code wiki / _hdl_build / nx_sheriff.nx
nx_sheriff.nx source
↩ module page · 656 lines · 34165 B
1// nx_sheriff.nx -- THE UAT/ACCEPTANCE SHERIFF (operator 2026-07-19: "workstreams say complete
2// and in compare there are massive gaps... a sheriff or guard as part of the pm/team capabilities
3// to make sure the work is truly user accepted"). DONE-ness is DERIVED FROM EVIDENCE, never
4// asserted (the same law as the conductor's phase derivation) -- applied to CLAIMED-COMPLETE work:
5// 1) every /compare registry domain: coverage score vs the acceptance floor; a sub-floor domain
6// WITHOUT filed frontier rungs on its published surface = REJECTED-UNFILED-GAP (the
7// less-than-SOTA-is-never-design law, mechanized); WITH filed rungs = ACCEPTED-FILED-CLIMB
8// (the climb is the design).
9// 2) every ws_sync DONE frame: open debt rows whose scope matches the ws = lane-local unfinished
10// work declared over = REJECTED-DONE-OVER-DEBT (scope-match-only, NOT the global sev floor,
11// so the verdict names the lane's OWN mess, not the tree's).
12// Rejections emit ready-to-file debt rows (proposed_debts) for nx_store_put -- the R2a scoped
13// debt gate then mechanically blocks new WORK in that lane until the last mile lands.
14// READ-ONLY organ: it proposes, never writes (provenance stays with the filer). Fail-closed:
15// unreadable registry = exit 1; unreadable debt store = REJECTED verdict, never a silent accept.
16// Envelope DECLARED in every output (scale law: no silent windowing/capping).
17// nx_sheriff seed [uatprefix] (CONFIG rows, idempotent)
18// nx_sheriff audit [registry] [journal] [debtprefix] [uatprefix] (JSON verdicts)
19// nx_sheriff page [registry] [journal] [debtprefix] [uatprefix] (HTML board)
20// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
21import "nx_store_seed_lib.nx"
22import "nx_seg_store.nx"
23import "nx_syscalls.nx"
24const SHF_MAGIC_4096: i64 = 4096
25
26const SHF_CAP: i64 = 33554432 // 2026-08-06 MEASURED by nx_planefit: knowledge/store/debt- loads to 4,396,892B. At the old 1 MiB this organ silently lost 3,348,316B = 76% of the board, and because AN APPEND-ONLY PLANE PAST A PREFIX CAP LOSES ITS NEWEST ROWS FIRST it was reporting on the OLDEST quarter -- degrading exactly as new work arrived. 32 MiB matches nx_debt DB_CAP sizing. Re-verify: nx_planefit knowledge/store/debt- 33554432
27const SHF_SPAN: i64 = 16
28const SHF_ROWCAP: i64 = 512
29const SHF_WSCAP: i64 = 256
30const SHF_TAB: i64 = 9
31const SHF_NL: i64 = 10
32const SHF_PIPE: i64 = 124
33const SHF_HASH: i64 = 35
34const SHF_STDERR: i64 = 2
35const SHF_SEEK_SET: i64 = 0
36const SHF_SEEK_END: i64 = 2
37const SHF_EXIT_USAGE: i64 = 2
38const SHF_DEF_FLOOR: i64 = 700
39// proposed-debt sev DEFAULT 5 = below the conductor's global-sev-min 6 floor -> sheriff debts gate
40// ONLY their scope-matched lane (surgical teeth), never freeze the whole tree. Data-overridable.
41const SHF_DEF_SEV: i64 = 5
42
43func shf_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
44func shf_werr(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(SHF_STDERR, s, n); return 0 }
45func shf_vlen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
46func shf_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o] = s[i]; o = o + 1; i = i + 1 } return o }
47// signed number append (unscored score emits -1; the wc_catn clamp would lie)
48func shf_catn(d: *u8, o: i64, v: i64) -> i64 {
49 let t: *u8 = sys_mmap(28)
50 var m: i64 = v
51 if m < 0 { d[o] = 45 as u8; o = o + 1; m = 0 - m }
52 var k: i64 = 0
53 if m == 0 { t[0] = 48 as u8; k = 1 }
54 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
55 var i: i64 = 0
56 while i < k { d[o] = t[k-1-i]; o = o + 1; i = i + 1 }
57 return o
58}
59// JSON/HTML-safe span append: double-quote -> single-quote, backslash -> slash, ctrl -> space
60// HTML-SINK ESCAPER (seq677 sweep, 2026-07-23). shf_cat_esc below is a JSON-STRING escaper and does NOT
61// neutralise markup; this organ emits BOTH a JSON branch and an HTML branch from the SAME data, so the
62// HTML branch needs context-correct escaping (the class that produced a live stored-injection on /standup).
