code wiki / _hdl_build / nx_wiki_publish_guard_gate.nx

nx_wiki_publish_guard_gate.nx

buildroot/runtime/_hdl_build/nx_wiki_publish_guard_gate.nx

8982 B157 linesdepth 8pulls 9 transitivereach 0 importersview sourcekind gate/prooftopic wiki
docsdependenciesstructsconstsfunctions

about

nx_wiki_publish_guard_gate.nx -- TEETH for the pre-publish guard (nx_wiki_publish_guard). Proves the fail-closed "liar-kill": a page is ALLOWED only when it is fresh-stamped AND every [[cite:<cid>]] resolves in the content-addressed archive AND every internal /wiki/<x>.html link is in the corpus AND the body is real content. Positive control (well-formed page -> ALLOW) + FOUR negative controls, each asserting the EXACT machine-readable reason code (not merely "rejected"): (i) well-formed page -> PG_ALLOW (ii) no freshness stamp -> PG_REJECT_NO_FRESHNESS (iii) a dangling [[cite:<cid>]] (cid absent) -> PG_REJECT_DANGLING_CITE (iv) href to a /wiki page NOT in the corpus -> PG_REJECT_DEAD_LINK (v) empty / placeholder body -> PG_REJECT_PLACEHOLDER The positive control PLANTS a real resolvable citation: it archives a source body into a fresh per-run seg_store (ss_begin -> war_archive_page -> ss_commit), gets back the REAL cid, and embeds [[cite:<that cid>]] in the page -- so the guard's archive resolution is exercised end-to-end, not mocked. Appends "PUBGUARD ... verdict=PASS" to knowledge/status/pubguard_gate.log on all-pass. Exit 0 iff all pass (no fake-green). license_tier: ORIGINAL

dependencies 2 imports · 0 importers

nx_wiki_publish_guard.nx nx_syscalls.nx nx_wiki_publish_guard_gate.nx

imports: nx_wiki_publish_guard.nxnx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main sys_mmap sys_now_us sys_mmap ↻ sys_clock_gettime_mono g_slen ss_begin ss_begin_cap sys_mmap ↻ war_archive_page war_cid_of_body cid_of sys_mmap ↻ sha256_digest sys_mmap ↻ sha256_init sys_mmap ↻ sha256_k sha256_update sha256_compress_ni_blocks blk_set_byte sha256_compress sha256_final blk_set_byte ↻ sha256_compress ↻ cid_from_digest sys_munmap war_blobkey war_cat ss_add ss_add2 ss_w32 ss_len war_cidkey war_cat ↻ g_w sys_write sys_exit ss_commit ss_segid_ok

structs

none

consts

none

functions

19func g_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
called by 2: g_rowmain calls 1: sys_write
20func g_num(v: i64) -> i64
called by 2: g_rowmain calls 2: sys_mmapsys_write
28func g_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64 = off; var k: i64 = 0; while s[k] != (0 as u8) { dst[o] = s[k]; o = o + 1; k = k + 1 } return o }
called by 1: main
29func g_catnum(dst: *u8, off: i64, v: i64) -> i64
called by 1: main calls 1: sys_mmap
35func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
called by 1: main
38func g_codename(v: i64) -> *u8
called by 1: g_row
48func g_row(id: i64, got: i64, want: i64, what: *u8) -> i64
called by 1: main calls 3: g_wg_numg_codename
57func main() -> i64
calls 17: sys_mmapsys_now_usg_slenss_beginwar_archive_pageg_w+11