nx_swcompare_evidence.nx source
↩ module page · 844 lines · 46980 B
1// nx_swcompare_evidence.nx -- the EVIDENCE layer under the SoftwareCompare matrices. Operator 2026-07-10:
2// "compare ... doesnt provide evidence for all the capabilities we claim and generate those autonomously".
3// For a <domain> this organ AUTONOMOUSLY produces two kinds of evidence and LIAR-KILLS a bare claim:
4// (1) GROUNDING -- for every claimed-present axis in <domain>.matrix, it OPENS the named organ source on
5// disk, finds the implementing symbol, and captures the ACTUAL source LINE + occurrence count. A claim
6// whose symbol is NOT in its named file = UNGROUNDED -> RED (mechanically catches a fabricated cell).
7// (2) EXECUTED PROOF -- it FORKS each gate in <domain>.gates (a real self-testing elf), captures its live
8// "pass=N/M ... GREEN" verdict + exit code. Not a stored number: the gate RUNS every time.
9// Modes: no-arg = console + liar-kill gate (exit 0/1); "json" = evidence JSON; "html" = the evidence page.
10// Liar-kill: every PRESENT/Yes/Best/Part axis grounded, EVERY declared gate GREEN (quorum -- see below), a
11// NEG-CONTROL bogus symbol NOT found. NOTE: no '#'/'!' in string literals (nx_cc trap) -> rgb() + emit those
12// bytes. license_tier: ORIGINAL
13//
14// 2026-07-30 QUORUM CORRECTION: this header used to read ">=1 executed gate GREEN", and the code matched it.
15// That was the defect, not a typo -- one green gate out of five stamped a whole domain PROVEN. The rule now
16// comes from the shared evidence law (nx_evidence_verdict.nx) so no future reader can re-loosen it locally.
17import "nx_syscalls.nx"
18import "nx_evidence_verdict.nx"
19import "nx_sha256.nx"
20import "nx_artifact_root.nx"
21import "nx_guarded_run.nx" // seq1789: bound every forked gate -- an instrument its subject can hang measures nothing
22const EV_MAGIC_8192: i64 = 8192
23const EV_MAGIC_4096: i64 = 4096
24const EV_MAGIC_4095: i64 = 4095
25const EV_MAGIC_604800: i64 = 604800
26const EV_MAGIC_8388608: i64 = 8388608
27const EV_MAGIC_1024: i64 = 1024
28const EV_MAGIC_65536: i64 = 65536
29const EV_MAGIC_2097152: i64 = 2097152
30const EV_MAGIC_16384: i64 = 16384
31const EV_MAGIC_12345: i64 = 12345
32
33// ---- PROVENANCE ACCUMULATOR (D3). Declared at the TOP, above every reader: a function defined textually
34// before a static it reads does not resolve to that datum -- it reads a clobbered register. ----
35// WHY THIS EXISTS: the stamp used to record ok/epoch/grounded/gates and nothing else. So a verdict produced
36// where the gate binaries exist was byte-indistinguishable from one produced where they do not. MEASURED
37// 2026-07-30: zero of the declared medbilling and warden gate elfs resolve on the NAS (neither _offc/ nor
38// buildroot/_offc/); they exist only in the laptop tree. The PROVEN column was therefore backed by binaries
39// absent from the machine that serves the claim, and nothing in the format could reveal that.
40// THE FIX IS SELF-ENFORCING: the suite digest is only defined if EVERY declared gate elf could be read and
41// hashed at verdict time. A missing binary cannot be hashed, so it cannot be stamped. Provenance stops being
42// a promise and becomes a thing that either computes or does not.
43static ev_prov_acc: *u8
44static ev_prov_buf: *u8
45static ev_prov_declared: i64
46static ev_prov_present: i64
47static ev_bite_seen: i64
48
49// ---- NON-VACUITY (D4, closes seq1344). Count the declared gates that have been PROVEN ABLE TO FAIL. ----
50// nx_gate_bite writes knowledge/status/bite_<gate>.verdict with killed=1 after mutating the gate's subject
51// source, rebuilding, and observing the gate go RED. A gate with no such record has not been shown to
52// detect anything, and clause 4 of the evidence law refuses to count it. This is the writer whose absence
53// pinned the honesty ratio at a structural zero.
54func ev_bite_fold(elf: *u8) -> i64 {
55 var n: i64 = 0
56 while elf[n] != (0 as u8) { n = n + 1 }
57 var s: i64 = 0
58 var i: i64 = 0
59 while i < n { if elf[i] == (47 as u8) { s = i + 1 } i = i + 1 }
60 var e: i64 = n
61 if n >= 4 { if elf[n-4] == (46 as u8) { e = n - 4 } }
62 if e <= s { return 0 }
63 let p: *u8 = sys_mmap(256)
64 var o: i64 = 0
65 let pre: *u8 = "knowledge/status/bite_"
66 var q: i64 = 0
67 while pre[q] != (0 as u8) { p[o] = pre[q]; o = o + 1; q = q + 1 }
68 var k: i64 = s
69 while k < e { p[o] = elf[k]; o = o + 1; k = k + 1 }
70 let sfx: *u8 = ".verdict"
71 q = 0
72 while sfx[q] != (0 as u8) { p[o] = sfx[q]; o = o + 1; q = q + 1 }
73 p[o] = 0 as u8
74 let b: *u8 = sys_mmap(512)
75 let bn: i64 = ev_read(p, b, 511)
76 if bn <= 0 { return 0 }
77 let off: i64 = ev_find_line(b, bn, "killed=1" as *u8, sys_mmap(16) as *i64)
78 if off < 0 { return 0 }
79 // ★A BITE RECORD EXPIRES ON THE SAME TTL AS EVERYTHING ELSE. This organ was counting killed=1 forever,
80 // regardless of the record's epoch -- which is D2 (a verdict that outlives its evidence) rebuilt one
81 // layer down, inside the very apparatus built to kill D2. A gate proven able to fail six months ago,
82 // against source that has since changed, has NOT been proven able to fail today. The record carries an
83 // epoch precisely so it can be refused; refusing it is what makes writing it meaningful.
84 let ep: i64 = ev_num_after(b, bn, "epoch=" as *u8, 6)
85 if ep <= 0 { return 0 }
86 let now: i64 = sys_now_realtime_sec()
87 if now < ep { return 0 }
88 if now - ep > ev_ttl_sec() { return 0 }
89 ev_bite_seen = ev_bite_seen + 1
90 return 1
91}
92
93// Parse the integer following `key`. Local to this organ's stamp/record dialect.
94func ev_num_after(buf: *u8, n: i64, key: *u8, kl: i64) -> i64 {
95 var i: i64 = 0
96 while i <= n - kl {
97 var j: i64 = 0
98 var m: i64 = 1
99 while j < kl { if buf[i+j] != key[j] { m = 0; j = kl } else { j = j + 1 } }
100 if m == 1 {
101 var p: i64 = i + kl
102 var v: i64 = 0
103 var got: i64 = 0
104 while p < n { let c: i64 = buf[p] as i64; if c >= 48 { if c <= 57 { v = v*10 + (c-48); got = 1; p = p + 1 } else { p = n } } else { p = n } }
105 if got == 1 { return v }
106 return 0 - 1
107 }
108 i = i + 1
109 }
110 return 0 - 1
111}
112
113// The evidence TTL, from the SAME config the status surface reads (rule 17). One policy, every consumer --
114// a second copy of the number is how two surfaces come to disagree about what "fresh" means.
