code wiki / (root) / nx_nxeconform_gate.nx
`nx_nxeconform_gate.nx` source

↩ module page · 672 lines · 33664 B
1// nx_nxeconform_gate.nx -- NXE FORMAT CONFORMANCE (constitution A2: NXE, NOT ELF).
2//
3// THE DEFECT THIS EXISTS TO MAKE UNSHIPPABLE (measured 2026-08-15, full population, 23,181 files):
4// NXE had forked into THREE on-disk layouts across TWO magics -- NXE1@80 (the prototype the rule-15 DRY
5// extraction left behind), NXE1@96 (the live lane, and F103a's own witness for C01/C02/C11), and
6// NXE0@64 with a WRAPPING SUM for the kernel image. Nobody was counting, because no instrument counted.
7//   * A FORKED FORMAT OUTLIVES THE CODE THAT FORKED IT, BECAUSE THE ARTIFACTS PERSIST.
8//   * A LAW THAT MUST BE RECALLED AT THE MOMENT OF TEMPTATION IS NOT A CONTROL; ONLY A MECHANISM IN
9//     THE PATH IS -- so this is a gate, not another paragraph.
10//
11// SUBJECT: every NXE artifact ON DISK under the declared roots, classified against the declared layouts.
12// It reads BYTES, never source prose -- a scanner that reads comments measures the documentation.
13//
14// NO HARDCODED NUMBERS: every offset, header size, magic and baseline is a row in
15// knowledge/registry/nxe_layouts.conf (rule 11). The layout/root tables are sized from the conf's OWN
16// line count, so even the table capacity is derived rather than guessed.
17// NO SAMPLING: the roots are swept RECURSIVELY and IN FULL; getdents64 is looped until it returns 0
18//   (one call is not a directory listing), and the single genuine bound -- the directory frontier --
19//   REFUSES at its cap instead of silently truncating (a cap reached in silence becomes a measurement
20//   nobody knows is partial).
21// HONEST THIRD STATE: absent conf, zero declared layouts or zero artifacts end the run SKIP via gv_need,
22//   never GREEN and never RED -- "I could not look" is not "I looked and it is fine".
23// RATCHET, NOT PERFECTION: three layouts exist TODAY, so a gate demanding one would be permanently RED
24//   and everyone would learn to ignore it. The declared-layout count and the weak-integrity count are
25//   ratchets that may only FALL. Convergence = delete a LAYOUT row and lower its RATCHET in one edit.
26//
27// THE IMPRECISION I CHOSE TO LIVE WITH, stated so the next reader does not mistake this for exact:
28//   (1) A ratchet baseline is DECLARED, so adding a LAYOUT row and raising its RATCHET in the same edit
29//       passes. That is deliberate -- the gate's job is to make a widening VISIBLE in the diff and
30//       impossible to do by accident, not to prevent a considered decision.
31//   (2) The population is artifacts ON DISK under the declared roots. An NXE emitted somewhere no ROOT
32//       row covers is outside the claim; that is why the roots are data and the sweep is exhaustive
33//       within them. "0 undeclared" always means "0 undeclared, in what was swept".
34//
35// argv[1] optionally overrides the conf path (pinned at registration). Exit 0 GREEN / 1 RED.
36// license_tier: ORIGINAL   No hw writes (Rule 26): reads a conf + artifact bytes, writes stdout only.
37import "nx_syscalls.nx"
38import "nx_gate_verdict.nx"
39import "nx_sha256.nx"   // integrity is RECOMPUTED, not believed: sha256_digest is the shipped one
40
41const NXC_CONF_DEFAULT: *u8 = "knowledge/registry/nxe_layouts.conf" as *u8
42const NXC_HASH:  i64 = 35     // hash sign -- built as a value: the nx_cc lexer rejects it inside a literal
43const NXC_PIPE:  i64 = 124    // pipe
44const NXC_NL:    i64 = 10     // newline
45const NXC_SLASH: i64 = 47     // slash
46const NXC_MAGIC_BYTES: i64 = 4    // an NXE magic is 4 bytes: the format says so, not a tuning knob
47const NXC_DIGIT_LO: i64 = 48      // ASCII zero -- the magic's 4th byte is a VERSION DIGIT
48const NXC_DIGIT_HI: i64 = 57      // ASCII nine
49const NXC_FIELD_MAX:   i64 = 10   // widest row grammar (LAYOUT) has 10 fields
50// Integrity kinds the gate can RECOMPUTE. An unrecognised kind is MALFORMED, never silently trusted:
51// UNKNOWN IS ITS OWN BUCKET, because the bucket it lands in becomes the number somebody plans against.
52const NXC_K_SHA256: i64 = 1
53const NXC_K_DJB2:   i64 = 2
54const NXC_K_SUM64:  i64 = 3
55const NXC_SHA256_BYTES: i64 = 32
56const NXC_DJB2_SEED: i64 = 5381   // the djb2 constants are the ALGORITHM, not tunables
57const NXC_DJB2_SHIFT: i64 = 5
58const NXC_WORD:        i64 = 8    // text_off / text_size are 8-byte little-endian in EVERY layout
59// The ONE genuine bound: how many directories may be pending at once. Unknowable in advance, so it is
60// NAMED for that single purpose and its exhaustion is a REFUSAL that announces -- never a quiet stop.
