`nx_srcguard.nx` source

↩ module page · 411 lines · 21569 B
1// nx_srcguard.nx -- CANONICAL-SOURCE REVERT DETECTOR (seq1439 sev9, the work-destroyer's last mile).
2// THE WOUND: on 2026-07-30 canonical daemon sources were silently reverted THREE times, each revert
3// erasing EATEN debts across three lanes with no error anywhere. seq1379 closed the two SOVEREIGN write
4// paths (nx_fs_write compare-and-swap; nx_treepack refuse-to-backdate) and both hold -- but the third
5// path is RAW scp/rsync over ssh, which never touches an API, so no API-side guard can ever see it.
6// ★You cannot gate a door you do not own. What you CAN do is make the damage IMPOSSIBLE TO MISS.
7//
8// ★★★THE RULER IS SYMBOLS, NOT BYTES (v2, 2026-07-30 -- this organ's OWN first field failure).
9// v1 alarmed on any byte-count DECREASE. Within a day of shipping it, it fired twice and was WRONG BOTH
10// TIMES: once on a file sampled mid-rewrite (a truncate-then-write window read as 0 bytes, and I reported
11// the supervisor source as annihilated when it settled to 279688), and once on a sibling's legitimate
12// refactor of nx_hostctl.nx that removed 1294 bytes while keeping ALL 212 top-level symbols. A shrink is
13// not a revert. Dead code gets deleted, comments get tightened, duplication gets folded -- all of that is
14// the tree getting BETTER, and a guard that calls it destruction trains everyone to ignore the guard.
15// What actually distinguishes a revert is that WORK DISAPPEARS: a func/const/struct that existed is GONE.
16// So the verdict is symbol-set containment -- recorded symbols must all still be present, BY NAME.
17// Growth is silent, refactors are silent, and only a real loss speaks. Same instrument the sibling
18// arrived at independently in nx_treepack (REFUSED-WOULD-DROP-SYMBOLS, seq1467).
19//
20// HONEST LIMITATION, stated because an unstated one is a lie: this tracks symbol EXISTENCE, not symbol
21// BODIES. Gutting a function while keeping its name is invisible here. Byte deltas are still reported
22// (advisory) precisely so that case has a signal to be noticed by -- but it is NOT claimed as covered.
23//
24// WHY A STANDALONE ORGAN: measured in the incident forensics, the CASUALTIES were long-lived shared daemon
25// sources while every NEWLY CREATED file SURVIVED every revert. A guard living inside the file it guards
26// would be reverted with it. This one is clobber-resistant BY CONSTRUCTION.
27//   nx_srcguard record [listfile] [statefile] [symsfile]  -- snapshot the watched set at a known-good state
28//   nx_srcguard check  [listfile] [statefile] [symsfile]  -- exit 0 clean · 4 = WORK LOST (named symbols)
29// Data-driven (rule 11): the watched set is knowledge/registry/srcguard.list, one path per line.
30// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
31import "nx_syscalls.nx"
32import "nx_itoa_lib.nx"   // shared MSB-first emitter (zero-alloc)
33
34// derived: AT_FDCWD per the kernel ABI; struct stat is 144B on x86-64 (256 = headroom); offsets VERIFIED
35// byte-exact against `stat -c '%Y %s'` by nx_mtime_probe before this organ was written.
36const SG_AT_FDCWD: i64 = 0 - 100
37const SG_SYS_NEWFSTATAT: i64 = 262
38const SG_STATBUF: i64 = 256
39const SG_OFF_SIZE: i64 = 48
40const SG_OFF_MTIME: i64 = 88
41// sized: the watched set is a handful of canonical daemon sources; 64KiB is ~1000 rows of headroom
42const SG_CAP: i64 = 65536
43const SG_PATHCAP: i64 = 512
44// sized from the MEASURED tree: the largest watched source is nx_mgmt_api.nx; 4MiB is >10x its size, so
45// a single read always lands whole. A short read would silently under-count symbols and manufacture a
46// false LOSS, which is exactly the failure mode this rewrite exists to kill.
