nx_unified_conductor.nx source

1// nx_unified_conductor.nx -- THE UNIFIED AUTONOMY-LOOP CONDUCTOR: warden-gated AND resource-governed AND 2// closing REPORT->LOG-NEXT, in ONE beat. Resolves the "two loop drivers" incoherence found by nx_loop_census: 3// nx_conductor_live (runtime/) = WARDEN-gated but FIXED cadence (ungoverned = the 20fps-hard-cap anti-pattern) 4// nx_governed_autoloop (_hdl_build/) = RESOURCE-governed but NOT warden-gated 5// This composes BOTH proven halves + my REPORT->LOG-NEXT bridge into one canonical cycle. Lives in _hdl_build/ 6// because (empirically proven by nx_import_probe, Rule 2) a _hdl_build/ organ CAN import both _hdl_build/ organs 7// (the governor) AND runtime/ organs (the warden + eval-queue) -- so no governor is inline-duplicated (which 8// would be the copy-paste anti-pattern this project's own catalog forbids). 9// 10// EACH BEAT: SENSE host (nx_sysload) -> GOVERN (nx_resource_governor: run only if the polite budget is free, 11// else AIMD back off) -> if free, WARDEN-gate the action (nx_warden_lib: ALLOW additive, DENY a source 12// overwrite -- proving the cardinal gate is live) -> if allowed, do a bounded REPORT->LOG-NEXT (queue an 13// evaluator gap via nx_eval_queue, additive to an isolated store). Journals each beat. 14// 15// SAFE BY CONSTRUCTION: BOUNDED beats (UC_BEATS, testable -- NOT the unbounded daemon; that stays a deliberate 16// later flip), ADDITIVE only (writes an isolated eval-gaps queue + a journal, never a source file -- the warden 17// DENIES that), resource-POLITE (yields to live serving + backs off over the load ceiling), NO Claude in the 18// loop. Also demonstrates the BACK-OFF path at a simulated-busy load (politeness proven, not asserted). 19// license_tier: ORIGINAL genealogy_id: operator-2026-07-03-ultimate-loop + unify(nx_conductor_live, nx_governed_autoloop) 20// lineage_id: nishi_unified_conductor_v1 expect_exit: 0 21import "nx_syscalls.nx" 22import "nx_sysload.nx" // SENSE 23import "nx_resource_governor.nx" // GOVERN 24import "nx_warden_lib.nx" // GATE 25import "nx_council_gate.nx" // COUNCIL: high-blast actions need M-of-N quorum (self-preservation of the loop itself) 26import "nx_eval_queue.nx" // LOG-NEXT (REPORT->queue) 27import "nx_win_ledger.nx" // GROW/LEARN (self-learning capture) 28const UC_MAGIC_4096: i64 = 4096 29 30const UC_BEATS: i64 = 3 // bounded/testable; unbounded daemon = a deliberate later config flip 31const UC_CEIL_MILLI: i64 = 800 // polite ceiling: back off when load > 0.8 core/cpu (HPA-style headroom) 32const UC_MEM_FLOOR_MB: i64 = 256 33const UC_JOURNAL: *u8 = "knowledge/status/unified_conductor.log\x00" 34 35func uc_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 36func uc_putn(v: i64) -> i64 { 37 if v < 0 { sys_write(1, "-" as *u8, 1); v = 0 - v } 38 if v == 0 { sys_write(1, "0" as *u8, 1); return 0 } 39 let d: *u8 = sys_mmap(24); var m: i64 = v; var k: i64 = 0 40 while m > 0 { d[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 41 let b: *u8 = sys_mmap(24); var i: i64 = 0 42 while i < k { b[i] = d[k - 1 - i]; i = i + 1 } sys_write(1, b, k); return 0 43} 44 45func uc_file_exists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 } 46 47// RESEARCH link: fork+exec the SOVEREIGN researcher (_offc/nx_research_fetch.elf) on a queued gap's domain, so 48// the crew learns HOW to close the gap (3rd-party SOTA acquisition -- step 4 of the loop), not just that it 49// exists. Bounded (called once/run), governed (only in a GO beat), additive (writes knowledge/fetched/, warden- 50// authorized). Returns the child exit code (0 = fetched ok). Ported from fire_god_cycle's hang-safe fork+exec. 51func