115func ev_ttl_sec() -> i64 {
116 let b: *u8 = sys_mmap(EV_MAGIC_4096)
117 let n: i64 = ev_read("knowledge/evidence_policy.conf" as *u8, b, EV_MAGIC_4095)
118 if n <= 0 { return EV_MAGIC_604800 }
119 let v: i64 = ev_num_after(b, n, "ttl_sec=" as *u8, 8)
120 if v <= 0 { return EV_MAGIC_604800 }
121 return v
122}
123
124// ---- ARTIFACT ROOT RESOLUTION -> now the SHARED lib nx_artifact_root.nx (seq1385). ----
125// This organ carried its own copy while the class was being characterised. It is now known to be
126// ecosystem-wide -- the sibling's seq1339 is the same defect seen from the other end -- so the
127// implementation lives in ONE place and this is a thin delegate. Rule 15: a second copy of a resolver is
128// precisely how two hosts drift apart again.
129func ev_resolve(inp: *u8, out: *u8) -> i64 { return ar_resolve(inp, out) }
130
131// Fold one gate elf into the suite digest. Byte-wise ADD (not XOR): order-independent, so gate order in the
132// .gates file cannot change the digest, but a duplicated elf does not silently cancel itself out.
133func ev_prov_fold(elf: *u8) -> i64 {
134 if (ev_prov_acc as i64) == 0 { ev_prov_acc = sys_mmap(32) }
135 if (ev_prov_buf as i64) == 0 { ev_prov_buf = sys_mmap(EV_MAGIC_8388608) }
136 ev_prov_declared = ev_prov_declared + 1
137 let n: i64 = ev_read(elf, ev_prov_buf, EV_MAGIC_8388608)
138 if n <= 0 { return 0 }
139 let d: *u8 = sys_mmap(32)
140 sha256_digest(ev_prov_buf, n, d)
141 var j: i64 = 0
142 while j < 32 { ev_prov_acc[j] = ((ev_prov_acc[j] as i64) + (d[j] as i64)) as u8; j = j + 1 }
143 ev_prov_present = ev_prov_present + 1
144 return 1
145}
146
147func w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
148func wc(fd: i64, code: i64) -> i64 { let t: *u8 = sys_mmap(2); t[0] = code as u8; sys_write(fd, t, 1); return 0 }
149func wn(fd: i64, v: i64) -> i64 {
150 var m: i64 = v; if m < 0 { w(fd, "-" as *u8); m = 0 - m }
151 let t: *u8 = sys_mmap(24); var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 }
152 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
153 let o: *u8 = sys_mmap(24); var i: i64 = 0; while i < k { o[i] = t[k-1-i]; i = i + 1 } sys_write(fd, o, k); return 0
154}
155func wj(fd: i64, s: *u8) -> i64 {
156 var i: i64 = 0
157 while s[i] != (0 as u8) { let c: i64 = s[i] as i64
158 if c == 34 { wc(fd, 92); wc(fd, 34) } else { if c == 92 { wc(fd, 92); wc(fd, 92) } else { if c < 32 { wc(fd, 32) } else { wc(fd, c) } } }
159 i = i + 1 }
160 return 0
161}
162func wq(fd: i64) -> i64 { wc(fd, 34); return 0 }
163func kv_s(fd: i64, key: *u8, val: *u8) -> i64 { wq(fd); w(fd, key); wq(fd); wc(fd, 58); wq(fd); wj(fd, val); wq(fd); return 0 }
164func kv_n(fd: i64, key: *u8, v: i64) -> i64 { wq(fd); w(fd, key); wq(fd); wc(fd, 58); wn(fd, v); return 0 }
165func streq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } if b[i] != (0 as u8) { return 0 } return 1 }
166func slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
167
168func ev_read(path: *u8, buf: *u8, cap: i64) -> i64 {
169 let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 - 1 }
170 var tot: i64 = 0
171 while tot < cap { let r: i64 = sys_read(fd, (buf as i64 + tot) as *u8, cap - tot); if r <= 0 { break } tot = tot + r }
172 sys_close(fd); return tot
173}
174
175// find `needle` in buf[0..n); return the byte offset of the START of the LINE containing the FIRST hit, or -1.
176// also writes the total occurrence count to *cnt.
177func ev_ident_ch(c: i64) -> i64 {
178 if c >= 48 { if c <= 57 { return 1 } }
179 if c >= 65 { if c <= 90 { return 1 } }
180 if c >= 97 { if c <= 122 { return 1 } }
181 if c == 95 { return 1 }
182 return 0
183}
184
185func ev_find_line(buf: *u8, n: i64, needle: *u8, cnt: *i64) -> i64 {
186 let nl: i64 = slen(needle)
187 var first: i64 = 0 - 1
188 var occ: i64 = 0
189 var i: i64 = 0
190 while i + nl <= n {
191 var k: i64 = 0
192 var hit: i64 = 1
193 while k < nl { if buf[i + k] != needle[k] { hit = 0; k = nl } else { k = k + 1 } }
194 if hit == 1 {
195 // WORD BOUNDARY, NOT SUBSTRING. A claim citing bidxv2 was being satisfied by the DEAD
196 // function bidxv2_unused (zero callers), and the domain still folded all-grounded=1 and
197 // MEASURED-HONEST. The _unused suffix is the strongest in-repo signal that code is NOT
198 // wired, and the old substring test read it as proof that it IS. The same rule now also
199 // rejects _old / _deprecated / _v1 renames and prefix collisions, e.g. a claim citing
200 // gs_thumb must not be grounded by gs_thumbnail_legacy. Found 2026-08-01 one step before
201 // an oracle row would have been signed onto the dead claim.
202 if i > 0 { if ev_ident_ch(buf[i - 1] as i64) == 1 { hit = 0 } }
203 if i + nl < n { if ev_ident_ch(buf[i + nl] as i64) == 1 { hit = 0 } }
204 }
205 if hit == 1 {
206 occ = occ + 1
207 if first < 0 {
208 var ls: i64 = i
209 while ls > 0 { if buf[ls - 1] == (10 as u8) { ls = 0 - ls; ls = 0 - ls; break } ls = ls - 1 }
210 if ls < 0 { ls = 0 }
211 first = ls
212 }
213 i = i + nl
214 } else { i = i + 1 }
215 }
216 cnt[0] = occ
217 return first
218}
219
220// copy the line starting at off (up to newline / cap) into dst, trimming leading whitespace; returns length.
