code wiki / _hdl_build / nx_osbench_judge.nx
nx_osbench_judge.nx source
↩ module page · 363 lines · 17379 B
1// nx_osbench_judge.nx -- rung F855 (lane osbench). The JUDGE: reads knowledge/status/osbench_measured.dat
2// and COMPUTES every verdict from the numbers. It asserts nothing and it trusts nothing.
3//
4// Mirrors the proven nx_container_bench judge contract (measure elsewhere, grade here, refuse a
5// different-config axis as an exceed) and adds the TIER rule that eats debt seq285.
6//
7// ★ THE THREE LIAR-KILLERS ARE NOT HYPOTHETICAL -- each one is a defect this lane actually shipped
8// and had to catch by hand on 2026-07-20. The judge exists so the NEXT one is caught mechanically:
9// L1 IMPLAUSIBLE a like-for-like store ratio beyond 10x either way is refused, not scored.
10// The harness really did emit a 30-permille (33x) "win" that was pure leak-bias
11// (Linux dir grew every run, NishiOS got a fresh image). This tooth catches that
12// class WITHOUT needing anyone to notice a trend across runs.
13// L2 CROSS-TIER only the sanctioned same-tier pair scores. An in-memory store compared against
14// an on-disk one is durability-asymmetric (the original seq285 18x artifact).
15// L3 UNSTABLE a ratio whose own cv exceeds the threshold is refused. Measured noise is not a
16// result, and on a noisy host EVERYTHING must refuse -- that is the tooth working.
17//
18// ★ MISSION COVERAGE: weights live in knowledge/registry/osbench_weights.tsv (rule 11, data not code).
19// The operator mission is RAW KERNEL PERFORMANCE, so context_switch/ipc/thread_spawn/syscall_trap
20// carry 750 of 1000 -- and none of them is measurable yet. The judge therefore reports what share of
21// the MISSION WEIGHT it could actually score, so a good number on the cheap axes can never be
22// mistaken for a good number on the mission. An index without its coverage is a gap in a costume.
23//
24// VERBS: judge (default) | selftest (runs L1/L2/L3 against synthetic rows, in-process)
25// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
26import "nx_syscalls.nx"
27import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc)
28const OJ_MAGIC_1643: i64 = 1643
29const OJ_MAGIC_1541: i64 = 1541
30
31const OJ_DAT: *u8 = "knowledge/status/osbench_measured.dat"
32const OJ_WTS: *u8 = "knowledge/registry/osbench_weights.tsv"
33const OJ_LOG: *u8 = "knowledge/status/osbench_judge.log"
34const OJ_CAP: i64 = 262144
35const OJ_TAB: i64 = 9
36const OJ_NL: i64 = 10
37const OJ_HASH: i64 = 35
38const OJ_MODE: i64 = 420
39const OJ_SLOTS: i64 = 24
40const OJ_SLOTW: i64 = 40
41// stability + plausibility gates
42const OJ_CV_MAX: i64 = 100
43const OJ_PAR_LO: i64 = 950
44const OJ_PAR_HI: i64 = 1050
45const OJ_IMPL_LO: i64 = 100
46const OJ_IMPL_HI: i64 = 10000
47// verdict codes
48const OJ_EXCEEDS: i64 = 0
49const OJ_PARITY: i64 = 1
50const OJ_BEHIND: i64 = 2
51const OJ_R_UNSTABLE: i64 = 3
52const OJ_R_XTIER: i64 = 4
53const OJ_R_IMPL: i64 = 5
54const OJ_R_BADSTAT: i64 = 6
55
56func oj_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
57func oj_w(fd: i64, s: *u8) -> i64 { let n: i64 = oj_len(s); sys_write(fd, s, n); return 0 }
58func oj_p(s: *u8) -> i64 { return oj_w(1, s) }
59// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer
60// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the
61// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls).
62// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign.
