`nx_tooldiff.nx` source

↩ module page · 209 lines · 12263 B
1// nx_tooldiff.nx -- toolsplane (seq162 DETECTION half #2: the tool_allowlist ROW-SET shrink detector).
2// Sibling of nx_route_diff (which covers /api routes): THIS catches any GREEN tool row VANISHING (or being
3// de-GREENed) vs a captured baseline -- the allowlist-clobber class (a hub re-assemble, stale-mirror deploy,
4// or bad edit silently killing MCP capability for every session). Transactional use: `snapshot` before a
5// deploy/registry edit, `check` after -> a MISSING name = a capability regression (exit 3 + restore hint).
6// READ-ONLY over the live registry; baseline + verdict land in the evidence layer (deploy_checks row
7// tool-shrink -> nx_deploy_ready surfaces it). ENFORCEMENT/auto-rollback stays mgmt-owned, same stance as
8// nx_route_diff (a cron cannot know intent; the deploy transaction can -- filed rung).
9//   nx_tooldiff snapshot | check
10// ENVELOPE (declared in output): TD_MAXTOOLS rows, TD_REGCAP registry read. exit: 0 GREEN | 3 RED-SHRINK |
11// 4 read-fail | 2 usage.
12// RULE-11 (seq274 / law-warden L001, own-house-first 2026-07-20): v1 of this organ shipped with inline
13// literals (16000/16384/32768/262144). REWRITTEN, not patched -- every bound is a NAMED CONST below, so a
14// future session tuning a limit edits a declaration instead of burying a new magic number in the body.
15// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
16import "nx_syscalls.nx"
17
18const TD_REGCAP: i64 = 262144
19const TD_BLOBCAP: i64 = 16384
20const TD_BASECAP: i64 = 16384
21const TD_BASEREAD: i64 = 16000
22const TD_WBUFMAX: i64 = 16300
23const TD_REPCAP: i64 = 32768
24const TD_REPMAX: i64 = 32000
25// ★★CAP RAISED + TRUNCATION MADE VISIBLE (2026-07-30). This was 512 and the live GREEN allowlist had
26// reached EXACTLY 512, so td_extract stopped at the cap and every row past it was invisible.
27// MEASURED CONSEQUENCE: nx_tooldiff reported `REMOVED: nx_eco_graph_build` = RED-SHRINK = a capability
28// REGRESSION -- while the row sat at tool_allowlist.conf:550, present and GREEN the whole time. The output
29// even printed `current=512` next to `TD_MAXTOOLS=512`, which is the tell, but declared the cap only in a
30// PARENTHETICAL and then presented the truncated scan as the verdict.
31// ★A FALSE CAPABILITY-REGRESSION ALARM IS WORSE THAN NO ALARM: it sends an operator hunting a phantom
32// vanished tool, and it trains everyone to ignore the one check that would catch a REAL allowlist clobber
33// (seq162). Third instance of this class in one session, after nx_debt_hygiene and nx_dbthyg.
