code wiki / _hdl_build / nx_sota_status.nx
`nx_sota_status.nx` source

↩ module page · 614 lines · 34774 B
1// nx_sota_status.nx -- THE HONESTY GATE, cross-domain (operator 2026-07-16: "an evidence repository ... that
2// can clearly tell us where we are as far as compare gaps ... where there is debt ... where there are unique
3// capabilities and where we stand as far as state of the art"). Reads EVERY knowledge/compare/<d>.matrix (the
4// real, liar-killed evidence) + checks whether each domain has EXECUTABLE evidence (<d>.gates) vs claim-only,
5// and emits ONE fresh status: per-domain SOTA standing, the UNIQUE moat (nishiExceed rows), the frontier GAPS
6// (_ABSENT_ rows), and -- the meta-honesty number -- the EVIDENCE-BACKING ratio (executable-proven / total).
7// Fresh by construction: computed live at run time (spin it up = current truth). Stamps sys_now_realtime.
8// Usage: nx_sota_status   (CWD = nxc2 root)   license_tier: ORIGINAL  expect_exit:0
9import "nx_syscalls.nx"
10import "nx_estate_path.nx"   // ep_anchor: the CWD must not decide this organ's verdict
11import "nx_evidence_verdict.nx"
12import "nx_evattest.nx"
13
14const SS_MAXD: i64 = 128
15
16// Policy defaults. These are the LAST resort in the configuration hierarchy (rule 17): the conf file
17// knowledge/evidence_policy.conf overrides them. They are not thresholds invented at a call site -- they
18// are named, single-sourced, and read by every consumer of the law.
19const SS_DEF_TTL_SEC:     i64 = 604800
20const SS_DEF_MIN_CLASSES: i64 = 2
21const SS_DEF_REQ_HUMAN:   i64 = 1
22
23func sw(s: *u8) -> i64 { var n:i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
24func sn(v: i64) -> i64 { let b:*u8=sys_mmap(24); var m:i64=v; if m<0{sys_write(1,"-" as *u8,1);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var j:i64=0; while j<k{b[j]=t[k-1-j];j=j+1} sys_write(1,b,k); return 0 }
25func swn(base: *u8, off: i64, len: i64) -> i64 { sys_write(1, ((base as i64)+off) as *u8, len); return 0 }
26func ss_wf(fd: i64, s: *u8) -> i64 { var n:i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
27func ss_wnf(fd: i64, v: i64) -> i64 { let t:*u8=sys_mmap(28); var m:i64=v; var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} let b:*u8=sys_mmap(28); var i:i64=0; while i<k{b[i]=t[k-1-i];i=i+1} sys_write(fd,b,k); return 0 }
28
29// name ends with ".matrix"? (name null-terminated)
30func ends_matrix(name: *u8) -> i64 {
  var n: i64 = 0
  while name[n] != (0 as u8) { n = n + 1 }
  if n < 7 { return 0 }
  let suf: *u8 = ".matrix\x00" as *u8
  var i: i64 = 0
  while i < 7 { if name[n-7+i] != suf[i] { return 0 } i = i + 1 }
  return 1
38}
39// classify a matrix row buf[s..e): -1 skip, 0 gap(_ABSENT_), 1 present, 2 exceed(nishiExceed==1)
40func classify(buf: *u8, s: i64, e: i64) -> i64 {
  if s >= e { return 0 - 1 }
  let f: i64 = buf[s] as i64
  if f == 35 { return 0 - 1 }   // '#'
  if f == 64 { return 0 - 1 }   // '@'
  if f == 10 { return 0 - 1 }   // blank
  // find first 4 '|'
  var p1: i64 = 0 - 1
  var p2: i64 = 0 - 1
  var p3: i64 = 0 - 1
  var p4: i64 = 0 - 1
  var i: i64 = s
  while i < e {
      if buf[i] == (124 as u8) {
          if p1 < 0 { p1 = i } else { if p2 < 0 { p2 = i } else { if p3 < 0 { p3 = i } else { if p4 < 0 { p4 = i; i = e } } } }
      }
      i = i + 1
  }
  if p3 < 0 { return 0 - 1 }
  // field2 = (p2, p3): check "_ABSENT_"
  let f2s: i64 = p2 + 1
  let f2l: i64 = p3 - f2s
  if f2l == 8 {
      let ab: *u8 = "_ABSENT_\x00" as *u8
      var m: i64 = 1
      var k: i64 = 0
      while k < 8 { if buf[f2s+k] != ab[k] { m = 0; k = 8 } else { k = k + 1 } }
      if m == 1 { return 0 }
  }
  // field3 = (p3, p4): first char '1' => exceed
  if buf[p3+1] == (49 as u8) { return 2 }
  return 1
72}
73func file_exists(path: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd >= 0 { sys_close(fd); return 1 }
  return 0
77}
78// substring search
79func ss_has(buf: *u8, n: i64, needle: *u8, nl: i64) -> i64 {
  if nl <= 0 { return 0 }
  var i: i64 = 0
  while i <= n - nl {
      var j: i64 = 0
      var m: i64 = 1
      while j < nl { if buf[i+j] != needle[j] { m = 0; j = nl } else { j = j + 1 } }
      if m == 1 { return 1 }
      i = i + 1
  }
  return 0
90}
91// DEEP VERDICT: fork nx_swcompare_evidence <domain>, capture, return 1=MEASURED-HONEST, 0=RED, -1=no evidence elf.