63func oj_wn(fd: i64, v: i64) -> i64 { nxi_fd(fd, v); return 0 }
64func oj_pn(v: i64) -> i64 { return oj_wn(1, v) }
65
66// bounded read (never sys_read_file: it mmaps 4GB per call and never frees)
67func oj_read(path: *u8, buf: *u8) -> i64 {
68 let fd: i64 = sys_openat_rd(path)
69 if fd < 0 { return 0 - 1 }
70 var tot: i64 = 0
71 var go: i64 = 1
72 while go == 1 {
73 let rem: i64 = OJ_CAP - tot
74 if rem <= 0 { go = 0 }
75 if go == 1 {
76 let q: *u8 = buf + tot
77 let r: i64 = sys_read(fd, q, rem)
78 if r <= 0 { go = 0 }
79 if r > 0 { tot = tot + r }
80 }
81 }
82 sys_close(fd)
83 return tot
84}
85
86func oj_lineend(q: *u8, i: i64, n: i64) -> i64 {
87 var e: i64 = i
88 var s: i64 = 1
89 while s == 1 { if e >= n { s = 0 } else { if q[e] == (OJ_NL as u8) { s = 0 } else { e = e + 1 } } }
90 return e
91}
92// span of column c within [ls,le); out[0]=start out[1]=end. returns 1 if the column exists.
93func oj_col(q: *u8, ls: i64, le: i64, c: i64, out: *i64) -> i64 {
94 var col: i64 = 0
95 var p: i64 = ls
96 while col < c {
97 var s: i64 = 1
98 while s == 1 { if p >= le { return 0 } if q[p] == (OJ_TAB as u8) { s = 0 } else { p = p + 1 } }
99 p = p + 1
100 col = col + 1
101 }
102 var e: i64 = p
103 var s2: i64 = 1
104 while s2 == 1 { if e >= le { s2 = 0 } else { if q[e] == (OJ_TAB as u8) { s2 = 0 } else { e = e + 1 } } }
105 out[0] = p
106 out[1] = e
107 return 1
108}
109func oj_span_eq(q: *u8, s: i64, e: i64, lit: *u8) -> i64 {
110 var i: i64 = 0
111 while s + i < e { if lit[i] == (0 as u8) { return 0 } if q[s+i] != lit[i] { return 0 } i = i + 1 }
112 if lit[i] != (0 as u8) { return 0 }
113 return 1
114}
115func oj_span_num(q: *u8, s: i64, e: i64) -> i64 {
116 var v: i64 = 0
117 var neg: i64 = 0
118 var i: i64 = s
119 if i < e { if q[i] == (45 as u8) { neg = 1; i = i + 1 } }
120 while i < e {
121 let c: i64 = q[i] as i64
122 if c < 48 { i = e } else { if c > 57 { i = e } else { v = v * 10 + (c - 48); i = i + 1 } }
123 }
124 if neg == 1 { return 0 - v }
125 return v
126}
127// copy span into a NUL-terminated slot
128func oj_span_cpy(q: *u8, s: i64, e: i64, dst: *u8) -> i64 {
129 var i: i64 = 0
130 while s + i < e { if i >= OJ_SLOTW - 1 { i = e - s } else { dst[i] = q[s+i]; i = i + 1 } }
131 dst[i] = 0 as u8
132 return i
133}
134
135// ---- THE VERDICT: computed from the numbers, never asserted -----------------------------------
136func oj_classify(ratio: i64, cv: i64, tierok: i64) -> i64 {
137 // L6 FIRST: a dispersion can never be negative and a ratio can never be <=0. A corrupt statistic
138 // invalidates EVERY downstream judgement, so it must be caught before anything else. This is not
139 // hypothetical either: a broken insertion sort in the harness produced IQR=-67, which sailed
140 // through a naive `cv > threshold` gate as a FALSE GREEN marked "usable".
141 if cv < 0 { return OJ_R_BADSTAT }
142 if ratio <= 0 { return OJ_R_BADSTAT }
143 if tierok == 0 { return OJ_R_XTIER }
144 if ratio < OJ_IMPL_LO { return OJ_R_IMPL }
145 if ratio > OJ_IMPL_HI { return OJ_R_IMPL }
146 if cv > OJ_CV_MAX { return OJ_R_UNSTABLE }
147 if ratio < OJ_PAR_LO { return OJ_EXCEEDS }
148 if ratio > OJ_PAR_HI { return OJ_BEHIND }
149 return OJ_PARITY
150}
151func oj_vname(v: i64) -> *u8 {
152 if v == OJ_EXCEEDS { return "EXCEEDS" as *u8 }
153 if v == OJ_PARITY { return "PARITY" as *u8 }
154 if v == OJ_BEHIND { return "BEHIND" as *u8 }
155 if v == OJ_R_UNSTABLE { return "REFUSED-UNSTABLE" as *u8 }
156 if v == OJ_R_XTIER { return "REFUSED-CROSS-TIER" as *u8 }
157 if v == OJ_R_BADSTAT { return "REFUSED-CORRUPT-STAT" as *u8 }
158 return "REFUSED-IMPLAUSIBLE" as *u8
159}
160func oj_scored(v: i64) -> i64 {
161 if v == OJ_EXCEEDS { return 1 }
162 if v == OJ_PARITY { return 1 }
163 if v == OJ_BEHIND { return 1 }
164 return 0
165}
166
167// ---- L1/L2/L3 NEGATIVE CONTROLS ---------------------------------------------------------------
168// A judge that cannot be shown to REFUSE is a rubber stamp. Each control replays a real defect.
