nx_workstream_audit_gate.nx source

1// nx_workstream_audit_gate.nx -- THE REFEREE for WMS-R4 (the boot-time completeness/crash audit). 2// Structural twin of nx_workstream_registry_gate: that proves the registry is an internally-complete 3// SSOT; THIS proves the registry is EXTERNALLY complete -- cross-checked against the real filesystem 4// (memory .md + code .nx) and the assignment_queue, so a lost/moved/never-registered workstream is 5// reported LOUDLY (orphan / untracked / unregistered) rather than silently dropped on crash recovery. 6// 7// HERMETIC: the gate seeds its OWN test store (knowledge/store/wsaudit-) with controlled fixtures 8// (NOT production claims) AND builds tiny fixture dirs under knowledge/store/wsaudit_fix/{mem,code}/ 9// so the FS walk runs over CONTROLLED data (a real DATA-driven walk, not one hardcoded branch). 10// Assertions (flat pass-tally, avoids the LM-002 deep-nested-if landmine): 11// T1 clean-store no-orphan : every fixture row's mem/code link resolves -> ws_audit_orphans_p==0 12// T2 orphan caught : one fixture row's memory_link points at a .md that was NOT created 13// -> orphans>=1 AND that id in orphan_out 14// T3 untracked NEG-CONTROL : a .nx organ dropped in wsaudit_fix/code/ with NO matching code_link 15// in the registry -> ws_audit_untracked_p>=1 AND its basename reported. 16// THE mandatory neg-control: a hidden workstream present in code but 17// absent from the registry is CAUGHT. 18// T4 no-false-positive : a fully-registered fixture organ (its basename IS a code_link) is 19// NOT in untracked_out (proves T3 isn't a constant non-zero). 20// T5 unregistered caught : a hermetic queue fixture row id T-PROSE-ONLY not in the registry -> 21// ws_audit_unregistered_p>=1 with that id reported; a registered id NOT. 22// T6 production roll-up : against the live ws- prefix + real memory/runtime/queue, 23// ws_audit_complete_r4_p runs and PRINTS orphan/untracked/unregistered 24// counts; GREEN-gate invariant = production ORPHANS==0 (the lost-things 25// invariant, using the basename-resolving code check so the path-shifted 26// links nx_geo/nx_drv_proto_emit/nx_root_trace do NOT false-orphan). 27// GREEN only if T1..T6 all hold. Evidence -> knowledge/status/workstream_audit_gate.log. 28// license_tier: ORIGINAL 29import "nx_workstream_audit.nx" 30import "nx_workstream_store.nx" 31import "nx_seg_store.nx" 32import "nx_syscalls.nx" 33import "nx_gate_verdict.nx" 34 35const WAG_LOG: *u8 = "knowledge/status/workstream_audit_gate.log" 36const WSAUDIT_PREFIX: *u8 = "knowledge/store/wsaudit-" 37const FIX_ROOT: *u8 = "knowledge/store/wsaudit_fix" 38const FIX_MEM: *u8 = "knowledge/store/wsaudit_fix/mem/" // ends '/' 39const FIX_CODE: *u8 = "knowledge/store/wsaudit_fix/code/" // ends '/' 40const FIX_QUEUE: *u8 = "knowledge/store/wsaudit_fix/queue.tsv" 41 42func wag_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 43func wag_n(fd: i64, v: i64) -> i64 { let bb: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m; sys_write(fd,"-" as *u8,1)}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48 as u8;k=1}; while m>0 {t[k]=(48+(m%10)) as u8; m=m/10; k=k+1}; var i: i64=0; while i<k {bb[i]=t[k-1-i]; i=i+1}; sys_write(fd, bb, k); return 0 } 44func wag_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 45 46func wag_streq(a: *u8, b: *u8) -> i64 { 47 var i: i64 = 0 48 while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } 49 if b[i] != (0 as u8) { return 0 } 50 return 1 51} 52 53func wag_row(fd: i64, name: *u8, pass: i64) -> i64 { 54 wag_w(fd, " "); wag_w(fd, name) 55 if pass == 1 { wag_w(fd, " PASS\n" as *u8) } else { wag_w(fd, " FAIL\n" as *u8) } 56 return 0 57} 58 59// 1 if the hermetic store value for `key` byte-equals `val` (idempotent seed helper). 60func wag_streq_store(key: *u8, val: *u8) -> i64 { 61 let pq: *i64 = sys_mmap(16) as *i64 62 let lq: *i64 = sys_mmap(16) as *i64 63 if ss_get(WSAUDIT_PREFIX, key, pq, lq) != 1 { return 0 } 64 let b: *u8 = pq[0] as *u8 65 let nn: i64 = lq[0] 66 let vl: i64 = wag_len(val) 67 if nn != vl { return 0 } 68 var i: i64 = 0 69 while i < nn { if b[i] != val[i] { return 0 } i = i + 1 } 70 return 1 71} 72 73// commit a single (key,val) into the hermetic prefix, idempotent. 74func wag_seed_one(key: *u8, val: *u8) -> i64 { 75 if wag_streq_store(key, val) == 1 { return 1 } 76 let w: *i64 = ss_begin() 77 ss_add(w, 1, key, val, wag_len(val)) 78 let segid: i64 = ws_seg_next(WSAUDIT_PREFIX) 79 return ss_commit(WSAUDIT_PREFIX, w, segid) 80} 81 82// write a fixture file (truncate) with a one-line body. Returns 0 ok, <0 open-fail. 83func wag_write_file(path: *u8, body: *u8) -> i64 { 84 let fd: i64 = sys_openat_wr(path, 420) 85 if fd < 0 { return 0 - 1 } 86 sys_write(fd, body, wag_len(body)) 87 sys_close(fd) 88 return 0 89} 90 91// is NUL-term `tok` present in out[0..cnt) of NUL-term strings? 92func wag_in_list(out: *i64, cnt: i64, tok: *u8) -> i64 { 93 var i: i64 = 0 94 while i < cnt { if wag_streq(out[i] as *u8, tok) == 1 { return 1 } i = i + 1 } 95 return 0 96} 97 98func main() -> i64 { 99 // ---- build hermetic fixture dirs (idempotent: mkdir returns -EEXIST on re-run, harmless) ---- 100 sys_mkdir(FIX_ROOT, 0x1ed) 101 sys_mkdir("knowledge/store/wsaudit_fix/mem" as *u8, 0x1ed) 102 sys_mkdir("knowledge/store/wsaudit_fix/code" as *u8, 0x1ed) 103 104 // ---- fixture MEMORY files (the ones that SHOULD resolve). T2's mem-missing.md is NOT created. ---- 105 wag_write_file("knowledge/store/wsaudit_fix/mem/fix-mem-a.md" as *u8, "fixture a\n" as *u8) 106 wag_write_file("knowledge/store/wsaudit_fix/mem/fix-mem-b.md" as *u8, "fixture b\n" as *u8) 107 wag_write_file("knowledge/store/wsaudit_fix/mem/fix-mem-c.md" as *u8, "fixture c\n" as *u8) 108 109 // ---- fixture CODE organs ---- 110 // fix-tracked.nx IS referenced by a registry code_link (T4 no-false-positive). 111 wag_write_file("knowledge/store/wsaudit_fix/code/fix-tracked.nx" as *u8, "// tracked fixture organ\n" as *u8) 112 // fix-hidden.nx is the HIDDEN workstream: real code, NO registry code_link (T3 neg-control). 