nx_ad_botfilter_gate.nx source

1// nx_ad_botfilter_gate.nx -- GATE (runnable) for ADS-019 invalid-traffic filter. The DELIVERABLE 2// organ: loads the DATA rules FROM THE SOVEREIGN STORE (adcfg:botrules, seeded by nx_ad_store_seed 3// -- pure Nishi ecosystem, no TSV) and proves the filter DISCRIMINATES on baked adversarial 4// controls run THROUGH those loaded rules -- cannot false-green; weaken the shipped rules and the 5// controls break (verdict RED, exit 1). 6// 7// pos : pure-bot class-bucket -> ALL counted invalid, valid=0 (we never bill it) 8// neg : pure-human class-bucket -> ALL counted valid, invalid=0 (we count it) 9// mixed : bot + human together -> SEPARATES exactly (not all-pass/all-fail) 10// 11// Evidence -> knowledge/status/ad_botfilter.log (BOTFILTERGATE authored=organ ... verdict=GREEN). 12// license_tier: ORIGINAL 13import "nx_ad_store.nx" 14import "nx_ad_botfilter.nx" 15import "nx_syscalls.nx" 16 17const BFG_LOG: *u8 = "knowledge/status/ad_botfilter.log" 18 19func bg_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 20func bg_wn(fd: i64, v: i64) -> i64 { let bb: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m; sys_write(fd,"-" as *u8,1)}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=(48+(m%10)) as u8; m=m/10; k=k+1}; var i: i64=0; while i<k {bb[i]=t[k-1-i]; i=i+1}; sys_write(fd, bb, k); return 0 } 21 22func bg_emit(fd: i64, nrules: i64, pv: i64, pi: i64, nv: i64, ni: i64, mv: i64, mi: i64, ok: i64) -> i64 { 23 bg_w(fd, "BOTFILTERGATE authored=organ source=store rules=" as *u8); bg_wn(fd, nrules) 24 bg_w(fd, " pos_valid=" as *u8); bg_wn(fd, pv) 25 bg_w(fd, " pos_invalid=" as *u8); bg_wn(fd, pi) 26 bg_w(fd, " neg_valid=" as *u8); bg_wn(fd, nv) 27 bg_w(fd, " neg_invalid=" as *u8); bg_wn(fd, ni) 28 bg_w(fd, " mixed_valid=" as *u8); bg_wn(fd, mv) 29 bg_w(fd, " mixed_invalid=" as *u8); bg_wn(fd, mi) 30 if ok == 1 { bg_w(fd, " verdict=GREEN\n" as *u8) } else { bg_w(fd, " verdict=RED\n" as *u8) } 31 return 0 32} 33 34func main() -> i64 { 35 let rules: *i64 = sys_mmap(BF_MAXRULES * 2 * 8) as *i64 36 let nrules: i64 = ads_botrules(rules, BF_MAXRULES) 37 38 let ev: *i64 = sys_mmap(64) as *i64 39 let ov: *i64 = sys_mmap(8) as *i64 40 let oi: *i64 = sys_mmap(8) as *i64 41 42 ev[0] = 1; ev[1] = 1; ev[2] = 0; ev[3] = 100 43 bf_tally(ev, 1, rules, nrules, ov, oi) 44 let pv: i64 = ov[0] 45 let pi: i64 = oi[0] 46 47 ev[0] = 0; ev[1] = 0; ev[2] = 1; ev[3] = 100 48 bf_tally(ev, 1, rules, nrules, ov, oi) 49 let nv: i64 = ov[0] 50 let ni: i64 = oi[0] 51 52 ev[0] = 1; ev[1] = 1; ev[2] = 0; ev[3] = 30 53 ev[4] = 0; ev[5] = 0; ev[6] = 1; ev[7] = 70 54 bf_tally(ev, 2, rules, nrules, ov, oi) 55 let mv: i64 = ov[0] 56 let mi: i64 = oi[0] 57 58 var ok: i64 = 1 59 if nrules < 1 { ok = 0 } 60 if pv != 0 { ok = 0 } 61 if pi != 100 { ok = 0 } 62 if nv != 100 { ok = 0 } 63 if ni != 0 { ok = 0 } 64 if mv != 70 { ok = 0 } 65 if mi != 30 { ok = 0 } 66 67 bg_emit(1, nrules, pv, pi, nv, ni, mv, mi, ok) 68 let lf: i64 = sys_openat_append(BFG_LOG, 420) 69 if lf >= 0 { bg_emit(lf, nrules, pv, pi, nv, ni, mv, mi, ok); sys_close(lf) } 70 71 if ok == 1 { return 0 } 72 return 1 73}