Nishi Family › Compare › Code Health and Janitor

Nishi Compare · capabilities, evidence and delivery

Code Health and Janitor

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

Nishi vs SonarQube and Semgrep and Knip and Renovate

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. The janitor is a running code-health system with properties the field does not ship: additive-only never-brick cleaning with no delete syscall anywhere in the fleet (exceed), a sovereign zero-dependency fleet on our own substrate (exceed), a whole-tree debt walker (genuine debt 544, purity 892 permil), a unified scorecard, shadow-name and dead-artifact detection, byte-verified migration, reversible retirement, multi-axis locked ratchets, a scratch meter, a freshness caretaker, caller analysis before rename, conductor-governed runs, and -- corrected today -- a gate-proven secrets scanner. Behind the field on breadth: dependency-update automation, SBOM and license, taint rules, multi-language lint, CI and PR and IDE surfaces, auto-fix, a web dashboard, and LLM-assisted repair.

Where we need to go. The security ring first (SBOM and license from the headers we already tag, taint rules over the genealogist's dataflow engine), then the surfaces (a dashboard that is the scorecard, PR and IDE doors, auto-fix that patches CODE with the same byte-verified reversibility the scrub gives DATA), then update automation and LLM-assisted repair verified by the forge's judge.

The unit. 1 u = one measured session-leg (estate calibration: graphics R21 in one leg 2026-08-15). Local evidence: the scorecard gate 5/5 and the retire organ gate 5/5 each landed in one leg; estimates are relative to those.

Where we are: 9 open rungs. Cleaning and ratchet culture ahead; security breadth and integration surfaces behind. Counts measured at emit below this line.

Cost to the security ring: 3.5 u. JN3 SBOM and license from the license_tier headers, JN4 taint rules over the genealogist's query engine.

Cost to surfaces: 3.5 u. JN9 the dashboard page emitted from the scorecard, JN6 the PR door, JN7 the IDE diagnostics push.

Cost to automation and repair: 7 u. JN2 dependency-update proposals, JN5 multi-language lint, JN8 reversible auto-fix, JN10 LLM-assisted refactor under the judge.

Research bar. SonarQube 26.7 is measured on quality gates, taint analysis, dashboard, IDE (SonarLint). Theirs: the platform bar. Ours: JN4 JN7 JN9 measured on this page.

Research bar. Semgrep 1.169 is measured on rule engine, taint mode, autofix, 30-plus languages. Theirs: the rule-engine bar. Ours: JN4 JN5 JN8.

Research bar. Renovate 43.257 is measured on scheduled dependency-update PRs. Theirs: the update-automation bar. Ours: JN2 JN6.

Research bar. Knip 6.25 is measured on dead-export detection with fix. Theirs: the dead-code bar. Ours: already matched on detection; JN8 adds the fix, reversibly.

Latest recorded release

No valid dated release entry is recorded for this domain.

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

15 of 26 capability source symbols found|2 of them authored stronger-claims|11 open|coverage 576/1000|adoption 8 full / 7 partial

Evidence profile — what the gaps on this board actually are

Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.

proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.

partition: grounded + unsupported = 15 vs present 15 · named + unnamed + withheld = 11 vs open 11 · both reconcile

liar-kill conj=GPQN · all four conjuncts held

graded document: BUILDROOT tree, 9842 bytes · gates map: PRIMARY · stamped 0d 16h ago · source ../knowledge/status/evstamp_janitor.verdict

Gap class	What it is, and the work it names
VACUOUS-GATE	A gate reported GREEN on a ZERO denominator. A gate with real teeth and a broken counter, and a gate with no teeth at all, are indistinguishable from outside; that indistinguishability is the finding, so it is reported here and never convicted.

This band reports the referee counts. The per-axis worklist rows — which axis is unsupported, which watch is ready to flip, which gap is unnamed — are printed by nx_swcompare_evidence janitor itself and are not carried on the stamp, so this page names the classes and the producer names the rows. That split is stated rather than hidden: a count without a worklist is not actionable, and this band is honest about which half of that it is.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: PLAN_MATRIX_BOUND_ONLY. Recorded priorities require current acceptance evidence and resource checks before execution.

Ranking matches the captured plan and matrix only. Latest execution outcome, research freshness, accepted delivery and investment return are unverified.

Recorded priority estimates

Order from nx_compare_rank (nx_dr_ocm: (deficit + cost-of-delay + option + enables) x sponsor x self-sufficiency x momentum / cost). FINISH rows are rungs whose symbol is present but whose organ is short of full adoption: listed before new work by this heuristic. Priority is not measured delivery cost or execution readiness. Stamp: # asof=1790081814 domain=janitor target_version=0.1 rungs=15 done=4 open=11 finish=3 ranker=nx_dr_ocm

#	Stage	Rung	Priority	Derivation
F	FINISH	Whole-tree debt walker (JR0) func sav_class_of dossier	SOURCE-ONLY	source exists, never compiled: /api/build it
F	FINISH	Locked multi-axis ratchet (JR1) func spr_check_all dossier	LIB-GATE-ONLY importers=1	imported only by validation organs (gates, tests, benches): wire it into a shipping program
F	FINISH	Secrets scanner (JR3) func main(argc dossier	REGISTERED-DARK	callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_secret_scan_gate -- a mention, not a run
#1	0.1	Security taint rules (JN4) tn_taint_rule dossier	200	v=2 m=2 c=20
#2	0.1	SBOM and license compliance (JN3) sbom_emit dossier	0	v=0 m=2 c=15
#3	later	CI and PR door (JN6) ci_pr_comment dossier	1200	v=6 m=2 c=10
#4	later	Web dashboard (JN9) hdj_emit_page dossier	1000	v=5 m=2 c=10
#5	later	Reversible auto-fix (JN8) afx_apply_fix dossier	1000	v=10 m=2 c=20
#6	later	Auto-fix must add information, not just a name (JN11) mg_name_adds_information dossier	1000	v=10 m=1 c=10
#7	later	Multi-language lint (JN5) mll_lint_lang dossier	400	v=3 m=2 c=15
#8	later	A fixer never edits a comment (JN12) mg_comment_untouched dossier	400	v=2 m=1 c=5
#9	later	Dependency-update automation (JN2) du_propose_update dossier	266	v=2 m=2 c=15
#10	later	IDE diagnostics push (JN7) idl_diag_push dossier	200	v=3 m=1 c=15
#11	later	LLM-assisted refactor (JN10) llr_propose_refactor dossier	0	v=0 m=1 c=20

