nx_rigfloor_gate.nx source
↩ module page · 525 lines · 25843 B
1// nx_rigfloor_gate.nx -- THE GATE FOR THE DERIVED ASSET FLOOR.
2//
3// SUBJECT: the nx_rigfloor ELF, forked for real. The organ's whole contract is its FOUR-STATE EXIT
4// (0 OK / 1 OUT-OF-BAND / 2 usage / 3 UNOBSERVABLE), and /api/gate_run derives its verdict from an
5// exit code, so a gate that inspected only stdout would test the least load-bearing half. Every
6// tooth here asserts an EXIT CODE, and the content teeth additionally read the conf that was
7// actually written.
8//
9// FIXTURES ARE ASSEMBLED AT RUNTIME, IN /tmp/nx_rigfloor_gate/. Two reasons, both measured in this
10// estate: a detector that scans source will find its own test fixture (writing the pattern in a
11// COMMENT re-arms the trap), and a gate that shares scratch with a production beat reports on the
12// FIXTURE rather than the code -- segguard folded a real store mid-run and the gate blamed the
13// subject. Scratch is created by sys_mkdir at SETUP, because a teardown does not run when a run
14// crashes.
15//
16// THE ANTI-VACUITY TOOTH IS T2, AND IT IS THE POINT. T1 only proves the organ exited 0. A floor
17// organ that wrote a hardcoded conf and exited 0 would pass T1 forever. T2 asserts the fixture
18// REACHED THE CONDITION (n_read equals the rows the roster declared) and T3 asserts the emitted
19// band actually SPANS the fixture values -- i.e. that the number was MEASURED, not emitted. A
20// green here without T2/T3 would be the gates-green-on-garbage class.
21//
22// THE NEGATIVE CONTROL IS T5, PAIRED WITH T4 THROUGH gv_bite: an asset inside the band must score
23// IN-BAND and an asset outside it must score OUT-OF-BAND. A guard that refuses everything passes
24// every deny-test, so the ALLOW case is not decoration -- it is the half that catches it.
25//
26// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
27import "nx_syscalls.nx"
28import "nx_gate_verdict.nx"
29import "nx_tool_run.nx"
30
31// ---- subject ----
32const RG_SUBJECT_DEFAULT: *u8 = "_offc/nx_rigfloor.elf"
33
34// ---- the organ's exit contract, restated here so a change to it BREAKS THIS GATE loudly ----
35const RG_EXIT_OK: i64 = 0
36const RG_EXIT_OUT_OF_BAND: i64 = 1
37const RG_EXIT_UNOBSERVABLE: i64 = 3
38
39// ---- NXA container layout, mirrored from the format (one format, one writer shape) ----
40const RG_HDR_BYTES: i64 = 32
41const RG_SECHDR_BYTES: i64 = 32
42const RG_SEC_OFF_FIELD: i64 = 8
43const RG_NSEC_FIELD: i64 = 16
44const RG_VERSION_FIELD: i64 = 8
45const RG_WORD_BYTES: i64 = 8
46const RG_TAG_BYTES: i64 = 4
47const RG_NXA_VERSION: i64 = 1
48const RG_SECTIONS: i64 = 3 // VERT, TRIS, SKEL -- the three this organ measures
49const RG_BYTE_RADIX: i64 = 256
50const RG_BYTE_MASK: i64 = 255
51
52// ---- fixture values. CHOSEN TO BE DISTINCT AND ORDERED so a band that merely echoed one asset,
53// or emitted a constant, cannot span them by accident. The three verts differ, so verts_min and
54// verts_max are DIFFERENT numbers and T3 can tell a measured range from a copied one.
