nx_shipjoin_gate.nx source

1// nx_shipjoin_gate.nx -- THE REFEREE for nx_dora `shipjoin` (DM6, devmgmt rung). 2// END-TO-END: forks the DEPLOYED nx_dora elf, so it grades the artifact callers run. 3// 4// The accept rule, verbatim from devmgmt.plan: "deploy-frequency and lead-time computed from 5// organ_ship.jrnl match a hand count over one week of journal." A hand count is only possible if 6// every joined row is PUBLISHED, so the first thing this gate asserts is that the per-row worklist 7// exists at all -- an average with no rows behind it cannot be checked by anybody. 8// 9// The fixture is built to break the three joins that would each produce a confident wrong number: 10// * INTERLEAVING -- another target is BUILT between alpha's build and alpha's ship, so a join that 11// takes "the previous BUILD row" instead of "the previous BUILD row FOR THIS TARGET" reports 12// lead=15 where the truth is 20. Both numbers look plausible; only the fixture separates them. 13// * AN UNMATCHED SHIP -- a SHIPPED with no BUILD for its target. Averaging over a set you cannot 14// reconstruct is how a lead time stops being auditable, so it must land in its own bucket. 15// * A REFUSAL COUNTED AS A FAILURE -- a refused ship never reached production. Naming it a 16// change-failure inverts the sign of the one metric an operator reads as bad news. 17// Plus a row before the window (must not be counted), and a malformed row (must be COUNTED as 18// unparsed, never silently dropped -- a parser that discards in silence reports a smaller, cleaner, 19// wrong population). 20// 21// The window anchor is asserted explicitly: window_end must equal the FIXTURE'S newest epoch, which 22// is years away from wall clock, so a gate that passed on a clock-anchored implementation could not. 23// Fixtures live under /tmp/nx_shipjoin_gate/ and are rewritten O_TRUNC each run (idempotent). 24// license_tier: ORIGINAL Read-only outside /tmp. No hw writes (Rule 26). 25import "nx_syscalls.nx" 26import "nx_sovjson_lib.nx" 27import "nx_gate_verdict.nx" 28import "nx_tool_run.nx" 29 30const SG_MODE_644: i64 = 420 31const SG_MODE_755: i64 = 493 32const SG_PATH: i64 = 512 33const SG_FIX: i64 = 65536 34const SG_OUT: i64 = 1048576 35const SG_EXIT_SKIP: i64 = 3 36const SG_RC_REFUSE: i64 = 3 37 38func sg_wr(path: *u8, buf: *u8, n: i64) -> i64 { 39 let fd: i64 = sys_openat_wr(path, SG_MODE_644) 40 if fd < 0 { return 0 - 1 } 41 sys_write(fd, buf, n) 42 sys_close(fd) 43 return n 44} 45func sg_run(subj: *u8, a1: *u8, a2: *u8, a3: *u8, out: *u8, cl: *i64) -> i64 { 46 let av: *i64 = sys_mmap(64) as *i64 47 av[0] = subj as i64 48 av[1] = a1 as i64 49 av[2] = a2 as i64 50 av[3] = a3 as i64 51 av[4] = 0 52 return tr_run_capture(subj, av, out, SG_OUT - 8, cl) 53} 54 55func main(argc: i64, argv: *i64) -> i64 { 56 let ctr: *i64 = gv_ctr() 57 gv_head("nx_shipjoin_gate -- a ship joins to ITS OWN build, and a refusal is not a failure" as *u8) 58 59 let subj: *u8 = sys_mmap(SG_PATH) 60 var have: i64 = 0 61 if argc >= 2 { var z: i64 = sj_cat(subj, 0, argv[1] as *u8); subj[z] = 0 as u8; have = 1 } 62 if have == 0 { if sj_allow_path("nx_dora" as *u8, subj) == 1 { have = 1 } } 63 if have == 0 { var z2: i64 = sj_cat(subj, 0, "./nx_dora.elf" as *u8); subj[z2] = 0 as