47const SG_FCAP: i64 = 4194304
48// sized: nx_hostctl.nx MEASURED at 212 top-level symbols; 256KiB holds ~8000 names at avg 30B.
49const SG_SYMSET_CAP: i64 = 262144
50// sized: 10 watched files x a few hundred symbols x ~60B/row
51const SG_SYMSTATE_CAP: i64 = 2097152
52// derived: a truncate-then-write window is milliseconds; 400ms is ~2 orders of margin and is only ever
53// paid on the rare suspicious path, never in the clean steady state.
54const SG_SETTLE_MS: i64 = 400
55// cap: name at most this many missing symbols in the JSON so a catastrophic loss cannot produce an
56// unbounded line; the COUNT is always exact and is what the verdict keys on.
57const SG_NAME_CAP: i64 = 24
58
59func sg_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
60// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer
61// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the
62// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls).
63// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign.
64func sg_n(v: i64) -> i64 { nxi_out(v); return 0 }
65func sg_eq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } if b[i] != (0 as u8) { return 0 } return 1 }
66
67// size+mtime of a path. 1 = ok (outs[0]=size, outs[1]=mtime) · 0 = absent. Never invents a value.
68func sg_stat(path: *u8, outs: *i64) -> i64 {
  let sb: *u8 = sys_mmap(SG_STATBUF)
  if __syscall(SG_SYS_NEWFSTATAT, SG_AT_FDCWD, path as i64, sb as i64, 0, 0, 0) != 0 { return 0 }
  let sp: *i64 = ((sb as i64) + SG_OFF_SIZE) as *i64
  let mp: *i64 = ((sb as i64) + SG_OFF_MTIME) as *i64
  outs[0] = sp[0]
  outs[1] = mp[0]
  return 1
76}
77
78func sg_read(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  let n: i64 = sys_read(fd, buf, cap - 1)
  sys_close(fd)
  if n < 0 { return 0 - 1 }
  buf[n] = 0 as u8
  return n
86}
87
88// copy line [ls,le) of buf into dst (NUL-terminated), returns length
89func sg_line(buf: *u8, ls: i64, le: i64, dst: *u8, cap: i64) -> i64 {
  var o: i64 = 0
  var i: i64 = ls
  while i < le { if o < cap - 1 { dst[o] = buf[i]; o = o + 1 } i = i + 1 }
  dst[o] = 0 as u8
  return o
95}
96
97func sg_isid(c: i64) -> i64 {
  if c >= 97 { if c <= 122 { return 1 } }
  if c >= 65 { if c <= 90 { return 1 } }
  if c >= 48 { if c <= 57 { return 1 } }
  if c == 95 { return 1 }
  return 0
103}
104
105// if line [i,le) begins with kw, return the offset just past it; else -1.
106func sg_starts(buf: *u8, i: i64, le: i64, kw: *u8) -> i64 {
  var k: i64 = 0
  while kw[k] != (0 as u8) {
      if i + k >= le { return 0 - 1 }
      if buf[i + k] != kw[k] { return 0 - 1 }
      k = k + 1
  }
  return i + k
114}
115
116// membership in a NUL-separated name set of setlen bytes
117func sg_set_has(set: *u8, setlen: i64, name: *u8) -> i64 {
  var i: i64 = 0
  while i < setlen {
      let ent: *u8 = ((set as i64) + i) as *u8
      if sg_eq(ent, name) == 1 { return 1 }
      var k: i64 = 0
      while ent[k] != (0 as u8) { k = k + 1 }
      i = i + k + 1
  }
  return 0
127}
128
129// Extract top-level declared symbols of <path> into out as NUL-separated names.
130// A "top-level symbol" is a declaration starting at COLUMN 0 -- indented forms are locals and are
131// deliberately not tracked (they are not the unit of work anyone loses sleep over).
132// Returns bytes written into out, or -1 if the file is unreadable. outs[0] receives the name count.
