code wiki / _hdl_build / nx_ciq_family_gate.nx
nx_ciq_family_gate.nx
buildroot/runtime/_hdl_build/nx_ciq_family_gate.nx
about
nx_ciq_family_gate.nx -- the OPAQUE family-level gate for the CIQ publish (operator: "opaque gate it behind
the family level"). Defines + PROVES the authz policy the wiki render daemon adopts for the /wiki/family/
route prefix, composing the proven nx_authz longest-prefix level rule (no reinvention):
policy: /wiki/ -> level 0 (public) ; /wiki/family/ -> level 2 (family) [longer prefix wins]
"OPAQUE" (the operator's word) = stronger than a visible 403: authz_filter OMITS family items from a
non-family user's listing entirely, so an anonymous/public visitor never even SEES that the CIQ analysis
exists. PROVES by construction:
(1) anon (lvl0) requesting /wiki/family/ciq.html -> DENY ; family (lvl2) -> ALLOW ; public page -> ALLOW
(2) OPAQUE: a public listing filters OUT the family items (count drops); a family listing keeps them.
This is the gating LOGIC, tested; wiring it into nx_wiki_doc_render's serve path = the wiki workstream's
coordinated adoption step. 100% sovereign. license_tier: ORIGINAL expect_exit: 0
dependencies 2 imports · 0 importers
imports: nx_syscalls.nxnx_authz.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 19 | const LVL_PUBLIC: i64 = 0 |
| 20 | const LVL_FAMILY: i64 = 2 |
functions
| 15 | func fw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } |
| 16 | func fn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)} let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1} sys_write(1,bb,k); return 0 } |
| 17 | func slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } called by 1: main |
| 22 | func main() -> i64 |