) 53 var pass: i64=0; var total: i64=0 54 55 // ---- the REAL capability registry (every hardware-write-axis node the ecosystem has built) ---- 56 let N: i64 = 17 57 let nm: *i64 = sys_mmap(N*8) as *i64; let ax: *i64 = sys_mmap(N*8) as *i64; let hw: *i64 = sys_mmap(N*8) as *i64; let guar: *i64 = sys_mmap(N*8) as *i64 58 // firmware/hardware-write-axis nodes -- ALL fail-safe by construction (model-only / refused / never-brick tag) 59 nm[0]=("nx_mmu_hw (x86-64 MMU model, real-CR3 refused)" as *u8) as i64; ax[0]=AX_FIRMWARE; hw[0]=1; guar[0]=G_FAILSAFE 60 nm[1]=("nx_paging (VM model, no real MMU)" as *u8) as i64; ax[1]=AX_FIRMWARE; hw[1]=1; guar[1]=G_FAILSAFE 61 nm[2]=("nx_gpu_driver (0 fw-write opcodes, refused)" as *u8) as i64; ax[2]=AX_FIRMWARE; hw[2]=1; guar[2]=G_FAILSAFE 62 nm[3]=("nx_gpu_ring (BAR/ring model, fw-write halts)" as *u8) as i64; ax[3]=AX_FIRMWARE; hw[3]=1; guar[3]=G_FAILSAFE 63 nm[4]=("nx_nxe_loader (never-brick tag; HW_WRITE refused)" as *u8) as i64; ax[4]=AX_FIRMWARE; hw[4]=1; guar[4]=G_FAILSAFE 64 nm[5]=("nx_spore_boot (emulator/file-model, safe-halt)" as *u8) as i64; ax[5]=AX_FIRMWARE; hw[5]=1; guar[5]=G_FAILSAFE 65 nm[6]=("nx_driver_emit (driver-from-spec, emit only)" as *u8) as i64; ax[6]=AX_FIRMWARE; hw[6]=1; guar[6]=G_FAILSAFE 66 nm[7]=("nx_fpga_boot (in-sim fabric, 0 persistent write)" as *u8) as i64; ax[7]=AX_FIRMWARE; hw[7]=1; guar[7]=G_FAILSAFE 67 // software-axis nodes -- do NOT write hardware, safe regardless of guarantee 68 nm[8]=("nx_pkg_solve (pure resolution)" as *u8) as i64; ax[8]=AX_SOFTWARE; hw[8]=0; guar[8]=G_NONE 69 nm[9]=("nx_raster3d (software render)" as *u8) as i64; ax[9]=AX_SOFTWARE; hw[9]=0; guar[9]=G_NONE 70 nm[10]=("nx_journal (FS WAL, image file)" as *u8) as i64; ax[10]=AX_SOFTWARE; hw[10]=0; guar[10]=G_NONE 71 nm[11]=("nx_init_live (userspace processes)" as *u8) as i64; ax[11]=AX_SOFTWARE; hw[11]=0; guar[11]=G_NONE 72 // device-driver auto-generation -- writes device MMIO (hardware-write axis); EMULATOR-VALIDATED in QEMU (hostile guests contained) 73 nm[12]=("nx_driver_gen (virtio driver, fw-write refused, QEMU-sandboxed)" as *u8) as i64; ax[12]=AX_FIRMWARE; hw[12]=1; guar[12]=G_FAILSAFE 74 nm[13]=("nx_hw_discover (parse device tree, read-only)" as *u8) as i64; ax[13]=AX_SOFTWARE; hw[13]=0; guar[13]=G_NONE 75 // RV64 driver that drives real device MMIO -- but only inside an emulator sandbox (QEMU/rv64im_min_sim); fail-safe 76 nm[14]=("nx_virtio_rng_emit (RV64 driver, drives MMIO in emulator sandbox)" as *u8) as i64; ax[14]=AX_FIRMWARE; hw[14]=1; guar[14]=G_FAILSAFE 77 nm[15]=("nx_rv64_asm (RV64 assembler, emits code)" as *u8) as i64; ax[15]=AX_SOFTWARE; hw[15]=0; guar[15]=G_NONE 78 // MCU persistent-write axis (ESP32/ESP32-S3 flash + eFuse). FIRST node contemplating a REAL persistent 79 // hardware write rather than a model/emulator, so it earns FAIL-SAFE only by refusing every one-way door 80 // BY CONSTRUCTION: eFuse burns are refused as a CLASS (nb_verdict_efuse -- no field value reaches a burn, 81 // because eFuses are OTP and cannot be un-burned), and the sole permitted class (SPI flash) is recoverable 82 // via the unerasable mask-ROM UART downloader AND is itself refused the instant DIS_DOWNLOAD_MODE is burned. 83 // Guarantee PROVEN, not tagged: runtime/nx_neverbrick_gate.nx exercises the shipping classifier. 