133func sg_syms_of(path: *u8, fb: *u8, out: *u8, ocap: i64, outs: *i64) -> i64 {
  outs[0] = 0
  let n: i64 = sg_read(path, fb, SG_FCAP)
  if n < 0 { return 0 - 1 }
  var o: i64 = 0
  var cnt: i64 = 0
  var i: i64 = 0
  while i < n {
      var le: i64 = i
      var sc: i64 = 1
      while sc == 1 { if le >= n { sc = 0 } else { if fb[le] == (10 as u8) { sc = 0 } else { le = le + 1 } } }
      var s: i64 = 0 - 1
      if s < 0 { s = sg_starts(fb, i, le, "func " as *u8) }
      if s < 0 { s = sg_starts(fb, i, le, "fn " as *u8) }
      if s < 0 { s = sg_starts(fb, i, le, "const " as *u8) }
      if s < 0 { s = sg_starts(fb, i, le, "struct " as *u8) }
      if s < 0 { s = sg_starts(fb, i, le, "export func " as *u8) }
      if s >= 0 {
          var e: i64 = s
          var go: i64 = 1
          while go == 1 { if e >= le { go = 0 } else { if sg_isid(fb[e] as i64) == 1 { e = e + 1 } else { go = 0 } } }
          if e > s {
              if o + (e - s) + 1 < ocap {
                  var p: i64 = s
                  while p < e { out[o] = fb[p]; o = o + 1; p = p + 1 }
                  out[o] = 0 as u8; o = o + 1
                  cnt = cnt + 1
              }
          }
      }
      i = le + 1
  }
  outs[0] = cnt
  return o
167}
168
169// recorded size/mtime for <path> in the state buffer, or 0 when unrecorded. Rows: <size>\t<mtime>\t<path>
170func sg_recorded(state: *u8, sn: i64, path: *u8, outs: *i64) -> i64 {
  var i: i64 = 0
  let tmp: *u8 = sys_mmap(SG_PATHCAP)
  while i < sn {
      var le: i64 = i
      var sc: i64 = 1
      while sc == 1 { if le >= sn { sc = 0 } else { if state[le] == (10 as u8) { sc = 0 } else { le = le + 1 } } }
      var p: i64 = i
      var sz: i64 = 0
      while p < le { let c: i64 = state[p] as i64; if c == 9 { p = le } else { if c >= 48 { if c <= 57 { sz = sz * 10 + (c - 48) } } p = p + 1 } }
      var q: i64 = i
      var tabs: i64 = 0
      var pstart: i64 = 0 - 1
      var mt: i64 = 0
      while q < le {
          if state[q] == (9 as u8) {
              tabs = tabs + 1
              if tabs == 1 { var r: i64 = q + 1; while r < le { let c2: i64 = state[r] as i64; if c2 == 9 { r = le } else { if c2 >= 48 { if c2 <= 57 { mt = mt * 10 + (c2 - 48) } } r = r + 1 } } }
              if tabs == 2 { pstart = q + 1; q = le }
          }
          if q < le { q = q + 1 }
      }
      if pstart > 0 {
          sg_line(state, pstart, le, tmp, SG_PATHCAP)
          if sg_eq(tmp, path) == 1 { outs[0] = sz; outs[1] = mt; return 1 }
      }
      i = le + 1
  }
  return 0
199}
200
201// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer
202// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the
203// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls).
204// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign.
205func sg_emit_i(fd: i64, v: i64) -> i64 { nxi_fd(fd, v); return 0 }
206
207func main(argc: i64, argv: *i64) -> i64 {
  // SAFE DEFAULT VERB so a SCHEDULER can run this bare (seq1439, id 1785439172).
