nx_wiredclaim_lib.nx source

1// nx_wiredclaim_lib.nx -- IS AN ORGAN ACTUALLY CALLED, OR ONLY CLAIMED TO BE? NO main() ON PURPOSE. 2// 3// THE CLASS THIS EXISTS FOR is the ecosystem's most-repeated defect: a capability that is BUILT, GATED, 4// and DESCRIBED AS WIRED, but has no production call site -- so it is, in effect, the baseline it was 5// meant to beat. Banked instances: public registration open while gate-proven ls_signup_allowed sat 6// unwired (1785445704); the pre-deploy gate computed, published and structurally unreachable from the 7// act it guards (1785453118); and F881, where nx_magicratchet is asserted "wired into /api/build" in 8// FOUR comments while grep finds ZERO call sites in the source AND ZERO in the deployed mgmt binary, 9// and a two-build experiment shows the enforcement does not fire (1785530277). 10// 11// METHOD, AND WHY IT IS DELIBERATELY NOT AN LLM: the 2026 literature on code/comment inconsistency 12// reports that plain LLM judging yields unacceptably high false positives, because a model reads the 13// normal gap between high-level prose and detailed code as a defect (DocPrism). The sound technique is 14// CASCADE-style DOCUMENT TESTING: turn the claim into something executable and run it. This organ is the 15// STATIC half of that -- it decides, over a corpus grep, whether every mention of an organ is PROSE. 16// A claim with no call site is not proof of absence, it is the trigger to run the behavioural test. 17// 18// INPUT is the output of `nx_shelltool grep <organ> <dir> nx out=<f>.out` -- lines of `path:lineno:text`. 19// Composing the grep rather than walking keeps this organ free of a corpus cap it would have to be 20// honest about, and reuses the ONE canonical search path. 21// 22// u26a0DECLARED ENVELOPE (L011): line-shape heuristics, not a parser. A call written across a line break, or 23// dispatched through a runtime-assembled path (the way a builder may exec `_offc/<name>.elf`), reads as 24// NO CALL SITE. That is why the verdict for zero-calls-plus-claims is CLAIMED-UNWIRED -- a REVIEW 25// TRIGGER naming the behavioural test to run -- and never "proven absent". 26// license_tier: ORIGINAL No hw writes (Rule 26). 27import "nx_gatedry_lib.nx" 28 29const WC_WIRED: i64 = 0 // at least one non-comment, non-self mention: a real call site candidate 30const WC_CLAIMED: i64 = 1 // zero call sites, but prose mentions it -- the F881 shape 31const WC_NOEVIDENCE: i64 = 2 // no mentions at all 32const WC_UNREADABLE: i64 = 3 33 34const WC_SLASH: i64 = 47 35const WC_SPACE: i64 = 32 36const WC_TAB: i64 = 9 37const WC_NL: i64 = 10 38 39// is the grep hit's TEXT (the part after path:lineno:) a comment line? 40func wc_is_comment(buf: *u8, s: i64, e: i64) -> i64 { 41 var j: i64 = s 42 var go: i64 = 1 43 while go == 1 { 44 if j >= e { go = 0 } else { 45 let c: i64 = buf[j] as i64 46 if c == WC_SPACE { j = j + 1 } else { if c == WC_TAB { j = j + 1 } else { go = 0 } } 47 } 48 } 49 if j + 1 >= e { return 0 } 50 if buf[j] == (WC_SLASH as u8) { if buf[j+1] == (WC_SLASH as u8) { return 1 } } 51 return 0 52} 53 54// does the PATH part of the hit name the organ itself (a self-reference, not a caller)? 55func wc_is_self(buf: *u8, s: i64, e: i64, organ: *u8) -> i64 { 56 let on: i64 = gd_len(organ) 57 var i: i64 = s 58 while i + on < e { 59 if buf[i] == (WC_SLASH as u8) { 60 var k: i64 = 0 61 var hit: i64 = 1 62 while k < on { if buf[i+1+k] != organ[k] { hit = 0; k = on } else { k = k + 1 } } 63 if hit == 1 { if buf[i+1+on] == (46 as u8) { return 1 } } 64 } 65 i = i + 1 66 } 67 return 0 68} 69 70// Walk grep output. Each line is `path:lineno:text`. cnt[0]=call-sites cnt[1]=comment-mentions 71// cnt[2]=self-references cnt[3]=lines seen. A trailer line (the `-- matches=` envelope) has no 72// second colon and is skipped, so the summary can never be miscounted as evidence. 73func wc_scan(buf: *u8, n: i64, organ: *u8, cnt: *i64) -> i64 { 74 cnt[0] = 0 75 cnt[1] = 0 76 cnt[2] = 0 77 cnt[3] = 0 78 var ls: i64 = 0 79 while ls < n { 80 var le: i64 = ls 81 var go: i64 = 1 82 while go == 1 { if le < n { if buf[le] != (WC_NL as u8) { le = le + 1 } else { go = 0 } } else { go = 0 } } 83 if le > ls { 84 var c1: i64 = 0 - 1 85 var c2: i64 = 0 - 1 86 var i: i64 = ls 87 while i < le { 88 if buf[i] == (58 as u8) { if c1 < 0 { c1 = i } else { if c2 < 0 { c2 = i } } } 89 i = i + 1 90 } 91 if c2 > 0 { 92 cnt[3] = cnt[3] + 1 93 if wc_is_comment(buf, c2 + 1, le) == 1 { cnt[1] = cnt[1] + 1 } else { 94 if wc_is_self(buf, ls, c1, organ) == 1 { cnt[2] = cnt[2] + 1 } else { cnt[0] = cnt[0] + 1 } 95 } 96 } 97 } 98 ls = le + 1 99 } 100 return cnt[3] 101} 102 103// A call site anywhere WINS -- one real caller means the capability is reachable, whatever the prose says. 104// Zero callers WITH prose is the dangerous shape, because the prose is what a reader trusts. 105func wc_verdict(cnt: *i64) -> i64 { 106 if cnt[0] > 0 { return WC_WIRED } 107 if cnt[1] > 0 { return WC_CLAIMED } 108 if cnt[2] > 0 { return WC_CLAIMED } 109 return WC_NOEVIDENCE 110} 111 112func wc_name(v: i64) -> *u8 { 113 if v == WC_WIRED { return "WIRED" as *u8 } 114 if v == WC_CLAIMED { return "CLAIMED-UNWIRED" as *u8 } 115 if v == WC_NOEVIDENCE { return "NO-EVIDENCE" as *u8 } 116 return "UNREADABLE" as *u8 117}