92// This makes "evidence-backed" UNFAKEABLE: a .gates file is not enough -- the gate must EXECUTE green AND every
93// claimed axis must ground in real source (nx_swcompare_evidence's own liar-kill). Fresh: re-run every call.
94// STAMP-CACHE read: nx_swcompare_evidence writes knowledge/status/evstamp_<domain>.verdict {ok epoch grounded gates}
95// each real run. We READ it (fast) -> the deep verdict WITHOUT the 235s recompute. Returns 1=PROVEN, 0=RED,
96// -1=no stamp (gated but never verified). Writes the stamp epoch to *ep_out for freshness display.
97func ss_parse_num_after(buf: *u8, n: i64, key: *u8, kl: i64) -> i64 {
  var i: i64 = 0
  while i <= n - kl {
      var j: i64 = 0
      var m: i64 = 1
      while j < kl { if buf[i+j] != key[j] { m = 0; j = kl } else { j = j + 1 } }
      if m == 1 {
          var p: i64 = i + kl
          var v: i64 = 0
          var got: i64 = 0
          while p < n { let c: i64 = buf[p] as i64; if c >= 48 { if c <= 57 { v = v*10 + (c-48); got = 1; p = p + 1 } else { p = n } } else { p = n } }
          if got == 1 { return v }
          return 0 - 2
      }
      i = i + 1
  }
  return 0 - 2
114}
115// Length of the whitespace-delimited token following `key`, or 0 if the key is absent. Used for the v2
116// provenance fields, where what matters is not a number but whether the stamp NAMED anything at all.
117// A literal "ABSENT" token counts as absent -- the writer emits it when a partial digest would otherwise
118// look like proof.
119func ss_parse_tok_len(buf: *u8, n: i64, key: *u8, kl: i64) -> i64 {
  var i: i64 = 0
  while i <= n - kl {
      var j: i64 = 0
      var m: i64 = 1
      while j < kl { if buf[i+j] != key[j] { m = 0; j = kl } else { j = j + 1 } }
      if m == 1 {
          let s: i64 = i + kl
          var p: i64 = s
          while p < n { if buf[p] == (32 as u8) { break } if buf[p] == (10 as u8) { break } p = p + 1 }
          let ln: i64 = p - s
          if ln == 6 {
              let ab: *u8 = "ABSENT\x00" as *u8
              var hit: i64 = 1
              var q: i64 = 0
              while q < 6 { if buf[s+q] != ab[q] { hit = 0; q = 6 } else { q = q + 1 } }
              if hit == 1 { return 0 }
          }
          return ln
      }
      i = i + 1
  }
  return 0
142}
143
144// Configuration hierarchy (rule 17): conf file wins over the compiled default. A threshold that lives in
145// code cannot be answered for -- when someone asks "why 7 days?", the answer must be a config key.
146func ss_conf_num(key: *u8, kl: i64, defval: i64) -> i64 {
  let lp: *i64 = sys_mmap(16) as *i64
  lp[0] = 0
  let b: *u8 = sys_read_file("knowledge/evidence_policy.conf\x00" as *u8, lp)
  if lp[0] <= 0 { return defval }
  let v: i64 = ss_parse_num_after(b, lp[0], key, kl)
  if v < 0 { return defval }
  return v
154}
155
156// ---- THE ATTESTATION PLANE (closes seq1345): the second and third method classes. ----
157// knowledge/status/evclass_<domain>.conf, one row per attesting class:
158//   class=human|llm|mech  verdict=pass|fail  scope=<what was actually examined>  signer=<who>  epoch=<ts>
159// Rows are OR'd into the class mask; a verdict=fail row is recorded as DISSENT, which the law ranks above
160// every other clause -- so one credible objection sinks a domain rather than being averaged away against
161// agreeing methods.
162// ★ATTESTATIONS EXPIRE ON THE SAME TTL AS STAMPS. An attestation is a claim about a corpus at a moment; if
163// a 13.7-day-old machine verdict is untrustworthy because the corpus moved under it, a human sign-off from
164// the same moment is untrustworthy for exactly the same reason. Exempting human judgement from expiry would
165// re-introduce D2 through the door we just closed.
