nx_barcheck.nx source

1// nx_barcheck.nx -- THE CITATION-ROT WATCHER (debt 1785822056). 2// 3// WHY THIS EXISTS, measured not guessed: on 2026-08-04 two comparison pages were caught carrying claims 4// about OTHER people's software that had silently decayed -- 5// ecosysdesign cited a propagation-cost band whose upper bound appears in NO cited source (1785817918) 6// genealogy cited jscpd v5.0.12 and dependency-cruiser v18.0.0; both had moved (5.0.14 / 18.1.1) in 25 days 7// Both were found only because a human-directed evidence run happened to re-read them. ~41 compare 8// matrices carry the same exposure and NOTHING WATCHED THEM. 9// AN EVIDENCE PROGRAM THAT ONLY CHECKS *OUR* CODE IS HALF A PROGRAM: the claims we make about OTHERS 10// decay too, and faster -- their release cadence is not ours to control. 11// 12// WHAT IT DOES: re-reads every declared version bar from the RIVAL PROJECT'S OWN registry over the 13// sovereign TLS lane, diffs against the banked value, and goes RED when a bar has rotted. Data-driven 14// (rule 11): the bars live in knowledge/barcheck.conf, never in this code. 15// row: <domain>|<label>|<kind npm or gh>|<id>|<banked-version> 16// npm -> registry.npmjs.org/<id>/latest key version 17// gh -> api.github.com/repos/<id>/releases/latest key tag_name 18// UNAUTHENTICATED BY DESIGN: this reads public release metadata only. The estate's GitHub PAT is an open 19// sev-9 (1785769931) and must never be spent on a job that does not need it. 20// 21// NON-VACUITY IS STRUCTURAL, NOT ASSERTED: T4/T5 are gv_bite cells. T4 re-checks a REAL row against a 22// deliberately corrupted banked value and REQUIRES the stale detector to fire on it while staying silent 23// on the true value. T5 REQUIRES a fabricated package to come back UNREACHABLE while a real one resolves. 24// A checker that cannot report STALE cannot report FRESH. 25// 26// expect_exit: 0 license_tier: ORIGINAL No hw writes (Rule 26). 27import "nx_syscalls.nx" 28import "nx_estate_path.nx" // ep_anchor: the CWD must not decide this organ's verdict 29import "nx_gate_verdict.nx" 30import "nx_x509_trust_store.nx" 31import "nx_trust_store_load_from_certdata.nx" 32import "nx_https_fetch_follow.nx" 33import "nx_gzip_wrap.nx" 34 35const BK_CERTS: i64 = 512 36const BK_STORECAP: i64 = 4194304 37const BK_FETCHCAP: i64 = 4194304 38const BK_GZOUT: i64 = 8388608 39const BK_MAXROWS: i64 = 64 40const BK_FIELD: i64 = 192 41const BK_HOPS: i64 = 8 42const BK_OUTBUF: i64 = 32768 43const BK_QUOTE: i64 = 34 44const BK_COLON: i64 = 58 45const BK_SPACE: i64 = 32 46const BK_PIPE: i64 = 124 47const BK_NL: i64 = 10 48const BK_HASH: i64 = 35 49 50func bk_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 51func bk_nl() -> i64 { let b: *u8 = sys_mmap(8); b[0] = BK_NL as u8; sys_write(1, b, 1); return 0 } 52func bk_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 53func bk_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; var p: i64 = o; while s[i] != (0 as u8) { d[p] = s[i]; p = p + 1; i = i + 1 } return p } 54 55func bk_eq(a: *u8, b: *u8) -> i64 { 56 var i: i64 = 0 57 while a[i] != (0 as u8) { 58 if a[i] != b[i] { return 0 } 59 i = i + 1 60 } 61 if b[i] == (0 as u8) { return 1 } 62 return 0 