  // THE GAP THIS CLOSES: nx_srcguard has been BUILT, DEPLOYED and bite-proven since 2026-07-30 and NOTHING has
  // ever invoked it -- the row asks for "a source-integrity watchdog ... on a beat" and the watchdog existed
  // while the beat did not. The live scheduler (clock_jobs.tsv) execs a BARE command: every row is a plain
  // binary or a legacy .sh, none carry args. So requiring a verb made this organ UNSCHEDULABLE without a shell
  // wrapper -- which would need a +x the sovereign write path cannot set, and would put /bin/sh on the program
  // path, which nx_standards_contract item 6 forbids outright.
  // u00e2u02dcu2026A GUARD THAT CANNOT BE SCHEDULED WITHOUT A SHELL WRAPPER IS A GUARD THAT DOES NOT RUN.
  // Defaulting to CHECK is safe by construction: `record` is the only mutating verb (it rewrites the baseline
  // state+syms files) and still has to be asked for BY NAME, so a bare or malformed invocation can never
  // overwrite the baseline it is supposed to be defending. Explicit args keep working unchanged (rule 19).
  var verb: *u8 = "check" as *u8
  if argc >= 2 { verb = argv[1] as *u8 }
  var listp: *u8 = "knowledge/registry/srcguard.list" as *u8
  var statep: *u8 = "knowledge/status/srcguard.state" as *u8
  var symsp: *u8 = "knowledge/status/srcguard.syms" as *u8
  if argc >= 3 { listp = argv[2] as *u8 }
  if argc >= 4 { statep = argv[3] as *u8 }
  if argc >= 5 { symsp = argv[4] as *u8 }
227
  let lb: *u8 = sys_mmap(SG_CAP)
  let ln: i64 = sg_read(listp, lb, SG_CAP)
  if ln < 0 { sg_w("{\"organ\":\"nx_srcguard\",\"refused\":\"watch list unreadable\"}\n" as *u8); sys_exit(2); return 2 }
  if ln == 0 { sg_w("{\"organ\":\"nx_srcguard\",\"refused\":\"watch list empty -- an empty guard is not a guard\"}\n" as *u8); sys_exit(2); return 2 }
232
  let isrec: i64 = sg_eq(verb, "record" as *u8)
  let sb2: *u8 = sys_mmap(SG_CAP)
  var sn: i64 = 0
  let yb: *u8 = sys_mmap(SG_SYMSTATE_CAP)
  var yn: i64 = 0
  if isrec == 0 {
      let r: i64 = sg_read(statep, sb2, SG_CAP); if r > 0 { sn = r }
      let r2: i64 = sg_read(symsp, yb, SG_SYMSTATE_CAP); if r2 > 0 { yn = r2 }
  }
242
  var ofd: i64 = 0 - 1
  var yfd: i64 = 0 - 1
  if isrec == 1 { ofd = sys_openat_wr(statep, 420); yfd = sys_openat_wr(symsp, 420) }
246
  let path: *u8 = sys_mmap(SG_PATHCAP)
  let st: *i64 = sys_mmap(32) as *i64
  let rec: *i64 = sys_mmap(32) as *i64
  let fb: *u8 = sys_mmap(SG_FCAP)
  let sset: *u8 = sys_mmap(SG_SYMSET_CAP)
  let scnt: *i64 = sys_mmap(32) as *i64
  let tmpp: *u8 = sys_mmap(SG_PATHCAP)
  let tmps: *u8 = sys_mmap(SG_PATHCAP)
  var watched: i64 = 0
  var absent: i64 = 0
  var newf: i64 = 0
  var shrank: i64 = 0
  var backwards: i64 = 0
  var okc: i64 = 0
  var settled: i64 = 0
  var lost: i64 = 0
  var symsrec: i64 = 0
  var named: i64 = 0
  if isrec == 0 { sg_w("{\"organ\":\"nx_srcguard\",\"ruler\":\"symbol-set containment (bytes advisory)\",\"lost_symbols\":[" as *u8) }
  var first: i64 = 1
  var advfirst: i64 = 1
  let advb: *u8 = sys_mmap(SG_SYMSET_CAP)
  var advo: i64 = 0
  var i: i64 = 0
  while i < ln {
      var le: i64 = i
      var sc: i64 = 1
      while sc == 1 { if le >= ln { sc = 0 } else { if lb[le] == (10 as u8) { sc = 0 } else { le = le + 1 } } }
      var use: i64 = 1
      if le <= i { use = 0 }
      if use == 1 { if lb[i] == (35 as u8) { use = 0 } }
      if use == 1 {
          sg_line(lb, i, le, path, SG_PATHCAP)
          watched = watched + 1
          if sg_stat(path, st) == 0 { absent = absent + 1 } else {
              let slen: i64 = sg_syms_of(path, fb, sset, SG_SYMSET_CAP, scnt)
              if isrec == 1 {
                  if ofd >= 0 {
                      sg_emit_i(ofd, st[0])