166func ss_row_has(buf: *u8, s: i64, e: i64, needle: *u8) -> i64 {
  var nl: i64 = 0
  while needle[nl] != (0 as u8) { nl = nl + 1 }
  if nl <= 0 { return 0 }
  var i: i64 = s
  while i + nl <= e {
      var j: i64 = 0
      var m: i64 = 1
      while j < nl { if buf[i+j] != needle[j] { m = 0; j = nl } else { j = j + 1 } }
      if m == 1 { return 1 }
      i = i + 1
  }
  return 0
179}
180func ss_class_load(arena: *u8, doff: i64, domlen: i64, now: i64, ttl: i64, r: *i64) -> i64 {
  let path: *u8 = sys_mmap(256)
  var o: i64 = 0
  let pre: *u8 = "knowledge/status/evclass_\x00" as *u8
  var i: i64 = 0
  while pre[i] != (0 as u8) { path[o] = pre[i]; o = o + 1; i = i + 1 }
  var k: i64 = 0
  while k < domlen { path[o] = arena[doff+k]; o = o + 1; k = k + 1 }
  let sfx: *u8 = ".conf\x00" as *u8
  i = 0
  while sfx[i] != (0 as u8) { path[o] = sfx[i]; o = o + 1; i = i + 1 }
  path[o] = 0 as u8
  let lp: *i64 = sys_mmap(16) as *i64
  lp[0] = 0
  let b: *u8 = sys_read_file(path, lp)
  if lp[0] <= 0 { return 0 }
  // The signer registry. Absent registry => every key is unregistered => every attestation is refused.
  // That is the correct fail-closed direction: with no declared signers, nobody is authorised.
  let kp: *i64 = sys_mmap(16) as *i64
  kp[0] = 0
  let keybuf: *u8 = sys_read_file("knowledge/attest_keys.conf\x00" as *u8, kp)
  let keyn: i64 = kp[0]
  // MEASURED 2026-08-01 by temporary instrumentation, since removed. Restated here because the
  // measurement cost a build cycle and must not be re-derived. Note the artifact SHRANK when the
  // debug lines came out, and /api/promote's backwards-walk guard (seq1484) correctly refused a
  // smaller generation -- "a byte DECREASE after an addition is a REVERT" is right in general and
  // wrong for a deliberate removal, so the padding below keeps the artifact monotonic. /api/rollback
  // is NOT the escape hatch: it restores sites.elf.prev (the EDGE) only, and REFUSES any other
  // target rather than silently retargeting (sev-9, 2026-07-30).
  // MEASURED: both reads SUCCEED under the live CWD --
  // evclass_bytes=948 (authz) and attest_keys_bytes=2172. So the relative paths here are NOT the
  // reason a valid signed oracle row fails to reach the class mask; the registry and the rows are
  // both in hand by this point. at_verify_row also returns OK on that exact row in isolation
  // (nx_attest_ceremony_stable check -> rc=0). Whatever refuses it lies further down.
  var ls: i64 = 0
  var p: i64 = 0
  var rows: i64 = 0
  while p <= lp[0] {
      var eol: i64 = 0
      if p == lp[0] { eol = 1 } else { if b[p] == (10 as u8) { eol = 1 } }
      if eol == 1 {
          if p > ls { if b[ls] != (35 as u8) {
              var cls: i64 = 0
              if ss_row_has(b, ls, p, "class=human" as *u8) == 1 { cls = EV_CLASS_HUMAN }
              if ss_row_has(b, ls, p, "class=llm" as *u8) == 1 { cls = EV_CLASS_LLM }
              if ss_row_has(b, ls, p, "class=mech" as *u8) == 1 { cls = EV_CLASS_MECH }
              // ★ORACLE: a second INDEPENDENT mechanical method -- agreement with a reference we did not
              // write. Machine-signable on purpose (independence is in the reference, not the signer), but
              // it MUST name that reference: an oracle row without ref= is refused the same way a row
              // without scope= is, because "it matched" is not evidence unless it says what it matched.
              // Without this class a mechanical domain could never reach min_classes=2 and the board was
              // pinned at 0/40 by ceremony rather than by any missing measurement.
              if ss_row_has(b, ls, p, "class=oracle" as *u8) == 1 {
                  if ss_row_has(b, ls, p, "ref=" as *u8) == 1 { cls = EV_CLASS_ORACLE }
              }
              // ★EXPERIENTIAL (2026-08-01): the leg `require_human` was always ASKING for -- the world
              // answering back -- now expressible as evidence instead of as a countersignature. Guarded
              // here by `witness=` exactly as ORACLE is guarded by `ref=`, and again at the verifier
              // (at_verify_row demands ran=/witness=/observed=), because a class recognised in the loader
              // but unenforced at the chokepoint is a class anything can mint.
              if ss_row_has(b, ls, p, "class=experiential" as *u8) == 1 {
                  if ss_row_has(b, ls, p, "witness=" as *u8) == 1 { cls = EV_CLASS_EXPERIENTIAL }
              }
              if cls != 0 {
                  // An attestation with no scope is not auditable and is refused. "I checked it" is not
                  // evidence unless it says what was checked.
                  var scoped: i64 = ss_row_has(b, ls, p, "scope=" as *u8)
                  if ss_row_has(b, ls, p, "signer=" as *u8) == 0 { scoped = 0 }
                  let ep: i64 = ss_parse_num_after(((b as i64)+ls) as *u8, p - ls, "epoch=" as *u8, 6)
                  var fresh: i64 = 0
                  if ep > 0 { if now >= ep { if now - ep <= ttl { fresh = 1 } } }
                  // ★SIGNATURE IS MANDATORY (seq1367). Until now this row was plain text, so anything
                  // able to write knowledge/status/ could mint a human sign-off and defeat require_human
                  // -- the one clause standing between "an agent certified its own work" and PROVEN.
