nx_sovereignty_audit.nx source
↩ module page · 528 lines · 27893 B
1// nx_sovereignty_audit.nx -- the team's SOVEREIGNTY-PURITY auditor.
2//
3// module: nishi-core.audit.sovereignty_audit
4// depends: nishi-core.storage.seg_store, nishi-core.io.syscalls
5// capability: AUDIT
6// license_tier: ORIGINAL
7//
8// MISSION: a sovereignty-obsessed operator needs a sovereignty tool that is
9// ITSELF perfectly sovereign. This organ recursively walks the WHOLE repo tree
10// (its OWN bounded getdents64 work-stack -- no find/grep/python/sqlite, no
11// shelling out, pure .nx), classifies EVERY file's sovereignty status with a
12// DATA-DRIVEN policy, PERSISTS every PRODUCT-CONTAMINANT (+ a summary) to the
13// sovereign seg_store so the debt is SEARCHABLE (ss_term later), and SELF-GATES
14// with a positive + negative control liar-kill before printing GREEN.
15//
16// CLASSIFICATION (data-driven; the policy IS the tables below):
17// ext SOVEREIGN = .nx / .md / .nxgate
18// ext CANDIDATE-NONSOV = .py .sh .js .mjs .ts .tsv .conf .toml .json .css .html
19// zone FENCED-REFERENCE = path contains /bench/ /.alelane/ /node_modules/
20// /_scratch/ /.build/ /.git/ (Law-1 allowed reference)
21// zone PRODUCT = everything else
22// per-file verdict:
23// SOVEREIGN = .nx/.md/.nxgate anywhere
24// FENCED-REFERENCE = candidate-non-sov in a fenced zone (allowed)
25// PRODUCT-CONTAMINANT = candidate-non-sov in PRODUCT zone (the REAL debt)
26// product_purity_permil = (n_product_files - n_product_contaminant)*1000
27// / n_product_files (files OUTSIDE fenced zones)
28//
29// LANDMINES DODGED (from the ecosystem's own registry):
30// - DOUBLE-IMPORT of syscalls -> nxasm rc6. nx_dir.nx imports "syscalls.nx"
31// (+nx_fcntl+nx_dirent) while nx_seg_store imports "nx_syscalls.nx"; pulling
32// both double-defines sys_* and fails to build. So this organ imports the
33// PROVEN-SAFE pair (nx_seg_store + nx_syscalls, the exact set nx_workstream_
34// store.nx uses) and does its OWN raw getdents64 walk.
35// - The NxDirent STRUCT path crashes signal-11 under nx_cc_sovereign
36// (nx_nas_book_census.nx header). So we walk struct-free over raw dirent
37// bytes via dirent_reclen/dirent_type/dirent_name -- the proven shape.
38// - JPL bounded-loop discipline: explicit budgets on dirs + files + iters; a
39// cap HIT is reported LOUD (capped=1), never a silent truncation.
40import "nx_seg_store.nx"
41import "nx_syscalls.nx"
42const SAV_MAGIC_8192: i64 = 8192
43
44const SAV_PREFIX: *u8 = "knowledge/store/sovaudit-"
45const SAV_LOG: *u8 = "knowledge/status/sovereignty_audit.log"
46
47// ---- bounded budgets (JPL rule 2) ----
48const SAV_MAX_DIRS: i64 = 60000 // pending-dir stack ceiling
49const SAV_MAX_FILES: i64 = 400000 // classified-file ceiling
50const SAV_ITER_CAP: i64 = 2000000 // hard dir-pop ceiling (symlink-loop guard)
51const SAV_DIRBUF: i64 = 1048576 // getdents64 batch buffer (1 MiB)
52const SAV_DIR_ARENA: i64 = 268435456 // 256 MiB of dir-path bytes
53const SAV_TOPK: i64 = 15 // contaminant paths echoed to stdout
54
55// ---- io helpers (mirror the census _p / _fn shape) ----
56func sav_w(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
57func sav_wn(fd: i64, buf: *u8, n: i64) -> i64 { sys_write(fd, buf, n); return 0 }
58func sav_n(fd: i64, v: i64) -> i64 {
