code wiki / _hdl_build / nx_organkind_gate.nx
nx_organkind_gate.nx source
↩ module page · 162 lines · 8993 B
1// nx_organkind_gate.nx -- proves the role classifier that unblocks seq1492.
2// T5/T6 are load-bearing: they replay the EXACT failure (nx_torrent_get refused by BOTH verbs) and the
3// substring lie that caused it (`nx_torrent` must never match `nx_torrent_get`).
4// license_tier: ORIGINAL expect_exit: 0 No hw writes (Rule 26).
5import "nx_organkind.nx"
6import "nx_gate_verdict.nx"
7
8const OG_BUF: i64 = 1024
9
10func og_eq(a: i64, b: i64) -> i64 { if a == b { return 1 } return 0 }
11func og_cpy(d: *u8, s: *u8) -> i64 {
12 var i: i64 = 0
13 while s[i] != (0 as u8) { d[i] = s[i]; i = i + 1 }
14 d[i] = 0 as u8
15 return i
16}
17
18const OG_CONF: i64 = 65536
19const OG_HASH: i64 = 35
20const OG_LF: i64 = 10
21
22// seq1789: THE SAFETY OF THE TERMINAL-SUFFIX RULE, PROVEN AGAINST LIVE DATA RATHER THAN ASSERTED.
23// The rule is only sound if no organ that is actually a DAEMON carries an oracle suffix. That is a
24// property of the declaration file, not of the code, so a comment claiming it is worth nothing -- this
25// walks the real conf every run. Returns -1 when the conf is unreadable (the INSTRUMENT is broken, which
26// must FAIL rather than sail through as `zero conflicts found`), else the number of declared daemons
27// whose name would be captured by the suffix rule. Also reports how many daemon rows it actually saw, so
28// a truncated or empty conf cannot manufacture a vacuous pass.
29func og_daemon_suffix_conflicts(path: *u8, rows: *i64) -> i64 {
30 rows[0] = 0
31 let fd: i64 = sys_openat_rd(path)
32 if fd < 0 { return 0 - 1 }
33 let b: *u8 = sys_mmap(OG_CONF)
34 var tot: i64 = 0
35 var r: i64 = sys_read(fd, b, OG_CONF - 1)
36 while r > 0 {
37 tot = tot + r
38 if tot >= OG_CONF - 1 { r = 0 } else { r = sys_read(fd, ((b as i64) + tot) as *u8, OG_CONF - 1 - tot) }
39 }
40 sys_close(fd)
41 if tot <= 0 { sys_munmap(b, OG_CONF); return 0 - 1 }
42 let nmb: *u8 = sys_mmap(256)
43 var bad: i64 = 0
44 var ls: i64 = 0
45 while ls < tot {
46 var le: i64 = ls
47 var s1: i64 = 1
48 while s1 == 1 {
49 if le >= tot { s1 = 0 } else {
50 if b[le] == (OG_LF as u8) { s1 = 0 } else { le = le + 1 }
51 }
52 }
53 var ne: i64 = ls
54 var s2: i64 = 1
55 while s2 == 1 {
56 if ne >= le { s2 = 0 } else {
57 if ok_is_sep(b[ne] as i64) == 1 { s2 = 0 } else { ne = ne + 1 }
58 }
59 }
60 let nl: i64 = ne - ls
61 if nl > 0 {
62 if b[ls] != (OG_HASH as u8) {
63 if nl < 250 {
64 var k: i64 = 0
65 while k < nl { nmb[k] = b[ls + k]; k = k + 1 }
66 nmb[nl] = 0 as u8
67 if ok_kind_of(b, tot, nmb) == OK_DAEMON {
68 rows[0] = rows[0] + 1
69 if ok_suffix_kind(nmb) == OK_ORACLE { bad = bad + 1 }
70 }
71 }
72 }
73 }
74 ls = le + 1
75 }
76 sys_munmap(b, OG_CONF)
77 return bad
78}
79
80func main() -> i64 {
81 let ctr: *i64 = gv_ctr()
82 gv_head("nx_organkind_gate -- classify by ROLE not NAME (seq1492)" as *u8)
83