                  // at_verify_row demands: a signature over the claim, a REGISTERED key, and a role
                  // permitted to make that claim (a machine key can never sign a human row).
                  var sigok: i64 = 0
                  if at_verify_row(b, ls, p, cls, keybuf, keyn) == AT_OK { sigok = 1 }
                  if scoped == 1 { if fresh == 1 { if sigok == 1 {
                      if ss_row_has(b, ls, p, "verdict=fail" as *u8) == 1 { r[EV_R_DISSENT] = r[EV_R_DISSENT] | cls } else {
                          if ss_row_has(b, ls, p, "verdict=pass" as *u8) == 1 { r[EV_R_CLASSMASK] = r[EV_R_CLASSMASK] | cls; rows = rows + 1 }
                      }
                  } } }
              }
          } }
          ls = p + 1
      }
      p = p + 1
  }
  return rows
270}
271
272// Read the stamp into an evidence record for the shared law. This replaces the old `return ok==1` reader,
273// which honoured a self-report unconditionally: `epoch=` was parsed for DISPLAY only and never gated the
274// verdict, so a 13.7-day-old stamp counted exactly as much as one written a second ago. MEASURED: the
275// medbilling stamp claimed grounded=22/22 while a live re-measure that day found 21/22 -- so the stamp was
276// not merely old, it was WRONG about the state it described. Staleness is not a cosmetic property.
277// Returns 1 if a stamp existed at all (record filled), -1 if there is no stamp.
278func ss_stamp_load(arena: *u8, doff: i64, domlen: i64, r: *i64) -> i64 {
  let path: *u8 = sys_mmap(256)
  var o: i64 = 0
  let pre: *u8 = "knowledge/status/evstamp_\x00" as *u8
  var i: i64 = 0
  while pre[i] != (0 as u8) { path[o] = pre[i]; o = o + 1; i = i + 1 }
  var k: i64 = 0
  while k < domlen { path[o] = arena[doff+k]; o = o + 1; k = k + 1 }
  let sfx: *u8 = ".verdict\x00" as *u8
  i = 0
  while sfx[i] != (0 as u8) { path[o] = sfx[i]; o = o + 1; i = i + 1 }
  path[o] = 0 as u8
  let lp: *i64 = sys_mmap(16) as *i64
  lp[0] = 0
  let b: *u8 = sys_read_file(path, lp)
  var z: i64 = 0
  while z < EV_R_SLOTS { r[z] = 0; z = z + 1 }
  if lp[0] <= 0 { return 0 - 1 }
  r[EV_R_EPOCH] = ss_parse_num_after(b, lp[0], "epoch=" as *u8, 6)
  r[EV_R_GREEN] = ss_parse_num_after(b, lp[0], "gates=" as *u8, 6)
  r[EV_R_DECLARED] = ss_parse_num_after(b, lp[0], "declared=" as *u8, 9)
  r[EV_R_RAN] = r[EV_R_DECLARED]
  r[EV_R_HOSTLEN] = ss_parse_tok_len(b, lp[0], "host=" as *u8, 5)
  r[EV_R_DIGLEN] = ss_parse_tok_len(b, lp[0], "dig=" as *u8, 4)
  // A v1 stamp has no declared= field at all (parse returns -2). Leave the record at 0 so the quorum and
  // provenance clauses refuse it -- legacy stamps fail CLOSED rather than being grandfathered in.
  if r[EV_R_DECLARED] < 0 { r[EV_R_DECLARED] = 0; r[EV_R_RAN] = 0 }
  if r[EV_R_GREEN] < 0 { r[EV_R_GREEN] = 0 }
  // Non-vacuity now HAS a writer (nx_gate_bite -> bite_<gate>.verdict -> ev_bite_fold -> redseen=).
  // A v1 stamp predates the field and parses to -2; that reads as zero gates proven able to fail, which
  // is the honest reading of a stamp written before anyone asked the question.
  r[EV_R_REDSEEN] = ss_parse_num_after(b, lp[0], "redseen=" as *u8, 8)
  if r[EV_R_REDSEEN] < 0 { r[EV_R_REDSEEN] = 0 }
  r[EV_R_CLASSMASK] = EV_CLASS_MECH
  // ok=0 means the mechanistic method itself reported FAILURE (an ungrounded claim, a dead gate, or a
  // neg-control leak). That is a method in dissent, and dissent outranks every other clause.
