code wiki / _hdl_build / nx_wirecensus.nx
`nx_wirecensus.nx` source

↩ module page · 283 lines · 15849 B
1// nx_wirecensus.nx -- THE NISHI KNIP, RUNG 1 (S4: registered but never called).
2//
3//   nx_wirecensus [allowlist] [cap_consent.log] [actlog.jrnl]
4//   defaults: tool_allowlist.conf  cap_consent.log  knowledge/status/actlog.jrnl
5//
6// WHY ONE ORGAN AND NOT FOUR (July-2026 SOTA, id=1785451391): Knip finds unused files, exports,
7// dependencies and devDependencies in ONE run over a whole monorepo -- ~300k weekly downloads, and
8// Vercel deleted ~300k lines with it. Our equivalent is FRAGMENTED across nx_adopt (functions),
9// nx_dupfunc (duplicate bodies), nx_srcdiverge (trees) and nx_toolreg_reconcile (registry): four
10// organs, four invocations, no single verdict -- and a census nobody runs in one look is a census
11// nobody runs. This organ is the consolidation point. Rung 1 is S4 because it is the class our
12// STATIC censuses structurally cannot see, and because the field's biggest win (16k lines, 35 pct of
13// an Express codebase) came from exactly this cross-reference: live evidence x declared surface.
14//
15// THE SIX CLASSES, so the shape is on the record even where unimplemented:
16//   S1 defined, zero EXTERNAL callers ............ nx_adopt answers this today
17//   S2 in SOURCE but in no shipped BINARY ........ open
18//   S3 built+promoted but never REGISTERED ....... open
19//   S4 registered but never AUTHORISED or CALLED . THIS ORGAN
20//   S5 conf row present, no consumer re-read it .. nx_toolreg_reconcile now upserts on drift
21//   S6 on the NAS but absent from the SSOT tree .. nx_srcdiverge_gate exists, stranded
22//
23// REFUSES RATHER THAN BLESSES: no allowlist, or zero registered tools, exits 2. "0 dark" computed
24// from an empty declared surface reads as a clean bill of health while guaranteeing nothing.
25// license_tier: ORIGINAL   Read-only. No hw writes (Rule 26).   expect_exit: 0
26import "nx_wirecensus_lib.nx"
27
28const WCO_OUT:  i64 = 262144
29const WCO_LIST: i64 = 60
30
31func wco_cat(o: *u8, at: i64, s: *u8) -> i64 {
  var a: i64 = at
  var i: i64 = 0
  while s[i] != (0 as u8) { o[a] = s[i]; a = a + 1; i = i + 1 }
  return a
36}
37func wco_num(o: *u8, at: i64, v: i64) -> i64 {
  if v == 0 { o[at] = 48 as u8; return at + 1 }
  let t: *u8 = sys_mmap(32)
  var n: i64 = 0
  var x: i64 = v
  while x > 0 { t[n] = ((x % 10) + 48) as u8; x = x / 10; n = n + 1 }
  var a: i64 = at
  while n > 0 { n = n - 1; o[a] = t[n]; a = a + 1 }
  return a
46}
47
48func main(argc: i64, argv: *i64) -> i64 {
  let o: *u8 = sys_mmap(WCO_OUT)
  var b: i64 = 0
51
  // EMIT MODE: propose organ_kind.conf rows that are DERIVABLE FROM EVIDENCE, never guessed.
  // WHY THIS IS NEEDED: declaration coverage is 45 permil (35 of 762), and BOTH /api/promote and
  // /api/deploy refuse an undeclared organ by design -- so 95 pct of promoted artifacts cannot be
  // shipped through the sanctioned path without someone stopping to declare them first. That
  // refusal blocked this session twice.
