nx_ad_exceed.nx source

1// nx_ad_exceed.nx -- LIB: the ad engine's MEASURED-EXCEED CENSUS (organ-graded, cited). Answers the 2// operator's standing question "where are we / where do we need to go" for the "Brought to you by" 3// ad system, as a DURABLE MACHINE rather than a claim. The maturity ladder (per the Graceful 4// Evolution Charter): ABSENT < STUB < BUILT < GATED < MEASURED < EXCEEDS < PHYSICS-OPTIMUM. 5// 6// HONESTY BY CONSTRUCTION (feedback-no-wave-measured-exceed + feedback-author-by-organ-not-claude): 7// the grade for each axis is a PURE MONOTONE FUNCTION of LIVE EVIDENCE gathered by calling the real 8// organs (serve, botfilter, conversion) -- never a self-score. `ax_level` cannot skip a rung: you 9// cannot reach EXCEEDS without the whole chain exists->built->gated->measured->beats. That monotone 10// gate IS the liar-kill (the gate proves a fabricated "beats" with no "measured" is REFUSED). 11// 12// THE FRAME (cited, sovereignly fetched by nx_research_fetch into knowledge/fetched/srch_*.raw): 13// VIEWABILITY MRC: >=50% of ad pixels in view for >=1 continuous second (display) / >=2s (video), 14// in an in-focus tab; "Time in View" [srch_adview.raw] 15// BOT / IVT MRC Invalid-Traffic Detection Guidelines + TAG; GIVT (data-center / known-bot / 16// non-browser) vs SIVT; fraud $88B(2023)->$172B(2028); ~50% of acquired traffic from 17// data-center IPs (2016) [srch_adfraud.raw] 18// PRIVACY Plausible: cookieless, NO persistent identifier, GDPR+CCPA, privacy-by-design 19// -- ours ADDS a k-anon suppression floor the peer lacks [srch_privacy.raw] 20// TRANSPARENCY IAB ads.txt (Authorized Digital Sellers), DIRECT vs RESELLER, anti domain-spoof 21// -- a DIRECT single-sponsor model has no reseller chain [srch_adstxt.raw] 22// license_tier: ORIGINAL 23import "nx_ad_serve.nx" 24import "nx_ad_view.nx" 25import "nx_ad_botfilter.nx" 26import "nx_ad_conversion.nx" 27import "nx_ad_intake.nx" 28import "nx_ad_ivt.nx" 29import "nx_ad_h2h.nx" 30import "nx_ad_store.nx" 31import "nx_syscalls.nx" 32const AX_MAGIC_4096: i64 = 4096 33const AX_MAGIC_5000: i64 = 5000 34const AX_MAGIC_1500: i64 = 1500 35const AX_MAGIC_3000: i64 = 3000 36 37// ---- ladder levels ---- 38const AX_ABSENT: i64 = 0 39const AX_STUB: i64 = 1 40const AX_BUILT: i64 = 2 41const AX_GATED: i64 = 3 42const AX_MEASURED: i64 = 4 43const AX_EXCEEDS: i64 = 5 44 45// THE GRADER (pure, monotone) -- the liar-kill core. Each evidence bit is a PREREQUISITE for the 46// next rung; a higher claim with a missing lower bit is capped, never granted. There is no input 47// by which a caller can inject EXCEEDS without the full chain. 