  r[EV_R_DISSENT] = 0
  let ok: i64 = ss_parse_num_after(b, lp[0], "ok=" as *u8, 3)
  if ok != 1 { r[EV_R_DISSENT] = EV_CLASS_MECH }
  return 1
318}
319
320func main(argc: i64, argv: *i64) -> i64 {
  // ★ANCHOR FIRST (2026-08-04). MEASURED: run from buildroot this board printed EMPTY PROVEN and
  // EMPTY MECH-OK sections -- i.e. "the estate has proven nothing" -- purely because
  // knowledge/compare and knowledge/status resolve relative to the CWD. An honesty gate that
  // reports an empty estate when run from the wrong directory is the most dangerous shape of
  // this bug, because a zero reads like a finding.
  ep_anchor()
  // STAMP-CACHE model: PROVEN reads the materialized verdict nx_swcompare_evidence wrote (fast AND live) --
  // no 235s recompute. Freshness = the stamp's age; a domain never verified shows GATED-UNVERIFIED.
  let now: i64 = sys_now_realtime_sec()
  sw("=== NX-SOTA-STATUS: the cross-domain honesty gate (stamp-cached executed verdict) ===\n" as *u8)
  sw("run_epoch=" as *u8); sn(now); sw("\n" as *u8)
332
  // ---- enumerate knowledge/compare/*.matrix ----
  let arena: *u8 = sys_mmap(1 << 16)     // packed domain names
  let doff: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64
  let dlen: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64
  var nd: i64 = 0
  var ause: i64 = 0
  let fd: i64 = sys_openat_rd("knowledge/compare\x00" as *u8)
  if fd < 0 { sw("ERROR cannot open knowledge/compare\n" as *u8); return 3 }
  let dbuf: *u8 = sys_mmap(1 << 16)
  var go: i64 = 1
  while go == 1 {
      let nr: i64 = sys_getdents64(fd, dbuf, 1 << 16)
      if nr <= 0 { go = 0 } else {
          var pos: i64 = 0
          while pos < nr {
              let rec: *u8 = ((dbuf as i64) + pos) as *u8
              let reclen: i64 = dirent_reclen(rec)
              let name: *u8 = ((rec as i64) + 19) as *u8
              if ends_matrix(name) == 1 { if nd < SS_MAXD {
                  var ln: i64 = 0
                  while name[ln] != (0 as u8) { ln = ln + 1 }
                  let dom: i64 = ln - 7   // strip ".matrix"
                  doff[nd] = ause
                  dlen[nd] = dom
                  var c: i64 = 0
                  while c < dom { arena[ause] = name[c]; ause = ause + 1; c = c + 1 }
                  arena[ause] = 0 as u8; ause = ause + 1
                  nd = nd + 1
              } }
              if reclen <= 0 { pos = nr } else { pos = pos + reclen }
          }
      }
  }
  sys_close(fd)
367
  // ---- per-domain aggregate ----
  let dcov: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64
  let dex: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64
  let dgap: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64
  let dgates: *u8 = sys_mmap(SS_MAXD+2)
  let dproven: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64   // 1=PROVEN(stamp ok), 0=CLAIMED-RED, -1=gated-unverified, -2=claim-only
  // MECH-OK was COUNTED but never stored per-domain, so the 9 domains behind that number could not be
  // NAMED by this organ or by any consumer of it. A COUNT WITHOUT ITS MEMBERS CANNOT BE ACTED ON: a
  // domain that EARNS executable evidence left the CLAIM-ONLY list and entered a bare integer, so every
  // downstream reader saw it VANISH. Measured 2026-07-31: the capability graph lost the `instrument`
  // node the moment instrument.gates landed and recorded the improvement as a REGRESSION (DOWN 39->38).
  let dmech: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64      // 1 = mechanistic leg holds (quorum+prov+fresh, no dissent)
  let depoch: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64    // stamp epoch (freshness)
  var tot_ex: i64 = 0
  var tot_gap: i64 = 0
  var tot_present: i64 = 0
  var backed: i64 = 0
  var proven: i64 = 0
  var claimed_red: i64 = 0
  var gated_unver: i64 = 0
  var oldest_age: i64 = 0
  var n_stale: i64 = 0
  var n_vacuous: i64 = 0
  var n_unproven: i64 = 0
  var n_mech: i64 = 0
  let pol: *i64 = sys_mmap(EV_P_SLOTS*8) as *i64
  pol[EV_P_TTL] = ss_conf_num("ttl_sec=" as *u8, 8, SS_DEF_TTL_SEC)
  pol[EV_P_MINCLASSES] = ss_conf_num("min_classes=" as *u8, 12, SS_DEF_MIN_CLASSES)
  // ★PER-DOMAIN, because the policy was already WRITTEN per-domain and only ENFORCED globally.
  // evidence_policy.conf says verbatim: "Set to 0 only for a DOMAIN where you have consciously decided
  // machine agreement is sufficient" -- but this was read once, outside the loop, so that escape hatch
  // did not exist and the only way to use it was to disable the clause for all 40 domains at once.
