nx_wiredclaim_gate.nx source
↩ module page · 220 lines · 11974 B
1// nx_wiredclaim_gate.nx -- THE STANDING TEST FOR "CLAIMED BUT NOT CALLED".
2//
3// WHY THIS EXISTS, from an open sev-8 (1785530277) re-confirmed live 2026-08-15. F881 wired the rule-11
4// magic-number ratchet into /api/build, that wiring was later LOST, and NOTHING SAID SO. Four source
5// comments went on asserting the enforcement as established fact for months while builds sailed through
6// unchallenged. The debt row names the missing piece itself:
7// "an enforcement with no standing test is how this silently reverted"
8// "IF NO TEST FAILS WHEN THE WIRING IS REMOVED, THE WIRING WILL BE REMOVED AND NOTHING WILL SAY SO."
9// nx_wiredclaim already COMPUTES the answer, but it takes a grep artefact as input, so nothing could put
10// it on a beat. That is the whole gap this organ closes: it is the thing that says so.
11//
12// COMPOSES, NEVER RE-DERIVES: the judgement is nx_wiredclaim_lib's (wc_scan/wc_verdict) so there is
13// exactly one definition of "called vs merely claimed" in the estate. Shaped after nx_sweepgate (same
14// session): fork the proven scanner, READ THE ENVELOPE BEFORE THE NUMBERS, then judge.
15//
16// THE CEILING, STATED UP FRONT: wc_verdict keys on LINE SHAPE -- a non-comment, non-self mention is a
17// call-site CANDIDATE, not proof that anything executes. So WIRED here is necessary, not sufficient, and
18// this gate detects the F881 SHAPE rather than certifying that a chokepoint fires. nx_wiredclaim says the
19// same of itself: confirm by execution. A gate that overstated this would be the false proof with an
20// authoritative name that the estate keeps paying for.
21// license_tier: ORIGINAL Read-only. No hw writes (Rule 26). expect_exit: 0
22
23import "nx_gate_verdict.nx"
24import "nx_wiredclaim_lib.nx"
25import "nx_tool_run.nx"
26
27// The ONE bound in this organ. A subprocess's output length is unknowable before it runs -- the only
28// ceiling this estate permits -- and its truncation ANNOUNCES rather than silently shortening the
29// evidence. Named for that single purpose and nothing else.
30const WG_CAPTURE_BYTES: i64 = 1048576
31const WG_NL: i64 = 10
32const WG_HASH: i64 = 35
33const WG_PIPE: i64 = 124
34const WG_CNTS: i64 = 64
35
36// LOCAL, AND NAMED LOCAL ON PURPOSE. My first cut called this gv_eq, assuming the base class provided it
37// -- it does not, and the sibling I had in mind (cg_eq in nx_ctxtop_gate) is itself a local helper. A
38// gv_ prefix on a function nx_gate_verdict does not define would tell every future reader it came from
39// the base class. A NAME THAT MISSTATES WHERE SOMETHING COMES FROM IS THE SAME DEFECT AS A COMMENT THAT
40// MISSTATES WHETHER SOMETHING IS WIRED -- which is the very class this gate exists to catch.
41func wg_eq(a: i64, b: i64) -> i64 { if a == b { return 1 } return 0 }
42
43func wg_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
44func wg_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
45func wg_n(v: i64) -> i64 {
46 let b: *u8 = sys_mmap(32)
47 let t: *u8 = sys_mmap(32)
48 if v == 0 { b[0] = 48 as u8; sys_write(1, b, 1); return 0 }
49 var m: i64 = v
50 var k: i64 = 0
51 if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m }
52 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
53 var o: i64 = 0
54 while k > 0 { k = k - 1; b[o] = t[k]; o = o + 1 }
55 sys_write(1, b, o)
56 return 0
57}
58
59// ---- SELFTEST: both directions, on buffers whose answer is known by construction --------------------
60// A DETECTOR THAT HAS ONLY EVER SAID ONE THING IS UNVERIFIED. The dangerous failure here is a gate that
61// reports CLAIMED for everything: it would "find" F881 and every other organ alike, and be believed.
62// So the positive control is a fixture that MUST come back WIRED, sharing every other property with the
63// negative one -- the two differ by exactly the single caller line, which is the discrimination itself.
64func wg_selftest() -> i64 {
65 let ctr: *i64 = gv_ctr()
66 gv_head("nx_wiredclaim_gate -- called, or only claimed? proven both ways on planted evidence" as *u8)
67
68 let cnt: *i64 = sys_mmap(WG_CNTS) as *i64
69
70 // WIRED fixture: one real caller, one comment mention, one self-reference, one envelope trailer.