55const RG_A_VERTS: i64 = 5000
56const RG_A_TRIS: i64 = 9000
57const RG_A_JOINTS: i64 = 50
58const RG_B_VERTS: i64 = 7000
59const RG_B_TRIS: i64 = 13000
60const RG_B_JOINTS: i64 = 60
61const RG_C_VERTS: i64 = 9000
62const RG_C_TRIS: i64 = 17000
63const RG_C_JOINTS: i64 = 70
64// the IN-BAND probe sits strictly inside every derived band
65const RG_IN_VERTS: i64 = 7000
66const RG_IN_TRIS: i64 = 13000
67const RG_IN_JOINTS: i64 = 60
68// the OUT-OF-BAND probe is far outside on the vertex axis -- a value no reference asset reaches
69const RG_OUT_VERTS: i64 = 900000
70const RG_OUT_TRIS: i64 = 1700000
71const RG_OUT_JOINTS: i64 = 65
72
73const RG_CAPTURE_CAP: i64 = 262144
74const RG_PATH_CAP: i64 = 4096
75const RG_ARGV_SLOTS: i64 = 8
76const RG_MODE_DIR: i64 = 493 // 0755
77const RG_ASCII_NL: i64 = 10
78const RG_ASCII_EQ: i64 = 61
79const RG_ASCII_ZERO: i64 = 48
80const RG_ASCII_NINE: i64 = 57
81const RG_DECIMAL: i64 = 10
82const RG_MISS: i64 = 0 - 999999
83
84const RG_DIR: *u8 = "/tmp/nx_rigfloor_gate"
85const RG_A: *u8 = "/tmp/nx_rigfloor_gate/a.nxa"
86const RG_B: *u8 = "/tmp/nx_rigfloor_gate/b.nxa"
87const RG_C: *u8 = "/tmp/nx_rigfloor_gate/c.nxa"
88const RG_IN: *u8 = "/tmp/nx_rigfloor_gate/in.nxa"
89const RG_OUT: *u8 = "/tmp/nx_rigfloor_gate/out.nxa"
90const RG_ROSTER_OK: *u8 = "/tmp/nx_rigfloor_gate/ok.roster"
91const RG_ROSTER_ONE: *u8 = "/tmp/nx_rigfloor_gate/one.roster"
92const RG_ROSTER_BAD: *u8 = "/tmp/nx_rigfloor_gate/bad.roster"
93const RG_CONF: *u8 = "/tmp/nx_rigfloor_gate/floor.conf"
94const RG_CONF_ONE: *u8 = "/tmp/nx_rigfloor_gate/one.conf"
95const RG_CONF_BAD: *u8 = "/tmp/nx_rigfloor_gate/bad.conf"
96const RG_CONF_HOLED: *u8 = "/tmp/nx_rigfloor_gate/holed.conf"
97const RG_NOSUCH: *u8 = "/tmp/nx_rigfloor_gate/no_such_roster_at_all"
98const RG_ROSTER_SAME: *u8 = "/tmp/nx_rigfloor_gate/same.roster"
99const RG_CONF_SAME: *u8 = "/tmp/nx_rigfloor_gate/same.conf"
100const RG_CONF_XCONT: *u8 = "/tmp/nx_rigfloor_gate/xcont.conf"
101// ---- NXMSH2 fixtures. nlay=0 is a REAL shipping case (nx_bvhfk), not a corruption.
102const RG_U32_BYTES: i64 = 4
103const RG_MSH_MAGIC_LEN: i64 = 6 // "NXMSH2"; bytes +6/+7 stay zero
104const RG_MSH_HDR: i64 = 16
105const RG_MSH_LAYROW: i64 = 24
106const RG_MSH_TRIREC: i64 = 84 // 21 float32: 9 position + 9 normal + 3 per-tri colour
107const RG_MSH_NLAY_OFF: i64 = 8
108const RG_MSH_NTRI_OFF: i64 = 12
109const RG_MSH_LAY_OFF_FIELD: i64 = 16
110const RG_MSH_LAY_CNT_FIELD: i64 = 20
111const RG_MSH_A_TRIS: i64 = 400
112const RG_MSH_A_LAYS: i64 = 4
113const RG_MSH_B_TRIS: i64 = 900
114const RG_MSH_B_LAYS: i64 = 9
115const RG_MSH_Z_TRIS: i64 = 500 // the ZERO-LAYER case
116const RG_MSH_A: *u8 = "/tmp/nx_rigfloor_gate/m_a.nxmesh"
117const RG_MSH_B: *u8 = "/tmp/nx_rigfloor_gate/m_b.nxmesh"