61const NXC_DIR_FRONTIER_MAX: i64 = 4096
62const NXC_PATH_ARENA_BYTES: i64 = 4194304
63const NXC_SCRATCH: i64 = 512
64
65// Copy a conf field out to a NUL-terminated scratch so it can be printed / compared.
66func nxc_cp(src: *u8, o: i64, n: i64, dst: *u8, cap: i64) -> i64 {
  var m: i64 = n
  if m > (cap - 1) { m = cap - 1 }
  if m < 0 { m = 0 }
  var i: i64 = 0
  while i < m { dst[i] = src[o + i]; i = i + 1 }
  dst[m] = 0 as u8
  return m
74}
75
76func nxc_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  var r: i64 = 0 - 1
  while r < 0 {
      let ca: i64 = a[i] as i64
      let cb: i64 = b[i] as i64
      if ca != cb { r = 0 }
      if r < 0 { if ca == 0 { r = 1 } }
      if r < 0 { i = i + 1 }
  }
  return r
87}
88
89// Decimal field -> integer. Returns -1 on any non-digit, so a malformed row is REFUSED, not defaulted.
90func nxc_num(src: *u8, o: i64, n: i64) -> i64 {
  if n <= 0 { return 0 - 1 }
  var v: i64 = 0
  var i: i64 = 0
  var bad: i64 = 0
  while i < n {
      let c: i64 = src[o + i] as i64
      if c < NXC_DIGIT_LO { bad = 1 } else { if c > NXC_DIGIT_HI { bad = 1 } }
      if bad == 0 { v = v * 10 + (c - NXC_DIGIT_LO) }
      i = i + 1
  }
  if bad == 1 { return 0 - 1 }
  return v
103}
104
105// Pack 4 magic bytes into one integer so comparison is a single ==.
106func nxc_m32(m: *u8, o: i64) -> i64 {
  return (m[o] as i64) | ((m[o+1] as i64) << 8) | ((m[o+2] as i64) << 16) | ((m[o+3] as i64) << 24)
108}
109
110func nxc_r64(m: *u8, o: i64) -> i64 {
  var v: i64 = 0
  var i: i64 = 0
  while i < NXC_WORD { v = v | ((m[o + i] as i64) << (i * 8)); i = i + 1 }
  return v
115}
116
117// Read ONLY the header window of a file and take its size from lseek END.
118// v1 of this gate called sys_read_file per candidate -- i.e. it mmap'd EVERY regular file in the tree
119// whole, just to look at 4 bytes, and hung on the first large root. Nothing here needs the payload:
120// the size comes from lseek and every field under test lives in the header.
121//   * NEVER ALLOCATE IN A HOT LOOP -- PASS THE BUFFER IN, AND COUNT SYSCALLS PER UNIT OF OUTPUT.
122// Returns bytes actually read into buf; szp[0] receives the TRUE file size (not the bytes read).
123func nxc_head(path: *u8, buf: *u8, want: i64, szp: *i64) -> i64 {
  szp[0] = 0
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 }
  let sz: i64 = sys_lseek(fd, 0, 2)
  sys_lseek(fd, 0, 0)
  var got: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let rem: i64 = want - got
      if rem <= 0 { go = 0 }
      if go == 1 {
          let q: *u8 = buf + got
          let r: i64 = sys_read(fd, q, rem)
          if r <= 0 { go = 0 }
          if r > 0 { got = got + r }
      }
  }
  sys_close(fd)
  szp[0] = sz
  return got
144}
145
146// ---- INTEGRITY, RECOMPUTED ---------------------------------------------------------------------
147// v1 carried an `integrity` column and never checked it, so I shipped a row claiming "sha256" for a
148// layout whose writer computes DJB2 (nx_nxe.nx:22). I had inferred the kind from the magic instead of
149// reading the code.
150//   * AN UNVERIFIED FIELD IN A REGISTRY IS AN ASSERTION WEARING THE COSTUME OF A MEASUREMENT.
151// These recompute the DECLARED kind over the artifact's own code section, so a mislabelled row fails.
152func nxc_djb2(m: *u8, off: i64, n: i64) -> i64 {
  var h: i64 = NXC_DJB2_SEED
  var i: i64 = 0
  while i < n { h = ((h << NXC_DJB2_SHIFT) + h) + (m[off + i] as i64); i = i + 1 }
  return h
157}
158// Wrapping sum of the payload's little-endian 64-bit words (the kernel image's declared scheme).
159func nxc_sum64(m: *u8, off: i64, n: i64) -> i64 {
  var s: i64 = 0
  var i: i64 = 0
  while (i + NXC_WORD) <= n { s = s + nxc_r64(m, off + i); i = i + NXC_WORD }
  return s
164}
165// 1 = the bytes stored at hoff ARE the declared hash of [toff, toff+tsz). 0 = they are not.
