code wiki / _hdl_build / nx_sov_guard2.nx
`nx_sov_guard2.nx` source

↩ module page · 260 lines · 12174 B
1// nx_sov_guard2.nx -- the NO-NEW-TSV law with a WORKING TOOTH (eats seq279 at the root).
2//
3// WHY A REWRITE, NOT A PATCH (rule 3): v1 scanned exactly ONE directory and defaulted to `knowledge/status`,
4// so `knowledge/registry` -- which holds ~150 .tsv including the 3 this session created -- was NEVER SCANNED.
5// The law existed, the organ existed, the allowlist existed, and none of it could fire on the directory that
6// mattered. A guard that cannot see the violation is not a guard.
7//
8// TWO STRUCTURAL FIXES:
9//  1. MULTI-DIR, DATA-DRIVEN scan-set. Dirs come from the native plane knowledge/store/sovguard- (`dir<TAB>path`
10//     rows) -- rule 11, and pointedly NOT from a .tsv (the anti-tsv guard configuring itself with a tsv would be
11//     the joke that writes itself). If the plane is absent the organ still guards using a compiled-in default set
12//     and DECLARES `config:default-set` -- fail-SAFE, because a guard that silently stops guarding is worse than
13//     one that guards loudly with defaults.
14//  2. RATCHET, not a cliff. ~150 legacy files exist; a plain count>0 rule would be RED forever and get ignored
15//     (an alarm nobody can silence is an alarm nobody hears). Instead we compare against a recorded BASELINE and
16//     fail ONLY when the count RISES -- which is exactly what "no NEW tsv" means. Legacy shrinks lane by lane;
17//     a new file trips it the same day. Same snapshot/check idiom as nx_tooldiff / nx_route_diff.
18//
19//   nx_sov_guard2 check      -> GREEN if count <= baseline; RED (exit 1) naming the NEW files if it rose
20//   nx_sov_guard2 snapshot   -> deliberately re-record the baseline (after a migration lands)
21// Emits knowledge/status/sov_guard.log with a VERDICT line for the reliability plane.
22// license_tier: ORIGINAL  expect_exit: 0
23import "nx_store_seed_lib.nx"
24import "nx_itoa_lib.nx"   // shared MSB-first emitter (zero-alloc)
25import "nx_seg_store.nx"
26import "nx_syscalls.nx"
27const SG2_MAGIC_65536: i64 = 65536
28const SG2_MAGIC_4096: i64 = 4096
29const SG2_MAGIC_1024: i64 = 1024
30const SG2_MAGIC_262144: i64 = 262144
31
32const SG2_PLANE:  *u8 = "knowledge/store/sovguard-"
33const SG2_ALLOW:  *u8 = "knowledge/registry/tsv_allow.list"
34const SG2_LOG:    *u8 = "knowledge/status/sov_guard.log"
35const SG2_CAP:    i64 = 1048576
36
37func sg_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
38// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer
39// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the
40// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls).
41// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign.
42func sg_wn(v: i64) -> i64 { nxi_out(v); return 0 }
43func sg_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
44func sg_cat(o: *u8, at: i64, s: *u8) -> i64 { var i: i64=0; var a: i64=at; while s[i]!=(0 as u8){o[a]=s[i]; a=a+1; i=i+1} return a }
45func sg_catn(o: *u8, at: i64, v: i64) -> i64 {
  var a: i64=at; var x: i64=v
  if x<0 { o[a]=45 as u8; a=a+1; x=0-x }
  let tm: *u8=sys_mmap(24); var k: i64=0
  if x==0 { tm[0]=48 as u8; k=1 }
  while x>0 { tm[k]=(48+x%10) as u8; x=x/10; k=k+1 }
  var j: i64=0
  while j<k { o[a]=tm[k-1-j]; a=a+1; j=j+1 }
  return a
54}
55func sg_ends(name: *u8, suf: *u8) -> i64 {
  let n: i64=sg_slen(name); let s: i64=sg_slen(suf)
  if n<s { return 0 }
  var i: i64=0
  while i<s { if name[n-s+i]!=suf[i] { return 0 } i=i+1 }
  return 1
61}
62func sg_readfile(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64=sys_openat_rd(path)
  if fd<0 { return 0 }
  var off: i64=0; var go: i64=1
  while go==1 { if off>=cap { go=0 } else { let r: i64=sys_read(fd, (buf as i64+off) as *u8, cap-off); if r<=0 { go=0 } else { off=off+r } } }
  sys_close(fd)
  return off
69}
70// exact non-# line match
71func sg_line_in(buf: *u8, n: i64, name: *u8) -> i64 {
