nx_cms_gate.nx

buildroot/runtime/_hdl_build/nx_cms_gate.nx

17470 B385 linesdepth 5pulls 10 transitivereach 0 importersview sourcekind gate/prooftopic cms

docs dependencies structs consts functions

about

nx_cms_gate.nx -- THE CMS ARC GATE (re-runnable, evidence-driven): boots the real admin daemon on loopback, then plays the LEGAL-TEAM USER + THE ATTACKER over real HTTP with its own client (no curl, no .sh): unauth surfaces refused, login lockout-guarded, CSRF enforced, stored-XSS sanitized on write, edit->publish live, revision rollback restores the prior publish. These are the spec's acceptance criteria (2026-06-06-sovereign-cms-architecture.md) mechanized. Appends a CMSGATE line to knowledge/status/cms_gate.log. Exit 0 iff permil=1000. license_tier: ORIGINAL

dependencies 6 imports · 0 importers

imports: nx_cms_store.nxnx_connect.nxnx_sha256.nxnx_syscalls.nxnx_gate_verdict.nxnx_kill_portable.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

14	const CG_PORT: i64 = 8077
15	const CG_SITE: *u8 = "/tmp/_cms_gate_site"

functions

17	func cg_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } called by 2: cg_row main calls 1: sys_write
18	func cg_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } called by 2: cg_index cg_post
19	func cg_cat(dst: u8, off: i64, s: u8) -> i64 called by 3: cg_post cg_get main
25	func cg_catn(dst: u8, off: i64, s: u8, n: i64) -> i64 called by 3: cg_post cg_get main
31	func cg_index(hay: u8, n: i64, needle: u8) -> i64 called by 2: cg_has main calls 1: cg_len
43	func cg_has(hay: u8, n: i64, needle: u8) -> i64 { if cg_index(hay, n, needle) >= 0 { return 1 } return 0 } called by 1: main calls 1: cg_index
46	func cg_http(req: u8, rl: i64, resp: u8, cap: i64) -> i64 called by 1: main calls 7: sys_socket sys_mmap nx_connect_bounded sys_close sys_write sys_set_socket_timeout+1
81	func cg_post(req: u8, path: u8, cookie: u8, body: u8) -> i64 called by 1: main calls 4: cg_cat cg_catn cg_len sys_mmap
104	func cg_get(req: u8, path: u8, cookie: *u8) -> i64 called by 1: main calls 2: cg_cat cg_catn
117	func cg_row(id: i64, ok: i64, what: *u8) -> i64 called by 1: main calls 2: cg_w sys_mmap
129	func cg_mkdir(path: *u8, mode: i64) -> i64 called by 1: main calls 1: sys_mmap
135	func main() -> i64 calls 28: cg_mkdir cst_copy sys_mmap sha256_digest sys_openat_wr sys_write+22