code wiki / _hdl_build / nx_treediverge_beat.nx
`nx_treediverge_beat.nx` source

↩ module page · 243 lines · 13964 B
1// nx_treediverge_beat.nx -- no-arg BEAT for the ONE clock: the standing cross-tree divergence gauge
2// (debt 1785622769: divergence must be caught the day it appears, not by archaeology). Composes the
3// three PROVEN instruments through tr_run_capture -- zero detector logic duplicated: nx_treediff
4// regenerates the NAS manifest, nx_treediverge compares it against the authoring manifest (pushed
5// fresh at every session start by the treecanon SessionStart hook), nx_treecanon_gate re-runs the
6// canon verdict. APPENDS one evidence line per run to the trend log -- including BEAT-FAIL lines
7// (a beat with no evidence line is a claim; failure lines are evidence too). The BURN-DOWN is the
8// point: divergent= over time IS the 8,258-file fork shrinking, minable from the trend file.
9// Scheduler contract: the tickless clock (clock_jobs.tsv / the clockjobs- store plane) fork+execs
10// this elf with NO args from cwd nishihost. argv[1]=authoring-manifest argv[2]=trendfile override
11// the defaults for testing (argv[1] pointed at a missing file is the negative control:
12// nx_treediverge REFUSES by its own non-vacuity law and this beat must append BEAT-FAIL + exit 1,
13// never a comforting line).
14//   trend line: <epoch>\tDIVERGE <envelope, newlines as ' | '>\tGATE rc=<rc> <verdict line>\n
15// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
16import "nx_sovjson_lib.nx"
17import "nx_syscalls.nx"
18import "nx_tool_run.nx"
19
20const TDB_DIVCAP: i64 = 4194304   // treediverge prints a row per divergent file (8,258 today, ~40B
                                // each = ~350KB); 4MB holds ~100k rows. AT the cap = truncated =
                                // the envelope (printed LAST) may be gone -> BEAT-FAIL, because a
                                // capped result is a FLOOR, never a count.
24const TDB_SMALLCAP: i64 = 16384
25const TDB_LINE: i64 = 4096
26const TDB_MODE: i64 = 420
27const TDB_TAB: i64 = 9
28const TDB_NL: i64 = 10
29const TDB_SPACE: i64 = 32
30const TDB_PIPE: i64 = 124
31
32func tdb_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
33func tdb_werr(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(2, s, n); return 0 }
34func tdb_append(path: *u8, buf: *u8, n: i64) -> i64 {
  let fd: i64 = sys_openat_append(path, TDB_MODE)
  if fd < 0 { return 0 - 1 }
  sys_write(fd, buf, n)
  sys_fsync(fd)
  sys_close(fd)
  return 0
41}
42// end index after stripping trailing newlines
43func tdb_tail_end(buf: *u8, n: i64) -> i64 {
  var e: i64 = n
  var go: i64 = 1
  while go == 1 { if e > 0 { if buf[e-1] == (TDB_NL as u8) { e = e - 1 } else { go = 0 } } else { go = 0 } }
  return e
48}
49// start index of the `want`-th line counting back from the (newline-stripped) end; 0-bounded
50func tdb_tail_start(buf: *u8, n: i64, want: i64) -> i64 {
  let e: i64 = tdb_tail_end(buf, n)
  var i: i64 = e
  var cnt: i64 = 0
  var go: i64 = 1
  while go == 1 {
      if i <= 0 { go = 0 } else {
          if buf[i-1] == (TDB_NL as u8) { cnt = cnt + 1; if cnt >= want { go = 0 } }
          if go == 1 { i = i - 1 }
      }
  }
  return i
62}
63func tdb_contains(buf: *u8, n: i64, pat: *u8) -> i64 {
  var pl: i64 = 0
  while pat[pl] != (0 as u8) { pl = pl + 1 }
  if pl == 0 { return 0 }
  var i: i64 = 0
  while i + pl <= n {
      var j: i64 = 0
      var hit: i64 = 1
      while j < pl { if buf[i+j] != pat[j] { hit = 0; j = pl } else { j = j + 1 } }