166func nxc_integ_ok(ab: *u8, asz: i64, toff: i64, tsz: i64, kind: i64, hoff: i64, hlen: i64) -> i64 {
  if (toff + tsz) > asz { return 0 }
  if (hoff + hlen) > asz { return 0 }
  if kind == NXC_K_SHA256 {
      if hlen != NXC_SHA256_BYTES { return 0 }
      let want: *u8 = sys_mmap(NXC_SHA256_BYTES)
      sha256_digest(((ab as i64) + toff) as *u8, tsz, want)
      var i: i64 = 0
      while i < NXC_SHA256_BYTES { if want[i] != ab[hoff + i] { return 0 } i = i + 1 }
      return 1
  }
  var v: i64 = 0
  if kind == NXC_K_DJB2  { v = nxc_djb2(ab, toff, tsz) }
  if kind == NXC_K_SUM64 { v = nxc_sum64(ab, toff, tsz) }
  if kind != NXC_K_DJB2 { if kind != NXC_K_SUM64 { return 0 } }
  // the scalar kinds are stored as hlen little-endian bytes
  var j: i64 = 0
  while j < hlen { if ab[hoff + j] != (((v >> (j * 8)) & 255) as u8) { return 0 } j = j + 1 }
  return 1
185}
186
187// Split one pipe row into field offsets/lengths. Returns the field count.
188func nxc_fields(buf: *u8, pos: i64, e: i64, fo: *i64, fl: *i64) -> i64 {
  var fi: i64 = 0
  fo[0] = pos
  var i: i64 = pos
  while i < e {
      if buf[i] == (NXC_PIPE as u8) {
          if fi < (NXC_FIELD_MAX - 1) { fl[fi] = i - fo[fi]; fi = fi + 1; fo[fi] = i + 1 }
      }
      i = i + 1
  }
  fl[fi] = e - fo[fi]
  return fi + 1
200}
201
202// THE CLASSIFIER. A row matches only when ALL THREE agree: the magic, the header size the artifact
203// itself declares, and the partition (size == text_off + text_size). Two rows share the magic NXE1, so
204// magic alone cannot classify -- the artifact's own bytes disambiguate. Returns the match COUNT; a
205// count of 0 or >1 is a refusal at the call site, never silently coerced to a winner.
206// mav = bytes actually in the buffer (never read past them, or the gate faults instead of judging).
207// msz = the artifact's TRUE size on disk, which is what the partition tooth is about.
208func nxc_classify(m: *u8, mav: i64, msz: i64, nlay: i64, lmag: *i64, lhdr: *i64, loft: *i64, lofs: *i64, midx: *i64) -> i64 {
  var hits: i64 = 0
  if mav < NXC_MAGIC_BYTES { return 0 }
  if msz < NXC_MAGIC_BYTES { return 0 }
  let mg: i64 = nxc_m32(m, 0)
  var i: i64 = 0
  while i < nlay {
      var ok: i64 = 1
      if lmag[i] != mg { ok = 0 }
      // Never read past the artifact: a short file fails the row, it does not fault the gate.
      if ok == 1 { if (loft[i] + NXC_WORD) > msz { ok = 0 } }
      if ok == 1 { if (lofs[i] + NXC_WORD) > msz { ok = 0 } }
      if ok == 1 { if (loft[i] + NXC_WORD) > mav { ok = 0 } }
      if ok == 1 { if (lofs[i] + NXC_WORD) > mav { ok = 0 } }
      if ok == 1 {
          let toff: i64 = nxc_r64(m, loft[i])
          let tsz:  i64 = nxc_r64(m, lofs[i])
          if toff != lhdr[i] { ok = 0 }
          if ok == 1 { if (toff + tsz) != msz { ok = 0 } }
      }
      if ok == 1 { hits = hits + 1; midx[0] = i }
      i = i + 1
  }
  return hits
232}
233
234// Build dir + slash + name into dst; returns its length.
235func nxc_join(dst: *u8, dir: *u8, name: *u8) -> i64 {
  var o: i64 = 0
  var i: i64 = 0
  while dir[i] != (0 as u8) { dst[o] = dir[i]; o = o + 1; i = i + 1 }
  if o > 0 { if dst[o-1] != (NXC_SLASH as u8) { dst[o] = NXC_SLASH as u8; o = o + 1 } }
  var j: i64 = 0
  while name[j] != (0 as u8) { dst[o] = name[j]; o = o + 1; j = j + 1 }
  dst[o] = 0 as u8
  return o
244}
245
246func nxc_is_dot(n: *u8) -> i64 {
  if n[0] != (46 as u8) { return 0 }
  if n[1] == (0 as u8) { return 1 }
  if n[1] == (46 as u8) { if n[2] == (0 as u8) { return 1 } }
  return 0
251}
252
253func main(argc: i64, argv: *i64) -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("NX-NXECONFORM -- every NXE artifact on disk classified against the DECLARED layouts (constitution A2)" as *u8)
256
  var cpath: *u8 = NXC_CONF_DEFAULT
  if argc >= 2 { let a1: i64 = argv[1]; cpath = a1 as *u8 }
259
  // sys_read_file sizes its buffer from the file itself (lseek END) -- there is no read cap to guess.