Declared roadmap — contract, acceptance, executor, effort

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Whole-tree debt walker (JR0)	func sav_class_of	89,742 files walked, KILL MIGRATE REVIEW classes -- LANDED	Organ	0 u
Locked multi-axis ratchet (JR1) after JR0	func spr_check_all	Debt, collisions, scratch ratchet down and lock -- LANDED	Organ	0 u
Reversible no-delete retirement (JR2)	func jan_retire_dest	Store-verified renameat to _retired, unretire proves reversal -- LANDED gated 5/5	Organ	0 u
Secrets scanner (JR3)	func main(argc	nx_secret_scan, KAT 5 of 5 plus production sweep GREEN -- LANDED (row corrected 2026-08-19)	Organ	0 u
SBOM and license compliance (JN3) after JR0	sbom_emit	A bill of materials for any organ closure from the license_tier headers and the import graph, with a license-policy check read as data; gate proves a closure containing a disallowed tier is refused with the organ named and our own stack lists zero third-party deps	Organ	1.5 u
Security taint rules (JN4) after JR0	tn_taint_rule	Vulnerability-pattern rules (source to sink) evaluated over the genealogist's dataflow engine (the cq_dataflow_query contract on /compare/genealogy); gate proves a planted unsanitized argv-to-exec path fires and the sanitized twin does not	Organ	2 u
Web dashboard (JN9) after JR1	hdj_emit_page	The scorecard emitted as a page behind the operator login: debt, collisions, scratch, ratchet floors, each number linking to its detector's log; gate proves the page numbers equal the scorecard's and a missing zone reads -1 not 0	Organ	1 u
CI and PR door (JN6) after JR1	ci_pr_comment	The ratchet verdict posted as a comment on a sovereign-git change with the offending rows named; gate proves a change that raises debt gets a RED comment and a clean change gets GREEN	Organ	1 u
IDE diagnostics push (JN7) after JN9	idl_diag_push	Scorecard and lint findings pushed as diagnostics through the lang lane's LSP door (lsp_serve) so they appear in-editor; gate proves a shadow-collision finding appears at the right file:line	Organ	1.5 u
Dependency-update automation (JN2) after JR0	du_propose_update	Proposed updates for organ-version staleness (the staleness caretaker already measures it) as reviewable change sets, never auto-applied; gate proves a stale organ yields one proposal and a current tree yields none	Organ	1.5 u
Multi-language lint (JN5) after JR0	mll_lint_lang	Real lint for at least one foreign file class beyond extension-level classification (sharing the genealogist's ml_parse_lang grammar table); gate proves a planted JS lint failure is found	Organ	1.5 u
Reversible auto-fix (JN8) after JR2	afx_apply_fix	Patches CODE for the mechanical classes (dead import, shadow rename) with the same law as the scrub: original banked, byte-verified, unretire-style reversal; gate proves apply then reverse returns byte-identical source and a fix that fails to build is auto-reversed	Organ	2 u
LLM-assisted refactor (JN10) after JN8	llr_propose_refactor	The sovereign model proposes a refactor for a scorecard finding, VERIFIED by the forge's byte-exact judge and applied only through JN8's reversible path; gate proves a proposal the judge rejects is never applied	Organ	2 u
Auto-fix must add information, not just a name (JN11)	mg_name_adds_information	An accept rule on the hoist itself: a proposed const name must carry information the value does not, and the fixer refuses and NAMES the site when it cannot derive one. Two of the survivors in nx_sdfrender show what the value-name destroyed -- PARTS_MAGIC_4096 is really the it_sin4096 fixed-point unit and PARTS_MAGIC_8192 is a positive-coordinate bias applied before sk_hash to dodge negative-division asymmetry. Those want purpose-names; deciding what each survivor is FOR is author work and must not be guessed by the tool. Ordered before JN12 because it is the rule that stops the inflow.	Organ	1 u
A fixer never edits a comment (JN12) after JN11	mg_comment_untouched	A tooth asserting no byte inside a comment is modified by any fixer path, bite-proven on the three witnessed corruptions (a date, a derivation, and a documented byte range in crypto). Cheap, mechanical, and it closes the class rather than the instances. Note the corrupted sites are NOT repaired by this rung -- it stops new ones; the existing 11-plus files need author review because only the author knows what the prose said before.	Organ	0.5 u

Milestones

Milestone	Rungs	Cumulative
M1 · Security ring	JN3,JN4	3.5 u
M2 · Surfaces	JN9,JN6,JN7	7 u
M3 · Automation and repair	JN2,JN5,JN8,JN10	14 u

Ladder verdict. NOT DECLARED. This board names no dated best-in-class or frontier target and no rung roles (sotatarget and rungrole rows on its plan); the ranker labels it NO-LADDER until it does, and until then its rungs climb toward a target nobody has written down. Bars read NO-BAR against the current month 2026-10.

Bar freshness, counted
Class	Count	Note
bars	0	sotabar rows on the plan
fresh	0	the bar month is the current month
attested	0	an older bar with a this-month barscan reporting no newer entry
stale	0	a this-month scan saw a newer month the bar ignores
unattested	0	nobody looked this month
malformed	0	a sotabar row missing a field
duplicate	0	bar ids an earlier row already carries
bars, summed	0	RECONCILED: the parts sum to the total 0
current month	2026-10	the month every bar is judged against

Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Inspect a rung and its prerequisites

Declared nodes 15. Rank input binding: PLAN_MATRIX_BOUND_ONLY. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 25a4a179e70442ca8942ef49db73da21b446a7a3b5e03bee9cf55d9a6436166e. Target rows 0; role rows 0. Existing risks and release worklog retain their own scope; no node completion is inferred.