59 let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m; sys_write(fd,"-" as *u8,1)}
60 let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1}
61 while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}
62 var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0
63}
64func sav_p(s: *u8) -> i64 { sav_w(1, s); return 0 }
65func sav_pn(v: i64) -> i64 { sav_n(1, v); return 0 }
66// write to BOTH stdout (gate evidence) and the durable log (Examiner grades)
67func sav_w2(lfd: i64, s: *u8) -> i64 { sav_w(1, s); if lfd >= 0 { sav_w(lfd, s) } return 0 }
68func sav_n2(lfd: i64, v: i64) -> i64 { sav_n(1, v); if lfd >= 0 { sav_n(lfd, v) } return 0 }
69
70func sav_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
71
72// ASCII lower of one byte
73func sav_lc(c: i64) -> i64 { if c >= 65 { if c <= 90 { return c + 32 } } return c }
74
75// exact (already-lowercased) string equality
76func sav_streq(a: *u8, b: *u8) -> i64 {
77 var i: i64 = 0
78 while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
79 if b[i] != (0 as u8) { return 0 }
80 return 1
81}
82
83// substring scan over a NUL-terminated haystack (zone fences)
84func sav_has(hay: *u8, needle: *u8) -> i64 {
85 let hn: i64 = sav_slen(hay)
86 let nl: i64 = sav_slen(needle)
87 if nl == 0 { return 0 }
88 var i: i64 = 0
89 while i + nl <= hn {
90 var k: i64 = 0
91 var hit: i64 = 1
92 while k < nl { if hay[i+k] != needle[k] { hit = 0; k = nl } else { k = k + 1 } }
93 if hit == 1 { return 1 }
94 i = i + 1
95 }
96 return 0
97}
98
99// ---- DATA-DRIVEN EXTENSION TABLES (already lowercase, no leading dot) ----
100// SOVEREIGN extensions
101const SAV_NSOV: i64 = 3
102func sav_sov_ext(i: i64) -> *u8 {
103 if i == 0 { return "nx" as *u8 }
104 if i == 1 { return "md" as *u8 }
105 if i == 2 { return "nxgate" as *u8 }
106 return "" as *u8
107}
108// CANDIDATE-NON-SOVEREIGN extensions (debt iff in PRODUCT zone)
109const SAV_NCAND: i64 = 11
110func sav_cand_ext(i: i64) -> *u8 {
111 if i == 0 { return "py" as *u8 }
112 if i == 1 { return "sh" as *u8 }
113 if i == 2 { return "js" as *u8 }
114 if i == 3 { return "mjs" as *u8 }
115 if i == 4 { return "ts" as *u8 }
116 if i == 5 { return "tsv" as *u8 }
117 if i == 6 { return "conf" as *u8 }
118 if i == 7 { return "toml" as *u8 }
119 if i == 8 { return "json" as *u8 }
120 if i == 9 { return "css" as *u8 }
121 if i == 10 { return "html" as *u8 }
122 return "" as *u8
123}
124// FENCED-REFERENCE zone substrings (Law-1 allowed reference)
125const SAV_NFENCE: i64 = 18
126func sav_fence(i: i64) -> *u8 {
127 if i == 0 { return "/bench/" as *u8 }
128 if i == 1 { return "/.alelane/" as *u8 }
129 if i == 2 { return "/node_modules/" as *u8 }
130 if i == 3 { return "/_scratch/" as *u8 }
131 if i == 4 { return "/.build/" as *u8 }
132 if i == 5 { return "/.git/" as *u8 }
133 if i == 6 { return "/_retired/" as *u8 } // janitor-retired files: backed-up in seg_store, out of the product zone
134 if i == 7 { return "/_quarantine/" as *u8 } // janitor-quarantined orphans/dead files: removed from active use, not product
135 // 3rd-party REFERENCE corpora (Law-1 allowed reference; appended 2026-06-28, s-class-IM migration census).
136 // External test-suite / captured sites / fetched raw / papers / corpus -- kept as reference, NOT our product
137 // debt (same status as node_modules/.git). Reversible (delete a row). Debt drop is MEASURED by re-running.
