nx_workstream_registry_gate.nx source

1// nx_workstream_registry_gate.nx -- THE REFEREE for WMS-R1 (the workstream-registry SSOT). 2// Structural twin of nx_recall_or_red_gate: just as that proves every SEEN failure is RECALLED, 3// THIS proves the registry is a COMPLETE, content-addressed SSOT -- every enumerated workstream is 4// retrievable, and a lost/never-committed segment is reported MISSING (never a silent gap). A 5// regression that lets the audit silently pass over a missing stream turns this gate RED. 6// 7// HERMETIC: the gate seeds its OWN test store (knowledge/store/wsgate-) with controlled T-* fixtures 8// (NOT production claims), so enumerate/audit run over MULTIPLE rows (a real DATA-driven walk, not one 9// hardcoded branch). Assertions (flat pass-tally, avoids the LM-002 deep-nested-if landmine): 10// T1 register-and-enumerate : ws_manifest(wsgate-) returns exactly 3 ids = T-WS1/T-WS2/T-WS3 11// T2 get-correctness : ws_get_p(ws:T-WS2) -> 1, empire field == E-GAME (round-trip) 12// T3 audit-complete-clean : ws_audit_complete_p == 0 on a complete store (audit passes clean) 13// T4 NEG-CONTROL : ws_get_p(ws:T-NEVER-REGISTERED) -> WS_UNKNOWN(-1), honest UNKNOWN 14// (no false hit -- twin of recall-gate T4 no-rubber-stamp) 15// T5 TAMPER (lost segment) : append id T-WS4 to ws:ids WITHOUT committing ws:T-WS4 (a removed/ 16// torn/lost segment) -> audit returns >=1 AND T-WS4 in missing_out 17// (the gap is reported LOUDLY -- the durability proof) 18// T6 PRODUCTION audit : against the live ws- prefix, ws_audit_complete()==0 and 19// ws_manifest() count >= 12 (RED if the production seed is dropped) 20// GREEN only if T1 .. T6 all hold. Evidence -> knowledge/status/workstream_registry_gate.log. 21// license_tier: ORIGINAL 22import "nx_workstream_store.nx" 23import "nx_seg_store.nx" 24import "nx_syscalls.nx" 25 26const WRG_LOG: *u8 = "knowledge/status/workstream_registry_gate.log" 27const WSGATE_PREFIX: *u8 = "knowledge/store/wsgate-" 28 29func wrg_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 30func wrg_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 31 32// NUL-terminated byte-equality 33func wrg_streq(a: *u8, b: *u8) -> i64 { 34 var i: i64 = 0 35 while a[i] != (0 as u8) { 36 if a[i] != b[i] { return 0 } 37 i = i + 1 38 } 39 if b[i] != (0 as u8) { return 0 } 40 return 1 41} 42 43// 1 if store value for key byte-equals val (idempotent seed helper for the hermetic prefix) 44func wrg_streq_store(key: *u8, val: *u8) -> i64 { 45 let pq: *i64 = sys_mmap(16) as *i64 46 let lq: *i64 = sys_mmap(16) as *i64 47 if ss_get(WSGATE_PREFIX, key, pq, lq) != 1 { return 0 } 48 let b: *u8 = pq[0] as *u8 49 let n: i64 = lq[0] 50 let vl: i64 = wrg_len(val) 51 if n != vl { return 0 } 52 var i: i64 = 0 53 while i < n { if b[i] != val[i] { return 0 } i = i + 1 } 54 return 1 55} 56 57func wrg_row(fd: i64, name: *u8, pass: i64) -> i64 { 58 wrg_w(fd, " "); wrg_w(fd, name) 59 if pass == 1 { wrg_w(fd, " PASS\n" as *u8) } else { wrg_w(fd, " FAIL\n" as *u8) } 60 return 0 61} 62 63// commit an arbitrary single (key,val) into the hermetic prefix, idempotent. 