Runtime observation coverage: 0 of 15 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

JR0 — Whole-tree debt walker
Prerequisites: None declared; this does not establish execution eligibility.
Contract: func sav_class_of
Acceptance: 89,742 files walked, KILL MIGRATE REVIEW classes -- LANDED
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
JR1 — Locked multi-axis ratchet
Prerequisites: JR0 (acceptance unverified)
Contract: func spr_check_all
Acceptance: Debt, collisions, scratch ratchet down and lock -- LANDED
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
JR2 — Reversible no-delete retirement
Prerequisites: None declared; this does not establish execution eligibility.
Contract: func jan_retire_dest
Acceptance: Store-verified renameat to _retired, unretire proves reversal -- LANDED gated 5/5
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
JR3 — Secrets scanner
Prerequisites: None declared; this does not establish execution eligibility.
Contract: func main(argc
Acceptance: nx_secret_scan, KAT 5 of 5 plus production sweep GREEN -- LANDED (row corrected 2026-08-19)
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
JN3 — SBOM and license compliance
Prerequisites: JR0 (acceptance unverified)
Contract: sbom_emit
Acceptance: A bill of materials for any organ closure from the license_tier headers and the import graph, with a license-policy check read as data; gate proves a closure containing a disallowed tier is refused with the organ named and our own stack lists zero third-party deps
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
JN4 — Security taint rules
Prerequisites: JR0 (acceptance unverified)
Contract: tn_taint_rule
Acceptance: Vulnerability-pattern rules (source to sink) evaluated over the genealogist's dataflow engine (the cq_dataflow_query contract on /compare/genealogy); gate proves a planted unsanitized argv-to-exec path fires and the sanitized twin does not
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
JN9 — Web dashboard
Prerequisites: JR1 (acceptance unverified)
Contract: hdj_emit_page
Acceptance: The scorecard emitted as a page behind the operator login: debt, collisions, scratch, ratchet floors, each number linking to its detector's log; gate proves the page numbers equal the scorecard's and a missing zone reads -1 not 0
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
JN6 — CI and PR door
Prerequisites: JR1 (acceptance unverified)
Contract: ci_pr_comment
Acceptance: The ratchet verdict posted as a comment on a sovereign-git change with the offending rows named; gate proves a change that raises debt gets a RED comment and a clean change gets GREEN
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
JN7 — IDE diagnostics push
Prerequisites: JN9 (acceptance unverified)
Contract: idl_diag_push
Acceptance: Scorecard and lint findings pushed as diagnostics through the lang lane's LSP door (lsp_serve) so they appear in-editor; gate proves a shadow-collision finding appears at the right file:line
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
JN2 — Dependency-update automation
Prerequisites: JR0 (acceptance unverified)
Contract: du_propose_update
Acceptance: Proposed updates for organ-version staleness (the staleness caretaker already measures it) as reviewable change sets, never auto-applied; gate proves a stale organ yields one proposal and a current tree yields none
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
JN5 — Multi-language lint
Prerequisites: JR0 (acceptance unverified)
Contract: mll_lint_lang
Acceptance: Real lint for at least one foreign file class beyond extension-level classification (sharing the genealogist's ml_parse_lang grammar table); gate proves a planted JS lint failure is found
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
JN8 — Reversible auto-fix
Prerequisites: JR2 (acceptance unverified)
Contract: afx_apply_fix
Acceptance: Patches CODE for the mechanical classes (dead import, shadow rename) with the same law as the scrub: original banked, byte-verified, unretire-style reversal; gate proves apply then reverse returns byte-identical source and a fix that fails to build is auto-reversed
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
JN10 — LLM-assisted refactor
Prerequisites: JN8 (acceptance unverified)
Contract: llr_propose_refactor
Acceptance: The sovereign model proposes a refactor for a scorecard finding, VERIFIED by the forge's byte-exact judge and applied only through JN8's reversible path; gate proves a proposal the judge rejects is never applied
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
JN11 — Auto-fix must add information, not just a name
Prerequisites: None declared; this does not establish execution eligibility.
Contract: mg_name_adds_information
Acceptance: An accept rule on the hoist itself: a proposed const name must carry information the value does not, and the fixer refuses and NAMES the site when it cannot derive one. Two of the survivors in nx_sdfrender show what the value-name destroyed -- PARTS_MAGIC_4096 is really the it_sin4096 fixed-point unit and PARTS_MAGIC_8192 is a positive-coordinate bias applied before sk_hash to dodge negative-division asymmetry. Those want purpose-names; deciding what each survivor is FOR is author work and must not be guessed by the tool. Ordered before JN12 because it is the rule that stops the inflow.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
JN12 — A fixer never edits a comment
Prerequisites: JN11 (acceptance unverified)
Contract: mg_comment_untouched
Acceptance: A tooth asserting no byte inside a comment is modified by any fixer path, bite-proven on the three witnessed corruptions (a date, a derivation, and a documented byte range in crypto). Cheap, mechanical, and it closes the class rather than the instances. Note the corrupted sites are NOT repaired by this rung -- it stops new ones; the existing 11-plus files need author review because only the author knows what the prose said before.
Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.

Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence janitor writes it beside its stamp); every gate below reads UNRECORDED until it runs.

Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.

JR0 Whole-tree debt walker · cell PRESENT · gate NO-GATE-DECLARED

Contract	`func sav_class_of` · executor Organ · 0 u · stands on nothing
Definition of done	89,742 files walked, KILL MIGRATE REVIEW classes -- LANDED
Matrix cell	Whole-tree debt walker with 3-way debt classification · `runtime/nx_sovereignty_audit.nx` · PRESENT decl Sovereign zero-dependency fleet on own substrate · `runtime/nx_sovereignty_audit.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_sovereignty_audit`; declare `nx_sovereignty_audit TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

JR1 Locked multi-axis ratchet · cell PRESENT · gate NO-GATE-DECLARED

Contract	`func spr_check_all` · executor Organ · 0 u · stands on JR0
Definition of done	Debt, collisions, scratch ratchet down and lock -- LANDED
Matrix cell	Multi-axis ratchet with locked floors · `runtime/_hdl_build/nx_sprawl_ratchet.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_sprawl_ratchet`; declare `nx_sprawl_ratchet TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