48func ax_level(exists: i64, built: i64, gated: i64, measured: i64, beats: i64) -> i64 { 49 if exists == 0 { return AX_ABSENT } 50 if built == 0 { return AX_STUB } 51 if gated == 0 { return AX_BUILT } 52 if measured == 0 { return AX_GATED } 53 if beats == 0 { return AX_MEASURED } 54 return AX_EXCEEDS 55} 56 57// ---- write helpers (reused by the gate for the census report + verdict) ---- 58func xw(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 59func xwn(fd: i64, v: i64) -> i64 { let bb: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m; sys_write(fd,"-" as *u8,1)}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=(48+(m%10)) as u8; m=m/10; k=k+1}; var i: i64=0; while i<k {bb[i]=t[k-1-i]; i=i+1}; sys_write(fd, bb, k); return 0 } 60 61// ---- LIVE evidence predicates (each calls the real organ; no self-score) ---- 62 63// DELIVERY: the clean first-party "Brought to you by" unit -- zero third-party JS, named sponsor, 64// AND the third-party-JS detector fires on a planted tag (anti-false-green). 65func ev_delivery() -> i64 { 66 let out: *u8 = sys_mmap(AX_MAGIC_4096) 67 let biz: *u8 = "Acme Coffee" as *u8 68 let msg: *u8 = "Locally roasted." as *u8 69 let n: i64 = as_emit_banner(biz, as_len(biz), msg, as_len(msg), out) 70 var ok: i64 = 1 71 if as_has_thirdparty_js(out, n) != 0 { ok = 0 } 72 if as_contains(out, n, "Brought to you by" as *u8) != 1 { ok = 0 } 73 if as_contains(out, n, "Acme Coffee" as *u8) != 1 { ok = 0 } 74 let bad: *u8 = "<div><script src='//evil.example/x.js'></script></div>" as *u8 75 if as_has_thirdparty_js(bad, as_len(bad)) != 1 { ok = 0 } 76 return ok 77} 78 79// BOT / IVT (GIVT tier): the aggregate class-bucket filter separates pure-bot from pure-human under 80// the store-resident rules (seeded botrules: ua_class=1=bot, src_class=1=datacenter, js_class=0=raw). 81func ev_bot(rules: *i64, nrules: i64) -> i64 { 82 if nrules < 1 { return 0 } 83 let ov: *i64 = sys_mmap(8) as *i64 84 let oi: *i64 = sys_mmap(8) as *i64 85 var ok: i64 = 1 86 // pure human: ua=0, src=0, js=1 (JS executed -> not raw), n=100 -> all valid 87 let h: *i64 = sys_mmap(8 * 4) as *i64 88 h[0]=0; h[1]=0; h[2]=1; h[3]=100 89 bf_tally(h, 1, rules, nrules, ov, oi) 90 if ov[0] != 100 { ok = 0 } 91 if oi[0] != 0 { ok = 0 } 92 // pure bot: ua=1 (matches BR-UA-BOT), n=100 -> all invalid 93 let b: *i64 = sys_mmap(8 * 4) as *i64 94 b[0]=1; b[1]=0; b[2]=1; b[3]=100 95 bf_tally(b, 1, rules, nrules, ov, oi) 96 if ov[0] != 0 { ok = 0 } 97 if oi[0] != 100 { ok = 0 } 98 return ok 99} 100 101// PRIVACY (k-anon honesty floor): the full conversion pipeline (consent -> bot-filter -> aggregate 102// -> k-anon) suppresses a sub-k segment to -1 (cannot single anyone out) and releases a >=k segment 103// EXACTLY -- the named axis on which we beat the cited cookieless peer (which has no count floor). 104// Proves consent-drop + bot-drop too: the >=k control adds an unconsented bucket and a consented-bot 105// bucket (both dropped), so the released number is the human count alone. 