138 if i == 8 { return "/wpt/" as *u8 }
139 if i == 9 { return "/captured_site/" as *u8 }
140 if i == 10 { return "/fetched/" as *u8 }
141 if i == 11 { return "/papers/" as *u8 }
142 if i == 12 { return "/corpus/" as *u8 }
143 if i == 13 { return "/_archive_auto" as *u8 } // dated auto-archives (_archive_auto_*): dead snapshots, not active product
144 // BUILD-OUTPUT dirs (appended 2026-06-28): _offc* = compiled .elf + build/test artifacts + packaging tooling =
145 // build OUTPUT not product SOURCE (same class as /.build/, already fenced). Reversible; makes debt accurate.
146 if i == 14 { return "/_offc/" as *u8 }
147 if i == 15 { return "/_offc_pack/" as *u8 }
148 if i == 16 { return "/_offc_bundle/" as *u8 }
149 if i == 17 { return "/_offc_batch/" as *u8 }
150 return "" as *u8
151}
152
153// extract lowercased extension (after last '.') of a NUL-terminated name into
154// extbuf (NUL-terminated). returns ext length (0 = no dot / empty ext).
155func sav_ext_of(name: *u8, extbuf: *u8) -> i64 {
156 var dotp: i64 = 0 - 1
157 var x: i64 = 0
158 while name[x] != (0 as u8) { if name[x] == (46 as u8) { dotp = x } x = x + 1 }
159 if dotp < 0 { extbuf[0] = 0 as u8; return 0 }
160 var e: i64 = 0
161 var y: i64 = dotp + 1
162 while name[y] != (0 as u8) { if e < 62 { extbuf[e] = sav_lc(name[y] as i64) as u8; e = e + 1 } y = y + 1 }
163 extbuf[e] = 0 as u8
164 return e
165}
166
167// is this lowercased extension in the SOVEREIGN set?
168func sav_is_sov_ext(extlc: *u8) -> i64 {
169 var i: i64 = 0
170 while i < SAV_NSOV { if sav_streq(extlc, sav_sov_ext(i)) == 1 { return 1 } i = i + 1 }
171 return 0
172}
173// is this lowercased extension in the CANDIDATE-NON-SOV set?
174func sav_is_cand_ext(extlc: *u8) -> i64 {
175 var i: i64 = 0
176 while i < SAV_NCAND { if sav_streq(extlc, sav_cand_ext(i)) == 1 { return 1 } i = i + 1 }
177 return 0
178}
179// candidate-ext INDEX (0..NCAND-1) or -1 -- for the per-ext debt histogram.
180func sav_cand_ext_idx(extlc: *u8) -> i64 {
181 var i: i64 = 0
182 while i < SAV_NCAND { if sav_streq(extlc, sav_cand_ext(i)) == 1 { return i } i = i + 1 }
183 return 0 - 1
184}
185// coarse debt class of a candidate-ext index (the honest 3-way split of the debt):
186// 1 = THIRDPARTY_LANG (py/sh/ts/mjs -- third-party source language: KILL)
187// 2 = NONSOV_FORMAT (tsv/conf/toml/json -- non-sovereign data/config: MIGRATE to seg_store)
188// 3 = WEB_BOUNDARY (js/css/html -- Law-1 browser boundary: REVIEW emitted-vs-vendored)
189func sav_class_of(ei: i64) -> i64 {
190 if ei == 0 { return 1 }
191 if ei == 1 { return 1 }
192 if ei == 3 { return 1 }
193 if ei == 4 { return 1 }
194 if ei == 5 { return 2 }
195 if ei == 6 { return 2 }
196 if ei == 7 { return 2 }
197 if ei == 8 { return 2 }
198 if ei == 2 { return 3 }
199 if ei == 9 { return 3 }
200 if ei == 10 { return 3 }
201 return 0
202}
203
204// is this full path inside a FENCED-REFERENCE zone?
