nx_adversarial_pattern_audit_test.nx source
↩ module page · 168 lines · 8100 B
1// nx_adversarial_pattern_audit_test.nx -- end-to-end smoke.
2//
3// Exercises:
4// 1. nx_apa_count_substring on canned needle/haystack pairs
5// (positive + negative + multi-match + edge cases)
6// 2. nx_apa_scan_file_returns on three known runtime files via
7// sys_read_file:
8// a) runtime/nx_canary_value.nx (FULLY_WIRED, 0 STUB)
9// b) runtime/nx_threat_model.nx (FULLY_WIRED, 0 STUB)
10// c) runtime/nx_adversarial_pattern_audit.nx (self-scan;
11// file MUST contain its own NX_APA_STUB_NOT_WIRED
12// sealed-enum decl + verdict_name resolver)
13// 3. nx_apa_judge_file_consistency on each scan -> CONSISTENT.
14
15// Match the audit primitive's syscall module (see header note
16// in nx_adversarial_pattern_audit.nx for the double-define
17// constraint).
18import "nx_syscalls.nx"
19import "nx_adversarial_pattern_audit.nx"
20
21const NX_TEST_NOW_UNIX: i64 = 1747436400
22
23// ===== Substring sanity tests =====================================
24
25func test_count_substring() -> i64 {
26 // Haystack: "abcabcabc"
27 let hay: *u8 = sys_mmap(16)
28 hay[0] = 0x61; hay[1] = 0x62; hay[2] = 0x63 // "abc"
29 hay[3] = 0x61; hay[4] = 0x62; hay[5] = 0x63 // "abc"
30 hay[6] = 0x61; hay[7] = 0x62; hay[8] = 0x63 // "abc"
31 hay[9] = 0
32
33 // Needle "abc" -> 3 matches (non-overlapping convention: scan
34 // increments by 1, finds all overlapping; here no overlap.)
35 let n1: *u8 = sys_mmap(8)
36 n1[0] = 0x61; n1[1] = 0x62; n1[2] = 0x63; n1[3] = 0
37 let c1: i64 = nx_apa_count_substring(hay, 9, n1, 3)
38 if c1 != 3 { return 1 }
39
40 // Needle "z" -> 0
41 let n2: *u8 = sys_mmap(8)
42 n2[0] = 0x7a; n2[1] = 0
43 let c2: i64 = nx_apa_count_substring(hay, 9, n2, 1)
44 if c2 != 0 { return 2 }
45
46 // Needle "abcd" (longer than any substring in haystack) -> 0
47 let n3: *u8 = sys_mmap(8)
48 n3[0] = 0x61; n3[1] = 0x62; n3[2] = 0x63; n3[3] = 0x64; n3[4] = 0
49 let c3: i64 = nx_apa_count_substring(hay, 9, n3, 4)
50 if c3 != 0 { return 3 }
51
52 // Empty needle -> 0 (guard)
53 let n4: *u8 = sys_mmap(8)
54 n4[0] = 0
55 let c4: i64 = nx_apa_count_substring(hay, 9, n4, 0)
56 if c4 != 0 { return 4 }
57
58 // Overlapping pattern: "aaa" in "aaaa" -> 2 (positions 0 and 1).
59 let hay2: *u8 = sys_mmap(8)
60 hay2[0] = 0x61; hay2[1] = 0x61; hay2[2] = 0x61; hay2[3] = 0x61; hay2[4] = 0
61 let n5: *u8 = sys_mmap(8)
62 n5[0] = 0x61; n5[1] = 0x61; n5[2] = 0x61; n5[3] = 0
63 let c5: i64 = nx_apa_count_substring(hay2, 4, n5, 3)
64 if c5 != 2 { return 5 }
65
66 return 0
67}
68
69// ===== Path constructors ==========================================
70
71func make_path_canary(out: *u8) {
72 // "runtime/nx_canary_value.nx\0"
73 out[0] = 0x72; out[1] = 0x75; out[2] = 0x6e; out[3] = 0x74 // runt
74 out[4] = 0x69; out[5] = 0x6d; out[6] = 0x65; out[7] = 0x2f // ime/
75 out[8] = 0x6e; out[9] = 0x78; out[10] = 0x5f; out[11] = 0x63 // nx_c
76 out[12] = 0x61; out[13] = 0x6e; out[14] = 0x61; out[15] = 0x72 // anar
77 out[16] = 0x79; out[17] = 0x5f; out[18] = 0x76; out[19] = 0x61 // y_va
78 out[20] = 0x6c; out[21] = 0x75; out[22] = 0x65; out[23] = 0x2e // lue.