84 let b: *u8 = sys_mmap(OG_BUF)
85 let n: i64 = og_cpy(b, "sites.elf daemon\nnx_torrent_get oneshot\nnx_torrent_daemon daemon\nnx_poolgov lib\nnx_procchurn oracle\n" as *u8)
86
87 gv_check("T1 a declared daemon classifies as daemon" as *u8,
88 og_eq(ok_kind_of(b, n, "sites.elf" as *u8), OK_DAEMON), ctr)
89 gv_check("T2 a declared one-shot classifies as oneshot" as *u8,
90 og_eq(ok_kind_of(b, n, "nx_torrent_get" as *u8), OK_ONESHOT), ctr)
91 gv_check("T3 a declared lib classifies as lib" as *u8,
92 og_eq(ok_kind_of(b, n, "nx_poolgov" as *u8), OK_LIB), ctr)
93 gv_check("T4 a declared oracle classifies as oracle" as *u8,
94 og_eq(ok_kind_of(b, n, "nx_procchurn" as *u8), OK_ORACLE), ctr)
95
96 // ---- THE EXACT seq1492 FAILURE, now decided by ROLE ----
97 let kget: i64 = ok_kind_of(b, n, "nx_torrent_get" as *u8)
98 var t5: i64 = 0
99 if ok_may_promote(kget) == 1 { if ok_may_deploy(kget) == 0 { t5 = 1 } }
100 gv_check("T5 nx_torrent_get is PROMOTABLE and NOT deployable (it has no port to health-probe)" as *u8, t5, ctr)
101 let kdae: i64 = ok_kind_of(b, n, "nx_torrent_daemon" as *u8)
102 var t6: i64 = 0
103 if ok_may_deploy(kdae) == 1 { if ok_may_promote(kdae) == 0 { t6 = 1 } }
104 gv_bite("T6 a DAEMON is deployable and NOT promotable (never swap a binary under a live process)" as *u8,
105 t6, og_eq(ok_may_promote(kdae), 1), ctr)
106
107 // ---- the substring lie that produced the defect ----
108 gv_bite("T7 'nx_torrent' does NOT match 'nx_torrent_get' -- whole-field only" as *u8,
109 og_eq(ok_kind_of(b, n, "nx_torrent" as *u8), OK_UNKNOWN),
110 og_eq(ok_kind_of(b, n, "nx_torrent_get" as *u8), OK_UNKNOWN), ctr)
111
112 // ---- fail-closed: undeclared is refused by BOTH verbs, never name-guessed ----
113 let ku: i64 = ok_kind_of(b, n, "nx_never_declared" as *u8)
114 var t8: i64 = 0
115 if ku == OK_UNKNOWN { if ok_may_deploy(ku) == 0 { if ok_may_promote(ku) == 0 { t8 = 1 } } }
116 gv_bite("T8 an UNDECLARED organ is refused by BOTH verbs (no fall-through to a name guess)" as *u8,
117 t8, og_eq(ok_is_shippable(ku), 1), ctr)
118 gv_check("T9 a LIB is shippable by neither verb (it compiles INTO consumers)" as *u8,
119 og_eq(ok_is_shippable(ok_kind_of(b, n, "nx_poolgov" as *u8)), 0), ctr)
120 gv_check("T10 ok_is_shippable is TRUE for both a daemon and a one-shot" as *u8,
121 og_eq(ok_is_shippable(kdae) + ok_is_shippable(kget), 2), ctr)
122 gv_bite("T11 an empty name REFUSES instead of matching the first row" as *u8,
123 og_eq(ok_kind_of(b, n, "" as *u8), OK_UNKNOWN),
124 og_eq(ok_kind_of(b, n, "sites.elf" as *u8), OK_UNKNOWN), ctr)
125
126 // ---- seq1789: THE TERMINAL-SUFFIX RULE, AND THE PROOF IT CANNOT MISFILE A DAEMON ----
127 // The defect: md_promote_deny asked `does the name CONTAIN "serve"`, so nx_survey_serve_gate -- an
128 // oracle -- was refused as a daemon and could not ship by any route. T12 is the discriminator that
129 // was missing: CONTAINS vs ENDS-WITH. Position is meaning.