u8; have = 1 } 64 65 let root: *u8 = "/tmp/nx_shipjoin_gate" as *u8 66 let fj: *u8 = "/tmp/nx_shipjoin_gate/ship.jrnl" as *u8 67 let fempty: *u8 = "/tmp/nx_shipjoin_gate/no_parseable_rows.jrnl" as *u8 68 let fabs: *u8 = "/tmp/nx_shipjoin_gate/absent.jrnl" as *u8 69 let d7: *u8 = "7" as *u8 70 sys_mkdir(root, SG_MODE_755) 71 72 let b: *u8 = sys_mmap(SG_FIX) 73 var o: i64 = 0 74 // BEFORE the 7-day window: a complete build+ship pair that must contribute NOTHING 75 o = sj_cat(b, o, "1786100000\told\tBUILD\tBUILT\tshaOLD\n" as *u8) 76 o = sj_cat(b, o, "1786100010\told\tSHIPPED\tGREEN\tshaOLD\n" as *u8) 77 // alpha builds; beta builds BETWEEN alpha's build and alpha's ship (the interleaving trap) 78 o = sj_cat(b, o, "1786999000\talpha\tBUILD\tBUILT\tshaA\n" as *u8) 79 o = sj_cat(b, o, "1786999005\tbeta\tBUILD\tBUILT\tshaB\n" as *u8) 80 o = sj_cat(b, o, "1786999010\talpha\tPROVE\tRED\t./gate.elf\n" as *u8) 81 o = sj_cat(b, o, "1786999020\talpha\tSHIPPED\tGREEN\tshaA\n" as *u8) 82 // a ship whose target never built here -- UNMATCHED, its own bucket 83 o = sj_cat(b, o, "1786999030\tgamma\tSHIPPED\tGREEN\tshaG\n" as *u8) 84 o = sj_cat(b, o, "1786999040\tbeta\tADOPT\tREFUSED-OR-MISSING\t\n" as *u8) 85 o = sj_cat(b, o, "1786999050\tbeta\tSHIPPED\tGREEN\tshaB\n" as *u8) 86 // malformed: no tabs, no epoch. Must be COUNTED as unparsed, never silently dropped. 87 o = sj_cat(b, o, "notarow-without-tabs-or-an-epoch\n" as *u8) 88 let w1: i64 = sg_wr(fj, b, o) 89 o = 0 90 o = sj_cat(b, o, "# only a comment and a malformed line, so there is nothing to report on\n" as *u8) 91 o = sj_cat(b, o, "still-not-a-row\n" as *u8) 92 let w2: i64 = sg_wr(fempty, b, o) 93 sys_unlinkat(fabs) 94 95 var fixok: i64 = 0 96 if w1 > 0 { if w2 > 0 { fixok = 1 } } 97 gv_check("fixture-written-both (assert the fixture reached the condition before the outcome)" as *u8, fixok, ctr) 98 99 let out: *u8 = sys_mmap(SG_OUT) 100 let cl: *i64 = sys_mmap(16) as *i64 101 let rc: i64 = sg_run(subj, "shipjoin" as *u8, fj, d7, out, cl) 102 let n: i64 = cl[0] 103 if n <= 0 { 104 gv_puts("SKIP subject produced no output -- build/deploy nx_dora, then re-run: " as *u8) 105 gv_puts(subj) 106 gv_puts("\n" as *u8) 107 sys_exit(SG_EXIT_SKIP) 108 return SG_EXIT_SKIP 109 } 110 gv_check("subject-ran-and-exited-zero-on-a-joinable-journal" as *u8, 1 - rc, ctr) 111 gv_check("subject-examined-a-nonzero-population-of-rows" as *u8, tr_contains(out, n, "rows_parsed=9" as *u8), ctr) 112 gv_check("a-malformed-row-is-COUNTED-as-unparsed-not-silently-dropped" as *u8, tr_contains(out, n, "rows_unparsed=1" as *u8), ctr) 113 114 // ---- the anti-vacuity tooth: the per-row worklist WITHOUT which no hand count is possible ---- 115 gv_check("ACCEPT-anti-vacuity-every-joined-row-is-PUBLISHED-so-a-hand-count-can-exist" as *u8, tr_contains(out, n, "SHIP alpha shipped=1786999020 build=1786999000 lead_s=20" as *u8), ctr) 116 var interleave: i64 = 1 117 if tr_contains(out, n, "lead_s=15" as *u8) == 1 { interleave = 0 } 118 gv_check("neg-control-a-BUILD-of-ANOTHER-target-in-between-is-not-the-origin" as *u8, interleave, ctr) 119 gv_check("beta-joins-across-the-interleave-to-its-own-earlier-build" as *u8, tr_contains(out, n, "SHIP beta shipped=1786999050 build=1786999005 lead_s=45" as *u8), ctr) 