221func ev_line_at(buf: *u8, n: i64, off: i64, dst: *u8, cap: i64) -> i64 {
222 var p: i64 = off
223 while p < n { let c: i64 = buf[p] as i64; if c == 32 { p = p + 1 } else { if c == 9 { p = p + 1 } else { break } } }
224 var t: i64 = 0
225 while p < n { if buf[p] == (10 as u8) { break } if t < cap - 1 { dst[t] = buf[p]; t = t + 1 } p = p + 1 }
226 dst[t] = 0 as u8
227 return t
228}
229
230// find the first occurrence of needle in ob[0..on); parse the integer right after it.
231// returns the value (or -1 if needle/digits absent); endpos[0] = byte after the digits (-1 if no hit).
232// RENAMED 2026-07-31 (debt 1785518763). This was ALSO called ev_num_after, colliding
233// with the (buf, n, key, kl: i64) variant defined above: same name, same arity,
234// INCOMPATIBLE 4th parameter (i64 key-length there, *i64 out-pointer here). nx_cc
235// accepted the redefinition silently and the FIRST definition won, so every call site
236// below passed the mmap'd `ep` POINTER into `kl: i64`, making the loop guard
237// `i <= n - kl` compare against a huge address so it NEVER executed and the function
238// returned -1 unconditionally -- ev_parse_pass could never match pass=/passed/PASS=/FAIL=
239// and reported a ZERO tally for EVERY gate, silently. Distinct behaviour, distinct name.
240func ev_num_after_endpos(ob: *u8, on: i64, needle: *u8, endpos: *i64) -> i64 {
241 let nl: i64 = slen(needle)
242 var i: i64 = 0
243 while i + nl <= on {
244 var k: i64 = 0
245 var hit: i64 = 1
246 while k < nl { if ob[i + k] != needle[k] { hit = 0; k = nl } else { k = k + 1 } }
247 if hit == 1 {
248 var bi: i64 = i + nl
249 var v: i64 = 0
250 var any: i64 = 0
251 var go: i64 = 1
252 while go == 1 {
253 if bi >= on { go = 0 } else {
254 let c: i64 = ob[bi] as i64
255 if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); any = 1; bi = bi + 1 } else { go = 0 } } else { go = 0 }
256 }
257 }
258 endpos[0] = bi
259 if any == 1 { return v }
260 return 0 - 1
261 }
262 i = i + 1
263 }
264 endpos[0] = 0 - 1
265 return 0 - 1
266}
267
268// parse a gate's pass tally from its captured output. Handles the fleet's real formats:
269// "pass=N/M" (nx_project) "passed N/M" (provenance) "PASS=N FAIL=K" (audit/orchestrate)
270// writes N to outn, M to outm (M = N when no denominator is printed).
271func ev_parse_pass(ob: *u8, on: i64, outn: *i64, outm: *i64) -> i64 {
272 outn[0] = 0
273 outm[0] = 0
274 let ep: *i64 = sys_mmap(16) as *i64
275 var v: i64 = ev_num_after_endpos(ob, on, "pass=" as *u8, ep)
276 if v < 0 { v = ev_num_after_endpos(ob, on, "passed " as *u8, ep) }
277 if v >= 0 {
278 outn[0] = v
279 outm[0] = v
280 if ep[0] >= 0 { if ep[0] < on { if ob[ep[0]] == (47 as u8) {
281 var bi: i64 = ep[0] + 1
282 var m2: i64 = 0
283 var any2: i64 = 0
284 var go2: i64 = 1
285 while go2 == 1 {
286 if bi >= on { go2 = 0 } else {
287 let c2: i64 = ob[bi] as i64
288 if c2 >= 48 { if c2 <= 57 { m2 = m2 * 10 + (c2 - 48); any2 = 1; bi = bi + 1 } else { go2 = 0 } } else { go2 = 0 }
289 }
290 }
291 if any2 == 1 { outm[0] = m2 }
292 } } }
293 return 1
294 }
295 let v2: i64 = ev_num_after_endpos(ob, on, "PASS=" as *u8, ep)
296 if v2 >= 0 {
297 outn[0] = v2
298 outm[0] = v2
299 let f2: i64 = ev_num_after_endpos(ob, on, "FAIL=" as *u8, ep)
300 if f2 >= 0 { outm[0] = v2 + f2 }
301 return 1
302 }
303 return 0
304}
305
306// ---- seq1789: THE GATE DEADLINE IS DATA (rule 11/17), not a literal buried in the runner --------------
307// The default is deliberately GENEROUS. This bound exists to turn INFINITY into a finite answer, not to
308// police slow gates: a domain gate legitimately walks tens of thousands of files (the librarian audit
309// scans 16,672), and a tight bound would manufacture false TIMEOUTs -- the same lie as a false GREEN with
310// the sign flipped. Override per host with a single integer (milliseconds) in the conf below; a value
311// under the floor, an unreadable file, or a file with no digits all fall back to the compiled default,
312// because a misconfigured deadline must never be MORE permissive than the one shipped.
313const EV_GR_DEADLINE_MS: i64 = 120000
314const EV_GR_DEADLINE_MIN: i64 = 1000
315const EV_GR_DEADLINE_CONF: *u8 = "knowledge/status/evidence_gate_deadline.conf"
316
317func ev_gate_deadline_ms() -> i64 {
318 let fd: i64 = sys_openat_rd(EV_GR_DEADLINE_CONF)
319 if fd < 0 { return EV_GR_DEADLINE_MS }
320 let b: *u8 = sys_mmap(64)
321 let n: i64 = sys_read(fd, b, 63)
322 sys_close(fd)
323 if n <= 0 { return EV_GR_DEADLINE_MS }
324 var v: i64 = 0
325 var seen: i64 = 0
326 var i: i64 = 0
327 while i < n {
328 let c: i64 = b[i] as i64
329 if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); seen = 1 } }
330 if c == 10 { i = n } else { i = i + 1 }
331 }
332 if seen == 0 { return EV_GR_DEADLINE_MS }
333 if v < EV_GR_DEADLINE_MIN { return EV_GR_DEADLINE_MS }
334 return v
335}
336
337// ---- PER-GATE DEADLINE OVERRIDE (added 2026-08-01) ----------------------------------------------
338// The global deadline exists to turn INFINITY into a finite answer, and this file already says a tight
339// bound "would manufacture false TIMEOUTs -- the same lie as a false GREEN with the sign flipped".
340// That is exactly what was happening: nx_vcodec_bgop_bench sweeps qp10-40 with a full decode-parity
341// check and legitimately needs HOURS, so against the 420s host deadline it reported exit=124 and its
342// whole domain read RED -- while the bench was demonstrably producing correct output (par=0).
343// A single global number cannot serve both a 2-second KAT and a 2-hour sweep, so the budget is now
344// PER GATE: knowledge/status/evidence_gate_deadline_overrides.conf holds "<elf-basename> <ms>" rows.
345// Absent file, absent row, or a value below the floor -> the global deadline, unchanged. This can only
346// ever LENGTHEN a specific named gate's rope; it cannot shorten or disable the bound for anything.