118const RG_MSH_Z: *u8 = "/tmp/nx_rigfloor_gate/m_zero.nxmesh"
119const RG_ROSTER_MSH: *u8 = "/tmp/nx_rigfloor_gate/msh.roster"
120const RG_ROSTER_ZERO: *u8 = "/tmp/nx_rigfloor_gate/zero.roster"
121const RG_ROSTER_MIX: *u8 = "/tmp/nx_rigfloor_gate/mix.roster"
122const RG_CONF_MSH: *u8 = "/tmp/nx_rigfloor_gate/msh.conf"
123const RG_CONF_ZERO: *u8 = "/tmp/nx_rigfloor_gate/zero.conf"
124const RG_CONF_MIX: *u8 = "/tmp/nx_rigfloor_gate/mix.conf"
125
126func rg_wr32(b: *u8, off: i64, v: i64) -> i64 {
127 var n: i64 = v
128 var i: i64 = 0
129 while i < RG_U32_BYTES {
130 let q: i64 = n / RG_BYTE_RADIX
131 b[off + i] = (n - q*RG_BYTE_RADIX) as u8
132 n = q
133 i = i + 1
134 }
135 return 0
136}
137func rg_wr64(b: *u8, off: i64, v: i64) -> i64 {
138 var n: i64 = v
139 var i: i64 = 0
140 while i < RG_WORD_BYTES {
141 let q: i64 = n / RG_BYTE_RADIX
142 b[off + i] = (n - q*RG_BYTE_RADIX) as u8
143 n = q
144 i = i + 1
145 }
146 return 0
147}
148func rg_tag(b: *u8, off: i64, t: *u8) -> i64 {
149 var i: i64 = 0
150 while i < RG_TAG_BYTES { b[off + i] = t[i]; i = i + 1 }
151 return 0
152}
153// write a minimal but STRUCTURALLY HONEST NXANIM01 container carrying VERT/TRIS/SKEL counts
154func rg_write_nxa(path: *u8, nv: i64, nt: i64, nj: i64) -> i64 {
155 let total: i64 = RG_HDR_BYTES + RG_SECTIONS*RG_SECHDR_BYTES + RG_SECTIONS*RG_WORD_BYTES
156 let b: *u8 = sys_mmap(total)
157 var i: i64 = 0
158 while i < total { b[i] = 0; i = i + 1 }
159 let mg: *u8 = "NXANIM01" as *u8
160 var k: i64 = 0
161 while k < RG_WORD_BYTES { b[k] = mg[k]; k = k + 1 }
162 rg_wr64(b, RG_VERSION_FIELD, RG_NXA_VERSION)
163 rg_wr64(b, RG_NSEC_FIELD, RG_SECTIONS)
164 let data: i64 = RG_HDR_BYTES + RG_SECTIONS*RG_SECHDR_BYTES
165 let h0: i64 = RG_HDR_BYTES
166 let h1: i64 = RG_HDR_BYTES + RG_SECHDR_BYTES
167 let h2: i64 = RG_HDR_BYTES + RG_SECHDR_BYTES*2
168 rg_tag(b, h0, "VERT" as *u8)
169 rg_wr64(b, h0 + RG_SEC_OFF_FIELD, data)
170 rg_tag(b, h1, "TRIS" as *u8)
171 rg_wr64(b, h1 + RG_SEC_OFF_FIELD, data + RG_WORD_BYTES)
172 rg_tag(b, h2, "SKEL" as *u8)
173 rg_wr64(b, h2 + RG_SEC_OFF_FIELD, data + RG_WORD_BYTES*2)
174 rg_wr64(b, data, nv)
175 rg_wr64(b, data + RG_WORD_BYTES, nt)
176 rg_wr64(b, data + RG_WORD_BYTES*2, nj)
177 let fd: i64 = sys_openat_wr(path, MODE_0644)
178 if fd < 0 { return 0 - 1 }
179 let wr: i64 = sys_write(fd, b, total)
180 sys_close(fd)
181 if wr != total { return 0 - 1 }
182 return total
183}
184// Write a minimal but STRUCTURALLY HONEST NXMSH2: magic "NXMSH2\0\0", u32 layer count at +8, u32
185// triangle count at +12, layer rows of 24 from +16, then ntri records of 84 bytes. nlay MAY BE
186// ZERO -- nx_bvhfk is a shipping producer that emits exactly that, which is why the zero case is
187// a fixture here and not an error.
