code wiki / (root) / nx_sitesweep_gate.nx
`nx_sitesweep_gate.nx` source

↩ module page · 282 lines · 15995 B
1// nx_sitesweep_gate.nx -- the referee for the site-wide broken-asset sweep.
2//
3// WHAT IT CAN AND CANNOT PROVE, STATED UP FRONT. nx_sitesweep adds exactly TWO pieces of judgement to
4// nx_page_verify: the ref PREFILTER (which pages can be proven ref-free without a fetch) and the RULER
5// VERDICT PARSER (how nx_page_verify's output is read). Everything else about a page is the ruler's
6// judgement, already refereed by nx_page_verify_gate. So this gate bites those two, and it bites them
7// IN PROCESS by importing nx_sitesweep_lib -- the same copy the sweep ships. There is no second
8// implementation for the teeth to agree with.
9//
10// The in-process teeth need no fork and no network, so they run in milliseconds and are safe on the
11// fast gate roster. The END-TO-END cell is a different cost class: it forks the deployed sweep against
12// six live pages and takes minutes. It is therefore OPT-IN (e2e=1) and, when it does not run, the gate
13// SAYS SO IN A NAMED LINE rather than silently counting one fewer tooth. A skipped cell that announces
14// itself is a fact; a skipped cell that does not is a false sense of coverage.
15//
16// FIXTURES. The bite cells read two PERMANENT PUBLISHED negative controls that exist for exactly this
17// purpose -- sites/nishifamily/render3d/negctl_bare.html (unquoted src=, the form the ruler was blind to
18// until 2026-08-25) and negctl_sq.html (single-quoted src=, the form it was blind to until 2026-08-18).
19// They are read ONLY, never written, so this gate shares no scratch with any production beat; the
20// fixture-ratchet law is about a gate WRITING where a beat writes, and there is no write here at all.
21// Synthetic fixtures are built in memory at RUNTIME, byte by byte, so no detector that scans source can
22// mistake a gate fixture for a real occurrence, and no literal newline inside a string is required.
23//
24//   usage: nx_sitesweep_gate [e2e=1]
25// license_tier: ORIGINAL
26import "nx_syscalls.nx"
27import "nx_gate_verdict.nx"
28import "nx_sitesweep_lib.nx"
29import "nx_tool_run.nx"
30
31const SG_NAME:      *u8 = "nx_sitesweep_gate"
32const SG_FIX_BARE:  *u8 = "sites/nishifamily/render3d/negctl_bare.html"
33const SG_FIX_SQ:    *u8 = "sites/nishifamily/render3d/negctl_sq.html"
34const SG_SWEEP_ELF: *u8 = "nx_sitesweep.elf"
35const SG_DOCROOT:   *u8 = "sites/nishifamily"
36const SG_ORIGIN:    *u8 = "https://nishifamily.com"
37
38const SG_BUF:       i64 = 65536
39const SG_E2E_BUF:   i64 = 1048576
40// 300 s: the e2e cell sweeps six live pages and one measured page costs ~5.5 s of TLS plus asset
41// decode (measured 2026-08-25 over 24 live checks in 131 s). 300 s is roughly 9x the expected 33 s, so
42// the bound fires only on a genuine hang.
43const SG_E2E_TMO_MS: i64 = 300000
44const SG_ARGVN:      i64 = 32
45
46// URLs the end-to-end cell discriminates between. All three live in ONE directory and come from ONE
47// generator, so the cell varies the DEFECT and holds everything else fixed.
48const SG_URL_BARE: *u8 = "/render3d/negctl_bare"
49const SG_URL_SQ:   *u8 = "/render3d/negctl_sq"
50const SG_URL_GOOD: *u8 = "/render3d/negctl_noviewport"
51
52func sgw(s: *u8) -> i64 { sys_write(1, s, ss_len(s)); return 0 }
53
54// build a synthetic nx_page_verify tail in buf; returns length. Newlines are CONSTRUCTED, never written
55// as a literal inside a string: this dialect permits a literal newline in a string and that has silently
56// shifted a scanner's mask before.