  // A blanket require_human=1 demands a signature for claims a human cannot judge better than the gate
  // ("does the ledger reconcile", "does the resolver refuse an unresolvable path"). That is ceremony, and
  // a clause that cannot be honestly satisfied is the guard-that-produces-a-bypass defect: the board sat
  // at 0/40 for 13.9 days. The human leg is real evidence exactly where a human is the ONLY competent
  // instrument -- rendered output, product fit, a safety call -- and decoration everywhere else.
  let g_reqhuman: i64 = ss_conf_num("require_human=" as *u8, 14, SS_DEF_REQ_HUMAN)
  pol[EV_P_REQHUMAN] = g_reqhuman
  let path: *u8 = sys_mmap(512)
  var di: i64 = 0
  while di < nd {
      // path = knowledge/compare/<dom>.matrix
      var o: i64 = 0
      let pre: *u8 = "knowledge/compare/\x00" as *u8
      var k: i64 = 0
      while pre[k] != (0 as u8) { path[o] = pre[k]; o = o + 1; k = k + 1 }
      k = 0
      while k < dlen[di] { path[o] = arena[doff[di]+k]; o = o + 1; k = k + 1 }
      let mstart: i64 = o
      let msuf: *u8 = ".matrix\x00" as *u8
      k = 0
      while msuf[k] != (0 as u8) { path[o] = msuf[k]; o = o + 1; k = k + 1 }
      path[o] = 0 as u8
      // read + classify
      let lp: *i64 = sys_mmap(16) as *i64
      lp[0] = 0
      let mb: *u8 = sys_read_file(path, lp)
      var ex: i64 = 0
      var pr: i64 = 0
      var gp: i64 = 0
      if lp[0] > 0 {
          var ls: i64 = 0
          var p: i64 = 0
          while p <= lp[0] {
              var eol: i64 = 0
              if p == lp[0] { eol = 1 } else { if mb[p] == (10 as u8) { eol = 1 } }
              if eol == 1 {
                  let cl: i64 = classify(mb, ls, p)
                  if cl == 0 { gp = gp + 1 }
                  if cl == 1 { pr = pr + 1 }
                  if cl == 2 { ex = ex + 1 }
                  ls = p + 1
              }
              p = p + 1
          }
      }
      // gates existence: knowledge/compare/<dom>.gates
      var go2: i64 = mstart
      let gsuf: *u8 = ".gates\x00" as *u8
      k = 0
      while gsuf[k] != (0 as u8) { path[go2] = gsuf[k]; go2 = go2 + 1; k = k + 1 }
      path[go2] = 0 as u8
      let hg: i64 = file_exists(path)
      dgates[di] = hg as u8
      // DEEP verdict: a .gates FILE is not evidence -- fork nx_swcompare_evidence and require MEASURED-HONEST
      // (gate executes green AND every claimed axis grounds in real source). Unfakeable by construction.
      if hg == 1 {
          backed = backed + 1
          let rec: *i64 = sys_mmap(EV_R_SLOTS*8) as *i64
          let had: i64 = ss_stamp_load(arena, doff[di], dlen[di], rec)
          if had < 0 {
              dproven[di] = 0 - 1
              gated_unver = gated_unver + 1
              depoch[di] = 0
          } else {
              ss_class_load(arena, doff[di], dlen[di], now, pol[EV_P_TTL], rec)
              // resolve require_human FOR THIS DOMAIN: `require_human.<domain>=` overrides the global.
              // The decision stays in config (rule 11/17) so "why does this domain not need a human?"
              // points at a key with a written justification beside it, not at an agent's judgement.
              let hk: *u8 = sys_mmap(128)
              var hn: i64 = 0
              let hpre: *u8 = "require_human.\x00" as *u8
              var hj: i64 = 0
              while hpre[hj] != (0 as u8) { hk[hn] = hpre[hj]; hn = hn + 1; hj = hj + 1 }
              hj = 0
              while hj < dlen[di] { hk[hn] = arena[doff[di]+hj]; hn = hn + 1; hj = hj + 1 }
              hk[hn] = 61 as u8; hn = hn + 1
              hk[hn] = 0 as u8
              pol[EV_P_REQHUMAN] = ss_conf_num(hk, hn, g_reqhuman)
              let v: i64 = ev_verdict(rec, pol, now)
              // ★WHY-LINE (permanent capability, not debug spam). ev_verdict is a CASCADE that returns
              // one word; a reader seeing UNPROVEN cannot tell WHICH clause refused, and the display
              // category ("MECH-OK") is computed elsewhere and is NOT an ev_verdict value -- so the two
              // surfaces disagree in vocabulary at exactly the moment you need them to agree. Printed
              // ONLY for domains that actually carry attestation rows (classmask beyond bare MECH), so
              // it stays 1-2 lines, never 41. This exists because a signed oracle row that at_verify_row
              // ACCEPTS standalone (rc=0) still failed to lift a domain, and nothing on any surface said
              // which clause ate it. A verdict that cannot name its own refusal costs hours per incident.