188func rg_write_msh(path: *u8, nlay: i64, ntri: i64) -> i64 {
189 let total: i64 = RG_MSH_HDR + nlay*RG_MSH_LAYROW + ntri*RG_MSH_TRIREC
190 let b: *u8 = sys_mmap(total)
191 var i: i64 = 0
192 while i < total { b[i] = 0; i = i + 1 }
193 let mg: *u8 = "NXMSH2" as *u8
194 var k: i64 = 0
195 while k < RG_MSH_MAGIC_LEN { b[k] = mg[k]; k = k + 1 }
196 rg_wr32(b, RG_MSH_NLAY_OFF, nlay)
197 rg_wr32(b, RG_MSH_NTRI_OFF, ntri)
198 var L: i64 = 0
199 while L < nlay {
200 let lb: i64 = RG_MSH_HDR + L*RG_MSH_LAYROW
201 rg_wr32(b, lb + RG_MSH_LAY_OFF_FIELD, 0)
202 rg_wr32(b, lb + RG_MSH_LAY_CNT_FIELD, ntri/nlay)
203 L = L + 1
204 }
205 let fd: i64 = sys_openat_wr(path, MODE_0644)
206 if fd < 0 { return 0 - 1 }
207 let wr: i64 = sys_write(fd, b, total)
208 sys_close(fd)
209 if wr != total { return 0 - 1 }
210 return total
211}
212func rg_write_text(path: *u8, s: *u8) -> i64 {
213 var n: i64 = 0
214 while s[n] != 0 { n = n + 1 }
215 let fd: i64 = sys_openat_wr(path, MODE_0644)
216 if fd < 0 { return 0 - 1 }
217 let wr: i64 = sys_write(fd, s, n)
218 sys_close(fd)
219 if wr != n { return 0 - 1 }
220 return n
221}
222// run the subject with two args; returns the child exit code (or a negative harness sentinel)
223func rg_run(subject: *u8, verb: *u8, a2: *u8, a3: *u8, out: *u8, outlen: *i64) -> i64 {
224 let av: *i64 = sys_mmap(RG_WORD_BYTES*RG_ARGV_SLOTS) as *i64
225 av[0] = subject as i64
226 av[1] = verb as i64
227 av[2] = a2 as i64
228 av[3] = a3 as i64
229 av[4] = 0
230 return tr_run_capture(subject, av, out, RG_CAPTURE_CAP, outlen)
231}
232// line-anchored conf read -- the same discipline the organ itself uses, for the same reason:
233// an unanchored key match would read a number out of a comment and confirm the wrong thing.
234func rg_conf(buf: *u8, n: i64, key: *u8) -> i64 {
235 var i: i64 = 0
236 var at_line_start: i64 = 1
237 var found: i64 = 0
238 var result: i64 = RG_MISS
239 while i < n {
240 if found == 0 { if at_line_start == 1 {
241 var k: i64 = 0
242 var matched: i64 = 1
243 while key[k] != 0 {
244 if i + k >= n { matched = 0 }
245 if matched == 1 { if buf[i + k] != key[k] { matched = 0 } }
246 k = k + 1
247 }
248 if matched == 1 { if i + k < n { if buf[i + k] == RG_ASCII_EQ {
249 var o: i64 = i + k + 1
250 var v: i64 = 0
251 var digits: i64 = 0
252 var scanning: i64 = 1
253 while scanning == 1 {
254 if o >= n { scanning = 0 }
255 if scanning == 1 {
256 let c: i64 = (buf[o] & RG_BYTE_MASK) as i64
257 if c < RG_ASCII_ZERO { scanning = 0 }
258 if c > RG_ASCII_NINE { scanning = 0 }
259 if scanning == 1 {
260 v = v*RG_DECIMAL + (c - RG_ASCII_ZERO)
261 digits = digits + 1
262 o = o + 1
263 }
264 }
265 }
266 if digits > 0 { result = v; found = 1 }
267 } } }
268 } }
269 if buf[i] == RG_ASCII_NL { at_line_start = 1 } else { at_line_start = 0 }
270 i = i + 1
271 }
272 return result
273}
274func rg_conf_of(path: *u8, key: *u8) -> i64 {
275 let lp: *i64 = sys_mmap(RG_WORD_BYTES*2) as *i64
276 let b: *u8 = sys_read_file(path, lp)
277 if (b as i64) == 0 { return RG_MISS }
278 return rg_conf(b, lp[0], key)
279}
280func rg_exists(path: *u8) -> i64 {
281 let lp: *i64 = sys_mmap(RG_WORD_BYTES*2) as *i64
282 let b: *u8 = sys_read_file(path, lp)
283 if (b as i64) == 0 { return 0 }
284 return 1
285}
286
287func main(argc: i64, argv: *i64) -> i64 {
288 let ctr: *i64 = gv_ctr()
289 gv_head("nx_rigfloor gate -- the asset floor is DERIVED from the corpus, and the derivation is proven" as *u8)
290 var subject: *u8 = RG_SUBJECT_DEFAULT
291 if argc >= 2 { subject = argv[1] as *u8 }
292 gv_puts(" subject: " as *u8)
293 gv_puts(subject)
294 gv_puts("\n\n" as *u8)
295
296 // ---- SETUP. mkdir at setup, never teardown: a teardown does not run when a run crashes.
297 sys_mkdir(RG_DIR, RG_MODE_DIR)
298 // A GATE THAT IS NOT IDEMPOTENT REPORTS ON ITS FIRST RUN AND LIES ABOUT EVERY RUN AFTER.