57func sg_tail(buf: *u8, summary: *u8, verdict: *u8) -> i64 {
  var o: i64 = ss_cat(buf, 0, "page status=200 bytes=4096" as *u8)
  buf[o] = SS_CH_NL as u8; o = o + 1
  if summary[0] != (0 as u8) {
      o = ss_cat(buf, o, summary)
      buf[o] = SS_CH_NL as u8; o = o + 1
  }
  o = ss_cat(buf, o, verdict)
  buf[o] = SS_CH_NL as u8; o = o + 1
  return o
67}
68
69func main(argc: i64, argv: *i64) -> i64 {
  var e2e: i64 = 0
  var ai: i64 = 1
  while ai < argc {
      let a: *u8 = argv[ai] as *u8
      let eo: i64 = ss_pfx(a, "e2e=" as *u8)
      if eo >= 0 { e2e = ss_int_at(a, ss_len(a), eo) }
      ai = ai + 1
  }
  gv_head("=== nx_sitesweep_gate -- referee for the site-wide broken-asset sweep ===" as *u8)
  let ctr: *i64 = gv_ctr()
  let outv: *i64 = sys_mmap(SS_WORD * SS_V_N) as *i64
  let buf: *u8 = sys_mmap(SG_BUF)
  let url: *u8 = sys_mmap(SG_BUF)
  let dl: i64 = ss_len(SG_DOCROOT)
84
  // ---- SUBJECTS: bind every aggregate below to a NON-ZERO denominator of REAL published bytes. ----
  let lp: *i64 = sys_mmap(SS_WORD * 2) as *i64
  let bare: *u8 = sys_read_file(SG_FIX_BARE, lp)
  var bare_n: i64 = 0
  if (bare as i64) != 0 { bare_n = lp[0] }
  let lp2: *i64 = sys_mmap(SS_WORD * 2) as *i64
  let sq: *u8 = sys_read_file(SG_FIX_SQ, lp2)
  var sq_n: i64 = 0
  if (sq as i64) != 0 { sq_n = lp2[0] }
  var nfix: i64 = 0
  if bare_n > 0 { nfix = nfix + 1 }
  if sq_n > 0 { nfix = nfix + 1 }
  sgw("  fixture bytes: negctl_bare=" as *u8); gv_num(bare_n)
  sgw(" negctl_sq=" as *u8); gv_num(sq_n); sgw("\n" as *u8)
  let have_fix: i64 = gv_subjects("published-negative-control-fixtures-readable" as *u8, nfix, ctr)
100
  // ---- THE PREFILTER: bite it against the two attribute forms the ruler was once blind to. --------
  // A ref-free control is built in memory so the good side is fully determined.
  var gn: i64 = ss_cat(buf, 0, "<html lang=en><head><title>t</title></head><body><h1>x</h1>" as *u8)
  gn = ss_cat(buf, gn, "<p>no assets here at all</p></body></html>" as *u8)
  let good_free: i64 = ss_may_have_refs(buf, gn)
106
  if have_fix == 1 {
      var bad_bare: i64 = 0
      if bare_n > 0 { bad_bare = ss_may_have_refs(bare, bare_n) }
      gv_bite("prefilter-sees-the-UNQUOTED-src-fixture-and-not-a-ref-free-page" as *u8, bad_bare, good_free, ctr)
      var bad_sq: i64 = 0
      if sq_n > 0 { bad_sq = ss_may_have_refs(sq, sq_n) }
      gv_bite("prefilter-sees-the-SINGLE-QUOTED-src-fixture-and-not-a-ref-free-page" as *u8, bad_sq, good_free, ctr)
  }
115
  // The prefilter must key on the ruler's actual trigger TOKEN, not on the word. A page whose only
  // "src" is inside another attribute name has no ref for the ruler to find, and treating it as one
  // would quietly convert a proof into a guess in the direction of extra network load.
  var dn: i64 = ss_cat(buf, 0, "<html><body><img data-source=x.png alt=a></body></html>" as *u8)
  gv_check("neg-control-prefilter-must-not-fire-on-data-source-attribute" as *u8, 1 - ss_may_have_refs(buf, dn), ctr)
  // ...and it MUST fire on a stylesheet link, the ruler's other trigger.
