code wiki / _hdl_build / nx_cms_roles_gate.nx

nx_cms_roles_gate.nx

buildroot/runtime/_hdl_build/nx_cms_roles_gate.nx

3702 B60 linesdepth 3pulls 4 transitivereach 0 importersview sourcekind gate/prooftopic cms
docsdependenciesstructsconstsfunctions

about

nx_cms_roles_gate.nx -- CMS ROLES/CAPABILITIES gate (land a missing class HONESTLY). Runs the TEAM-AUTHORED authz FSM c0_authz_step (shape 18, authored hands-off this session via auto_builder) over a real role x route matrix and proves the security properties WordPress subscriber-roles get wrong: tenant isolation (clientA cannot reach clientB scope) + privilege separation (no client reaches an admin route) + admin reach. Writes CMSGATE roles-capabilities verdict=PASS to knowledge/status/cms_gate.log ONLY if ALL assertions hold (no fake-green). license_tier: ORIGINAL states: 0=anon 1=clientA 2=clientB 3=admin events: 0=public 1=clientA-scope 2=clientB-scope 3..5=admin-only D001-MIGRATED 2026-08-01: this gate was GREEN and UNREADABLE at the same time -- it printed "verdict=PASS" while nx_swcompare_evidence parses the nx_gate_verdict vocabulary, so cms scored gates_green=0/2 with both gates passing. A correct proof nobody can parse contributes exactly as much as no proof. Teeth and the durable cms_gate.log frame are UNCHANGED; only the verdict emission moved onto the shared base class.

dependencies 3 imports · 0 importers

c0_authz_step.nx nx_syscalls.nx nx_gate_verdict.nx nx_cms_roles_gate.nx

imports: c0_authz_step.nxnx_syscalls.nxnx_gate_verdict.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main gv_ctr sys_mmap gv_head gv_puts sys_write c0_authz_step_step gv_check gv_puts ↻ gv_verdict gv_puts ↻ gv_num sys_mmap ↻ sys_write ↻ sys_munmap gv_journal sys_openat_append sys_mmap ↻ gv_catn sys_mmap ↻ sys_munmap ↻ sys_now_realtime_sec sys_mmap ↻ sys_clock_gettime_real gv_cat sys_write ↻ sys_close sys_munmap ↻ sys_openat_append ↻ sys_write ↻ rg_len sys_close ↻ rg_puts sys_write ↻ rg_num sys_mmap ↻ sys_write ↻ sys_exit

structs

none

consts

none

functions

17func rg_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
called by 1: main calls 1: sys_write
18func rg_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
called by 1: main
19func rg_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
called by 1: main calls 2: sys_mmapsys_write
21func main() -> i64
calls 12: gv_ctrgv_headc0_authz_step_stepgv_checkgv_verdictsys_openat_append+6