nx_sclass_dispatch_gate.nx source

1// nx_sclass_dispatch_gate.nx -- SCLASS-FLOW-01: AUTONOMOUS FLOW over the REAL WMS registry (the audit's #1 2// gap: "no real registered stream is auto-picked, leased, RUN, and COMPLETED by the machine"). This closes 3// the execute+complete half that nx_dispatch_lease (pick+lease only) left open: the dispatcher PICKS a real 4// registered stream, LEASES it (fl_acquire), RUNS the gate named in its code_link (fork/exec the sovereign 5// runner, verdict on the exit code -- nx_gate_sweep idiom), and -- iff GREEN -- marks the stream DONE in the 6// registry (ws_put_locked) + beats its heartbeat. So the MACHINE moves a real stream ACTIVE->DONE, not Claude. 7// LIAR-KILL / neg-control: a stream whose code_link names a NON-EXISTENT gate is NEVER completed (stays ACTIVE). 8// REUSE (rule 15): fl_acquire/fl_release (nx_arbiter), ws_put_p/ws_get/ws_field/ws_member/WS_PREFIX (registry), 9// ws_put_locked (nx_ws_cas), hb_beat_s (nx_heartbeat_str), run_gate fork/exec (nx_gate_sweep). Sovereign, 10// concurrency-safe, additive, liar-killed. license_tier: ORIGINAL expect_exit: 0 11import "nx_ws_cas.nx" 12import "nx_arbiter.nx" 13import "nx_heartbeat_str.nx" 14import "nx_gate_verdict.nx" 15import "nx_artifact_root.nx" // HOST-BOUND FIX 2026-08-02: the runner is _offc/ on the laptop and 16// buildroot/_offc/ (or flat) on the NAS. Execing the literal made this gate grade the MACHINE, not the 17// capability -- T2 could never pass off-laptop. ar_resolve is the ecosystem's existing roots-table 18// resolver (the 9-of-9-UNGROUNDED law); wire it, never build a second. 19 20const SD_RUNNER: *u8 = "_offc/nx_sov_build_run.elf" 21const SD_HBP: *u8 = "knowledge/status/wms_heartbeat.log" 22const SD_PROOF_GATE: *u8 = "nx_raci_gate" // a real, light, GREEN leaf gate = the proof stream's work 23// nx_sov_build_run exits SBR_ADMIT_REFUSED (6) for EVERY admission denial; the `rc=3/4/5` it PRINTS is the 24// admitter's own code and deliberately not its exit, because 3/4/5 collide with COMPILE_FAIL/ASM_FAIL. The 25// first cut of this gate matched the printed 4 and so read a refused build as a broken subject (-20, RED) 26// on 2026-09-02 -- a WAIT signal decoding as a defect, exactly the collision the runner's comment names. 27const SD_RUNNER_ADMIT_REFUSED: i64 = 6 28 29func sd_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 30func sd_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var i: i64=0; while s[i]!=(0 as u8){ dst[o]=s[i]; o=o+1; i=i+1 } return o } 31func sd_num(dst: *u8, off: i64, v0: i64) -> i64 { var o: i64=off; var v: i64=v0; if v<0 {dst[o]=45 as u8;o=o+1;v=0-v} let t: *u8=sys_mmap(24); var k: i64=0; if v==0{t[0]=48 as u8;k=1} while v>0{t[k]=(48+(v-(v/10)*10)) as u8;v=v/10;k=k+1} var i: i64=0; while i<k{dst[o+i]=t[k-1-i];i=i+1} return o+k } 32func sd_n(v: i64) -> i64 { let b: *u8=sys_mmap(24); let e: i64=sd_num(b,0,v); sys_write(1,b,e); return 0 } 33func sd_streq(a: *u8, b: *u8) -> i64 { var i: i64=0; while a[i]!=(0 as u8){ if a[i]!=b[i]{return 0} i=i+1 } if b[i]!=(0 as u8){return 0} return 1 } 34func sd_key(id: *u8, out: *u8) -> i64 { out[0]=119 as u8; out[1]=115 as u8; out[2]=58 as u8; var k: i64=0; while id[k]!