uc_fire_research(url: *u8, name: *u8) -> i64 { 52 let pid: i64 = sys_fork() 53 if pid == 0 { 54 let dn: i64 = sys_openat_wr("/dev/null\x00" as *u8, 420) 55 if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) } 56 let argv: *i64 = sys_mmap(64) as *i64 57 argv[0] = "_offc/nx_research_fetch.elf" as *u8 as i64 58 argv[1] = url as i64 59 argv[2] = name as i64 60 argv[3] = 0 61 let envp: *i64 = sys_mmap(16) as *i64; envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64; envp[1] = 0 62 sys_execve("_offc/nx_research_fetch.elf" as *u8, argv, envp); sys_exit(127) 63 } 64 let st: *i64 = sys_mmap(16) as *i64; sys_wait4(pid, st, 0); return (st[0] >> 8) & 0xff 65} 66 67// DO+TEST link: fork+exec the god-cycle self-build (scaffold->emit->god-build->grade, ZERO Claude inside) via 68// nx_sov_build_run -- proves the beat can BUILD+VERIFY autonomously. Identical to nx_governed_autoloop's 69// fire_god_cycle (compose, don't duplicate the concept). Returns child exit (0 = a real organ self-built+ran). 70func uc_fire_god_cycle() -> i64 { 71 let pid: i64 = sys_fork() 72 if pid == 0 { 73 let dn: i64 = sys_openat_wr("/dev/null\x00" as *u8, 420) 74 if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) } 75 let argv: *i64 = sys_mmap(64) as *i64 76 argv[0] = "_offc/nx_sov_build_run.elf" as *u8 as i64 77 argv[1] = "nx_god_cycle_gate" as *u8 as i64 78 argv[2] = 0 79 let envp: *i64 = sys_mmap(16) as *i64; envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64; envp[1] = 0 80 sys_execve("_offc/nx_sov_build_run.elf" as *u8, argv, envp); sys_exit(127) 81 } 82 let st: *i64 = sys_mmap(16) as *i64; sys_wait4(pid, st, 0); return (st[0] >> 8) & 0xff 83} 84 85// the polite per-beat budget: yields to live serving + memory admission + load ceiling (composes the governor). 86func uc_budget(ncpu: i64, load: i64, freemb: i64, conns: i64) -> i64 { 87 if rg_serve_first(conns) == 1 { return 0 } // a live request is being served -> yield 88 if rg_memory_ok(freemb, UC_MEM_FLOOR_MB) == 0 { return 0 } // low memory -> don't start 89 if rg_should_backoff(RG_POLITE, ncpu, load, UC_CEIL_MILLI) == 1 { return 0 } // over the load ceiling -> back off 90 return rg_hw_budget(RG_POLITE, ncpu, load, UC_CEIL_MILLI) // hw-class-aware (sensor..supercomputer) 91} 92 93func main() -> i64 { 94 uc_puts("=== nx_unified_conductor -- governed + warden-gated + REPORT->LOG-NEXT, one beat (bounded, no-LLM) ===\n" as *u8) 95 96 var beat: i64 = 0 97 var go_beats: i64 = 0 // beats where the governor said resources were free 98 var warden_allows: i64 = 0 // additive actions authorized 99 var warden_denies: i64 = 0 // source-overwrite attempts DENIED (proves the gate is live) 100 var queued: i64 = 0 // REPORT->LOG-NEXT: gaps routed to the work queue 101 var researched: i64 = 0 // RESEARCH: gap-domain SOTA fetched in-beat (bounded, once) 102 var research_ok: i64 = 0 // did the fetch land a real file? 103 var did_build: i64 = 0 // DO+TEST: self-build+verify machinery fired in-beat (bounded, once) 104 var build_ok: i64 = 0 // did the god-cycle self-build+run an organ (exit 0)? 105 var learned: i64 = 0 // GROW/LEARN: wins recorded to the self-learning ledger 106 107 let ledger: *NxWinLedger = nx_win_ledger_new() 108 let q_before: i64 = nx_eval_queue_count() 109 110 while beat < UC_BEATS { 111 uc_puts(" beat " as *u8); uc_putn(beat) 112 113 // 1. SENSE the real host 114 let ncpu: i64 = sl_ncpu() 115 let load: i64 = sl_loadavg_milli() 116 let freemb: i64 = sl_freemem_mb() 117 let conns: i64 = sl_active_conns_8443() 118 119 // 2. GOVERN: only proceed if the polite budget is free 120 let budget: i64 = uc_budget(ncpu, load, freemb, conns) 121 uc_puts(": load=" as *u8); uc_putn(load); uc_puts("m budget=" as *u8); uc_putn(budget) 122 if budget <= 0 { 123 let sleep_ms: i64 = rg_backoff_ms(RG_POLITE, ncpu, load, UC_CEIL_MILLI, 1000) 124 uc_puts(" -> BACK OFF (polite; AIMD sleep " as *u8); uc_putn(sleep_ms); uc_puts("ms)\n" as *u8) 125 beat = beat + 1 126 continue 127 } 128 go_beats = go_beats + 1 129 130 // 3. WARDEN + COUNCIL gate: authorize the additive action; prove a high-blast source-overwrite is DENIED. 