63func shf_cat_esc_html(d: *u8, o: i64, q: *u8, s: i64, e: i64) -> i64 {
64 var i: i64 = s
65 var w: i64 = o
66 while i < e {
67 if w > SHF_CAP - 16 { i = e } else {
68 let c: i64 = q[i] as i64
69 if c == 38 { w = shf_cat(d, w, "&" as *u8) } else { if c == 60 { w = shf_cat(d, w, "<" as *u8) } else { if c == 62 { w = shf_cat(d, w, ">" as *u8) } else { if c == 34 { w = shf_cat(d, w, """ as *u8) } else { if c < 32 { d[w] = 32 as u8; w = w + 1 } else { d[w] = c as u8; w = w + 1 } } } } }
70 i = i + 1
71 }
72 }
73 return w
74}
75func shf_cat_esc(d: *u8, o: i64, q: *u8, s: i64, e: i64) -> i64 {
76 var i: i64 = s
77 while i < e {
78 var c: i64 = q[i] as i64
79 if c == 34 { c = 39 }
80 if c == 92 { c = 47 }
81 if c < 32 { c = 32 }
82 d[o] = c as u8
83 o = o + 1
84 i = i + 1
85 }
86 return o
87}
88// tail-window read (scale law: newest lines always in-window; envelope declares true size)
89func shf_read(path: *u8, buf: *u8, cap: i64, sizep: *i64) -> i64 {
90 sizep[0] = 0
91 let fd: i64 = sys_openat_rd(path)
92 if fd < 0 { return 0 }
93 var size: i64 = sys_lseek(fd, 0, SHF_SEEK_END)
94 if size < 0 { size = 0 }
95 sizep[0] = size
96 var off: i64 = 0
97 if size > cap { off = size - cap }
98 sys_lseek(fd, off, SHF_SEEK_SET)
99 var n: i64 = 0
100 var go: i64 = 1
101 while go == 1 { let r: i64 = sys_read(fd, ((buf as i64) + n) as *u8, cap - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap { go = 0 } }
102 sys_close(fd)
103 if off > 0 {
104 var fnl: i64 = 0
105 var s: i64 = 1
106 while s == 1 { if fnl >= n { s = 0 } else { if buf[fnl] == (SHF_NL as u8) { s = 0 } else { fnl = fnl + 1 } } }
107 if fnl < n {
108 var t: i64 = 0
109 let sk: i64 = fnl + 1
110 while sk + t < n { buf[t] = buf[sk + t]; t = t + 1 }
111 n = t
112 }
113 }
114 return n
115}
116func shf_le(q: *u8, i: i64, n: i64) -> i64 { var e: i64 = i; var s: i64 = 1; while s == 1 { if e >= n { s = 0 } else { if q[e] == (SHF_NL as u8) { s = 0 } else { e = e + 1 } } } return e }
117// column c of a line, separator-parameterized via two thin wrappers (pipe registry / tab planes)
118func shf_colsep(q: *u8, ls: i64, le: i64, c: i64, sep: i64, out: *i64) -> i64 {
119 var col: i64 = 0
120 var p: i64 = ls
121 while col < c {
122 var s: i64 = 1
123 while s == 1 { if p >= le { return 0 } if q[p] == (sep as u8) { s = 0 } else { p = p + 1 } }
124 p = p + 1
125 col = col + 1
126 }
127 var e: i64 = p
128 var s2: i64 = 1
129 while s2 == 1 { if e >= le { s2 = 0 } else { if q[e] == (sep as u8) { s2 = 0 } else { e = e + 1 } } }
130 out[0] = p
131 out[1] = e
132 return 1
133}
134func shf_colp(q: *u8, ls: i64, le: i64, c: i64, out: *i64) -> i64 { return shf_colsep(q, ls, le, c, SHF_PIPE, out) }
135func shf_colt(q: *u8, ls: i64, le: i64, c: i64, out: *i64) -> i64 { return shf_colsep(q, ls, le, c, SHF_TAB, out) }
136func shf_lit_eq(q: *u8, s: i64, e: i64, lit: *u8) -> i64 {
137 var i: i64 = 0
138 while s + i < e { if lit[i] == (0 as u8) { return 0 } if q[s+i] != lit[i] { return 0 } i = i + 1 }
139 if lit[i] != (0 as u8) { return 0 }
140 return 1
141}
142func shf_span_eq(q: *u8, s1: i64, e1: i64, s2: i64, e2: i64) -> i64 {
143 if e1 - s1 != e2 - s2 { return 0 }
144 var i: i64 = 0
145 while s1 + i < e1 { if q[s1+i] != q[s2+i] { return 0 } i = i + 1 }
146 return 1
147}
148func shf_atoi_span(q: *u8, s: i64, e: i64) -> i64 { var v: i64 = 0; var i: i64 = s; while i < e { let c: i64 = q[i] as i64; if c >= 48 { if c <= 57 { v = v * 10 + (c - 48) } } i = i + 1 } return v }
149func shf_isdig(c: i64) -> i64 { if c >= 48 { if c <= 57 { return 1 } } return 0 }
150// coverage score in a stat span: FIRST "<digits>/1000" hit, else "<digits>[ &]permil"; -1 = unscored
151func shf_score(q: *u8, s: i64, e: i64) -> i64 {
152 var i: i64 = s
153 while i + 4 < e {
154 var hit: i64 = 0
155 if q[i] == (47 as u8) { if q[i+1] == (49 as u8) { if q[i+2] == (48 as u8) { if q[i+3] == (48 as u8) { if q[i+4] == (48 as u8) { hit = 1 } } } } }
156 if hit == 1 {
157 // reject "/10000" (a longer run) -- next byte must not be a digit
158 if i + 5 < e { if shf_isdig(q[i+5] as i64) == 1 { hit = 0 } }
159 }
160 if hit == 1 {
161 // walk left over the digit run immediately preceding '/'; no digits -> keep scanning
162 var j: i64 = i
163 var st: i64 = 1
164 while st == 1 { if j - 1 < s { st = 0 } else { if shf_isdig(q[j-1] as i64) == 1 { j = j - 1 } else { st = 0 } } }
165 if j < i { return shf_atoi_span(q, j, i) }
166 }
167 i = i + 1
168 }
169 // permil fallback: p e r m i l
170 var i2: i64 = s
171 while i2 + 5 < e {
172 var hit2: i64 = 0
173 if q[i2] == (112 as u8) { if q[i2+1] == (101 as u8) { if q[i2+2] == (114 as u8) { if q[i2+3] == (109 as u8) { if q[i2+4] == (105 as u8) { if q[i2+5] == (108 as u8) { hit2 = 1 } } } } } }