79 out[24] = 0x6e; out[25] = 0x78; out[26] = 0 // nx\0
80}
81
82func make_path_threat(out: *u8) {
83 // "runtime/nx_threat_model.nx\0"
84 out[0] = 0x72; out[1] = 0x75; out[2] = 0x6e; out[3] = 0x74 // runt
85 out[4] = 0x69; out[5] = 0x6d; out[6] = 0x65; out[7] = 0x2f // ime/
86 out[8] = 0x6e; out[9] = 0x78; out[10] = 0x5f; out[11] = 0x74 // nx_t
87 out[12] = 0x68; out[13] = 0x72; out[14] = 0x65; out[15] = 0x61 // hrea
88 out[16] = 0x74; out[17] = 0x5f; out[18] = 0x6d; out[19] = 0x6f // t_mo
89 out[20] = 0x64; out[21] = 0x65; out[22] = 0x6c; out[23] = 0x2e // del.
90 out[24] = 0x6e; out[25] = 0x78; out[26] = 0 // nx\0
91}
92
93func make_path_apa(out: *u8) {
94 // "runtime/nx_adversarial_pattern_audit.nx\0" (length 39)
95 out[0] = 0x72; out[1] = 0x75; out[2] = 0x6e; out[3] = 0x74 // runt
96 out[4] = 0x69; out[5] = 0x6d; out[6] = 0x65; out[7] = 0x2f // ime/
97 out[8] = 0x6e; out[9] = 0x78; out[10] = 0x5f; out[11] = 0x61 // nx_a
98 out[12] = 0x64; out[13] = 0x76; out[14] = 0x65; out[15] = 0x72 // dver
99 out[16] = 0x73; out[17] = 0x61; out[18] = 0x72; out[19] = 0x69 // sari
100 out[20] = 0x61; out[21] = 0x6c; out[22] = 0x5f; out[23] = 0x70 // al_p
101 out[24] = 0x61; out[25] = 0x74; out[26] = 0x74; out[27] = 0x65 // atte
102 out[28] = 0x72; out[29] = 0x6e; out[30] = 0x5f; out[31] = 0x61 // rn_a
103 out[32] = 0x75; out[33] = 0x64; out[34] = 0x69; out[35] = 0x74 // udit
104 out[36] = 0x2e; out[37] = 0x6e; out[38] = 0x78; out[39] = 0 // .nx\0
105}
106
107func scan_path(path: *u8, path_len: i64) -> *ApaFileScanCounts {
108 let len_box: *u8 = sys_mmap(8)
109 let lp: *i64 = len_box as *i64
110 let bytes: *u8 = sys_read_file(path, lp)
111 if bytes == 0 as *u8 { return 0 as *ApaFileScanCounts }
112 return nx_apa_scan_file_returns(path, path_len, bytes, *lp, NX_TEST_NOW_UNIX)
113}
114
115// ===== Main ========================================================
116
117func main() -> i64 {
118 let sub_err: i64 = test_count_substring()
119 if sub_err != 0 { return __syscall(93, sub_err, 0, 0, 0, 0, 0) }
120
121 // ----- canary_value scan (FULLY_WIRED, 0 stub markers) ----
122 let path_c: *u8 = sys_mmap(32)
123 make_path_canary(path_c)
124 let sc: *ApaFileScanCounts = scan_path(path_c, 26)
125 if sc == 0 as *ApaFileScanCounts { return __syscall(93, 10, 0, 0, 0, 0, 0) }
126 if sc.verdict != NX_APA_OK { return __syscall(93, 11, 0, 0, 0, 0, 0) }
127 if sc.n_header_fully_wired < 1 { return __syscall(93, 12, 0, 0, 0, 0, 0) }
