code wiki / _hdl_build / nx_resgov_gate.nx
`nx_resgov_gate.nx` source

1// nx_resgov_gate.nx -- PROVE THE GOVERNOR IS PROACTIVE, DEFAULT-COVERED, AND CANNOT KILL AN INNOCENT.
2// Every tooth asserts BOTH polarities: the thing it must do, and the thing it must REFUSE.
3// license_tier: ORIGINAL   No hw writes (Rule 26).
4import "nx_syscalls.nx"
5import "nx_gate_verdict.nx"
6import "nx_resgov_core.nx"
7
8const GB: i64 = 1048576   // kB in a GiB
9
10func main(argc: i64, argv: *i64) -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_resgov_gate -- proactive, default-covered, pressure-gated, fail-safe on ignorance" as *u8)
13
  // T1 THE INSTRUMENT FIX: the footprint is resident+swap, so a huge RESERVATION is invisible to it.
  // (nx_wiki_gw: 47.4GB VSZ / 355MB RSS -- the process a VSZ rule would have killed while healthy.)
  let wiki_foot: i64 = rg_footprint_kb(363520, 0)
  let lvl_wiki: i64 = rg_level(0, 8, 363520, 0, 0, 1, 0, 3600, 900)
  gv_check("T1 RESERVED ADDRESS SPACE IS NOT PRESSURE: a 355MB-resident process is OK even under system pressure and an 8GB cap -- the VSZ instrument would have killed this healthy daemon" as *u8, (lvl_wiki == RG_OK) as i64, ctr)
19
  // T2 ...and the same process WOULD be caught once its RESIDENT footprint is genuinely over cap.
  let lvl_res: i64 = rg_level(0, 8, 9 * GB, 0, 0, 1, 0, 3600, 900)
  gv_check("T2 RESIDENT GROWTH IS CAUGHT: 9GB resident against an 8GB cap under pressure escalates to TERM -- the meter measures the resource that actually hurts" as *u8, (lvl_res == RG_TERM) as i64, ctr)
23
  // T3 SWAP COUNTS: a process mostly swapped out is still consuming the scarce resource.
  let lvl_swap: i64 = rg_level(0, 8, 5 * GB, 5 * GB, 0, 1, 0, 3600, 900)
  gv_check("T3 SWAPPED PAGES COUNT: 5GB resident + 5GB swapped exceeds an 8GB cap -- a process cannot hide from the breaker by being paged out" as *u8, (lvl_swap == RG_TERM) as i64, ctr)
27
  // T4 DEFAULT COVERAGE: an unlisted process is governed by the default cap, not ignored. (The
  // incumbent's allow-list would have returned OK here purely because nobody typed its name.)
  let lvl_unlisted: i64 = rg_level(0, 4, 6 * GB, 0, 0, 1, 0, 3600, 900)
  gv_check("T4 DEFAULT-COVERED: a process nobody listed is still governed -- 6GB against the default 4GB cap acts, so coverage no longer depends on memory of names" as *u8, (lvl_unlisted == RG_TERM) as i64, ctr)
32
  // T5 EXEMPTION IS A PROMISE: honoured unconditionally, even wildly over cap under pressure.
  let lvl_exempt: i64 = rg_level(1, 4, 30 * GB, 0, 10000, 1, 1, 3600, 900)
  gv_check("T5 AN EXEMPTION IS UNCONDITIONAL: an exempt process at 30GB, growing fast, under pressure, already termed -- still OK. Exemptions are auditable rows, not soft hints" as *u8, (lvl_exempt == RG_OK) as i64, ctr)
36
  // T6 THE PROACTIVE RUNG: not over cap, but ON COURSE to breach inside the act horizon -> deprioritise
  // BEFORE the ceiling. This is the whole point: act while headroom remains.
  // 3GB now, 4GB cap, growing 2MB/s -> ETA ~512s, inside the 900s act horizon.
  let vel: i64 = rg_velocity_kb_s(3 * GB - 120000, 1000, 3 * GB, 1060)
  let eta: i64 = rg_eta_s(3 * GB, 4 * GB, vel)
  let lvl_pro: i64 = rg_level(0, 4, 3 * GB, 0, vel, 1, 0, 3600, 900)
  var t6: i64 = 0
  if vel > 0 { if eta > 0 { if eta <= 900 { if lvl_pro == RG_RENICE { t6 = 1 } } } }
  gv_check("T6 PROACTIVE, NOT POST-MORTEM: a process still UNDER its cap but forecast to breach inside the act horizon is DEPRIORITISED while headroom remains -- the breaker moves before the hardware is hammered" as *u8, t6, ctr)
46
  // T7 ...and a slow grower gets a forecast WARNING only -- no action on a distant ETA.