34const TD_MAXTOOLS: i64 = 4096
35const TD_PTR: i64 = 8
36const TD_SLACK: i64 = 16
37const TD_NL: i64 = 10
38const TD_TAB: i64 = 9
39const TD_HASH: i64 = 35
40const TD_SNAPCH: i64 = 115
41const TD_MODE: i64 = 420
42const TD_STDOUT: i64 = 1
43const TD_STDERR: i64 = 2
44const TD_EXIT_USAGE: i64 = 2
45const TD_EXIT_SHRINK: i64 = 3
46const TD_EXIT_FAIL: i64 = 4
47
48func td_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
49func td_b(rep: *u8, pos: i64, s: *u8) -> i64 { var p: i64 = pos; var i: i64 = 0; while s[i] != (0 as u8) { if p < TD_REPMAX { rep[p] = s[i]; p = p + 1 } i = i + 1 } return p }
50func td_bn(rep: *u8, pos: i64, v: i64) -> i64 { var p: i64 = pos; var m: i64 = v; if m < 0 { if p < TD_REPMAX { rep[p] = 45 as u8; p = p + 1 } m = 0 - m } let t: *u8 = sys_mmap(28); var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 } while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } var i: i64 = 0; while i < k { if p < TD_REPMAX { rep[p] = t[k - 1 - i]; p = p + 1 } i = i + 1 } return p }
51func td_reads(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var n: i64 = 0
  var go: i64 = 1
  while go == 1 { let r: i64 = sys_read(fd, (buf as i64 + n) as *u8, cap - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap { go = 0 } }
  sys_close(fd)
  return n
59}
60func td_span_eq_z(a: *u8, ls: i64, le: i64, z: *u8) -> i64 {
  var i: i64 = ls
  var j: i64 = 0
  while i < le { if z[j] == (0 as u8) { return 0 } if a[i] != z[j] { return 0 } i = i + 1; j = j + 1 }
  if z[j] != (0 as u8) { return 0 }
  return 1
66}
67func td_in_baseline(bbuf: *u8, bn: i64, z: *u8) -> i64 {
  var ls: i64 = 0
  var i: i64 = 0
  var hit: i64 = 0
  while i <= bn {
      var isend: i64 = 0
      if i == bn { isend = 1 } else { if bbuf[i] == (TD_NL as u8) { isend = 1 } }
      if isend == 1 { if i > ls { if td_span_eq_z(bbuf, ls, i, z) == 1 { hit = 1; i = bn } } ls = i + 1 }
      i = i + 1
  }
  return hit
78}
79func td_line_in_cur(bbuf: *u8, ls: i64, le: i64, blob: *u8, offs: *i64, cnt: i64) -> i64 {
  var j: i64 = 0
  var hit: i64 = 0
  while j < cnt { if td_span_eq_z(bbuf, ls, le, (blob as i64 + offs[j]) as *u8) == 1 { hit = 1; j = cnt } else { j = j + 1 } }
  return hit
84}
85func td_extract(buf: *u8, n: i64, blob: *u8, offs: *i64, maxr: i64) -> i64 {
  var cnt: i64 = 0
  var bp: i64 = 0
  var i: i64 = 0
  while i < n {
      var le: i64 = i
      var s: i64 = 1
      while s == 1 { if le >= n { s = 0 } else { if buf[le] == (TD_NL as u8) { s = 0 } else { le = le + 1 } } }
      if le > i { if buf[i] != (TD_HASH as u8) {
          var ne: i64 = i
          var s2: i64 = 1
          while s2 == 1 { if ne >= le { s2 = 0 } else { if buf[ne] == (TD_TAB as u8) { s2 = 0 } else { ne = ne + 1 } } }
          if ne > i { if ne < le {
              var ps: i64 = ne + 1
              var pe: i64 = ps
              var s3: i64 = 1
              while s3 == 1 { if pe >= le { s3 = 0 } else { if buf[pe] == (TD_TAB as u8) { s3 = 0 } else { pe = pe + 1 } } }
              if pe < le {
                  var gs: i64 = pe + 1
                  var ge: i64 = gs
                  var s4: i64 = 1
                  while s4 == 1 { if ge >= le { s4 = 0 } else { if buf[ge] == (TD_TAB as u8) { s4 = 0 } else { ge = ge + 1 } } }
                  if td_span_eq_z(buf, gs, ge, "GREEN" as *u8) == 1 {
                      if cnt < maxr {
                          offs[cnt] = bp
                          var k: i64 = i
