code wiki / _hdl_build / _offc_install_gate.nx
_offc_install_gate.nx source
↩ module page · 141 lines · 7318 B
1// _offc_install_gate.nx -- LOCK for the LM-026 prevention (stale-_offc guardrail). NO mocks.
2// Proves the ENGINEER guardrail (nx_offc_install) detects + atomically fixes a stale _offc artifact,
3// AND that the DOCTOR's recall (ki_recall over the LIVE ki- catalogue) routes the STALE-OFFC-ARTIFACT
4// signature to the wired auto-remedy -- so the team prevents the landmine that cost a full session.
5//
6// HERMETIC: operates on a clearly-test name (_oitest*), writing the /tmp "fresh build" and the _offc
7// "installed" artifact directly, so the file-copy logic is exercised end-to-end with NO real build.
8// T1 detect : _offc differs from /tmp -> oi_stale==1
9// T2 fix : oi_install copies + verifies -> _offc now byte-equals /tmp
10// T3 post-fresh : after install -> oi_stale==0
11// T4 neg-control : _offc already equals /tmp -> oi_stale==0 (no false-positive)
12// T5 recall : a real STALE-OFFC-ARTIFACT diag -> ki_recall HIT id=LM-026 rem=nx_offc_install:oi_install
13// T6 tamper : corrupt the signature -> ki_recall UNKNOWN (real substring, not constant)
14// T7 fresh-LM027 : oi_fresh removes a stale artifact -> artifact gone (external-oracle gate path that
15// oi_install cannot cover -- no /tmp twin: compile-then-run can never fork a stale binary)
16// GREEN only if T1..T7 hold. Evidence -> knowledge/status/offc_install.log. license_tier: ORIGINAL
17import "nx_offc_install.nx"
18import "nx_known_issue_store.nx"
19import "nx_syscalls.nx"
20
21const G_LOG: *u8 = "knowledge/status/offc_install.log"
22
23func g_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
24func g_p(s: *u8) -> i64 { sys_write(1, s, g_len(s)); return 0 }
25func g_fp(fd: i64, s: *u8) -> i64 { sys_write(fd, s, g_len(s)); return 0 }
26func g_streq(a: *u8, b: *u8) -> i64 {
27 var i: i64 = 0
28 while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
29 if b[i] != (0 as u8) { return 0 }
30 return 1
31}
32func g_write(path: *u8, content: *u8) -> i64 {
33 let fd: i64 = sys_openat_wr(path, 493)
34 if fd < 0 { return 0 }
35 sys_write(fd, content, g_len(content)); sys_close(fd)
36 return 1
37}
38// 1 if file at path byte-equals expected (NUL-terminated).
39func g_file_eq(path: *u8, expected: *u8) -> i64 {
40 let l: *i64 = sys_mmap(16) as *i64
41 let b: *u8 = sys_read_file(path, l)
42 if (b as i64) == 0 { return 0 }
43 let el: i64 = g_len(expected)
44 if l[0] != el { return 0 }
45 var i: i64 = 0
46 while i < el { if b[i] != expected[i] { return 0 } i = i + 1 }
47 return 1
48}
49func g_row(name: *u8, pass: i64) -> i64 { g_p(" " as *u8); g_p(name); if pass == 1 { g_p(" PASS\n" as *u8) } else { g_p(" FAIL\n" as *u8) } return 0 }
50
51func main() -> i64 {
52 // ---- fixtures: a "fresh /tmp build" and a stale "installed _offc" for name _oitest ----
53 g_write("/tmp/_oitest.sov.elf" as *u8, "FRESH-BUILD-BYTES-v1-aaaaaaaaaa" as *u8)
54 g_write("_offc/_oitest.elf" as *u8, "STALE-OLD-v0" as *u8)
55
56 // T1 detect: installed _offc differs from the fresh /tmp build
57 var t1: i64 = 0
58 if oi_stale("_oitest" as *u8) == 1 { t1 = 1 }
59
60 // T2 fix: atomic install copies + verifies; _offc now equals the fresh build
61 var t2: i64 = 0
62 if oi_install("_oitest" as *u8) == 1 {
63 if g_file_eq("_offc/_oitest.elf" as *u8, "FRESH-BUILD-BYTES-v1-aaaaaaaaaa" as *u8) == 1 { t2 = 1 }
64 }
65
66 // T3 post-fresh: no longer stale after install
67 var t3: i64 = 0
68 if oi_stale("_oitest" as *u8) == 0 { t3 = 1 }
69
70 // T4 neg-control: when _offc already equals /tmp, NOT stale (no false-positive)