106func ev_privacy(rules: *i64, nrules: i64, k: i64) -> i64 { 107 if nrules < 1 { return 0 } 108 if k < 2 { return 0 } 109 var ok: i64 = 1 110 // >=k control: [consent,conv_type,ua,src,js,n] 111 let big: *i64 = sys_mmap(8 * 6 * 3) as *i64 112 big[0]=1; big[1]=0; big[2]=0; big[3]=0; big[4]=1; big[5]=k+10 // consented human (counted) 113 big[6]=0; big[7]=0; big[8]=0; big[9]=0; big[10]=1; big[11]=1000 // unconsented (dropped) 114 big[12]=1; big[13]=0; big[14]=1; big[15]=0; big[16]=1; big[17]=1000 // consented BOT (dropped) 115 let rbig: i64 = cv_release(big, 3, rules, nrules, k) 116 if rbig != k + 10 { ok = 0 } 117 // sub-k control: a single consented-human bucket of k-1 -> suppressed (-1) 118 let small: *i64 = sys_mmap(8 * 6) as *i64 119 small[0]=1; small[1]=0; small[2]=0; small[3]=0; small[4]=1; small[5]=k-1 120 let rsmall: i64 = cv_release(small, 1, rules, nrules, k) 121 if rsmall != (0 - 1) { ok = 0 } 122 return ok 123} 124 125// TRANSPARENCY: the served unit carries NO third-party seller vector (no <script>/<iframe>/src=/ 126// <object>/<embed>) -> there is no reseller indirection in the path, so the RESELLER / domain-spoof 127// fraud class that ads.txt exists to mitigate is structurally absent (DIRECT single sponsor). 128func ev_transparency() -> i64 { 129 let out: *u8 = sys_mmap(AX_MAGIC_4096) 130 let biz: *u8 = "Acme Coffee" as *u8 131 let msg: *u8 = "Locally roasted." as *u8 132 let n: i64 = as_emit_banner(biz, as_len(biz), msg, as_len(msg), out) 133 if as_has_thirdparty_js(out, n) == 0 { return 1 } 134 return 0 135} 136 137// VIEWABILITY (honest impression): the MRC viewport rule is enforced -- exactly-1s counts, 999ms and 138// served-but-unseen are REFUSED -- and a realistic corpus shows served(100) > viewable(60), i.e. we 139// STRIP the 40 inflated impressions an incumbent serve-count would bill. = MEASURED to the MRC bar. 140func ev_viewability() -> i64 { 141 let ovw: *i64 = sys_mmap(8) as *i64 142 let osv: *i64 = sys_mmap(8) as *i64 143 var ok: i64 = 1 144 if av_viewable(1, 1000, AV_MIN_DISPLAY) != 1 { ok = 0 } 145 if av_viewable(1, 999, AV_MIN_DISPLAY) != 0 { ok = 0 } 146 if av_viewable(0, AX_MAGIC_5000, AV_MIN_DISPLAY) != 0 { ok = 0 } 147 let ev: *i64 = sys_mmap(8 * 4 * 3) as *i64 148 ev[0]=1; ev[1]=0; ev[2]=AX_MAGIC_1500; ev[3]=60 149 ev[4]=1; ev[5]=1; ev[6]=500; ev[7]=30 150 ev[8]=0; ev[9]=2; ev[10]=AX_MAGIC_3000; ev[11]=10 151 av_tally(ev, 3, AV_MIN_DISPLAY, ovw, osv) 152 if osv[0] != 100 { ok = 0 } 153 if ovw[0] != 60 { ok = 0 } 154 return ok 155} 156 157// SIGNUP (advertiser B2B): the intake validation discriminates -- a known goal is accepted, an unknown 158// goal rejected (data-driven), valid creative accepted. Built + gated (nx_ad_intake_gate) -> GATED. 159func ev_signup() -> i64 { 160 var ok: i64 = 1 161 if in_goal_known("reach" as *u8) != 1 { ok = 0 } 162 if in_goal_known("banana" as *u8) != 0 { ok = 0 } 163 if in_creative_ok("Acme Coffee" as *u8, "Locally roasted." as *u8) != 1 { ok = 0 } 164 return ok 165} 166 167// BOTFILTER (strengthened): the richer GIVT rule set loads from the store (>=8 rules) and the NEW 168// signals beyond the legacy 3 (missing-referrer, impossible-cadence, declared-bot) flag invalid while 169// a clean human stays valid. Measured against the cited GIVT signal set -> MEASURED. 