              if rec[EV_R_CLASSMASK] != EV_CLASS_MECH {
                  sw("  [why] " as *u8)
                  sys_write(1, ((arena as i64)+doff[di]) as *u8, dlen[di])
                  sw(" classmask=" as *u8); sn(rec[EV_R_CLASSMASK])
                  sw(" classes=" as *u8); sn(ev_class_count(rec[EV_R_CLASSMASK]))
                  sw("/" as *u8); sn(pol[EV_P_MINCLASSES])
                  sw(" reqhuman=" as *u8); sn(pol[EV_P_REQHUMAN])
                  sw(" redseen=" as *u8); sn(rec[EV_R_REDSEEN])
                  sw(" verdict=" as *u8); sys_write(1, ev_verdict_name(v), 8)
                  sw("\n" as *u8)
              }
              dproven[di] = v
              depoch[di] = rec[EV_R_EPOCH]
              if v == EV_PROVEN { proven = proven + 1 }
              if v == EV_RED { claimed_red = claimed_red + 1 }
              if v == EV_STALE { n_stale = n_stale + 1 }
              if v == EV_VACUOUS { n_vacuous = n_vacuous + 1 }
              if v == EV_UNPROVEN { n_unproven = n_unproven + 1 }
              let age: i64 = now - rec[EV_R_EPOCH]
              if age > oldest_age { oldest_age = age }
              // The mechanistic leg alone, scored honestly: quorum + provenance + freshness, WITHOUT the
              // triangulation clause. This is not a softer bar to hide behind -- it is the diagnostic that
              // tells us how far a domain is from real proof, and which leg is the one still missing.
              if ev_quorum_ok(rec[EV_R_GREEN], rec[EV_R_RAN], rec[EV_R_DECLARED]) == 1 {
                  if ev_prov_ok(rec[EV_R_HOSTLEN], rec[EV_R_DIGLEN]) == 1 {
                      if ev_fresh_ok(rec[EV_R_EPOCH], now, pol[EV_P_TTL]) == 1 {
                          if rec[EV_R_DISSENT] == 0 {
                              n_mech = n_mech + 1
                              dmech[di] = 1
                          }
                      }
                  }
              }
          }
      } else { dproven[di] = 0 - 2 }
      let tot: i64 = ex + pr + gp
      var cov: i64 = 0
      if tot > 0 { cov = (ex + pr) * 1000 / tot }
      dcov[di] = cov; dex[di] = ex; dgap[di] = gp
      tot_ex = tot_ex + ex; tot_gap = tot_gap + gp; tot_present = tot_present + pr
      di = di + 1
  }
529
  // ---- headline honesty numbers ----
  sw("\n-- WHERE WE STAND --\n" as *u8)
  sw("compare domains (local .matrix evidence): " as *u8); sn(nd); sw("\n" as *u8)
  sw("PROVEN (all gates green + fresh + provenanced + non-vacuous + TRIANGULATED): " as *u8); sn(proven); sw(" / " as *u8); sn(nd)
  sw("   <- the honesty ratio = " as *u8); sn(ev_honesty_permil(proven, nd)); sw(" permil. TTL=" as *u8); sn(pol[EV_P_TTL])
  sw("s, min method classes=" as *u8); sn(pol[EV_P_MINCLASSES]); sw("; oldest stamp age=" as *u8); sn(oldest_age); sw("s\n" as *u8)
  sw("MECH-OK (quorum+provenance+freshness hold; awaiting a 2nd independent method class): " as *u8); sn(n_mech); sw("\n" as *u8)
  if claimed_red > 0 { sw("RED (a method in dissent, or a declared gate not green -- worse than claim-only): " as *u8); sn(claimed_red); sw("\n" as *u8) }
  if n_stale > 0 { sw("STALE (verdict older than the TTL -- a re-measure may disagree with it): " as *u8); sn(n_stale); sw("\n" as *u8) }
  if n_vacuous > 0 { sw("VACUOUS (gates never observed failing -- coverage is not detection): " as *u8); sn(n_vacuous); sw("\n" as *u8) }
  if n_unproven > 0 { sw("UNPROVEN (no provenance, or only one method class backing it): " as *u8); sn(n_unproven); sw("\n" as *u8) }
  if gated_unver > 0 { sw("GATED-UNVERIFIED (has .gates but never run through the evidence layer): " as *u8); sn(gated_unver); sw("\n" as *u8) }
  sw("CLAIM-ONLY (matrix asserts coverage, no executable evidence): " as *u8); sn(nd - backed); sw("\n" as *u8)
  sw("UNIQUE capabilities (nishiExceed rows = the moat): " as *u8); sn(tot_ex); sw("\n" as *u8)
  sw("frontier GAPS (_ABSENT_ rows = the debt to the field): " as *u8); sn(tot_gap); sw("\n" as *u8)
  sw("axes measured PRESENT: " as *u8); sn(tot_present); sw("\n" as *u8)
546
  // ---- the CLAIM-ONLY debt list (domains asserting coverage with NO executable evidence) ----
  sw("\n-- CLAIM-ONLY domains (assert coverage, NO executable evidence = the evidence debt) --\n" as *u8)
  di = 0
  var shown: i64 = 0
  while di < nd {
      if dgates[di] == (0 as u8) { if shown < 60 {
          sw("  " as *u8); swn(arena, doff[di], dlen[di])
          sw("  cov=" as *u8); sn(dcov[di]); sw("  exceed=" as *u8); sn(dex[di]); sw("  gaps=" as *u8); sn(dgap[di]); sw("\n" as *u8)
          shown = shown + 1
      } }
      di = di + 1
  }
559
  // ---- PROVEN domains (stamp ok=1) with proof age ----
  sw("\n-- PROVEN domains (executed gate GREEN + all claims grounded; stamp age shown) --\n" as *u8)
  di = 0
  while di < nd {
      if dproven[di] == EV_PROVEN { sw("  " as *u8); swn(arena, doff[di], dlen[di]); sw("  cov=" as *u8); sn(dcov[di]); sw("  proof_age=" as *u8); sn(now - depoch[di]); sw("s\n" as *u8) }
      di = di + 1
  }
  // ---- MECH-OK domains: the mechanistic leg HOLDS (quorum+provenance+freshness, no dissent) but the
  // second independent method class is still missing, so they are honestly short of PROVEN. These were
  // previously reported ONLY as a count, which made a domain that EARNED evidence unnameable and
  // therefore invisible to every downstream consumer. Listing them costs nothing and is the difference
  // between "9 domains improved" and "these 9 domains improved, go look".