  let clenp: *i64 = sys_mmap(NXC_WORD) as *i64
  let conf: *u8 = sys_read_file(cpath, clenp)
  let cn: i64 = clenp[0]
  if gv_need("nxe_layouts.conf readable" as *u8, (cn > 0) as i64, ctr) == 0 {
      let rcS: i64 = gv_verdict("NXECONFORM" as *u8, ctr, "conf absent -- cannot look" as *u8)
      sys_exit(rcS)
  }
268
  // Table capacity DERIVED from the conf's own line count: an exact upper bound, not a guess.
  var nlines: i64 = 1
  var q: i64 = 0
  while q < cn { if conf[q] == (NXC_NL as u8) { nlines = nlines + 1 } q = q + 1 }
273
  let lmag: *i64 = sys_mmap(nlines * NXC_WORD) as *i64
  let lhdr: *i64 = sys_mmap(nlines * NXC_WORD) as *i64
  let loft: *i64 = sys_mmap(nlines * NXC_WORD) as *i64
  let lofs: *i64 = sys_mmap(nlines * NXC_WORD) as *i64
  let lhoff: *i64 = sys_mmap(nlines * NXC_WORD) as *i64
  let lhlen: *i64 = sys_mmap(nlines * NXC_WORD) as *i64
  let lkind: *i64 = sys_mmap(nlines * NXC_WORD) as *i64
  let lweak: *i64 = sys_mmap(nlines * NXC_WORD) as *i64
  let lseen: *i64 = sys_mmap(nlines * NXC_WORD) as *i64
  let lido: *i64 = sys_mmap(nlines * NXC_WORD) as *i64
  let lidl: *i64 = sys_mmap(nlines * NXC_WORD) as *i64
  let rooto: *i64 = sys_mmap(nlines * NXC_WORD) as *i64
  let rootl: *i64 = sys_mmap(nlines * NXC_WORD) as *i64
  let fo: *i64 = sys_mmap(NXC_FIELD_MAX * NXC_WORD) as *i64
  let fl: *i64 = sys_mmap(NXC_FIELD_MAX * NXC_WORD) as *i64
  let midx: *i64 = sys_mmap(NXC_WORD) as *i64
  let sc: *u8 = sys_mmap(NXC_SCRATCH)
  let sc2: *u8 = sys_mmap(NXC_SCRATCH)
292
  var nlay: i64 = 0
  var nroot: i64 = 0
  var malformed: i64 = 0
  var rat_lay: i64 = 0 - 1
  var rat_weak: i64 = 0 - 1
  var strongest_o: i64 = 0
  var strongest_l: i64 = 0
300
  // ---- pass 1: STRONGEST must be known before any layout can be graded against it ----------------
  var pos: i64 = 0
  while pos < cn {
      var e: i64 = pos
      var scan: i64 = 1
      while scan == 1 {
          if e >= cn { scan = 0 } else { if conf[e] == (NXC_NL as u8) { scan = 0 } else { e = e + 1 } }
      }
      var skip: i64 = 0
      if (e - pos) < 3 { skip = 1 }
      if skip == 0 { if conf[pos] == (NXC_HASH as u8) { skip = 1 } }
      if skip == 0 {
          let nf: i64 = nxc_fields(conf, pos, e, fo, fl)
          nxc_cp(conf, fo[0], fl[0], sc, NXC_SCRATCH)
          if nxc_streq(sc, "STRONGEST" as *u8) == 1 {
              if nf >= 2 { strongest_o = fo[1]; strongest_l = fl[1] }
          }
      }
      pos = e + 1
  }
321
  // ---- pass 2: ROOT / LAYOUT / RATCHET -----------------------------------------------------------
  pos = 0
  while pos < cn {
      var e2: i64 = pos
      var scan2: i64 = 1
      while scan2 == 1 {
          if e2 >= cn { scan2 = 0 } else { if conf[e2] == (NXC_NL as u8) { scan2 = 0 } else { e2 = e2 + 1 } }
      }
      var skip2: i64 = 0
      if (e2 - pos) < 3 { skip2 = 1 }
      if skip2 == 0 { if conf[pos] == (NXC_HASH as u8) { skip2 = 1 } }
      if skip2 == 0 {
          let nf: i64 = nxc_fields(conf, pos, e2, fo, fl)
          nxc_cp(conf, fo[0], fl[0], sc, NXC_SCRATCH)
          if nxc_streq(sc, "ROOT" as *u8) == 1 {
              if nf >= 2 { rooto[nroot] = fo[1]; rootl[nroot] = fl[1]; nroot = nroot + 1 }
              else { malformed = malformed + 1 }
          }
          if nxc_streq(sc, "LAYOUT" as *u8) == 1 {
              if nf >= 10 {
                  if fl[2] == NXC_MAGIC_BYTES {
                      let h: i64 = nxc_num(conf, fo[3], fl[3])
                      let a: i64 = nxc_num(conf, fo[4], fl[4])
                      let b: i64 = nxc_num(conf, fo[5], fl[5])
                      let ho: i64 = nxc_num(conf, fo[6], fl[6])
