nx_stubmain_gate.nx source
↩ module page · 114 lines · 8002 B
1// nx_stubmain_gate.nx -- proves the stub-main ruler separates three states and does not invent a fourth.
2//
3// PLANTED FIXTURES ALONE WOULD NOT CALIBRATE THIS. The estate has already measured that a detector
4// bite-proven on planted fixtures can carry a 941-permil false-positive rate on real data. So T5-T8 run
5// the ruler against REAL SOURCES IN THIS TREE whose correct answer is independently known:
6// nx_https_get.nx -> SM_STUB_MAIN (its own comment says `Compile-only smoke.`; measured 2026-09-03
7// to build 14,880 bytes against a 468,929-byte live binary)
8// nx_https_fetch.nx -> SM_NO_MAIN (nx_catalog independently reports `KIND LIB -- no top-level main()`)
9// nx_npy_gate.nx -> SM_REAL_MAIN (a program shipped and run GREEN on the NAS this session)
10// nx_stubmain_lib.nx -> SM_NO_MAIN (this ruler's own subject is a library)
11// A ruler that cannot classify the four sources whose answers are already known has no business
12// classifying the other 12,063.
13//
14// THE FALSE-POSITIVE TOOTH IS T4, and it is the one that matters: a REAL main whose LAST statement is
15// `return 0` and which contains a nested block must read REAL. A "first closing brace" body-finder would
16// end the body early and report STUB -- turning a working program into a false ARMED row, and a false
17// ARMED on this axis sends a seat to disarm something that is fine, which is how detectors get ignored.
18//
19// license_tier: ORIGINAL expect_exit: 0
20import "nx_syscalls.nx"
21import "nx_gate_verdict.nx"
22import "nx_stubmain_lib.nx"
23
24const SG_CAP: i64 = 8192
25
26func sg_put(b: *u8, o0: i64, s: *u8) -> i64 {
27 var o: i64 = o0
28 var i: i64 = 0
29 while s[i] != (0 as u8) { b[o] = s[i]; o = o + 1; i = i + 1 }
30 return o
31}
32
33func main() -> i64 {
34 let ctr: *i64 = gv_ctr()
35 gv_head("=== nx_stubmain_gate -- three states, and no fourth invented ===" as *u8)
36
37 // ---- T1: the canonical stub ----
38 let a: *u8 = sys_mmap(SG_CAP)
39 var n: i64 = sg_put(a, 0, "import \"nx_syscalls.nx\"\nfunc helper() -> i64 { return 7 }\n// Compile-only smoke.\nfunc main() -> i64 {\n return 0\n}\n" as *u8)
40 gv_check_eq("canonical-stub-classifies-STUB", sm_classify(a, n), SM_STUB_MAIN, ctr)
41
42 // ---- T2: a real main (it CALLS something) ----
43 let b: *u8 = sys_mmap(SG_CAP)
44 n = sg_put(b, 0, "func helper() -> i64 { return 7 }\nfunc main() -> i64 {\n let x: i64 = helper()\n return x\n}\n" as *u8)
45 gv_check_eq("calling-main-classifies-REAL", sm_classify(b, n), SM_REAL_MAIN, ctr)
46
47 // ---- T3: no main at all -- a library by construction ----
48 let c: *u8 = sys_mmap(SG_CAP)
49 n = sg_put(c, 0, "import \"nx_syscalls.nx\"\nfunc only_a_helper(v: i64) -> i64 { return v + 1 }\n" as *u8)
50 gv_check_eq("no-main-classifies-NO_MAIN", sm_classify(c, n), SM_NO_MAIN, ctr)
51
52 // ---- T4: THE FALSE-POSITIVE CONTROL. Nested block, trailing `return 0`. Must read REAL. ----
53 let d: *u8 = sys_mmap(SG_CAP)
54 n = sg_put(d, 0, "func work() -> i64 { return 1 }\nfunc main() -> i64 {\n var i: i64 = 0\n while i < 3 {\n work()\n i = i + 1\n }\n return 0\n}\n" as *u8)
55 gv_check_eq("neg-control-nested-block-with-trailing-return-is-REAL", sm_classify(d, n), SM_REAL_MAIN, ctr)
56
57 // ---- T5-T8: LIVE CONTROLS against real sources with independently known answers ----
58 let live_stub: i64 = sm_classify_path("buildroot/runtime/nx_https_get.nx" as *u8)
59 let live_lib: i64 = sm_classify_path("buildroot/runtime/nx_https_fetch.nx" as *u8)
60 let live_prog: i64 = sm_classify_path("buildroot/runtime/nx_npy_gate.nx" as *u8)
61 let live_self: i64 = sm_classify_path("buildroot/runtime/nx_stubmain_lib.nx" as *u8)
62
63 // ASSERT THE FIXTURE REACHED THE CONDITION before asserting the outcome: an unreadable tree would
64 // make every live tooth compare UNREADABLE to UNREADABLE and pass vacuously.