JR2 Reversible no-delete retirement · cell PRESENT · gate NO-GATE-DECLARED

Contract	`func jan_retire_dest` · executor Organ · 0 u · stands on nothing
Definition of done	Store-verified renameat to _retired, unretire proves reversal -- LANDED gated 5/5
Matrix cell	Reversible no-delete retirement · `runtime/_hdl_build/nx_janitor_retire.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_janitor_retire`; declare `nx_janitor_retire TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

JR3 Secrets scanner · cell PRESENT · gate NO-GATE-DECLARED

Contract	`func main(argc` · executor Organ · 0 u · stands on nothing
Definition of done	nx_secret_scan, KAT 5 of 5 plus production sweep GREEN -- LANDED (row corrected 2026-08-19)
Matrix cell	Secrets and credential scanning · `runtime/_hdl_build/nx_secret_scan.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_secret_scan`; declare `nx_secret_scan TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

JN3 SBOM and license compliance · cell WATCHING · gate NO-GATE-DECLARED

Contract	`sbom_emit` · executor Organ · 1.5 u · stands on JR0
Definition of done	A bill of materials for any organ closure from the license_tier headers and the import graph, with a license-policy check read as data; gate proves a closure containing a disallowed tier is refused with the organ named and our own stack lists zero third-party deps
Matrix cell	SBOM and license compliance · `runtime/nx_sbom.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_sbom`; declare `nx_sbom TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

JN4 Security taint rules · cell WATCHING · gate NO-GATE-DECLARED

Contract	`tn_taint_rule` · executor Organ · 2 u · stands on JR0
Definition of done	Vulnerability-pattern rules (source to sink) evaluated over the genealogist's dataflow engine (the cq_dataflow_query contract on /compare/genealogy); gate proves a planted unsanitized argv-to-exec path fires and the sanitized twin does not
Matrix cell	Security taint-analysis rules · `runtime/nx_taint.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_taint`; declare `nx_taint TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

JN9 Web dashboard · cell WATCHING · gate NO-GATE-DECLARED

Contract	`hdj_emit_page` · executor Organ · 1 u · stands on JR1
Definition of done	The scorecard emitted as a page behind the operator login: debt, collisions, scratch, ratchet floors, each number linking to its detector's log; gate proves the page numbers equal the scorecard's and a missing zone reads -1 not 0
Matrix cell	Web dashboard UI · `runtime/nx_health_dashboard_jan.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_health_dashboard_jan`; declare `nx_health_dashboard_jan TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

JN6 CI and PR door · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ci_pr_comment` · executor Organ · 1 u · stands on JR1
Definition of done	The ratchet verdict posted as a comment on a sovereign-git change with the offending rows named; gate proves a change that raises debt gets a RED comment and a clean change gets GREEN
Matrix cell	CI and PR integration · `runtime/nx_ci_hook.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ci_hook`; declare `nx_ci_hook TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

JN7 IDE diagnostics push · cell WATCHING · gate NO-GATE-DECLARED

Contract	`idl_diag_push` · executor Organ · 1.5 u · stands on JN9
Definition of done	Scorecard and lint findings pushed as diagnostics through the lang lane's LSP door (lsp_serve) so they appear in-editor; gate proves a shadow-collision finding appears at the right file:line
Matrix cell	IDE integration · `runtime/nx_ide_lint.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ide_lint`; declare `nx_ide_lint TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

JN2 Dependency-update automation · cell WATCHING · gate NO-GATE-DECLARED

Contract	`du_propose_update` · executor Organ · 1.5 u · stands on JR0
Definition of done	Proposed updates for organ-version staleness (the staleness caretaker already measures it) as reviewable change sets, never auto-applied; gate proves a stale organ yields one proposal and a current tree yields none
Matrix cell	Dependency update automation · `runtime/nx_dep_update.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_dep_update`; declare `nx_dep_update TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

JN5 Multi-language lint · cell WATCHING · gate NO-GATE-DECLARED

Contract	`mll_lint_lang` · executor Organ · 1.5 u · stands on JR0
Definition of done	Real lint for at least one foreign file class beyond extension-level classification (sharing the genealogist's ml_parse_lang grammar table); gate proves a planted JS lint failure is found
Matrix cell	Multi-language analysis · `runtime/nx_multilang_lint.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_multilang_lint`; declare `nx_multilang_lint TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

JN8 Reversible auto-fix · cell WATCHING · gate NO-GATE-DECLARED

Contract	`afx_apply_fix` · executor Organ · 2 u · stands on JR2
Definition of done	Patches CODE for the mechanical classes (dead import, shadow rename) with the same law as the scrub: original banked, byte-verified, unretire-style reversal; gate proves apply then reverse returns byte-identical source and a fix that fails to build is auto-reversed
Matrix cell	Automated fix generation · `runtime/nx_autofix.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_autofix`; declare `nx_autofix TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

JN10 LLM-assisted refactor · cell WATCHING · gate NO-GATE-DECLARED

Contract	`llr_propose_refactor` · executor Organ · 2 u · stands on JN8
Definition of done	The sovereign model proposes a refactor for a scorecard finding, VERIFIED by the forge's byte-exact judge and applied only through JN8's reversible path; gate proves a proposal the judge rejects is never applied
Matrix cell	LLM-assisted repair and refactoring · `runtime/nx_llm_refactor.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_llm_refactor`; declare `nx_llm_refactor TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

JN11 Auto-fix must add information, not just a name · cell WATCHING · gate NO-GATE-DECLARED

Contract	`mg_name_adds_information` · executor Organ · 1 u · stands on nothing
Definition of done	An accept rule on the hoist itself: a proposed const name must carry information the value does not, and the fixer refuses and NAMES the site when it cannot derive one. Two of the survivors in nx_sdfrender show what the value-name destroyed -- PARTS_MAGIC_4096 is really the it_sin4096 fixed-point unit and PARTS_MAGIC_8192 is a positive-coordinate bias applied before sk_hash to dodge negative-division asymmetry. Those want purpose-names; deciding what each survivor is FOR is author work and must not be guessed by the tool. Ordered before JN12 because it is the rule that stops the inflow.
Matrix cell	HYGIENE: an auto-fixer may not satisfy a ratchet with an uninformative name · `runtime/nx_magic.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_magic`; declare `nx_magic TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

