nx_sota_why.nx source
↩ module page · 193 lines · 12438 B
1// nx_sota_why.nx -- WHERE DOES ONE DOMAIN STAND, AND WHAT IS THE NEXT STEP FOR IT.
2//
3// WHY THIS FILE EXISTS AT ALL, WRITTEN DOWN BECAUSE THE HISTORY IS THE POINT (2026-09-03):
4// The NAME nx_sota_why has been REGISTERED, AUTHORISED and INVOKED on the MCP surface for weeks -- and it
5// was an ALIAS of nx_sota_status. Identical 56,557 B source and 125,712 B binary; no file called
6// nx_sota_why existed anywhere under nishihost. So it inherited an argv-ignoring main, and asking it about
7// a domain returned the whole-estate aggregate: an answer to a question nobody asked.
8// A NAME THAT PROMISES A CAPABILITY ITS BINARY DOES NOT HAVE IS WORSE THAN THE MISSING CAPABILITY,
9// BECAUSE THE REGISTRY ENTRY READS AS COVERAGE AND STOPS ANYONE LOOKING. A seat this session filed a
10// design for the verb, which nx_capsearch would have told it already existed -- a retrieval failure, and
11// then a second discovery that the thing retrieved was hollow. This file makes the name honest.
12//
13// IT IS A READER, NOT A SECOND RULER. Every number here is read from knowledge/status/sota_board.ledger,
14// which nx_sota_status truncate-writes on every run. This organ re-derives NOTHING: a duplicate ruler
15// made of prose is how two organs come to disagree about one estate, and the whole reason the ledger
16// exists is that A VERDICT PRINTED BUT NOT PERSISTED CANNOT BE AGREED WITH, DISPUTED OR REGRESSED AGAINST.
17//
18// THREE WAYS IT REFUSES, AND THEY ARE DIFFERENT ANSWERS:
19// exit 1 the domain is not in the ledger -- a fact about the ARGUMENT
20// exit 2 no domain was given -- a fact about the CALL
21// exit 3 the ledger is absent, capped, stale or self-inconsistent -- a fact about the EVIDENCE
22// It never answers from a ledger whose own reconciliation line reads RED, because that line means the
23// per-domain classes and the printed buckets disagree and NEITHER MAY BE QUOTED UNTIL IT IS SETTLED.
24// license_tier: ORIGINAL expect_exit: 0 Read-only. No hw writes (Rule 26).
25import "nx_syscalls.nx"
26import "nx_string_ops.nx"
27import "nx_resmon_lib.nx"
28import "nx_sota_why_lib.nx"
29
30const SW_CAP: i64 = 262144
31const SW_CONFCAP: i64 = 4096
32const SW_NEEDLECAP: i64 = 256
33const SW_EXIT_OK: i64 = 0
34const SW_EXIT_NOTFOUND: i64 = 1
35const SW_EXIT_USAGE: i64 = 2
36const SW_EXIT_UNUSABLE: i64 = 3
37const SW_NL: i64 = 10
38const SW_GREENLEN: i64 = 13
39
40func main(argc: i64, argv: *i64) -> i64 {
41 if argc < 2 {
42 rm_puts("usage: nx_sota_why <domain>\n" as *u8)
43 rm_puts(" Answers WHERE ONE DOMAIN STANDS on the /compare honesty board and WHAT THE NEXT STEP IS,\n" as *u8)
44 rm_puts(" read from knowledge/status/sota_board.ledger which nx_sota_status writes on every run.\n" as *u8)
45 rm_puts(" exit 0 answered - 1 domain not on the board - 2 no domain given - 3 ledger unusable\n" as *u8)
46 return SW_EXIT_USAGE
47 }
48 let dom: *u8 = argv[1] as *u8
49
50 let buf: *u8 = sys_mmap(SW_CAP)
51 let n: i64 = rm_read("knowledge/status/sota_board.ledger" as *u8, buf, SW_CAP)
52 if n <= 0 {
53 rm_puts("LEDGER-ABSENT knowledge/status/sota_board.ledger -- the board has not been written.\n" as *u8)
54 rm_puts("REMEDY: run nx_sota_status from the nishihost root; it truncate-writes the ledger every run.\n" as *u8)
55 rm_puts("verdict=UNUSABLE\n" as *u8)
56 return SW_EXIT_UNUSABLE
57 }
58 // NO SILENT CAPS. A read that fills its buffer may have been truncated, and a truncated ledger lets
59 // this organ report a PRESENT domain as ABSENT -- a confident wrong answer, not an error.
60 // THE BAR IS SW_CAP-1, NOT SW_CAP, AND THAT IS NOT A DETAIL. rm_read reads at most cap-1 bytes and
61 // NUL-terminates, so a fully-truncated read returns exactly cap-1 and NEVER cap. The first draft of
62 // this guard tested `n >= SW_CAP` and therefore COULD NOT FIRE: the no-silent-cap check was itself
63 // silent. It was caught only because its gate carries a fixture-reached tooth beside the outcome
64 // tooth, so the fixture proved it really exceeded the cap while the outcome proved the organ noticed.
