nx_toolhealth_gate.nx source

1// nx_toolhealth_gate.nx -- THE BITE PROOF FOR THE HALF-CAPABLE DETECTOR (lane D, 2026-08-20). 2// nx_toolhealth accuses a registered tool of declaring a verb it does not implement. An accusation 3// organ that has only ever been seen agreeing with its author is unverified, and one with false 4// positives is worse than none -- so this gate plants the known-bad, sees RED, restores, sees GREEN, 5// and separately proves that each ABSTENTION abstains instead of accusing. 6// EVERY FIXTURE IS ASSEMBLED AT RUNTIME under /tmp/<gate>/ and nothing here is a production path. 7// Two reasons, both measured elsewhere in this estate and both load-bearing here: 8// * a gate that shares a fixture with a production beat reports on the FIXTURE, not the code; 9// * THIS subject is a SOURCE SCANNER -- a fixture written as a literal in a production tree would 10// become a subject of the very census under test. 11// nx_toolhealth_gate [subject-elf] -> per-tooth PASS/FAIL then verdict=GREEN|RED (exit carries it) 12// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0 13import "nx_syscalls.nx" 14import "nx_estr.nx" 15import "nx_gate_verdict.nx" 16import "nx_gatekit_lib.nx" 17import "nx_tool_run.nx" 18 19// sized: the census JSON line plus a few banner lines 20const TG_OUTCAP: i64 = 65536 21// sized: one fixture file 22const TG_TXTCAP: i64 = 4096 23// sized: absolute paths under /tmp plus a filename 24const TG_PATHCAP: i64 = 512 25// declared: argv slots for the longest call (census + 7 path arguments + NUL) 26const TG_ARGVN: i64 = 16 27// derived: the census over a 5-row fixture is milliseconds; this is a generous ceiling, not a guess 28const TG_TIMEOUT_MS: i64 = 60000 29const TG_DIR: *u8 = "/tmp/nx_toolhealth_gate" 30const TG_SRCDIR: *u8 = "/tmp/nx_toolhealth_gate/src/" 31 32// the subject-resolution ladder, most-authoritative first. PRINTED, never assumed: a gate that does 33// not say which artifact it ran cannot tell a stale binary from a failing one. 34const TG_SUBJ_1: *u8 = "./nx_toolhealth.elf" 35const TG_SUBJ_2: *u8 = "../nx_toolhealth.elf" 36const TG_SUBJ_3: *u8 = "_build/nx_toolhealth.sov.elf" 37const TG_SUBJ_4: *u8 = "buildroot/_build/nx_toolhealth.sov.elf" 38 39func tgp(dst: *u8, name: *u8) -> i64 { 40 var o: i64 = es_cat(dst, 0, TG_DIR) 41 o = es_cat(dst, o, "/" as *u8) 42 o = es_cat(dst, o, name) 43 dst[o] = 0 as u8 44 return o 45} 46 47// Run the subject; returns the wait-decoded exit code. 48// ⚠THE CWD IS DELIBERATELY NOT CHANGED. v1 ran the subject with cwd=/tmp/<gate> and every tooth failed, 49// because the subject path resolved on the LADDER is RELATIVE and does not exist from there -- so the 50// gate reported 2/19 RED about a subject it had never once executed. 51// A GATE THAT CANNOT LAUNCH ITS SUBJECT REPORTS THE SUBJECT AS BROKEN, AND THE TWO ARE INDISTINGUISHABLE 52// FROM THE OUTPUT ALONE. Every fixture path handed to the subject is absolute, so no cwd is needed. 