  let nl: i64=sg_slen(name)
  var ls: i64=0; var i: i64=0
  while i<=n {
      var eol: i64=0
      if i>=n { eol=1 } else { if buf[i]==(10 as u8) { eol=1 } }
      if eol==1 {
          let llen: i64=i-ls
          if llen==nl { if buf[ls]!=(35 as u8) {
              var m: i64=0; var ok: i64=1
              while m<nl { if buf[ls+m]!=name[m] { ok=0; m=nl } else { m=m+1 } }
              if ok==1 { return 1 }
          } }
          ls=i+1
      }
      i=i+1
  }
  return 0
89}
90// scan ONE dir; appends violating names to `names` (bounded); returns violation count, -1 unopenable
91func sg_scan_dir(dir: *u8, allow: *u8, an: i64, names: *u8, no: *i64, shown: *i64) -> i64 {
  let dfd: i64 = __syscall(257, 0-100, dir, 0x10000, 0, 0, 0)
  if dfd<0 { return 0-1 }
  let buf: *u8=sys_mmap(SG2_MAGIC_65536)
  let nm: *u8=sys_mmap(512)
  var viol: i64=0
  var go: i64=1
  while go==1 {
      let nread: i64 = __syscall(217, dfd, buf, SG2_MAGIC_65536, 0, 0, 0)
      if nread<=0 { go=0 } else {
          var pos: i64=0
          while pos<nread {
              let reclen: i64=(buf[pos+16] as i64)|((buf[pos+17] as i64)<<8)
              let dtype: i64=buf[pos+18] as i64
              var nl: i64=0
              while buf[pos+19+nl]!=(0 as u8) { nm[nl]=buf[pos+19+nl]; nl=nl+1 }
              nm[nl]=0 as u8
              if dtype==8 { if sg_ends(nm, ".tsv\x00" as *u8)==1 {
                  if sg_line_in(allow, an, nm)==0 {
                      viol=viol+1
                      if shown[0]<12 {
                          var o: i64=no[0]
                          o=sg_cat(names, o, dir); names[o]=47 as u8; o=o+1
                          o=sg_cat(names, o, nm); names[o]=10 as u8; o=o+1
                          no[0]=o
                          shown[0]=shown[0]+1
                      }
                  }
              } }
              if reclen<=0 { pos=nread } else { pos=pos+reclen }
          }
      }
  }
  sys_close(dfd)
  return viol
126}
127
128func main(argc: i64, argv: *i64) -> i64 {
  var verb: *u8 = "check\x00" as *u8
  if argc>=2 { verb = argv[1] as *u8 }
  // ---- scan-set + baseline from the NATIVE plane (never a .tsv), else declared defaults
  let pb: *u8=sys_mmap(SG2_CAP)
  let pn: i64=sts_load(SG2_PLANE, pb, SG2_CAP-SG2_MAGIC_4096)
  let dirs: *i64=sys_mmap(SG2_MAGIC_1024) as *i64
  let dbuf: *u8=sys_mmap(SG2_MAGIC_65536)
  var ndir: i64=0
  var baseline: i64=0-1
  var cfg: *u8="plane\x00" as *u8
  var dbo: i64=0
  if pn>0 {
      var i: i64=0
      while i<pn {
          let ls: i64=i
          var le: i64=ls
          var sc: i64=1
          while sc==1 { if le>=pn { sc=0 } else { if pb[le]==(10 as u8) { sc=0 } else { le=le+1 } } }
          i=le+1
          if le>ls {
              // split at first TAB
              var t: i64=ls
              var found: i64=0-1
              while t<le { if pb[t]==(9 as u8) { if found<0 { found=t } } t=t+1 }
              if found>0 {
                  let klen: i64=found-ls
                  let vs: i64=found+1
                  let vlen: i64=le-vs
                  // key "dir"
                  if klen==3 { if pb[ls]==(100 as u8) { if pb[ls+1]==(105 as u8) { if pb[ls+2]==(114 as u8) {
                      if ndir<64 { if dbo+vlen+2<SG2_MAGIC_65536 {
                          dirs[ndir]=(dbuf as i64)+dbo
                          var k: i64=0
                          while k<vlen { dbuf[dbo]=pb[vs+k]; dbo=dbo+1; k=k+1 }
                          dbuf[dbo]=0 as u8; dbo=dbo+1
                          ndir=ndir+1
                      } }
                  } } } }
                  // key "baseline"
                  if klen==8 { if pb[ls]==(98 as u8) {
                      var v: i64=0; var k: i64=0
                      while k<vlen { let c: i64=pb[vs+k] as i64; if c>=48 { if c<=57 { v=v*10+(c-48) } } k=k+1 }
                      baseline=v
                  } }
              }
          }
      }
  }
  if ndir==0 {
      cfg="default-set\x00" as *u8