347const EV_GR_OVR_CONF: *u8 = "knowledge/status/evidence_gate_deadline_overrides.conf"
348
349// basename of a path (after the last '/')
350func ev_basename(pth: *u8) -> *u8 {
351 var n: i64 = 0
352 while pth[n] != (0 as u8) { n = n + 1 }
353 var b: i64 = 0
354 var i: i64 = 0
355 while i < n { if pth[i] == (47 as u8) { b = i + 1 } i = i + 1 }
356 return ((pth as i64) + b) as *u8
357}
358
359func ev_gate_deadline_for(elf: *u8) -> i64 {
360 let base: i64 = ev_gate_deadline_ms()
361 let fd: i64 = sys_openat_rd(EV_GR_OVR_CONF)
362 if fd < 0 { return base }
363 let cap: i64 = EV_MAGIC_8192
364 let b: *u8 = sys_mmap(cap)
365 let n: i64 = sys_read(fd, b, cap - 1)
366 sys_close(fd)
367 if n <= 0 { return base }
368 let want: *u8 = ev_basename(elf)
369 var wl: i64 = 0
370 while want[wl] != (0 as u8) { wl = wl + 1 }
371 var i: i64 = 0
372 while i < n {
373 var e: i64 = i
374 while e < n { if b[e] == (10 as u8) { break } e = e + 1 }
375 if b[i] != (35 as u8) {
376 // does the line start with the basename followed by a space or tab?
377 var m: i64 = 1
378 var k: i64 = 0
379 while k < wl { if i + k >= e { m = 0; k = wl } else { if b[i + k] != want[k] { m = 0; k = wl } else { k = k + 1 } } }
380 if m == 1 {
381 var q: i64 = i + wl
382 if q < e {
383 if b[q] == (32 as u8) { m = 1 } else { if b[q] == (9 as u8) { m = 1 } else { m = 0 } }
384 } else { m = 0 }
385 if m == 1 {
386 var v: i64 = 0
387 var seen: i64 = 0
388 while q < e {
389 let c: i64 = b[q] as i64
390 if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); seen = 1 } }
391 q = q + 1
392 }
393 if seen == 1 { if v >= EV_GR_DEADLINE_MIN { return v } }
394 return base
395 }
396 }
397 }
398 i = e + 1
399 }
400 return base
401}
402
403// fork the elf (argless if av0 only), redirect child stdout+stderr to outpath; return exit code, 128+sig,
404// or 124 when the gate breached its deadline and was SIGKILLed.
405func ev_run(elf: *u8, outpath: *u8) -> i64 {
406 // ★RESOLVE THE GATE BINARY BEFORE EXECVE. ev_resolve has delegated to ar_resolve since round 4, but only
407 // for SOURCES -- the gate EXECUTION path still ran the .gates first field exactly as written. On the NAS,
408 // where promote installs binaries FLAT at the serving root, a row naming `_offc/nx_medbill_nsa_gate.elf`
409 // therefore died with 127, and the board published the domain as CLAIMED-BUT-RED, which it calls
410 // "worse than claim-only".
411 // ★★MEASURED 2026-07-30, and this is the whole point: nx_bite_sweep resolves the SAME .gates rows through
412 // ar_resolve and RAN those gates and KILLED MUTANTS with them, in the same minute this reader was calling
413 // them missing. Two readers of one declaration disagreed, and the one reporting ABSENCE was the broken
414 // one -- absence is exactly what an unresolved path looks like. Four domains were being defamed by a
415 // path bug while their gates were provably alive.
416 // Fixed at the CHOKEPOINT, not the call sites: every caller of ev_run gets it, no signature churn.
417 // ar_resolve leaves out == input and returns 0 when it cannot resolve, so an genuinely absent binary
418 // still fails as 127 naming what was actually asked for.
419 let eres: *u8 = sys_mmap(EV_MAGIC_1024)
420 var eelf: *u8 = elf
421 if ev_resolve(elf, eres) == 1 { eelf = eres }
422 // ★★★seq1789: BOUNDED. This forked each gate and then sys_wait4(pid, stp, 0) -- a BLOCKING wait with no
423 // deadline -- so ONE hung gate hung the whole domain read, forever. Measured 2026-07-30: nx_orchestrate_gate
424 // wedged (a seg-store handle opened per RACI row and never closed), and `nx_swcompare_evidence librarian`
425 // never returned at all. The symptom presented as an MCP transport error, so the instrument's own failure
426 // was read as the network's -- three domains looked fine and one looked like flaky infrastructure.
427 // LAW: AN INSTRUMENT ITS SUBJECT CAN HANG MEASURES NOTHING -- not the hung subject, and not the healthy
428 // ones queued behind it. A measurement tool must bound every subject it runs, because the whole point is
429 // that the subject is UNTRUSTED; "the gate will terminate" is the assumption under test.
430 // No new mechanism: nx_guarded_run has been the ecosystem's hang-proof exec since 2026-06-10 (WNOHANG poll
431 // + SIGKILL, since SIGTERM does not reap these). This was an ADOPTION gap, not a missing primitive -- the
432 // same shape as the memory-floor guard earlier today. A timeout now surfaces as its OWN exit code (124),
433 // distinct from 127 (binary absent) and 1 (gate genuinely RED), so the three are never again confused.
434 let ofd: i64 = sys_openat_wr(outpath, 0x1a4)
435 let argv: *i64 = sys_mmap(16) as *i64
436 argv[0] = eelf as i64; argv[1] = 0
437 let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
438 let rc: i64 = nx_guarded_run(eelf, argv, envp, ev_gate_deadline_for(eelf), ofd, ofd)
439 if ofd >= 0 { sys_close(ofd) }
440 return rc
441}
442
443// ---- parse one .matrix line into fields[0..8] (label|organ|symbol|exceed|c1..c4|note); return field count ----
444func ev_split(line: *u8, ln: i64, fs: *i64, fe: *i64, maxf: i64) -> i64 {
445 var nf: i64 = 0
446 var s: i64 = 0
447 var i: i64 = 0
448 while i <= ln {
449 if i == ln { if nf < maxf { fs[nf] = s; fe[nf] = i; nf = nf + 1 } i = i + 1 }