174 if hit2 == 1 {
175 var j2: i64 = i2 - 1
176 var sk: i64 = 1
177 while sk == 1 { if j2 < s { sk = 0 } else { let c2: i64 = q[j2] as i64; if c2 == 32 { j2 = j2 - 1 } else { if c2 == 38 { j2 = j2 - 1 } else { sk = 0 } } } }
178 let dend: i64 = j2 + 1
179 var j3: i64 = j2
180 var sk2: i64 = 1
181 while sk2 == 1 { if j3 < s { sk2 = 0 } else { if shf_isdig(q[j3] as i64) == 1 { j3 = j3 - 1 } else { sk2 = 0 } } }
182 let dstart: i64 = j3 + 1
183 if dend > dstart { return shf_atoi_span(q, dstart, dend) }
184 }
185 i2 = i2 + 1
186 }
187 return 0 - 1
188}
189// filed-rung marker on the published surface: 'F'+2digits (F74x, F10x...) or 'G','x',digit|'-' (Gx1, Gx-1)
190func shf_filed(q: *u8, s: i64, e: i64) -> i64 {
191 var i: i64 = s
192 while i + 2 < e {
193 if q[i] == (70 as u8) { if shf_isdig(q[i+1] as i64) == 1 { if shf_isdig(q[i+2] as i64) == 1 { return 1 } } }
194 if q[i] == (71 as u8) { if q[i+1] == (120 as u8) { let c3: i64 = q[i+2] as i64; if shf_isdig(c3) == 1 { return 1 } if c3 == 45 { return 1 } } }
195 i = i + 1
196 }
197 return 0
198}
199// verdict codes: 0 ACCEPTED / 1 ACCEPTED-FILED-CLIMB / 2 REJECTED-UNFILED-GAP / 3 UNSCORED
200func shf_verdict(score: i64, filed: i64, floor: i64) -> i64 {
201 if score < 0 { return 3 }
202 if score >= floor { return 0 }
203 if filed == 1 { return 1 }
204 return 2
205}
206func shf_verdict_str(v: i64) -> *u8 {
207 if v == 0 { return "ACCEPTED" as *u8 }
208 if v == 1 { return "ACCEPTED-FILED-CLIMB" as *u8 }
209 if v == 2 { return "REJECTED-UNFILED-GAP" as *u8 }
210 return "UNSCORED" as *u8
211}
212// slug = the path segment after "/compare/" in the href span; fills nul-term dst, returns len
213func shf_slug(q: *u8, s: i64, e: i64, dst: *u8, cap: i64) -> i64 {
214 var p: i64 = s
215 if p < e { if q[p] == (47 as u8) { p = p + 1 } }
216 var s1: i64 = 1
217 while s1 == 1 { if p >= e { s1 = 0 } else { if q[p] == (47 as u8) { s1 = 0 } else { p = p + 1 } } }
218 if p < e { p = p + 1 }
219 var k: i64 = 0
220 var s2: i64 = 1
221 while s2 == 1 {
222 if p >= e { s2 = 0 } else {
223 if q[p] == (47 as u8) { s2 = 0 } else {
224 if k < cap - 1 { dst[k] = q[p]; k = k + 1 }
225 p = p + 1
226 }
227 }
228 }
229 dst[k] = 0 as u8
230 return k
231}
232// data-driven CONFIG on the uat- store (rule 11); absent store/key -> defv
233func shf_cfg(uprefix: *u8, key: *u8, defv: i64) -> i64 {
234 let b: *u8 = sys_mmap(SHF_CAP)
235 let n: i64 = sts_load(uprefix, b, SHF_CAP)
236 if n <= 0 { return defv }
237 let c1: *i64 = sys_mmap(SHF_SPAN) as *i64
238 let c2: *i64 = sys_mmap(SHF_SPAN) as *i64
239 let c3: *i64 = sys_mmap(SHF_SPAN) as *i64
240 var i: i64 = 0
241 while i < n {
242 let le: i64 = shf_le(b, i, n)
243 if shf_colt(b, i, le, 1, c1) == 1 { if shf_lit_eq(b, c1[0], c1[1], "CONFIG" as *u8) == 1 {
244 if shf_colt(b, i, le, 2, c2) == 1 { if shf_lit_eq(b, c2[0], c2[1], key) == 1 {
245 if shf_colt(b, i, le, 3, c3) == 1 { return shf_atoi_span(b, c3[0], c3[1]) }
246 } }
247 } }
248 i = le + 1
249 }
250 return defv
251}
252// legacy debt row detect (col0 all-digits len>=8 = epoch id): sev@1 scope@2, else v2 sev@2 scope@5
253func shf_row_legacy(q: *u8, ls: i64, le: i64, c0: *i64) -> i64 {
254 if shf_colt(q, ls, le, 0, c0) == 0 { return 0 }
255 if c0[1] - c0[0] < 8 { return 0 }
256 var i: i64 = c0[0]
257 while i < c0[1] { if shf_isdig(q[i] as i64) == 0 { return 0 } i = i + 1 }
258 return 1
259}
260func shf_scope_hits_ws(q: *u8, s: i64, e: i64, ws: *u8) -> i64 {
261 if shf_lit_eq(q, s, e, "global" as *u8) == 1 { return 1 }
262 if shf_lit_eq(q, s, e, ws) == 1 { return 1 }
263 var wl: i64 = 0
264 while ws[wl] != (0 as u8) { wl = wl + 1 }
265 let sl: i64 = e - s
266 if sl > 0 { if sl <= wl {
267 var i: i64 = 0
268 while i + sl <= wl {
269 var j: i64 = 0
270 var ok: i64 = 1
271 while j < sl { if ws[i+j] != q[s+j] { ok = 0; j = sl } else { j = j + 1 } }
272 if ok == 1 { return 1 }
273 i = i + 1
274 }
275 } }
276 if wl > 0 { if wl <= sl {
277 var i2: i64 = s
278 while i2 + wl <= e {
279 var j2: i64 = 0
280 var ok2: i64 = 1
281 while j2 < wl { if q[i2+j2] != ws[j2] { ok2 = 0; j2 = wl } else { j2 = j2 + 1 } }
282 if ok2 == 1 { return 1 }
283 i2 = i2 + 1
284 }
285 } }
286 return 0
287}
288// ONE-TIME debt-plane load (scale law: the 17-lane DONE loop must never re-load the plane per lane
289// -- per-row seg-store gets x lanes went quadratic on the real 190-row NAS plane and blew the edge
290// timeout; load ONCE, count in memory). A dprefix starting with '@' means a FLAT TSV snapshot file
291// (e.g. a live-plane dump fetched over MCP) instead of a seg store -- same row schemas.