71 let fx1: *u8 = "runtime/nx_caller.nx:42: let r: i64 = nx_target(1)\nruntime/nx_other.nx:7:// nx_target is described as wired into the beat\nruntime/nx_target.nx:3: let z: i64 = 0\n-- matches=3 coverage_complete=1 corpus_complete=1\n" as *u8
72 wc_scan(fx1, wg_slen(fx1), "nx_target" as *u8, cnt)
73 gv_check("POS-CONTROL: a real caller line makes the verdict WIRED", wg_eq(wc_verdict(cnt), WC_WIRED), ctr)
74 gv_check("the caller is counted as a call site, exactly once", wg_eq(cnt[0], 1), ctr)
75 gv_check("the comment mention is counted as prose, not as a call", wg_eq(cnt[1], 1), ctr)
76 gv_check("the organ's OWN file is counted as a self-reference, not as a caller", wg_eq(cnt[2], 1), ctr)
77 gv_check("neg-control-the-scanner-envelope-trailer-is-not-evidence: 4 lines in, 3 counted", wg_eq(cnt[3], 3), ctr)
78
79 // CLAIMED fixture: byte-identical MINUS the caller line. Everything else is held constant so the
80 // verdict flip can only be attributed to the one thing that changed.
81 let fx2: *u8 = "runtime/nx_other.nx:7:// nx_target is described as wired into the beat\nruntime/nx_target.nx:3: let z: i64 = 0\n-- matches=2 coverage_complete=1 corpus_complete=1\n" as *u8
82 wc_scan(fx2, wg_slen(fx2), "nx_target" as *u8, cnt)
83 gv_check("NEG-CONTROL: prose plus self-reference and NO caller is CLAIMED, the F881 shape", wg_eq(wc_verdict(cnt), WC_CLAIMED), ctr)
84 gv_check("and it reports zero call sites, so the finding names itself", wg_eq(cnt[0], 0), ctr)
85
86 // An empty corpus must not read as either answer.
87 let fx3: *u8 = "-- matches=0 coverage_complete=1 corpus_complete=1\n" as *u8
88 wc_scan(fx3, wg_slen(fx3), "nx_target" as *u8, cnt)
89 gv_check("neg-control-no-mentions-at-all-is-NOEVIDENCE-not-CLAIMED", wg_eq(wc_verdict(cnt), WC_NOEVIDENCE), ctr)
90
91 return gv_verdict("nx_wiredclaim_gate" as *u8, ctr, "the claimed-vs-called judgement discriminates on planted evidence" as *u8)
92}
93
94// ---- ONE DECLARED CLAIM ----------------------------------------------------------------------------
95// Returns the wc_ verdict, or -1 when the scan could not be trusted. An axis that cannot see must
96// abstain, never acquit AND never convict.
97func wg_one(organ: *u8, dir: *u8, ext: *u8) -> i64 {
98 let out: *u8 = sys_mmap(WG_CAPTURE_BYTES)
99 let ol: *i64 = sys_mmap(16) as *i64
100 let av: *i64 = sys_mmap(64) as *i64
101
102 // CWD PROBE, not an assumption: a gate may run from the serving root or from buildroot, and a tool
103 // path that resolves in one and not the other is the difference between a census and a lie.
104 var tool: *u8 = "nx_shelltool.elf" as *u8
105 var fd: i64 = sys_openat_rd(tool)
106 if fd < 0 {
107 tool = "../nx_shelltool.elf" as *u8
108 fd = sys_openat_rd(tool)
109 if fd < 0 { wg_w(" scanner unreachable from either root -- I could not look\n" as *u8); return 0 - 1 }
110 }
111 sys_close(fd)
112
113 av[0] = tool as i64
114 av[1] = "grep" as i64
115 av[2] = organ as i64
116 av[3] = dir as i64
117 var an: i64 = 4
118 if (ext as i64) != 0 { av[an] = ext as i64; an = an + 1 }
119 av[an] = 0
120 let rc: i64 = tr_run_capture(tool, av, out, WG_CAPTURE_BYTES, ol)
121 let n: i64 = ol[0]
122 if rc != 0 { wg_w(" scanner failed\n" as *u8); return 0 - 1 }
123
124 // THE ONE BOUND ANSWERS FOR ITSELF, rather than relying on the envelope happening to sit last.
125 if n >= WG_CAPTURE_BYTES { wg_w(" capture cap reached -- THIS ORGAN's read was partial, whatever the scan did\n" as *u8); return 0 - 1 }
126
127 // READ THE ENVELOPE BEFORE THE NUMBERS. Absence proven through a partial scan is not absence, and
128 // "zero call sites" is precisely an absence claim.