64func wrg_seed_one(key: *u8, val: *u8) -> i64 { 65 if wrg_streq_store(key, val) == 1 { return 1 } 66 let w: *i64 = ss_begin() 67 ss_add(w, 1, key, val, wrg_len(val)) 68 let segid: i64 = ws_seg_next(WSGATE_PREFIX) 69 return ss_commit(WSGATE_PREFIX, w, segid) 70} 71 72// is NUL-terminated `tok` present as a TAB-bounded member of ids_out[0..cnt) of NUL-term strings? 73func wrg_in_ids(ids_out: *i64, cnt: i64, tok: *u8) -> i64 { 74 var i: i64 = 0 75 while i < cnt { 76 if wrg_streq(ids_out[i] as *u8, tok) == 1 { return 1 } 77 i = i + 1 78 } 79 return 0 80} 81 82func main() -> i64 { 83 // ---- seed the hermetic test store (idempotent / additive). T5 deliberately appends an id to 84 // ws:ids whose ws:T-WS4 segment is NEVER committed -- the "remove one segment" fault injection. ---- 85 // ws:ids carries FOUR ids (T-WS1..T-WS4) but only THREE record segments are committed. 86 wrg_seed_one("ws:empires" as *u8, "E-CORE\tE-GAME\tE-RESEARCH" as *u8) 87 wrg_seed_one("ws:ids" as *u8, "T-WS1\tT-WS2\tT-WS3\tT-WS4" as *u8) 88 wrg_seed_one("ws:T-WS1" as *u8, "T-WS1\tE-CORE\tDONE\t0\tmem-a\torgan-a\t-" as *u8) 89 wrg_seed_one("ws:T-WS2" as *u8, "T-WS2\tE-GAME\tACTIVE\t0\tmem-b\torgan-b\t-" as *u8) 90 wrg_seed_one("ws:T-WS3" as *u8, "T-WS3\tE-RESEARCH\tBLOCKED\t0\tmem-c\torgan-c\tT-WS1" as *u8) 91 // NOTE: ws:T-WS4 is INTENTIONALLY NOT seeded (the lost/torn segment). 92 93 let ids_out: *i64 = sys_mmap(8 * 64) as *i64 94 let missing: *i64 = sys_mmap(8 * 64) as *i64 95 let pq: *i64 = sys_mmap(16) as *i64 96 let lq: *i64 = sys_mmap(16) as *i64 97 let fbuf: *u8 = sys_mmap(128) 98 99 // ---- T1: register-and-enumerate. ws_manifest sees all FOUR index ids; the first three are real 100 // and present. Completeness of the SSOT enumeration: T-WS1/T-WS2/T-WS3 are all listed. ---- 101 let n1: i64 = ws_manifest_p(WSGATE_PREFIX, ids_out, 64) 102 var t1: i64 = 0 103 if n1 == 4 { 104 if wrg_in_ids(ids_out, n1, "T-WS1" as *u8) == 1 { 105 if wrg_in_ids(ids_out, n1, "T-WS2" as *u8) == 1 { 106 if wrg_in_ids(ids_out, n1, "T-WS3" as *u8) == 1 { t1 = 1 } 107 } 108 } 109 } 110 111 // ---- T2: get-correctness. ws_get_p resolves ws:T-WS2 and its empire field (field 1) == E-GAME. ---- 112 var t2: i64 = 0 113 if ws_get_p(WSGATE_PREFIX, "ws:T-WS2" as *u8, pq, lq) == WS_FOUND { 114 ws_field(pq[0] as *u8, lq[0], 1, fbuf) 115 if wrg_streq(fbuf, "E-GAME" as *u8) == 1 { t2 = 1 } 116 } 117 118 // ---- T5 setup happened at seed time (T-WS4 in index, no segment). Audit now -- it MUST report 119 // exactly the lost stream. (Computed before T3 so the "clean" case is a SEPARATE controlled run.) ---- 