nx_browser_gate.nx
buildroot/runtime/nx_browser_gate.nx
about
nx_browser_gate.nx -- THE BROWSER GATE: one command re-proves the
Nishi browser claim set, evidence-driven + durable.
Data-driven row table (add a row = add a table entry). Each row
names a runtime/<module>.nx; the gate builds it through THE SOVEREIGN
BUILD LANE (_offc/nx_sov_build_run.elf <mod> --build-only -- nx_cc ->
nxasm_x86, no gcc, no binutils), runs the artifact that lane names,
and judges via the RAW wait4 status (the sovereign exit-judging law --
never $? through a shell).
Rows (the browser claim set, 2026-06-10):
arg7-tailcall compiler regression gate: >6-arg tail-call drop
(the defect that zeroed every TLS Derive-Secret)
tls-kdf RFC 8448 Derive-Secret KATs
tls-schedule TLS 1.3 key-schedule KATs
jpeg-ascii deterministic synthetic-JPEG decode + raster
page-demo live HTTP fetch + html_to_text (example.com:80)
own-site-live LIVE sovereign HTTPS fetch of nishifamily.com
(TLS 1.3 + real Mozilla CA chain validation)
render-own paints the FETCHED page's text -> framebuffer
(consumes own-site-live's /tmp/nishi_own.html)
recv-hs-probe B1 rung: full encrypted-handshake walk vs
example.com (per-record/per-message markers,
cert-pipeline verdict + chain sig-alg census);
exit 0 = handshake to WAIT_CLIENT_FIN
p256-keyshare B4 rung: P-256 ECDH (RFC 5903 KAT both
directions, boundary rejects) + dual key_share
wire format (x25519 + secp256r1 in one CH)
derefcast compiler regression gate: `*p as T` precedence
(pre-fix: cast bound inside the deref -> byte-
load of the pointer cell -> SIGSEGV; fixed in
parse_unary 2026-06-10)
p256-loopback B4 server side: OUR server completes a P-256-only
client (no HRR), both roles derive byte-identical
traffic secrets, off-curve share rejected (the
nishifamily P-256 gap, healed + loopback-proven)
ch-compat B2 rung, two live legs: httpbin.org census
(TLS-1.2-only signature classified -- the CH
was never the defect; auto-escalates to a full
handshake if they enable 1.3) + github.com
dependencies 2 imports · 0 importers
imports: nx_syscalls.nxnx_gate_verdict.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 92 | const BG_BUILD_ROWS: i64 = 12 // rows built from runtime/<mod>.nx through the sovereign lane |
| 93 | const BG_SHOT_ROW: i64 = 12 // index of the browser-shot row (the shipped artifact itself) |
| 94 | const BG_ROWS: i64 = 13 // every declared row: BG_BUILD_ROWS + the shot row |
| 95 | const BG_SHOT_ARGV_SLOTS: i64 = 5 // artifact, shot, fixture, png-out, NUL |
| 96 | const BG_PATH_CAP: i64 = 512 // one resolved path |
| 97 | const BG_LINE_CAP: i64 = 512 // the builder's last output line, carried onto the row that failed to build |
| 98 | const BG_NUM_CAP: i64 = 28 // decimal scratch |
| 99 | const BG_ARGV_SLOTS: i64 = 4 // builder argv: elf, module, --build-only, NUL |
| 100 | const BG_MODE_644: i64 = 420 |
| 101 | const BG_COPY_CHUNK: i64 = 65536 |
| 103 | const BG_EXIT_SHIFT: i64 = 8 |
| 104 | const BG_EXIT_MASK: i64 = 255 |
| 105 | const BG_SIG_MASK: i64 = 127 |
| 106 | const BG_EXEC_FAIL: i64 = 127 // what bg_run's child exits with when execve itself fails |
| 107 | const BG_SPACE: i64 = 32 |
| 108 | const BG_TAB: i64 = 9 |
| 109 | const BG_LF: i64 = 10 |
| 110 | const BG_CR: i64 = 13 |
| 114 | const BG_B_OK: i64 = 0 |
| 115 | const BG_B_COMPILE_FAIL: i64 = 1 // the row's source does not compile/assemble -- a row FAIL |
| 116 | const BG_B_SRC_NOT_FOUND: i64 = 4 // runtime/<mod>.nx absent under both roots -- a row FAIL (the claim set names a source that is gone) |
| 117 | const BG_B_NO_ARTIFACT: i64 = 5 // the builder exited 0 and named no artifact -- fail loud, never run a fossil |
| 118 | const BG_B_BUILDER_OTHER: i64 = 10 // any other builder exit (usage etc.) -- a row FAIL with the builder's own last line as the reason |
| 119 | const BG_B_ADMIT_REFUSED: i64 = 6 // nx_build_admit said no: a fact about the BOX -> NOT RUN |
| 120 | const BG_B_CANON_REFUSED: i64 = 7 // tree-canon divergence: compiling would prove a FORKED copy -> NOT RUN |
| 121 | const BG_B_BUILD_TIMEOUT: i64 = 8 // the builder's own deadline fired -> NOT RUN |
| 122 | const BG_B_BUILDER_EXEC: i64 = 9 // the builder could not be exec'd or died by signal -> NOT RUN |
| 127 | const BG_SBR_USAGE: i64 = 2 |
| 128 | const BG_SBR_COMPILE_FAIL: i64 = 3 |
| 129 | const BG_SBR_ASM_FAIL: i64 = 4 |
| 130 | const BG_SBR_ADMIT_REFUSED: i64 = 6 |
| 131 | const BG_SBR_CANON_REFUSED: i64 = 7 |
| 132 | const BG_SBR_BUILD_TIMEOUT: i64 = 8 |
functions
| 134 | func bg_puts(s: *u8) -> i64 |
| 141 | func bg_fputs(fd: i64, s: *u8) -> i64 |
| 148 | func bg_fputn(fd: i64, v: i64) -> i64 |
| 162 | func bg_putn(v: i64) -> i64 { bg_fputn(1, v); return 0 } |
| 164 | func bg_cat(dst: *u8, off: i64, s: *u8) -> i64 |
| 171 | func bg_run(path: *u8, argv: *i64, envp: *i64, redir_out: i64, redir_err: i64) -> i64 |
| 184 | func bg_exists(path: *u8) -> i64 called by 4: bg_sov_resolvebg_src_resolvebg_artifact_resolvebg_subject_resolve calls 2: sys_openat_rdsys_close |
| 200 | func bg_sov_resolve() -> *u8 |
| 213 | func bg_src_resolve(mod: *u8, out: *u8) -> i64 |
| 233 | func bg_artifact_path(mod: *u8, which: i64, out: *u8) -> i64 |
| 243 | func bg_artifact_resolve(mod: *u8, out: *u8) -> i64 |
| 254 | func bg_artifact_unlink(mod: *u8) -> i64 |
| 266 | func bg_last_line(path: *u8, out: *u8, cap: i64) -> i64 |
| 307 | func bg_build(mod: *u8, sov: *u8, envp: *i64, logpath: *u8, art: *u8) -> i64 |
| 336 | func bg_report(logfd: i64, name: *u8, build_rc: i64, exit_code: i64, sig: i64, word: *u8, reason: *u8) -> i64 |
| 383 | func bg_stage_certdata(used: *u8) -> i64 |
| 410 | func bg_subject_resolve(argc: i64, argv: *i64, out: *u8) -> i64 |
| 430 | func bg_write_shot_fixture(path: *u8) -> i64 |
| 442 | func bg_open_log() -> i64 |
| 448 | func main(argc: i64, argv: *i64) -> i64 |