nx_ad_ivt_gate.nx source

1// nx_ad_ivt_gate.nx -- GATE (runnable) for the strengthened IVT classifier (nx_ad_ivt). Seeds the 2// richer GIVT rule set into the sovereign store (adcfg:ivtrules, additive + idempotent), then proves: 3// load : >=8 rules across 6 signal fields load from the store (data-driven, rule 11) 4// signals : EACH GIVT signal flags invalid -- known-bot UA, non-browser UA, data-center ASN, 5// proxy/VPN, raw-JS, missing-referrer, impossible-cadence, declared-bot 6// clean : a clean human vector is VALID (the filter is not stuck-at-invalid: anti-false-green) 7// tally : a mixed corpus separates exactly (served=100 -> valid=70, invalid=30), aggregate-only 8// richer : rule count strictly exceeds the legacy 3-signal nx_ad_botfilter set 9// Evidence -> knowledge/status/ad_ivt.log (IVTGATE ... verdict=GREEN). license_tier: ORIGINAL 10import "nx_ad_ivt.nx" 11import "nx_ad_store.nx" 12import "nx_seg_store.nx" 13import "nx_syscalls.nx" 14 15const IVG_LOG: *u8 = "knowledge/status/ad_ivt.log" 16const IVT_KEY: *u8 = "adcfg:ivtrules" 17const IVT_RULES: *u8 = "0\t1\tIVT-UA-KNOWNBOT\n0\t2\tIVT-UA-NONBROWSER\n1\t1\tIVT-SRC-DATACENTER\n1\t2\tIVT-SRC-PROXY\n2\t1\tIVT-JS-RAW\n3\t1\tIVT-REF-MISSING\n4\t1\tIVT-CADENCE-IMPOSSIBLE\n5\t1\tIVT-DECLARED-BOT\n" 18 19func ivg_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 20func ivg_wn(fd: i64, v: i64) -> i64 { let bb: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m; sys_write(fd,"-" as *u8,1)}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=(48+(m%10)) as u8; m=m/10; k=k+1}; var i: i64=0; while i<k {bb[i]=t[k-1-i]; i=i+1}; sys_write(fd, bb, k); return 0 } 21func ivg_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 22 23func ivg_streq_store(key: *u8, val: *u8) -> i64 { 24 let pq: *i64 = sys_mmap(16) as *i64 25 let lq: *i64 = sys_mmap(16) as *i64 26 if ads_get(key, pq, lq) != 1 { return 0 } 27 let b: *u8 = pq[0] as *u8 28 let n: i64 = lq[0] 29 let vl: i64 = ivg_len(val) 30 if n != vl { return 0 } 31 var i: i64 = 0 32 while i < n { if b[i] != val[i] { return 0 } i = i + 1 } 33 return 1 34} 35 36// build a 6-field vector with fields[idx]=val (rest 0) and return iv_invalid. 37func ivg_probe(idx: i64, val: i64, rules: *i64, nrules: i64) -> i64 { 38 let f: *i64 = sys_mmap(8 * 8) as *i64 39 var i: i64 = 0 40 while i < 6 { f[i] = 0; i = i + 1 } 41 f[idx] = val 42 return iv_invalid(f, 6, rules, nrules) 43} 44 45func main() -> i64 { 46 // seed the richer rule set additively (idempotent, rule 10/13) 47 var seeded: i64 = 0 48 if ivg_streq_store(IVT_KEY, IVT_RULES) == 0 { 49 let w: *i64 = ss_begin() 50 ss_add(w, 1, IVT_KEY, IVT_RULES, ivg_len(IVT_RULES)) 51 let segid: i64 = ads_seg_next() 52 let rc: i64 = ss_commit(ADS_PREFIX, w, segid) 53 if rc == 0 { seeded = 1 } 54 } 55 56 let rules: *i64 = sys_mmap(8 * 64) as *i64 57 let nrules: i64 = iv_load_rules(IVT_KEY, rules, 32) 58 59 // each GIVT signal must