292// Returns bytes loaded; <=0 = unreadable (callers FAIL-CLOSED, never silently accept).
293// SELF-SIZING (2026-08-06). SIGNATURE CHANGED ON PURPOSE: it used to take a caller-supplied buffer,
294// which is exactly what forced a fixed cap on the plane read. knowledge/store/debt- measured
295// 4,419,932B against the old 1 MiB SHF_CAP, so the sheriff was judging DONE claims from a PREFIX of
296// the board -- and an append-only plane past a prefix cap loses its NEWEST rows first, so the rows
297// it was blindest to were precisely the freshly-filed ones a DONE claim is most likely to concern.
298// Raising SHF_CAP to 32 MiB fixed today's number; returning an OWNED, self-sized buffer removes the
299// number. ★A CAP THAT CAN BE CROSSED IN SILENCE WILL BE CROSSED AGAIN (nx_debt DB_CAP, third raise).
300// The '@' FLAT-FILE path keeps a bounded buffer deliberately: it reads a snapshot FILE, not a plane,
301// and shf_read already reports its own size -- sts_load_fit's completeness proof is a seg-store
302// property and must not be implied for a path it does not cover.
303// Returns the buffer (null = unreadable) and writes bytes to out_len; callers FAIL-CLOSED on <=0.
304func shf_debts_load(dprefix: *u8, out_len: *i64) -> *u8 {
305 if dprefix[0] == (64 as u8) {
306 let szp: *i64 = sys_mmap(SHF_SPAN) as *i64
307 let fbuf: *u8 = sys_mmap(SHF_CAP)
308 out_len[0] = shf_read(((dprefix as i64) + 1) as *u8, fbuf, SHF_CAP - 4, szp)
309 return fbuf
310 }
311 return sts_load_fit(dprefix, out_len)
312}
313// DONE-claim acceptance debts over the PRE-LOADED plane buffer: open rows whose SCOPE matches the
314// ws ONLY (lane-local mess; the global sev floor is the conductor's WORK gate, not the sheriff's
315// DONE test). n<=0 = FAIL-CLOSED -1.
316func shf_debts_count_ws(buf: *u8, n: i64, ws: *u8) -> i64 {
317 if n <= 0 { return 0 - 1 }
318 let c1: *i64 = sys_mmap(SHF_SPAN) as *i64
319 let c2: *i64 = sys_mmap(SHF_SPAN) as *i64
320 let c3: *i64 = sys_mmap(SHF_SPAN) as *i64
321 var k: i64 = 0
322 var i: i64 = 0
323 while i < n {
324 let le: i64 = shf_le(buf, i, n)
325 if shf_colt(buf, i, le, 3, c3) == 1 { if shf_lit_eq(buf, c3[0], c3[1], "open" as *u8) == 1 {
326 var scopecol: i64 = 5
327 if shf_row_legacy(buf, i, le, c1) == 1 { scopecol = 2 }
328 if shf_colt(buf, i, le, scopecol, c2) == 1 { if shf_scope_hits_ws(buf, c2[0], c2[1], ws) == 1 { k = k + 1 } }
329 } }
330 i = le + 1
331 }
332 return k
333}
334func shf_has(q: *u8, n: i64, verb: *u8, ws_s: i64, ws_e: i64) -> i64 {
335 let cv: *i64 = sys_mmap(SHF_SPAN) as *i64
336 let cw: *i64 = sys_mmap(SHF_SPAN) as *i64
337 var i: i64 = 0
338 while i < n {
339 let le: i64 = shf_le(q, i, n)
340 if shf_colt(q, i, le, 1, cv) == 1 { if shf_lit_eq(q, cv[0], cv[1], verb) == 1 {
341 if shf_colt(q, i, le, 2, cw) == 1 { if shf_span_eq(q, cw[0], cw[1], ws_s, ws_e) == 1 { return 1 } }
342 } }
343 i = le + 1
344 }
345 return 0
346}
347func shf_first_kick(q: *u8, upto: i64, ws_s: i64, ws_e: i64) -> i64 {
348 let cv: *i64 = sys_mmap(SHF_SPAN) as *i64
349 let cw: *i64 = sys_mmap(SHF_SPAN) as *i64
350 var i: i64 = 0
351 while i < upto {
352 let le: i64 = shf_le(q, i, upto)
353 if shf_colt(q, i, le, 1, cv) == 1 { if shf_lit_eq(q, cv[0], cv[1], "KICKOFF" as *u8) == 1 {
354 if shf_colt(q, i, le, 2, cw) == 1 { if shf_span_eq(q, cw[0], cw[1], ws_s, ws_e) == 1 { return 0 } }
355 } }
356 i = le + 1
357 }
358 return 1
359}
360func shf_seed(prefix: *u8) -> i64 {
361 let b: *u8 = sys_mmap(SHF_MAGIC_4096)
362 var o: i64 = 0
363 o = shf_cat(b, o, "0\tCONFIG\taccept-floor-permille\t700\tcompare-domain-below-this-needs-filed-rungs-on-its-published-surface\n" as *u8)