299 // Caught by this gate on itself, 2026-08-22: T7 and T11 both assert "and wrote NO floor", and a
300 // conf left behind by an EARLIER run (against an earlier binary) satisfied rg_exists forever
301 // after -- so the teeth failed against a subject that was behaving correctly. Every output the
302 // subject might create is removed HERE, before anything is measured, so each run starts from a
303 // state it established rather than one it inherited.
304 sys_unlinkat(RG_CONF)
305 sys_unlinkat(RG_CONF_ONE)
306 sys_unlinkat(RG_CONF_BAD)
307 sys_unlinkat(RG_CONF_SAME)
308 sys_unlinkat(RG_CONF_HOLED)
309 sys_unlinkat(RG_CONF_XCONT)
310 sys_unlinkat(RG_CONF_MSH)
311 sys_unlinkat(RG_CONF_ZERO)
312 sys_unlinkat(RG_CONF_MIX)
313 let wa: i64 = rg_write_nxa(RG_A, RG_A_VERTS, RG_A_TRIS, RG_A_JOINTS)
314 let wb: i64 = rg_write_nxa(RG_B, RG_B_VERTS, RG_B_TRIS, RG_B_JOINTS)
315 let wc: i64 = rg_write_nxa(RG_C, RG_C_VERTS, RG_C_TRIS, RG_C_JOINTS)
316 let wi: i64 = rg_write_nxa(RG_IN, RG_IN_VERTS, RG_IN_TRIS, RG_IN_JOINTS)
317 let wo: i64 = rg_write_nxa(RG_OUT, RG_OUT_VERTS, RG_OUT_TRIS, RG_OUT_JOINTS)
318 rg_write_text(RG_ROSTER_OK, "# three reference assets\n/tmp/nx_rigfloor_gate/a.nxa\n/tmp/nx_rigfloor_gate/b.nxa\n/tmp/nx_rigfloor_gate/c.nxa\n" as *u8)
319 rg_write_text(RG_ROSTER_ONE, "/tmp/nx_rigfloor_gate/a.nxa\n" as *u8)
320 rg_write_text(RG_ROSTER_BAD, "/tmp/nx_rigfloor_gate/a.nxa\n/tmp/nx_rigfloor_gate/does_not_exist.nxa\n/tmp/nx_rigfloor_gate/c.nxa\n" as *u8)
321 var setup: i64 = 0
322 if wa > 0 { if wb > 0 { if wc > 0 { if wi > 0 { if wo > 0 { setup = 1 } } } } }
323 // ASSERT THE FIXTURE EXISTS BEFORE ASSERTING ANY OUTCOME. A gate whose fixtures silently
324 // failed to write would report on an empty directory and call it a clean subject.
325 gv_check("setup-fixtures-written (five NXA containers)" as *u8, setup, ctr)
326 // ASSERT THE FIXTURE REACHED THE CONDITION BEFORE ASSERTING ANY OUTCOME. Without this, a failed
327 // unlink silently restores the exact non-idempotency this setup exists to remove, and the
328 // wrote-no-floor teeth go back to reporting on a previous run's leftovers.
329 var clean: i64 = 0
330 if rg_exists(RG_CONF) == 0 { if rg_exists(RG_CONF_BAD) == 0 { if rg_exists(RG_CONF_SAME) == 0 { clean = 1 } } }
331 gv_check("setup-output-confs-absent-before-measuring (gate is idempotent)" as *u8, clean, ctr)
332
333 let cap: *u8 = sys_mmap(RG_CAPTURE_CAP)
334 let olen: *i64 = sys_mmap(RG_WORD_BYTES*2) as *i64
335
336 // ---- T1: derive over a complete 3-row roster ----
337 let rc1: i64 = rg_run(subject, "derive" as *u8, RG_ROSTER_OK, RG_CONF, cap, olen)
338 gv_puts(" [T1] derive rc=" as *u8)
339 gv_num(rc1)
340 gv_puts("\n" as *u8)
341 var t1: i64 = 0
342 if rc1 == RG_EXIT_OK { t1 = 1 }
343 gv_check("derive-over-complete-roster-exits-OK" as *u8, t1, ctr)
344
345 // ---- T2: ANTI-VACUITY. The organ must have actually READ all three rows. Exiting 0 while
346 // writing a canned conf would pass T1; it cannot pass this.