169func oj_selftest() -> i64 {
170 oj_p("=== nx_osbench_judge SELFTEST -- three liar-killers, each a defect this lane really shipped ===\n" as *u8)
171 var pass: i64 = 0
172 var total: i64 = 0
173
174 // L1: the fabricated/leaked 33x win (ratio 30 permille), perfectly 'stable', correct tier.
175 // A naive judge scores this EXCEEDS. It must be REFUSED as physically implausible.
176 let v1: i64 = oj_classify(30, 0, 1)
177 total = total + 1
178 if v1 == OJ_R_IMPL { pass = pass + 1; oj_p(" PASS L1 implausible 33x win REFUSED (the real leak-bias defect)\n" as *u8) } else { oj_p(" FAIL L1 implausible win was SCORED -- judge is a rubber stamp\n" as *u8) }
179
180 // L2: a cross-tier pair (in-memory vs on-disk) -- the original seq285 18x artifact.
181 let v2: i64 = oj_classify(500, 0, 0)
182 total = total + 1
183 if v2 == OJ_R_XTIER { pass = pass + 1; oj_p(" PASS L2 cross-tier comparison REFUSED (the seq285 altitude artifact)\n" as *u8) } else { oj_p(" FAIL L2 cross-tier scored as a win\n" as *u8) }
184
185 // L3: a plausible ratio whose own cv is far over threshold -- noise is not a result.
186 let v3: i64 = oj_classify(900, 900, 1)
187 total = total + 1
188 if v3 == OJ_R_UNSTABLE { pass = pass + 1; oj_p(" PASS L3 unstable ratio REFUSED (cv 900 vs threshold 100)\n" as *u8) } else { oj_p(" FAIL L3 noise scored as a result\n" as *u8) }
189
190 // POSITIVE control: the judge must still be ABLE to say EXCEEDS, or it is merely broken.
191 let v4: i64 = oj_classify(800, 40, 1)
192 total = total + 1
193 if v4 == OJ_EXCEEDS { pass = pass + 1; oj_p(" PASS L4 positive control: a clean 1.25x win DOES score EXCEEDS\n" as *u8) } else { oj_p(" FAIL L4 judge cannot score a legitimate win -- it is broken, not strict\n" as *u8) }
194
195 // POSITIVE control: an honest loss must read BEHIND, not be quietly dropped.
196 let v5: i64 = oj_classify(OJ_MAGIC_1643, 40, 1)
197 total = total + 1
198 if v5 == OJ_BEHIND { pass = pass + 1; oj_p(" PASS L5 positive control: an honest 1.64x loss reads BEHIND\n" as *u8) } else { oj_p(" FAIL L5 a loss was not reported as BEHIND\n" as *u8) }
199
200 // L6: a NEGATIVE dispersion -- physically impossible, and a real false-GREEN this lane shipped.