      if hit == 1 { return 1 }
      i = i + 1
  }
  return 0
76}
77// copy [s,e) of buf into ln at o, rendering newlines as ' | '; bounded by TDB_LINE
78func tdb_cat_span(ln: *u8, o: i64, buf: *u8, s: i64, e: i64) -> i64 {
  var p: i64 = o
  var i: i64 = s
  while i < e {
      if p >= TDB_LINE - 4 { i = e } else {
          if buf[i] == (TDB_NL as u8) { ln[p] = TDB_SPACE as u8; ln[p+1] = TDB_PIPE as u8; ln[p+2] = TDB_SPACE as u8; p = p + 3 }
          else { ln[p] = buf[i]; p = p + 1 }
          i = i + 1
      }
  }
  return p
89}
90
91func main(argc: i64, argv: *i64) -> i64 {
  var lapmf: *u8 = "knowledge/status/treecanon_laptop.mf" as *u8
  var trend: *u8 = "knowledge/status/treediverge_trend.log" as *u8
  if argc > 1 { lapmf = argv[1] as *u8 }
  if argc > 2 { trend = argv[2] as *u8 }
  let nasmf: *u8 = "knowledge/status/treecanon_nas.mf" as *u8
  let conf: *u8 = "knowledge/tree_canon.conf" as *u8
  let e_td: *u8 = "/volume1/homes/elderwesto/nishihost/nx_treediff.elf" as *u8
  let e_dv: *u8 = "/volume1/homes/elderwesto/nishihost/nx_treediverge.elf" as *u8
  let e_gt: *u8 = "/volume1/homes/elderwesto/nishihost/nx_treecanon_gate.elf" as *u8
101
  // 1) fresh NAS manifest (also a durable artifact other instruments can read)
  let av1: *i64 = sys_mmap(8*4) as *i64
  av1[0] = e_td as i64; av1[1] = ("buildroot/runtime" as *u8) as i64; av1[2] = nasmf as i64; av1[3] = 0
  let out1: *u8 = sys_mmap(TDB_SMALLCAP)
  let ol1: *i64 = sys_mmap(16) as *i64
  let rc1: i64 = tr_run_capture(e_td, av1, out1, TDB_SMALLCAP, ol1)
108
  // 2) the divergence report (the burn-down number lives in its envelope, printed LAST)
  let av2: *i64 = sys_mmap(8*6) as *i64
  av2[0] = e_dv as i64; av2[1] = nasmf as i64; av2[2] = lapmf as i64
  av2[3] = ("NAS" as *u8) as i64; av2[4] = ("LAPTOP" as *u8) as i64; av2[5] = 0
  let out2: *u8 = sys_mmap(TDB_DIVCAP)
  let ol2: *i64 = sys_mmap(16) as *i64
  let rc2: i64 = tr_run_capture(e_dv, av2, out2, TDB_DIVCAP, ol2)
116
  // 1b) CONTENT manifest of the NAS tree -- MOVED ABOVE THE GATE 2026-08-07.
  //    It used to run last (as leg 5), which meant the canon verdict below could only ever read the
  //    manifest this beat wrote AN HOUR AGO. Hashing 18k files is the expensive half and this beat
  //    already walks the tree, so it belongs on the clock -- but it has to happen BEFORE the consumer
  //    that reads it, not after. A missing/failed leg is reported in the envelope and never fails the beat.
  let e_th: *u8 = "/volume1/homes/elderwesto/nishihost/nx_treehash.elf" as *u8
  let nashash: *u8 = "knowledge/status/treecanon_nas_hash.mf" as *u8
  let av5: *i64 = sys_mmap(8*4) as *i64
  av5[0] = e_th as i64; av5[1] = ("buildroot/runtime" as *u8) as i64; av5[2] = nashash as i64; av5[3] = 0
  let out5: *u8 = sys_mmap(TDB_SMALLCAP)
  let ol5: *i64 = sys_mmap(16) as *i64
  let rc5: i64 = tr_run_capture(e_th, av5, out5, TDB_SMALLCAP, ol5)
129
  // 3) the canon verdict (RED here is EVIDENCE, not a beat failure -- the build lane enforces;
  //    this beat only measures, so its own exit stays 0 as long as the evidence was captured)
  //
  // ---- 2026-08-07: THIS LEG NOW RUNS ON THE CONTENT MANIFESTS, NOT THE SIZE ONES. ----
  // It was passing treecanon_nas.mf / treecanon_laptop.mf, which carry `<bytes> <relpath>`. A SIZE
  // SCREEN CANNOT SEE A MUTATION-CLASS DEFECT, because such a defect preserves length by construction
  // -- this estate has an escaped `==` -> `!=` mutant on record that was byte-for-byte the same size.