53func tg_run(subj: *u8, av: *i64, out: *u8, olen: *i64) -> i64 { 54 return tr_run_capture(subj, av, out, TG_OUTCAP - 1, olen) 55} 56 57func main(argc: i64, argv: *i64) -> i64 { 58 let ctr: *i64 = gv_ctr() 59 gv_head("nx_toolhealth_gate -- the half-capable detector must NAME a planted dead verb, must NOT accuse an implemented one, and must ABSTAIN rather than guess when it cannot see the dispatch" as *u8) 60 61 // ---- resolve the subject ------------------------------------------------- 62 var subj: *u8 = TG_SUBJ_1 63 var found: i64 = 0 64 if argc >= 2 { subj = argv[1] as *u8; if gk_exists(subj) == 1 { found = 1 } } 65 if found == 0 { subj = TG_SUBJ_1; if gk_exists(subj) == 1 { found = 1 } } 66 if found == 0 { subj = TG_SUBJ_2; if gk_exists(subj) == 1 { found = 1 } } 67 if found == 0 { subj = TG_SUBJ_3; if gk_exists(subj) == 1 { found = 1 } } 68 if found == 0 { subj = TG_SUBJ_4; if gk_exists(subj) == 1 { found = 1 } } 69 gv_puts(" subject-artifact: " as *u8) 70 if found == 1 { gv_puts(subj) } else { gv_puts("<NONE RESOLVED>" as *u8) } 71 gv_puts("\n" as *u8) 72 gv_check("subject-artifact-resolved-and-named" as *u8, found, ctr) 73 if found == 0 { 74 gv_puts(" (no runnable nx_toolhealth artifact on the ladder -- every tooth below would be VACUOUS, refusing)\n" as *u8) 75 let rcx: i64 = gv_verdict("TOOLHEALTH-GATE" as *u8, ctr, "cannot run the subject" as *u8) 76 sys_exit(rcx) 77 return rcx 78 } 79 80 // ---- fixture, assembled at RUNTIME, idempotent --------------------------- 81 gk_mkdir(TG_DIR) 82 gk_mkdir("/tmp/nx_toolhealth_gate/src" as *u8) 83 let p_allow: *u8 = sys_mmap(TG_PATHCAP) 84 let p_gram: *u8 = sys_mmap(TG_PATHCAP) 85 let p_schem: *u8 = sys_mmap(TG_PATHCAP) 86 let p_log: *u8 = sys_mmap(TG_PATHCAP) 87 let p_base: *u8 = sys_mmap(TG_PATHCAP) 88 let p_elf: *u8 = sys_mmap(TG_PATHCAP) 89 let p_src: *u8 = sys_mmap(TG_PATHCAP) 90 tgp(p_allow, "allow.conf" as *u8) 91 tgp(p_gram, "gram.conf" as *u8) 92 tgp(p_schem, "schemas.conf" as *u8) 93 tgp(p_log, "th.log" as *u8) 94 tgp(p_base, "th.base" as *u8) 95 tgp(p_elf, "myorgan.elf" as *u8) 96 tgp(p_src, "src/myorgan.nx" as *u8) 97 // a previous run's baseline must not survive, or the ratchet teeth report on the FIXTURE 98 gk_rm(p_base) 99 gk_rm(p_log) 100 101 gk_write(p_elf, "ELF" as *u8) 102 let allow_txt: *u8 = sys_mmap(TG_TXTCAP) 103 var ao: i64 = es_cat(allow_txt, 0, "myorgan\t" as *u8) 104 ao = es_cat(allow_txt, ao, p_elf) 105 ao = es_cat(allow_txt, ao, "\tGREEN\n" as *u8) 106 allow_txt[ao] = 0 as u8 107 gk_write(p_allow, allow_txt) 108 gk_write(p_schem, "# schemas fixture: no col8 row, so the derived grammar is the served one\n" as *u8) 109 gk_write(p_gram, "myorgan\talpha <x> | beta <y>\n" as *u8) 110 gk_write(p_src, "// myorgan fixture\nfunc main() { if eq(a, \"alpha\") { return 1 } }\n" as *u8) 111 112 let av: *i64 = sys_mmap(8 * TG_ARGVN) as *i64 113 let out: *u8 = sys_mmap(TG_OUTCAP) 114 let olen: *i64 = sys_mmap(16) as *i64 115 116 av[0] = subj as i64 117 av[1] = "census" as *u8 as i64 