=(0 as u8){ out[3+k]=id[k]; k=k+1 } out[3+k]=0 as u8; return 3+k } 35 36// fork/exec the sovereign runner on `name`; stdout+stderr -> /dev/null; return the exit code (0=GREEN). 37// PHASE-SPLIT (2026-08-02, debt 1785694359): BUILD and RUN need DIFFERENT working directories, and 38// conflating them is what made a healthy gate report its subject broken. 39// build phase: cwd MUST be buildroot (nx_sov_build_run resolves runtime/ relative to cwd) 40// run phase: cwd MUST be the SERVING ROOT (the built gate resolves its DATA -- knowledge/... -- 41// relative to cwd; running it from buildroot re-roots that data and it reports a 42// perfectly valid registry as invalid) 43// So: fork#1 chdir->buildroot, exec the runner with --build-only; fork#2 exec the produced elf from 44// the root we are already standing in. The parent NEVER chdirs. 45func sd_build_only(name: *u8) -> i64 { 46 let pid: i64 = sys_fork() 47 if pid == 0 { 48 let dn: i64 = sys_openat_wr("/dev/null\x00" as *u8, 420) 49 if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) } 50 if sys_chdir("buildroot" as *u8) != 0 { sys_exit(126) } 51 let argv: *i64 = sys_mmap(64) as *i64 52 argv[0] = "_offc/nx_sov_build_run.elf" as *u8 as i64 53 argv[1] = name as i64 54 argv[2] = "--build-only" as *u8 as i64 55 argv[3] = 0 56 let envp: *i64 = sys_mmap(16) as *i64 57 envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64; envp[1] = 0 58 sys_execve("_offc/nx_sov_build_run.elf" as *u8, argv, envp) 59 sys_exit(127) 60 } 61 let st: *i64 = sys_mmap(16) as *i64 62 sys_wait4(pid, st, 0) 63 if (st[0] & 0x7f) != 0 { return 128 + (st[0] & 0x7f) } 64 return (st[0] >> 8) & 0xff 65} 66 67func sd_run_gate(name: *u8) -> i64 { 68 let runner: *u8 = sys_mmap(512) 69 ar_resolve(SD_RUNNER, runner) 70 // phase 1: build (in buildroot). A build failure is NOT a subject verdict -- surface it distinctly. 71 let brc: i64 = sd_build_only(name) 72 if brc == SD_RUNNER_ADMIT_REFUSED { return 0 - 22 } 73 if brc != 0 { return 0 - 20 } 74 // phase 2: run the produced elf FROM THE SERVING ROOT (never from buildroot) 75 let built: *u8 = sys_mmap(512) 76 var bo: i64 = sd_cat(built, 0, "buildroot/_build/" as *u8) 77 bo = sd_cat(built, bo, name); bo = sd_cat(built, bo, ".sov.elf" as *u8); built[bo] = 0 as u8 78 let bprobe: i64 = sys_openat_rd(built) 79 if bprobe < 0 { return 0 - 21 } 80 sys_close(bprobe) 81 // HOST-BOUND FIX 2026-08-02 (3rd and last facet): nx_sov_build_run RESOLVES ITS SOURCE TREE RELATIVE TO 82 // CWD -- the banked law is `cd buildroot && ./_offc/nx_sov_build_run.elf <target>`. Forked from nishihost 83 // it cannot see runtime/ and the build fails exit=2, which read as "the stream's gate is RED" when the 84 // truth was "the builder was standing in the wrong directory". The chdir happens in the CHILD ONLY, so 85 // the parent's registry/lock/heartbeat paths stay exactly as they were. 86 let pid: i64 = sys_fork() 87 if pid == 0 { 88 let dn: i64 = sys_openat_wr("/dev/null\x00" as *u8, 420) 89 if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) } 90 let argv: *i64 = sys_mmap(64) as *i64 91 argv[0] = built