JN12 A fixer never edits a comment · cell WATCHING · gate NO-GATE-DECLARED

Contract	`mg_comment_untouched` · executor Organ · 0.5 u · stands on JN11
Definition of done	A tooth asserting no byte inside a comment is modified by any fixer path, bite-proven on the three witnessed corruptions (a date, a derivation, and a documented byte range in crypto). Cheap, mechanical, and it closes the class rather than the instances. Note the corrupted sites are NOT repaired by this rung -- it stops new ones; the existing 11-plus files need author review because only the author knows what the prose said before.
Matrix cell	HYGIENE: a code fixer may never rewrite prose · `runtime/nx_magic.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_magic`; declare `nx_magic TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

dossiers=15 cells_joined=15 no_matrix_row=0 (sum 15) gates_recorded=0 gates_unrecorded=0 no_gate_declared=15 (sum 15 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

Rows. 26 feature rows mapped of 26 matrix rows; 0 substrate rows (kernels, bounds and instruments the plan's rungrole marks substrate) are the estate's scaffolding, not category features, and stay off the map

Views. 2D cut: centrality, distinctiveness · 3D cube: centrality, distinctiveness, breadth · axes registered: centrality, distinctiveness, breadth, depth, momentum · a board picks its own in knowledge/compare/janitor.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaults

bubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 300–1000, distinctiveness 100–600 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 0 (a fact of the data: two players that close are that close) · data spread 722 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)

axes fitted: centrality 300–1000 · distinctiveness 100–600 · breadth 100–600 permil · farther bubbles are painted first, nearer ones over them · the floor shadow is each bubble's (x, y) at height 0
readability of the 3D cube, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 0 (a fact of the data: two players that close are that close) · data spread 258 permil of the plot

Nishi SonarQube Semgrep Knip Renovate
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 0 (a fact of the data: two players that close are that close) · data spread 572 permil of the plot

Player	Quadrant	centrality	distinctiveness	breadth	depth	momentum	Rows held	Days on spine	First seen
Nishi	Unconventional	567	538	410	711	0 since 2026-09-23	15	10	2026-09-15
SonarQube	Aspirational	910	392	487	603	0 since 2026-09-23	21	10	2026-09-15
Semgrep	Mainstream	686	277	294	511	0 since 2026-09-23	15	10	2026-09-15
Knip	Peripheral	462	177	141	458	0 since 2026-09-23	8	10	2026-09-15
Renovate	Unconventional	402	427	205	666	0 since 2026-09-23	8	10	2026-09-15

Day	Matrix rows reviewed	Players recorded
2026-09-15	26	5
2026-09-16	26	5
2026-09-17	26	5
2026-09-18	26	5
2026-09-19	26	5
2026-09-20	26	5
2026-09-21	26	5
2026-09-22	26	5
2026-09-23	26	5
2026-10-08	26	5

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 104, unassessed 0. Authored assessments are not verified outcomes.