118 av[2] = p_allow as i64 119 av[3] = p_schem as i64 120 av[4] = p_gram as i64 121 av[5] = p_log as i64 122 av[6] = p_base as i64 123 av[7] = TG_SRCDIR as i64 124 av[8] = TG_SRCDIR as i64 125 av[9] = 0 126 127 // ---- 1. THE PLANTED KNOWN-BAD: beta is declared and has no literal ------- 128 tg_run(subj, av, out, olen) 129 let n1: i64 = olen[0] 130 // ANTI-VACUITY, FIRST: prove the subject actually RAN before believing anything it did not say. 131 // Without this the "NOT accused" teeth below pass on an absent worklist -- a tooth that passes on 132 // the empty set is not a tooth, and it is the ONE tooth that stayed green when the gate was broken. 133 gv_check("subject-actually-ran-and-emitted-its-census" as *u8, gk_out_has(out, n1, "\"organ\":\"nx_toolhealth\"" as *u8), ctr) 134 gv_check("worklist-was-written-so-the-not-accused-teeth-are-not-vacuous" as *u8, gk_contains(p_log, "DEAD-VERB" as *u8), ctr) 135 gv_check("planted-dead-verb-counted-exactly-once" as *u8, gk_out_has(out, n1, "\"DEAD-VERB-SUBJECTS\":1" as *u8), ctr) 136 gv_check("planted-dead-verb-NAMED-in-the-worklist" as *u8, gk_contains(p_log, "verb=beta" as *u8), ctr) 137 // the whole value of the detector is that it does NOT accuse the implemented verb 138 gv_check("implemented-verb-alpha-NOT-accused" as *u8, 1 - gk_contains(p_log, "verb=alpha" as *u8), ctr) 139 gv_check("broken-partition-reconciles-on-the-bad-fixture" as *u8, gk_out_has(out, n1, "\"partition_reconciles\":1" as *u8), ctr) 140 gv_check("halfcapable-partition-reconciles-on-the-bad-fixture" as *u8, gk_out_has(out, n1, "\"halfcapable_partition_reconciles\":1" as *u8), ctr) 141 142 // ---- 2. RESTORE: every declared verb now carries a literal --------------- 143 gk_write(p_src, "// myorgan fixture\nfunc main() { if eq(a, \"alpha\") { } if eq(a, \"beta\") { } }\n" as *u8) 144 tg_run(subj, av, out, olen) 145 let n2: i64 = olen[0] 146 gv_check("restored-source-reads-CLEAN" as *u8, gk_out_has(out, n2, "\"CLEAN\":1" as *u8), ctr) 147 gv_check("restored-source-accuses-nobody" as *u8, gk_out_has(out, n2, "\"DEAD-VERB-SUBJECTS\":0" as *u8), ctr) 148 149 // ---- 3. NEG-CONTROL: a dispatch this scanner cannot see must ABSTAIN ----- 150 // (a byte-compare dispatch carries no verb literal at all; a detector that reported 2 dead verbs 151 // here would be a confident wrong answer, which is the failure mode that kills adoption) 152 gk_write(p_src, "// myorgan fixture\nfunc main() { if a[0] == 97 { } }\n" as *u8) 153 tg_run(subj, av, out, olen) 154 let n3: i64 = olen[0] 155 gv_check("neg-control-unseeable-dispatch-lands-in-DISPATCH-UNDECIDABLE" as *u8, gk_out_has(out, n3, "\"DISPATCH-UNDECIDABLE\":1" as *u8), ctr) 156 gv_check("neg-control-unseeable-dispatch-accuses-nobody" as *u8, gk_out_has(out, n3, "\"DEAD-VERB-SUBJECTS\":0" as *u8), ctr) 157 158 // ---- 4. NEG-CONTROL: a positional contract is NOT a missing contract ----- 159 // (merging these two read 618 of 959 on the live estate; they have opposite remedies) 