71 g_write("/tmp/_oitest3.sov.elf" as *u8, "IDENTICAL-CONTENT-zzz" as *u8)
72 g_write("_offc/_oitest3.elf" as *u8, "IDENTICAL-CONTENT-zzz" as *u8)
73 var t4: i64 = 0
74 if oi_stale("_oitest3" as *u8) == 0 { t4 = 1 }
75
76 // T5 recall: a real STALE-OFFC-ARTIFACT diagnostic recalls LM-026 from the LIVE catalogue + routes the auto-fix
77 let outid: *u8 = sys_mmap(64)
78 let outrem: *u8 = sys_mmap(256)
79 let outstat: *u8 = sys_mmap(64)
80 let d_real: *u8 = "engineer: OFFC-INSTALL STALE-OFFC-ARTIFACT name=nx_boot_run_sov installed=0\n" as *u8
81 let r5: i64 = ki_recall(KI_PREFIX, d_real, g_len(d_real), outid, outrem, outstat)
82 var t5: i64 = 0
83 if r5 == KI_HIT {
84 if g_streq(outid, "LM-026" as *u8) == 1 {
85 if g_streq(outrem, "nx_offc_install:oi_install" as *u8) == 1 { t5 = 1 }
86 }
87 }
88
89 // T6 tamper: corrupt the signature -> recall MUST miss (proves a real substring match, not a constant)
90 let d_tamper: *u8 = "engineer: OFFC-INSTALL STALE-OFFC-ARTIFAKT name=nx_boot_run_sov installed=0\n" as *u8
91 let r6: i64 = ki_recall(KI_PREFIX, d_tamper, g_len(d_tamper), outid, outrem, outstat)
92 var t6: i64 = 0
93 if r6 == KI_UNKNOWN { t6 = 1 }
94
95 // T7 fresh-compile guarantee (LM-027 external-oracle gate path): a pre-existing artifact is REMOVED
96 // by oi_fresh so a gate that compiles-then-runs can NEVER fork a stale binary -- the path oi_install
97 // cannot cover (no /tmp twin). Write a stale artifact, oi_fresh it, prove it is gone.
98 g_write("_offc/_oifreshtest.elf" as *u8, "STALE-ORACLE-BINARY-v0" as *u8)
99 var t7: i64 = 0
100 if oi_fresh("_offc/_oifreshtest.elf" as *u8) == 1 {
101 let l7: *i64 = sys_mmap(16) as *i64
102 let b7: *u8 = sys_read_file("_offc/_oifreshtest.elf" as *u8, l7)
103 if (b7 as i64) == 0 { t7 = 1 }
104 }
105
106 // ---- cleanup: reliably REMOVE the _offc test artifacts (dogfoods oi_fresh = unlinkat; renameat
107 // left junk when the /tmp trash target already existed, so the durable dir stays junk-free now) ----
108 oi_fresh("_offc/_oitest.elf" as *u8)
109 oi_fresh("_offc/_oitest3.elf" as *u8)
110
111 var passes: i64 = 0
112 if t1 == 1 { passes = passes + 1 }
113 if t2 == 1 { passes = passes + 1 }
114 if t3 == 1 { passes = passes + 1 }
115 if t4 == 1 { passes = passes + 1 }
116 if t5 == 1 { passes = passes + 1 }
117 if t6 == 1 { passes = passes + 1 }
118 if t7 == 1 { passes = passes + 1 }
119 var ok: i64 = 0
120 if passes == 7 { ok = 1 }
121
122 g_p("OFFC-INSTALL gate (LM-026 stale-_offc + LM-027 oracle-gate fresh-compile prevention)\n" as *u8)
123 g_row("T1 detect-stale " as *u8, t1)
124 g_row("T2 atomic-fix-verify " as *u8, t2)
125 g_row("T3 post-install-fresh " as *u8, t3)
126 g_row("T4 neg-control-fresh " as *u8, t4)
127 g_row("T5 recall-routes-LM026 " as *u8, t5)
128 g_row("T6 tamper-miss " as *u8, t6)
129 g_row("T7 fresh-compile-LM027 " as *u8, t7)
130
131 let lf: i64 = sys_openat_append(G_LOG, 420)
132 if ok == 1 {
133 g_p("OFFCINSTALLGATE verdict=GREEN keystone=stale-offc-prevention probe=offc-install detect=stale fix=atomic-renameat+verify recall=LM-026->nx_offc_install:oi_install tamper=rejected\n" as *u8)
134 if lf >= 0 { g_fp(lf, "OFFCINSTALLGATE verdict=GREEN keystone=stale-offc-prevention probe=offc-install detect+fix+recall(LM-026)+tamper all-pass epoch=" as *u8); oi_wn(lf, sys_now_realtime_sec()); g_fp(lf, "\n" as *u8); sys_close(lf) }
135 sys_exit(0); return 0
136 }
137 g_p("OFFCINSTALLGATE verdict=RED (not all T1..T6 passed)\n" as *u8)
138 if lf >= 0 { g_fp(lf, "OFFCINSTALLGATE verdict=RED passes=" as *u8); oi_wn(lf, passes); g_fp(lf, "\n" as *u8); sys_close(lf) }
139 sys_exit(1)
140 return 1
141}