code wiki / _hdl_build / nx_sovereign_surface_gate.nx
`nx_sovereign_surface_gate.nx` source

↩ module page · 284 lines · 15755 B
1// nx_sovereign_surface_gate.nx -- PROVES, mechanically, that the Breeders stack is emitted from NishiLang
2// FROM THE FIRST BYTE UP and that ONE frame is interoperable across the sovereign surfaces.
3// (operator 2026-07-27: "make sure we are emitting from nishi lang from the first byte up not building
4// into 3rd parties but we do want it to be interoperable aka nishi os and browser first then making it
5// work on android or windows etc")
6//
7// ★WHY A GATE AND NOT A PROMISE: rule 26's discipline -- a sovereignty claim must be proven mechanically,
8// never asserted. So this gate READS ITS OWN DEPENDENCIES' SOURCE OFF DISK and fails if any of them
9// reaches outside the nx_* namespace. A future session cannot quietly `import` a third-party shim and
10// keep the green, because the check is structural rather than documentary.
11//
12// THE INTEROP CONTRACT UNDER TEST -- ONE framebuffer, many sinks, no conversion library:
13//     packed i64 per pixel, R | G<<8 | B<<16   (nx_game_raster's format)
14//        -> NishiOS      : the same word order the sovereign display controller + UEFI GOP sink consume
15//        -> Nishi Browser: byte 0=R,1=G,2=B of each i64 read straight out of linear memory by the canvas
16//                          blit (the loader contract the emitted pages already use)
17//        -> PNG          : nx_png_write_rgb, our own encoder (STORED zlib, no third-party deflate)
18//        -> Android/Windows: reachable BECAUSE the core is integer-only -- no float, no FPU rounding
19//                          mode, no endian-dependent struct punning -- so a byte-identical result on a
20//                          different ISA is a property of the code, not a hope. T5 proves determinism;
21//                          the aarch64/x86 backends are the graphics lane's Gx-2 rung, NOT claimed here.
22// license_tier: ORIGINAL
23import "nx_syscalls.nx"
24import "nx_char_identity.nx"
25import "nx_game_raster.nx"
26import "nx_png_write.nx"
27
28func p(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
29func pn(v: i64) -> i64 {
  let t: *u8 = sys_mmap(32) as *u8
  var m: i64 = v
  var w: i64 = 0
  if m < 0 { t[w] = 45 as u8; w = w + 1; m = 0 - m }
  if m == 0 { t[w] = 48 as u8; sys_write(1, t, w + 1); return 0 }
  let d: *u8 = sys_mmap(32) as *u8
  var k: i64 = 0
  while m > 0 { d[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var j: i64 = 0
  while j < k { t[w] = d[k - 1 - j]; w = w + 1; j = j + 1 }
  sys_write(1, t, w)
  return 0
42}
43func nl() -> i64 { p("\n" as *u8); return 0 }
44
45const TW: i64 = 96
46const TH: i64 = 64
47
48// read a whole source file; returns length or -1
49func slurp(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var total: i64 = 0
  var run: i64 = 1
  while run == 1 {
      let n: i64 = sys_read(fd, (buf as i64 + total) as *u8, cap - total)
      if n <= 0 { run = 0 }
      if n > 0 { total = total + n }
      if total >= cap { run = 0 }
  }
  sys_close(fd)
  return total
62}
63// does `buf` contain `needle` starting at i?
64func at(buf: *u8, len: i64, i: i64, needle: *u8) -> i64 {
  var k: i64 = 0
  while needle[k] != (0 as u8) {
      if i + k >= len { return 0 }
      if buf[i + k] != needle[k] { return 0 }
      k = k + 1
  }
  return 1
72}
73// count occurrences of a literal
74func count_of(buf: *u8, len: i64, needle: *u8) -> i64 {
  var c: i64 = 0
  var i: i64 = 0
  while i < len { if at(buf, len, i, needle) == 1 { c = c + 1 } i = i + 1 }
  return c
79}
80// ★scan every `import "` in a source and verify the target begins with nx_ . Returns foreign count.
81func foreign_imports(buf: *u8, len: i64) -> i64 {
  var bad: i64 = 0
  var i: i64 = 0
  while i < len {
      if at(buf, len, i, "import \"" as *u8) == 1 {
          let s: i64 = i + 8
          var isnx: i64 = 0
          if at(buf, len, s, "nx_" as *u8) == 1 { isnx = 1 }
          if isnx == 0 { bad = bad + 1 }
      }
      i = i + 1
  }
  return bad
94}
95
96func main() -> i64 {
  p("=== nx_sovereign_surface_gate (first byte up, and interoperable BY CONSTRUCTION) ===\n" as *u8)
  var pass: i64 = 0
  let checks: i64 = 6
  let buf: *u8 = sys_mmap(600000) as *u8
101
  // ---------- T1 ★SOVEREIGN SOURCE: no dependency reaches outside the nx_ namespace ----------
  // The whole Breeders + identity stack, scanned off disk. Any `import "` of a non-nx_ target fails.