131 // The deny path now routes through the COUNCIL gate with NO proposal -> proves the AUTONOMOUS LOOP ITSELF 132 // cannot do a high-blast action without M-of-N council quorum (self-preservation of the machinery: even 133 // our own loop can't "break things" unilaterally; a human/council must approve heavy actions). 134 let allow: i64 = warden_authorize(W_ADDITIVE, UC_JOURNAL, 0) 135 let deny: i64 = nx_warden_council_authorize(W_OVERWRITE_SRC, "runtime/nx_syscalls.nx\x00" as *u8, "autonomous-beat-no-council-proposal\x00" as *u8) 136 if allow == W_ALLOW { warden_allows = warden_allows + 1 } 137 if deny == W_DENY { warden_denies = warden_denies + 1 } 138 uc_puts(" warden+council: additive=" as *u8); if allow == W_ALLOW { uc_puts("ALLOW" as *u8) } else { uc_puts("DENY" as *u8) } 139 uc_puts(" high-blast(no-quorum)=" as *u8); if deny == W_DENY { uc_puts("DENY(self-preserved)" as *u8) } else { uc_puts("ALLOW(BAD!)" as *u8) } 140 141 // 4. if authorized, do a bounded REPORT->LOG-NEXT: route one evaluator gap to the work queue (additive) 142 if allow == W_ALLOW { 143 nx_eval_queue_emit("R5\x00" as *u8, "runtime/nx_ml_dsa_65.nx\x00" as *u8, "SKELETON_ERR_PENDING\x00" as *u8, "unified-conductor beat: orphaned skeleton -> complete (never delete)\x00" as *u8) 144 queued = queued + 1 145 uc_puts(" -> REPORT->LOG-NEXT: gap queued" as *u8) 146 147 // RESEARCH the gap's domain ONCE (bounded): the ml_dsa_65 skeleton is a post-quantum SIGNATURE gap, 148 // so fetch PQ-crypto SOTA to inform completion. Governed (this is a GO beat) + additive (warden ok). 149 if researched == 0 { 150 let ra: i64 = warden_authorize(W_ADDITIVE, "knowledge/fetched/research_pqc_mldsa_gap.raw\x00" as *u8, 0) 151 if ra == W_ALLOW { 152 let rc: i64 = uc_fire_research("https://en.wikipedia.org/wiki/Post-quantum_cryptography\x00" as *u8, "research_pqc_mldsa_gap.raw\x00" as *u8) 153 researched = 1 154 if rc == 0 { if uc_file_exists("knowledge/fetched/research_pqc_mldsa_gap.raw\x00" as *u8) == 1 { research_ok = 1 } } 155 uc_puts(" -> RESEARCH: fetched gap-domain SOTA (rc=" as *u8); uc_putn(rc); uc_puts(" landed=" as *u8); uc_putn(research_ok); uc_puts(")\n" as *u8) 156 } else { uc_puts(" -> RESEARCH: warden denied (skipped)\n" as *u8) } 157 158 // DO+TEST (bounded, once): the beat proves it can self-build+verify (god-cycle machinery). 159 let ba: i64 = warden_authorize(W_ADDITIVE, "_offc/nx_god_cycle_artifact\x00" as *u8, 0) 160 if ba == W_ALLOW { 161 let bc: i64 = uc_fire_god_cycle() 162 did_build = 1 163 if bc == 0 { build_ok = 1 } 164 uc_puts(" -> DO+TEST: self-build+verify machinery fired (god-cycle exit=" as *u8); uc_putn(bc); uc_puts(", built+verified=" as *u8); uc_putn(build_ok); uc_puts(")\n" as *u8) 165 166 // GROW/LEARN: capture the win to the self-learning ledger (what closed, why, its repro gate). 