nx_ad_botfilter_gate.nx source

1// nx_ad_botfilter_gate.nx -- GATE (runnable) for ADS-019 invalid-traffic filter. The DELIVERABLE 2// organ: loads the DATA rules FROM THE SOVEREIGN STORE (adcfg:botrules, seeded by nx_ad_store_seed 3// -- pure Nishi ecosystem, no TSV) and proves the filter DISCRIMINATES on baked adversarial 4// controls run THROUGH those loaded rules -- cannot false-green; weaken the shipped rules and the 5// controls break (verdict RED, exit 1). 6// 7// pos : pure-bot class-bucket -> ALL counted invalid, valid=0 (we never bill it) 8// neg : pure-human class-bucket -> ALL counted valid, invalid=0 (we count it) 9// mixed : bot + human together -> SEPARATES exactly (not all-pass/all-fail) 10// 11// Evidence -> knowledge/status/ad_botfilter.log (BOTFILTERGATE authored=organ ... verdict=GREEN). 12// license_tier: ORIGINAL 13import "nx_ad_store.nx" 14import "nx_ad_botfilter.nx" 15import "nx_syscalls.nx" 16import "nx_gate_verdict.nx" 17 18const BFG_LOG: *u8 = "knowledge/status/ad_botfilter.log" 19 20func bg_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 21func bg_wn(fd: i64, v: i64) -> i64 { let bb: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m; sys_write(fd,"-" as *u8,1)}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=(48+(m%10)) as u8; m=m/10; k=k+1}; var i: i64=0; while i<k {bb[i]=t[k-1-i]; i=i+1}; sys_write(fd, bb, k); return 0 } 22 23func bg_emit(fd: i64, nrules: i64, pv: i64, pi: i64, nv: i64, ni: i64, mv: i64, mi: i64, ok: i64) -> i64 { 24 bg_w(fd, "BOTFILTERGATE authored=organ source=store rules=" as *u8); bg_wn(fd, nrules) 25 bg_w(fd, " pos_valid=" as *u8); bg_wn(fd, pv) 26 bg_w(fd, " pos_invalid=" as *u8); bg_wn(fd, pi) 27 bg_w(fd, " neg_valid=" as *u8); bg_wn(fd, nv) 28 bg_w(fd, " neg_invalid=" as *u8); bg_wn(fd, ni) 29 bg_w(fd, " mixed_valid=" as *u8); bg_wn(fd, mv) 30 bg_w(fd, " mixed_invalid=" as *u8); bg_wn(fd, mi) 31 if ok == 1 { bg_w(fd, " verdict=GREEN\n" as *u8) } else { bg_w(fd, " verdict=RED\n" as *u8) } 32 return 0 33} 34 35func main() -> i64 { 36 let rules: *i64 = sys_mmap(BF_MAXRULES * 2 * 8) as *i64 37 let nrules: i64 = ads_botrules(rules, BF_MAXRULES) 38 39 let ev: *i64 = sys_mmap(64) as *i64 40 let ov: *i64 = sys_mmap(8) as *i64 41 let oi: *i64 = sys_mmap(8) as *i64 42 43 ev[0] = 1; ev[1] = 1; ev[2] = 0; ev[3] = 100 44 bf_tally(ev, 1, rules, nrules, ov, oi) 45 let pv: i64 = ov[0] 46 let pi: i64 = oi[0] 47 48 ev[0] = 0; ev[1] = 0; ev[2] = 1; ev[3] = 100 49 bf_tally(ev, 1, rules, nrules, ov, oi) 50 let nv: i64 = ov[0] 51 let ni: i64 = oi[0] 52 53 ev[0] = 1; ev[1] = 1; ev[2] = 0; ev[3] = 30 54 ev[4] = 0; ev[5] = 0; ev[6] = 1; ev[7] = 70 55 bf_tally(ev, 2, rules, nrules, ov, oi) 56 let mv: i64 = ov[0] 57 let mi: i64 = oi[0] 58 59 var ok: i64 = 1 60 if nrules < 1 { ok = 0 } 61 if pv != 0 { ok = 0 } 62 if pi != 100 { ok = 0 } 63 if nv != 100 { ok = 0 } 64 if ni != 0 { ok = 0 } 65 if mv != 70 { ok = 0 } 66 if mi != 30 { ok = 0 } 67 68 bg_emit(1, nrules, pv, pi, nv, ni, mv, mi, ok) 69 let lf: i64 = sys_openat_append(BFG_LOG, 420) 70 if lf >= 0 { bg_emit(lf, nrules, pv, pi, nv, ni, mv, mi, ok); sys_close(lf) } 71 72 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 73 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 74 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 75 let ctr__dry: *i64 = gv_ctr() 76 ctr__dry[0] = ok 77 ctr__dry[1] = 1 78 let rc__dry: i64 = gv_verdict("AD-BOTFILTER-GATE" as *u8, ctr__dry, "teeth unchanged; verdict emission migrated onto the shared base class" as *u8) 79 sys_exit(rc__dry) 80 return rc__dry 81}