Capability	Nishi	SonarQube	Semgrep	Knip	Renovate
Whole-tree debt walker with 3-way debt classification Measured: `func sav_class_of` exists in `runtime/nx_sovereignty_audit.nx`, verified at emit. LIVE 2026-07-10: 89742 files walked, genuine_debt=544 verdict GREEN, purity 892 permil (was 7071 on 2026-06-23); classes KILL, MIGRATE, REVIEW [cunningham92]; SonarQube is the platform bar for debt dashboards [sonarqube-qgates] Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. dossiernot adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Knip, RenovateCons behind SonarQube (leads); not adopted yet: source exists, never compiled: /api/build it	●	◉	●	◐	○
Unified cleanliness scorecard (debt + collisions + scratch) Measured: `func ssc_debt` exists in `runtime/_hdl_build/nx_sovereignty_scorecard.nx`, verified at emit. LIVE 2026-07-10 gate 5/5: debt=544, shadow_collisions=19, scratch=627 -- one observable, each axis grounded in its own detector rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Semgrep, Knip, Renovate; fully adopted on the estate ladderCons behind SonarQube (leads)	●	◉	○	○	○
Duplicate and shadow-name detection Measured: `func jdn_scan` exists in `runtime/_hdl_build/nx_janitor_dupname.nx`, verified at emit. LIVE: 19 shadow collisions (organs that run the WRONG code by name); June resolutions took 22 to 14, five NEW ones crept in since -- the creep the ratchet exists to catch; SonarQube CPD finds copy-paste, not name-shadowing rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=12 nonval=6` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of SonarQube, Semgrep, Knip, Renovate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	◐	○	◐	○
Dead and orphan artifact detection Measured: `func js_referenced` exists in `runtime/_hdl_build/nx_janitor_sprawl.nx`, verified at emit. Registry artifacts referenced by ZERO organs get flagged for reversible quarantine; Knip is the dead-export bar for JS/TS [knip-docs] Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of SonarQube, Semgrep, RenovateCons behind Knip (leads); not adopted yet: source exists, never compiled: /api/build it	●	◐	○	◉	○
In-content sovereignty lint (imports + exec targets) Measured: `func sa_audit` exists in `runtime/_hdl_build/nx_sov_import_lint.nx`, verified at emit. Flags non-sovereign imports and exec-target literals inside source; Semgrep the rule-engine bar [semgrep-taint] Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Knip, RenovateCons behind Semgrep (leads); not adopted yet: source exists, never compiled: /api/build it	●	●	◉	○	○
Byte-verified additive migration Measured: `func jan_migrate` exists in `runtime/_hdl_build/nx_janitor_scrub.nx`, verified at emit. Any non-sov data file to seg_store, BYTE-VERIFIED, original INTACT; peers report problems, none carry a verified data-migration action Adoption: `LIB-WIRED importers=3 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of SonarQube, Semgrep, Knip, Renovate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Reversible no-delete retirement Measured: `func jan_retire_dest` exists in `runtime/_hdl_build/nx_janitor_retire.nx`, verified at emit. REFUSES unless bytes are store-verified; renameat to _retired/, jan_unretire proves reversal; gate 5/5 Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of SonarQube, Semgrep, Knip, Renovate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Multi-axis ratchet with locked floors Measured: `func spr_check_all` exists in `runtime/_hdl_build/nx_sprawl_ratchet.nx`, verified at emit. Debt, collisions, scratch each ratchet DOWN and LOCK -- any rise is RED; SonarQube quality gates fail-on-worse [sonarqube-qgates] is the closest peer idea; floors need re-lock at today's 544/19/627 Adoption: `LIB-GATE-ONLY importers=1` — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program. dossiernot adopted: imported only by validation organs (gates, tests, benches): wire it into a shipping program Pros Implementing source symbol found; runtime acceptance separate; ahead of SonarQube, Semgrep, Knip, RenovateCons not adopted yet: imported only by validation organs (gates, tests, benches): wire it into a shipping program	●	◐	○	○	○
Scratch and artifact accumulation meter Measured: `func jsc_count` exists in `runtime/_hdl_build/nx_janitor_scratch.nx`, verified at emit. LIVE: 627 scratch files (was 258 on 2026-06-23 -- 2.4x creep); missing zone reads -1 not 0 (absent is not empty) Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of SonarQube, Semgrep, Knip, Renovate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Staleness and freshness caretaker Measured: `func jn_surface` exists in `runtime/_hdl_build/nx_janitor.nx`, verified at emit. Are surfaces regenerating, is the system alive -- STALE = silent death; Renovate [renovate-docs] covers the dependency-staleness slice only Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of SonarQube, Semgrep, Knip, RenovateCons not adopted yet: source exists, never compiled: /api/build it	●	○	○	○	◐
Caller and impact analysis before rename Measured: `func oc_grep` exists in `runtime/_hdl_build/nx_organ_callers.nx`, verified at emit. Sovereign whole-tree reference search (no timeout on 89k files); powers the checked collision-resolution method that took 22 to 14 with zero functionality lost rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=6 nonval=4` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of SonarQube, Semgrep, Knip, Renovate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	◐	◐	◐	○
Governed autonomous runs (conductor-owned pulses) Measured: `cr_seed` exists in `runtime/_hdl_build/nx_conductor_registry.nx`, verified at emit. Ratchet gates registered as warden-owned conductor pulses -- governed, never ad-hoc; Renovate is the bar for fully-scheduled autonomous hygiene [renovate-docs] Adoption: `LIB-WIRED importers=5 nonval=4` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of SonarQube, Semgrep, Knip; fully adopted on the estate ladderCons behind Renovate (leads)	●	◐	○	○	◉
Dependency update automation Open — watching `runtime/nx_dep_update.nx` : `du_propose_update`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Renovate 43.257.2 (released 2026-07-10) is the field bar [renovate-docs]; sovereign imports are vendored by doctrine but organ-version staleness has no automation dossierwatching du_propose_update Pros none measured yetCons behind SonarQube, Renovate (leads); open contract; expected source declaration not established	○	◐	○	○	◉
Secrets and credential scanning Measured: `func main(argc` exists in `runtime/_hdl_build/nx_secret_scan.nx`, verified at emit. STALE-ABSENT CORRECTED 2026-08-19: the scanner EXISTS (nx_secret_scan, its KAT gate 5 of 5 plus a production sweep GREEN over 15,566 files on 2026-08-14); this row carried a bare _ABSENT_ on a file name that was never the organ's. The fs reader deny-lists the scanner's own source by name, so the measured symbol is the program itself; gitleaks remains the breadth bar [gitleaks] Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_secret_scan_gate -- a mention, not a run. dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_secret_scan_gate -- a mention, not a run Pros Implementing source symbol found; runtime acceptance separate; ahead of Semgrep, Knip, RenovateCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_secret_scan_gate -- a mention, not a run	●	●	◐	○	○
SBOM and license compliance Open — watching `runtime/nx_sbom.nx` : `sbom_emit`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. license_tier tags exist in organ headers; no bill-of-materials or license-audit organ reads them [spdx-spec] dossierwatching sbom_emit Pros none measured yetCons behind SonarQube, Semgrep; open contract; expected source declaration not established	○	◐	◐	○	○
Security taint-analysis rules Open — watching `runtime/nx_taint.nx` : `tn_taint_rule`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. SonarQube commercial taint analysis leads; Semgrep taint mode [semgrep-taint] partial; we have no vulnerability-pattern rules dossierwatching tn_taint_rule Pros none measured yetCons behind SonarQube (leads), Semgrep; open contract; expected source declaration not established	○	◉	◐	○	○
Multi-language analysis Open — watching `runtime/nx_multilang_lint.nx` : `mll_lint_lang`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Peers analyze 30+ languages; our lint depth is NishiLang-only (the auditor classifies every file type but only by extension) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching mll_lint_lang Pros none measured yetCons behind SonarQube (leads), Semgrep, Knip, Renovate; open contract; expected source declaration not established	○	◉	●	◐	◐
CI and PR integration Open — watching `runtime/nx_ci_hook.nx` : `ci_pr_comment`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Every peer comments on pull requests; our pulses are internal -- no PR surface rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching ci_pr_comment Pros none measured yetCons behind SonarQube, Semgrep, Knip, Renovate (leads); open contract; expected source declaration not established	○	●	●	●	◉
IDE integration Open — watching `runtime/nx_ide_lint.nx` : `idl_diag_push`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. SonarLint in-editor is the bar; we ship none rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching idl_diag_push Pros none measured yetCons behind SonarQube (leads), Semgrep; open contract; expected source declaration not established	○	◉	●	○	○
Automated fix generation Open — watching `runtime/nx_autofix.nx` : `afx_apply_fix`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Renovate auto-PRs updates, Semgrep autofix, Knip --fix removes dead exports [knip-docs]; our scrub migrates DATA but never patches CODE dossierwatching afx_apply_fix Pros none measured yetCons behind SonarQube, Semgrep, Knip, Renovate (leads); open contract; expected source declaration not established	○	◐	◐	◐	◉
Web dashboard UI Open — watching `runtime/nx_health_dashboard_jan.nx` : `hdj_emit_page`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. SonarQube dashboard is the bar; our scorecard is console-only (this /compare page is the first public surface) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching hdj_emit_page Pros none measured yetCons behind SonarQube (leads), Semgrep, Renovate; open contract; expected source declaration not established	○	◉	◐	○	◐
LLM-assisted repair and refactoring Open — watching `runtime/nx_llm_refactor.nx` : `llr_propose_refactor`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. SonarQube AI CodeFix class features arriving across the field; connects to our LLM-assisted-compiler-testing radar gap (mom 145) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching llr_propose_refactor Pros none measured yetCons behind SonarQube, Semgrep; open contract; expected source declaration not established	○	◐	◐	○	○
Never-brick cleaning by construction (additive-only, no delete syscall, reversible) Source present; authored stronger claim: `jan_unretire` in `runtime/_hdl_build/nx_janitor_retire.nx`, verified at emit. The janitor CANNOT destroy: no sys_unlink anywhere in the fleet, byte-verified store before any move, unretire proves reversal, gates 5/5 x4 organs; knip --fix deletes code, Renovate rewrites manifests -- none are reversible-by-construction Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of SonarQube, Semgrep, Knip, Renovate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
Sovereign zero-dependency fleet on own substrate Source present; authored stronger claim: `func sav_class_of` in `runtime/nx_sovereignty_audit.nx`, verified at emit. Whole fleet is NishiLang organs on our own compiler and runtime, offline, zero SaaS, zero phone-home; peers self-host but sit on Java, OCaml or Node stacks and center on cloud services rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. dossiernot adopted: source exists, never compiled: /api/build it Pros Source symbol found; stronger capability claim is authored; ahead of SonarQube, Semgrep, Knip, RenovateCons not adopted yet: source exists, never compiled: /api/build it	◉	◐	◐	◐	◐
HYGIENE
an auto-fixer may not satisfy a ratchet with an uninformative name Open — watching `runtime/nx_magic.nx` : `mg_name_adds_information`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. MEASURED 2026-08-28, in OUR OWN tooling. nx_magic apply hoists a literal to a const named after its own value (4096 becomes PARTS_MAGIC_4096), which satisfies rule 11 while making the site LESS greppable than the bare literal was -- and nx_magicname ratchets exactly that shape as value_named offenders. So the sanctioned FIXER manufactures the other gate METRIC of offenders: the count goes green and the defect stays. Census over a 161,511 B window of a CAPPED 1,048,576 B artifact, so a FLOOR twice over: 543 value-restating names across 189 files. The contract is an accept rule the hoist must pass -- a proposed name must add information the value does not already carry -- with the fixer REFUSING and naming the site when it cannot, because a rename that cannot be justified is worse than the literal it replaced. Rivals report magic numbers; none of them auto-name, so none of them have this defect and none have the guard either. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching mg_name_adds_information Pros none measured yetCons behind SonarQube, Semgrep; open contract; expected source declaration not established	○	●	●	○	○
a code fixer may never rewrite prose Open — watching `runtime/nx_magic.nx` : `mg_comment_untouched`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. The same auto-hoist edits COMMENTS it does not understand, because it operates on raw text with no idea what is code. Three classes witnessed: a date, "the lid-part follow-on, 2026-07-07", became PARTS_MAGIC_2026-07-07, a dead const made out of a corrupted date; a derivation, "72128 = 9216", became "72128 = K_MAGIC_9216", destroying the arithmetic that was the only reason the comment existed; and in ML-KEM 768 crypto, documented scratch-buffer byte ranges became const names, one of which the tool NEVER DEFINED -- harmless to the build and proof it was editing text blind. Also reached the age gate, where a fixture comment now reads "PERSON_Y born ADULT_MAGIC_2010 -> MINOR". Floor: 10 corrupted-prose occurrences across 8 files in the same capped window, disjoint from the 3 found by hand, so at least 11 files. The contract is a tooth that no byte inside a comment is ever modified by a fixer, bite-proven both ways. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching mg_comment_untouched Pros none measured yetCons behind SonarQube, Semgrep; open contract; expected source declaration not established	○	●	●	○	○

Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.

Rival claims, counted
Class	Count	Note
rows with rival marks	22	rows carrying a Yes, Best or Part in a rival column
cited	11	a reference mark resolves to a pinned mirror
uncited	11	an observation read, badged until a reference lands
rows, summed	22	RECONCILED: the parts sum to the total 22

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Risk register

Risk	Likelihood x impact	Mitigation
An auto-fix that deletes is the one thing the janitor has never been allowed to do	certain x high	JN8 inherits the no-delete law: bank, verify, reverse -- a fix without a reversal path is refused by its own gate.
Taint rules tuned on the planted example fire on everything	possible x medium	JN4 publishes its false-positive rate over the corpus before any rule ships.

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

Honest verdict. The Nishi janitor is a REAL, running code-health system with properties the field does not ship: additive-only never-brick cleaning (byte-verified store before any move, reversible unretire, the janitor has NO delete syscall) and locked ratchet floors so cleaned debt cannot silently return. The instruments ran live for this census: genuine debt 544 (down from 7071 on 2026-06-23, purity 892 permil) but shadow collisions crept 14 to 19 and scratch doubled to 627 -- the ratchet floors need conductor-governed re-locking. Against the field it is honestly behind on breadth: no dependency-update automation (Renovate), no secrets scanning, no SBOM or license compliance, no taint-analysis security rules (SonarQube and Semgrep), no CI, PR, or IDE integration, no auto-fix generation, single-substrate only. The climb: wire the detect-clean-ratchet loop autonomous through the conductor, then the security ring (secrets, vuln rules), then integration surfaces.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/janitor.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain janitor, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

The field — discovered, not chosen

Rows written by nx_field_discover from janitor.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

Discovery receipt. One row per counter the run wrote, in the receipt's own order; the rival rows follow in their own table.

