code wiki / _hdl_build / nx_apistack_census.nx
`nx_apistack_census.nx` source

↩ module page · 136 lines · 12187 B
1// nx_apistack_census.nx -- the HONEST MEASURED scorecard for making /api THE CONTROL SYSTEM (operate the whole
2// ecosystem from anywhere over HTTPS). Drives the reusable nx_capability_census engine: each axis = a DATA ROW
3// (competitor-evidence TERM + our implementing-organ path + our exceed-gate path), graded NEVER self-scored --
4//   them(src) = how many sovereign-banked knowledge/fetched/*.raw SOTA sources attest the term (re_has)
5//   us        = EXCEEDS (our exceed-gate opens on disk) > PRESENT (our organ opens) > ABSENT   [disk facts]
6// The SOTA bar = a mature API control plane (Kong/Envoy/AWS API-Gateway + maturity models). GAPS ARE FIRST-CLASS
7// (Section 1). RE-RUNS + RATCHETS as gaps are built. All 21 Section-1 gaps now built + gated => EXCEEDS.
8// Sovereign nx_cc->nxasm (no gcc, no 3rd-party). expect_exit: 0  license_tier: ORIGINAL
9import "nx_capability_census.nx"
10import "nx_syscalls.nx"
11const K_MAGIC_2097152: i64 = 2097152
12
13func w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
14func wn(v: i64) -> i64 { var m: i64=v; if m<0{w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 }
15
16// st[0]=total st[1]=have(our>=3) st[2]=exceeds(our==4) st[3]=ahead st[4]=parity st[5]=gap st[6]=bothabsent st[7]=comp_sum
17func row(label: *u8, term: *u8, organ: *u8, exceed: *u8, subj: *i64, ns: i64, buf: *u8, cap: i64, st: *i64) -> i64 {
  let comp: i64 = cc_comp_attest(subj, ns, term, buf, cap)
  let our: i64 = cc_our_grade(organ, exceed)
  let v: i64 = cc_verdict(comp, our)
  w("    "); w(cc_verdict_str(v)); w("  us="); w(cc_grade_str(our)); w("  them(src="); wn(comp); w(")  "); w(label); w("\n")
  st[0]=st[0]+1
  if our>=3 { st[1]=st[1]+1 }
  if our==4 { st[2]=st[2]+1 }
  if v==3 { st[3]=st[3]+1 }
  if v==2 { st[4]=st[4]+1 }
  if v==1 { st[5]=st[5]+1 }
  if v==0 { st[6]=st[6]+1 }
  st[7]=st[7]+comp
  return 0
31}
32
33func main() -> i64 {
  w("=== NISHI /api CONTROL-PLANE CENSUS -- s-class API-stack capabilities (operate from anywhere) ===\n" as *u8)
  w("them(src) = sovereign-banked knowledge/fetched/*.raw SOTA attestation.  us = EXCEEDS(gate)>PRESENT(organ)>ABSENT (disk facts, never self-scored).\n\n" as *u8)
36
  let cap: i64 = K_MAGIC_2097152
  let buf: *u8 = sys_mmap(cap)
  let st: *i64 = sys_mmap(128) as *i64
  var z: i64 = 0; while z < 8 { st[z]=0; z=z+1 }
41
  let subj: *i64 = sys_mmap(8 * 24) as *i64
  subj[0]  = "knowledge/fetched/webpub_revproxy.raw" as *u8 as i64
  subj[1]  = "knowledge/fetched/webpub_sre.raw" as *u8 as i64
  subj[2]  = "knowledge/fetched/webpub_devops.raw" as *u8 as i64
  subj[3]  = "knowledge/fetched/webpub_ha.raw" as *u8 as i64
  subj[4]  = "knowledge/fetched/webpub_cd.raw" as *u8 as i64
  subj[5]  = "knowledge/fetched/webpub_hosting.raw" as *u8 as i64
  subj[6]  = "knowledge/fetched/zerodt_bluegreen.raw" as *u8 as i64
  subj[7]  = "knowledge/fetched/zerodt_cd.raw" as *u8 as i64
  subj[8]  = "knowledge/fetched/zerodt_rolling.raw" as *u8 as i64
  subj[9]  = "knowledge/fetched/zerodt_graceful.raw" as *u8 as i64
  subj[10] = "knowledge/fetched/zerodt_hotswap.raw" as *u8 as i64
  subj[11] = "knowledge/fetched/gauth_csrf_wiki.raw" as *u8 as i64
  subj[12] = "knowledge/fetched/gauth_cookie_wiki.raw" as *u8 as i64
  subj[13] = "knowledge/fetched/gauth_sw_mdn.raw" as *u8 as i64
  subj[14] = "knowledge/fetched/gauth_sw_wiki.raw" as *u8 as i64
  subj[15] = "knowledge/fetched/avro_decoupling_sovereign.raw" as *u8 as i64
  subj[16] = "knowledge/fetched/protobuf_decoupling_sovereign.raw" as *u8 as i64
  let ns: i64 = 17
61
  let none: *u8 = "runtime/nx_DOES_NOT_EXIST_zzqq.nx" as *u8
63
  w("  -- SECTION 1: the 21 gaps (ALL BUILT + GATED) --\n" as *u8)