  // ONLY THE SAFE DIRECTION IS EMITTED. organ_kind.conf's own header states the asymmetry:
  // misfiling a DAEMON as a one-shot lets promote swap a live binary with no health probe (a
  // rule-26 hazard); misfiling a one-shot as a daemon merely BLOCKS it. So:
  //   registered in tool_allowlist  -> oneshot : it is fork-exec'd per call BY CONSTRUCTION
  //   name ends _gate/_test/_kat    -> oracle  : this is the SYSTEM'S OWN RULE, not a convention
  //                                             I invented -- /api/gate_run refuses any target
  //                                             whose name does not end in gate, test or kat
  // DAEMONS ARE NEVER EMITTED. That class needs a human or a live-listener probe, and it is the
  // only class where being wrong is dangerous. Emitting is read-only; appending stays deliberate.
  if argc > 1 {
      let v: *u8 = argv[1] as *u8
      if v[0] == (101 as u8) {
          let ab2: *u8 = sys_mmap(WC_BUF)
          let an3: i64 = wc_read("tool_allowlist.conf" as *u8, ab2, WC_BUF)
          if an3 <= 0 {
              b = wco_cat(o, b, "EMIT REFUSED -- cannot read tool_allowlist.conf\n" as *u8)
              sys_write(2, o, b); return 2
          }
          let rn2: *u8 = sys_mmap(WC_MAXT * WC_NAMEMAX)
          let rl2: *i64 = sys_mmap(WC_MAXT * 8) as *i64
          let tr2: *i64 = sys_mmap(16) as *i64
          tr2[0] = 0
          let rc2: i64 = wc_parse_registered(ab2, an3, rn2, rl2, tr2)
          let kb2: *u8 = sys_mmap(WC_BUF)
          let kn2: i64 = wc_read("knowledge/status/organ_kind.conf" as *u8, kb2, WC_BUF)
          b = wco_cat(o, b, "# DERIVED organ_kind rows -- evidence-backed, SAFE DIRECTION ONLY.\n# oneshot = registered in tool_allowlist (fork-exec'd per call by construction)\n# oracle  = name ends _gate/_test/_kat (the /api/gate_run bound, the system's own rule)\n# NO daemon rows are emitted: that is the one class where a wrong row is a rule-26 hazard.\n# Review, then append. Rows already present in organ_kind.conf are skipped.\n" as *u8)
          var emitted: i64 = 0
          var q: i64 = 0
          while q < rc2 {
              let p: *u8 = (rn2 as i64 + q * WC_NAMEMAX) as *u8
              let l: i64 = rl2[q]
              var already: i64 = 0
              if kn2 > 0 { if wc_contains_name(kb2, kn2, p, l) == 1 { already = 1 } }
              if already == 0 {
                  b = wco_cat(o, b, p)
                  if wc_looks_oracle(p, l) == 1 { b = wco_cat(o, b, " oracle\n" as *u8) }
                  else { b = wco_cat(o, b, " oneshot\n" as *u8) }
                  emitted = emitted + 1
              }
              q = q + 1
          }
          b = wco_cat(o, b, "# emitted=" as *u8); b = wco_num(o, b, emitted)
          b = wco_cat(o, b, " of registered=" as *u8); b = wco_num(o, b, rc2)
          b = wco_cat(o, b, " (skipped=already declared)\n" as *u8)
          sys_write(1, o, b)
          return 0
      }
  }
105
  var apath: *u8 = "tool_allowlist.conf" as *u8
  var cpath: *u8 = "cap_consent.log" as *u8
  var lpath: *u8 = "knowledge/status/actlog.jrnl" as *u8
  if argc > 1 { apath = argv[1] as *u8 }
  if argc > 2 { cpath = argv[2] as *u8 }
  if argc > 3 { lpath = argv[3] as *u8 }
112
  let abuf: *u8 = sys_mmap(WC_BUF)
  let an: i64 = wc_read(apath, abuf, WC_BUF)
  if an <= 0 {
      b = wco_cat(o, b, "WIRECENSUS REFUSED -- cannot read the tool allowlist: " as *u8)
      b = wco_cat(o, b, apath)
      b = wco_cat(o, b, "\n  Without the DECLARED surface there is nothing to audit, and reporting\n  '0 dark' from an empty expectation would read as a clean bill of health.\n" as *u8)
      sys_write(2, o, b); return 2
  }
121
  let rn: *u8 = sys_mmap(WC_MAXT * WC_NAMEMAX)
  let rl: *i64 = sys_mmap(WC_MAXT * 8) as *i64
  let tr: *i64 = sys_mmap(16) as *i64
  tr[0] = 0
  let rc: i64 = wc_parse_registered(abuf, an, rn, rl, tr)
  if rc == 0 {
      b = wco_cat(o, b, "WIRECENSUS REFUSED -- the allowlist parsed to ZERO registered tools.\n" as *u8)
      sys_write(2, o, b); return 2
  }
131
  // W1 STRONG (a cap is mandatory to invoke) | W2 WEAK-POSITIVE (voluntary logging)
  let cbuf: *u8 = sys_mmap(WC_BUF)
  // TAIL-ANCHORED (2026-08-07): cap_consent.log and actlog.jrnl are APPEND-ONLY, so when either
  // outgrows WC_BUF the head-anchored read kept the oldest bytes and dropped the newest -- inflating
  // DARK by hiding exactly the most recent evidence. actlog was measured at 1262 permil of the cap.