364 o = shf_cat(b, o, "0\tCONFIG\tuat-sev-min\t5\tproposed-debt-sev-below-global-floor-so-sheriff-debts-gate-scoped-lanes-only\n" as *u8)
365 let cnt: i64 = sts_seed(prefix, b, o)
366 if cnt < 0 { shf_werr("SHERIFF-FAIL seed commit error\n" as *u8); return 1 }
367 let m: *u8 = sys_mmap(64)
368 var mo: i64 = shf_cat(m, 0, "SHERIFF-SEEDED rows=" as *u8)
369 mo = shf_catn(m, mo, cnt)
370 m[mo] = SHF_NL as u8
371 mo = mo + 1
372 sys_write(1, m, mo)
373 return 0
374}
375func main(argc: i64, argv: *i64) -> i64 {
376 if argc < 2 { shf_werr("usage: nx_sheriff {seed [uatprefix] | audit [registry] [journal] [debtprefix] [uatprefix] | page [registry] [journal] [debtprefix] [uatprefix]}\n" as *u8); sys_exit(SHF_EXIT_USAGE); return SHF_EXIT_USAGE }
377 let verb: *u8 = argv[1] as *u8
378 if shf_lit_eq(verb, 0, shf_vlen(verb), "seed" as *u8) == 1 {
379 var up0: *u8 = "knowledge/store/uat-" as *u8
380 if argc > 2 { up0 = argv[2] as *u8 }
381 let rc: i64 = shf_seed(up0)
382 sys_exit(rc)
383 return rc
384 }
385 var mode: i64 = 0 - 1
386 if shf_lit_eq(verb, 0, shf_vlen(verb), "audit" as *u8) == 1 { mode = 0 }
387 if shf_lit_eq(verb, 0, shf_vlen(verb), "page" as *u8) == 1 { mode = 1 }
388 if shf_lit_eq(verb, 0, shf_vlen(verb), "publish" as *u8) == 1 { mode = 2 }
389 if mode < 0 { shf_werr("usage: nx_sheriff {seed [uatprefix] | audit [registry] [journal] [debtprefix] [uatprefix] | page [same] | publish [outpath] [registry] [journal] [debtprefix] [uatprefix]}\n" as *u8); sys_exit(SHF_EXIT_USAGE); return SHF_EXIT_USAGE }
390 var outpath: *u8 = "sites/nishifamily/sheriff.html" as *u8
391 var reg: *u8 = "knowledge/compare/registry" as *u8
392 var jr: *u8 = "knowledge/status/ws_sync.jrnl" as *u8
393 var dp: *u8 = "knowledge/store/debt-" as *u8
394 var up: *u8 = "knowledge/store/uat-" as *u8
395 var ai: i64 = 2
396 if mode == 2 { if argc > 2 { outpath = argv[2] as *u8 } ai = 3 }
397 if argc > ai { reg = argv[ai] as *u8 }
398 if argc > ai + 1 { jr = argv[ai+1] as *u8 }
399 if argc > ai + 2 { dp = argv[ai+2] as *u8 }
400 if argc > ai + 3 { up = argv[ai+3] as *u8 }
401 let floor: i64 = shf_cfg(up, "accept-floor-permille" as *u8, SHF_DEF_FLOOR)
402 let sevmin: i64 = shf_cfg(up, "uat-sev-min" as *u8, SHF_DEF_SEV)
403 // registry (fail-closed: unreadable/empty = exit 1, no verdicts from nothing)
404 let rq: *u8 = sys_mmap(SHF_CAP)
405 let rsz: *i64 = sys_mmap(SHF_SPAN) as *i64
406 let rn: i64 = shf_read(reg, rq, SHF_CAP - 4, rsz)
407 if rn <= 0 { shf_werr("SHERIFF-FAIL registry unreadable or empty (fail-closed, no acceptance from missing evidence)\n" as *u8); sys_exit(1); return 1 }
408 // journal (absent = empty done-claims, declared in envelope)
409 let jq: *u8 = sys_mmap(SHF_CAP)
410 let jsz: *i64 = sys_mmap(SHF_SPAN) as *i64
411 let jn: i64 = shf_read(jr, jq, SHF_CAP - 4, jsz)
412 let dlen: *i64 = sys_mmap(SHF_SPAN) as *i64
413 let dbuf: *u8 = shf_debts_load(dp, dlen)
414 var dn: i64 = dlen[0]
415 if (dbuf as i64) == 0 { dn = 0 }
416 if dn < 0 { dn = 0 }
417 let now: i64 = sys_now_realtime_sec()
418 let out: *u8 = sys_mmap(SHF_CAP)
419 let pd: *u8 = sys_mmap(SHF_CAP)
420 let slug: *u8 = sys_mmap(SHF_WSCAP)
421 let wsb: *u8 = sys_mmap(SHF_WSCAP)
422 let ck: *i64 = sys_mmap(SHF_SPAN) as *i64
423 let ch: *i64 = sys_mmap(SHF_SPAN) as *i64
424 let cs: *i64 = sys_mmap(SHF_SPAN) as *i64
425 let cv: *i64 = sys_mmap(SHF_SPAN) as *i64
426 let cw: *i64 = sys_mmap(SHF_SPAN) as *i64
427 var acc: i64 = 0
428 var accf: i64 = 0
429 var rej: i64 = 0
430 var unsc: i64 = 0
431 var done_ok: i64 = 0
432 var done_bad: i64 = 0
433 var rows_total: i64 = 0