  // The sha256 manifests were already being written (leg 1b above, and the laptop's by its hook) and
  // simply were not being read by the one leg whose whole job is to refuse a forked build.
  // ★★★★★THE STRONGER RULER ALREADY EXISTED AND THE GATE WAS STILL POINTED AT THE WEAKER ONE.
  //
  // argv[4] is the LIVE tree this manifest describes. It arms two teeth that cannot work without it:
  //   T4 resamples every canon file to catch a snapshot taken mid-write, and
  //   T5 adjudicates each divergent canon row against the live bytes, separating a REAL fork from a
  //      STALE MANIFEST -- the difference between a build outage that is earned and one that is not.
  let laphash: *u8 = "knowledge/status/treecanon_laptop_hash.mf" as *u8
  let liveroot: *u8 = "buildroot/runtime" as *u8
  let av3: *i64 = sys_mmap(8*6) as *i64
  av3[0] = e_gt as i64; av3[1] = nashash as i64; av3[2] = laphash as i64; av3[3] = conf as i64
  av3[4] = liveroot as i64; av3[5] = 0
150
  let out3: *u8 = sys_mmap(TDB_SMALLCAP)
  let ol3: *i64 = sys_mmap(16) as *i64
  let rc3: i64 = tr_run_capture(e_gt, av3, out3, TDB_SMALLCAP, ol3)
154
  // 4) SYMBOL-LEVEL WORK-LOSS on the canonical sources (added 2026-08-06). nx_srcguard already
  //    existed, was GREEN, and NOTHING RAN IT ON A SCHEDULE -- and until today its watch set did not
  //    contain a single tree_canon.conf row, so the two registries of files-that-must-not-silently-
  //    change had ZERO overlap. It is argless-defaults-to-check, so it drops straight in here rather
  //    than needing its own organ and its own clock row: this beat is ALREADY on the clock, already
  //    composes instruments through tr_run_capture, and already leaves one evidence line per run.
  //    A WORK-LOST verdict is EVIDENCE, not a beat failure -- same stance as the canon gate leg above;
  //    the beat measures, the build lane enforces. A MISSING elf is reported LOUD but must not kill the
  //    divergence gauge that was already working: a new leg may never take down the old instrument.
  let e_sg: *u8 = "/volume1/homes/elderwesto/nishihost/nx_srcguard.elf" as *u8
  let av4: *i64 = sys_mmap(8*3) as *i64
  av4[0] = e_sg as i64; av4[1] = ("check" as *u8) as i64; av4[2] = 0
  let out4: *u8 = sys_mmap(TDB_SMALLCAP)
  let ol4: *i64 = sys_mmap(16) as *i64
  let rc4: i64 = tr_run_capture(e_sg, av4, out4, TDB_SMALLCAP, ol4)
170
  // 5) CONTENT manifest of the NAS tree (added 2026-08-07). Leg 1 already writes the SIZE manifest
  //    (nx_treediff), which is what the build-lane canon check consumes. This leg additionally writes a
  //    sha256 manifest so a laptop-side flow-back can compute "which NAS files CHANGED since my last
  //    sync" against a stored baseline -- CONTENT-exact, so a same-size seat edit cannot hide in it.
  //    WHY IT LIVES HERE: hashing 18k files is the expensive half, and this beat is already on the clock
  //    and already walks the tree. Putting it in a session-start hook would pay the cost per session and
  //    still be later than hourly. PUT THE HEAVY HALF ON THE BEAT THAT ALREADY TICKS; leave the cheap
  //    delta to the consumer. A missing/failed leg is reported in the envelope and never fails the beat.
  // ---- 2026-08-07: THIS LEG'S WORK NOW RUNS ABOVE, BEFORE THE CANON GATE. ----
  // It stayed here, after the gate, for a day -- and that ordering is why the gate could only ever
  // read the PREVIOUS beat's content manifest. The call moved; only the reporting stayed, so the
  // envelope below is unchanged for its readers. See leg 1b.
  // ★★★★★★A PRODUCER PLACED AFTER ITS CONSUMER IN THE SAME LOOP MAKES THE CONSUMER EXACTLY ONE
  //   FULL CYCLE STALE, FOREVER -- AND BOTH LEGS STILL REPORT SUCCESS, SO NOTHING EVER SAYS SO.