347 let n_read: i64 = rg_conf_of(RG_CONF, "n_read" as *u8)
348 let n_decl: i64 = rg_conf_of(RG_CONF, "n_declared" as *u8)
349 gv_puts(" [T2] n_declared=" as *u8)
350 gv_num(n_decl)
351 gv_puts(" n_read=" as *u8)
352 gv_num(n_read)
353 gv_puts("\n" as *u8)
354 var t2: i64 = 0
355 if n_read == RG_SECTIONS { if n_decl == RG_SECTIONS { t2 = 1 } }
356 gv_check("anti-vacuity-fixture-reached-the-condition (all three rows measured)" as *u8, t2, ctr)
357
358 // ---- T3: the band SPANS the fixture. This is what separates a MEASUREMENT from a constant.
359 let vmin: i64 = rg_conf_of(RG_CONF, "verts_min" as *u8)
360 let vmax: i64 = rg_conf_of(RG_CONF, "verts_max" as *u8)
361 let jmin: i64 = rg_conf_of(RG_CONF, "joints_min" as *u8)
362 let jmax: i64 = rg_conf_of(RG_CONF, "joints_max" as *u8)
363 gv_puts(" [T3] verts band=[" as *u8)
364 gv_num(vmin)
365 gv_puts("," as *u8)
366 gv_num(vmax)
367 gv_puts("] joints band=[" as *u8)
368 gv_num(jmin)
369 gv_puts("," as *u8)
370 gv_num(jmax)
371 gv_puts("]\n" as *u8)
372 var t3: i64 = 0
373 if vmin == RG_A_VERTS { if vmax == RG_C_VERTS { if jmin == RG_A_JOINTS { if jmax == RG_C_JOINTS { t3 = 1 } } } }
374 gv_check("band-equals-the-observed-range (derived, not declared)" as *u8, t3, ctr)
375
376 // ---- T4 / T5: the BITE PAIR. Allow case and deny case, judged together.
377 let rc4: i64 = rg_run(subject, "score" as *u8, RG_IN, RG_CONF, cap, olen)
378 gv_puts(" [T4] score in-band rc=" as *u8)
379 gv_num(rc4)
380 gv_puts("\n" as *u8)
381 let rc5: i64 = rg_run(subject, "score" as *u8, RG_OUT, RG_CONF, cap, olen)
382 gv_puts(" [T5] score out-of-band rc=" as *u8)
383 gv_num(rc5)
384 gv_puts("\n" as *u8)
385 var fired_on_bad: i64 = 0
386 if rc5 == RG_EXIT_OUT_OF_BAND { fired_on_bad = 1 }
387 var fired_on_good: i64 = 1
388 if rc4 == RG_EXIT_OK { fired_on_good = 0 }
389 gv_bite("neg-control-out-of-band-asset-refused-and-in-band-asset-admitted" as *u8, fired_on_bad, fired_on_good, ctr)
390
391 // ---- T6: n=1 is a DEGENERATE band and must abstain, not pass. A point is not a bar.
392 let rc6: i64 = rg_run(subject, "derive" as *u8, RG_ROSTER_ONE, RG_CONF_ONE, cap, olen)
393 gv_puts(" [T6] derive n=1 rc=" as *u8)
394 gv_num(rc6)
395 gv_puts("\n" as *u8)
396 var t6: i64 = 0
397 if rc6 == RG_EXIT_UNOBSERVABLE { t6 = 1 }
398 gv_check("degenerate-single-asset-corpus-abstains-not-passes" as *u8, t6, ctr)
399
400 // ---- T7: a partial corpus must abstain AND must not leave a floor behind. A floor derived
401 // from an unknown fraction of the corpus looks authoritative and is not.
402 let rc7: i64 = rg_run(subject, "derive" as *u8, RG_ROSTER_BAD, RG_CONF_BAD, cap, olen)
403 gv_puts(" [T7] derive with one unreadable row rc=" as *u8)
404 gv_num(rc7)
405 gv_puts("\n" as *u8)
406 var t7: i64 = 0
407 if rc7 == RG_EXIT_UNOBSERVABLE { if rg_exists(RG_CONF_BAD) == 0 { t7 = 1 } }
408 gv_check("partial-corpus-abstains-AND-writes-no-floor" as *u8, t7, ctr)
409
410 // ---- T8: a bound MISSING from the conf must read UNOBSERVABLE, never IN-BAND. This is the
411 // gate-passes-on-the-empty-set defect, in its scoring form.
412 // container=1 IS LOAD-BEARING IN THIS FIXTURE. Without it the subject exits 3 on
413 // CONTAINER-MISMATCH instead of on the absent ratio bounds -- the right exit code for the wrong
414 // reason, which is the most easily accepted false proof there is. The fixture must reach the
415 // condition the tooth NAMES, not merely the exit code it expects.