130 gv_bite("T12 the suffix is TERMINAL, not a substring: nx_survey_serve_gate ENDS with _gate; nx_gate_bite merely CONTAINS it" as *u8,
131 og_eq(ok_ends_with("nx_survey_serve_gate" as *u8, "_gate" as *u8), 1),
132 og_eq(ok_ends_with("nx_gate_bite" as *u8, "_gate" as *u8), 1), ctr)
133 gv_check("T13 an oracle suffix classifies an UNDECLARED name as OK_ORACLE" as *u8,
134 og_eq(ok_suffix_kind("nx_survey_serve_gate" as *u8), OK_ORACLE), ctr)
135 gv_check("T14 _test and _kat carry the same meaning as _gate" as *u8,
136 og_eq(ok_suffix_kind("nx_hostctl_syscalls_test" as *u8) + ok_suffix_kind("nx_mlkem_kat" as *u8), OK_ORACLE + OK_ORACLE), ctr)
137 gv_bite("T15 THE seq1789 REPLAY: undeclared nx_survey_serve_gate is promotable by suffix; nx_gallery_serve (no oracle suffix) still is not" as *u8,
138 og_eq(ok_may_promote(ok_kind_or_suffix(OK_UNKNOWN, "nx_survey_serve_gate" as *u8)), 1),
139 og_eq(ok_may_promote(ok_kind_or_suffix(OK_UNKNOWN, "nx_gallery_serve" as *u8)), 1), ctr)
140 // The asymmetry this whole policy exists to protect: misfiling a DAEMON as a one-shot is the only
141 // dangerous direction (rule 26). T16 proves a declaration always beats the suffix, and T17 proves the
142 // suffix rule is one-directional -- it has no expressible path to OK_DAEMON.
143 gv_bite("T16 A DECLARATION STILL WINS: a daemon declared *_gate stays NOT promotable; the same name UNDECLARED is" as *u8,
144 og_eq(ok_may_promote(ok_kind_or_suffix(OK_DAEMON, "nx_pretend_gate" as *u8)), 0),
145 og_eq(ok_may_promote(ok_kind_or_suffix(OK_UNKNOWN, "nx_pretend_gate" as *u8)), 0), ctr)
146 gv_check("T17 ok_suffix_kind is ONE-DIRECTIONAL -- it can never yield OK_DAEMON for any daemon-shaped name" as *u8,
147 og_eq(ok_suffix_kind("nx_torrent_daemon" as *u8) + ok_suffix_kind("sites.elf" as *u8) + ok_suffix_kind("nx_gallery_serve" as *u8),
148 OK_UNKNOWN + OK_UNKNOWN + OK_UNKNOWN), ctr)
149 // T18 is the one that matters: the rule's safety is a property of the LIVE declaration file, so it is
150 // MEASURED here, not promised in a comment. An unreadable conf or a conf with zero daemon rows FAILS
151 // -- a check that cannot distinguish `no conflicts` from `nothing examined` proves nothing.
152 let ogrows: *i64 = sys_mmap(8)
153 let ogc: i64 = og_daemon_suffix_conflicts("knowledge/status/organ_kind.conf" as *u8, ogrows)
154 var t18: i64 = 0
155 if ogc == 0 { if ogrows[0] > 0 { t18 = 1 } }
156 gv_check("T18 LIVE DATA: zero declared daemons carry an oracle suffix, over a NON-EMPTY daemon set (unreadable or empty conf FAILS, never passes vacuously)" as *u8,
157 t18, ctr)
158
159 let rc: i64 = gv_verdict("ORGANKIND-GATE" as *u8, ctr, "role-based ship policy proven; undeclared refused by both verbs" as *u8)
160 sys_exit(rc)
161 return rc
162}