63} 64 65func bk_find(hay: *u8, n: i64, needle: *u8) -> i64 { 66 let m: i64 = bk_len(needle) 67 if m <= 0 { return 0 - 1 } 68 var i: i64 = 0 69 while i + m <= n { 70 var j: i64 = 0 71 var hit: i64 = 1 72 while j < m { if hay[i + j] != needle[j] { hit = 0; j = m } else { j = j + 1 } } 73 if hit == 1 { return i } 74 i = i + 1 75 } 76 return 0 - 1 77} 78 79// Extract the quoted string that follows a JSON key. 80// TOLERANT OF WHITESPACE AFTER THE COLON ON PURPOSE: npm emits version:x with no space and GitHub emits 81// tag_name: x with one. A parser that assumed one shape would silently read nothing on the other, and a 82// missing version would look like an unreachable host -- two different failures wearing one face. 83func bk_json_str(buf: *u8, n: i64, key: *u8, out: *u8, cap: i64) -> i64 { 84 let pat: *u8 = sys_mmap(BK_FIELD) 85 var p: i64 = 0 86 pat[p] = BK_QUOTE as u8 87 p = p + 1 88 var k: i64 = 0 89 while key[k] != (0 as u8) { pat[p] = key[k]; p = p + 1; k = k + 1 } 90 pat[p] = BK_QUOTE as u8 91 p = p + 1 92 pat[p] = 0 as u8 93 let at: i64 = bk_find(buf, n, pat) 94 if at < 0 { return 0 } 95 var i: i64 = at + p 96 var scanning: i64 = 1 97 while scanning == 1 { 98 if i >= n { return 0 } 99 if buf[i] == (BK_COLON as u8) { scanning = 0; i = i + 1 } 100 else { 101 if buf[i] == (BK_SPACE as u8) { i = i + 1 } else { return 0 } 102 } 103 } 104 scanning = 1 105 while scanning == 1 { 106 if i >= n { return 0 } 107 if buf[i] == (BK_SPACE as u8) { i = i + 1 } else { scanning = 0 } 108 } 109 if buf[i] != (BK_QUOTE as u8) { return 0 } 110 i = i + 1 111 var o: i64 = 0 112 scanning = 1 113 while scanning == 1 { 114 if i >= n { return 0 } 115 if buf[i] == (BK_QUOTE as u8) { scanning = 0 } 116 else { 117 if o + 1 < cap { out[o] = buf[i]; o = o + 1 } 118 i = i + 1 119 } 120 } 121 out[o] = 0 as u8 122 if o <= 0 { return 0 } 123 return 1 124} 125 126// Fetch one bar's CURRENT version from the rival's own registry. 127// Returns 1 = read a version into out, 0 = unreachable or unparseable. The caller must NOT conflate the 128// two with fresh: an unread bar is UNKNOWN, never OK -- that is how a silent outage becomes a false green. 129func bk_fetch_version(kind: *u8, id: *u8, store: *TrustStore, page: *u8, out: *u8) -> i64 { 130 let url: *u8 = sys_mmap(BK_FIELD * 4) 131 var o: i64 = 0 132 var isnpm: i64 = 0 133 if bk_eq(kind, "npm" as *u8) == 1 { isnpm = 1 } 134 if isnpm == 1 { 135 o = bk_cat(url, o, "https://registry.npmjs.org/" as *u8) 136 o = bk_cat(url, o, id) 137 o = bk_cat(url, o, "/latest" as *u8) 138 } else { 139 o = bk_cat(url, o, "https://api.github.com/repos/" as *u8) 140 o = bk_cat(url, o, id) 141 o = bk_cat(url, o, "/releases/latest" as *u8) 142 } 143 url[o] = 0 as u8 144 let st: *i64 = sys_mmap(16) as *i64 145 st[0] = 0 146 var n: i64 = nx_https_fetch_follow(url, store, page, BK_FETCHCAP, BK_HOPS, st) 147 if st[0] != 200 { return 0 } 148 if n < 8 { return 0 } 149 // INFLATE: both registries advertise gzip and nx_codec_caps asks for it. The 2026-08-03 crawler defect 150 // (tokenising gzip wire bytes as text) is the same class -- decompress before parsing, always. 