450 else { if line[i] == (124 as u8) { if nf < maxf { fs[nf] = s; fe[nf] = i; nf = nf + 1 } s = i + 1; i = i + 1 } else { i = i + 1 } }
451 }
452 return nf
453}
454func ev_fcopy(line: *u8, s: i64, e: i64, dst: *u8, cap: i64) -> i64 {
455 var t: i64 = 0
456 var p: i64 = s
457 while p < e { if t < cap - 1 { dst[t] = line[p]; t = t + 1 } p = p + 1 }
458 dst[t] = 0 as u8
459 return t
460}
461
462// counters returned in st: 0=axes 1=grounded 2=ungrounded 3=absent 4=present_claims
463func ev_scan(domain: *u8, mode: i64, st: *i64) -> i64 {
464 // load the matrix file
465 let mpath: *u8 = sys_mmap(256)
466 var mo: i64 = 0
467 let pfx: *u8 = "knowledge/compare/"
468 var pi: i64 = 0
469 while pfx[pi] != (0 as u8) { mpath[mo] = pfx[pi]; mo = mo + 1; pi = pi + 1 }
470 var di: i64 = 0
471 while domain[di] != (0 as u8) { mpath[mo] = domain[di]; mo = mo + 1; di = di + 1 }
472 let sfx: *u8 = ".matrix"
473 var si: i64 = 0
474 while sfx[si] != (0 as u8) { mpath[mo] = sfx[si]; mo = mo + 1; si = si + 1 }
475 mpath[mo] = 0 as u8
476 let mbuf: *u8 = sys_mmap(EV_MAGIC_65536)
477 let mn: i64 = ev_read(mpath, mbuf, EV_MAGIC_65536)
478 if mn <= 0 { w(1, "EVIDENCE: matrix file missing -- fail loud\n" as *u8); return 1 }
479
480 // organ source cache buffer (reused per row)
481 let src: *u8 = sys_mmap(EV_MAGIC_2097152)
482 let line: *u8 = sys_mmap(EV_MAGIC_1024)
483 let flabel: *u8 = sys_mmap(256)
484 let forgan: *u8 = sys_mmap(256)
485 let fsym: *u8 = sys_mmap(128)
486 let fc1: *u8 = sys_mmap(16)
487 let codeline: *u8 = sys_mmap(EV_MAGIC_1024)
488 let fs: *i64 = sys_mmap(8 * 32) as *i64
489 let fe: *i64 = sys_mmap(8 * 32) as *i64
490 let cnt: *i64 = sys_mmap(16) as *i64
491
492 st[0] = 0; st[1] = 0; st[2] = 0; st[3] = 0; st[4] = 0
493
494 if mode == 1 { w(1, ",\n " as *u8); wc(1, 34); w(1, "axes" as *u8); wc(1, 34); wc(1, 58); w(1, "[\n" as *u8) }
495 if mode == 2 {
496 w(1, "<h2 style='font-size:clamp(1.05rem,2.5vw,1.25rem);margin:24px 0 10px'>Per-axis grounding (real source lines)</h2>\n" as *u8)
497 w(1, "<p class='meth'>Each capability we mark present is <b>grounded</b>: the evidence organ opens the named Nishi organ on disk, finds the implementing symbol, and shows the <b>actual source line</b> proving it (with an occurrence count). A claim whose symbol is absent from its file fails the build — so this table cannot contain an ungrounded “Yes”.</p>\n" as *u8)
498 w(1, "<div class='wrap'><table><thead><tr><th>Capability</th><th>Organ</th><th>Symbol</th><th>Occurrences</th><th>Evidence (source line)</th></tr></thead><tbody>\n" as *u8)
499 }
500
501 var first_json: i64 = 1
502 var i: i64 = 0
503 while i < mn {
504 var e: i64 = i
505 while e < mn { if mbuf[e] == (10 as u8) { break } e = e + 1 }
506 let ll: i64 = e - i
507 if ll > 0 {
508 if mbuf[i] != (35 as u8) { if mbuf[i] != (64 as u8) {
509 // copy the line
510 var t: i64 = 0
511 while t < ll { if t < 1023 { line[t] = mbuf[i + t] } t = t + 1 }
512 line[ll] = 0 as u8
513 let nf: i64 = ev_split(line, ll, fs, fe, 32)
514 if nf >= 9 {
515 ev_fcopy(line, fs[0], fe[0], flabel, 256)
516 ev_fcopy(line, fs[1], fe[1], forgan, 256)
517 ev_fcopy(line, fs[2], fe[2], fsym, 128)
518 ev_fcopy(line, fs[3], fe[3], fc1, 16)
519 st[0] = st[0] + 1
520 var absent: i64 = 0
521 if streq(fsym, "_ABSENT_" as *u8) == 1 { absent = 1 }
522 if absent == 1 {
523 st[3] = st[3] + 1
524 } else {
525 st[4] = st[4] + 1
526 // ground it: read organ, find the symbol line. Resolve first -- a source living
527 // under a different artifact root is NOT an ungrounded claim, and reporting it as
528 // one is how 9 of 9 real warden axes read UNGROUNDED on the NAS while every symbol
529 // was present in the tree the whole time.
530 let fres: *u8 = sys_mmap(512)
531 ev_resolve(forgan, fres)
532 let sn: i64 = ev_read(fres, src, EV_MAGIC_2097152)
533 var found: i64 = 0
534 cnt[0] = 0
535 codeline[0] = 0 as u8
536 if sn > 0 {
537 let off: i64 = ev_find_line(src, sn, fsym, cnt)
538 if off >= 0 { found = 1; ev_line_at(src, sn, off, codeline, 240) }
539 }
540 if found == 1 { st[1] = st[1] + 1 } else { st[2] = st[2] + 1 }
541 if mode == 0 {
542 w(1, " [" as *u8)
543 if found == 1 { w(1, "GROUNDED " as *u8) } else { w(1, "UNGROUNDED" as *u8) }
544 w(1, "] " as *u8); w(1, flabel); w(1, " sym=" as *u8); w(1, fsym); w(1, " x" as *u8); wn(1, cnt[0])
545 w(1, " @ " as *u8); w(1, forgan); w(1, "\n" as *u8)
546 }
547 if mode == 1 {
548 if first_json == 0 { w(1, ",\n" as *u8) }
549 first_json = 0
550 w(1, " {" as *u8)
551 kv_s(1, "axis" as *u8, flabel); wc(1, 44)
552 kv_s(1, "organ" as *u8, forgan); wc(1, 44)
553 kv_s(1, "symbol" as *u8, fsym); wc(1, 44)
554 kv_n(1, "grounded" as *u8, found); wc(1, 44)
555 kv_n(1, "occurrences" as *u8, cnt[0]); wc(1, 44)
556 kv_s(1, "evidence_line" as *u8, codeline)
557 w(1, "}" as *u8)
558 }
559 if mode == 2 {
560 w(1, "<tr><td class='cat'>" as *u8); w(1, flabel); w(1, "</td><td class='note'>" as *u8); w(1, forgan)
561 w(1, "</td><td><code>" as *u8); w(1, fsym); w(1, "</code></td><td class='b" as *u8)
562 if found == 1 { w(1, " y'>" as *u8) } else { w(1, " n'>" as *u8) }
563 wn(1, cnt[0]); w(1, "</td><td class='note'><code>" as *u8)
564 // HTML-escape < > & in the source line
565 var ci: i64 = 0
566 while codeline[ci] != (0 as u8) {
567 let c: i64 = codeline[ci] as i64