  let files: *i64 = sys_mmap(32 * 8) as *i64
  files[0] = "runtime/_hdl_build/nx_game_actor.nx" as i64
  files[1] = "runtime/_hdl_build/nx_game_agent.nx" as i64
  files[2] = "runtime/_hdl_build/nx_game_genetics.nx" as i64
  files[3] = "runtime/_hdl_build/nx_game_breed.nx" as i64
  files[4] = "runtime/_hdl_build/nx_game_taming.nx" as i64
  files[5] = "runtime/_hdl_build/nx_breeder_arena.nx" as i64
  files[6] = "runtime/_hdl_build/nx_char_identity.nx" as i64
  files[7] = "runtime/_hdl_build/nx_anatomy_critic.nx" as i64
  files[8] = "runtime/_hdl_build/nx_game_raster.nx" as i64
  files[9] = "runtime/nx_png_write.nx" as i64
  files[10] = "runtime/nx_syscalls.nx" as i64
  let NF: i64 = 11
  var foreign: i64 = 0
  var scanned: i64 = 0
  var missing: i64 = 0
  var i1: i64 = 0
  while i1 < NF {
      let n: i64 = slurp(files[i1] as *u8, buf, 600000)
      if n < 0 { missing = missing + 1 }
      if n > 0 {
          scanned = scanned + 1
          foreign = foreign + foreign_imports(buf, n)
      }
      i1 = i1 + 1
  }
  var t1: i64 = 0
  if foreign == 0 { if scanned == NF { if missing == 0 { t1 = 1 } } }
  if t1 == 1 { pass = pass + 1; p("T1 GREEN sovereign source: " as *u8); pn(scanned); p(" organs scanned ON DISK, " as *u8); pn(foreign); p(" imports outside the nx_ namespace -- the stack cannot reach a third party\n" as *u8) }
  if t1 == 0 { p("T1 RED scanned=" as *u8); pn(scanned); p(" foreign=" as *u8); pn(foreign); p(" missing=" as *u8); pn(missing); nl() }
134
  // ---------- T2 ★THE LEAF IS RAW SYSCALLS -- there is nothing under us but the kernel ----------
  let sl: i64 = slurp("runtime/nx_syscalls.nx" as *u8, buf, 600000)
  let nsys: i64 = count_of(buf, sl, "__syscall(" as *u8)
  let nextern: i64 = count_of(buf, sl, "extern " as *u8)
  let ninc: i64 = count_of(buf, sl, "#include" as *u8)
  // ★MEASURE THE ARTIFACT, NOT THE PROSE. A first version counted the STRING "libc" in the source and
  // went RED at 3 -- all three were COMMENTS, the first of which literally reads "Sovereign path: no
  // libc." Grepping source text cannot tell a dependency from a comment DENYING one, so the strongest
  // evidence of sovereignty was failing the sovereignty check. The real, unfakeable check is the BINARY:
  // a dynamically-linked program must name its loader ("ld-linux") and its libc ("libc.so") in its own
  // string table. Their absence from OUR OWN running ELF is proof no loader is involved.
  let el: i64 = slurp("/tmp/nx_sovereign_surface_gate.sov.elf" as *u8, buf, 600000)
  var loader: i64 = 0
  var libcso: i64 = 0
  var elfmagic: i64 = 0
  if el > 4 {
      if (buf[0] as i64) == 127 { if (buf[1] as i64) == 69 { if (buf[2] as i64) == 76 { if (buf[3] as i64) == 70 { elfmagic = 1 } } } }
      // ⚠SELF-REFERENCE TRAP (measured): searching for the LITERAL "ld-linux" found 2 hits in a
      // statically-linked binary -- because the literal I search FOR is itself compiled into my own
      // string table. A scanner that contains its needle always finds it. So build the needles
      // BYTE-BY-BYTE at runtime; they then never appear contiguously in the ELF being scanned.
      let n1: *u8 = sys_mmap(16) as *u8
      n1[0] = 108 as u8; n1[1] = 100 as u8; n1[2] = 45 as u8; n1[3] = 108 as u8   // l d - l
      n1[4] = 105 as u8; n1[5] = 110 as u8; n1[6] = 117 as u8; n1[7] = 120 as u8  // i n u x
      n1[8] = 0 as u8
      let n2: *u8 = sys_mmap(16) as *u8
      n2[0] = 108 as u8; n2[1] = 105 as u8; n2[2] = 98 as u8; n2[3] = 99 as u8    // l i b c
      n2[4] = 46 as u8; n2[5] = 115 as u8; n2[6] = 111 as u8                       // . s o
      n2[7] = 0 as u8
      loader = count_of(buf, el, n1)
      libcso = count_of(buf, el, n2)
  }
  var t2: i64 = 0
  if sl > 0 { if nsys > 20 { if nextern == 0 { if ninc == 0 {
      if elfmagic == 1 { if loader == 0 { if libcso == 0 { t2 = 1 } } }
  } } } }
  // ⚠SELF-REFERENCE, ROUND TWO: this message must NOT spell the needles out either. The first version
  // said "...contains 0 'ld-linux' and 0 'libc.so' strings", and that sentence is itself compiled into
  // the binary -- so the scan kept finding 1 of each, inside its own PASS message. A scanner that
  // reports what it searches for contaminates its own haystack. Name the concepts, never the literals.