  var kn: i64 = ss_cat(buf, 0, "<html><head><link rel=stylesheet href=/s.css></head></html>" as *u8)
  gv_check("prefilter-fires-on-a-link-tag-the-rulers-other-trigger" as *u8, ss_may_have_refs(buf, kn), ctr)
124
  // ---- THE VERDICT PARSER: both signals present, so the cell proves DISCRIMINATION, not detection --
  let tail: *u8 = sys_mmap(SG_BUF)
  let tn_red: i64 = sg_tail(tail, "checked=16 skipped=0 law-violations=15 broken=15" as *u8, "VERDICT=RED broken=15" as *u8)
  let c_red: i64 = ss_parse_ruler(tail, tn_red, 0, outv)
  let red_broken: i64 = outv[SS_V_BROKEN]
  let red_law: i64 = outv[SS_V_LAW]
  let red_checked: i64 = outv[SS_V_CHECKED]
132
  let tail2: *u8 = sys_mmap(SG_BUF)
  let tn_grn: i64 = sg_tail(tail2, "checked=16 skipped=0 law-violations=0 broken=0" as *u8, "VERDICT=GREEN (every referenced asset fetches AND decodes)" as *u8)
  let c_grn: i64 = ss_parse_ruler(tail2, tn_grn, 0, outv)
136
  var f_red: i64 = 0
  if c_red == SS_C_BROKEN { f_red = 1 }
  var f_grn: i64 = 0
  if c_grn == SS_C_BROKEN { f_grn = 1 }
  gv_bite("verdict-parser-fires-on-RED-and-is-silent-on-GREEN" as *u8, f_red, f_grn, ctr)
142
  sgw("  parsed RED: broken=" as *u8); gv_num(red_broken)
  sgw(" law=" as *u8); gv_num(red_law)
  sgw(" checked=" as *u8); gv_num(red_checked); sgw("\n" as *u8)
  var nums_ok: i64 = 0
  if red_broken == 15 { if red_law == 15 { if red_checked == 16 { nums_ok = 1 } } }
  gv_check("parser-carries-the-rulers-own-numbers-not-just-its-word" as *u8, nums_ok, ctr)
149
  // A RED with NO asset-summary line means the ruler exited before it ever looked at an asset: the
  // PAGE did not serve. Folding that into the broken-image count sends the next reader to fix the
  // wrong thing. Both cases are asserted TOGETHER so the tooth proves the split, not one half of it.
  let tail3: *u8 = sys_mmap(SG_BUF)
  let tn_pr: i64 = sg_tail(tail3, "" as *u8, "VERDICT=RED (page not 200)" as *u8)
  let c_pr: i64 = ss_parse_ruler(tail3, tn_pr, 0, outv)
  var split_ok: i64 = 0
  if c_pr == SS_C_PAGERED { if c_red == SS_C_BROKEN { split_ok = 1 } }
  gv_check("parser-splits-PAGE-RED-from-BROKEN-both-signals-present" as *u8, split_ok, ctr)
159
  // GREEN-PARTIAL must never be read as GREEN: the ruler emits it precisely when its own coverage is
  // UNPROVEN, and a prefix match on the shorter word would launder that into a clean pass.
  let tail4: *u8 = sys_mmap(SG_BUF)
  let tn_gp: i64 = sg_tail(tail4, "checked=1 skipped=0 law-violations=0 broken=0" as *u8, "VERDICT=GREEN-PARTIAL (examined assets fetch AND decode; 15 img ref(s) unread)" as *u8)
  let c_gp: i64 = ss_parse_ruler(tail4, tn_gp, 0, outv)
  var gp_ok: i64 = 0
  if c_gp == SS_C_PARTIAL { gp_ok = 1 }
  gv_check("green-partial-is-its-own-class-never-folded-into-green" as *u8, gp_ok, ctr)
168
  // THE THIRD STATE, twice. A vantage failure and a destroyed capture are both "I could not look",
  // and neither may be spelled RED. The cut case reuses the REAL RED bytes, so the only thing that
  // changes is the truncation flag -- if the parser ignored it, this tooth reads BROKEN and fails.