568 if c == 60 { w(1, "<" as *u8) } else { if c == 62 { w(1, ">" as *u8) } else { if c == 38 { w(1, "&" as *u8) } else { wc(1, c) } } }
569 ci = ci + 1
570 }
571 w(1, "</code></td></tr>\n" as *u8)
572 }
573 }
574 }
575 } }
576 }
577 i = e + 1
578 }
579 if mode == 1 { w(1, "\n ]" as *u8) }
580 if mode == 2 { w(1, "</tbody></table></div>\n" as *u8) }
581 return 0
582}
583
584// run the executable gates; returns green count, writes ran count to *ran
585func ev_gates(domain: *u8, mode: i64, ran: *i64, st_out: *i64) -> i64 {
586 let gpath: *u8 = sys_mmap(256)
587 var mo: i64 = 0
588 let pfx: *u8 = "knowledge/compare/"
589 var pi: i64 = 0
590 while pfx[pi] != (0 as u8) { gpath[mo] = pfx[pi]; mo = mo + 1; pi = pi + 1 }
591 var di: i64 = 0
592 while domain[di] != (0 as u8) { gpath[mo] = domain[di]; mo = mo + 1; di = di + 1 }
593 let sfx: *u8 = ".gates"
594 var si: i64 = 0
595 while sfx[si] != (0 as u8) { gpath[mo] = sfx[si]; mo = mo + 1; si = si + 1 }
596 gpath[mo] = 0 as u8
597 let gbuf: *u8 = sys_mmap(EV_MAGIC_16384)
598 let gn: i64 = ev_read(gpath, gbuf, EV_MAGIC_16384)
599 ran[0] = 0
600 var green: i64 = 0
601 if gn <= 0 { return 0 }
602
603 let line: *u8 = sys_mmap(EV_MAGIC_1024)
604 let felf: *u8 = sys_mmap(256)
605 let frel: *u8 = sys_mmap(512)
606 let flabel: *u8 = sys_mmap(256)
607 let outp: *u8 = sys_mmap(256)
608 let ob: *u8 = sys_mmap(EV_MAGIC_65536)
609 let fs: *i64 = sys_mmap(8 * 8) as *i64
610 let fe: *i64 = sys_mmap(8 * 8) as *i64
611 let cnt: *i64 = sys_mmap(16) as *i64
612
613 if mode == 2 {
614 w(1, "<h2 style='font-size:clamp(1.05rem,2.5vw,1.25rem);margin:24px 0 10px'>Executed proofs (gates forked live)</h2>\n" as *u8)
615 w(1, "<p class='meth'>These are not stored numbers. For each proof the evidence organ <b>forks the real gate elf</b> and captures its verdict on this run — the same self-test that gates the build. A red or crashed gate fails this page.</p>\n" as *u8)
616 }
617 if mode == 1 { w(1, ",\n " as *u8); wc(1, 34); w(1, "executed" as *u8); wc(1, 34); wc(1, 58); w(1, "[\n" as *u8) }
618
619 var uniq: i64 = EV_MAGIC_12345
620 var first_json: i64 = 1
621 var i: i64 = 0
622 while i < gn {
623 var e: i64 = i
624 while e < gn { if gbuf[e] == (10 as u8) { break } e = e + 1 }
625 let ll: i64 = e - i
626 if ll > 0 { if gbuf[i] != (35 as u8) {
627 var t: i64 = 0
628 while t < ll { if t < 1023 { line[t] = gbuf[i + t] } t = t + 1 }
629 line[ll] = 0 as u8
630 let nf: i64 = ev_split(line, ll, fs, fe, 8)
631 if nf >= 3 {
632 ev_fcopy(line, fs[0], fe[0], felf, 256)
633 ev_fcopy(line, fs[2], fe[2], flabel, 256)
634 ev_resolve(felf, frel) // find the artifact on THIS host before judging it missing
635 ev_prov_fold(frel) // hash the binary we are about to trust, where we are trusting it
636 ev_bite_fold(frel) // and check it has been proven able to FAIL
637 var oo: i64 = 0
638 let op: *u8 = "/tmp/ev_"
639 var oi: i64 = 0
640 while op[oi] != (0 as u8) { outp[oo] = op[oi]; oo = oo + 1; oi = oi + 1 }
641 oo = oo + 0
642 var m: i64 = uniq
643 let tb: *u8 = sys_mmap(24); var k: i64 = 0
644 while m > 0 { tb[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
645 var q: i64 = k - 1
646 while q >= 0 { outp[oo] = tb[q]; oo = oo + 1; q = q - 1 }
647 let oe: *u8 = ".out"
648 var ei: i64 = 0
649 while oe[ei] != (0 as u8) { outp[oo] = oe[ei]; oo = oo + 1; ei = ei + 1 }
650 outp[oo] = 0 as u8
651 uniq = uniq + 7
652
653 let rc: i64 = ev_run(frel, outp)
654 let on: i64 = ev_read(outp, ob, EV_MAGIC_65536)
655 let pnb: *i64 = sys_mmap(16) as *i64
656 let pmb: *i64 = sys_mmap(16) as *i64
657 ev_parse_pass(ob, on, pnb, pmb)
658 let pass_n: i64 = pnb[0]
659 let pass_m: i64 = pmb[0]
660 cnt[0] = 0
661 let greenoff: i64 = ev_find_line(ob, on, "GREEN" as *u8, cnt)
662 var is_green: i64 = 0
663 if greenoff >= 0 { if rc == 0 { is_green = 1 } }
664 ran[0] = ran[0] + 1
665 if is_green == 1 { green = green + 1 }
666
667 if mode == 0 {
668 w(1, " [" as *u8); if is_green == 1 { w(1, "GREEN " as *u8) } else { w(1, "RED " as *u8) } w(1, "] exit=" as *u8); wn(1, rc)
669 w(1, " pass=" as *u8); wn(1, pass_n); w(1, "/" as *u8); wn(1, pass_m); w(1, " " as *u8); w(1, flabel); w(1, "\n" as *u8)
670 }
671 if mode == 1 {
672 if first_json == 0 { w(1, ",\n" as *u8) }
673 first_json = 0
674 w(1, " {" as *u8)
675 kv_s(1, "proof" as *u8, flabel); wc(1, 44)
676 kv_s(1, "elf" as *u8, felf); wc(1, 44)
677 kv_n(1, "exit" as *u8, rc); wc(1, 44)
678 kv_n(1, "pass" as *u8, pass_n); wc(1, 44)
679 kv_n(1, "of" as *u8, pass_m); wc(1, 44)
680 kv_n(1, "green" as *u8, is_green)
681 w(1, "}" as *u8)
682 }
683 if mode == 2 {
684 w(1, "<div class='verdict'><b>" as *u8)
685 if is_green == 1 { w(1, "GREEN" as *u8) } else { w(1, "RED" as *u8) }
686 w(1, "</b> — forked <code>" as *u8); w(1, felf); w(1, "</code> → pass=" as *u8); wn(1, pass_n); w(1, "/" as *u8); wn(1, pass_m)
687 w(1, ", exit " as *u8); wn(1, rc); w(1, ". " as *u8); w(1, flabel); w(1, "</div>\n" as *u8)
688 }
689 st_out[0] = pass_n
690 st_out[1] = pass_m
691 }
692 } }
693 i = e + 1
694 }
695 if mode == 1 { w(1, "\n ]" as *u8) }
696 return green
697}
698
699// STAMP the verdict to knowledge/status/evstamp_<domain>.verdict so nx_sota_status reads PROVEN fast + live
700// (the deep verdict costs ~20s/domain -- too slow to inline on every status call; this materializes it).