as i64; argv[1] = 0 92 let envp: *i64 = sys_mmap(16) as *i64 93 envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64; envp[1] = 0 94 sys_execve(built, argv, envp) 95 sys_exit(127) 96 } 97 let st: *i64 = sys_mmap(16) as *i64 98 sys_wait4(pid, st, 0) 99 return (st[0] >> 8) & 0xff 100} 101 102// does an organ source exist (so we never dispatch a phantom gate)? checks both organ dirs. 103func sd_organ_exists(name: *u8) -> i64 { 104 // HOST-BOUND FIX 2026-08-02 (2nd site in this organ): the source dirs are `runtime/...` on a dev tree 105 // and `buildroot/runtime/...` on the NAS. Hardcoding them made a REAL gate read as a PHANTOM (rc -3) 106 // off-laptop -- the dispatcher then refused to run work that exists, and T1/T2/T4 could never pass. 107 // ar_resolve walks the host's roots table; the raw path is still tried FIRST so dev behaviour is identical. 108 let p: *u8 = sys_mmap(512) 109 var o: i64 = sd_cat(p, 0, "runtime/_hdl_build/" as *u8); o = sd_cat(p, o, name); o = sd_cat(p, o, ".nx" as *u8); p[o]=0 as u8 110 let r1: *u8 = sys_mmap(512) 111 ar_resolve(p, r1) 112 let fd: i64 = sys_openat_rd(r1) 113 if fd >= 0 { sys_close(fd); return 1 } 114 let p2: *u8 = sys_mmap(512) 115 var o2: i64 = sd_cat(p2, 0, "runtime/" as *u8); o2 = sd_cat(p2, o2, name); o2 = sd_cat(p2, o2, ".nx" as *u8); p2[o2]=0 as u8 116 let r2: *u8 = sys_mmap(512) 117 ar_resolve(p2, r2) 118 let fd2: i64 = sys_openat_rd(r2) 119 if fd2 >= 0 { sys_close(fd2); return 1 } 120 return 0 121} 122 123// register a NEW stream (E-PM), concurrency-safe: hold the registry wlock across the ws:ids RMW + record write. 124func sd_register(id: *u8, state: *u8, code: *u8) -> i64 { 125 let wp: *u8 = WS_PREFIX 126 let lp: *u8 = sys_mmap(512); var li: i64 = 0 127 while wp[li] != (0 as u8) { lp[li]=wp[li]; li=li+1 } 128 let suf: *u8 = "wlock"; var ls: i64 = 0 129 while suf[ls] != (0 as u8) { lp[li]=suf[ls]; li=li+1; ls=ls+1 } 130 lp[li]=0 as u8 131 let lfd: i64 = sys_openat_append(lp, 0x1a4) 132 if lfd >= 0 { sys_flock(lfd, SYS_LOCK_EX) } 133 let key: *u8 = sys_mmap(192); sd_key(id, key) 134 let rec: *u8 = sys_mmap(1024); var o: i64 = 0 135 o=sd_cat(rec,o,id); rec[o]=9 as u8;o=o+1 136 o=sd_cat(rec,o,"E-PM" as *u8); rec[o]=9 as u8;o=o+1 137 o=sd_cat(rec,o,state); rec[o]=9 as u8;o=o+1 138 o=sd_num(rec,o,sys_now_realtime_sec()); rec[o]=9 as u8;o=o+1 139 o=sd_cat(rec,o,"nx_sclass_dispatch" as *u8); rec[o]=9 as u8;o=o+1 140 o=sd_cat(rec,o,code); rec[o]=9 as u8;o=o+1 141 o=sd_cat(rec,o,"-" as *u8) 142 rec[o]=0 as u8 143 ws_put_p(WS_PREFIX, key, rec) 144 let pq: *i64 = sys_mmap(16) as *i64; let lq: *i64 = sys_mmap(16) as *i64 145 if ss_get(WS_PREFIX, "ws:ids" as *u8, pq, lq) == 1 { 146 let ids: *u8 = pq[0] as *u8; let idn: i64 = lq[0] 147 if ws_member(ids, idn, id) == 0 { 148 let nb: *u8 = sys_mmap(idn + 192); var c: i64 = 0 149 while c < idn { nb[c]=ids[c]; c=c+1 } 150 nb[c]=9 as u8; c=c+1 151 var d: i64 = 0; while id[d] != (0 as u8) { nb[c]=id[d]; c=c+1; d=d+1 } 152 nb[c]=0 as u8 153 ws_put_p(WS_PREFIX, "ws:ids" as *u8, nb) 154 } 155 } 156 if lfd >= 0 { sys_flock(lfd, SYS_LOCK_UN); sys_close(lfd) } 157 return 0 158} 159 160// read field f of stream id into out (1 found / 0 absent). 