120 gv_check("an-unmatched-ship-is-NAMED-and-excluded-from-the-statistics" as *u8, tr_contains(out, n, "SHIP gamma shipped=1786999030 build=NONE lead_s=UNMATCHED" as *u8), ctr) 121 122 // ---- window: deterministic anchor, and the pre-window pair contributes nothing ---- 123 gv_check("window-is-anchored-on-the-JOURNAL-newest-row-not-on-wall-clock" as *u8, tr_contains(out, n, "window_end=1786999050 window_start=1786394250 first_row_in_window=1786999000 span_s=50" as *u8), ctr) 124 var oldout: i64 = 1 125 if tr_contains(out, n, "SHIP old " as *u8) == 1 { oldout = 0 } 126 gv_check("neg-control-a-ship-before-the-window-appears-in-no-row-and-no-count" as *u8, oldout, ctr) 127 128 // ---- the accept rule numbers themselves ---- 129 gv_check("ACCEPT-deploy-frequency-is-exactly-3-ships-2-builds-and-the-rate-is-derived" as *u8, tr_contains(out, n, "# DEPLOY ships=3 builds=2 per_week_x100=3628800 band=" as *u8), ctr) 130 gv_check("ACCEPT-lead-time-mean-min-max-are-exact-over-the-matched-set-only" as *u8, tr_contains(out, n, "matched=2 unmatched=1 sum=3 sum_ok=1 mean_s=32 min_s=20 max_s=45 mean_h=0 band=" as *u8), ctr) 131 gv_check("the-matched-unmatched-partition-prints-its-sum-and-it-reconciles" as *u8, tr_contains(out, n, "sum=3 sum_ok=1" as *u8), ctr) 132 gv_check("the-shared-DORA-band-ruler-is-COMPOSED-not-re-implemented" as *u8, tr_contains(out, n, "band=ELITE" as *u8), ctr) 133 gv_check("the-final-line-carries-the-whole-run-verdict" as *u8, tr_contains(out, n, "SHIPJOIN ships=3 matched=2 per_week_x100=3628800 sum_ok=1" as *u8), ctr) 134 135 // ---- the sign-inversion control: refusals counted, and explicitly NOT called change-failures ---- 136 gv_check("ship-refusals-are-counted-separately-at-exactly-2" as *u8, tr_contains(out, n, "# SHIP-REFUSALS n=2" as *u8), ctr) 137 gv_check("neg-control-the-refusal-count-DISCLAIMS-being-the-DORA-change-failure-rate" as *u8, tr_contains(out, n, "NOT the DORA change-failure rate" as *u8), ctr) 138 139 // ---- fail-closed ---- 140 let rc2: i64 = sg_run(subj, "shipjoin" as *u8, fabs, d7, out, cl) 141 var r1: i64 = 0 142 if rc2 == SG_RC_REFUSE { if tr_contains(out, cl[0], "REFUSED ship journal unreadable" as *u8) == 1 { r1 = 1 } } 143 gv_check("neg-control-an-unreadable-journal-REFUSES-rather-than-reporting-zero-deploys" as *u8, r1, ctr) 144 let rc3: i64 = sg_run(subj, "shipjoin" as *u8, fempty, d7, out, cl) 145 var r2: i64 = 0 146 if rc3 == SG_RC_REFUSE { if tr_contains(out, cl[0], "a zero-subject run cannot report a deploy rate" as *u8) == 1 { r2 = 1 } } 147 gv_check("neg-control-a-journal-with-no-parseable-rows-REFUSES-rather-than-acquitting" as *u8, r2, ctr) 148 149 // ---- idempotence ---- 150 let rc4: i64 = sg_run(subj, "shipjoin" as *u8, fj, d7, out, cl) 151 var idem: i64 = 0 152 if rc4 == 0 { if tr_contains(out, cl[0], "SHIPJOIN ships=3 matched=2 per_week_x100=3628800 sum_ok=1" as *u8) == 1 { idem = 1 } } 153 gv_check("idempotent-a-second-run-on-the-same-fixture-grades-identically" as *u8, idem, ctr) 154 155 let v: i64 = gv_verdict("SHIPJOIN-GATE" as *u8, ctr, "the join is per-target, the window is journal-anchored, the unmatched set is named rather than averaged, and a refusal is never reported as a production failure" as *u8) 156 sys_exit(v) 157 return v 158}