701func ev_stamp(domain: *u8, ok: i64, grounded: i64, present: i64, green: i64, ran: i64) -> i64 {
702 let path: *u8 = sys_mmap(256)
703 var o: i64 = 0
704 let pre: *u8 = "knowledge/status/evstamp_"
705 var i: i64 = 0
706 while pre[i] != (0 as u8) { path[o] = pre[i]; o = o + 1; i = i + 1 }
707 i = 0
708 while domain[i] != (0 as u8) { path[o] = domain[i]; o = o + 1; i = i + 1 }
709 let sfx: *u8 = ".verdict"
710 i = 0
711 while sfx[i] != (0 as u8) { path[o] = sfx[i]; o = o + 1; i = i + 1 }
712 path[o] = 0 as u8
713 let fd: i64 = sys_openat_wr(path, 0x1a4)
714 if fd < 0 { return 0 - 1 }
715 w(fd, "ok=" as *u8); wn(fd, ok); w(fd, " epoch=" as *u8); wn(fd, sys_now_realtime_sec())
716 w(fd, " grounded=" as *u8); wn(fd, grounded); w(fd, "/" as *u8); wn(fd, present)
717 w(fd, " gates=" as *u8); wn(fd, green); w(fd, "/" as *u8); wn(fd, ran)
718 // ---- v2 PROVENANCE (additive per rule 19: v1 readers ignore these; the new reader REQUIRES them) ----
719 // declared/hashed says how many gate binaries were actually present to be hashed. When they differ, the
720 // suite digest is undefined and no reader may treat this stamp as proof -- that is the whole point.
721 w(fd, " declared=" as *u8); wn(fd, ev_prov_declared); w(fd, " hashed=" as *u8); wn(fd, ev_prov_present)
722 w(fd, " redseen=" as *u8); wn(fd, ev_bite_seen)
723 w(fd, " host=" as *u8); ev_write_host(fd)
724 w(fd, " dig=" as *u8); ev_write_dig(fd)
725 w(fd, "\n" as *u8)
726 sys_close(fd)
727 return 0
728}
729
730// WHERE this verdict was produced. A stamp that cannot name its own machine is a rumour about a machine.
731func ev_write_host(fd: i64) -> i64 {
732 let hb: *u8 = sys_mmap(256)
733 let n: i64 = ev_read("/etc/hostname" as *u8, hb, 255)
734 if n <= 0 { w(fd, "UNKNOWN" as *u8); return 0 }
735 var k: i64 = 0
736 while k < n { if hb[k] == (10 as u8) { break } if hb[k] == (32 as u8) { break } k = k + 1 }
737 if k <= 0 { w(fd, "UNKNOWN" as *u8); return 0 }
738 sys_write(fd, hb, k)
739 return 0
740}
741
742// WHAT was executed, as a hex digest over every gate binary. Emitted as ABSENT unless every declared gate
743// was present and hashed -- a partial digest would be worse than none, because it would look like proof.
744func ev_write_dig(fd: i64) -> i64 {
745 if ev_prov_declared <= 0 { w(fd, "ABSENT" as *u8); return 0 }
746 if ev_prov_present != ev_prov_declared { w(fd, "ABSENT" as *u8); return 0 }
747 let hex: *u8 = "0123456789abcdef"
748 let out: *u8 = sys_mmap(72)
749 var j: i64 = 0
750 while j < 32 {
751 let b: i64 = ev_prov_acc[j] as i64
752 out[j*2] = hex[(b >> 4) & 15]
753 out[j*2+1] = hex[b & 15]
754 j = j + 1
755 }
756 sys_write(fd, out, 64)
757 return 0
758}
759
760func main(argc: i64, argv: *i64) -> i64 {
761 if argc < 2 { w(1, "usage: nx_swcompare_evidence <domain> [json|html]\n" as *u8); sys_exit(2); return 2 }
762 let domain: *u8 = argv[1] as *u8
763 var mode: i64 = 0
764 if argc >= 3 { if streq(argv[2] as *u8, "json" as *u8) == 1 { mode = 1 } if streq(argv[2] as *u8, "html" as *u8) == 1 { mode = 2 } }
765
766 if mode == 2 {
767 w(1, "<" as *u8); wc(1, 33); w(1, "DOCTYPE html>\n<html lang=\"en\"><head><meta charset='utf-8'><meta name='viewport' content='width=device-width, initial-scale=1'>\n" as *u8)
768 w(1, "<title>Nishi Compare -- Evidence: " as *u8); w(1, domain); w(1, "</title>\n<style>\n" as *u8)
769 w(1, ":root{--nx-color-bg:rgb(255,255,255);--nx-color-fg:rgb(22,22,34);--nx-color-accent:rgb(42,77,143);--bg:var(--nx-color-bg);--fg:var(--nx-color-fg);--ac:var(--nx-color-accent);--y:rgb(26,127,55);--n:rgb(179,38,30);--line:rgb(227,227,234);--soft:rgb(246,247,251)}\n" as *u8)
770 w(1, "*{box-sizing:border-box}body{background:var(--bg);font-family:-apple-system,Segoe UI,Roboto,sans-serif;max-width:1080px;margin:0 auto;padding:0 clamp(14px,4vw,20px) 5vh;color:var(--fg);line-height:1.6;font-size:clamp(15px,0.6vw + 13px,17px)}\n" as *u8)
771 w(1, "h1{font-size:clamp(1.6rem,4vw,2rem);margin:0 0 4px;background:linear-gradient(90deg,var(--ac),rgb(130,80,223));-webkit-background-clip:text;background-clip:text;-webkit-text-fill-color:transparent;color:transparent}.sub{color:rgb(102,102,102);font-size:clamp(.95rem,2vw,1.05rem)}.crumb{font-size:.85rem;margin-bottom:18px}a{color:var(--ac)}\n" as *u8)
772 w(1, ".skip-link{position:absolute;left:-999px;top:0;background:var(--ac);color:rgb(255,255,255);padding:12px 16px;z-index:9;border-radius:0 0 8px 0}.skip-link:focus{left:0}\n" as *u8)
773 w(1, ".hd{background:linear-gradient(90deg,var(--ac),rgb(9,58,136));border-radius:0 0 12px 12px;margin:0 0 20px}.hd nav{display:flex;gap:8px;flex-wrap:wrap;padding:8px 14px}.hd a{color:rgb(255,255,255);text-decoration:none;padding:10px 12px;border-radius:8px;font-weight:600;min-height:44px;display:inline-flex;align-items:center}\n" as *u8)
774 w(1, ".meth{background:var(--soft);border:1px solid var(--line);border-radius:12px;padding:14px 18px;margin:16px 0;font-size:.9rem}.wrap{overflow-x:auto;border:1px solid var(--line);border-radius:12px;box-shadow:0 1px 3px rgba(16,20,28,0.08)}table{border-collapse:collapse;width:100%;min-width:820px;font-size:.9rem}\n" as *u8)
775 w(1, "th,td{padding:9px 12px;text-align:left;border-bottom:1px solid var(--line);vertical-align:top}thead th{background:var(--soft);font-weight:600}.cat{font-weight:600}.note{color:rgb(119,119,119);font-size:.82rem}td.b{text-align:center;font-weight:600}td.b.y{color:var(--y)}td.b.n{color:var(--n)}code{font-size:.82rem;white-space:pre-wrap;word-break:break-word}\n" as *u8)