201 let v6: i64 = oj_classify(OJ_MAGIC_1541, 0 - 67, 1)
202 total = total + 1
203 if v6 == OJ_R_BADSTAT { pass = pass + 1; oj_p(" PASS L6 negative IQR REFUSED as corrupt (the real broken-sort false GREEN)\n" as *u8) } else { oj_p(" FAIL L6 a negative dispersion was accepted -- corrupt stats reach verdicts\n" as *u8) }
204
205 oj_p("---- selftest "); oj_pn(pass); oj_p(" / "); oj_pn(total); oj_p(" ----\n" as *u8)
206 if pass == total { oj_p("NX-OSBENCH-JUDGE-SELFTEST verdict=GREEN\n" as *u8); return 0 }
207 oj_p("NX-OSBENCH-JUDGE-SELFTEST verdict=RED\n" as *u8)
208 return 1
209}
210
211func main(argc: i64, argv: *i64) -> i64 {
212 if argc > 1 {
213 let a1: *u8 = argv[1] as *u8
214 if oj_span_eq(a1, 0, oj_len(a1), "selftest" as *u8) == 1 { let rc: i64 = oj_selftest(); sys_exit(rc); return rc }
215 }
216
217 oj_p("=== nx_osbench_judge -- verdicts COMPUTED from the numbers; nothing here is asserted ===\n" as *u8)
218
219 // ---- weights (data-driven, rule 11) ----
220 let wbuf: *u8 = sys_mmap(OJ_CAP)
221 let wn: i64 = oj_read(OJ_WTS, wbuf)
222 if wn <= 0 { oj_p("JUDGE-FAIL weights table missing: " as *u8); oj_p(OJ_WTS); oj_p("\n" as *u8); sys_exit(2); return 2 }
223 let names: *u8 = sys_mmap(OJ_SLOTS * OJ_SLOTW)
224 let wts: *i64 = sys_mmap(OJ_SLOTS * 8) as *i64
225 let sp: *i64 = sys_mmap(32) as *i64
226 var nw: i64 = 0
227 var i: i64 = 0
228 while i < wn {
229 let le: i64 = oj_lineend(wbuf, i, wn)
230 if le > i { if wbuf[i] != (OJ_HASH as u8) {
231 if oj_col(wbuf, i, le, 0, sp) == 1 {
232 let ns: i64 = sp[0]
233 let ne: i64 = sp[1]
234 if oj_col(wbuf, i, le, 1, sp) == 1 {
235 if nw < OJ_SLOTS {
236 let slot: *u8 = names + nw * OJ_SLOTW
237 oj_span_cpy(wbuf, ns, ne, slot)
238 wts[nw] = oj_span_num(wbuf, sp[0], sp[1])
239 nw = nw + 1
240 }
241 }
242 }
243 } }
244 i = le + 1
245 }
246 var wtot: i64 = 0
247 var q: i64 = 0
248 while q < nw { wtot = wtot + wts[q]; q = q + 1 }
249 oj_p(" mission weights loaded: "); oj_pn(nw); oj_p(" axes, total "); oj_pn(wtot); oj_p(" permille\n" as *u8)
250
251 // ---- measurements ----
252 let dbuf: *u8 = sys_mmap(OJ_CAP)
253 let dn: i64 = oj_read(OJ_DAT, dbuf)
254 if dn <= 0 { oj_p("JUDGE-FAIL no measurement file: " as *u8); oj_p(OJ_DAT); oj_p("\n" as *u8); sys_exit(2); return 2 }
255
256 // ★ GRADE ONLY THE MOST RECENT RUN. The dat is append-only (history is sacred), but a judge that
257 // averages every historical row grades SUPERSEDED measurements forever -- including rows taken
258 // before a methodology defect was fixed. Find the last run header ('#') and start there.
259 var start: i64 = 0
260 var h: i64 = 0
261 while h < dn {
262 let he: i64 = oj_lineend(dbuf, h, dn)
263 if he > h { if dbuf[h] == (OJ_HASH as u8) { start = he + 1 } }
264 h = he + 1
265 }
266 oj_p(" grading the most recent run only (byte offset "); oj_pn(start)
267 oj_p(" of "); oj_pn(dn); oj_p("); earlier runs retained on disk but NOT scored\n" as *u8)
268
269 oj_p("\n AXIS RATIO(permil) CV VERDICT\n" as *u8)
270 var acc: i64 = 0
271 var wscored: i64 = 0
272 var nref: i64 = 0
273 var nunm: i64 = 0
274 var j: i64 = start
275 while j < dn {
276 let le: i64 = oj_lineend(dbuf, j, dn)
277 if le > j {
278 if oj_col(dbuf, j, le, 0, sp) == 1 {
279 let c0s: i64 = sp[0]
280 let c0e: i64 = sp[1]
281 if oj_span_eq(dbuf, c0s, c0e, "UNMEASURED" as *u8) == 1 { nunm = nunm + 1 }
282 if oj_span_eq(dbuf, c0s, c0e, "PAIRED" as *u8) == 1 {
283 // cols: 1=axis 2=subject 3=tier 4=ratio 5=cv
284 oj_col(dbuf, j, le, 1, sp)
285 let axs: i64 = sp[0]
286 let axe: i64 = sp[1]
287 oj_col(dbuf, j, le, 2, sp)
288 let sbs: i64 = sp[0]
289 let sbe: i64 = sp[1]
290 oj_col(dbuf, j, le, 3, sp)
291 let trs: i64 = sp[0]
292 let tre: i64 = sp[1]
293 oj_col(dbuf, j, le, 4, sp)
294 let ratio: i64 = oj_span_num(dbuf, sp[0], sp[1])
295 oj_col(dbuf, j, le, 5, sp)
296 let cv: i64 = oj_span_num(dbuf, sp[0], sp[1])
297 // TIER GATE: only the sanctioned same-tier pair is scoreable.