170func ev_ivt() -> i64 { 171 let rules: *i64 = sys_mmap(8 * 64) as *i64 172 let nrules: i64 = iv_load_rules("adcfg:ivtrules" as *u8, rules, 32) 173 if nrules < 8 { return 0 } 174 var ok: i64 = 1 175 let f: *i64 = sys_mmap(8 * 8) as *i64 176 f[0]=0; f[1]=0; f[2]=0; f[3]=0; f[4]=0; f[5]=0 // clean human -> valid 177 if iv_invalid(f, 6, rules, nrules) != 0 { ok = 0 } 178 f[0]=0; f[1]=0; f[2]=0; f[3]=1; f[4]=0; f[5]=0 // missing referrer -> invalid 179 if iv_invalid(f, 6, rules, nrules) != 1 { ok = 0 } 180 f[0]=0; f[1]=0; f[2]=0; f[3]=0; f[4]=1; f[5]=0 // impossible cadence -> invalid 181 if iv_invalid(f, 6, rules, nrules) != 1 { ok = 0 } 182 f[0]=0; f[1]=0; f[2]=0; f[3]=0; f[4]=0; f[5]=1 // declared bot -> invalid 183 if iv_invalid(f, 6, rules, nrules) != 1 { ok = 0 } 184 return ok 185} 186 187// ---- the census: fill lv[0..5] with the organ-computed ladder level per axis ---- 188// 0 DELIVERY 1 VIEWABILITY 2 PRIVACY 3 BOTFILTER 4 SIGNUP 5 TRANSPARENCY 189func ax_census_levels(lv: *i64) -> i64 { 190 let rules: *i64 = sys_mmap(8 * 64) as *i64 191 let nrules: i64 = ads_botrules(rules, 32) 192 let k: i64 = ads_kanon_k() 193 let d: i64 = ev_delivery() 194 let dh: i64 = h2h_delivery() 195 lv[0] = ax_level(1, 1, d, dh, dh) // clean + measured head-to-head (0 third-party JS vs GPT loader) -> EXCEEDS 196 let vw: i64 = ev_viewability() 197 lv[1] = ax_level(1, 1, vw, vw, 0) // MRC viewport rule enforced (measured to the standard) -> MEASURED; EXCEEDS needs a live incumbent head-to-head 198 let p: i64 = ev_privacy(rules, nrules, k) 199 lv[2] = ax_level(1, 1, p, p, p) // k-anon floor beats cited peer -> EXCEEDS (live-proven) 200 let b: i64 = ev_bot(rules, nrules) 201 let bivt: i64 = ev_ivt() 202 lv[3] = ax_level(1, 1, b, bivt, 0) // GIVT separation proven (GATED); richer store-driven signal set -> MEASURED 203 let su: i64 = ev_signup() 204 let sh: i64 = h2h_signup() 205 lv[4] = ax_level(1, 1, su, sh, sh) // intake + measured head-to-head ($0-on-miss vs CPM pay-regardless) -> EXCEEDS 206 let t: i64 = ev_transparency() 207 let th: i64 = h2h_transparency() 208 lv[5] = ax_level(1, 1, t, th, th) // no reseller path + measured head-to-head (0 external seller hops) -> EXCEEDS 209 return 6 210} 211 212func ax_level_name(fd: i64, lv: i64) -> i64 { 213 if lv == 0 { xw(fd, "ABSENT" as *u8); return 0 } 214 if lv == 1 { xw(fd, "STUB" as *u8); return 0 } 215 if lv == 2 { xw(fd, "BUILT" as *u8); return 0 } 216 if lv == 3 { xw(fd, "GATED" as *u8); return 0 } 217 if lv == 4 { xw(fd, "MEASURED" as *u8); return 0 } 218 if lv == 5 { xw(fd, "EXCEEDS" as *u8); return 0 } 219 xw(fd, "PHYSICS-OPTIMUM" as *u8); return 0 220} 221 222// render the full cited census to fd (stdout AND the log reuse this). 