776 w(1, ".verdict{background:var(--soft);border-left:4px solid var(--y);padding:12px 18px;border-radius:0 10px 10px 0;margin:12px 0}.foot{margin-top:28px;color:rgb(136,136,136);font-size:.78rem;border-top:1px solid var(--line);padding-top:14px}\n" as *u8)
777 w(1, ":focus-visible{outline:3px solid var(--ac);outline-offset:2px}main>*{animation:rise .5s ease both}@keyframes rise{from{opacity:0;transform:translateY(10px)}to{opacity:1;transform:none}}@media(prefers-reduced-motion:reduce){main>*{animation:none}}\n" as *u8)
778 w(1, "@media(prefers-color-scheme:dark){:root{--nx-color-bg:rgb(15,15,20);--nx-color-fg:rgb(230,230,238);--line:rgb(38,38,47);--soft:rgb(23,23,31)}}\n" as *u8)
779 w(1, "</style></head><body>\n" as *u8)
780 w(1, "<a class='skip-link' href='" as *u8); wc(1, 35); w(1, "main'>Skip to content</a><header class='hd'><nav><a href='/'>Nishi Family</a><a href='/compare'>Compare</a></nav></header><main id='main'>\n" as *u8)
781 w(1, "<p class='crumb'><a href='/'>Nishi Family</a> › <a href='/compare'>Compare</a> › Evidence: " as *u8); w(1, domain); w(1, "</p>\n" as *u8)
782 w(1, "<h1>Evidence — " as *u8); w(1, domain); w(1, "</h1>\n<p class='sub'>Every capability we claim, grounded in real source and proven by a live-forked gate. Autonomously generated by nx_swcompare_evidence.</p>\n" as *u8)
783 }
784 if mode == 1 { w(1, "{" as *u8); kv_n(1, "v" as *u8, 1); wc(1, 44); kv_s(1, "domain" as *u8, domain); wc(1, 44); kv_s(1, "kind" as *u8, "evidence" as *u8) }
785 if mode == 0 { w(1, "=== NX-SWCOMPARE-EVIDENCE domain=" as *u8); w(1, domain); w(1, " (grounding + executed proofs) ===\n" as *u8) }
786
787 let gst: *i64 = sys_mmap(16) as *i64
788 let ran: *i64 = sys_mmap(16) as *i64
789 let green: i64 = ev_gates(domain, mode, ran, gst)
790
791 let st: *i64 = sys_mmap(64) as *i64
792 ev_scan(domain, mode, st)
793
794 // NEG-CONTROL: a bogus symbol must NOT be found in a real organ (proves grounding discriminates)
795 let src: *u8 = sys_mmap(EV_MAGIC_2097152)
796 let cnt: *i64 = sys_mmap(16) as *i64
797 let negp: *u8 = sys_mmap(512)
798 ev_resolve("runtime/nx_project.nx" as *u8, negp)
799 let neg_n: i64 = ev_read(negp, src, EV_MAGIC_2097152)
800 var neg_found: i64 = 0
801 if neg_n > 0 { let off: i64 = ev_find_line(src, neg_n, "ZZ_NOT_A_REAL_SYMBOL_QQ" as *u8, cnt); if off >= 0 { neg_found = 1 } }
802
803 let liar_grounded: i64 = (st[2] == 0) as i64
804 let liar_present: i64 = (st[4] >= 5) as i64
805 // QUORUM (fixed 2026-07-30, was the headline defect). This read `if ran[0] > 0 { liar_green = (green >= 1) }`
806 // -- ONE green gate out of any number stamped the whole domain PROVEN, so four RED gates were invisible to
807 // the number we published. MEASURED consequence: medbilling sat in the PROVEN column on that rule.
808 // The law is ev_quorum_ok: every declared gate ran, and every one was green.
809 // The old `ran[0] == 0 -> liar_green = 1` default is ALSO removed deliberately: grounding proves a claim
810 // maps to real source, it does not prove the code works. A domain with no executed gate has no execution
811 // evidence, and must not be stampable as PROVEN on an empty conjunction.
812 let liar_green: i64 = ev_quorum_ok(green, ran[0], ran[0])
813 let liar_neg: i64 = (neg_found == 0) as i64
814
815 if mode == 2 {
816 w(1, "<div class='meth'><b>Liar-kill.</b> ungrounded claims=" as *u8); wn(1, st[2])
817 w(1, " (must be 0) · grounded=" as *u8); wn(1, st[1]); w(1, "/" as *u8); wn(1, st[4])
818 w(1, " present axes · executed gates GREEN=" as *u8); wn(1, green); w(1, "/" as *u8); wn(1, ran[0])
819 w(1, " · neg-control bogus symbol found=" as *u8); wn(1, neg_found); w(1, " (must be 0).</div>\n" as *u8)
820 w(1, "<p class='foot'>Generated by nx_swcompare_evidence — grounding reads real organ source on disk; executed proofs fork the real gate elf on every render. Zero JS, zero trackers, sovereign.</p>\n" as *u8)
821 w(1, "</main></body></html>\n" as *u8)
822 sys_exit(0); return 0
823 }
824 if mode == 1 {
825 wc(1, 44); w(1, "\n " as *u8)
826 kv_n(1, "present_axes" as *u8, st[4]); wc(1, 44)
827 kv_n(1, "grounded" as *u8, st[1]); wc(1, 44)
828 kv_n(1, "ungrounded" as *u8, st[2]); wc(1, 44)
829 kv_n(1, "gates_green" as *u8, green); wc(1, 44)
830 kv_n(1, "gates_ran" as *u8, ran[0])
831 w(1, "\n}\n" as *u8)
832 sys_exit(0); return 0
833 }
834
835 w(1, " TALLY: present_axes=" as *u8); wn(1, st[4]); w(1, " grounded=" as *u8); wn(1, st[1]); w(1, " ungrounded=" as *u8); wn(1, st[2])
836 w(1, " absent=" as *u8); wn(1, st[3]); w(1, " gates_green=" as *u8); wn(1, green); w(1, "/" as *u8); wn(1, ran[0]); w(1, "\n" as *u8)
837 w(1, " LIAR-KILL: all-grounded=" as *u8); wn(1, liar_grounded); w(1, " present>=5=" as *u8); wn(1, liar_present)
838 w(1, " gate-green=" as *u8); wn(1, liar_green); w(1, " neg-control=" as *u8); wn(1, liar_neg); w(1, "\n" as *u8)
839 let ok: i64 = liar_grounded & liar_present & liar_green & liar_neg
840 ev_stamp(domain, ok, st[1], st[4], green, ran[0]) // materialize the verdict for the fast status surface
841 w(1, "NX-SWCOMPARE-EVIDENCE domain=" as *u8); w(1, domain); w(1, " verdict=" as *u8)
842 if ok == 1 { w(1, "MEASURED-HONEST (every claim grounded + gate GREEN)\n" as *u8); sys_exit(0); return 0 }
843 w(1, "RED (an ungrounded claim, dead gate, or neg-control leak)\n" as *u8); sys_exit(1); return 1
844}