                      sys_write(ofd, "\t" as *u8, 1)
                      sg_emit_i(ofd, st[1])
                      sys_write(ofd, "\t" as *u8, 1)
                      var pl: i64 = 0; while path[pl] != (0 as u8) { pl = pl + 1 }
                      sys_write(ofd, path, pl)
                      sys_write(ofd, "\n" as *u8, 1)
                  }
                  if yfd >= 0 {
                      if slen > 0 {
                          var so: i64 = 0
                          while so < slen {
                              let ent: *u8 = ((sset as i64) + so) as *u8
                              var el: i64 = 0; while ent[el] != (0 as u8) { el = el + 1 }
                              var pl2: i64 = 0; while path[pl2] != (0 as u8) { pl2 = pl2 + 1 }
                              sys_write(yfd, path, pl2)
                              sys_write(yfd, "\t" as *u8, 1)
                              sys_write(yfd, ent, el)
                              sys_write(yfd, "\n" as *u8, 1)
                              symsrec = symsrec + 1
                              so = so + el + 1
                          }
                      }
                  }
                  okc = okc + 1
              } else {
                  var pathlost: i64 = 0
                  if slen >= 0 {
                      var j: i64 = 0
                      while j < yn {
                          var je: i64 = j
                          var jc: i64 = 1
                          while jc == 1 { if je >= yn { jc = 0 } else { if yb[je] == (10 as u8) { jc = 0 } else { je = je + 1 } } }
                          var tb: i64 = 0 - 1
                          var q: i64 = j
                          while q < je { if yb[q] == (9 as u8) { tb = q; q = je } else { q = q + 1 } }
                          if tb > 0 {
                              sg_line(yb, j, tb, tmpp, SG_PATHCAP)
                              if sg_eq(tmpp, path) == 1 {
                                  sg_line(yb, tb + 1, je, tmps, SG_PATHCAP)
                                  if sg_set_has(sset, slen, tmps) == 0 {
                                      lost = lost + 1
                                      pathlost = pathlost + 1
                                      if named < SG_NAME_CAP {
                                          named = named + 1
                                          if first == 0 { sg_w("," as *u8) }
                                          first = 0
                                          sg_w("{\"path\":\"" as *u8); sg_w(path)
                                          sg_w("\",\"symbol\":\"" as *u8); sg_w(tmps)
                                          sg_w("\"}" as *u8)
                                      }
                                  }
                              }
                          }
                          j = je + 1
                      }
                  }
                  if sg_recorded(sb2, sn, path, rec) == 0 { newf = newf + 1 } else {
                      var bad: i64 = 0
                      if st[0] < rec[0] { bad = 1 }
                      if st[1] < rec[1] { bad = 1 }
                      // ★CONFIRM BEFORE ACCUSING. A writer that truncates-then-writes is momentarily
                      // indistinguishable from a wipe, so a SINGLE sample cannot tell a revert from a
                      // write in progress -- this organ made exactly that mistake in production. Re-stat
                      // after a settle and require BOTH reads to agree, the same two-consecutive-reads
                      // discipline nx_debt's loader uses to rule out a mid-commit sibling.