  if t2 == 1 { pass = pass + 1; p("T2 GREEN the leaf is the KERNEL: nx_syscalls makes " as *u8); pn(nsys); p(" raw __syscall calls (0 extern, 0 #include), and OUR OWN " as *u8); pn(el); p("-byte ELF carries ZERO dynamic-loader references and ZERO C-library references -- nothing runs beneath us but the kernel\n" as *u8) }
  if t2 == 0 { p("T2 RED syscalls=" as *u8); pn(nsys); p(" extern=" as *u8); pn(nextern); p(" include=" as *u8); pn(ninc); p(" elf=" as *u8); pn(el); p(" magic=" as *u8); pn(elfmagic); p(" loaderrefs=" as *u8); pn(loader); p(" clibrefs=" as *u8); pn(libcso); nl() }
177
  // ---------- T3 THE SHARED FRAMEBUFFER CONTRACT (NishiOS + browser read the SAME words) ----------
  // gr_pack must place R in byte0, G in byte1, B in byte2 of the i64. The browser canvas blit reads
  // mem[b+0..2] straight out of linear memory; the sovereign display controller consumes the same
  // word. If this byte order ever drifts, EVERY surface breaks at once -- so it is pinned here.
  let probe: i64 = gr_pack(0x12, 0x34, 0x56)
  var t3: i64 = 0
  if (probe & 255) == 0x12 {
      if ((probe >> 8) & 255) == 0x34 {
          if ((probe >> 16) & 255) == 0x56 {
              if gr_r(probe) == 0x12 { if gr_g(probe) == 0x34 { if gr_b(probe) == 0x56 { t3 = 1 } } }
          }
      }
  }
  if t3 == 1 { pass = pass + 1; p("T3 GREEN one framebuffer contract: R=byte0 G=byte1 B=byte2 of the packed i64 -- the exact word order NishiOS's display path AND the browser canvas blit both consume, with no conversion layer between them\n" as *u8) }
  if t3 == 0 { p("T3 RED packing drifted: " as *u8); pn(probe); nl() }
193
  // ---------- T4 ONE FRAME -> EVERY SINK, byte-exact, using only our own encoders ----------
  let fb: *i64 = sys_mmap(TW*TH*8) as *i64
  let idv: *i64 = sys_mmap(IDV_SLOTS * 8) as *i64
  idv_from_seed(idv, 20260727)
  gr_clear(fb, TW, TH, gr_pack(9, 8, 20))
  gr_rect(fb, TW, TH, 8, 8, 60, 30, idv[IDV_SKIN])
  gr_disc(fb, TW, TH, 70, 40, 12, idv[IDV_HAIR])
  gr_text(fb, TW, TH, 6, 46, "NISHI" as *u8, gr_pack(240,236,255))
  // sink A -- the BROWSER path: the canvas reads bytes 0,1,2 of each i64 out of linear memory
  let rgb: *u8 = sys_mmap(TW*TH*3) as *u8
  var q: i64 = 0
  while q < TW*TH {
      let v: i64 = fb[q]
      rgb[q*3] = (v & 255) as u8
      rgb[q*3+1] = ((v >> 8) & 255) as u8
      rgb[q*3+2] = ((v >> 16) & 255) as u8
      q = q + 1
  }
  // every RGB triple must equal the packed word it came from -- no lossy step anywhere
  var mismatch: i64 = 0
  var z: i64 = 0
  while z < TW*TH {
      let v: i64 = fb[z]
      if (rgb[z*3] as i64) != (v & 255) { mismatch = mismatch + 1 }
      if (rgb[z*3+1] as i64) != ((v >> 8) & 255) { mismatch = mismatch + 1 }
      if (rgb[z*3+2] as i64) != ((v >> 16) & 255) { mismatch = mismatch + 1 }
      z = z + 1
  }
  // sink B -- PNG, via OUR encoder
  let wrote: i64 = nx_png_write_rgb("knowledge/nx_sov_surface.png" as *u8, rgb, TW, TH)
  let pl: i64 = slurp("knowledge/nx_sov_surface.png" as *u8, buf, 600000)
  var magic_ok: i64 = 0
  if pl > 8 {
      if (buf[0] as i64) == 137 { if (buf[1] as i64) == 80 { if (buf[2] as i64) == 78 { if (buf[3] as i64) == 71 { magic_ok = 1 } } } }
  }
  var t4: i64 = 0
  if mismatch == 0 { if wrote >= 0 { if magic_ok == 1 { if pl > 1000 { t4 = 1 } } } }
  if t4 == 1 { pass = pass + 1; p("T4 GREEN one frame -> every sink: " as *u8); pn(TW*TH); p(" px to the browser byte-layout with 0 mismatches, and a " as *u8); pn(pl); p("-byte PNG from OUR OWN encoder (magic 137 80 78 71) -- no third-party codec in the chain\n" as *u8) }
  if t4 == 0 { p("T4 RED mismatch=" as *u8); pn(mismatch); p(" wrote=" as *u8); pn(wrote); p(" pnglen=" as *u8); pn(pl); nl() }
233
  // ---------- T5 ★PORTABILITY BY CONSTRUCTION: integer-only => ISA-independent result ----------
  // The reason this can move to aarch64 (Android) or Windows is that nothing in the render path uses
  // floating point, so there is no FPU rounding mode, no x87 80-bit intermediate, no fast-math skew.
