code wiki / _hdl_build / nx_hr_visitor.nx
nx_hr_visitor.nx
buildroot/runtime/_hdl_build/nx_hr_visitor.nx
about
nx_hr_visitor.nx -- NISHI HR, visitor module (S-class HR rung 3): the "front desk" -- WELCOME the visitors we
want business from, and BLOCK/kick the ones we want gone, by BEHAVIOR (incl. bots). Unlike the team/user side
(deny-by-default), the public site is ALLOW-by-default (NEUTRAL) -- visitors are welcome until behavior says
otherwise. Verdicts: 0=NEUTRAL (serve normally), 1=WELCOME (a wanted/business visitor -> VIP path), 2=BLOCK
(hostile/abusive/bot -> 403/drop). PRIORITY (security wins): blocklist > abusive-rate > bot-UA > welcomelist >
neutral -- so a WELCOMED visitor who turns abusive is still BLOCKED. Thresholds are DATA-DRIVEN (CLAUDE.md #11).
HONEST: UA bot-detection is a first-tier heuristic (declared crawlers + lazy clients); the RATE limb catches
UA-spoofing abuse; deeper signals (JA3, challenge, per-path anomaly) are later rungs. license_tier: ORIGINAL
dependencies 2 imports · 2 importers
imports: nx_hr.nxnx_syscalls.nx
imported by: nx_hr_visitor_gate.nxnx_hr_visitor_log.nx
structs
| none |
consts
| 11 | const HV_MAGIC_262144: i64 = 262144 |
| 13 | const HV_NEUTRAL: i64 = 0 |
| 14 | const HV_WELCOME: i64 = 1 |
| 15 | const HV_BLOCK: i64 = 2 |
| 16 | const HV_BLOCK_RPM: i64 = 600 // requests/minute over the window above which a visitor is "abusive" (config, not magic) |
functions
| 19 | func hv_contains(hay: *u8, needle: *u8) -> i64 called by 1: hv_is_bot |
| 28 | func hv_is_bot(ua: *u8) -> i64 |
| 41 | func hv_rate_abusive(req_count: i64, window_sec: i64) -> i64 called by 1: hv_classify |
| 47 | func hv_listed(path: *u8, id: *u8, idlen: i64) -> i64 |
| 59 | func hv_classify(id: *u8, idlen: i64, req_count: i64, window_sec: i64, ua: *u8, block_path: *u8, welcome_path: *u8) -> i64 |