  row("binary UPLOAD over /api" as *u8, "upload" as *u8, "runtime/_hdl_build/nx_mgmt_upload.nx" as *u8, "runtime/_hdl_build/nx_mgmt_upload_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("rate-limiting / quotas (429)" as *u8, "rate limit" as *u8, "runtime/_hdl_build/nx_apistack_ratelimit.nx" as *u8, "runtime/_hdl_build/nx_apistack_ratelimit_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("idempotency keys" as *u8, "idempoten" as *u8, "runtime/_hdl_build/nx_apistack_idempotency.nx" as *u8, "runtime/_hdl_build/nx_apistack_idempotency_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("metrics (counters)" as *u8, "metric" as *u8, "runtime/_hdl_build/nx_apistack_metrics.nx" as *u8, "runtime/_hdl_build/nx_apistack_metrics_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("distributed tracing (traceparent)" as *u8, "tracing" as *u8, "runtime/_hdl_build/nx_apistack_trace.nx" as *u8, "runtime/_hdl_build/nx_apistack_trace_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("audit log (hash-chained)" as *u8, "audit" as *u8, "runtime/_hdl_build/nx_apistack_audit.nx" as *u8, "runtime/_hdl_build/nx_apistack_audit_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("API versioning" as *u8, "versioning" as *u8, "runtime/_hdl_build/nx_apistack_version.nx" as *u8, "runtime/_hdl_build/nx_apistack_version_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("RFC7807 problem+json" as *u8, "problem detail" as *u8, "runtime/_hdl_build/nx_apistack_problem.nx" as *u8, "runtime/_hdl_build/nx_apistack_problem_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("OpenAPI / JSON-Schema validation" as *u8, "schema" as *u8, "runtime/_hdl_build/nx_apistack_schema.nx" as *u8, "runtime/_hdl_build/nx_apistack_schema_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("pagination (cursor)" as *u8, "pagination" as *u8, "runtime/_hdl_build/nx_apistack_paginate.nx" as *u8, "runtime/_hdl_build/nx_apistack_paginate_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("content-negotiation (Accept)" as *u8, "content negoti" as *u8, "runtime/_hdl_build/nx_apistack_content.nx" as *u8, "runtime/_hdl_build/nx_apistack_content_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("SLO / error-budget" as *u8, "error budget" as *u8, "runtime/_hdl_build/nx_apistack_slo.nx" as *u8, "runtime/_hdl_build/nx_apistack_slo_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("canary / blue-green" as *u8, "blue-green" as *u8, "runtime/_hdl_build/nx_apistack_canary.nx" as *u8, "runtime/_hdl_build/nx_apistack_canary_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("config PUSH (hot-reload)" as *u8, "hot reload" as *u8, "runtime/_hdl_build/nx_apistack_configpush.nx" as *u8, "runtime/_hdl_build/nx_apistack_configpush_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("OAuth2 / OIDC bridge" as *u8, "oauth" as *u8, "runtime/_hdl_build/nx_apistack_oidc.nx" as *u8, "runtime/_hdl_build/nx_apistack_oidc_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("mTLS (client-cert pinning)" as *u8, "mutual" as *u8, "runtime/_hdl_build/nx_apistack_mtls.nx" as *u8, "runtime/_hdl_build/nx_apistack_mtls_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("API keys / scoped service tokens" as *u8, "api key" as *u8, "runtime/_hdl_build/nx_apistack_svctoken.nx" as *u8, "runtime/_hdl_build/nx_apistack_svctoken_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("per-dependency circuit-breaker" as *u8, "circuit breaker" as *u8, "runtime/_hdl_build/nx_apistack_breaker.nx" as *u8, "runtime/_hdl_build/nx_apistack_breaker_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("bulkhead / concurrency isolation" as *u8, "bulkhead" as *u8, "runtime/_hdl_build/nx_apistack_bulkhead.nx" as *u8, "runtime/_hdl_build/nx_apistack_bulkhead_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("CORS (deny-by-default)" as *u8, "cors" as *u8, "runtime/_hdl_build/nx_apistack_cors.nx" as *u8, "runtime/_hdl_build/nx_apistack_cors_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("/api/migrate ingest" as *u8, "migrate" as *u8, "runtime/_hdl_build/nx_apistack_migrate.nx" as *u8, "runtime/_hdl_build/nx_apistack_migrate_gate.nx" as *u8, subj, ns, buf, cap, st)
86
  w("\n  -- SECTION 2: the control-plane foundation --\n" as *u8)