  let cn: i64 = wc_read_tail(cpath, cbuf, WC_BUF)
  let an2: *u8 = sys_mmap(WC_MAXT * WC_NAMEMAX)
  let al2: *i64 = sys_mmap(WC_MAXT * 8) as *i64
  var ac: i64 = 0
  if cn > 0 { ac = wc_parse_authorised(cbuf, cn, an2, al2, tr) }
142
  let lbuf: *u8 = sys_mmap(WC_BUF)
  let ln: i64 = wc_read_tail(lpath, lbuf, WC_BUF)
  let in2: *u8 = sys_mmap(WC_MAXT * WC_NAMEMAX)
  let il2: *i64 = sys_mmap(WC_MAXT * 8) as *i64
  var ic: i64 = 0
  if ln > 0 { ic = wc_parse_invoked(lbuf, ln, in2, il2, tr) }
149
  let dk: *i64 = sys_mmap(WC_MAXT * 8) as *i64
  let d: i64 = wc_dark(rn, rl, rc, an2, al2, ac, in2, il2, ic, dk, WC_MAXT)
152
  b = wco_cat(o, b, "=== NISHI WIRECENSUS -- S4: registered but never called ===\n  registered=" as *u8)
  b = wco_num(o, b, rc)
  b = wco_cat(o, b, "  authorised(W1 cap mints)=" as *u8); b = wco_num(o, b, ac)
  b = wco_cat(o, b, "  invoked(W2 actlog)=" as *u8);       b = wco_num(o, b, ic)
  b = wco_cat(o, b, "\n  DARK=" as *u8); b = wco_num(o, b, d)
  if rc > 0 {
      b = wco_cat(o, b, "  dark_permil=" as *u8)
      b = wco_num(o, b, (d * 1000) / rc)
  }
  b = wco_cat(o, b, "  table_truncated=" as *u8); b = wco_num(o, b, tr[0])
  if cn <= 0 { b = wco_cat(o, b, "\n  ! W1 ABSENT: cap_consent.log unreadable -- DARK is inflated, treat as UNMEASURED" as *u8) }
  if ln <= 0 { b = wco_cat(o, b, "\n  ! W2 ABSENT: actlog unreadable -- tools proven only by invocation cannot be rescued" as *u8) }
  b = wco_cat(o, b, "\n  BOUND: DARK is an UPPER BOUND. Caps minted before this log existed, or minted with the\n  root nx_cap_mint on the NAS instead of POST /api/cap/mint, never reach cap_consent.log; and\n  seats log to actlog VOLUNTARILY. Quote the bound whenever you quote the number.\n" as *u8)
166
  // ---- S3: promoted artifacts nobody registered ------------------------------------------------
  let en: *u8  = sys_mmap(WC_MAXT * WC_NAMEMAX)
  let el: *i64 = sys_mmap(WC_MAXT * 8) as *i64
  let ec: i64 = wc_scan_elfs("." as *u8, en, el, tr)
  let gn: *u8  = sys_mmap(WC_MAXT * WC_NAMEMAX)
  let gl: *i64 = sys_mmap(WC_MAXT * 8) as *i64
  let gc: i64 = wc_parse_registered_elfs(abuf, an, gn, gl, tr)
  let kbuf: *u8 = sys_mmap(WC_BUF)
  let kn: i64 = wc_read("knowledge/status/organ_kind.conf" as *u8, kbuf, WC_BUF)
  let nn: *u8  = sys_mmap(WC_MAXT * WC_NAMEMAX)
  let nl: *i64 = sys_mmap(WC_MAXT * 8) as *i64