161func sd_field(id: *u8, f: i64, out: *u8) -> i64 { 162 let key: *u8 = sys_mmap(192); sd_key(id, key) 163 let pq: *i64 = sys_mmap(16) as *i64; let lq: *i64 = sys_mmap(16) as *i64 164 if ws_get(key, pq, lq) != 1 { out[0]=0 as u8; return 0 } 165 ws_field(pq[0] as *u8, lq[0], f, out) 166 return 1 167} 168 169// set an EXISTING stream's state (preserve mem/code/deps); last_touched = now. ws_put_locked (single key). 170func sd_set_state(id: *u8, newstate: *u8) -> i64 { 171 let key: *u8 = sys_mmap(192); sd_key(id, key) 172 let pq: *i64 = sys_mmap(16) as *i64; let lq: *i64 = sys_mmap(16) as *i64 173 if ws_get(key, pq, lq) != 1 { return 0 } 174 let rec: *u8 = pq[0] as *u8; let rlen: i64 = lq[0] 175 let mem: *u8 = sys_mmap(256); ws_field(rec, rlen, 4, mem) 176 let code: *u8 = sys_mmap(256); ws_field(rec, rlen, 5, code) 177 let deps: *u8 = sys_mmap(256); ws_field(rec, rlen, 6, deps) 178 let nr: *u8 = sys_mmap(1024); var o: i64 = 0 179 o=sd_cat(nr,o,id); nr[o]=9 as u8;o=o+1 180 o=sd_cat(nr,o,"E-PM" as *u8); nr[o]=9 as u8;o=o+1 181 o=sd_cat(nr,o,newstate); nr[o]=9 as u8;o=o+1 182 o=sd_num(nr,o,sys_now_realtime_sec()); nr[o]=9 as u8;o=o+1 183 o=sd_cat(nr,o,mem); nr[o]=9 as u8;o=o+1 184 o=sd_cat(nr,o,code); nr[o]=9 as u8;o=o+1 185 o=sd_cat(nr,o,deps) 186 nr[o]=0 as u8 187 ws_put_locked(WS_PREFIX, key, nr) 188 return 1 189} 190 191// DISPATCH one stream end-to-end: lease -> read its code_link gate -> run it -> complete iff GREEN. 192// returns the gate exit code (0=GREEN, >0=RED), -2 busy(lease lost), -3 no runnable gate. 193func sd_dispatch_one(id: *u8) -> i64 { 194 let resource: *u8 = sys_mmap(160); var o: i64 = sd_cat(resource, 0, "sclassdisp_" as *u8); o=sd_cat(resource,o,id); resource[o]=0 as u8 195 let lk: i64 = fl_acquire(resource, 50, 20) 196 if lk < 0 { return 0 - 2 } 197 let codebuf: *u8 = sys_mmap(256) 198 sd_field(id, 5, codebuf) 199 if sd_organ_exists(codebuf) == 0 { fl_release(lk); return 0 - 3 } 200 let ex: i64 = sd_run_gate(codebuf) 201 if ex == 0 { sd_set_state(id, "DONE" as *u8); hb_beat_s(SD_HBP, id, 1) } 202 fl_release(lk) 203 return ex 204} 205 206func main() -> i64 { 207 sd_w("=== nx_sclass_dispatch (SCLASS-FLOW-01): AUTONOMOUS pick -> lease -> RUN gate -> COMPLETE a real WMS stream ===\n" as *u8) 208 sd_register("SCLASS-DISP-PROOF" as *u8, "ACTIVE" as *u8, SD_PROOF_GATE) 209 sd_register("SCLASS-DISP-NEG" as *u8, "ACTIVE" as *u8, "nx_no_such_gate_zzz" as *u8) 210 sd_w(" registered 2 real WMS streams (E-PM): PROOF(gate=" as *u8); sd_w(SD_PROOF_GATE); sd_w(") + NEG(phantom gate)\n" as *u8) 211 212 sd_w("-- the machine dispatches (lease -> run the stream's gate -> complete iff GREEN) ...