113 wag_write_file("knowledge/store/wsaudit_fix/code/fix-hidden.nx" as *u8, "// HIDDEN workstream organ -- not in any registry row\n" as *u8) 114 115 // ---- fixture QUEUE: one comment, one registered id, one prose-only (unregistered) id ---- 116 wag_write_file(FIX_QUEUE, "# fixture queue\nT-WS-A\trung\n#another comment\nT-PROSE-ONLY\trung\n" as *u8) 117 118 // ---- seed the hermetic registry. T-WS-A: links resolve. T-WS-B: memory_link points at a .md 119 // that was NEVER created (the ORPHAN, T2). code_links point at fixture organs by relative path. ---- 120 wag_seed_one("ws:empires" as *u8, "E-CORE\tE-GAME\tE-RESEARCH" as *u8) 121 wag_seed_one("ws:ids" as *u8, "T-WS-A\tT-WS-B" as *u8) 122 // schema: id empire state last_touched memory_link code_link deps 123 wag_seed_one("ws:T-WS-A" as *u8, "T-WS-A\tE-CORE\tDONE\t0\tfix-mem-a.md\tknowledge/store/wsaudit_fix/code/fix-tracked.nx\t-" as *u8) 124 wag_seed_one("ws:T-WS-B" as *u8, "T-WS-B\tE-GAME\tACTIVE\t0\tfix-mem-MISSING.md\tknowledge/store/wsaudit_fix/code/fix-tracked.nx\t-" as *u8) 125 126 let orph: *i64 = sys_mmap(8 * 256) as *i64 127 let untr: *i64 = sys_mmap(8 * 256) as *i64 128 let unreg: *i64 = sys_mmap(8 * 256) as *i64 129 130 // ---- T2 (computed first): with T-WS-B's memory_link missing, the orphan pass MUST flag T-WS-B. 131 // Note both rows' code_links point at the SAME real fix-tracked.nx, so code resolves -> the ONLY 132 // orphan source here is T-WS-B's missing memory file (isolates the memory-link detector). ---- 133 let n_orph: i64 = ws_audit_orphans_p(WSAUDIT_PREFIX, FIX_MEM, orph, 256) 134 var t2: i64 = 0 135 if n_orph >= 1 { if wag_in_list(orph, n_orph, "T-WS-B" as *u8) == 1 { t2 = 1 } } 136 137 // ---- T1: clean-store no-orphan. Repair T-WS-B's memory_link to a real file -> a fully-resolving 138 // store -> orphans MUST be 0 (proves the orphan pass is not a constant non-zero). Additive new 139 // version of ws:T-WS-B (the store is append-only; latest version wins). ---- 140 wag_seed_one("ws:T-WS-B" as *u8, "T-WS-B\tE-GAME\tACTIVE\t0\tfix-mem-b.md\tknowledge/store/wsaudit_fix/code/fix-tracked.nx\t-" as *u8) 141 let n_orph2: i64 = ws_audit_orphans_p(WSAUDIT_PREFIX, FIX_MEM, orph, 256) 142 var t1: i64 = 0 143 if n_orph2 == 0 { t1 = 1 } 144 145 // ---- T3 NEG-CONTROL: untracked pass over the fixture code dir MUST catch fix-hidden.nx (real 146 // organ, no registry code_link). ---- 147 let n_untr: i64 = ws_audit_untracked_p(WSAUDIT_PREFIX, FIX_CODE, untr, 256) 148 var t3: i64 = 0 149 if n_untr >= 1 { if wag_in_list(untr, n_untr, "fix-hidden.nx" as *u8) == 1 { t3 = 1 } } 150 151 // ---- T4 no-false-positive: fix-tracked.nx IS a registry code_link -> MUST NOT be untracked. ---- 152 var t4: i64 = 0 153 if wag_in_list(untr, n_untr, "fix-tracked.nx" as *u8) == 0 { t4 = 1 } 154 155 // ---- T5 unregistered: the fixture queue's T-PROSE-ONLY is not in the registry -> caught; the 156 // registered T-WS-A is NOT flagged. ---- 157 let n_unreg: i64 = ws_audit_unregistered_p(WSAUDIT_PREFIX, FIX_QUEUE, unreg, 256) 158 var t5: i64 = 0 159 if n_unreg >= 1 { 160 if