      dirs[0]="knowledge/registry\x00" as *u8 as i64
      dirs[1]="knowledge/status\x00" as *u8 as i64
      ndir=2
  }
  // ---- scan
  let allow: *u8=sys_mmap(SG2_MAGIC_262144)
  let an: i64=sg_readfile(SG2_ALLOW, allow, SG2_MAGIC_262144)
  let names: *u8=sys_mmap(SG2_MAGIC_65536)
  let no: *i64=sys_mmap(16) as *i64
  let shown: *i64=sys_mmap(16) as *i64
  no[0]=0; shown[0]=0
  var total: i64=0
  var unopenable: i64=0
  var d: i64=0
  while d<ndir {
      let v: i64=sg_scan_dir(dirs[d] as *u8, allow, an, names, no, shown)
      if v<0 { unopenable=unopenable+1 } else { total=total+v }
      d=d+1
  }
  names[no[0]]=0 as u8
  // ---- snapshot: deliberately re-record the baseline into the native plane
  if verb[0]==(115 as u8) {
      let ob: *u8=sys_mmap(SG2_MAGIC_65536)
      var o: i64=0
      var k: i64=0
      while k<ndir { o=sg_cat(ob, o, "dir\x09" as *u8); o=sg_cat(ob, o, dirs[k] as *u8); ob[o]=10 as u8; o=o+1; k=k+1 }
      o=sg_cat(ob, o, "baseline\x09" as *u8); o=sg_catn(ob, o, total); ob[o]=10 as u8; o=o+1
      let rc: i64=sts_seed(SG2_PLANE, ob, o)
      sg_w("{\x22verb\x22:\x22snapshot\x22,\x22dirs\x22:" as *u8); sg_wn(ndir)
      sg_w(",\x22unallowlisted_tsv\x22:" as *u8); sg_wn(total)
      sg_w(",\x22baseline_recorded\x22:" as *u8); sg_wn(total)
      sg_w(",\x22plane_rows\x22:" as *u8); sg_wn(rc)
      sg_w("}\n" as *u8)
      if rc<0 { sg_w("SOV-GUARD RED -- baseline commit failed\n" as *u8); sys_exit(2); return 2 }
      sg_w("SOV-GUARD SNAPSHOT -- ratchet armed at the current count; any RISE is now a violation\n" as *u8)
      return 0
  }
  // ---- check (the ratchet)
  var eff: i64=baseline
  var armed: i64=1
  if baseline<0 { eff=total; armed=0 }   // first ever run: adopt, declare UNARMED, never fake a pass
  let delta: i64=total-eff
  var red: i64=0
  if delta>0 { red=1 }
  sg_w("{\x22verb\x22:\x22check\x22,\x22config\x22:\x22" as *u8); sg_w(cfg)
  sg_w("\x22,\x22dirs_scanned\x22:" as *u8); sg_wn(ndir)
  sg_w(",\x22dirs_unopenable\x22:" as *u8); sg_wn(unopenable)
  sg_w(",\x22unallowlisted_tsv\x22:" as *u8); sg_wn(total)
  sg_w(",\x22baseline\x22:" as *u8); sg_wn(eff)
  sg_w(",\x22delta\x22:" as *u8); sg_wn(delta)
  sg_w(",\x22ratchet_armed\x22:" as *u8); sg_wn(armed)
  sg_w(",\x22verdict\x22:\x22" as *u8)
  if red==1 { sg_w("RED" as *u8) } else { sg_w("GREEN" as *u8) }
  sg_w("\x22,\x22law\x22:\x22no NEW tsv -- legacy shrinks lane by lane, but the count must never RISE\x22}\n" as *u8)
  if no[0]>0 { sg_w("unallowlisted (first 12):\n" as *u8); sg_w(names) }
  // ---- evidence for the reliability plane
  let lf: i64=sys_openat_wr(SG2_LOG, 0x1a4)
  if lf>=0 {
      let lb: *u8=sys_mmap(SG2_MAGIC_4096)
      var o: i64=0
      o=sg_cat(lb, o, "nx_sov_guard2 -- no-new-tsv ratchet (config=" as *u8); o=sg_cat(lb, o, cfg)
      o=sg_cat(lb, o, ")\n  dirs_scanned=" as *u8); o=sg_catn(lb, o, ndir)
      o=sg_cat(lb, o, " unallowlisted_tsv=" as *u8); o=sg_catn(lb, o, total)
      o=sg_cat(lb, o, " baseline=" as *u8); o=sg_catn(lb, o, eff)
      o=sg_cat(lb, o, " delta=" as *u8); o=sg_catn(lb, o, delta)
      o=sg_cat(lb, o, " armed=" as *u8); o=sg_catn(lb, o, armed)
      o=sg_cat(lb, o, "\nVERDICT=" as *u8)
      if red==1 { o=sg_cat(lb, o, "RED" as *u8) } else { o=sg_cat(lb, o, "GREEN" as *u8) }
      o=sg_cat(lb, o, "\n" as *u8)
      sys_write(lf, lb, o)
      if no[0]>0 { sys_write(lf, names, no[0]) }
      sys_close(lf)
  }
  if red==1 {
      sg_w("SOV-GUARD RED -- a NEW unallowlisted .tsv appeared (count rose above baseline). Migrate it with nx_tsv_migrate, or allowlist it with an owner note; re-snapshot only when the rise is intentional.\n" as *u8)
      sys_exit(1)
      return 1
  }
  if armed==0 { sg_w("SOV-GUARD GREEN (ratchet UNARMED -- no baseline recorded yet; run `snapshot` to arm it)\n" as *u8); return 0 }
  sg_w("SOV-GUARD GREEN -- no new tsv since the baseline\n" as *u8)
  return 0
260}
nx_sov_guard2.nx source

`nx_sov_guard2.nx` source