                      let hl: i64 = nxc_num(conf, fo[7], fl[7])
                      // resolve the integrity kind to something RECOMPUTABLE; unknown = malformed
                      nxc_cp(conf, fo[8], fl[8], sc2, NXC_SCRATCH)
                      var kd: i64 = 0
                      if nxc_streq(sc2, "sha256" as *u8) == 1 { kd = NXC_K_SHA256 }
                      if nxc_streq(sc2, "djb2" as *u8) == 1 { kd = NXC_K_DJB2 }
                      if nxc_streq(sc2, "sum64" as *u8) == 1 { kd = NXC_K_SUM64 }
                      if h < 0 { malformed = malformed + 1 } else {
                      if a < 0 { malformed = malformed + 1 } else {
                      if b < 0 { malformed = malformed + 1 } else {
                      if ho < 0 { malformed = malformed + 1 } else {
                      if hl < 0 { malformed = malformed + 1 } else {
                      if kd == 0 { malformed = malformed + 1 } else {
                          lmag[nlay] = nxc_m32(conf, fo[2])
                          lhdr[nlay] = h
                          loft[nlay] = a
                          lofs[nlay] = b
                          lhoff[nlay] = ho
                          lhlen[nlay] = hl
                          lkind[nlay] = kd
                          lido[nlay] = fo[1]
                          lidl[nlay] = fl[1]
                          lseen[nlay] = 0
                          // weaker-than-constitutional integrity is the convergence worklist
                          nxc_cp(conf, strongest_o, strongest_l, sc, NXC_SCRATCH)
                          if nxc_streq(sc2, sc) == 1 { lweak[nlay] = 0 } else { lweak[nlay] = 1 }
                          nlay = nlay + 1
                      } } } } } }
                  } else { malformed = malformed + 1 }
              } else { malformed = malformed + 1 }
          }
          if nxc_streq(sc, "RATCHET" as *u8) == 1 {
              if nf >= 3 {
                  nxc_cp(conf, fo[1], fl[1], sc2, NXC_SCRATCH)
                  let v: i64 = nxc_num(conf, fo[2], fl[2])
                  if v < 0 { malformed = malformed + 1 }
                  if v >= 0 {
                      if nxc_streq(sc2, "layouts" as *u8) == 1 { rat_lay = v }
                      if nxc_streq(sc2, "weak_integrity" as *u8) == 1 { rat_weak = v }
                  }
              } else { malformed = malformed + 1 }
          }
      }
      pos = e2 + 1
  }
392
  if gv_need("at least one LAYOUT declared" as *u8, (nlay > 0) as i64, ctr) == 0 {
      let rcS2: i64 = gv_verdict("NXECONFORM" as *u8, ctr, "no layouts declared -- cannot look" as *u8)
      sys_exit(rcS2)
  }
  if gv_need("at least one ROOT declared" as *u8, (nroot > 0) as i64, ctr) == 0 {
      let rcS3: i64 = gv_verdict("NXECONFORM" as *u8, ctr, "no roots declared -- cannot look" as *u8)
      sys_exit(rcS3)
  }
401
  // ---- the header window and the candidate rule, DERIVED from the declared rows ------------------
  var window: i64 = NXC_MAGIC_BYTES
  var li0: i64 = 0
  while li0 < nlay {
      if (loft[li0] + NXC_WORD) > window { window = loft[li0] + NXC_WORD }
      if (lofs[li0] + NXC_WORD) > window { window = lofs[li0] + NXC_WORD }
      li0 = li0 + 1
  }
  // Every declared magic must share one format-family prefix; the 4th byte is the VERSION.
  // A candidate is that prefix followed by a DIGIT -- so knowledge/status/nxe.log, whose first bytes
  // are the ASCII letters NXE, is not mistaken for a binary. v1 tested the bare 3-byte prefix and
  // reported three .log files as NXE artifacts.
  //   * A DETECTOR WITH FALSE POSITIVES IS WORSE THAN NONE -- IT TEACHES EVERYONE TO IGNORE IT.