65 // A CAP GUARD MUST BE WRITTEN AGAINST THE READER'S ACTUAL FULL-CAP SIGNAL, NEVER AGAINST THE CAP YOU
66 // HANDED IT -- the two differ by whatever that reader reserves, and the difference is invisible.
67 if n >= SW_CAP - 1 {
68 rm_puts("LEDGER-CAPPED read=" as *u8); rm_num(n)
69 rm_puts(" cap=" as *u8); rm_num(SW_CAP)
70 rm_puts(" -- the ledger filled the read buffer, so absence cannot be told from truncation.\n" as *u8)
71 rm_puts("verdict=UNUSABLE\n" as *u8)
72 return SW_EXIT_UNUSABLE
73 }
74
75 // The ledger judges ITSELF. If its classes and the printed buckets disagreed, nx_sota_status says so
76 // on its last line, and an organ that answered anyway would be laundering a known-inconsistent board.
77 if nx_str_find(buf, n, "verdict=GREEN" as *u8, SW_GREENLEN) < 0 {
78 rm_puts("LEDGER-SELF-INCONSISTENT -- its own reconciliation line is not GREEN, which means the\n" as *u8)
79 rm_puts("per-domain classes and the printed buckets disagree. One of the two is wrong and NEITHER\n" as *u8)
80 rm_puts("may be quoted until it is settled, so this organ declines to answer from it.\n" as *u8)
81 rm_puts("REMEDY: re-run nx_sota_status and read its LEDGER-RECONCILES-WITH-BUCKETS line.\n" as *u8)
82 rm_puts("verdict=UNUSABLE\n" as *u8)
83 return SW_EXIT_UNUSABLE
84 }
85
86 // FRESHNESS TRAVELS WITH THE ANSWER. There is no fixed beat writing this ledger, so a bar is a
87 // DECLARATION rather than a derivation: when one is declared and blown, this refuses; when none is
88 // declared it still answers, but stamps the age and says the bar is UNDECLARED. An answer whose age
89 // is invisible is how a stale claim propagates, and refusing every question until somebody writes a
90 // conf row would make the organ useless rather than safe.
91 let cbuf: *u8 = sys_mmap(SW_CONFCAP)
92 let cn: i64 = rm_read("knowledge/status/sota_why.conf" as *u8, cbuf, SW_CONFCAP)
93 let bar: i64 = rm_conf(cbuf, cn, "max-age-s" as *u8, 0)
94 let epoch: i64 = rm_field(buf, n, "run_epoch=" as *u8)
95 let now: i64 = sys_now_realtime_sec()
96 var age: i64 = 0 - 1
97 if epoch > 0 { age = now - epoch }
98 if bar > 0 {
99 if age < 0 {
100 rm_puts("LEDGER-UNDATED no run_epoch line, so its age cannot be checked against the declared bar.\n" as *u8)
101 rm_puts("verdict=UNUSABLE\n" as *u8)
102 return SW_EXIT_UNUSABLE
103 }
104 if age > bar {
105 rm_puts("LEDGER-STALE age_s=" as *u8); rm_num(age)
106 rm_puts(" max_age_s=" as *u8); rm_num(bar)
107 rm_puts(" -- a re-measure may disagree with it, so this answer is withheld rather than given stale.\n" as *u8)
108 rm_puts("REMEDY: re-run nx_sota_status.\n" as *u8)
109 rm_puts("verdict=UNUSABLE\n" as *u8)
110 return SW_EXIT_UNUSABLE
111 }
112 }
113
114 // EXACT TOKEN MATCH. The needle carries the field name on BOTH sides, so a domain whose name is a
115 // prefix of another cannot answer for its neighbour. That is the same discipline the board itself
116 // uses when it names RED domains for a downstream consumer.
117 let nd: *u8 = sys_mmap(SW_NEEDLECAP)
118 var o: i64 = 0
119 o = sw_cat(nd, o, "domain= " as *u8)
120 o = sw_cat(nd, o, dom)
121 o = sw_cat(nd, o, " class=" as *u8)
122 nd[o] = 0 as u8
123 let hit: i64 = nx_str_find(buf, n, nd, o)
124 if hit < 0 {
125 rm_puts("DOMAIN-NOT-ON-THE-BOARD name=" as *u8); rm_puts(dom)
126 rm_puts(" ledger_bytes=" as *u8); rm_num(n)
127 rm_puts(" ledger_age_s=" as *u8); rm_num(age)
128 rm_puts("\n A domain is graded only if knowledge/compare/<name>.matrix exists. A page emitted\n" as *u8)
129 rm_puts(" straight from an organ, with no local evidence file, is NOT graded and must never be\n" as *u8)
130 rm_puts(" read as covered -- that is how a 41-of-41 came to be quoted as an estate-wide 1000.\n" as *u8)
131 rm_puts("verdict=NOT-FOUND\n" as *u8)
132 return SW_EXIT_NOTFOUND
133 }
134 // Row extent. The stop flag is deliberately NOT the cursor: writing the loop-exit sentinel into the
135 // search cursor erases the answer, which this estate has measured four times in one day.