Field discovery, counted
Class	Count	Note
seeds	4
scanned	4
fetched	4
reused	0
failed	0
named	4
candidates	4
mentions	4
capped	0

Rank	Rival	Seeds	Mentions	First seed	Kind	Link
1	SonarQube	1	1	col0-sonarqube	named	https://docs.sonarsource.com/sonarqube-server/quality-standards-administration/managing-quality-gates/introduction-to-quality-gates
2	Semgrep	1	1	col1-semgrep	named	https://docs.semgrep.dev/writing-rules/data-flow/taint-mode
3	Knip	1	1	col2-knip	named	https://knip.dev/
4	Renovate	1	1	col3-renovate	named	https://docs.renovatebot.com/

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 25 capabilities: 24 exclusive to it and 1 shared with other boards. Shared rows on this page: 1 = home here 0 + home elsewhere 0 + ambiguous 0 + undecided 1 + refused 0 (partition 1); undecided = unmapped 0 + unproven 1 + unevidenced 0; homonyms 1; since the previous census: new 0, resolved 0. Census FRESH age_s=6507.

Capability	Organ	Boards grading it	Home	Rule	Evidence	Standing on this board
func main(argc	`-`	lang:runtime/nx_compile_x86.nx, lang:runtime/nx_compile_x86.nx, janitor:runtime/_hdl_build/nx_secret_scan.nx	—	homonym	-	homonym
cr_seed	`nx_conductor_registry.nx`	janitor, team	—	none	unproven	undecided

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1395612 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kind	name	board	source	evidence

rows shown 0|this board's directives 0|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[sonarqube-qgates] Sonar. SonarQube Server documentation: Understanding quality gates -- a set of conditions on new or overall code metrics that a project must pass to be release-ready. publisher · read in our library knowledge/fetched/cmp_janitor_sonarqube-qgates.html · pin h22e98a5d4284c7e473df745eaca989efe573d3373900e4716f6d6c0920f95736 · accessed 2026-08-18 · vendor-docGrounds: The SonarQube column: "Multi-axis ratchet with locked floors" names SonarQube quality gates fail-on-worse as the closest peer idea to our DOWN-and-LOCK ratchets, and "Whole-tree debt walker" and "Web dashboard UI" grade SonarQube as the platform bar; this is the vendor's own definition of that gate.
[semgrep-taint] Semgrep documentation: Taint analysis overview (taint mode) -- tracking untrusted data from sources through propagators to sinks without sanitization. publisher · read in our library knowledge/fetched/cmp_janitor_semgrep-taint.html · pin h7c15e8955c033765749a3a8848839e9be4e051af019960cf5e6cad64f34e2a68 · accessed 2026-08-18 · vendor-docGrounds: The Semgrep column: "Security taint-analysis rules" (Semgrep taint mode partial, 3; Nishi _ABSENT_) and "In-content sovereignty lint (imports + exec targets)" where Semgrep is the rule-engine bar (2); this is what taint mode is per the vendor.
[knip-docs] Knip documentation: Declutter your JavaScript and TypeScript projects -- finds and removes unused files, dependencies and exports. publisher · read in our library knowledge/fetched/cmp_janitor_knip-docs.html · pin hc46229f255ac6744d683d80a4b1771508b54c5f7abf56ad43a212be7dac1830f · accessed 2026-08-18 · vendor-docGrounds: The Knip column: "Dead and orphan artifact detection" (Knip is the dead-export bar for JS/TS, 2) and "Automated fix generation" (knip --fix removes dead exports); the EXCEED row notes knip --fix DELETES code where our retirement is reversible by construction.
[renovate-docs] Renovate documentation (docs.renovatebot.com): automated dependency updates, multi-platform and multi-language, delivered as pull requests. publisher · read in our library knowledge/fetched/cmp_janitor_renovate-docs.html · pin h4164ac65c65681c208f37fe9af96096ee07e91d6e15824d0e843776e13f2740d · accessed 2026-08-18 · vendor-docGrounds: The Renovate column: "Dependency update automation" (Renovate is the field bar, 2; Nishi _ABSENT_), "Governed autonomous runs" (Renovate is the bar for fully-scheduled autonomous hygiene) and "Staleness and freshness caretaker" (dependency-staleness slice only).
[cunningham92] Cunningham. The WyCash Portfolio Management System. OOPSLA 1992 experience report -- the origin of the technical-debt metaphor ("shipping first time code is like going into debt"). publisher · read in our library knowledge/fetched/cmp_janitor_cunningham92.html · pin h7bb0ebbd6e99b96cb15229de39e810dd7644ea56a755a22668663f68b09de5d5 · accessed 2026-08-18 · published-paperGrounds: The "Whole-tree debt walker with 3-way debt classification" row and the genuine_debt 544 figure: the debt vocabulary the janitor measures (KILL, MIGRATE, REVIEW; purity permil) descends from this report's metaphor, including its warning that unrepaid debt brings an organization to a standstill. The mirror is the complete short report (4,311 bytes), not a stub.
[gitleaks] Gitleaks (gitleaks/gitleaks): a secret-detection tool for passwords, API keys and tokens in git repositories, files and stdin, driven by regex rules (GitHub repository README). publisher · read in our library knowledge/fetched/cmp_janitor_gitleaks.html · pin h038472de2aecbca2257ae5c1e985961042796bd1432474a9b63ffeebcb745782 · accessed 2026-08-18 · vendor-docGrounds: The "Secrets and credential scanning" row (Nishi _ABSENT_ at census time; the vault doctrine keeps credentials out of source by convention but nothing SCANS): what a leak scanner is in the field, the bar for the named security ring.
[spdx-spec] SPDX (System Package Data Exchange) Specification 3.0.1, The Linux Foundation: the software bill of materials data model and serialization. publisher · read in our library knowledge/fetched/cmp_devguardrails_spdx-spec.html · pin ha905ca11b54700955ba92b4dbdf9d35553852b82bfddf2fabc06cabc194e120a · accessed 2026-08-18 · published-standardGrounds: The "SBOM and license compliance" row (Nishi _ABSENT_; license_tier tags exist in organ headers but no bill-of-materials organ reads them): the interchange format such an organ would emit. Mirror shared with devguardrails.refs.

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/janitor.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls