_galx_ingest_gate.nx source

1import "nx_gate_base.nx" 2// _galx_ingest_gate.nx -- STRENGTHENED NO-FAKE-GREEN gate for GALX-001 (X-GALX-INGEST, the 3// 5-stage ingest compose). The ORGAN-authored nx_store_ingest_ingest (author=emitter, banner "no 4// Claude logic"; authored hands-off by nx_auto_builder from knowledge/specs/build_store_ingest.spec 5// via the shape-19 PNG_INGEST compose emitter) really ingests the REAL multi-tEXt corpus samples. 6// 7// THE BUG THIS GATE NOW CATCHES (council wisjdwyg9, severity=block): a CONSTANT baked segid makes a 8// 2nd DISTINCT image (different CID) commit into the SAME seg-<id>.docs file -> rename(2) OVERWRITES 9// the first image's segment -> the first record is CLOBBERED off disk (silent data loss). The OLD 10// gate only re-ingested the SAME image (idempotency), so the clobber path was NEVER exercised -- 11// the gate could not fail on the bug = itself fake-green. This strengthened gate adds the 12// TWO-DISTINCT-IMAGE NO-CLOBBER arm: ingest image A (genrec_multi.png) AND a SECOND distinct image 13// B (genrec_multi_b.png, different GENREC values -> different CID), then assert BOTH are retrievable 14// by their OWN CIDs and the manifest segment count GREW to 2. On the buggy constant-segid module 15// image A is gone -> ss_get(CID-A) returns not-found -> this gate goes RED (clobber detected). 16// 17// This harness writes ZERO ingest logic -- it COMPOSES the green organ and asserts: 18// (0) NO-CLOBBER (the new DEFINITIVE arm): ingest A then B (2 distinct images, 2 distinct CIDs); 19// BOTH ss_get(CID-A) AND ss_get(CID-B) return FOUND (no clobber) AND segment count == 2. 20// (1) CID round-trip byte-exact: ss_get the stored record back, re-hash the canonical bytes -> 21// the SAME CID, AND that CID equals the off-band python oracle CID (computed off-band, 22// never shipped): image A nxc1-6a59140bf7491b8c70f94820872874c73d3737603db1dc100a6bdcfbb2081738 23// image B nxc1-8600a9243cc7614463a825e3a1129f37f3c047de5ea52726bfa764baa87e58b5. 24// (2) Idempotency (rule 10): a 2nd ingest of the SAME file returns 0 (no dup) and the manifest 25// segment count is UNCHANGED. 26// (3) GENREC fields populated FROM THE REAL SEPARATE tEXt chunks: the canonical record contains 27// every key+value (image A seed=4273739273, model=z_image_turbo, sampler=euler, steps=12, 28// generator_host=laptop) -- proving the per-chunk WALK loop assembled the vector from five 29// distinct chunks, not a single packed chunk. 30// TAMPER (no-fake-green): flip one source keyword byte WITHOUT fixing the chunk crc -> the 31// _pe_pngtext_locate read still runs but the keyword no longer matches a GENREC key, so that 32// field drops -> the canonical vector changes -> a DIFFERENT CID is produced (a NEW record). 33// The on-disk file is NEVER modified (the flip is in an in-memory copy). 34// Pure Nishi, sovereign (no gcc; python is only the off-band sample/oracle, not in the deliverable). 35// license_tier: ORIGINAL 36import "nx_store_ingest.nx" 37import "nx_canon_cid.nx" 38import "nx_seg_store.nx" 39import "nx_syscalls.nx" 40 41func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw(" 42" as *u8); return ok } 43func gwn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m; sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 44 45// does buf[0..n) contain the kl bytes of `key` contiguously? (GENREC-field presence probe) 46func g_contains(buf: *u8, n: i64, key: *u8, kl: i64) -> i64 { 47 var i: i64 = 0 48 while i + kl <= n { 49 var j: i64 = 0 50 var ok: i64 = 1 51 while j < kl { if (buf[i + j] & 0xff) != (key[j] & 0xff) { ok = 0; j = kl } else { j = j + 1 } } 52 if ok == 1 { return 1 } 53 i = i + 1 54 } 55 return 0 56} 57 58// count segments listed in the live manifest (the no-clobber + idempotency proof) 59func g_segcount(prefix: *u8) -> i64 { 60 let segs: *i64 = sys_mmap(8 * 260) as *i64 61 return ss_manifest(prefix, segs) 62} 63 64// build the record key "img:" + the 68-char CID `cid` (null-terminated) into rk; rk len 74. 65func g_imgkey(rk: *u8, cid: *u8) -> i64 { 66 rk[0]=105 as u8; rk[1]=109 as u8; rk[2]=103 as u8; rk[3]=58 as u8 // "img:" 67 var ci: i64 = 0 68 while ci < 69 { rk[4 + ci] = cid[ci]; ci = ci + 1 } 69 rk[73] = 0 as u8 70 return 0 71} 72 73// read a file into a fresh mmap; lenout[0] = size, returns ptr (0 on failure) 74func g_readfile(path: *u8, lenout: *i64) -> *u8 { 75 let b: *u8 = sys_read_file(path, lenout) 76 return b 77} 78 79// truncate the manifest at `prefix` so a fresh namespace starts at 0 segments 80func g_freshns(prefix: *u8) -> i64 { 81 let mfn: *u8 = sys_mmap(64) 82 var mo: i64 = 0 83 while (prefix[mo] & 0xff) != 0 { mfn[mo] = prefix[mo]; mo = mo + 1 } 84 let suf: *u8 = "manifest.txt" as *u8 85 var so: i64 = 0 86 while (suf[so] & 0xff) != 0 { mfn[mo + so] = suf[so]; so = so + 1 } 87 mfn[mo + so] = 0 as u8 88 let cfd: i64 = sys_openat_wr(mfn, 0x1a4) 89 if cfd >= 0 { sys_close(cfd) } 90 return 0 91} 92 93func main() -> i64 { 94 // ---- read BOTH real corpus samples (2 DISTINCT images, different GENREC values) ---- 95 let lenA: *i64 = sys_mmap(16) as *i64 96 let bufA: *u8 = g_readfile("_g1work/genrec_multi.png" as *u8, lenA) 97 if (bufA as i64) == 0 { gw("GALX-GATE FAIL: cannot read REAL corpus sample _g1work/genrec_multi.png\n" as *u8); sys_exit(1); return 1 } 98 let flenA: i64 = lenA[0] 99 let lenB: *i64 = sys_mmap(16) as *i64 100 let bufB: *u8 = g_readfile("_g1work/genrec_multi_b.png" as *u8, lenB) 101 if (bufB as i64) == 0 { gw("GALX-GATE FAIL: cannot read 2nd DISTINCT corpus sample _g1work/genrec_multi_b.png\n" as *u8); sys_exit(1); return 1 } 102 let flenB: i64 = lenB[0] 103 104 // off-band oracle CIDs (python zlib/sha256, never shipped): A and B are DISTINCT. 