434 var rows_scanned: i64 = 0
435 var pdo: i64 = 0
436 var pdn: i64 = 0
437 var o: i64 = 0
438 if mode == 0 {
439 o = shf_cat(out, o, "{\"epoch\":" as *u8)
440 o = shf_catn(out, o, now)
441 o = shf_cat(out, o, ",\"organ\":\"nx_sheriff\",\"compare\":[" as *u8)
442 } else {
443 o = shf_cat(out, o, "<html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>Nishi Sheriff -- UAT acceptance</title><style>body{background:black;color:gainsboro;font:15px sans-serif;margin:24px;max-width:1080px}h1{color:white}h2{color:silver}table{border-collapse:collapse;width:100%}td,th{border-bottom:1px solid dimgray;padding:5px 9px;text-align:left}th{color:gray}.ok{color:springgreen}.cl{color:gold}.no{color:tomato}.un{color:gray}p.d{color:gray}</style></head><body><main><h1>Nishi Sheriff</h1><p class=d>UAT/acceptance derived from machine evidence only -- the /compare registry, the ws_sync journal, the debt plane. No self-report can pass. epoch " as *u8)
444 o = shf_catn(out, o, now)
445 o = shf_cat(out, o, " · accept floor " as *u8)
446 o = shf_catn(out, o, floor)
447 o = shf_cat(out, o, " permille</p><p class=d><a href='/org' style='color:silver'>/org</a> · <a href='/pm' style='color:silver'>/pm</a> · <a href='/standup' style='color:silver'>/standup</a> · <a href='/compare' style='color:silver'>/compare</a> · <a href='/supervision' style='color:silver'>/supervision</a></p><h2>Compare-domain acceptance</h2><table><tr><th>domain</th><th>kind</th><th>score</th><th>filed rungs</th><th>verdict</th></tr>" as *u8)
448 }
449 var emitted: i64 = 0
450 var i: i64 = 0
451 while i < rn {
452 let le: i64 = shf_le(rq, i, rn)
453 var datarow: i64 = 0
454 if le > i { if rq[i] != (SHF_HASH as u8) { datarow = 1 } }
455 if datarow == 1 {
456 rows_total = rows_total + 1
457 if rows_scanned < SHF_ROWCAP {
458 if shf_colp(rq, i, le, 4, cs) == 1 { if shf_colp(rq, i, le, 1, ck) == 1 { if shf_colp(rq, i, le, 2, ch) == 1 {
459 rows_scanned = rows_scanned + 1
460 let score: i64 = shf_score(rq, cs[0], cs[1])
461 let filed: i64 = shf_filed(rq, cs[0], cs[1])
462 let vd: i64 = shf_verdict(score, filed, floor)
463 if vd == 0 { acc = acc + 1 }
464 if vd == 1 { accf = accf + 1 }
465 if vd == 2 { rej = rej + 1 }
466 if vd == 3 { unsc = unsc + 1 }
467 let sl: i64 = shf_slug(rq, ch[0], ch[1], slug, SHF_WSCAP)
468 if mode == 0 {
469 if emitted > 0 { o = shf_cat(out, o, "," as *u8) }
470 o = shf_cat(out, o, "{\"domain\":\"" as *u8)
471 o = shf_cat(out, o, slug)
472 o = shf_cat(out, o, "\",\"kind\":\"" as *u8)
473 o = shf_cat_esc(out, o, rq, ck[0], ck[1])
474 o = shf_cat(out, o, "\",\"score\":" as *u8)
475 o = shf_catn(out, o, score)
476 o = shf_cat(out, o, ",\"filed\":" as *u8)
477 o = shf_catn(out, o, filed)
478 o = shf_cat(out, o, ",\"verdict\":\"" as *u8)
479 o = shf_cat(out, o, shf_verdict_str(vd))
480 o = shf_cat(out, o, "\"}" as *u8)
481 } else {
482 o = shf_cat(out, o, "<tr><td><a href='/compare/" as *u8)
483 o = shf_cat(out, o, slug)
484 o = shf_cat(out, o, "' style='color:inherit'>" as *u8)
485 o = shf_cat(out, o, slug)
486 o = shf_cat(out, o, "</a></td><td>" as *u8)
487 o = shf_cat_esc_html(out, o, rq, ck[0], ck[1])
488 o = shf_cat(out, o, "</td><td>" as *u8)
489 if score < 0 { o = shf_cat(out, o, "—" as *u8) } else { o = shf_catn(out, o, score) }
490 o = shf_cat(out, o, "</td><td>" as *u8)
491 if filed == 1 { o = shf_cat(out, o, "yes" as *u8) } else { o = shf_cat(out, o, "no" as *u8) }
492 o = shf_cat(out, o, "</td><td>" as *u8)
493 if vd == 0 { o = shf_cat(out, o, "<span class=ok>ACCEPTED</span>" as *u8) }
494 if vd == 1 { o = shf_cat(out, o, "<span class=cl>ACCEPTED-FILED-CLIMB</span>" as *u8) }