129 if tr_contains(out, n, "coverage_complete=1" as *u8) != 1 { wg_w(" coverage incomplete -- no claim available\n" as *u8); return 0 - 1 }
130 if tr_contains(out, n, "corpus_complete=1" as *u8) != 1 { wg_w(" corpus incomplete -- no claim available\n" as *u8); return 0 - 1 }
131
132 let cnt: *i64 = sys_mmap(WG_CNTS) as *i64
133 wc_scan(out, n, organ, cnt)
134 let v: i64 = wc_verdict(cnt)
135 wg_w("NX-WIREDCLAIM-GATE organ=" as *u8); wg_w(organ)
136 wg_w(" verdict=" as *u8); wg_w(wc_name(v))
137 wg_w(" call_sites=" as *u8); wg_n(cnt[0])
138 wg_w(" comment_mentions=" as *u8); wg_n(cnt[1])
139 wg_w(" self_refs=" as *u8); wg_n(cnt[2])
140 wg_w(" lines=" as *u8); wg_n(cnt[3])
141 wg_w("\n" as *u8)
142 return v
143}
144
145// ---- THE DECLARED CLAIMS ---------------------------------------------------------------------------
146// Rows live in a conf so the estate declares WHICH assertions must stay true, and this organ re-checks
147// them on a beat. Running declared conf rows on no-argv is not the silent-default defect: the rows are
148// explicit, they are the SSOT, and a missing conf reports UNOBSERVABLE rather than clean.
149func wg_watch() -> i64 {
150 let ctr: *i64 = gv_ctr()
151 let cl: *i64 = sys_mmap(16) as *i64
152 var conf: *u8 = sys_read_file("knowledge/status/wiredclaim_watch.conf" as *u8, cl)
153 if (conf as i64) == 0 { conf = sys_read_file("buildroot/knowledge/status/wiredclaim_watch.conf" as *u8, cl) }
154 if (conf as i64) == 0 {
155 gv_need("wiredclaim_watch.conf -- it resolves from neither root, so the declared claims are unknown" as *u8, 0, ctr)
156 return gv_verdict("nx_wiredclaim_gate" as *u8, ctr, "declared wiring claims still hold" as *u8)
157 }
158 let n: i64 = cl[0]
159 wg_w("\nstanding check over the declared wiring claims:\n" as *u8)
160 var rows: i64 = 0
161 var p: i64 = 0
162 while p < n {
163 var e: i64 = p
164 while e < n { if conf[e] == (WG_NL as u8) { break } e = e + 1 }
165 if e > p { if conf[p] != (WG_HASH as u8) {
166 var f1: i64 = 0 - 1
167 var f2: i64 = 0 - 1
168 var c: i64 = p
169 while c < e {
170 if conf[c] == (WG_PIPE as u8) { if f1 < 0 { f1 = c } else { if f2 < 0 { f2 = c } } }
171 c = c + 1
172 }
173 if f1 > 0 {
174 conf[f1] = 0 as u8
175 var ext2: *u8 = 0 as *u8
176 if f2 > 0 { conf[f2] = 0 as u8; ext2 = (conf as i64 + f2 + 1) as *u8 }
177 conf[e] = 0 as u8
178 let organ: *u8 = (conf as i64 + p) as *u8
179 let dir: *u8 = (conf as i64 + f1 + 1) as *u8
180 rows = rows + 1
181 let v: i64 = wg_one(organ, dir, ext2)
182 if v < 0 {
183 gv_need("a trustworthy scan for a declared claim -- the scanner could not cover it" as *u8, 0, ctr)
184 } else {
185 gv_check("a declared-wired organ is CALLED, not merely CLAIMED", wg_eq(v, WC_WIRED), ctr)
186 }
187 }
188 } }
189 p = e + 1
190 }
191 if rows == 0 {
192 gv_need("at least one declared claim -- the conf listed none, so nothing was checked" as *u8, 0, ctr)
193 }
194 return gv_verdict("nx_wiredclaim_gate" as *u8, ctr, "every declared wiring claim has a call site, not just prose" as *u8)
195}
196
197func main(argc: i64, argv: *i64) -> i64 {
198 if argc < 2 {
199 let rc0: i64 = wg_selftest()
200 let rc1: i64 = wg_watch()
201 var rc: i64 = rc0
202 if rc1 != 0 { rc = rc1 }
203 sys_exit(rc)
204 return rc
205 }
206 if argc < 3 {
207 wg_w("usage: nx_wiredclaim_gate <organ> <dir> [ext]\n" as *u8)
208 wg_w(" With NO arguments it runs its selftest AND every claim declared in the watch conf.\n" as *u8)
209 wg_w(" WIRED means a call-site CANDIDATE exists by line shape -- necessary, not proof of execution.\n" as *u8)
210 sys_exit(2)
211 return 2
212 }
213 var ext3: *u8 = 0 as *u8
214 if argc >= 4 { ext3 = argv[3] as *u8 }
215 let v: i64 = wg_one(argv[1] as *u8, argv[2] as *u8, ext3)
216 if v < 0 { sys_exit(3); return 3 }
217 if v == WC_WIRED { sys_exit(0); return 0 }
218 sys_exit(1)
219 return 1
220}