136 var e2: i64 = hit
137 var stop: i64 = 0
138 while stop == 0 {
139 if e2 >= n { stop = 1 }
140 if stop == 0 { if (buf[e2] as i64) == SW_NL { stop = 1 } }
141 if stop == 0 { e2 = e2 + 1 }
142 }
143
144 rm_puts("=== NX-SOTA-WHY domain=" as *u8); rm_puts(dom); rm_puts(" ===\n" as *u8)
145 rm_puts("ledger_age_s=" as *u8); rm_num(age)
146 rm_puts(" bar=" as *u8)
147 if bar > 0 { rm_puts("DECLARED max_age_s=" as *u8); rm_num(bar) }
148 if bar <= 0 { rm_puts("UNDECLARED (the age above is the whole freshness statement; declare max-age-s in knowledge/status/sota_why.conf to make staleness REFUSE instead of merely report)" as *u8) }
149 rm_puts("\n" as *u8)
150 sys_write(1, ((buf as i64) + hit) as *u8, e2 - hit)
151 rm_puts("\n" as *u8)
152
153 // WHAT IS THE NEXT STEP. Each branch names the ONE thing standing between this domain and the next
154 // class up, because a status without a next step is a number, not an answer.
155 if sw_row_has(buf, hit, e2, " class=PROVEN" as *u8) == 1 {
156 rm_puts("WHY: every declared gate ran GREEN, every claim is grounded in an organ, the stamp is fresh\n" as *u8)
157 rm_puts(" and provenanced, no tooth is vacuous, and TWO INDEPENDENT METHOD CLASSES agree.\n" as *u8)
158 rm_puts("NEXT: nothing is owed. Keep the stamp inside its TTL or it falls back to STALE.\n" as *u8)
159 }
160 if sw_row_has(buf, hit, e2, " class=MECH-OK" as *u8) == 1 {
161 rm_puts("WHY: the MECHANISTIC leg holds -- quorum, provenance and freshness all pass and no method is\n" as *u8)
162 rm_puts(" in dissent. What is missing is a SECOND INDEPENDENT METHOD CLASS. One method agreeing\n" as *u8)
163 rm_puts(" with itself is not triangulation, and this board refuses to call that PROVEN.\n" as *u8)
164 rm_puts("NEXT: add a second method class -- an external adjudicator that re-derives a published number\n" as *u8)
165 rm_puts(" by different means, signed, and recorded in this domain evclass conf.\n" as *u8)
166 }
167 if sw_row_has(buf, hit, e2, " class=RED" as *u8) == 1 {
168 rm_puts("WHY: an independent method RAN and REPORTED FAILURE, or a declared gate is not green. This is\n" as *u8)
169 rm_puts(" the ONE class that is a statement about the CODE rather than about evidence debt.\n" as *u8)
170 rm_puts("NEXT: fix it before trusting anything this domain publishes. Run nx_domain_admit <domain> and\n" as *u8)
171 rm_puts(" nx_swcompare_evidence for the failing row; a RED here is what blocks a deploy.\n" as *u8)
172 }
173 if sw_row_has(buf, hit, e2, " class=CLAIM-ONLY" as *u8) == 1 {
174 rm_puts("WHY: the matrix asserts coverage and NO EXECUTABLE EVIDENCE backs it. There is no .gates file,\n" as *u8)
175 rm_puts(" so nothing re-measures the claim and it can only ever be as true as the day it was typed.\n" as *u8)
176 rm_puts("NEXT: write knowledge/compare/<domain>.gates -- one row per executed gate as\n" as *u8)
177 rm_puts(" <elf>|<argv or dash>|<what that binary proves>|<source> -- then re-run nx_domain_admit.\n" as *u8)
178 }
179 if sw_row_has(buf, hit, e2, " class=GATED-UNVERIFIED" as *u8) == 1 {
180 rm_puts("WHY: a .gates file exists but this domain has never been through the evidence layer, so its\n" as *u8)
181 rm_puts(" gates have never actually been RUN by the referee. A gate nobody runs is a comment.\n" as *u8)
182 rm_puts("NEXT: run nx_swcompare_evidence for this domain to produce its stamp.\n" as *u8)
183 }
184 if sw_row_has(buf, hit, e2, " class=UNPROVEN" as *u8) == 1 {
185 rm_puts("WHY: one of three DIFFERENT things, and the board deliberately keeps them in one bucket rather\n" as *u8)
186 rm_puts(" than guessing: no provenance, or only ONE method class backing it, or THE REFEREE ITSELF\n" as *u8)
187 rm_puts(" ABSTAINED. The third is evidence debt, not a failure, and it is not a deploy block.\n" as *u8)
188 rm_puts("NEXT: run nx_sota_status and read the per-domain abstain lines at the top of its output --\n" as *u8)
189 rm_puts(" they name which of the three applies here.\n" as *u8)
190 }
191 rm_puts("verdict=ANSWERED\n" as *u8)
192 return SW_EXIT_OK
193}