code wiki / _hdl_build / nx_dp_leak_gate.nx

nx_dp_leak_gate.nx

buildroot/runtime/_hdl_build/nx_dp_leak_gate.nx

9842 B174 linesdepth 5pulls 11 transitivereach 0 importersview sourcekind gate/prooftopic dp
docsdependenciesstructsconstsfunctions

about

nx_dp_leak_gate.nx -- STANDING "RED on leak" guarantee for rung 0: the PUBLIC corpus must carry NO document bearing an internal/SECRET marker. Dual-mode: (gate) no args -> hermetic 3-tooth proof in a fresh nonce domain (seed leak -> detect -> reclassify -> clean) (live) `scan <domain>` -> run leak_scan against the REAL store (search-level closure proof) leak_scan(domain): for each internal marker, dss_search (the LIVE consent-filtered search) returns BM25 candidates; each candidate's doc bytes are re-read (dp_read) and the LITERAL marker string is re-confirmed in the bytes (dss_search tokenizes -- the literal re-confirm kills false positives). Distinct leaking cids are summed. 0 = clean. NOTE: the markers' dashes are word-internal (preceded by a token char) so dss_search treats them as inert separators, NOT as -NOT operators -- the markers tokenize into positive OR terms. STANDALONE check organ -- imports only; modifies/redeploys NO daemon. license_tier: ORIGINAL

dependencies 3 imports · 0 importers

nx_dp_reclassify.nx nx_docportal_search_seg.nx nx_docportal_lib.nx nx_dp_leak_gate.nx

imports: nx_dp_reclassify.nxnx_docportal_search_seg.nxnx_docportal_lib.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main lk_streq g_puts leak_scan dss_prefix ss_open ss_open2 sys_mmap ss_manifest_dyn ss_manifest_file_dyn sys_mmap ↻ ss_cat ss_readall sys_munmap ss_cat ↻ ss_loadfile sys_map_file sys_openat_rd sys_lseek sys_close ss_readall ↻ ss_load_aux2 sys_mmap ↻ ss_cat ↻ ss_loadfile ↻ ss_r32 sys_munmap ↻ ssl_total_keys ss_r32 ↻ ssl_pow2 ssl_build ss_r32 ↻ ssl_hash_entry ss_r32 ↻ ssl_key_eq ss_r32 ↻ ss_r32 ↻ ssl_lookup ssl_hash_entry ↻ ssl_key_eq ↻

structs

none

consts

16const LK_MAXR: i64 = 512 // dss_search candidate cap per marker (leaking internal docs rank high on rare markers)

functions

18func g_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
called by 2: leak_scanmain
19func g_num(v: i64) -> i64
called by 2: leak_scanmain
25func g_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
called by 1: main
26func g_wn(fd: i64, v: i64) -> i64
called by 1: main
32func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
called by 2: leak_scanmain
33func g_cat(out: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { out[o] = s[i]; o = o + 1; i = i + 1 } return o }
called by 1: main
34func g_catnum(out: *u8, o: i64, v: i64) -> i64
called by 1: main
40func lk_streq(a: *u8, b: *u8) -> i64
called by 1: main
47func lk_contains(hay: *u8, hn: i64, needle: *u8, nn: i64) -> i64
called by 1: leak_scan
63func leak_scan(domain: *u8) -> i64
called by 1: main calls 9: dss_prefixss_openg_slendss_searchdss_mkkeyss_hget+3
111func main(argc: i64, argv: *i64) -> i64
calls 14: lk_streqg_putsleak_scang_numg_catg_catnum+8