nx_ad_intake_gate.nx source

1// nx_ad_intake_gate.nx -- GATE (runnable) for advertiser self-serve signup (nx_ad_intake). Proves: 2// create : a valid campaign returns IN_OK and reads back with business + goal + fee + status 3// liar-kill: every invalid intake is REFUSED with the right code AND not persisted -- 4// unknown goal (-1, absent in store), negative fee (-2), over-ceiling fee (-2), 5// empty business (-3) 6// privacy : the persisted record carries NO site-visitor identity (scan for a visitor token = 0), 7// and the scanner FIRES on a planted token (anti-false-green) -- the LAW made load-bearing 8// Evidence -> knowledge/status/ad_intake.log (INTAKEGATE ... verdict=GREEN). license_tier: ORIGINAL 9import "nx_ad_intake.nx" 10import "nx_ad_store.nx" 11import "nx_syscalls.nx" 12import "nx_gate_verdict.nx" 13 14const IG_LOG: *u8 = "knowledge/status/ad_intake.log" 15 16func ig_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 17func ig_wn(fd: i64, v: i64) -> i64 { let bb: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m; sys_write(fd,"-" as *u8,1)}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=(48+(m%10)) as u8; m=m/10; k=k+1}; var i: i64=0; while i<k {bb[i]=t[k-1-i]; i=i+1}; sys_write(fd, bb, k); return 0 } 18 19// 1 if the campaign record at `key` contains `needle`. 20func ig_record_has(key: *u8, needle: *u8) -> i64 { 21 let pq: *i64 = sys_mmap(16) as *i64 22 let lq: *i64 = sys_mmap(16) as *i64 23 if ads_get(key, pq, lq) != 1 { return 0 } 24 return as_contains(pq[0] as *u8, lq[0], needle) 25} 26 27// 1 if the store currently has a live record for `key`. 28func ig_present(key: *u8) -> i64 { 29 let pq: *i64 = sys_mmap(16) as *i64 30 let lq: *i64 = sys_mmap(16) as *i64 31 if ads_get(key, pq, lq) == 1 { return 1 } 32 return 0 33} 34 35func main() -> i64 { 36 var ok: i64 = 1 37 38 // happy path: a valid campaign is created 39 let rc1: i64 = in_create_campaign("gate-coffee" as *u8, "Acme Coffee" as *u8, "reach" as *u8, 50, "Locally roasted, neighbor-owned." as *u8) 40 if rc1 != 0 { ok = 0 } 41 42 // read-back: the record holds the advertiser data 43 let key1: *u8 = sys_mmap(256) 44 in_campaign_key("gate-coffee" as *u8, key1) 45 let has_biz: i64 = ig_record_has(key1, "Acme Coffee" as *u8) 46 let has_goal: i64 = ig_record_has(key1, "reach" as *u8) 47 let has_status: i64 = ig_record_has(key1, "staging" as *u8) 48 if has_biz != 1 { ok = 0 } 49 if has_goal != 1 { ok = 0 } 50 if has_status != 1 { ok = 0 } 51 52 // privacy LAW: NO visitor identity in the persisted record (we never passed one), AND the scanner 53 // is not stuck-at-0 (it FIRES on a planted token). 54 let leaked: i64 = ig_record_has(key1, "vtok-" as *u8) // expect 0 55 let probe: *u8 = "advertiser data vtok-AAA111 would-be-leak" as *u8 56 let snoop_fires: i64 = as_contains(probe, as_len(probe), "vtok-" as *u8) // expect 1 57 if leaked != 0 { ok = 0 } 58 if snoop_fires != 1 { ok = 0 } 59 60 // LIAR-KILL: invalid intake refused with the right code + not persisted 61 let rc_badgoal: i64 = in_create_campaign("gate-badgoal" as *u8, "Acme" as *u8, "banana" as *u8, 50, "x" as *u8) 62 let keyb: *u8 = sys_mmap(256) 63 in_campaign_key("gate-badgoal" as *u8, keyb) 64 let badgoal_present: i64 = ig_present(keyb) // expect 0 (never persisted) 65 let rc_negfee: i64 = in_create_campaign("gate-negfee" as *u8, "Acme" as *u8, "reach" as *u8, 0 - 5, "x" as *u8) 66 let rc_bigfee: i64 = in_create_campaign("gate-bigfee" as *u8, "Acme" as *u8, "reach" as *u8, 999999999, "x" as *u8) 67 let empty_biz: *u8 = sys_mmap(8) 68 empty_biz[0] = 0 as u8 69 let rc_noname: i64 = in_create_campaign("gate-noname" as *u8, empty_biz, "reach" as *u8, 50, "x" as *u8) 70 71 if rc_badgoal != (0 - 1) { ok = 0 } 72 if badgoal_present != 0 { ok = 0 } 73 if rc_negfee != (0 - 2) { ok = 0 } 74 if rc_bigfee != (0 - 2) { ok = 0 } 75 if rc_noname != (0 - 3) { ok = 0 } 76 77 ig_w(1, "INTAKEGATE authored=organ create=" as *u8); ig_wn(1, rc1) 78 ig_w(1, " has_business=" as *u8); ig_wn(1, has_biz) 79 ig_w(1, " has_goal=" as *u8); ig_wn(1, has_goal) 80 ig_w(1, " badgoal_rc=" as *u8); ig_wn(1, rc_badgoal) 81 ig_w(1, " badgoal_persisted=" as *u8); ig_wn(1, badgoal_present) 82 ig_w(1, " negfee_rc=" as *u8); ig_wn(1, rc_negfee) 83 ig_w(1, " bigfee_rc=" as *u8); ig_wn(1, rc_bigfee) 84 ig_w(1, " noname_rc=" as *u8); ig_wn(1, rc_noname) 85 ig_w(1, " visitor_token_leaked=" as *u8); ig_wn(1, leaked) 86 ig_w(1, " snoop_detector_fired=" as *u8); ig_wn(1, snoop_fires) 87 if ok == 1 { ig_w(1, " verdict=GREEN\n" as *u8) } 88 if ok != 1 { ig_w(1, " verdict=RED\n" as *u8) } 89 90 let lf: i64 = sys_openat_append(IG_LOG, 420) 91 if lf >= 0 { 92 ig_w(lf, "INTAKEGATE authored=organ create=" as *u8); ig_wn(lf, rc1) 93 ig_w(lf, " badgoal_rc=" as *u8); ig_wn(lf, rc_badgoal) 94 ig_w(lf, " badgoal_persisted=" as *u8); ig_wn(lf, badgoal_present) 95 ig_w(lf, " negfee_rc=" as *u8); ig_wn(lf, rc_negfee) 96 ig_w(lf, " bigfee_rc=" as *u8); ig_wn(lf, rc_bigfee) 97 ig_w(lf, " noname_rc=" as *u8); ig_wn(lf, rc_noname) 98 ig_w(lf, " visitor_token_leaked=" as *u8); ig_wn(lf, leaked) 99 if ok == 1 { ig_w(lf, " verdict=GREEN\n" as *u8) } 100 if ok != 1 { ig_w(lf, " verdict=RED\n" as *u8) } 101 sys_close(lf) 102 } 103 104 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 105 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 106 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 107 let ctr__dry: *i64 = gv_ctr() 108 ctr__dry[0] = ok 109 ctr__dry[1] = 1 110 let rc__dry: i64 = gv_verdict("AD-INTAKE-GATE" as *u8, ctr__dry, "teeth unchanged; verdict emission migrated onto the shared base class" as *u8) 111 sys_exit(rc__dry) 112 return rc__dry 113}