205func sav_is_fenced(path: *u8) -> i64 {
206 var i: i64 = 0
207 while i < SAV_NFENCE { if sav_has(path, sav_fence(i)) == 1 { return 1 } i = i + 1 }
208 return 0
209}
210
211// ---- the per-file VERDICT classifier (the policy, in one place) ----
212// returns: 1 = SOVEREIGN, 2 = FENCED-REFERENCE, 3 = PRODUCT-CONTAMINANT,
213// 0 = OTHER (neither sovereign nor candidate-non-sov, e.g. .png/.bin)
214// extbuf is caller scratch (>=64 bytes).
215func sav_classify(path: *u8, name: *u8, extbuf: *u8) -> i64 {
216 sav_ext_of(name, extbuf)
217 if sav_is_sov_ext(extbuf) == 1 { return 1 } // .nx/.md/.nxgate anywhere
218 if sav_is_cand_ext(extbuf) == 1 {
219 if sav_is_fenced(path) == 1 { return 2 } // allowed reference
220 return 3 // PRODUCT-CONTAMINANT (the debt)
221 }
222 return 0
223}
224
225// verdict name (for log / store value tagging)
226func sav_vname(v: i64) -> *u8 {
227 if v == 1 { return "SOVEREIGN" as *u8 }
228 if v == 2 { return "FENCED-REFERENCE" as *u8 }
229 if v == 3 { return "PRODUCT-CONTAMINANT" as *u8 }
230 return "OTHER" as *u8
231}
232
233// ---- small value-builder helpers (defined BEFORE main: NishiLang resolves
234// top-down, mirroring nx_competitive_census which defines all helpers first) ----
235func sav_catstr(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){ dst[off+i]=s[i]; i=i+1 } return off+i }
236func sav_catnum(dst: *u8, off: i64, v: i64) -> i64 {
237 var m: i64=v; var o: i64=off
238 if m<0 { dst[o]=45 as u8; o=o+1; m=0-m }
239 let t: *u8=sys_mmap(28); var k: i64=0
240 if m==0 { t[0]=48 as u8; k=1 }
241 while m>0 { t[k]=(48+(m%10)) as u8; m=m/10; k=k+1 }
242 var i: i64=0; while i<k { dst[o+i]=t[k-1-i]; i=i+1 }
243 return o+k
244}
245
246func main() -> i64 {
247 sav_p("SOVAUDIT: start (sovereign recursive sovereignty-purity walk)\n" as *u8)
248
249 // ---- arenas (mmap; bounded) ----
250 let parena: *u8 = sys_mmap(SAV_DIR_ARENA + 64) // dir-path bytes for the work-stack
251 var pused: i64 = 0
252 let stkoff: *i64 = sys_mmap(SAV_MAX_DIRS * 8) as *i64 // stack of parena-offsets
253 var sp: i64 = 0
254 let dirbuf: *u8 = sys_mmap(SAV_DIRBUF + 64) // getdents64 batch buffer
255 let childbuf: *u8 = sys_mmap(SAV_MAGIC_8192) // assembled child path
256 let extbuf: *u8 = sys_mmap(64) // lowercased extension scratch
257
258 // ---- the sovereign store writer (every PRODUCT-CONTAMINANT -> a record) ----
259 let w: *i64 = ss_begin()
260 let valbuf: *u8 = sys_mmap(512) // store value scratch
261
262 // ---- top-K contaminant path echo: keep first SAV_TOPK full paths ----
263 let topk_arena: *u8 = sys_mmap(SAV_TOPK * SAV_MAGIC_8192)
264 var topk_n: i64 = 0
265
266 // ---- counters ----
267 var total: i64 = 0
268 var n_sovereign: i64 = 0
269 var n_fenced: i64 = 0
270 var n_contam: i64 = 0
271 var n_other: i64 = 0
272 var n_product_files: i64 = 0 // files OUTSIDE fenced zones (sov + contam + product-other)
273 var dirs_walked: i64 = 0
274 var open_fail: i64 = 0
275 var capped: i64 = 0 // LOUD: a budget ceiling was hit
276 let ext_count: *i64 = sys_mmap(SAV_NCAND * 8) as *i64 // per-ext contaminant histogram
277 let class_count: *i64 = sys_mmap(64) as *i64 // coarse debt classes [1..3]
278 var zz: i64 = 0
279 while zz < SAV_NCAND { ext_count[zz] = 0; zz = zz + 1 }
280 zz = 0
281 while zz < 8 { class_count[zz] = 0; zz = zz + 1 }
282
283 // ---- seed the walk at "." (sovereign run cwd = repo root) ----
284 parena[pused] = 46 as u8; pused = pused + 1 // '.'