160 gk_write(p_gram, "myorgan\t<url> <outfile>\n" as *u8) 161 gk_write(p_src, "// myorgan fixture\nfunc main() { return 0 }\n" as *u8) 162 tg_run(subj, av, out, olen) 163 let n4: i64 = olen[0] 164 gv_check("neg-control-positional-contract-is-POSITIONAL-ONLY-not-NO-GRAMMAR" as *u8, gk_out_has(out, n4, "\"POSITIONAL-ONLY\":1" as *u8), ctr) 165 gv_check("neg-control-positional-contract-is-not-counted-NO-GRAMMAR" as *u8, gk_out_has(out, n4, "\"NO-GRAMMAR\":0" as *u8), ctr) 166 167 // ---- 5. THE RATCHET, both directions ------------------------------------ 168 gk_write(p_gram, "myorgan\talpha <x> | beta <y>\n" as *u8) 169 gk_write(p_src, "// myorgan fixture\nfunc main() { if eq(a, \"alpha\") { return 1 } }\n" as *u8) 170 tg_run(subj, av, out, olen) 171 let rv: *i64 = sys_mmap(8 * TG_ARGVN) as *i64 172 rv[0] = subj as i64 173 rv[1] = "ratchet" as *u8 as i64 174 rv[2] = p_base as i64 175 rv[3] = p_log as i64 176 rv[4] = 0 177 let rc_base: i64 = tg_run(subj, rv, out, olen) 178 gv_check("ratchet-self-baselines-on-first-sight" as *u8, gk_out_has(out, olen[0], "SELF-BASELINED-ON-FIRST-SIGHT" as *u8), ctr) 179 gv_check("ratchet-first-sight-is-GREEN-not-a-wall-of-false-regressions" as *u8, 1 - rc_base, ctr) 180 181 // an UNCHANGED population must stay GREEN -- v1 of this ratchet reported every row as NEW because 182 // its key was derived differently on each side, and a ratchet that cries wolf is switched off 183 tg_run(subj, av, out, olen) 184 let rc_same: i64 = tg_run(subj, rv, out, olen) 185 gv_check("ratchet-unchanged-population-stays-GREEN" as *u8, 1 - rc_same, ctr) 186 187 // plant a regression: a THIRD declared verb with no literal 188 gk_write(p_gram, "myorgan\talpha <x> | beta <y> | delta <z>\n" as *u8) 189 tg_run(subj, av, out, olen) 190 let rc_red: i64 = tg_run(subj, rv, out, olen) 191 var red_ok: i64 = 0 192 if rc_red == 1 { red_ok = 1 } 193 gv_check("neg-control-ratchet-goes-RED-on-a-planted-regression" as *u8, red_ok, ctr) 194 gv_check("neg-control-ratchet-NAMES-the-new-offender-not-just-a-count" as *u8, gk_out_has(out, olen[0], "NEW offender=" as *u8), ctr) 195 gv_check("neg-control-ratchet-names-the-planted-verb-specifically" as *u8, gk_out_has(out, olen[0], "verb=delta" as *u8), ctr) 196 197 let acv: *i64 = sys_mmap(8 * TG_ARGVN) as *i64 198 acv[0] = subj as i64 199 acv[1] = "accept" as *u8 as i64 200 acv[2] = p_base as i64 201 acv[3] = p_log as i64 202 acv[4] = 0 203 tg_run(subj, acv, out, olen) 204 let rc_after: i64 = tg_run(subj, rv, out, olen) 205 gv_check("ratchet-returns-GREEN-after-an-explicit-accept" as *u8, 1 - rc_after, ctr) 206 207 // the note states the STANDARD, never a tally of the teeth -- every tooth already names itself, and 208 // a note that recites them silently goes stale the moment one is added 209 let rc: i64 = gv_verdict("TOOLHEALTH-GATE" as *u8, ctr, "every accusation and every abstention was planted and observed; each tooth above names what it proved" as *u8) 210 sys_exit(rc) 211 return rc 212}