  var nc: i64 = 0
  if kn > 0 { nc = wc_parse_nontools(kbuf, kn, nn, nl, tr) }
  let s3: *i64 = sys_mmap(WC_MAXT * 8) as *i64
  let n3: i64 = wc_dark(en, el, ec, gn, gl, gc, nn, nl, nc, s3, WC_MAXT)
182
  b = wco_cat(o, b, "\n=== S3: built + promoted but NEVER REGISTERED ===\n  promoted_elfs=" as *u8)
  b = wco_num(o, b, ec)
  b = wco_cat(o, b, "  registered_elfs=" as *u8); b = wco_num(o, b, gc)
  b = wco_cat(o, b, "  declared_nontool(daemon|lib)=" as *u8); b = wco_num(o, b, nc)
  b = wco_cat(o, b, "\n  UNEXPOSED=" as *u8); b = wco_num(o, b, n3)
  if kn <= 0 { b = wco_cat(o, b, "\n  ! organ_kind.conf unreadable -- daemons/libs CANNOT be excluded, UNEXPOSED is inflated" as *u8) }
  b = wco_cat(o, b, "\n  (a promoted artifact that is neither registered NOR declared daemon/lib is callable by\n  nobody -- nx_srcdiverge_gate is the canonical instance: promoted, unregistered, and it is\n  itself the detector for a stranding class)\n" as *u8)
  // TRIAGE: a raw UNEXPOSED count mixes running daemons with real strays. Split it by CONVENTION
  // (reporting only -- organ_kind.conf remains the sole authority for any promote decision) so the
  // residue is the only thing a human has to look at.
  // S7 evidence: an artifact that WRITES A LOG has run, even if the registry never exposed it.
  let ln7: *u8  = sys_mmap(WC_MAXT * WC_NAMEMAX)
  let ll7: *i64 = sys_mmap(WC_MAXT * 8) as *i64
  // CORRECT witness first: tools named in column 1 of the plan- planes. Log stems are kept as a
  // weak secondary because they cost nothing, but the plan planes are what actually joins.
  var lc7: i64 = wc_scan_plan_tools("knowledge/store" as *u8, ln7, ll7, 0, tr)
  let plan_tools: i64 = lc7
  lc7 = wc_scan_logs("logs" as *u8, ln7, ll7, lc7, tr)
  lc7 = wc_scan_logs("knowledge/status" as *u8, ln7, ll7, lc7, tr)
  let lc7b: i64 = lc7
  var looks_o: i64 = 0
  var looks_d: i64 = 0
  var s7run: i64 = 0
  var unclass: i64 = 0
  var j: i64 = 0
  while j < n3 {
      if j < WC_MAXT {
          let p: *u8 = (en as i64 + s3[j] * WC_NAMEMAX) as *u8
          let l: i64 = el[s3[j]]
          if wc_looks_oracle(p, l) == 1 { looks_o = looks_o + 1 } else {
              if wc_looks_daemon(p, l) == 1 { looks_d = looks_d + 1 } else {
                  // S7 RESCUE before condemning: a log with this stem proves it ran.