298 var tierok: i64 = 0
299 if oj_span_eq(dbuf, trs, tre, "mem" as *u8) == 1 {
300 if oj_span_eq(dbuf, sbs, sbe, "nishios-over-linux-tmpfs" as *u8) == 1 { tierok = 1 }
301 }
302 let v: i64 = oj_classify(ratio, cv, tierok)
303 oj_p(" ")
304 var pz: i64 = axs
305 while pz < axe { sys_write(1, dbuf + pz, 1); pz = pz + 1 }
306 oj_p(" "); oj_pn(ratio)
307 oj_p(" "); oj_pn(cv)
308 oj_p(" "); oj_p(oj_vname(v)); oj_p("\n" as *u8)
309 if oj_scored(v) == 0 { nref = nref + 1 }
310 if oj_scored(v) == 1 {
311 // weight lookup by axis name
312 var k: i64 = 0
313 var wfound: i64 = 0
314 while k < nw {
315 let slot: *u8 = names + k * OJ_SLOTW
316 if oj_span_eq(dbuf, axs, axe, slot) == 1 { wfound = wts[k]; k = nw } else { k = k + 1 }
317 }
318 if wfound > 0 {
319 // lower ratio = we are faster. advantage permille = 1000*1000/ratio.
320 var adv: i64 = 0
321 if ratio > 0 { adv = (1000 * 1000) / ratio }
322 acc = acc + wfound * adv
323 wscored = wscored + wfound
324 }
325 }
326 }
327 }
328 }
329 j = le + 1
330 }
331
332 oj_p("\n refused rows: "); oj_pn(nref)
333 oj_p(" unmeasured axes: "); oj_pn(nunm); oj_p("\n" as *u8)
334
335 var cover: i64 = 0
336 if wtot > 0 { cover = (wscored * 1000) / wtot }
337 oj_p(" MISSION COVERAGE: "); oj_pn(cover)
338 oj_p(" permille of the mission weight was actually scoreable ("); oj_pn(wscored)
339 oj_p(" of "); oj_pn(wtot); oj_p(")\n" as *u8)
340
341 let lg: i64 = sys_openat_append(OJ_LOG, OJ_MODE)
342 if wscored == 0 {
343 oj_p("\n SUPERIORITY INDEX: UNDEFINED -- not 0, not 1000. NO row survived the gates, so there is\n" as *u8)
344 oj_p(" nothing to average. This is the correct output on a noisy host and it is NOT a failure\n" as *u8)
345 oj_p(" of the rig: refusing to publish a number we have not earned is the rig working.\n" as *u8)
346 if lg >= 0 { oj_w(lg, "NX-OSBENCH-JUDGE verdict=GREEN index=UNDEFINED coverage=0 refused=" as *u8); oj_wn(lg, nref); oj_w(lg, "\n" as *u8); sys_close(lg) }
347 oj_p("\nNX-OSBENCH-JUDGE verdict=GREEN (index UNDEFINED -- no claim earned)\n" as *u8)
348 return 0
349 }
350 let idx: i64 = acc / wscored
351 oj_p(" SUPERIORITY INDEX: "); oj_pn(idx)
352 oj_p(" permille (1000 = parity) over "); oj_pn(cover)
353 oj_p(" permille of the mission ONLY\n" as *u8)
354 oj_p(" ^ this index is NOT comparable to a full-mission index; read it with its coverage or not at all.\n" as *u8)
355 if lg >= 0 {
356 oj_w(lg, "NX-OSBENCH-JUDGE verdict=GREEN index=" as *u8); oj_wn(lg, idx)
357 oj_w(lg, " coverage=" as *u8); oj_wn(lg, cover)
358 oj_w(lg, " refused=" as *u8); oj_wn(lg, nref); oj_w(lg, "\n" as *u8)
359 sys_close(lg)
360 }
361 oj_p("\nNX-OSBENCH-JUDGE verdict=GREEN\n" as *u8)
362 return 0
363}