105 let ocidA: *u8 = "nxc1-6a59140bf7491b8c70f94820872874c73d3737603db1dc100a6bdcfbb2081738" as *u8 106 let ocidB: *u8 = "nxc1-8600a9243cc7614463a825e3a1129f37f3c047de5ea52726bfa764baa87e58b5" as *u8 107 // they MUST differ (else the "2 distinct images" premise is bogus) 108 var dci: i64 = 0 109 var distinct: i64 = 0 110 while dci < 69 { if (ocidA[dci] & 0xff) != (ocidB[dci] & 0xff) { distinct = 1 } dci = dci + 1 } 111 if distinct != 1 { gw("GALX-GATE FAIL: oracle CID-A == CID-B (images not distinct)\n" as *u8); sys_exit(1); return 1 } 112 113 // ============================================================================ 114 // (0) NO-CLOBBER ARM (the DEFINITIVE bug catcher): ingest A then B into a FRESH 115 // namespace; assert BOTH retrievable by their OWN CID + segment count grew to 2. 116 // A constant baked segid makes B's commit overwrite A's seg file -> ss_get(CID-A) 117 // would return not-found here -> this arm goes RED. 118 // ============================================================================ 119 let prefix: *u8 = "/tmp/galx001-" as *u8 120 g_freshns(prefix) 121 122 let rA: i64 = nx_store_ingest_ingest(bufA, flenA, prefix) 123 if rA != 1 { gw("GALX-GATE FAIL: ingest A (genrec_multi.png) did not store (rA=" as *u8); gwn(rA); gw(")\n" as *u8); sys_exit(1); return 1 } 124 let segAfterA: i64 = g_segcount(prefix) 125 let rB: i64 = nx_store_ingest_ingest(bufB, flenB, prefix) 126 if rB != 1 { gw("GALX-GATE FAIL: ingest B (genrec_multi_b.png, DISTINCT) did not store (rB=" as *u8); gwn(rB); gw(")\n" as *u8); sys_exit(1); return 1 } 127 let segAfterB: i64 = g_segcount(prefix) 128 129 // BOTH must be independently retrievable by their distinct CIDs (NO clobber). 130 let rkA: *u8 = sys_mmap(96) 131 g_imgkey(rkA, ocidA) 132 let rkB: *u8 = sys_mmap(96) 133 g_imgkey(rkB, ocidB) 134 let ppA: *i64 = sys_mmap(16) as *i64 135 let llA: *i64 = sys_mmap(16) as *i64 136 let ppB: *i64 = sys_mmap(16) as *i64 137 let llB: *i64 = sys_mmap(16) as *i64 138 let gA: i64 = ss_get(prefix, rkA, ppA, llA) 139 let gB: i64 = ss_get(prefix, rkB, ppB, llB) 140 if gA != 1 { gw("GALX-GATE FAIL: NO-CLOBBER -- image A's record is GONE after ingesting B (ss_get(CID-A)=" as *u8); gwn(gA); gw("); a constant baked segid CLOBBERED the first image (DATA LOSS)\n" as *u8); sys_exit(1); return 1 } 141 if gB != 1 { gw("GALX-GATE FAIL: NO-CLOBBER -- image B's record not found after ingest (ss_get(CID-B)=" as *u8); gwn(gB); gw(")\n" as *u8); sys_exit(1); return 1 } 142 // segment count MUST have grown to 2 (two distinct images -> two segments; constant segid keeps it pinned/overwrites) 143 if segAfterA != 1 { gw("GALX-GATE FAIL: NO-CLOBBER -- after image A segment count != 1 (got " as *u8); gwn(segAfterA); gw(")\n" as *u8); sys_exit(1); return 1 } 144 if segAfterB != 2 { gw("GALX-GATE FAIL: NO-CLOBBER -- segment count did NOT grow to 2 after the 2nd DISTINCT image (got " as *u8); gwn(segAfterB); gw("); segid did not advance -> clobber\n" as *u8); sys_exit(1); return 1 } 145 gw("GATE