495 if vd == 2 { o = shf_cat(out, o, "<span class=no>REJECTED-UNFILED-GAP</span>" as *u8) }
496 if vd == 3 { o = shf_cat(out, o, "<span class=un>UNSCORED</span>" as *u8) }
497 o = shf_cat(out, o, "</td></tr>" as *u8)
498 }
499 emitted = emitted + 1
500 if vd == 2 {
501 // ready-to-file debt row for nx_store_put (the filer carries provenance)
502 if pdn > 0 { pdo = shf_cat(pd, pdo, "," as *u8) }
503 pdo = shf_cat(pd, pdo, "{\"id\":\"SHF-" as *u8)
504 pdo = shf_cat(pd, pdo, slug)
505 pdo = shf_cat(pd, pdo, "\",\"title\":\"sheriff: compare " as *u8)
506 pdo = shf_cat(pd, pdo, slug)
507 pdo = shf_cat(pd, pdo, " score " as *u8)
508 pdo = shf_catn(pd, pdo, score)
509 pdo = shf_cat(pd, pdo, " below floor " as *u8)
510 pdo = shf_catn(pd, pdo, floor)
511 pdo = shf_cat(pd, pdo, " with NO filed rung on the published surface\",\"sev\":" as *u8)
512 pdo = shf_catn(pd, pdo, sevmin)
513 pdo = shf_cat(pd, pdo, ",\"scope\":\"" as *u8)
514 pdo = shf_cat(pd, pdo, slug)
515 pdo = shf_cat(pd, pdo, "\"}" as *u8)
516 pdn = pdn + 1
517 }
518 } } }
519 }
520 }
521 i = le + 1
522 }
523 let rows_dropped: i64 = rows_total - rows_scanned
524 if mode == 0 {
525 o = shf_cat(out, o, "],\"done_claims\":[" as *u8)
526 } else {
527 o = shf_cat(out, o, "</table><h2>DONE-claim acceptance (journal window)</h2><table><tr><th>workstream</th><th>lane-scoped open debts</th><th>verdict</th></tr>" as *u8)
528 }
529 var demitted: i64 = 0
530 var i4: i64 = 0
531 while i4 < jn {
532 let le4: i64 = shf_le(jq, i4, jn)
533 if shf_colt(jq, i4, le4, 1, cv) == 1 { if shf_lit_eq(jq, cv[0], cv[1], "KICKOFF" as *u8) == 1 {
534 if shf_colt(jq, i4, le4, 2, cw) == 1 { if shf_first_kick(jq, i4, cw[0], cw[1]) == 1 {
535 if shf_has(jq, jn, "DONE" as *u8, cw[0], cw[1]) == 1 {
536 var wl: i64 = cw[1] - cw[0]
537 if wl > SHF_WSCAP - 2 { wl = SHF_WSCAP - 2 }
538 var wi: i64 = 0
539 while wi < wl { wsb[wi] = jq[cw[0]+wi]; wi = wi + 1 }
540 wsb[wl] = 0 as u8
541 let kws: i64 = shf_debts_count_ws(dbuf, dn, wsb)
542 if kws == 0 { done_ok = done_ok + 1 } else { done_bad = done_bad + 1 }
543 if mode == 0 {
544 if demitted > 0 { o = shf_cat(out, o, "," as *u8) }
545 o = shf_cat(out, o, "{\"ws\":\"" as *u8)
546 o = shf_cat(out, o, wsb)
547 o = shf_cat(out, o, "\",\"scoped_open_debts\":" as *u8)
548 o = shf_catn(out, o, kws)
549 o = shf_cat(out, o, ",\"verdict\":\"" as *u8)
550 if kws == 0 { o = shf_cat(out, o, "ACCEPTED-DONE" as *u8) } else { if kws < 0 { o = shf_cat(out, o, "REJECTED-DEBT-STORE-UNREADABLE" as *u8) } else { o = shf_cat(out, o, "REJECTED-DONE-OVER-DEBT" as *u8) } }
551 o = shf_cat(out, o, "\"}" as *u8)
552 } else {
553 o = shf_cat(out, o, "<tr><td><b>" as *u8)
554 o = shf_cat(out, o, wsb)
555 o = shf_cat(out, o, "</b></td><td>" as *u8)
556 o = shf_catn(out, o, kws)
557 o = shf_cat(out, o, "</td><td>" as *u8)
558 if kws == 0 { o = shf_cat(out, o, "<span class=ok>ACCEPTED-DONE</span>" as *u8) } else { if kws < 0 { o = shf_cat(out, o, "<span class=no>REJECTED-DEBT-STORE-UNREADABLE</span>" as *u8) } else { o = shf_cat(out, o, "<span class=no>REJECTED-DONE-OVER-DEBT</span>" as *u8) } }
559 o = shf_cat(out, o, "</td></tr>" as *u8)
560 }
561 demitted = demitted + 1
562 }
563 } }
564 } }
565 i4 = le4 + 1
566 }
567 if mode == 0 {
568 o = shf_cat(out, o, "],\"proposed_debts\":[" as *u8)
569 var ci: i64 = 0
570 while ci < pdo { out[o] = pd[ci]; o = o + 1; ci = ci + 1 }
571 o = shf_cat(out, o, "],\"summary\":{\"accepted\":" as *u8)
572 o = shf_catn(out, o, acc)
573 o = shf_cat(out, o, ",\"accepted_filed_climb\":" as *u8)
574 o = shf_catn(out, o, accf)
575 o = shf_cat(out, o, ",\"rejected_unfiled\":" as *u8)