416 rg_write_text(RG_CONF_HOLED, "method=observed-range-full-population\nn_read=3\ncorpus_complete=1\ncontainer=1\nverts_min=1\nverts_max=999999\ntris_min=1\ntris_max=9999999\njoints_min=1\njoints_max=9999\n" as *u8)
417 let rc8: i64 = rg_run(subject, "score" as *u8, RG_IN, RG_CONF_HOLED, cap, olen)
418 gv_puts(" [T8] score against a conf missing the ratio bounds rc=" as *u8)
419 gv_num(rc8)
420 gv_puts("\n" as *u8)
421 var t8: i64 = 0
422 if rc8 == RG_EXIT_UNOBSERVABLE { t8 = 1 }
423 gv_check("absent-bound-reads-UNOBSERVABLE-never-IN-BAND" as *u8, t8, ctr)
424
425 // ---- T9: an unreadable roster is UNOBSERVABLE, and must not be confused with an empty one.
426 let rc9: i64 = rg_run(subject, "derive" as *u8, RG_NOSUCH, RG_CONF_ONE, cap, olen)
427 gv_puts(" [T9] derive with an unreadable roster rc=" as *u8)
428 gv_num(rc9)
429 gv_puts("\n" as *u8)
430 var t9: i64 = 0
431 if rc9 == RG_EXIT_UNOBSERVABLE { t9 = 1 }
432 gv_check("unreadable-roster-abstains" as *u8, t9, ctr)
433
434 // ---- T11: THE DEGENERATE-CORPUS TOOTH, WRITTEN BECAUSE REAL DATA REFUTED THE FIRST GUARD.
435 // A roster of N IDENTICAL assets satisfies n>=2 and still yields a zero-width band on every
436 // axis -- a bar that admits only the reference itself. This is the exact condition the
437 // estate's own 12-file corpus hits (11 rigged files, all verts=14164 tris=28092 joints=104),
438 // so this tooth is not hypothetical: it is the live case.
439 rg_write_text(RG_ROSTER_SAME, "/tmp/nx_rigfloor_gate/a.nxa\n/tmp/nx_rigfloor_gate/a.nxa\n/tmp/nx_rigfloor_gate/a.nxa\n" as *u8)
440 let rc11: i64 = rg_run(subject, "derive" as *u8, RG_ROSTER_SAME, RG_CONF_SAME, cap, olen)
441 gv_puts(" [T11] derive over three IDENTICAL assets rc=" as *u8)
442 gv_num(rc11)
443 gv_puts("\n" as *u8)
444 var t11: i64 = 0
445 if rc11 == RG_EXIT_UNOBSERVABLE { if rg_exists(RG_CONF_SAME) == 0 { t11 = 1 } }
446 gv_check("identical-corpus-abstains-AND-writes-no-floor (zero-width band is not a bar)" as *u8, t11, ctr)
447
448 // ---- T12: and the ALLOW half of that pair -- a corpus with width must still derive. Without
449 // this, a guard that refused every corpus would pass T11 and look correct.
450 var width_bite_bad: i64 = 0
451 if rc11 == RG_EXIT_UNOBSERVABLE { width_bite_bad = 1 }
452 var width_bite_good: i64 = 1
453 if rc1 == RG_EXIT_OK { width_bite_good = 0 }
454 gv_bite("neg-control-zero-width-corpus-refused-and-widthful-corpus-derived" as *u8, width_bite_bad, width_bite_good, ctr)
455
456 // ---- T13: CONTAINER MISMATCH. A floor derived from NXMSH2 donors declares no joints band at
457 // all. Scoring an NXANIM01 asset against it is a SUBJECT MISMATCH, not a stricter test: it
458 // would silently grade a rigged character on form axes alone and report a pass. Must abstain.
459 rg_write_text(RG_CONF_XCONT, "method=observed-range-full-population\nn_read=3\ncorpus_complete=1\ncontainer=2\ntris_min=1\ntris_max=9999999\nparts_min=1\nparts_max=99\ntris_per_part_min=1\ntris_per_part_max=999999\n" as *u8)
460 let rc13: i64 = rg_run(subject, "score" as *u8, RG_IN, RG_CONF_XCONT, cap, olen)
461 gv_puts(" [T13] score an NXANIM01 asset against an NXMSH2-derived floor rc=" as *u8)
462 gv_num(rc13)
463 gv_puts("\n" as *u8)
464 var t13: i64 = 0
465 if rc13 == RG_EXIT_UNOBSERVABLE { t13 = 1 }
466 gv_check("container-mismatch-abstains (a form floor cannot grade a rig)" as *u8, t13, ctr)
467
468 // ---- T14: and the ALLOW half. Without it, a subject that refused EVERY score would pass T13
469 // and look correct -- a guard that refuses everything passes every deny-test.