  let tail5: *u8 = sys_mmap(SG_BUF)
  let tn_uo: i64 = sg_tail(tail5, "" as *u8, "VERDICT=UNOBSERVABLE vantage=pinned:127.0.0.1:8443 reason=no-connection(connect)" as *u8)
  let c_uo: i64 = ss_parse_ruler(tail5, tn_uo, 0, outv)
  var uo_ok: i64 = 0
  if c_uo == SS_C_UNOBSERVABLE { uo_ok = 1 }
  gv_check("unobservable-stays-unobservable-never-red" as *u8, uo_ok, ctr)
178
  let c_cut: i64 = ss_parse_ruler(tail, tn_red, 1, outv)
  var cut_ok: i64 = 0
  if c_cut == SS_C_UNREADABLE { cut_ok = 1 }
  gv_check("neg-control-a-CUT-capture-reads-UNREADABLE-not-BROKEN" as *u8, cut_ok, ctr)
183
  // An empty capture is a fork that produced nothing, not a clean page.
  let c_empty: i64 = ss_parse_ruler(tail, 0, 0, outv)
  var emp_ok: i64 = 0
  if c_empty == SS_C_UNREADABLE { emp_ok = 1 }
  gv_check("neg-control-an-EMPTY-capture-reads-UNREADABLE-not-GREEN" as *u8, emp_ok, ctr)
189
  // POSITIONAL ANCHORING. The ruler quotes verdict words in its own prose, so the answer is the LAST
  // occurrence and only the last. This fixture puts a GREEN ahead of the real RED: a first-match or
  // unanchored parser reads GREEN and the whole sweep silently acquits every broken page.
  let tail6: *u8 = sys_mmap(SG_BUF)
  var t6: i64 = ss_cat(tail6, 0, "note: a page that passes prints VERDICT=GREEN here" as *u8)
  tail6[t6] = SS_CH_NL as u8; t6 = t6 + 1
  t6 = ss_cat(tail6, t6, "checked=3 skipped=0 law-violations=2 broken=2" as *u8)
  tail6[t6] = SS_CH_NL as u8; t6 = t6 + 1
  t6 = ss_cat(tail6, t6, "VERDICT=RED broken=2" as *u8)
  tail6[t6] = SS_CH_NL as u8; t6 = t6 + 1
  let c_anch: i64 = ss_parse_ruler(tail6, t6, 0, outv)
  var anch_ok: i64 = 0
  if c_anch == SS_C_BROKEN { anch_ok = 1 }
  gv_check("verdict-read-from-the-LAST-occurrence-not-the-first" as *u8, anch_ok, ctr)
204
  // ---- THE PATH -> URL MAP. These three cases are the whole contract. -----------------------------
  ss_url_of(SG_ORIGIN, dl, "sites/nishifamily/world/foundation.html" as *u8, url)
  var u1: i64 = 0
  if ss_tok_eq(url, ss_len(url), 0, "https://nishifamily.com/world/foundation" as *u8) == 1 { u1 = 1 }
  sgw("  url(world/foundation.html) = " as *u8); sgw(url); sgw("\n" as *u8)
  gv_check("url-map-drops-the-html-extension" as *u8, u1, ctr)
211
  ss_url_of(SG_ORIGIN, dl, "sites/nishifamily/world/index.html" as *u8, url)
  var u2: i64 = 0
  if ss_tok_eq(url, ss_len(url), 0, "https://nishifamily.com/world" as *u8) == 1 { u2 = 1 }
  sgw("  url(world/index.html) = " as *u8); sgw(url); sgw("\n" as *u8)
  gv_check("url-map-collapses-index-to-its-own-directory" as *u8, u2, ctr)
217
  ss_url_of(SG_ORIGIN, dl, "sites/nishifamily/index.html" as *u8, url)
  var u3: i64 = 0
  if ss_tok_eq(url, ss_len(url), 0, "https://nishifamily.com/" as *u8) == 1 { u3 = 1 }
  sgw("  url(index.html) = " as *u8); sgw(url); sgw("\n" as *u8)
  gv_check("url-map-root-index-is-the-site-root" as *u8, u3, ctr)
223
  // ---- CLASS NAMES ROUND-TRIP. The ledger is rewritten every run and re-read the next run, so a
  // name that does not survive the round trip silently resets a page to UNCHECKED and the coverage
  // number quietly falls without anything reporting a fault.