285 parena[pused] = 0 as u8; pused = pused + 1
286 stkoff[sp] = 0; sp = sp + 1
287
288 // ---- bounded walk: pop a dir, getdents64 it, classify files, push child dirs ----
289 var iters: i64 = 0
290 while sp > 0 {
291 if iters >= SAV_ITER_CAP { capped = 1; sp = 0 }
292 else {
293 iters = iters + 1
294 sp = sp - 1
295 let doff: i64 = stkoff[sp]
296 let dpath: *u8 = (parena as i64 + doff) as *u8
297 let dlen: i64 = sav_slen(dpath)
298
299 let dfd: i64 = sys_openat_rd(dpath)
300 if dfd < 0 { open_fail = open_fail + 1 }
301 else {
302 dirs_walked = dirs_walked + 1
303 var done: i64 = 0
304 while done == 0 {
305 let nb: i64 = sys_getdents64(dfd, dirbuf, SAV_DIRBUF)
306 if nb <= 0 { done = 1 }
307 else {
308 var off: i64 = 0
309 while off < nb {
310 let rec: *u8 = (dirbuf as i64 + off) as *u8
311 let rl: i64 = dirent_reclen(rec)
312 if rl <= 0 { off = nb }
313 else {
314 let nm: *u8 = dirent_name(rec)
315 let dt: i64 = dirent_type(rec)
316 // skip "." and ".."
317 var skip: i64 = 0
318 if nm[0] == (46 as u8) {
319 if nm[1] == (0 as u8) { skip = 1 }
320 else { if nm[1] == (46 as u8) { if nm[2] == (0 as u8) { skip = 1 } } }
321 }
322 // SKIP the .git tree entirely (per spec): never descend, never classify
323 if skip == 0 {
324 if nm[0] == (46 as u8) { if nm[1] == (103 as u8) { if nm[2] == (105 as u8) { if nm[3] == (116 as u8) { if nm[4] == (0 as u8) { skip = 1 } } } } }
325 }
326 if skip == 0 {
327 // assemble childpath = dpath + "/" + nm (into childbuf)
328 var cw: i64 = 0
329 var z: i64 = 0
330 while z < dlen { childbuf[cw] = dpath[z]; cw = cw + 1; z = z + 1 }
331 childbuf[cw] = 47 as u8; cw = cw + 1
332 var nl: i64 = 0
333 while nm[nl] != (0 as u8) { childbuf[cw] = nm[nl]; cw = cw + 1; nl = nl + 1 }
334 childbuf[cw] = 0 as u8
335 let clen: i64 = cw
336
337 if dt == 4 {
338 // DT_DIR: push child onto the work-stack (descend later)
339 if sp < SAV_MAX_DIRS {
340 if pused + clen + 1 < SAV_DIR_ARENA {
341 let cbase: i64 = pused
342 var q: i64 = 0
343 while q < clen { parena[pused] = childbuf[q]; pused = pused + 1; q = q + 1 }
344 parena[pused] = 0 as u8; pused = pused + 1
345 stkoff[sp] = cbase
346 sp = sp + 1
347 } else { capped = 1 }
348 } else { capped = 1 }
349 } else {
350 if dt == 10 { } else {
351 // DT_REG (8) OR DT_UNKNOWN (0; drvfs/9p often returns 0) -> classify.