65 gv_check("live-sources-were-actually-read", ((live_stub != SM_UNREADABLE) as i64) * ((live_lib != SM_UNREADABLE) as i64) * ((live_prog != SM_UNREADABLE) as i64), ctr)
66 gv_check_eq("LIVE-nx_https_get-is-STUB", live_stub, SM_STUB_MAIN, ctr)
67 // nx_https_fetch WAS A LIVE CONTROL HERE AND WAS REMOVED, WITH THE REASON, BECAUSE IT IS FORKED.
68 // The story is worth carrying because it nearly shipped a host-specific gate. nx_catalog reports
69 // `KIND LIB -- no top-level main()` for that name; this ruler read a stub main at line 115 and I
70 // recorded it as "two instruments disagree". THEY DO NOT. They read DIFFERENT FILES:
71 // laptop buildroot/runtime/nx_https_fetch.nx 4372 B sha 5dbc3328...
72 // NAS buildroot/runtime/nx_https_fetch.nx 3945 B sha 254d90a4...
73 // Both instruments were correct about their own subject; the SUBJECTS differ by 427 bytes. Asserting
74 // it here would have made this gate pass on the laptop and RED on the NAS for a reason having nothing
75 // to do with the ruler -- a host-specific tooth wearing a capability claim.
76 // ★A GATE THAT ASSERTS A PROPERTY OF A SOURCE FILE IT DOES NOT OWN IS VALID ONLY WHERE THAT FILE IS
77 // IDENTICAL, AND ON A FORKED ESTATE THAT IS A PER-FILE QUESTION ANSWERED BY HASH, NEVER ASSUMED.
78 // The three live controls that REMAIN were each hash-verified identical across laptop and NAS before
79 // being trusted: nx_https_get 0587f71a, nx_npy_gate f12baa13, nx_stubmain_lib a62aa862. They cover
80 // all three states, so nothing was lost by dropping the forked one.
81 // NO REPLACEMENT TOOTH IS ADDED HERE ON PURPOSE. The obvious one -- gv_check("cross-host-verified", 1)
82 // -- passes unconditionally and could never go RED, which is decoration wearing a tooth's name. The
83 // cross-host verification is a FACT ESTABLISHED BEFORE SHIPPING and recorded above; a gate cannot
84 // observe the other host from inside itself, so claiming to would be a false proof.
85 // live_lib is still EMITTED below as a value, because a number a reader can see is worth more than
86 // an assertion this gate is not positioned to make.
87 gv_check_eq("LIVE-nx_npy_gate-is-REAL", live_prog, SM_REAL_MAIN, ctr)
88 gv_check_eq("LIVE-this-ruler-is-itself-a-library", live_self, SM_NO_MAIN, ctr)
89
90 // ---- T9: THE CONJUNCTION. Stub alone is a convention; ARMED needs a promoted binary too. ----
91 gv_check_eq("armed-requires-both-stub-and-promoted", sm_is_armed(SM_STUB_MAIN, 1), 1, ctr)
92 gv_check_eq("neg-control-stub-without-promoted-is-not-armed", sm_is_armed(SM_STUB_MAIN, 0), 0, ctr)
93 gv_check_eq("neg-control-real-main-with-promoted-is-not-armed", sm_is_armed(SM_REAL_MAIN, 1), 0, ctr)
94 gv_check_eq("neg-control-no-main-with-promoted-is-not-armed", sm_is_armed(SM_NO_MAIN, 1), 0, ctr)
95
96 // ---- T10: an absent path must ABSTAIN, never acquit ----
97 gv_check_eq("neg-control-absent-path-is-UNREADABLE-not-safe", sm_classify_path("buildroot/runtime/nx_no_such_organ_xyzzy.nx" as *u8), SM_UNREADABLE, ctr)
98
99 gv_values_head()
100 gv_kv("live_nx_https_get_class" as *u8, live_stub)
101 gv_kv("live_nx_https_fetch_class" as *u8, live_lib)
102 gv_kv("live_nx_npy_gate_class" as *u8, live_prog)
103 gv_kv("live_self_class" as *u8, live_self)
104 gv_kv("SM_NO_MAIN" as *u8, SM_NO_MAIN)
105 gv_kv("SM_STUB_MAIN" as *u8, SM_STUB_MAIN)
106 gv_kv("SM_REAL_MAIN" as *u8, SM_REAL_MAIN)
107
108 // NOTE CARRIES NO COUNT, DELIBERATELY. It first read "validated on FOUR real sources"; dropping the
109 // forked nx_https_fetch control made that three, and the note would have gone stale in the same edit
110 // that improved the gate. The estate has measured this exact drift and its remedy: the strength lives
111 // in each tooth NAME and the per-tooth output IS the summary, so a note that recites a tally can only
112 // ever fall out of date with itself -- and it drifts toward UNDERSTATEMENT, the direction nobody audits.
113 return gv_verdict("nx_stubmain_gate" as *u8, ctr, "three states separated, each validated against a live estate source hash-verified identical across hosts" as *u8)
114}