                      if bad == 1 {
                          sys_sleep_ms(SG_SETTLE_MS)
                          let st2: *i64 = sys_mmap(32) as *i64
                          if sg_stat(path, st2) == 0 { bad = 0; absent = absent + 1 } else {
                              bad = 0
                              if st2[0] < rec[0] { bad = 1 }
                              if st2[1] < rec[1] { bad = 1 }
                              if bad == 1 { st[0] = st2[0]; st[1] = st2[1] } else { settled = settled + 1 }
                          }
                      }
                      if bad == 1 {
                          if st[1] < rec[1] { backwards = backwards + 1 }
                          if st[0] < rec[0] {
                              shrank = shrank + 1
                              if advo + SG_PATHCAP < SG_SYMSET_CAP {
                                  var ap: i64 = 0
                                  if advfirst == 0 { advb[advo] = 44 as u8; advo = advo + 1 }
                                  advfirst = 0
                                  while path[ap] != (0 as u8) { advb[advo] = path[ap]; advo = advo + 1; ap = ap + 1 }
                              }
                          }
                      }
                      if bad == 0 { okc = okc + 1 }
                  }
                  if pathlost == 0 { okc = okc + 0 }
              }
          }
      }
      i = le + 1
  }
  if isrec == 1 {
      if ofd >= 0 { sys_close(ofd) }
      if yfd >= 0 { sys_close(yfd) }
      sg_w("{\"organ\":\"nx_srcguard\",\"action\":\"RECORDED\",\"watched\":" as *u8); sg_n(watched)
      sg_w(",\"recorded\":" as *u8); sg_n(okc)
      sg_w(",\"symbols_recorded\":" as *u8); sg_n(symsrec)
      sg_w(",\"absent\":" as *u8); sg_n(absent)
      sg_w("}\n" as *u8)
      return 0
  }
  sg_w("],\"watched\":" as *u8); sg_n(watched)
  sg_w(",\"symbols_lost\":" as *u8); sg_n(lost)
  sg_w(",\"symbols_watched\":" as *u8)
  var yc: i64 = 0
  var z: i64 = 0
  while z < yn { if yb[z] == (10 as u8) { yc = yc + 1 } z = z + 1 }
  sg_n(yc)
  sg_w(",\"advisory_shrank\":" as *u8); sg_n(shrank)
  sg_w(",\"advisory_shrank_paths\":\"" as *u8)
  if advo > 0 { advb[advo] = 0 as u8; sg_w(advb) }
  sg_w("\",\"mtime_went_backwards\":" as *u8); sg_n(backwards)
  sg_w(",\"settled_on_recheck\":" as *u8); sg_n(settled)
  sg_w(",\"unrecorded\":" as *u8); sg_n(newf)
  sg_w(",\"absent\":" as *u8); sg_n(absent)
  if yc == 0 { sg_w(",\"verdict\":\"REFUSED -- no symbol baseline recorded; a guard with an empty baseline passes everything and is worse than none. Run: nx_srcguard record\"}\n" as *u8); sys_exit(2); return 2 }
  if lost > 0 { sg_w(",\"verdict\":\"WORK LOST -- a recorded top-level symbol is GONE from a canonical source. That is not a refactor, it is a revert (seq1439). Restore from the newest .bak before building, and DO NOT deploy from this tree.\"}\n" as *u8); sys_exit(4); return 4 }
  if backwards > 0 { sg_w(",\"verdict\":\"BACKDATE DETECTED -- mtime went backwards with symbols intact; an older copy was laid down over a newer one (seq1439).\"}\n" as *u8); sys_exit(4); return 4 }
  if shrank > 0 { sg_w(",\"verdict\":\"CLEAN (symbols intact) -- listed paths shrank in BYTES but lost no top-level symbol, which is what a refactor looks like. Advisory only: symbol bodies are not tracked.\"}\n" as *u8); return 0 }
  sg_w(",\"verdict\":\"CLEAN -- every recorded symbol is still present and no clock ran backwards\"}\n" as *u8)
  return 0
411}
nx_srcguard.nx source

`nx_srcguard.nx` source