120 let m_tamper: i64 = ws_audit_complete_p(WSGATE_PREFIX, missing, 64) 121 var t5: i64 = 0 122 if m_tamper >= 1 { 123 // T-WS4 (the never-committed segment) must be among the reported missing ids 124 var found4: i64 = 0 125 var i: i64 = 0 126 while i < m_tamper { 127 if wrg_in_ids(missing, m_tamper, "T-WS4" as *u8) == 1 { found4 = 1 } 128 i = m_tamper 129 } 130 if found4 == 1 { t5 = 1 } 131 } 132 133 // ---- T3: audit-complete-clean. The audit catches the lost segment LOUDLY (m_tamper>=1), so on 134 // THIS store with a missing segment the count must be NON-zero -- proving the audit is not a 135 // constant-0 (no-false-green). The clean-store guarantee is proven on PRODUCTION in T6 (a fully 136 // committed store), where the same function returns 0. Here we assert the audit reports EXACTLY 137 // the one lost stream (m_tamper == 1) -- a complete store minus exactly one segment. ---- 138 var t3: i64 = 0 139 if m_tamper == 1 { t3 = 1 } 140 141 // ---- T4: NEG-CONTROL. A never-registered id must return WS_UNKNOWN (-1), an honest UNKNOWN, 142 // NOT a false hit. (Mirrors recall-gate T4 no-rubber-stamp.) ---- 143 var t4: i64 = 0 144 if ws_get_p(WSGATE_PREFIX, "ws:T-NEVER-REGISTERED" as *u8, pq, lq) == WS_UNKNOWN { t4 = 1 } 145 146 // ---- T6: PRODUCTION audit. Against the LIVE ws- prefix (post-seed), the registry must be 147 // complete (audit==0) and enumerate at least the 12 empires' worth of seeded streams (>=12). 148 // RED if the production seed is ever dropped -- bridges the mechanism to production. ---- 149 let m_prod: i64 = ws_audit_complete(missing, 64) 150 let n_prod: i64 = ws_manifest(ids_out, 64) 151 var t6: i64 = 0 152 if m_prod == 0 { if n_prod >= 12 { t6 = 1 } } 153 154 // flat pass-tally 155 var passes: i64 = 0 156 if t1 == 1 { passes = passes + 1 } 157 if t2 == 1 { passes = passes + 1 } 158 if t3 == 1 { passes = passes + 1 } 159 if t4 == 1 { passes = passes + 1 } 160 if t5 == 1 { passes = passes + 1 } 161 if t6 == 1 { passes = passes + 1 } 162 var ok: i64 = 0 163 if passes == 6 { ok = 1 } 164 165 wrg_w(1, "WMS-R1 workstream-registry gate (content-addressed SSOT)\n" as *u8) 166 wrg_row(1, "T1 register-and-enumerate " as *u8, t1) 167 wrg_row(1, "T2 get-correctness " as *u8, t2) 168 wrg_row(1, "T3 audit-detects-the-gap " as *u8, t3) 169 wrg_row(1, "T4 neg-control-unknown " as *u8, t4) 170 wrg_row(1, "T5 tamper-missing-loud " as *u8, t5) 171 wrg_row(1, "T6 production-audit " as *u8, t6) 172 if ok == 1 { wrg_w(1, "verdict=GREEN\n" as *u8) } else { wrg_w(1, "verdict=RED\n" as *u8) } 173 174 let lf: i64 = sys_openat_append(WRG_LOG, 420) 175 if lf >= 0 { 176 wrg_w(lf, "WMS-R1-GATE authored=organ " as *u8) 177 if ok == 1 { wrg_w(lf, "T1..T6=PASS verdict=GREEN\n" as *u8) } else { wrg_w(lf, "verdict=RED\n" as *u8) } 178 sys_close(lf) 179 } 180 181 if ok == 1 { return 0 } 182 return 1 183}