  // Requiring a digit still SEES an artifact carrying a version no row declares (that is the whole
  // point of the undeclared bucket); it only stops prose from entering the population.
  let pref_mask: i64 = (1 << ((NXC_MAGIC_BYTES - 1) * 8)) - 1
  let pref3: i64 = lmag[0] & pref_mask
  var pref_same: i64 = 1
  li0 = 0
  while li0 < nlay { if (lmag[li0] & pref_mask) != pref3 { pref_same = 0 } li0 = li0 + 1 }
  gv_check("all declared magics share one format-family prefix" as *u8, pref_same, ctr)
  let hbuf: *u8 = sys_mmap(window + NXC_WORD)
424
  // ---- FULL RECURSIVE SWEEP of every declared root -----------------------------------------------
  let arena: *u8 = sys_mmap(NXC_PATH_ARENA_BYTES)
  let stko: *i64 = sys_mmap(NXC_DIR_FRONTIER_MAX * NXC_WORD) as *i64
  var apos: i64 = 0
  var sp: i64 = 0
  var frontier_overflow: i64 = 0
  var arena_overflow: i64 = 0
432
  var ri: i64 = 0
  while ri < nroot {
      let n: i64 = nxc_cp(conf, rooto[ri], rootl[ri], arena + apos, NXC_SCRATCH)
      if sp < NXC_DIR_FRONTIER_MAX { stko[sp] = apos; sp = sp + 1 } else { frontier_overflow = 1 }
      apos = apos + n + 1
      ri = ri + 1
  }
440
  let dbuf: *u8 = sys_mmap(NXC_PATH_ARENA_BYTES)
  let pbuf: *u8 = sys_mmap(NXC_SCRATCH * 8)
  let alenp: *i64 = sys_mmap(NXC_WORD) as *i64
444
  let bitepath: *u8 = sys_mmap(NXC_SCRATCH * 8)
  let alenp2: *i64 = sys_mmap(NXC_WORD) as *i64
  var files_seen: i64 = 0
  var artifacts: i64 = 0
  var unmatched: i64 = 0
  var ambiguous: i64 = 0
  var dirs_walked: i64 = 0
  var integ_bad: i64 = 0
  var integ_checked: i64 = 0
  var bite_row: i64 = 0 - 1
455
  while sp > 0 {
      sp = sp - 1
      let dpath: *u8 = arena + stko[sp]
      let dfd: i64 = sys_openat_rd(dpath)
      if dfd >= 0 {
          dirs_walked = dirs_walked + 1
          // ONE getdents64 CALL IS NOT A DIRECTORY LISTING -- loop until it returns 0.
          var more: i64 = 1
          while more == 1 {
              let got: i64 = sys_getdents64(dfd, dbuf, NXC_PATH_ARENA_BYTES)
              if got <= 0 { more = 0 }
              if got > 0 {
                  var off: i64 = 0
                  while off < got {
                      let rec: *u8 = (dbuf as i64 + off) as *u8
                      let rl: i64 = dirent_reclen(rec)
                      let dt: i64 = dirent_type(rec)
                      let nm: *u8 = dirent_name(rec)
                      if nxc_is_dot(nm) == 0 {
                          let pl: i64 = nxc_join(pbuf, dpath, nm)
                          if dt == DT_DIR {
                              if (apos + pl + 1) < NXC_PATH_ARENA_BYTES {
                                  var k: i64 = 0
                                  while k <= pl { arena[apos + k] = pbuf[k]; k = k + 1 }
                                  if sp < NXC_DIR_FRONTIER_MAX { stko[sp] = apos; sp = sp + 1 }
                                  else { frontier_overflow = 1 }
                                  apos = apos + pl + 1
                              } else { arena_overflow = 1 }
                          }
                          if dt == DT_REG {
                              files_seen = files_seen + 1
                              // ONE open, a bounded header read, size from lseek. The payload is
                              // never touched: nothing under test lives outside the header.
                              let agot: i64 = nxc_head(pbuf, hbuf, window, alenp)
                              let asz: i64 = alenp[0]
                              // Candidate by CONTENT (declared family prefix + version digit), never
                              // by file extension -- KERNEL.NXE and .nxe both qualify on their bytes.
                              var isnxe: i64 = 0
                              if agot >= NXC_MAGIC_BYTES {
                                  if (nxc_m32(hbuf, 0) & pref_mask) == pref3 {
                                      let v4: i64 = hbuf[NXC_MAGIC_BYTES - 1] as i64
                                      if v4 >= NXC_DIGIT_LO { if v4 <= NXC_DIGIT_HI { isnxe = 1 } }
                                  }
                              }
                              if isnxe == 1 {
                                  artifacts = artifacts + 1
                                  midx[0] = 0 - 1
                                  let hits: i64 = nxc_classify(hbuf, agot, asz, nlay, lmag, lhdr, loft, lofs, midx)
                                  gv_puts("    artifact " as *u8)
                                  gv_puts(pbuf)
                                  gv_puts(" bytes=" as *u8)
                                  gv_num(asz)
                                  if hits == 1 {
                                      let r: i64 = midx[0]
                                      lseen[r] = lseen[r] + 1
                                      gv_puts(" layout=" as *u8)
                                      nxc_cp(conf, lido[r], lidl[r], sc, NXC_SCRATCH)
                                      gv_puts(sc)
                                      // RECOMPUTE the declared integrity over the artifact's own code
                                      // section. Only matched artifacts are read in full (3 of 77k),
                                      // so the payload read stays off the hot path.