  // Two independent renders of the same identity must be BIT-IDENTICAL; and the source must contain
  // no float types at all. That is what makes "same bytes on another ISA" a property, not a hope.
  let fb2: *i64 = sys_mmap(TW*TH*8) as *i64
  let idv2: *i64 = sys_mmap(IDV_SLOTS * 8) as *i64
  idv_from_seed(idv2, 20260727)
  gr_clear(fb2, TW, TH, gr_pack(9, 8, 20))
  gr_rect(fb2, TW, TH, 8, 8, 60, 30, idv2[IDV_SKIN])
  gr_disc(fb2, TW, TH, 70, 40, 12, idv2[IDV_HAIR])
  gr_text(fb2, TW, TH, 6, 46, "NISHI" as *u8, gr_pack(240,236,255))
  var diff: i64 = 0
  var ck: i64 = 1469598103
  var d5: i64 = 0
  while d5 < TW*TH {
      if fb[d5] != fb2[d5] { diff = diff + 1 }
      ck = ((ck ^ fb[d5]) * 1099511) & 4611686018427387903
      d5 = d5 + 1
  }
  // no floating point anywhere in the render path's own sources
  var floats: i64 = 0
  var f5: i64 = 0
  while f5 < NF {
      let n: i64 = slurp(files[f5] as *u8, buf, 600000)
      if n > 0 {
          floats = floats + count_of(buf, n, ": f64" as *u8)
          floats = floats + count_of(buf, n, ": f32" as *u8)
      }
      f5 = f5 + 1
  }
  var t5: i64 = 0
  if diff == 0 { if floats == 0 { if ck != 0 { t5 = 1 } } }
  if t5 == 1 { pass = pass + 1; p("T5 GREEN portable BY CONSTRUCTION: byte-identical re-render (frame ck " as *u8); pn(ck); p(") and " as *u8); pn(floats); p(" float declarations across the stack -- no FPU rounding to diverge on aarch64/ARM or Windows\n" as *u8) }
  if t5 == 0 { p("T5 RED diff=" as *u8); pn(diff); p(" floats=" as *u8); pn(floats); nl() }
269
  // ---------- T6 HONEST NON-CLAIM: what is proven vs what is merely reachable ----------
  // A gate that lets us claim Android today would be a liar. Proven here: sovereign source, kernel leaf,
  // one shared fb contract, our own encoders, ISA-independent determinism. NOT proven here: an actual
  // aarch64 or Windows BUILD of this stack. That is the graphics lane's Gx-2 rung. This tooth exists so
  // the distinction is recorded in the gate output itself and cannot quietly rot into an overclaim.
  var t6: i64 = 0
  if t1 == 1 { if t3 == 1 { if t5 == 1 { t6 = 1 } } }
  if t6 == 1 { pass = pass + 1; p("T6 GREEN honest boundary recorded: PROVEN = sovereign source + kernel leaf + one fb contract + our encoders + ISA-independent determinism. NOT PROVEN = an actual aarch64/Windows build of this stack (Gx-2 rung). Interoperability is EARNED here, not claimed.\n" as *u8) }
  if t6 == 0 { p("T6 RED prerequisites unmet\n" as *u8) }
279
  p("nx_sovereign_surface_gate: " as *u8); pn(pass); p("/" as *u8); pn(checks); nl()
  if pass == checks { p("VERDICT GREEN\n" as *u8); return 0 }
  p("VERDICT RED\n" as *u8)
  return 1
284}
nx_sovereign_surface_gate.nx source

`nx_sovereign_surface_gate.nx` source