352 if total >= SAV_MAX_FILES { capped = 1 } else {
353 let v: i64 = sav_classify(childbuf, nm, extbuf)
354 total = total + 1
355 // PRODUCT-zone membership = NOT fenced (independent of ext)
356 var fenced: i64 = sav_is_fenced(childbuf)
357 if fenced == 0 { n_product_files = n_product_files + 1 }
358 if v == 1 { n_sovereign = n_sovereign + 1 }
359 if v == 2 { n_fenced = n_fenced + 1 }
360 if v == 0 { n_other = n_other + 1 }
361 if v == 3 {
362 n_contam = n_contam + 1
363 // per-ext + per-class debt histogram (extbuf still holds this file's ext)
364 let ei: i64 = sav_cand_ext_idx(extbuf)
365 if ei >= 0 {
366 ext_count[ei] = ext_count[ei] + 1
367 let cls: i64 = sav_class_of(ei)
368 if cls >= 1 { if cls <= 3 { class_count[cls] = class_count[cls] + 1 } }
369 }
370 // ---- PERSIST: key = full path, value = tagged status ----
371 var vo: i64 = 0
372 var s2: i64 = 0
373 let tag: *u8 = "PRODUCT-CONTAMINANT\text=" as *u8
374 while tag[s2] != (0 as u8) { valbuf[vo] = tag[s2]; vo = vo + 1; s2 = s2 + 1 }
375 var s3: i64 = 0
376 while extbuf[s3] != (0 as u8) { valbuf[vo] = extbuf[s3]; vo = vo + 1; s3 = s3 + 1 }
377 // a key MUST be NUL-terminated for ss_add (it ss_len's it)
378 childbuf[clen] = 0 as u8
379 ss_add(w, 1, childbuf, valbuf, vo)
380 // keep the first SAV_TOPK paths for the stdout summary
381 if topk_n < SAV_TOPK {
382 let base: i64 = topk_n * SAV_MAGIC_8192
383 var tk: i64 = 0
384 while tk < clen { topk_arena[base + tk] = childbuf[tk]; tk = tk + 1 }
385 topk_arena[base + clen] = 0 as u8
386 topk_n = topk_n + 1
387 }
388 }
389 }
390 }
391 }
392 }
393 off = off + rl
394 }
395 }
396 }
397 }
398 sys_close(dfd)
399 }
400 }
401 }
402
403 // ---- product purity (files outside fenced zones; clean = no contaminants) ----
404 var purity: i64 = 1000
405 if n_product_files > 0 { purity = ((n_product_files - n_contam) * 1000) / n_product_files }
406
407 // ---- SELF-VALIDATING GATE: positive + negative controls (the liar-kill) ----
408 // POSITIVE: a known sovereign path MUST classify SOVEREIGN.
409 let cp_name: *u8 = "nx_dir.nx" as *u8
410 let cp_path: *u8 = "runtime/nx_dir.nx" as *u8
411 let ctl_pos_v: i64 = sav_classify(cp_path, cp_name, extbuf)
412 var ctl_pos: i64 = 0
413 if ctl_pos_v == 1 { ctl_pos = 1 }
414 // NEGATIVE-A: a real PRODUCT-zone .py MUST classify PRODUCT-CONTAMINANT.
415 let cn_name: *u8 = "_library_server.py" as *u8
416 let cn_path: *u8 = "runtime/_hdl_build/_library_server.py" as *u8
417 let ctl_negA_v: i64 = sav_classify(cn_path, cn_name, extbuf)
418 // NEGATIVE-B: a fenced-zone .py MUST classify FENCED-REFERENCE (Law-1 allowed).
419 // The walker emits paths rooted at "./", so the realistic fenced path the
420 // fence substrings ("/bench/" etc.) match is "./bench/...". Using the bare
421 // "bench/..." form would (correctly) MISS the leading-slash fence and read
422 // as a contaminant -- the control must mirror what the walk actually produces.