flag invalid 60 let s_uabot: i64 = ivg_probe(0, 1, rules, nrules) 61 let s_uanonb: i64 = ivg_probe(0, 2, rules, nrules) 62 let s_dc: i64 = ivg_probe(1, 1, rules, nrules) 63 let s_proxy: i64 = ivg_probe(1, 2, rules, nrules) 64 let s_rawjs: i64 = ivg_probe(2, 1, rules, nrules) 65 let s_noref: i64 = ivg_probe(3, 1, rules, nrules) 66 let s_cadence: i64 = ivg_probe(4, 1, rules, nrules) 67 let s_declared:i64 = ivg_probe(5, 1, rules, nrules) 68 // clean human vector must be VALID (anti-false-green) 69 let s_clean: i64 = ivg_probe(0, 0, rules, nrules) 70 71 // mixed corpus tally [c0..c5, n] 72 let ov: *i64 = sys_mmap(8) as *i64 73 let oi: *i64 = sys_mmap(8) as *i64 74 let ev: *i64 = sys_mmap(8 * 7 * 5) as *i64 75 ev[0]=0; ev[1]=0; ev[2]=0; ev[3]=0; ev[4]=0; ev[5]=0; ev[6]=70 // clean human -> 70 valid 76 ev[7]=1; ev[8]=0; ev[9]=0; ev[10]=0; ev[11]=0; ev[12]=0; ev[13]=10 // bot UA -> 10 invalid 77 ev[14]=0; ev[15]=1; ev[16]=0; ev[17]=0; ev[18]=0; ev[19]=0; ev[20]=8 // datacenter -> 8 invalid 78 ev[21]=0; ev[22]=0; ev[23]=0; ev[24]=1; ev[25]=0; ev[26]=0; ev[27]=7 // missing ref -> 7 invalid 79 ev[28]=0; ev[29]=0; ev[30]=0; ev[31]=0; ev[32]=1; ev[33]=0; ev[34]=5 // impossible cadence -> 5 invalid 80 iv_tally(ev, 5, 6, rules, nrules, ov, oi) 81 let valid: i64 = ov[0] // expect 70 82 let invalid: i64 = oi[0] // expect 30 83 84 var ok: i64 = 1 85 if nrules < 8 { ok = 0 } 86 if s_uabot != 1 { ok = 0 } 87 if s_uanonb != 1 { ok = 0 } 88 if s_dc != 1 { ok = 0 } 89 if s_proxy != 1 { ok = 0 } 90 if s_rawjs != 1 { ok = 0 } 91 if s_noref != 1 { ok = 0 } 92 if s_cadence != 1 { ok = 0 } 93 if s_declared != 1 { ok = 0 } 94 if s_clean != 0 { ok = 0 } 95 if valid != 70 { ok = 0 } 96 if invalid != 30 { ok = 0 } 97 98 ivg_w(1, "IVTGATE authored=organ source=store seeded=" as *u8); ivg_wn(1, seeded) 99 ivg_w(1, " rules=" as *u8); ivg_wn(1, nrules) 100 ivg_w(1, " signals[uabot,nonbrowser,datacenter,proxy,rawjs,noref,cadence,declared]=" as *u8) 101 ivg_wn(1, s_uabot); ivg_wn(1, s_uanonb); ivg_wn(1, s_dc); ivg_wn(1, s_proxy); ivg_wn(1, s_rawjs); ivg_wn(1, s_noref); ivg_wn(1, s_cadence); ivg_wn(1, s_declared) 102 ivg_w(1, " clean_valid=" as *u8); ivg_wn(1, s_clean) 103 ivg_w(1, " mixed_valid=" as *u8); ivg_wn(1, valid) 104 ivg_w(1, " mixed_invalid=" as *u8); ivg_wn(1, invalid) 105 if ok == 1 { ivg_w(1, " verdict=GREEN\n" as *u8) } 106 if ok != 1 { ivg_w(1, " verdict=RED\n" as *u8) } 107 108 let lf: i64 = sys_openat_append(IVG_LOG, 420) 109 if lf >= 0 { 110 ivg_w(lf, "IVTGATE authored=organ source=store seeded=" as *u8); ivg_wn(lf, seeded) 111 ivg_w(lf, " rules=" as *u8); ivg_wn(lf, nrules) 112 ivg_w(lf, " mixed_valid=" as *u8); ivg_wn(lf, valid) 113 ivg_w(lf, " mixed_invalid=" as *u8); ivg_wn(lf, invalid) 114 if ok == 1 { ivg_w(lf, " verdict=GREEN\n" as *u8) } 115 if ok != 1 { ivg_w(lf, " verdict=RED\n" as *u8) } 116 sys_close(lf) 117 } 118 119 if ok == 1 { return 0 } 120 return 1 121}