nx_ws_hygiene_gate.nx source
↩ module page · 104 lines · 6912 B
1// nx_ws_hygiene_gate.nx -- liar-killed GATE for the workstream-hygiene classifier (R-ORCH).
2// Proves it flags the exact anti-patterns the operator called out AND does NOT false-flag the
3// sanctioned sovereign path: the live example line (`wsl -e sh -c './_offc/nx_swcompare_research.elf
4// ... > /tmp/... 2>&1'`) is a VIOLATION; the sanctioned build launcher (nx_sov_build_run via wsl
5// --cd /mnt/c) is GREEN (the rule-27 exception -- the load-bearing negative control that keeps the
6// gate from banning the one allowed shell use); mcp/api lines are GREEN; TSV/plumbing/tmp caught.
7// MIGRATED 2026-09-02 onto nx_gate_verdict (D001): every tooth is a named gv_check, so /api/gate_run
8// reads the verdict from the exit code and harness.jrnl records a frame. Before this the gate printed a
9// hand-rolled `pass=N/20 verdict=` line and /api/promote correctly refused it. The teeth are unchanged;
10// the diagnostic line (got -> want) is printed BEFORE each tooth so a FAIL names the verdict it saw.
11// license_tier: ORIGINAL expect_exit: 0
12import "nx_syscalls.nx"
13import "nx_ws_hygiene_core.nx"
14import "nx_gate_verdict.nx" // brings the shared digit emitter too: importing nx_itoa_lib beside it defines ccz_cat_num twice
15
16func h_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
17
18func h_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
19
20// classify a NUL-terminated line; print what the classifier said, then the tooth.
21func h_check(desc: *u8, line: *u8, want: i64, ctr: *i64) -> i64 {
22 let got: i64 = hv_classify(line, h_slen(line))
23 h_puts(" " as *u8); h_puts(desc); h_puts(" -> " as *u8); h_puts(hv_name(got)); h_puts(" (want " as *u8); h_puts(hv_name(want)); h_puts(")\n" as *u8)
24 gv_check(desc, got == want, ctr)
25 return 0
26}
27
28// classify a tool NAME on the token-budget axis; print what the classifier said, then the tooth.
29func h_check_tool(desc: *u8, name: *u8, want: i64, ctr: *i64) -> i64 {
30 let got: i64 = hv_tool_verdict(name, h_slen(name))
31 h_puts(" " as *u8); h_puts(desc); h_puts(" -> " as *u8); h_puts(hv_name(got)); h_puts(" (want " as *u8); h_puts(hv_name(want)); h_puts(")\n" as *u8)
32 gv_check(desc, got == want, ctr)
33 return 0
34}
35
36func main(argc: i64, argv: *i64) -> i64 {
37 let ctr: *i64 = gv_ctr()
38 gv_head("nx_ws_hygiene_gate -- the workstream-hygiene classifier: the operator's anti-patterns flagged, the sanctioned lanes GREEN, driven directly" as *u8)
39
40 // THE live example the operator pasted -> SHELL-EXEC-ORGAN violation
41 h_check("live-swcompare-shchain-is-SHELL-EXEC" as *u8,
42 "wsl -d Ubuntu --cd /mnt/c/Users/elder/nishi-core/nxc2 -e sh -c './_offc/nx_swcompare_research.elf knowledge/compare/swarm.q > /tmp/sw_research.out 2>&1'" as *u8,
43 HV_SHELL_EXEC, ctr)
44
45 // load-bearing NEG-CONTROL: the sanctioned build launcher (rule-27 exception) -> GREEN, NOT flagged
46 h_check("neg-control-sanctioned-build-lane-is-SOV-BUILD-not-a-violation" as *u8,
47 "wsl -d Ubuntu --cd /mnt/c/Users/elder/nishi-core/nxc2 -e ./_offc/nx_sov_build_run.elf nx_ws_hygiene_gate" as *u8,
48 HV_SOV_BUILD, ctr)
49
50 // nx_ship / nx_content_ship also sanctioned
51 h_check("neg-control-sanctioned-ship-is-SOV-BUILD" as *u8,
52 "_offc/nx_ship.elf nx_tool_argecho /tmp/tok /tmp/shipsrc" as *u8,
53 HV_SOV_BUILD, ctr)
54
55 // sovereign API/MCP paths -> GREEN (an mcp/api build call is SOV-API, distinct from the shell
56 // build-lane launcher above -- both GREEN, neither a violation)
57 h_check("mcp-tool-line-is-SOV-API" as *u8, "mcp__nishi__nx_mgmt POST /api/build target=x" as *u8, HV_SOV_API, ctr)
58 h_check("api-route-line-is-SOV-API" as *u8, "POST /api/route host=nishifamily.com prefix=/media" as *u8, HV_SOV_API, ctr)
59
60 // bare sh -c glue (no organ) -> SHELL-CHAIN
61 h_check("bare-shchain-is-SHELL-CHAIN" as *u8, "sh -c 'echo hi && cat foo'" as *u8, HV_SHELL_CHAIN, ctr)
62
63 // TSV write -> TSV-FORMAT
64 h_check("tsv-write-is-TSV" as *u8, "write knowledge/compare/swarm_results.tsv" as *u8, HV_TSV, ctr)
65
66 // raw plumbing -> PLUMBING
67 h_check("scp-line-is-PLUMBING" as *u8, "scp build.elf elderwesto@192.168.8.227:/tmp/" as *u8, HV_PLUMBING, ctr)
68 h_check("curl-line-is-PLUMBING" as *u8, "curl -s https://nishifamily.com/api/health" as *u8, HV_PLUMBING, ctr)
69
70 // tmp redirect on a plain command -> TMP-REDIRECT
71 h_check("tmp-redirect-is-TMP-REDIRECT" as *u8, "cat foo > /tmp/scratch.out" as *u8, HV_TMP_REDIRECT, ctr)
72
73 // bare /mnt/c outside build lane -> WSL-PATH
74 h_check("bare-wsl-path-is-WSL-PATH" as *u8, "read /mnt/c/Users/elder/data/x" as *u8, HV_WSL_PATH, ctr)
75
76 // NEUTRAL: an ordinary sovereign edit/read (no shell, no tsv) -> not flagged, not GREEN-marked
77 h_check("neg-control-neutral-edit-is-NONE" as *u8, "Edit runtime/nx_foo.nx add function" as *u8, HV_NONE, ctr)
78
79 // git-the-VCS is the operator's ACCEPTED "git or beyond" -> ACCEPTED-VCS, NOT a violation (round-3
80 // self-correction: my enforcer had over-flagged the accepted tool at rm-severity)
81 h_check("neg-control-git-commit-is-ACCEPTED-VCS" as *u8, "cd nishi-core && git add x && git commit -m msg" as *u8, HV_ACCEPTED_VCS, ctr)
82 // the ACTUAL sin (rm plumbing / lock-reaping) STILL trips
83 h_check("lock-reap-rm-is-SHELL-UTIL" as *u8, "rm -f .git/index.lock" as *u8, HV_SHELL_UTIL, ctr)
84 // and a MIXED pipeline still trips (rm checked before git, so the sin can't hide behind a commit)
85 h_check("pipeline-rm-plus-git-still-trips-SHELL-UTIL" as *u8, "cd r && rm -f .git/index.lock && git commit -m x" as *u8, HV_SHELL_UTIL, ctr)
86
87 // token-burn tool axis (hv_tool_verdict on a tool NAME) -> flag the expensive one-offs, GREEN the MCP
88 h_check_tool("webfetch-tool-is-TOKEN-BURN" as *u8, "WebFetch" as *u8, HV_TOKEN_BURN, ctr)
89 h_check_tool("workflow-tool-is-TOKEN-BURN" as *u8, "Workflow" as *u8, HV_TOKEN_BURN, ctr)
90 h_check_tool("agent-tool-is-TOKEN-BURN" as *u8, "Agent" as *u8, HV_TOKEN_BURN, ctr)
91 h_check_tool("neg-control-nishi-mcp-tool-is-SOV-API" as *u8, "mcp__nishi__nishi_search" as *u8, HV_SOV_API, ctr)
92
93 // is_violation predicate: SHELL-EXEC + SHELL-UTIL + TOKEN-BURN are violations, SOV-BUILD is not
94 var okpred: i64 = 1
95 if hv_is_violation(HV_SHELL_EXEC) != 1 { okpred = 0 }
96 if hv_is_violation(HV_SHELL_UTIL) != 1 { okpred = 0 }
97 if hv_is_violation(HV_TOKEN_BURN) != 1 { okpred = 0 }
98 if hv_is_violation(HV_SOV_BUILD) != 0 { okpred = 0 }
99 if hv_is_violation(HV_ACCEPTED_VCS) != 0 { okpred = 0 }
100 if hv_is_violation(HV_NONE) != 0 { okpred = 0 }
101 gv_check("is-violation-predicate-flags-exec-util-tokenburn-and-clears-build-vcs-none" as *u8, okpred == 1, ctr)
102
103 return gv_verdict("nx_ws_hygiene_gate" as *u8, ctr, "the workstream-hygiene classifier flags the operator's anti-patterns and clears the sanctioned lanes" as *u8)
104}