code wiki / _hdl_build / nx_warden_paths.nx
nx_warden_paths.nx
buildroot/runtime/_hdl_build/nx_warden_paths.nx
about
nx_warden_paths.nx -- the WARDEN's real teeth: classify whether an autonomous
action on a PATH is additive-safe or must be DENIED. Gives the crew council's
Warden leg actual protected-path safety (vs a hand-set flag), so the loop can
self-heal/build but can NEVER overwrite the canonical assets.
Protected (OVERWRITE / DELETE = HARD DENY):
- the known-good compiler _offc/nx_cc_known_good.elf (the canonical root of
trust everything is proven against -- the operator's #1 asset)
- any *.nx SOURCE (autonomous overwrite-in-place forbidden; real edits land
ADDITIVELY + via a gate + review, never an in-place clobber)
Safe:
- CREATE a new file (additive), APPEND (journals), READ
- OVERWRITE of a regenerable build artifact (_offc/*.s, *.o, *.elf scratch, /tmp/*)
license_tier: ORIGINAL
dependencies 1 imports · 3 importers
imports: nx_syscalls.nx
imported by: nx_doctor_heal_test.nxnx_self_heal_conductor.nxnx_warden_paths_test.nx
structs
| none |
consts
| 18 | const WP_SAFE: i64 = 1 |
| 19 | const WP_DENY: i64 = 0 |
| 21 | const WP_READ: i64 = 0 |
| 22 | const WP_APPEND: i64 = 1 |
| 23 | const WP_CREATE: i64 = 2 // create a NEW path (additive) |
| 24 | const WP_OVERWRITE: i64 = 3 // write over an EXISTING path |
| 25 | const WP_DELETE: i64 = 4 |
functions
| 27 | func wp_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } |
| 30 | func wp_contains(hay: *u8, needle: *u8) -> i64 |
| 49 | func wp_endswith(s: *u8, suf: *u8) -> i64 |
| 62 | func wp_is_protected(path: *u8) -> i64 |
| 69 | func nx_warden_path_safe(action: i64, path: *u8) -> i64 |