\n" as *u8) 213 let v1: i64 = sd_dispatch_one("SCLASS-DISP-PROOF" as *u8) 214 let v2: i64 = sd_dispatch_one("SCLASS-DISP-NEG" as *u8) 215 216 let st1: *u8 = sys_mmap(64); sd_field("SCLASS-DISP-PROOF" as *u8, 2, st1) 217 let st2: *u8 = sys_mmap(64); sd_field("SCLASS-DISP-NEG" as *u8, 2, st2) 218 sd_w(" PROOF: gate-exit=" as *u8); sd_n(v1); sd_w(" -> registry state=" as *u8); sd_w(st1); sd_w("\n" as *u8) 219 sd_w(" NEG: dispatch-rc=" as *u8); sd_n(v2); sd_w(" -> registry state=" as *u8); sd_w(st2); sd_w("\n" as *u8) 220 221 var pass: i64=0; var fail: i64=0 222 if v1 >= 0 { sd_w(" T1 lease+run: PROOF leased + RAN its real gate end-to-end. PASS\n" as *u8); pass=pass+1 } else { sd_w(" T1 FAIL (no lease / no gate, v1=" as *u8); sd_n(v1); sd_w(")\n" as *u8); fail=fail+1 } 223 if v1 == 0 { if sd_streq(st1, "DONE" as *u8) == 1 { sd_w(" T2 complete-on-GREEN: the gate passed -> the MACHINE marked the stream DONE. PASS\n" as *u8); pass=pass+1 } else { sd_w(" T2 FAIL: GREEN but state!=DONE\n" as *u8); fail=fail+1 } } else { sd_w(" T2 FAIL: proof gate not GREEN (v1=" as *u8); sd_n(v1); sd_w(") -- swap SD_PROOF_GATE\n" as *u8); fail=fail+1 } 224 if v2 == (0 - 3) { if sd_streq(st2, "ACTIVE" as *u8) == 1 { sd_w(" T3 LIAR-KILL: phantom gate -> NOT run, stream stays ACTIVE (no fabricated completion). PASS\n" as *u8); pass=pass+1 } else { sd_w(" T3 FAIL\n" as *u8); fail=fail+1 } } else { sd_w(" T3 FAIL: NEG rc != -3 (=" as *u8); sd_n(v2); sd_w(")\n" as *u8); fail=fail+1 } 225 if sd_streq(st1, "DONE" as *u8) == 1 { sd_w(" T4 FLOW PROVEN: a REAL registry stream went ACTIVE->DONE by the dispatcher (not by Claude). PASS\n" as *u8); pass=pass+1 } else { sd_w(" T4 FAIL\n" as *u8); fail=fail+1 } 226 227 sd_w("\npass=" as *u8); sd_n(pass); sd_w(" fail=" as *u8); sd_n(fail); sd_w("\n" as *u8) 228 if fail == 0 { sd_w("VERDICT: GREEN (autonomous pick->lease->run->complete proven on a real WMS stream; liar-killed). The team FLOWS.\n" as *u8) } else { sd_w("VERDICT: RED\n" as *u8) } 229 // 2026-09-02: a builder ADMISSION REFUSAL (nx_sov_build_run rc=4, surfaced as -22) is not a subject 230 // verdict -- the fixture never reached its condition. gv_need makes that a SKIP; the hand tally above 231 // used to convict the subject with RED whenever the box was saturated (measured: load 31 on 8 CPUs). 232 // The teeth are per-tooth gv_check so the denominator is counted, never typed; T3 (the liar-kill) 233 // needs no build and runs regardless. 234 let ctr: *i64 = gv_ctr() 235 var reached: i64 = 1 236 if v1 == (0 - 22) { reached = 0 } 237 gv_need("builder admission GRANTED the proof gate's build (rc=4 REFUSED-BUILD-ADMIT = saturated box, subject unexamined)" as *u8, reached, ctr) 238 if reached == 1 { 239 var t1: i64 = 0 240 if v1 >= 0 { t1 = 1 } 241 gv_check("T1 lease+run: PROOF leased and RAN its real gate end-to-end" as *u8, t1, ctr) 242 var t2: i64 = 0 243 if v1 == 0 { if sd_streq(st1, "DONE" as *u8) == 1 { t2 = 1 } } 244 gv_check("T2 complete-on-GREEN: the MACHINE marked the stream DONE" as *u8, t2, ctr) 245 var t4: i64 = 0 246 if sd_streq(st1, "DONE" as *u8) == 1 { t4 = 1 } 247 gv_check("T4 FLOW PROVEN: a REAL registry stream went ACTIVE->DONE by the dispatcher, not by a seat" as *u8, t4, ctr) 248 } 249 var t3: i64 = 0 250 if v2 == (0 - 3) { if sd_streq(st2, "ACTIVE" as *u8) == 1 { t3 = 1 } } 251 gv_check("T3 neg-control-phantom-gate: never run, stream stays ACTIVE (a fabricated completion is impossible)" as *u8, t3, ctr) 252 return gv_verdict("SCLASS-DISPATCH-GATE" as *u8, ctr, "autonomous pick-lease-run-complete on a REAL WMS stream, phantom-gate liar-kill holding" as *u8) 253}