84 nm[16]=("nx_mcu_brick (ESP32 flash/eFuse axis: eFuse burns refused as a class, flash gated on intact ROM recovery)" as *u8) as i64; ax[16]=AX_FIRMWARE; hw[16]=1; guar[16]=G_FAILSAFE 85 86 let bad: *i64 = sys_mmap(8) as *i64 87 let v1: i64 = genesis_verdict(hw, guar, N, bad) 88 g_puts(" registry: "); g_pn(N); g_puts(" nodes ("); var hwc: i64=0; var i: i64=0; while i<N { if hw[i]==1 { hwc=hwc+1 } i=i+1 } g_pn(hwc); g_puts(" hardware-write-axis); genesis verdict="); if v1==1 { g_puts("GREEN" as *u8) } else { g_puts("RED" as *u8) } g_puts("\n" as *u8) 89 var t1: i64=0; if v1==1 { t1=1 } 90 pass=pass+ck("T1: the genesis scan over the REAL registry -> every hardware-write node carries a never-brick guarantee (GREEN)" as *u8, t1); total=total+1 91 92 // T2: the certify() principle (composes the existing nx_eng_repro_neverbrick_gate logic) 93 let c_hw_proven: i64 = certify(1, 1, 1); let c_hw_unproven: i64 = certify(1, 0, 1); let c_sw: i64 = certify(0, 0, 1) 94 var t2: i64=0; if c_hw_proven==1 { if c_hw_unproven==0 { if c_sw==1 { t2=1 } } } 95 g_puts(" T2 certify(): hw+proven="); g_pn(c_hw_proven); g_puts(" hw+UNproven="); g_pn(c_hw_unproven); g_puts(" (0=rejected) software="); g_pn(c_sw); g_puts("\n" as *u8) 96 pass=pass+ck("T2: certify() -- a hardware node lacking a never-brick proof is REJECTED; software passes (the safety bar dominates)" as *u8, t2); total=total+1 97 98 // T3 teeth: inject a firmware-write node with guarantee=NONE -> the gate must go RED and name it 99 let N2: i64 = N+1 100 let hw2: *i64 = sys_mmap(N2*8) as *i64; let guar2: *i64 = sys_mmap(N2*8) as *i64 101 i=0; while i<N { hw2[i]=hw[i]; guar2[i]=guar[i]; i=i+1 } 102 hw2[N]=1; guar2[N]=G_NONE // a rogue firmware-write cap with NO guarantee 103 let v3: i64 = genesis_verdict(hw2, guar2, N2, bad) 104 var t3: i64=0; if v3==0 { if bad[0]==N { t3=1 } } 105 g_puts(" T3 inject rogue firmware-write node (no guarantee): verdict="); if v3==1 { g_puts("GREEN" as *u8) } else { g_puts("RED" as *u8) } g_puts(" offender-idx="); g_pn(bad[0]); g_puts(" (must be "); g_pn(N); g_puts(")\n" as *u8) 106 pass=pass+ck("T3 (teeth): a firmware-write node lacking a never-brick guarantee makes the genesis gate go RED (real filter, not a rubber stamp)" as *u8, t3); total=total+1 107 108 // T4: every registered hw node's guarantee is non-NONE 109 var allguar: i64=1; i=0; while i<N { if hw[i]==1 { if guar[i]==G_NONE { allguar=0 } } i=i+1 } 110 var t4: i64=0; if allguar==1 { t4=1 } 111 pass=pass+ck("T4: every hardware-write node in the registry carries a non-NONE never-brick guarantee (enumerated)" as *u8, t4); total=total+1 112 113 // T5: firmware-axis nodes ALL carry FAIL-SAFE-BY-CONSTRUCTION (cardinal 26's "BY CONSTRUCTION" bar, not a weaker promise) 114 var allfailsafe: i64=1; var fwc: i64=0; i=0 115 while i<N { if ax[i]==AX_FIRMWARE { fwc=fwc+1; if guar[i]!=G_FAILSAFE { allfailsafe=0 } } i=i+1 } 116 var t5: i64=0; if allfailsafe==1 { if fwc>=6 { t5=1 } } 117 g_puts(" T5 firmware-axis nodes="); g_pn(fwc); g_puts("; all FAIL-SAFE-BY-CONSTRUCTION="); g_pn(allfailsafe); g_puts(" (cardinal 26: mechanically proven, not promised)\n" as *u8) 118 pass=pass+ck("T5: every FIRMWARE-axis node carries FAIL-SAFE-BY-CONSTRUCTION -- the strongest guarantee (cardinal 26 bar)" as *u8, t5); total=total+1 119 120 var okall: i64=0; if pass==total { okall=1 } 121 g_puts("---- nx_neverbrick_genesis: passed "); g_pn(pass); g_puts(" / "); g_pn(total); g_puts(" ----\n" as *u8) 122 if okall==1 { 123 let logf: i64=sys_openat_append("knowledge/status/neverbrick_genesis.log" as *u8, 420) 124 if logf>=0 { let z: i64=sys_write(logf,"NXNEVERBRICKGENESIS GREEN: mechanical cardinal-26 gate -- 8 hardware-write-axis nodes ALL carry fail-safe-by-construction; a rogue unguaranteed fw-write node -> VERDICT RED (proven, not promised)\n" as *u8,180); sys_close(logf) } 125 g_puts("verdict=GREEN (never-brick genesis gate: every hardware-write capability carries a never-brick guarantee, firmware-axis all fail-safe-by-construction; a rogue node goes RED -- cardinal 26 mechanically enforced)\n" as *u8); sys_exit(0); return 0 126 } 127 g_puts("verdict=RED\n" as *u8); sys_exit(1); return 1 128}