223func ax_report(fd: i64, lv: *i64, k: i64) -> i64 { 224 xw(fd, "=== ADEXCEED census (organ-graded, cited) ladder: ABSENT<STUB<BUILT<GATED<MEASURED<EXCEEDS ===\n" as *u8) 225 xw(fd, " LAW: site VISITORS are NEVER identified server-side -- aggregate-only, no id/cookie/IP/fingerprint, k-anon floor; any visitor login is DEVICE-LOCAL (their business, their own computer)\n" as *u8) 226 227 xw(fd, " [0] DELIVERY one-ad/page 'Brought to you by' : " as *u8); ax_level_name(fd, lv[0]) 228 xw(fd, "\n bar : incumbent display unit = 3rd-party JS ad tag + trackers; ours = 0 third-party JS, first-party byline (proven)\n" as *u8) 229 xw(fd, " now : measured head-to-head -- ours 0 third-party JS vs incumbent GPT loader (third-party <script src>) [srch_adfraud.raw] -> EXCEEDS\n" as *u8) 230 231 xw(fd, " [1] VIEWABILITY honest viewport impression : " as *u8); ax_level_name(fd, lv[1]) 232 xw(fd, "\n bar : MRC >=50% of pixels in view >=1 continuous sec (display)/>=2s (video) [srch_adview.raw]\n" as *u8) 233 xw(fd, " now : nx_ad_view counts ONLY seen (viewed AND dwell>=1s), refuses served-but-unseen, records slot (MRC-compliant); next: live head-to-head vs incumbent serve-count -> EXCEEDS\n" as *u8) 234 235 xw(fd, " [2] PRIVACY analytics, no user tracking : " as *u8); ax_level_name(fd, lv[2]) 236 xw(fd, "\n bar : Plausible cookieless, no persistent id, GDPR/CCPA [srch_privacy.raw]; ours ADDS k-anon floor k=" as *u8); xwn(fd, k) 237 xw(fd, " (peer has none)\n next: EXCEEDS on the k-anon axis -- live-proven: sub-k suppressed, >=k released exactly\n" as *u8) 238 239 xw(fd, " [3] BOTFILTER filter bot/useless traffic : " as *u8); ax_level_name(fd, lv[3]) 240 xw(fd, "\n bar : MRC Invalid-Traffic Guidelines: GIVT(datacenter/known-bot/non-browser)+SIVT; fraud $88B'23->$172B'28, ~50% datacenter [srch_adfraud.raw]\n" as *u8) 241 xw(fd, " now : nx_ad_ivt adds aggregate GIVT signals (bot/non-browser UA, datacenter/proxy, raw-JS, missing-ref, impossible-cadence, declared-bot), data-driven; SIVT needs per-user fingerprint we REFUSE (privacy)\n" as *u8) 242 243 xw(fd, " [4] SIGNUP businesses sign up to advertise : " as *u8); ax_level_name(fd, lv[4]) 244 xw(fd, "\n bar : self-serve campaign creation + transparent flat-fee pay-on-results\n" as *u8) 245 xw(fd, " now : nx_ad_intake (advertiser B2B, NO visitor id) + measured head-to-head -- $0-on-miss pay-on-results vs CPM pay-per-impression-regardless [srch_cpm.raw] -> EXCEEDS\n" as *u8) 246 247 xw(fd, " [5] TRANSPARENCY supply-chain trust : " as *u8); ax_level_name(fd, lv[5]) 248 xw(fd, "\n bar : IAB ads.txt DIRECT/RESELLER vs domain spoofing [srch_adstxt.raw]; ours: DIRECT single-sponsor, no reseller chain\n" as *u8) 249 xw(fd, " now : measured head-to-head -- 0 external seller hops (DIRECT single-sponsor) vs incumbent reseller chain [srch_adstxt.raw] -> EXCEEDS\n" as *u8) 250 251 var i: i64 = 0 252 var exc: i64 = 0 253 var sum: i64 = 0 254 while i < 6 { 255 if lv[i] == 5 { exc = exc + 1 } 256 sum = sum + lv[i] 257 i = i + 1 258 } 259 xw(fd, " ---- SUMMARY exceeds=" as *u8); xwn(fd, exc) 260 xw(fd, "/6 level_sum=" as *u8); xwn(fd, sum) 261 xw(fd, "/30 (S-class = ALL 6 EXCEEDS; VIEWABILITY+BOTFILTER held at MEASURED ON PURPOSE -- incumbents match there [Active View / SIVT-via-fingerprinting we refuse], so claiming a beat would be overclaim)\n" as *u8) 262 return 0 263}