                  if wc_has(ln7, ll7, lc7b, p, l) == 1 { s7run = s7run + 1 } else { unclass = unclass + 1 }
              }
          }
      }
      j = j + 1
  }
  b = wco_cat(o, b, "  TRIAGE (convention-inferred, REPORTING ONLY -- organ_kind.conf stays authoritative):\n    oracle-shaped(_gate/_test/_kat)=" as *u8)
  b = wco_num(o, b, looks_o)
  b = wco_cat(o, b, "  daemon-shaped(_daemon/_serve/_gw)=" as *u8); b = wco_num(o, b, looks_d)
  b = wco_cat(o, b, "\n    S7 plan/cron-INVOKED (named in a plan- plane, so a schedule CALLS it)=" as *u8); b = wco_num(o, b, s7run)
  b = wco_cat(o, b, "  [plan-named tools=" as *u8); b = wco_num(o, b, plan_tools)
  b = wco_cat(o, b, " +log stems, total witnesses=" as *u8); b = wco_num(o, b, lc7b)
  b = wco_cat(o, b, "]\n    UNCLASSIFIED=" as *u8); b = wco_num(o, b, unclass)
  b = wco_cat(o, b, "  <-- the honest S3 residue; these are the rows worth a human declaration\n" as *u8)
  b = wco_cat(o, b, "  (S7 reads COLUMN 1 of the plan- planes -- the tool a scheduled plan actually calls, e.g.\n  plan-surfsentinel- = 10x nx_https_get. An earlier attempt used LOG STEMS and rescued ZERO from\n  224 stems: logs are named after the JOB, never the ORGAN, so they can never join. Rescue is\n  POSITIVE-ONLY, so a loose match shrinks the residue and can never retire a live organ.\n  UNCLASSIFIED still means UNKNOWN -- a plan is not the only way to be called.)\n" as *u8)
  if gc > 0 {
      b = wco_cat(o, b, "  declaration_coverage_permil=" as *u8)
      b = wco_num(o, b, (nc * 1000) / ec)
      b = wco_cat(o, b, " (organ_kind.conf declares " as *u8); b = wco_num(o, b, nc)
      b = wco_cat(o, b, " of " as *u8); b = wco_num(o, b, ec)
      b = wco_cat(o, b, " promoted artifacts -- BOTH /api/promote and /api/deploy consult it)\n" as *u8)
  }
  var s3shown: i64 = 0
  j = 0
  while j < n3 {
      if s3shown < WCO_LIST {
          if j < WC_MAXT {
              let p2: *u8 = (en as i64 + s3[j] * WC_NAMEMAX) as *u8
              let l2: i64 = el[s3[j]]
              if wc_looks_oracle(p2, l2) == 0 { if wc_looks_daemon(p2, l2) == 0 {
                  if wc_has(ln7, ll7, lc7b, p2, l2) == 0 {
                      b = wco_cat(o, b, "    UNCLASSIFIED  " as *u8)
                      b = wco_cat(o, b, p2)
                      b = wco_cat(o, b, "\n" as *u8)
                      s3shown = s3shown + 1
                  }
              } }
          }
      }
      j = j + 1
  }
  if unclass > s3shown {
      b = wco_cat(o, b, "    ... " as *u8); b = wco_num(o, b, unclass - s3shown)
      b = wco_cat(o, b, " more UNCLASSIFIED not shown\n" as *u8)
  }
  b = wco_cat(o, b, "\n=== S4 DARK LIST ===\n" as *u8)
261
  var shown: i64 = 0
  var i: i64 = 0
  while i < d {
      if shown < WCO_LIST {
          if i < WC_MAXT {
              b = wco_cat(o, b, "    DARK  " as *u8)
              b = wco_cat(o, b, (rn as i64 + dk[i] * WC_NAMEMAX) as *u8)
              b = wco_cat(o, b, "\n" as *u8)
              shown = shown + 1
          }
      }
      i = i + 1
  }
  if d > shown {
      b = wco_cat(o, b, "    ... " as *u8); b = wco_num(o, b, d - shown)
      b = wco_cat(o, b, " more DARK not shown (list bounded to " as *u8); b = wco_num(o, b, WCO_LIST)
      b = wco_cat(o, b, ")\n" as *u8)
  }
  if d == 0 { b = wco_cat(o, b, "  GREEN -- every registered tool has been authorised or invoked at least once.\n" as *u8) }
  sys_write(1, o, b)
  return 0
283}
nx_wirecensus.nx source

`nx_wirecensus.nx` source