                                      let full: *u8 = sys_read_file(pbuf, alenp2)
                                      let fsz: i64 = alenp2[0]
                                      var iok: i64 = 0
                                      if fsz == asz {
                                          iok = nxc_integ_ok(full, fsz, nxc_r64(full, loft[r]), nxc_r64(full, lofs[r]), lkind[r], lhoff[r], lhlen[r])
                                      }
                                      integ_checked = integ_checked + 1
                                      if iok == 1 { gv_puts(" integrity=VERIFIED" as *u8) }
                                      if iok == 0 { integ_bad = integ_bad + 1; gv_puts(" integrity=MISMATCH-OR-MISLABELLED" as *u8) }
                                      // remember one VERIFIED artifact as the bite subject
                                      if bite_row < 0 { if iok == 1 { bite_row = r; nxc_cp(pbuf, 0, pl, bitepath, NXC_SCRATCH * 8) } }
                                  }
                                  if hits == 0 { unmatched = unmatched + 1; gv_puts(" layout=UNDECLARED" as *u8) }
                                  if hits > 1 { ambiguous = ambiguous + 1; gv_puts(" layout=AMBIGUOUS" as *u8) }
                                  gv_puts("\n" as *u8)
                              }
                          }
                      }
                      if rl <= 0 { off = got } else { off = off + rl }
                  }
              }
          }
          sys_close(dfd)
      }
  }
542
  // ---- REFUSE rather than publish a partial sweep as a total -------------------------------------
  gv_check("sweep complete: directory frontier never overflowed" as *u8, (frontier_overflow == 0) as i64, ctr)
  gv_check("sweep complete: path arena never overflowed" as *u8, (arena_overflow == 0) as i64, ctr)
  gv_check("conf has zero malformed rows" as *u8, (malformed == 0) as i64, ctr)
547
  if gv_need("at least one NXE artifact found on disk" as *u8, (artifacts > 0) as i64, ctr) == 0 {
      let rcS4: i64 = gv_verdict("NXECONFORM" as *u8, ctr, "no artifacts -- gate would be vacuous" as *u8)
      sys_exit(rcS4)
  }
552
  gv_check("every artifact matches a DECLARED layout (0 undeclared)" as *u8, (unmatched == 0) as i64, ctr)
  gv_check("no artifact matches two layouts (0 ambiguous)" as *u8, (ambiguous == 0) as i64, ctr)
  // The row's integrity column is now a MEASUREMENT: recomputed over the artifact's own code section.
  // This is the tooth that would have caught my own "sha256" mislabel on a djb2 layout.
  gv_check("every artifact's DECLARED integrity kind RECOMPUTES to its stored hash" as *u8, (integ_bad == 0) as i64, ctr)
558
  // BITE 4 -- tamper a real, VERIFIED artifact in memory: integrity must fail. A verifier that has
  // only ever seen good bytes has not been shown to fire.
  if bite_row >= 0 {
      let bb: *u8 = sys_read_file(bitepath, alenp2)
      let bsz: i64 = alenp2[0]
      let bt: i64 = nxc_r64(bb, loft[bite_row])
      let bl: i64 = nxc_r64(bb, lofs[bite_row])
      let good_i: i64 = nxc_integ_ok(bb, bsz, bt, bl, lkind[bite_row], lhoff[bite_row], lhlen[bite_row])
      bb[bt] = (bb[bt] ^ (0xFF as u8))
      let bad_i: i64 = nxc_integ_ok(bb, bsz, bt, bl, lkind[bite_row], lhoff[bite_row], lhlen[bite_row])
      gv_bite("neg-control-tampered-payload: a flipped code byte FAILS the recomputed integrity" as *u8,
              (bad_i == 0) as i64, (good_i == 0) as i64, ctr)
  }
  if bite_row < 0 { gv_need("one VERIFIED artifact to use as the tamper subject" as *u8, 0, ctr) }
573
  // ---- the ratchets: these numbers may only FALL -------------------------------------------------
  var weak: i64 = 0
  var li: i64 = 0
  while li < nlay { if lweak[li] == 1 { weak = weak + 1 } li = li + 1 }
578
  gv_check("RATCHET layouts declared in conf" as *u8, (rat_lay >= 0) as i64, ctr)
  gv_check("RATCHET weak_integrity declared in conf" as *u8, (rat_weak >= 0) as i64, ctr)
  gv_check("declared layouts <= ratchet (a fork may never widen)" as *u8, (nlay <= rat_lay) as i64, ctr)
  gv_check("weak-integrity layouts <= ratchet (C01/C11 convergence)" as *u8, (weak <= rat_weak) as i64, ctr)
583
  // ---- NON-VACUITY: the classifier must FIRE on bad bytes and stay SILENT on good ones ------------
  // Fixtures are assembled AT RUNTIME: a detector that scans for a pattern will otherwise find its own
  // test fixture, and prose is source bytes too.
  let fx: *u8 = sys_mmap(NXC_SCRATCH)
  var fi2: i64 = 0
  while fi2 < NXC_SCRATCH { fx[fi2] = 0 as u8; fi2 = fi2 + 1 }
  // Build a GOOD artifact for layout row 0, from that row's OWN declared numbers -- never a literal.