  // 1GB now, 4GB cap, 1MB/s -> ETA ~3145s: past the act horizon, inside the warn horizon.
  let vslow: i64 = rg_velocity_kb_s(1 * GB - 60000, 1000, 1 * GB, 1060)
  let lvl_warn: i64 = rg_level(0, 4, 1 * GB, 0, vslow, 1, 0, 3600, 900)
  gv_check("T7 A DISTANT FORECAST IS A WARNING, NOT A VERDICT: a slow grower ~52min from its cap is WARNed and left alone -- prediction must not become a licence to act early" as *u8, (lvl_warn == RG_WARN) as i64, ctr)
52
  // T8 SYSTEM PRESSURE GATES DESTRUCTION: the SAME over-cap process on a CALM box is only WATCHed.
  let lvl_calm: i64 = rg_level(0, 8, 9 * GB, 0, 0, 0, 0, 3600, 900)
  gv_check("T8 BIG IS NOT HARMFUL: an over-cap process on an unpressured box is WATCHed, never signalled -- a healthy fleet is never disturbed by a number alone" as *u8, (lvl_calm == RG_WATCH) as i64, ctr)
56
  // T9 ESCALATION LADDER: TERM first; KILL only after a TERM in this window went unheeded.
  let lvl_kill: i64 = rg_level(0, 8, 9 * GB, 0, 0, 1, 1, 3600, 900)
  var t9: i64 = 0
  if lvl_res == RG_TERM { if lvl_kill == RG_KILL { t9 = 1 } }
  gv_check("T9 GRACEFUL LADDER: first breach = SIGTERM (guard respawns fresh), SIGKILL only for a process that already ignored a TERM this window -- a breaker whose only verb is KILL gets switched off" as *u8, t9, ctr)
62
  // T10 NEVER ACT ON IGNORANCE: unmeasurable footprint, and unmeasurable system state.
  let lvl_blind: i64 = rg_level(0, 4, 0 - 1, 0 - 1, 0, 1, 0, 3600, 900)
  let press_blind: i64 = rg_system_pressured(0 - 1, 0 - 1, 150, 500)
  var t10: i64 = 0
  if lvl_blind == RG_OK { if press_blind == 0 { t10 = 1 } }
  gv_check("T10 IGNORANCE IS NOT AUTHORITY: an unreadable process footprint yields OK, and unreadable system meters yield NOT-pressured -- the governor can only act on what it measured" as *u8, t10, ctr)
69
  // T11 PID-REUSE SAFETY at the velocity primitive: a shrink or a clock that did not advance is 0,
  // never a negative/absurd rate that a forecast could act on.
  var t11: i64 = 0
  if rg_velocity_kb_s(5000, 100, 1000, 200) == 0 { if rg_velocity_kb_s(1000, 100, 5000, 100) == 0 { if rg_velocity_kb_s(0, 0, 5000, 200) == 0 { t11 = 1 } } }
  gv_check("T11 THE FORECAST REFUSES NONSENSE: a shrinking process, a frozen clock, and a first-ever sample all yield velocity 0 -- so no ETA, no action; growth must be OBSERVED, never inferred" as *u8, t11, ctr)
75
  // T12 the pressure meters themselves, both polarities.
  var t12: i64 = 0
  if rg_headroom_permil(3600, 36000) == 100 { if rg_system_pressured(100, 0, 150, 500) == 1 { if rg_system_pressured(400, 100, 150, 500) == 0 { if rg_system_pressured(400, 800, 150, 500) == 1 { t12 = 1 } } } }
  gv_check("T12 PRESSURE IS MEASURED IN BOTH DIRECTIONS: 10% headroom is pressure, 40% headroom with light swap is not, and heavy SWAP alone is pressure even with RAM headroom -- the 08-04 signature" as *u8, t12, ctr)
80
  // T13 an inert cap can never become a kill-everything rule.
  let lvl_inert: i64 = rg_level(0, 0, 30 * GB, 0, 99999, 1, 1, 3600, 900)
  gv_check("T13 A ZERO CAP IS INERT, NOT OMNIPOTENT: cap_gb<1 yields OK even for a huge fast-growing process under pressure -- a missing or malformed threshold can never authorise mass destruction" as *u8, (lvl_inert == RG_OK) as i64, ctr)
84
  // T14 cooldown suppresses storms, and permits action once the window passes.
  var t14: i64 = 0
  if rg_cooldown_ok(1000, 1100, 600) == 0 { if rg_cooldown_ok(1000, 1700, 600) == 1 { if rg_cooldown_ok(0, 50, 600) == 1 { t14 = 1 } } }
  gv_check("T14 COOLDOWN BOTH WAYS: a second action inside the window is refused, the same action after it is allowed, and a never-acted process is not blocked -- storms suppressed without creating a deadlock" as *u8, t14, ctr)
89
  let rc: i64 = gv_verdict("RESGOV-GATE", ctr, "RSS+swap instrument, default coverage, predictive ladder, pressure-gated, fail-safe on ignorance" as *u8)
  sys_exit(rc)
  return rc
93}
nx_resgov_gate.nx source

`nx_resgov_gate.nx` source