wag_in_list(unreg, n_unreg, "T-PROSE-ONLY" as *u8) == 1 { 161 if wag_in_list(unreg, n_unreg, "T-WS-A" as *u8) == 0 { t5 = 1 } 162 } 163 } 164 165 // ---- T6 PRODUCTION roll-up: against the LIVE ws- prefix + real memory/runtime/queue. Emit the 166 // three counts LOUDLY. GREEN-gate invariant = production ORPHANS == 0 (the lost-things invariant, 167 // basename-resolving code check). untracked/unregistered are informational (the detectors are 168 // proven by T2/T3/T5); they are NOT asserted to 0 on production. ---- 169 let p_orph: i64 = ws_audit_orphans_p(WS_PREFIX, WA_MEM_DIR, orph, 256) 170 let p_untr: i64 = ws_audit_untracked_p(WS_PREFIX, WA_CODE_DIR_B, untr, 256) 171 let p_unreg: i64 = ws_audit_unregistered_p(WS_PREFIX, WA_QUEUE, unreg, 256) 172 var t6: i64 = 0 173 if p_orph == 0 { t6 = 1 } 174 175 // flat pass-tally 176 var passes: i64 = 0 177 if t1 == 1 { passes = passes + 1 } 178 if t2 == 1 { passes = passes + 1 } 179 if t3 == 1 { passes = passes + 1 } 180 if t4 == 1 { passes = passes + 1 } 181 if t5 == 1 { passes = passes + 1 } 182 if t6 == 1 { passes = passes + 1 } 183 var ok: i64 = 0 184 if passes == 6 { ok = 1 } 185 186 wag_w(1, "WMS-R4 workstream-audit gate (boot-time completeness/crash audit)\n" as *u8) 187 wag_row(1, "T1 clean-store-no-orphan " as *u8, t1) 188 wag_row(1, "T2 orphan-caught " as *u8, t2) 189 wag_row(1, "T3 untracked-NEG-CONTROL " as *u8, t3) 190 wag_row(1, "T4 no-false-positive " as *u8, t4) 191 wag_row(1, "T5 unregistered-caught " as *u8, t5) 192 wag_row(1, "T6 production-roll-up " as *u8, t6) 193 wag_w(1, " production: orphans=" as *u8); wag_n(1, p_orph) 194 wag_w(1, " untracked=" as *u8); wag_n(1, p_untr) 195 wag_w(1, " unregistered=" as *u8); wag_n(1, p_unreg); wag_w(1, "\n" as *u8) 196 if ok == 1 { wag_w(1, "verdict=GREEN\n" as *u8) } else { wag_w(1, "verdict=RED\n" as *u8) } 197 198 let lf: i64 = sys_openat_append(WAG_LOG, 420) 199 if lf >= 0 { 200 wag_w(lf, "WMS-R4-GATE authored=organ ts=" as *u8); wag_n(lf, sys_now_realtime_sec()) 201 wag_w(lf, " T1=" as *u8); wag_n(lf, t1) 202 wag_w(lf, " T2=" as *u8); wag_n(lf, t2) 203 wag_w(lf, " T3=" as *u8); wag_n(lf, t3) 204 wag_w(lf, " T4=" as *u8); wag_n(lf, t4) 205 wag_w(lf, " T5=" as *u8); wag_n(lf, t5) 206 wag_w(lf, " T6=" as *u8); wag_n(lf, t6) 207 wag_w(lf, " prod{orphans=" as *u8); wag_n(lf, p_orph) 208 wag_w(lf, " untracked=" as *u8); wag_n(lf, p_untr) 209 wag_w(lf, " unregistered=" as *u8); wag_n(lf, p_unreg); wag_w(lf, "}" as *u8) 210 if ok == 1 { wag_w(lf, " verdict=GREEN\n" as *u8) } else { wag_w(lf, " verdict=RED\n" as *u8) } 211 sys_close(lf) 212 } 213 214 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 215 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 216 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 217 let ctr__dry: *i64 = gv_ctr() 218 ctr__dry[0] = ok 219 ctr__dry[1] = 1 220 let rc__dry: i64 = gv_verdict("WORKSTREAM-AUDIT-GATE" as *u8, ctr__dry, "teeth unchanged; verdict emission migrated onto the shared base class" as *u8) 221 sys_exit(rc__dry) 222 return rc__dry 223}