185
  var ok: i64 = 1
  if rc1 != 0 { ok = 0 }
  if ol2[0] <= 0 { ok = 0 }
  if ol2[0] >= TDB_DIVCAP - 1 { ok = 0 }
  if tdb_contains(out2, ol2[0], "verdict=" as *u8) == 0 { ok = 0 }
  // MEASURED (first negative-control run): a REFUSED report also prints "verdict=REFUSED", so
  // contains("verdict=") alone waved a blind gauge through as OK. treediverge's exit codes are
  // rc=1 for a successful DIVERGENT compare and rc=3 for REFUSED, so rc can't be the ok-signal
  // either without baking in its full code table -- anchor on the tool's own refusal vocabulary.
  if tdb_contains(out2, ol2[0], "verdict=REFUSED" as *u8) == 1 { ok = 0 }
  if ol3[0] <= 0 { ok = 0 }
197
  let ln: *u8 = sys_mmap(TDB_LINE)
  var o: i64 = sj_catn(ln, 0, sys_now_realtime_sec())
  ln[o] = TDB_TAB as u8; o = o + 1
  if ok == 1 {
      o = sj_cat(ln, o, "DIVERGE " as *u8)
      o = tdb_cat_span(ln, o, out2, tdb_tail_start(out2, ol2[0], 3), tdb_tail_end(out2, ol2[0]))
      ln[o] = TDB_TAB as u8; o = o + 1
      o = sj_cat(ln, o, "GATE rc=" as *u8)
      o = sj_catn(ln, o, rc3)
      ln[o] = TDB_SPACE as u8; o = o + 1
      o = tdb_cat_span(ln, o, out3, tdb_tail_start(out3, ol3[0], 1), tdb_tail_end(out3, ol3[0]))
      ln[o] = TDB_TAB as u8; o = o + 1
      o = sj_cat(ln, o, "SRCGUARD rc=" as *u8)
      o = sj_catn(ln, o, rc4)
      ln[o] = TDB_SPACE as u8; o = o + 1
      // ABSENT is said OUT LOUD rather than left as a blank field: a leg that silently contributes
      // nothing is indistinguishable from a leg that ran and found nothing wrong.
      if ol4[0] <= 0 { o = sj_cat(ln, o, "SRCGUARD-ABSENT (no output captured -- is nx_srcguard.elf deployed?)" as *u8) }
      if ol4[0] > 0 { o = tdb_cat_span(ln, o, out4, tdb_tail_start(out4, ol4[0], 1), tdb_tail_end(out4, ol4[0])) }
      ln[o] = TDB_TAB as u8; o = o + 1
      o = sj_cat(ln, o, "NASHASH rc=" as *u8)
      o = sj_catn(ln, o, rc5)
      ln[o] = TDB_SPACE as u8; o = o + 1
      if ol5[0] <= 0 { o = sj_cat(ln, o, "NASHASH-ABSENT (no content manifest written -- flow-back consumers will see a stale baseline)" as *u8) }
      if ol5[0] > 0 { o = tdb_cat_span(ln, o, out5, tdb_tail_start(out5, ol5[0], 1), tdb_tail_end(out5, ol5[0])) }
  } else {
      o = sj_cat(ln, o, "BEAT-FAIL treediff_rc=" as *u8)
      o = sj_catn(ln, o, rc1)
      o = sj_cat(ln, o, " diverge_rc=" as *u8)
      o = sj_catn(ln, o, rc2)
      o = sj_cat(ln, o, " diverge_outlen=" as *u8)
      o = sj_catn(ln, o, ol2[0])
      o = sj_cat(ln, o, " gate_rc=" as *u8)
      o = sj_catn(ln, o, rc3)
  }
  ln[o] = TDB_NL as u8; o = o + 1
  if tdb_append(trend, ln, o) != 0 { tdb_werr("TREEDIVERGE-BEAT FAIL cannot append trend file\n" as *u8); sys_exit(1); return 1 }
  if ok == 1 {
      tdb_puts("TREEDIVERGE-BEAT OK appended evidence line\n" as *u8)
      sys_exit(0)
      return 0
  }
  tdb_werr("TREEDIVERGE-BEAT FAIL (BEAT-FAIL line appended as evidence)\n" as *u8)
  sys_exit(1)
  return 1
243}
nx_treediverge_beat.nx source

`nx_treediverge_beat.nx` source