128 if sc.n_stub_not_wired_markers != 0 { return __syscall(93, 13, 0, 0, 0, 0, 0) }
129 if sc.n_func_decls < 5 { return __syscall(93, 14, 0, 0, 0, 0, 0) }
130 if sc.n_return_nx < 5 { return __syscall(93, 15, 0, 0, 0, 0, 0) }
131 let jc: i64 = nx_apa_judge_file_consistency(sc)
132 if jc != NX_APA_CONSISTENCY_CONSISTENT { return __syscall(93, 16, 0, 0, 0, 0, 0) }
133
134 // ----- threat_model scan (FULLY_WIRED, 0 stub markers) ----
135 let path_t: *u8 = sys_mmap(32)
136 make_path_threat(path_t)
137 let st: *ApaFileScanCounts = scan_path(path_t, 26)
138 if st == 0 as *ApaFileScanCounts { return __syscall(93, 20, 0, 0, 0, 0, 0) }
139 if st.verdict != NX_APA_OK { return __syscall(93, 21, 0, 0, 0, 0, 0) }
140 if st.n_header_fully_wired < 1 { return __syscall(93, 22, 0, 0, 0, 0, 0) }
141 if st.n_stub_not_wired_markers != 0 { return __syscall(93, 23, 0, 0, 0, 0, 0) }
142 let jt: i64 = nx_apa_judge_file_consistency(st)
143 if jt != NX_APA_CONSISTENCY_CONSISTENT { return __syscall(93, 24, 0, 0, 0, 0, 0) }
144
145 // ----- adversarial_pattern_audit self-scan ----------------
146 let path_a: *u8 = sys_mmap(48)
147 make_path_apa(path_a)
148 let sa: *ApaFileScanCounts = scan_path(path_a, 39)
149 if sa == 0 as *ApaFileScanCounts { return __syscall(93, 30, 0, 0, 0, 0, 0) }
150 if sa.verdict != NX_APA_OK { return __syscall(93, 31, 0, 0, 0, 0, 0) }
151 // Self-scan: must include the sealed-enum decl + the verdict_name
152 // resolver branches; at least 5 STUB markers expected.
153 if sa.n_stub_not_wired_markers < 5 { return __syscall(93, 32, 0, 0, 0, 0, 0) }
154 if sa.n_header_fully_wired < 1 { return __syscall(93, 33, 0, 0, 0, 0, 0) }
155 // The self-scan SHOULD register as CONSISTENT under the heuristic:
156 // it declares FULLY_WIRED in the canonical header (and possibly
157 // mentions PARTIAL_WIRED elsewhere in commentary).
158 let ja: i64 = nx_apa_judge_file_consistency(sa)
159 if ja != NX_APA_CONSISTENCY_CONSISTENT { return __syscall(93, 34, 0, 0, 0, 0, 0) }
160
161 // ----- Determinism: re-scanning yields equal counts -------
162 let sc2: *ApaFileScanCounts = scan_path(path_c, 26)
163 if sc2.n_stub_not_wired_markers != sc.n_stub_not_wired_markers { return __syscall(93, 40, 0, 0, 0, 0, 0) }
164 if sc2.n_header_fully_wired != sc.n_header_fully_wired { return __syscall(93, 41, 0, 0, 0, 0, 0) }
165 if sc2.n_func_decls != sc.n_func_decls { return __syscall(93, 42, 0, 0, 0, 0, 0) }
166
167 return 0
168}