  let g_hdr: i64 = lhdr[0]
  let g_off: i64 = loft[0]
  let g_ofs: i64 = lofs[0]
  let g_text: i64 = NXC_WORD                     // any non-zero payload; the sum is what is under test
  let g_size: i64 = g_hdr + g_text
  var bi: i64 = 0
  while bi < NXC_MAGIC_BYTES { fx[bi] = ((lmag[0] >> (bi * 8)) & 255) as u8; bi = bi + 1 }
  var wi: i64 = 0
  while wi < NXC_WORD { fx[g_off + wi] = ((g_hdr >> (wi * 8)) & 255) as u8; wi = wi + 1 }
  wi = 0
  while wi < NXC_WORD { fx[g_ofs + wi] = ((g_text >> (wi * 8)) & 255) as u8; wi = wi + 1 }
602
  midx[0] = 0 - 1
  let good_hits: i64 = nxc_classify(fx, NXC_SCRATCH, g_size, nlay, lmag, lhdr, loft, lofs, midx)
  // BITE 1 -- a magic no row declares must classify as UNDECLARED.
  let saved0: u8 = fx[0]
  fx[0] = 0x51 as u8                              // Q: not an NXE magic under any declared row
  midx[0] = 0 - 1
  let bad_magic_hits: i64 = nxc_classify(fx, NXC_SCRATCH, g_size, nlay, lmag, lhdr, loft, lofs, midx)
  fx[0] = saved0
  gv_bite("neg-control-undeclared-magic: classifier refuses a magic no row declares" as *u8,
          (bad_magic_hits == 0) as i64, (good_hits != 1) as i64, ctr)
613
  // BITE 2 -- a TRUNCATED artifact must fail the partition, because size == text_off + text_size is
  // the tooth that catches a short write and a layout mismatch with the same arithmetic.
  midx[0] = 0 - 1
  let trunc_hits: i64 = nxc_classify(fx, NXC_SCRATCH, g_size - 1, nlay, lmag, lhdr, loft, lofs, midx)
  gv_bite("neg-control-truncated: partition size == text_off + text_size refuses a short artifact" as *u8,
          (trunc_hits == 0) as i64, (good_hits != 1) as i64, ctr)
620
  // BITE 3 -- a header claiming a size no row declares must not match.
  var sv: i64 = 0
  while sv < NXC_WORD { fx[g_off + sv] = (((g_hdr + 1) >> (sv * 8)) & 255) as u8; sv = sv + 1 }
  midx[0] = 0 - 1
  let skew_hits: i64 = nxc_classify(fx, NXC_SCRATCH, g_size, nlay, lmag, lhdr, loft, lofs, midx)
  gv_bite("neg-control-header-skew: an undeclared header size is refused" as *u8,
          (skew_hits == 0) as i64, (good_hits != 1) as i64, ctr)
628
  // ---- the census, printed as a WORKLIST: a count without names is not actionable ----------------
  gv_puts("  layouts declared=" as *u8)
  gv_num(nlay)
  gv_puts(" ratchet=" as *u8)
  gv_num(rat_lay)
  gv_puts(" weak_integrity=" as *u8)
  gv_num(weak)
  gv_puts("/" as *u8)
  gv_num(rat_weak)
  gv_puts("\n" as *u8)
  li = 0
  while li < nlay {
      gv_puts("    layout " as *u8)
      nxc_cp(conf, lido[li], lidl[li], sc, NXC_SCRATCH)
      gv_puts(sc)
      gv_puts(" hdr=" as *u8)
      gv_num(lhdr[li])
      gv_puts(" artifacts=" as *u8)
      gv_num(lseen[li])
      if lweak[li] == 1 { gv_puts("  WEAK-INTEGRITY: converge onto the constitutional kind" as *u8) }
      if lseen[li] == 0 { gv_puts("  NO ARTIFACT: retire this row or prove it is still emitted" as *u8) }
      gv_puts("\n" as *u8)
      li = li + 1
  }
  gv_puts("  swept dirs=" as *u8)
  gv_num(dirs_walked)
  gv_puts(" files=" as *u8)
  gv_num(files_seen)
  gv_puts(" nxe_artifacts=" as *u8)
  gv_num(artifacts)
  gv_puts(" undeclared=" as *u8)
  gv_num(unmatched)
  gv_puts(" ambiguous=" as *u8)
  gv_num(ambiguous)
  gv_puts(" integrity_checked=" as *u8)
  gv_num(integ_checked)
  gv_puts(" integrity_bad=" as *u8)
  gv_num(integ_bad)
  gv_puts("\n" as *u8)
668
  let rc: i64 = gv_verdict("NXECONFORM" as *u8, ctr, "every NXE artifact classified; the fork is a shrinking ratchet, not a rediscovery" as *u8)
  sys_exit(rc)
  return 0
672}
nx_nxeconform_gate.nx source

`nx_nxeconform_gate.nx` source