ROW no-clobber: GREEN -- ingested 2 DISTINCT images (CID-A 6a59.. + CID-B 8600..); BOTH retrievable, segments grew 1->2 (no overwrite, additive)\n" as *u8) 146 147 // ---- (1) CID ROUND-TRIP byte-exact vs the OFF-BAND ORACLE CID (image A) ---- 148 let rbA: *u8 = ppA[0] as *u8 149 let rlenA: i64 = llA[0] 150 let cidA2: *u8 = sys_mmap(80) 151 cid_of(rbA, rlenA, cidA2) 152 var ci: i64 = 0 153 while ci < 69 { if (cidA2[ci] & 0xff) != (ocidA[ci] & 0xff) { gw("GALX-GATE FAIL: CID-A round-trip mismatch at " as *u8); gwn(ci); gw("\n" as *u8); sys_exit(1); return 1 } ci = ci + 1 } 154 // round-trip image B too (its readback must re-hash to CID-B) 155 let rbB: *u8 = ppB[0] as *u8 156 let rlenB: i64 = llB[0] 157 let cidB2: *u8 = sys_mmap(80) 158 cid_of(rbB, rlenB, cidB2) 159 ci = 0 160 while ci < 69 { if (cidB2[ci] & 0xff) != (ocidB[ci] & 0xff) { gw("GALX-GATE FAIL: CID-B round-trip mismatch at " as *u8); gwn(ci); gw("\n" as *u8); sys_exit(1); return 1 } ci = ci + 1 } 161 gw("GATE ROW cid-roundtrip: GREEN -- A and B readback bytes each re-hash to their OWN off-band oracle CID (6a59.. and 8600..)\n" as *u8) 162 163 // ---- (3) GENREC fields populated FROM THE REAL SEPARATE tEXt CHUNKS (image A) ---- 164 let nfail: *i64 = sys_mmap(16) as *i64 165 nfail[0] = 0 166 if g_contains(rbA, rlenA, "seed" as *u8, 4) != 1 { gw("GALX-GATE FAIL: GENREC key 'seed' missing\n" as *u8); nfail[0] = 1 } 167 if g_contains(rbA, rlenA, "4273739273" as *u8, 10) != 1 { gw("GALX-GATE FAIL: GENREC value '4273739273' missing\n" as *u8); nfail[0] = 1 } 168 if g_contains(rbA, rlenA, "model" as *u8, 5) != 1 { gw("GALX-GATE FAIL: GENREC key 'model' missing\n" as *u8); nfail[0] = 1 } 169 if g_contains(rbA, rlenA, "z_image_turbo" as *u8, 13) != 1 { gw("GALX-GATE FAIL: GENREC value 'z_image_turbo' missing\n" as *u8); nfail[0] = 1 } 170 if g_contains(rbA, rlenA, "sampler" as *u8, 7) != 1 { gw("GALX-GATE FAIL: GENREC key 'sampler' missing\n" as *u8); nfail[0] = 1 } 171 if g_contains(rbA, rlenA, "euler" as *u8, 5) != 1 { gw("GALX-GATE FAIL: GENREC value 'euler' missing\n" as *u8); nfail[0] = 1 } 172 if g_contains(rbA, rlenA, "steps" as *u8, 5) != 1 { gw("GALX-GATE FAIL: GENREC key 'steps' missing\n" as *u8); nfail[0] = 1 } 173 if g_contains(rbA, rlenA, "generator_host" as *u8, 14) != 1 { gw("GALX-GATE FAIL: GENREC key 'generator_host' missing\n" as *u8); nfail[0] = 1 } 174 if g_contains(rbA, rlenA, "laptop" as *u8, 6) != 1 { gw("GALX-GATE FAIL: GENREC value 'laptop' missing\n" as *u8); nfail[0] = 1 } 175 if nfail[0] != 0 { sys_exit(1); return 1 } 176 gw("GATE ROW genrec-fields: GREEN -- seed/model/sampler/steps/generator_host all present (assembled from 5 SEPARATE tEXt chunks)\n" as *u8) 177 178 // ---- (2) IDEMPOTENCY: re-ingest image A (SAME file) -> 0 dup, segment count UNCHANGED ---- 179 let segBefore: i64 = g_segcount(prefix) 180 let r2: i64 = nx_store_ingest_ingest(bufA, flenA, prefix) 181 if r2 != 0 { gw("GALX-GATE FAIL: re-ingest produced a duplicate (r2=" as *u8); gwn(r2); gw(", expected 0)\n" as *u8); sys_exit(1); return 1 } 182 let segAfter: i64 = g_segcount(prefix) 183 if segAfter != segBefore { gw("GALX-GATE FAIL: segment count grew on re-ingest (" as *u8); gwn(segBefore); gw(" -> " as *u8); gwn(segAfter); gw(")\n" as *u8); sys_exit(1); return 1 } 184 // and image A is STILL retrievable after the idempotent re-ingest (no regression) 185 let gA2: i64 = ss_get(prefix, rkA, ppA, llA) 186 if gA2 != 1 { gw("GALX-GATE FAIL: image A vanished after idempotent re-ingest (gA2=" as *u8); gwn(gA2); gw(")\n" as *u8); sys_exit(1); return 1 } 187 gw("GATE ROW idempotency: GREEN -- 2nd ingest of SAME image returned 0 (no dup), segment count unchanged (" as *u8); gwn(segAfter); gw("), A still retrievable\n" as *u8) 188 189 // ---- TAMPER (no-fake-green): flip one source keyword byte in an IN-MEMORY COPY of A ---- 190 let tb: *u8 = sys_mmap(512) 191 var t: i64 = 0 192 while t < flenA { tb[t] = bufA[t]; t = t + 1 } 193 var off: i64 = 8 194 var kwpos: i64 = 0 - 1 195 while off + 8 <= flenA { 196 let blen: i64 = (((tb[off] & 0xff) << 24) | ((tb[off+1] & 0xff) << 16)) | (((tb[off+2] & 0xff) << 8) | (tb[off+3] & 0xff)) 197 let ty: i64 = (((tb[off+4] & 0xff) << 24) | ((tb[off+5] & 0xff) << 16)) | (((tb[off+6] & 0xff) << 8) | (tb[off+7] & 0xff)) 198 if ty == 1950701684 { kwpos = off + 8; off = flenA } else { off = off + 12 + blen } 199 } 200 if kwpos < 0 { gw("GALX-GATE FAIL: tamper arm could not locate a tEXt chunk\n" as *u8); sys_exit(1); return 1 } 201 let orig: i64 = tb[kwpos] & 0xff 202 tb[kwpos] = ((orig ^ 0x20) & 0xff) as u8 // flip one keyword byte ('s' -> 'S') 203 let r3: i64 = nx_store_ingest_ingest(tb, flenA, prefix) 204 if r3 != 1 { gw("GALX-GATE FAIL: tamper arm -- changed-content image did NOT yield a NEW record (r3=" as *u8); gwn(r3); gw(", CID may be blind/constant)\n" as *u8); sys_exit(1); return 1 } 205 let r3b: i64 = nx_store_ingest_ingest(tb, flenA, prefix) 206 if r3b != 0 { gw("GALX-GATE FAIL: tampered record not idempotent on its own CID (r3b=" as *u8); gwn(r3b); gw(")\n" as *u8); sys_exit(1); return 1 } 207 // after the tamper insert, image A is STILL retrievable (the new record did not clobber it) 208 let gA3: i64 = ss_get(prefix, rkA, ppA, llA) 209 if gA3 != 1 { gw("GALX-GATE FAIL: image A clobbered by the tamper record (gA3=" as *u8); gwn(gA3); gw(")\n" as *u8); sys_exit(1); return 1 } 210 gw("GATE ROW tamper-arm: RED-on-corruption fired (flip 1 keyword byte -> different GENREC vector -> NEW CID record, content-derived not constant; A survives)\n" as *u8) 211 212 gw("GALX-001-GATE 5/5 GREEN -- organ-authored nx_store_ingest: NO-CLOBBER (2 distinct images both retrievable, segs 1->2) + CID round-trip byte-exact (A and B) + idempotent (0 dup) + GENREC from 5 separate tEXt chunks + tamper fires\n" as *u8) 213 sys_exit(0) 214 return 0 215}