                          while k < ne { if bp < TD_WBUFMAX { blob[bp] = buf[k]; bp = bp + 1 } k = k + 1 }
                          blob[bp] = 0 as u8
                          bp = bp + 1
                          cnt = cnt + 1
                      }
                  }
              }
          } }
      } }
      i = le + 1
  }
  return cnt
123}
124func main(argc: i64, argv: *i64) -> i64 {
  if argc < 2 { td_w(TD_STDERR, "usage: nx_tooldiff snapshot | check\n" as *u8); sys_exit(TD_EXIT_USAGE); return TD_EXIT_USAGE }
  let verb: *u8 = argv[1] as *u8
  let reg: *u8 = "tool_allowlist.conf" as *u8
  let baseline: *u8 = "knowledge/status/tool_baseline.txt" as *u8
  let basetmp: *u8 = "knowledge/status/tool_baseline.txt.tmp" as *u8
  let cbuf: *u8 = sys_mmap(TD_REGCAP + TD_SLACK)
  let cn: i64 = td_reads(reg, cbuf, TD_REGCAP)
  if cn <= 0 { td_w(TD_STDOUT, "TOOL-DIFF verdict=READ-FAIL tool_allowlist.conf unreadable\n" as *u8); sys_exit(TD_EXIT_FAIL); return TD_EXIT_FAIL }
  let blob: *u8 = sys_mmap(TD_BLOBCAP)
  let offs: *i64 = sys_mmap(TD_MAXTOOLS * TD_PTR) as *i64
  let cur: i64 = td_extract(cbuf, cn, blob, offs, TD_MAXTOOLS)
  if cur <= 0 { td_w(TD_STDOUT, "TOOL-DIFF verdict=READ-FAIL no GREEN rows parsed\n" as *u8); sys_exit(TD_EXIT_FAIL); return TD_EXIT_FAIL }
  let rep: *u8 = sys_mmap(TD_REPCAP)
  var p: i64 = 0
  let v0: i64 = verb[0]
  if v0 == TD_SNAPCH {
      var wp: i64 = 0
      let wbuf: *u8 = sys_mmap(TD_BASECAP)
      var i: i64 = 0
      while i < cur { var j: i64 = offs[i]; while blob[j] != (0 as u8) { if wp < TD_WBUFMAX { wbuf[wp] = blob[j]; wp = wp + 1 } j = j + 1 } if wp < TD_WBUFMAX { wbuf[wp] = TD_NL as u8; wp = wp + 1 } i = i + 1 }
      let tfd: i64 = sys_openat_wr(basetmp, TD_MODE)
      if tfd < 0 { td_w(TD_STDOUT, "TOOL-DIFF verdict=WRITE-FAIL\n" as *u8); sys_exit(TD_EXIT_FAIL); return TD_EXIT_FAIL }
      sys_write(tfd, wbuf, wp); sys_close(tfd); sys_renameat(basetmp, baseline)
      p = td_b(rep, p, "TOOL-DIFF verb=snapshot tools=" as *u8); p = td_bn(rep, p, cur)
      p = td_b(rep, p, " -> baseline knowledge/status/tool_baseline.txt VERDICT=GREEN (baseline captured)\n" as *u8)
      sys_write(TD_STDOUT, rep, p)
      sys_exit(0); return 0
  }
  let bbuf: *u8 = sys_mmap(TD_BASECAP)
  let bn: i64 = td_reads(baseline, bbuf, TD_BASEREAD)
  if bn < 0 {
      var wp2: i64 = 0
      let wbuf2: *u8 = sys_mmap(TD_BASECAP)
      var i2: i64 = 0
      while i2 < cur { var j2: i64 = offs[i2]; while blob[j2] != (0 as u8) { if wp2 < TD_WBUFMAX { wbuf2[wp2] = blob[j2]; wp2 = wp2 + 1 } j2 = j2 + 1 } if wp2 < TD_WBUFMAX { wbuf2[wp2] = TD_NL as u8; wp2 = wp2 + 1 } i2 = i2 + 1 }
      let tfd2: i64 = sys_openat_wr(basetmp, TD_MODE)
      if tfd2 >= 0 { sys_write(tfd2, wbuf2, wp2); sys_close(tfd2); sys_renameat(basetmp, baseline) }
      p = td_b(rep, p, "TOOL-DIFF verb=check tools=" as *u8); p = td_bn(rep, p, cur)
      p = td_b(rep, p, " no-prior-baseline -> INITIALIZED VERDICT=GREEN\n" as *u8)
      sys_write(TD_STDOUT, rep, p)
      let lfdi: i64 = sys_openat_append("knowledge/status/tool_diff.log" as *u8, TD_MODE)
      if lfdi >= 0 { sys_write(lfdi, rep, p); sys_close(lfdi) }
      sys_exit(0); return 0
  }
  var basec: i64 = 0
  var removed: i64 = 0
  p = td_b(rep, p, "TOOL-DIFF verb=check current=" as *u8); p = td_bn(rep, p, cur)
  // ★TRUNCATION IN THE NUMBERS. `cap_hit=1` means this scan reached TD_MAXTOOLS and rows beyond it were
  // never read -- in which case every REMOVED name below may be an artifact of the cap, not a regression.