423 let cb_name: *u8 = "thing.py" as *u8
424 let cb_path: *u8 = "./bench/ops/thing.py" as *u8
425 let ctl_negB_v: i64 = sav_classify(cb_path, cb_name, extbuf)
426 var ctl_neg: i64 = 0
427 if ctl_negA_v == 3 { if ctl_negB_v == 2 { ctl_neg = 1 } }
428
429 // ---- PERSIST: summary record (the searchable tally) ----
430 var so: i64 = 0
431 let sm0: *u8 = "SOVAUDIT-SUMMARY total=" as *u8
432 var k0: i64 = 0; while sm0[k0]!=(0 as u8){ valbuf[so]=sm0[k0]; so=so+1; k0=k0+1 }
433 so = sav_catnum(valbuf, so, total)
434 so = sav_catstr(valbuf, so, " sovereign=" as *u8); so = sav_catnum(valbuf, so, n_sovereign)
435 so = sav_catstr(valbuf, so, " fenced=" as *u8); so = sav_catnum(valbuf, so, n_fenced)
436 so = sav_catstr(valbuf, so, " product_contaminant=" as *u8); so = sav_catnum(valbuf, so, n_contam)
437 so = sav_catstr(valbuf, so, " product_files=" as *u8); so = sav_catnum(valbuf, so, n_product_files)
438 so = sav_catstr(valbuf, so, " product_purity_permil=" as *u8); so = sav_catnum(valbuf, so, purity)
439 ss_add(w, 1, "__sovaudit_summary__" as *u8, valbuf, so)
440
441 // ---- PERSIST: breakdown record (searchable: debt classes + per-ext histogram) ----
442 var bo: i64 = 0
443 bo = sav_catstr(valbuf, bo, "SOVAUDIT-BREAKDOWN thirdparty_lang=" as *u8); bo = sav_catnum(valbuf, bo, class_count[1])
444 bo = sav_catstr(valbuf, bo, " nonsov_format=" as *u8); bo = sav_catnum(valbuf, bo, class_count[2])
445 bo = sav_catstr(valbuf, bo, " web_boundary=" as *u8); bo = sav_catnum(valbuf, bo, class_count[3])
446 bo = sav_catstr(valbuf, bo, " genuine_debt=" as *u8); bo = sav_catnum(valbuf, bo, class_count[1] + class_count[2])
447 var bx: i64 = 0
448 while bx < SAV_NCAND {
449 bo = sav_catstr(valbuf, bo, " " as *u8); bo = sav_catstr(valbuf, bo, sav_cand_ext(bx))
450 bo = sav_catstr(valbuf, bo, "=" as *u8); bo = sav_catnum(valbuf, bo, ext_count[bx])
451 bx = bx + 1
452 }
453 ss_add(w, 1, "__sovaudit_breakdown__" as *u8, valbuf, bo)
454
455 // ---- COMMIT the segment (crash-safe; builds the searchable term index) ----
456 let crc: i64 = ss_commit(SAV_PREFIX, w, 0)
457
458 // ---- final GREEN/RED verdict ----
459 // GREEN requires: walk produced files, controls held, no cap hit, commit ok.
460 var verdict_green: i64 = 1
461 if total <= 0 { verdict_green = 0 }
462 if ctl_pos != 1 { verdict_green = 0 }
463 if ctl_neg != 1 { verdict_green = 0 }
464 if capped != 0 { verdict_green = 0 }
465 if crc != 0 { verdict_green = 0 }
466
467 // ---- author the SOVAUDIT verdict line to BOTH stdout + the durable log ----
468 let lfd: i64 = sys_openat_append(SAV_LOG, 420)
469 sav_w2(lfd, "SOVAUDIT epoch=" as *u8); sav_n2(lfd, sys_now_realtime_sec())
470 sav_w2(lfd, " files=" as *u8); sav_n2(lfd, total)
471 sav_w2(lfd, " sovereign=" as *u8); sav_n2(lfd, n_sovereign)
472 sav_w2(lfd, " fenced=" as *u8); sav_n2(lfd, n_fenced)
473 sav_w2(lfd, " product_contaminant=" as *u8); sav_n2(lfd, n_contam)
474 sav_w2(lfd, " product_files=" as *u8); sav_n2(lfd, n_product_files)
475 sav_w2(lfd, " product_purity_permil=" as *u8); sav_n2(lfd, purity)