167 if build_ok == 1 { 168 let rec: *NxWinRecord = nx_win_record_new( 169 "unified beat closed the core autonomy cycle\x00" as *u8, 170 "autonomy-loop\x00" as *u8, 171 "governed+warden-gated self-build+verify -> report -> log-next -> research, no-LLM\x00" as *u8, 172 "nx_unified_conductor\x00" as *u8, 173 "GREEN\x00" as *u8) 174 if nx_win_ledger_record(ledger, rec) >= 0 { learned = learned + 1 } 175 uc_puts(" -> GROW/LEARN: win recorded to the ledger (self-learning; count=" as *u8); uc_putn(nx_win_ledger_count(ledger)); uc_puts(")\n" as *u8) 176 } 177 } 178 } else { uc_puts("\n" as *u8) } 179 } else { uc_puts(" -> action denied; nothing queued\n" as *u8) } 180 181 beat = beat + 1 182 } 183 184 // prove the BACK-OFF path (politeness by construction, not asserted): at a SIMULATED busy load the budget is 0. 185 let busy_load: i64 = 32 * 1000 // 32 cores fully busy = way over any ceiling 186 let busy_budget: i64 = uc_budget(sl_ncpu(), busy_load, UC_MAGIC_4096, 0) 187 188 let q_after: i64 = nx_eval_queue_count() 189 190 uc_puts("\n ---- UNIFIED BEAT SCORECARD ----\n" as *u8) 191 uc_puts(" beats=" as *u8); uc_putn(UC_BEATS) 192 uc_puts(" governed-GO=" as *u8); uc_putn(go_beats) 193 uc_puts(" warden-allows=" as *u8); uc_putn(warden_allows) 194 uc_puts(" warden-denies=" as *u8); uc_putn(warden_denies) 195 uc_puts(" gaps-queued=" as *u8); uc_putn(queued) 196 uc_puts(" gap-domain-researched=" as *u8); uc_putn(researched); uc_puts(" (landed-file=" as *u8); uc_putn(research_ok); uc_puts(")\n" as *u8) 197 uc_puts(" self-build+verify(DO+TEST)=" as *u8); uc_putn(did_build); uc_puts(" (built+verified=" as *u8); uc_putn(build_ok); uc_puts(")\n" as *u8) 198 uc_puts(" GROW/LEARN wins-recorded=" as *u8); uc_putn(learned); uc_puts(" (ledger count=" as *u8); uc_putn(nx_win_ledger_count(ledger)); uc_puts(")\n" as *u8) 199 uc_puts(" back-off proof: at simulated busy load(32 cores) budget=" as *u8); uc_putn(busy_budget); uc_puts(" (0 = would stay polite)\n" as *u8) 200 uc_puts(" queue: " as *u8); uc_putn(q_before); uc_puts(" -> " as *u8); uc_putn(q_after); uc_puts(" (idempotent: same gap re-stated, not duplicated)\n" as *u8) 201 202 // VERDICT: the beat must be governed (GO under low load), warden-live (denies == go_beats), close the loop 203 // (queued > 0), and provably polite (busy budget 0). 204 var ok: i64 = 1 205 if go_beats < 1 { ok = 0 } // low load -> at least one beat should have run 206 if warden_denies != go_beats { ok = 0 } // every GO beat must have the src-overwrite DENIED (gate live) 207 if warden_allows != go_beats { ok = 0 } // every GO beat must have the additive action ALLOWED 208 if queued < 1 { ok = 0 } // REPORT->LOG-NEXT must have queued work 209 if researched < 1 { ok = 0 } // RESEARCH must have fired in-beat 210 if research_ok < 1 { ok = 0 } // and landed a real file (this env has network) 211 if did_build < 1 { ok = 0 } // DO+TEST self-build machinery must have fired 212 if build_ok < 1 { ok = 0 } // and self-built+verified an organ (exit 0) 213 if learned < 1 { ok = 0 } // GROW/LEARN must have captured a win to the ledger 214 if busy_budget != 0 { ok = 0 } // the governor must back off under simulated load 215 if ok == 1 { 216 uc_puts("NX-UNIFIED-CONDUCTOR GREEN: ONE governed + warden-gated beat closes the FULL CYCLE in-beat -- DO+TEST(self-build+verify) -> REPORT -> LOG-NEXT(queue) -> RESEARCH(SOTA) -> GROW/LEARN(win-ledger), resource-polite + no-LLM. The two-driver incoherence is UNIFIED; the autonomy loop closes on itself. (Targeted synthesis + promote-canonical + the deliberate unbounded flip = the remaining arc.)\n" as *u8) 217 sys_exit(0); return 0 218 } 219 uc_puts("NX-UNIFIED-CONDUCTOR RED (go=" as *u8); uc_putn(go_beats); uc_puts(" allows=" as *u8); uc_putn(warden_allows); uc_puts(" denies=" as *u8); uc_putn(warden_denies); uc_puts(" queued=" as *u8); uc_putn(queued); uc_puts(" researched=" as *u8); uc_putn(researched); uc_puts(" research_ok=" as *u8); uc_putn(research_ok); uc_puts(" busy=" as *u8); uc_putn(busy_budget); uc_puts(")\n" as *u8) 220 sys_exit(1); return 1 221}