  // Emitting it as a NUMBER beside the counts is the whole fix: the old output printed the cap in a
  // parenthetical and the reader had to notice current==cap themselves.
  p = td_b(rep, p, " cap_hit=" as *u8)
  if cur >= TD_MAXTOOLS { p = td_b(rep, p, "1-REMOVED-LIST-UNTRUSTWORTHY" as *u8) } else { p = td_b(rep, p, "0" as *u8) }
  p = td_b(rep, p, " (caps: TD_MAXTOOLS=4096 tools, TD_REGCAP=256KB registry read, TD_BASEREAD=16000B baseline; GREEN rows only -- a de-GREENed row counts as removed)\nREMOVED (in baseline, GONE now): " as *u8)
  var ls: i64 = 0
  var i3: i64 = 0
  while i3 <= bn {
      var isend: i64 = 0
      if i3 == bn { isend = 1 } else { if bbuf[i3] == (TD_NL as u8) { isend = 1 } }
      if isend == 1 { if i3 > ls { basec = basec + 1; if td_line_in_cur(bbuf, ls, i3, blob, offs, cur) == 0 { removed = removed + 1; var k: i64 = ls; while k < i3 { if p < TD_REPMAX { rep[p] = bbuf[k]; p = p + 1 } k = k + 1 } p = td_b(rep, p, " " as *u8) } } ls = i3 + 1 }
      i3 = i3 + 1
  }
  p = td_b(rep, p, "\nADDED (new since baseline): " as *u8)
  var added: i64 = 0
  var i4: i64 = 0
  while i4 < cur { let z: *u8 = (blob as i64 + offs[i4]) as *u8; if td_in_baseline(bbuf, bn, z) == 0 { added = added + 1; p = td_b(rep, p, z); p = td_b(rep, p, " " as *u8) } i4 = i4 + 1 }
  p = td_b(rep, p, "\nSUMMARY baseline=" as *u8); p = td_bn(rep, p, basec)
  p = td_b(rep, p, " current=" as *u8); p = td_bn(rep, p, cur)
  p = td_b(rep, p, " added=" as *u8); p = td_bn(rep, p, added)
  p = td_b(rep, p, " removed=" as *u8); p = td_bn(rep, p, removed)
  if removed > 0 {
      p = td_b(rep, p, "\nVERDICT=RED-SHRINK (" as *u8); p = td_bn(rep, p, removed)
      p = td_b(rep, p, " tool row(s) vanished/de-GREENed = capability regression; restore the row via /api/tools/register update=yes or bank .prev, then re-snapshot)\n" as *u8)
  } else {
      p = td_b(rep, p, "\nVERDICT=GREEN (no tool shrink)\n" as *u8)
  }
  sys_write(TD_STDOUT, rep, p)
  let lfd: i64 = sys_openat_append("knowledge/status/tool_diff.log" as *u8, TD_MODE)
  if lfd >= 0 { sys_write(lfd, rep, p); sys_close(lfd) }
  let tfd3: i64 = sys_openat_wr("knowledge/status/tool_diff.out.tmp" as *u8, TD_MODE)
  if tfd3 >= 0 { sys_write(tfd3, rep, p); sys_close(tfd3); sys_renameat("knowledge/status/tool_diff.out.tmp" as *u8, "knowledge/status/tool_diff.out" as *u8) }
  if removed > 0 { sys_exit(TD_EXIT_SHRINK); return TD_EXIT_SHRINK }
  sys_exit(0)
  return 0
209}
nx_tooldiff.nx source

`nx_tooldiff.nx` source