476 sav_w2(lfd, " other=" as *u8); sav_n2(lfd, n_other)
477 sav_w2(lfd, " dirs=" as *u8); sav_n2(lfd, dirs_walked)
478 sav_w2(lfd, " open_fail=" as *u8); sav_n2(lfd, open_fail)
479 sav_w2(lfd, " capped=" as *u8); sav_n2(lfd, capped)
480 sav_w2(lfd, " commit_rc=" as *u8); sav_n2(lfd, crc)
481 sav_w2(lfd, " ctl_pos=" as *u8); sav_n2(lfd, ctl_pos)
482 sav_w2(lfd, " ctl_neg=" as *u8); sav_n2(lfd, ctl_neg)
483 sav_w2(lfd, " thirdparty_lang=" as *u8); sav_n2(lfd, class_count[1])
484 sav_w2(lfd, " nonsov_format=" as *u8); sav_n2(lfd, class_count[2])
485 sav_w2(lfd, " web_boundary=" as *u8); sav_n2(lfd, class_count[3])
486 sav_w2(lfd, " genuine_debt=" as *u8); sav_n2(lfd, class_count[1] + class_count[2])
487 if verdict_green == 1 { sav_w2(lfd, " verdict=GREEN\n" as *u8) } else { sav_w2(lfd, " verdict=RED\n" as *u8) }
488 if lfd >= 0 { sys_close(lfd) }
489
490 // ---- human-readable summary to stdout (counts + top contaminant paths) ----
491 sav_p("SOVAUDIT human-summary:\n" as *u8)
492 sav_p(" total_files = " as *u8); sav_pn(total); sav_p("\n" as *u8)
493 sav_p(" n_sovereign(.nx/.md) = " as *u8); sav_pn(n_sovereign); sav_p("\n" as *u8)
494 sav_p(" n_fenced(reference) = " as *u8); sav_pn(n_fenced); sav_p("\n" as *u8)
495 sav_p(" n_product_contaminant= " as *u8); sav_pn(n_contam); sav_p("\n" as *u8)
496 sav_p(" n_other(bin/img/etc) = " as *u8); sav_pn(n_other); sav_p("\n" as *u8)
497 sav_p(" product_files = " as *u8); sav_pn(n_product_files); sav_p("\n" as *u8)
498 sav_p(" product_purity_permil= " as *u8); sav_pn(purity); sav_p("\n" as *u8)
499 sav_p(" dirs_walked = " as *u8); sav_pn(dirs_walked); sav_p("\n" as *u8)
500 sav_p(" store committed at = " as *u8); sav_p(SAV_PREFIX); sav_p(" (rc="as *u8); sav_pn(crc); sav_p(")\n" as *u8)
501 sav_p(" top PRODUCT-CONTAMINANT paths (first " as *u8); sav_pn(topk_n); sav_p("):\n" as *u8)
502 var ti: i64 = 0
503 while ti < topk_n {
504 sav_p(" - " as *u8); sav_p((topk_arena as i64 + ti * SAV_MAGIC_8192) as *u8); sav_p("\n" as *u8)
505 ti = ti + 1
506 }
507 if capped != 0 { sav_p(" WARNING: a budget ceiling was HIT -- counts are a LOWER BOUND (capped=1)\n" as *u8) }
508 sav_p(" --- contaminant breakdown (the product debt, split 3 ways) ---\n" as *u8)
509 sav_p(" THIRDPARTY_LANG (py/sh/ts/mjs, KILL) = " as *u8); sav_pn(class_count[1]); sav_p("\n" as *u8)
510 sav_p(" NONSOV_FORMAT (tsv/conf/toml/json, MIGRATE) = " as *u8); sav_pn(class_count[2]); sav_p("\n" as *u8)
511 sav_p(" WEB_BOUNDARY (js/css/html, REVIEW) = " as *u8); sav_pn(class_count[3]); sav_p("\n" as *u8)
512 sav_p(" >> genuine_debt (lang+format, drive to 0) = " as *u8); sav_pn(class_count[1] + class_count[2]); sav_p("\n" as *u8)
513 sav_p(" by extension:\n" as *u8)
514 var xi: i64 = 0
515 while xi < SAV_NCAND {
516 sav_p(" ." as *u8); sav_p(sav_cand_ext(xi)); sav_p(" = " as *u8); sav_pn(ext_count[xi]); sav_p("\n" as *u8)
517 xi = xi + 1
518 }
519
520 if verdict_green == 1 {
521 sav_p("SOVAUDIT-OK verdict=GREEN\n" as *u8)
522 sys_exit(0)
523 return 0
524 }
525 sav_p("SOVAUDIT-FAIL verdict=RED\n" as *u8)
526 sys_exit(1)
527 return 1
528}