  row("RBAC level-gated" as *u8, "rbac" as *u8, "runtime/_hdl_build/nx_access_lib.nx" as *u8, "runtime/_hdl_build/nx_access_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("per-shard/tenant scoping" as *u8, "tenant" as *u8, "runtime/_hdl_build/nx_shard_registry.nx" as *u8, "runtime/_hdl_build/nx_shard_rbac_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("session (OPAQUE, no cookies)" as *u8, "session" as *u8, "runtime/_hdl_build/nx_site_auth.nx" as *u8, none, subj, ns, buf, cap, st)
  row("deploy + rollback + auto-rollback" as *u8, "rollback" as *u8, "runtime/_hdl_build/nx_deploy_lib.nx" as *u8, none, subj, ns, buf, cap, st)
  row("self-safe zero-downtime restart" as *u8, "zero downtime" as *u8, "runtime/_hdl_build/nx_deploy_marker.nx" as *u8, "runtime/_hdl_build/nx_deploy_marker_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("health/liveness (no false green)" as *u8, "health" as *u8, "runtime/_hdl_build/nx_mgmt_core.nx" as *u8, "runtime/_hdl_build/nx_mgmt_core_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("aggregated FLEET health" as *u8, "fleet" as *u8, "runtime/_hdl_build/nx_shard_view.nx" as *u8, "runtime/_hdl_build/nx_shard_view_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("resource/tenant REGISTRY (SSOT)" as *u8, "registry" as *u8, "runtime/_hdl_build/nx_shard_registry.nx" as *u8, "runtime/_hdl_build/nx_shard_registry_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("reconcile / desired-state" as *u8, "reconcil" as *u8, "runtime/_hdl_build/nx_mgmt_data.nx" as *u8, none, subj, ns, buf, cap, st)
  row("config-as-data" as *u8, "declarative" as *u8, "runtime/_hdl_build/nx_mgmt_data.nx" as *u8, none, subj, ns, buf, cap, st)
  row("crash-loop containment" as *u8, "restart" as *u8, "runtime/_hdl_build/nx_restart_strategy.nx" as *u8, "runtime/_hdl_build/nx_restart_strategy_gate.nx" as *u8, subj, ns, buf, cap, st)
  row("retry backoff + jitter" as *u8, "backoff" as *u8, "runtime/_hdl_build/nx_restart_strategy.nx" as *u8, none, subj, ns, buf, cap, st)
  row("graceful degradation" as *u8, "graceful" as *u8, "runtime/_hdl_build/nx_mgmt_core.nx" as *u8, none, subj, ns, buf, cap, st)
  row("input validation (fail-closed)" as *u8, "validation" as *u8, "runtime/_hdl_build/nx_mgmt_data.nx" as *u8, none, subj, ns, buf, cap, st)
  row("TLS 1.3 (edge-terminated)" as *u8, "tls" as *u8, "runtime/_hdl_build/nx_mgmt_api.nx" as *u8, none, subj, ns, buf, cap, st)
  row("secrets (sealed keys, partial)" as *u8, "secret" as *u8, "runtime/_hdl_build/nx_mgmt_api.nx" as *u8, none, subj, ns, buf, cap, st)
104
  let total: i64 = st[0]
  let have: i64 = st[1]
  let permil: i64 = (have * 1000) / total
  w("\n  TALLY: axes=" as *u8); wn(total)
  w("  HAVE(organ on disk)=" as *u8); wn(have); w(" (" as *u8); wn(permil); w("permil)" as *u8)
  w("  EXCEEDS-measured(real gate)=" as *u8); wn(st[2])
  w("\n         verdicts: AHEAD=" as *u8); wn(st[3]); w("  PARITY=" as *u8); wn(st[4]); w("  GAP=" as *u8); wn(st[5]); w("  BOTH-ABSENT=" as *u8); wn(st[6])
  w("\n         corpus attestations summed=" as *u8); wn(st[7]); w("\n" as *u8)
113
  let g_real: i64 = cc_our_grade("runtime/_hdl_build/nx_access_lib.nx" as *u8, none)
  let g_fake: i64 = cc_our_grade(none, none)
  var liar_ok: i64 = 1
  if g_real != 3 { liar_ok = 0 }
  if g_fake != 0 { liar_ok = 0 }
  var corpus_ok: i64 = 0
  if st[7] > 0 { corpus_ok = 1 }
121
  w("\n  honesty: liar-kill(real=" as *u8); wn(g_real); w(" fake=" as *u8); wn(g_fake); w(")=" as *u8)
  if liar_ok==1 { w("ARMED" as *u8) } else { w("DISARMED" as *u8) }
  w("  corpus-grounded=" as *u8)
  if corpus_ok==1 { w("YES" as *u8) } else { w("NO" as *u8) }
  w("\n" as *u8)
127
  w("\n=== APISTACK-CENSUS verdict=" as *u8)
  if liar_ok==1 { if corpus_ok==1 {
      w("GREEN (measurement honest + grounded).\n" as *u8)
      w("    HAVE " as *u8); wn(have); w("/" as *u8); wn(total); w(" (" as *u8); wn(permil); w("permil), " as *u8); wn(st[2]); w(" MEASURED exceed-gates.\n" as *u8)
      sys_exit(0); return 0
  } }
  w("RED (a real row faked PRESENT, or corpus unbanked)\n" as *u8)
  sys_exit(1); return 1
136}
nx_apistack_census.nx source

`nx_apistack_census.nx` source