  var c: i64 = 0
  var rt_ok: i64 = 1
  var rt_n: i64 = 0
  while c < SS_C_N {
      if ss_class_of_name(ss_class_name(c)) != c { rt_ok = 0 }
      rt_n = rt_n + 1
      c = c + 1
  }
  sgw("  class round-trip checked=" as *u8); gv_num(rt_n); sgw("\n" as *u8)
  var rt_pop: i64 = 0
  if rt_n == SS_C_N { rt_pop = 1 }
  gv_check("class-roundtrip-covers-EVERY-declared-class" as *u8, rt_pop, ctr)
  gv_check("every-class-name-round-trips-through-the-ledger-spelling" as *u8, rt_ok, ctr)
240
  // ---- THE END-TO-END CELL --------------------------------------------------------------------
  if e2e == 1 {
      let eb: *u8 = sys_mmap(SG_E2E_BUF)
      let av: *i64 = sys_mmap(SG_ARGVN) as *i64
      av[0] = SG_SWEEP_ELF as i64
      av[1] = "root=render3d" as *u8 as i64
      av[2] = 0
      let elp: *i64 = sys_mmap(SS_WORD * 2) as *i64
      let etr: *i64 = sys_mmap(SS_WORD * 2) as *i64
      etr[0] = 0
      elp[0] = 0
      tr_run_capture_tr(SG_SWEEP_ELF, av, eb, SG_E2E_BUF, elp, SG_E2E_TMO_MS, etr)
      let en: i64 = elp[0]
      sgw("  e2e capture bytes=" as *u8); gv_num(en)
      sgw(" cut=" as *u8); gv_num(etr[0]); sgw("\n" as *u8)
      var ran: i64 = 0
      if en > 0 { if etr[0] == 0 { ran = 1 } }
      if gv_need("e2e-sweep-produced-a-readable-capture" as *u8, ran, ctr) == 1 {
          var e_bare: i64 = ss_contains(eb, en, SG_URL_BARE)
          var e_sq: i64 = ss_contains(eb, en, SG_URL_SQ)
          var e_good: i64 = ss_contains(eb, en, SG_URL_GOOD)
          var e_bad: i64 = 0
          if e_bare == 1 { if e_sq == 1 { e_bad = 1 } }
          sgw("  e2e worklist: bare=" as *u8); gv_num(e_bare)
          sgw(" sq=" as *u8); gv_num(e_sq)
          sgw(" good=" as *u8); gv_num(e_good); sgw("\n" as *u8)
          // Both fixtures named AND the asset-clean sibling absent, from ONE run over ONE directory
          // produced by ONE generator: the only thing that varies between them is the defect.
          gv_bite("e2e-sweep-names-both-published-fixtures-and-not-their-clean-sibling" as *u8, e_bad, e_good, ctr)
          gv_check("e2e-verdict-line-is-present-and-last" as *u8, ss_contains(eb, en, "verdict=RED" as *u8), ctr)
      }
  } else {
      // A NAMED ABSENCE, NOT A PASS. The cell simply does not run, the denominator is smaller, and the
      // reader is told which proof is missing and exactly how to obtain it.
      sgw("  E2E-CELL: NOT EXERCISED THIS RUN -- the end-to-end bite forks the deployed sweep against\n" as *u8)
      sgw("    six live pages (~35 s) and is opt-in so this gate stays safe on the fast roster.\n" as *u8)
      sgw("    Run `nx_sitesweep_gate e2e=1` to exercise it. The tooth count below is SMALLER by 3\n" as *u8)
      sgw("    because those teeth did not run -- it is not that they passed.\n" as *u8)
  }
280
  return gv_verdict(SG_NAME, ctr, "prefilter and verdict-parser bitten against the PUBLISHED unquoted and single-quoted negative controls; third state proven for cut, empty and unobservable captures" as *u8)
282}
nx_sitesweep_gate.nx source

`nx_sitesweep_gate.nx` source