576 o = shf_catn(out, o, rej)
577 o = shf_cat(out, o, ",\"unscored\":" as *u8)
578 o = shf_catn(out, o, unsc)
579 o = shf_cat(out, o, ",\"done_accepted\":" as *u8)
580 o = shf_catn(out, o, done_ok)
581 o = shf_cat(out, o, ",\"done_rejected\":" as *u8)
582 o = shf_catn(out, o, done_bad)
583 o = shf_cat(out, o, "},\"envelope\":{\"registry_bytes\":" as *u8)
584 o = shf_catn(out, o, rsz[0])
585 o = shf_cat(out, o, ",\"registry_window\":" as *u8)
586 o = shf_catn(out, o, rn)
587 o = shf_cat(out, o, ",\"rows_scanned\":" as *u8)
588 o = shf_catn(out, o, rows_scanned)
589 o = shf_cat(out, o, ",\"rows_dropped\":" as *u8)
590 o = shf_catn(out, o, rows_dropped)
591 o = shf_cat(out, o, ",\"row_cap\":" as *u8)
592 o = shf_catn(out, o, SHF_ROWCAP)
593 o = shf_cat(out, o, ",\"journal_bytes\":" as *u8)
594 o = shf_catn(out, o, jsz[0])
595 o = shf_cat(out, o, ",\"window_bytes\":" as *u8)
596 o = shf_catn(out, o, jn)
597 o = shf_cat(out, o, ",\"accept_floor_permille\":" as *u8)
598 o = shf_catn(out, o, floor)
599 o = shf_cat(out, o, ",\"uat_sev_min\":" as *u8)
600 o = shf_catn(out, o, sevmin)
601 o = shf_cat(out, o, ",\"derivation\":\"evidence-only; compare floor + filed-rung law; done-claims scope-match-only; fail-closed\"}}" as *u8)
602 } else {
603 o = shf_cat(out, o, "</table><h2>Summary</h2><p>accepted " as *u8)
604 o = shf_catn(out, o, acc)
605 o = shf_cat(out, o, " · <span class=cl>filed-climb " as *u8)
606 o = shf_catn(out, o, accf)
607 o = shf_cat(out, o, "</span> · <span class=no>rejected-unfiled " as *u8)
608 o = shf_catn(out, o, rej)
609 o = shf_cat(out, o, "</span> · unscored " as *u8)
610 o = shf_catn(out, o, unsc)
611 o = shf_cat(out, o, " · done accepted " as *u8)
612 o = shf_catn(out, o, done_ok)
613 o = shf_cat(out, o, " · <span class=no>done rejected " as *u8)
614 o = shf_catn(out, o, done_bad)
615 o = shf_cat(out, o, "</span></p><p class=d>envelope: registry " as *u8)
616 o = shf_catn(out, o, rsz[0])
617 o = shf_cat(out, o, "B, rows " as *u8)
618 o = shf_catn(out, o, rows_scanned)
619 o = shf_cat(out, o, " scanned / " as *u8)
620 o = shf_catn(out, o, rows_dropped)
621 o = shf_cat(out, o, " dropped (cap " as *u8)
622 o = shf_catn(out, o, SHF_ROWCAP)
623 o = shf_cat(out, o, "); journal " as *u8)
624 o = shf_catn(out, o, jsz[0])
625 o = shf_cat(out, o, "B window " as *u8)
626 o = shf_catn(out, o, jn)
627 o = shf_cat(out, o, "B. A sub-floor domain with filed rungs is lawful climbing; without them it is an unfiled gap (less-than-SOTA is never design). A DONE claim over lane-scoped open debt is work declared complete before its last mile.</p></main></body></html>" as *u8)
628 }
629 out[o] = SHF_NL as u8
630 o = o + 1
631 if mode == 2 {
632 // atomic publish: write <outpath>.new then rename over outpath (never a torn page)
633 let np: *u8 = sys_mmap(SHF_WSCAP + 8)
634 var no: i64 = shf_cat(np, 0, outpath)
635 no = shf_cat(np, no, ".new" as *u8)
636 np[no] = 0 as u8
637 let fd: i64 = sys_openat_wr(np, 420)
638 if fd < 0 { shf_werr("SHERIFF-FAIL publish open failed\n" as *u8); sys_exit(1); return 1 }
639 sys_write(fd, out, o)
640 sys_close(fd)
641 if sys_renameat(np, outpath) != 0 { shf_werr("SHERIFF-FAIL publish rename failed\n" as *u8); sys_exit(1); return 1 }
642 let m2: *u8 = sys_mmap(SHF_WSCAP + 64)
643 var mo2: i64 = shf_cat(m2, 0, "SHERIFF-PUBLISHED bytes=" as *u8)
644 mo2 = shf_catn(m2, mo2, o)
645 mo2 = shf_cat(m2, mo2, " path=" as *u8)
646 mo2 = shf_cat(m2, mo2, outpath)
647 m2[mo2] = SHF_NL as u8
648 mo2 = mo2 + 1
649 sys_write(1, m2, mo2)
650 sys_exit(0)
651 return 0
652 }
653 sys_write(1, out, o)
654 sys_exit(0)
655 return 0
656}