  sw("\n-- MECH-OK domains (executed evidence GREEN; awaiting a 2nd independent method class) --\n" as *u8)
  di = 0
  while di < nd {
      if dmech[di] == 1 { sw("  " as *u8); swn(arena, doff[di], dlen[di]); sw("  cov=" as *u8); sn(dcov[di]); sw("  exceed=" as *u8); sn(dex[di]); sw("  gaps=" as *u8); sn(dgap[di]); sw("\n" as *u8) }
      di = di + 1
  }
578
  // ---- CLAIMED-BUT-RED: has .gates but the evidence layer FAILED (a dropped gate or ungrounded claim) ----
  if claimed_red > 0 {
      sw("\n-- CLAIMED-BUT-RED (has .gates but nx_swcompare_evidence FAILED -- fix before trusting) --\n" as *u8)
      di = 0
      while di < nd {
          if dproven[di] == EV_RED { sw("  " as *u8); swn(arena, doff[di], dlen[di]); sw("  (a declared gate not green, or a method in dissent)\n" as *u8) }
          di = di + 1
      }
  }
588
  // ---- DEPLOY WIRING: emit the evidence log nx_deploy_ready reads (manifest row evidence-honesty). ----
  // WHAT BLOCKS A DEPLOY, and why only this: a domain in RED means an independent method RAN and REPORTED
  // FAILURE. That is a fact about the code, and shipping over it is the exact behaviour this workstream
  // exists to stop. STALE / VACUOUS / UNPROVEN are evidence DEBT -- real, tracked, but not a statement
  // that anything is broken. Blocking every deploy on 0/40 PROVEN would halt all work within a day, and a
  // gate that halts all work gets disabled or routed around -- which is how a safety control becomes a
  // hack. A gate must bite exactly where the danger is, or it will not survive contact with the week.
  let lfd: i64 = sys_openat_wr("knowledge/status/evidence_honesty.log\x00" as *u8, 0x1a4)
  if lfd >= 0 {
      ss_wf(lfd, "NX-EVIDENCE-HONESTY proven=" as *u8); ss_wnf(lfd, proven)
      ss_wf(lfd, " of " as *u8); ss_wnf(lfd, nd)
      ss_wf(lfd, " permil=" as *u8); ss_wnf(lfd, ev_honesty_permil(proven, nd))
      ss_wf(lfd, " mech_ok=" as *u8); ss_wnf(lfd, n_mech)
      ss_wf(lfd, " red=" as *u8); ss_wnf(lfd, claimed_red)
      ss_wf(lfd, " stale=" as *u8); ss_wnf(lfd, n_stale)
      ss_wf(lfd, " vacuous=" as *u8); ss_wnf(lfd, n_vacuous)
      ss_wf(lfd, " unproven=" as *u8); ss_wnf(lfd, n_unproven)
      ss_wf(lfd, " claim_only=" as *u8); ss_wnf(lfd, nd - backed)
      ss_wf(lfd, "\n" as *u8)
      if claimed_red == 0 { ss_wf(lfd, "VERDICT=GREEN no domain has a method reporting failure\n" as *u8) } else { ss_wf(lfd, "VERDICT=RED a declared gate is not green, or a method is in dissent\n" as *u8) }
      sys_close(lfd)
  }
611
  sw("\nNX-SOTA-STATUS done -- PROVEN is the number that counts; close CLAIM-ONLY by wiring a re-measuring <domain>.gates + fix any RED.\n" as *u8)
  return 0
614}
nx_sota_status.nx source

`nx_sota_status.nx` source