470 var xc_bad: i64 = 0
471 if rc13 == RG_EXIT_UNOBSERVABLE { xc_bad = 1 }
472 var xc_good: i64 = 1
473 if rc4 == RG_EXIT_OK { xc_good = 0 }
474 gv_bite("neg-control-mismatched-container-refused-and-matched-container-scored" as *u8, xc_bad, xc_good, ctr)
475
476 // ---- T15: NXMSH2 corpora derive. A second container is not a second ruler -- it is the same
477 // ruler answering the axes THAT container can answer.
478 rg_write_msh(RG_MSH_A, RG_MSH_A_LAYS, RG_MSH_A_TRIS)
479 rg_write_msh(RG_MSH_B, RG_MSH_B_LAYS, RG_MSH_B_TRIS)
480 rg_write_text(RG_ROSTER_MSH, "/tmp/nx_rigfloor_gate/m_a.nxmesh\n/tmp/nx_rigfloor_gate/m_b.nxmesh\n" as *u8)
481 let rc15: i64 = rg_run(subject, "derive" as *u8, RG_ROSTER_MSH, RG_CONF_MSH, cap, olen)
482 gv_puts(" [T15] derive over an NXMSH2 corpus rc=" as *u8)
483 gv_num(rc15)
484 gv_puts("\n" as *u8)
485 var t15: i64 = 0
486 if rc15 == RG_EXIT_OK { t15 = 1 }
487 gv_check("nxmsh2-corpus-derives" as *u8, t15, ctr)
488
489 // ---- T16: ZERO-LAYER MESHES ARE VALID, NOT BROKEN. nx_bvhfk ships nlay=0. An earlier version
490 // of the subject rejected them outright, calling a conformant file unreadable -- and dividing
491 // by nlay would have been a SIGFPE. The honest outcome is that the PARTS axes are simply
492 // unavailable for such a file while the tris axis still measures.
493 rg_write_msh(RG_MSH_Z, 0, RG_MSH_Z_TRIS)
494 rg_write_text(RG_ROSTER_ZERO, "/tmp/nx_rigfloor_gate/m_zero.nxmesh\n/tmp/nx_rigfloor_gate/m_a.nxmesh\n" as *u8)
495 let rc16: i64 = rg_run(subject, "derive" as *u8, RG_ROSTER_ZERO, RG_CONF_ZERO, cap, olen)
496 gv_puts(" [T16] derive over a corpus containing a ZERO-LAYER mesh rc=" as *u8)
497 gv_num(rc16)
498 gv_puts("\n" as *u8)
499 var t16: i64 = 0
500 if rc16 == RG_EXIT_OK { t16 = 1 }
501 gv_check("zero-layer-mesh-is-valid-not-unreadable (no SIGFPE, no false refusal)" as *u8, t16, ctr)
502
503 // ---- T17: a MIXED-container roster must abstain. NXANIM01 and NXMSH2 answer different axes;
504 // ranging across both would put two different quantities in one band and publish it as a bound.
505 rg_write_text(RG_ROSTER_MIX, "/tmp/nx_rigfloor_gate/a.nxa\n/tmp/nx_rigfloor_gate/m_a.nxmesh\n" as *u8)
506 let rc17: i64 = rg_run(subject, "derive" as *u8, RG_ROSTER_MIX, RG_CONF_MIX, cap, olen)
507 gv_puts(" [T17] derive over a MIXED-container roster rc=" as *u8)
508 gv_num(rc17)
509 gv_puts("\n" as *u8)
510 var t17: i64 = 0
511 if rc17 == RG_EXIT_UNOBSERVABLE { if rg_exists(RG_CONF_MIX) == 0 { t17 = 1 } }
512 gv_check("mixed-container-roster-abstains-AND-writes-no-floor" as *u8, t17, ctr)
513
514 // ---- T10: the subject must actually have RUN. tr_run_capture returns a negative sentinel on
515 // a harness failure and 127 when execve could not find the ELF -- both of which would make
516 // every exit-code tooth above compare against a number the subject never produced.
517 var ran: i64 = 1
518 if rc1 < 0 { ran = 0 }
519 if rc1 == 127 { ran = 0 }
520 gv_check("neg-control-subject-actually-executed (not 127, not a harness sentinel)" as *u8, ran, ctr)
521
522 let rc: i64 = gv_verdict("RIGFLOOR" as *u8, ctr, "the floor is a measurement of the corpus, and the measurement is bitten both ways" as *u8)
523 sys_exit(rc)
524 return rc
525}