151 if page[0] == (31 as u8) { 152 if page[1] == (139 as u8) { 153 let gr: *NxGzipResult = nx_gzip_inflate(page, n, BK_GZOUT) 154 if gr.error_code != 0 { return 0 } 155 if gr.output_size <= 0 { return 0 } 156 var gn: i64 = gr.output_size 157 if gn > BK_FETCHCAP { gn = BK_FETCHCAP } 158 let gd: *u8 = gr.output_data 159 var gc: i64 = 0 160 while gc < gn { page[gc] = gd[gc]; gc = gc + 1 } 161 n = gn 162 } 163 } 164 // ⚠THE FIRST MATCH IS NOT THE RIGHT MATCH. v1 searched for the key `version` and on dependency-cruiser 165 // read back `npm-run-all --node-run build depcruise:graph:doc scm:stage` -- because an npm package may 166 // declare a LIFECYCLE SCRIPT named `version` inside `scripts`, and that object comes first in the blob. 167 // The checker's own first run caught it: a bar it had itself verified minutes earlier came back STALE 168 // with a shell command as the live value. A flat substring scan has no notion of nesting, so anchor on 169 // a field that cannot collide: npm's `_id` is exactly `<name>@<version>` at the document root. 170 // Fall back to `version` only if `_id` is absent, and take the text after the LAST @ so scoped 171 // packages (@scope/name@1.2.3) resolve correctly too. 172 if isnpm == 1 { 173 let idb: *u8 = sys_mmap(BK_FIELD) 174 if bk_json_str(page, n, "_id" as *u8, idb, BK_FIELD) == 1 { 175 var lastat: i64 = 0 - 1 176 var z: i64 = 0 177 while idb[z] != (0 as u8) { if idb[z] == (64 as u8) { lastat = z } z = z + 1 } 178 if lastat >= 0 { 179 var w: i64 = 0 180 var y: i64 = lastat + 1 181 while idb[y] != (0 as u8) { out[w] = idb[y]; w = w + 1; y = y + 1 } 182 out[w] = 0 as u8 183 if w > 0 { return 1 } 184 } 185 } 186 return bk_json_str(page, n, "version" as *u8, out, BK_FIELD) 187 } 188 return bk_json_str(page, n, "tag_name" as *u8, out, BK_FIELD) 189} 190 191func main(argc: i64, argv: *i64) -> i64 { 192 // ANCHOR FIRST (2026-08-04): run from buildroot this organ read an EMPTY/absent estate 193 // and fail-closed RED (or, worse, appended to a SECOND store). Its subject is the 194 // estate, so the caller's working directory must not decide its verdict. 195 ep_anchor() 196 let ctr: *i64 = gv_ctr() 197 gv_head("NX-BARCHECK -- do our published claims about OTHER projects still hold?" as *u8) 198 199 let sr: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt" as *u8, BK_CERTS, BK_STORECAP) 200 if sr <= 0 { bk_puts("REJECT: trust store load failed" as *u8); bk_nl(); return 2 } 201 let store: *TrustStore = sr as *TrustStore 202 203 let lp: *i64 = sys_mmap(16) as *i64 204 lp[0] = 0 205 let conf: *u8 = sys_read_file("knowledge/barcheck.conf" as *u8, lp) 206 let cn: i64 = lp[0] 207 let dom: *u8 = sys_mmap(BK_MAXROWS * BK_FIELD) 208 let lab: *u8 = sys_mmap(BK_MAXROWS * BK_FIELD) 209 let knd: *u8 = sys_mmap(BK_MAXROWS * BK_FIELD) 210 let ids: *u8 = sys_mmap(BK_MAXROWS * BK_FIELD) 211 let bnk: *u8 = sys_mmap(BK_MAXROWS * BK_FIELD) 212 var rows: i64 = 0 213 if cn > 0 { 214 var ls: i64 = 0 215 var i: i64 = 0 216 while i <= cn { 217 var eol: i64 = 0 218 if i == cn { eol = 1 } else { if conf[i] == (BK_NL as u8) { eol = 1 } } 219 if eol == 1 { 220 if i > ls { 221 if conf[ls] != (BK_HASH as u8) { 222 if rows < BK_MAXROWS { 223 var f: i64 = 0 224 var w: i64 = 0 225 var q: i64 = ls 226 while q < i { 227 if conf[q] == (BK_PIPE as u8) { 228 if f == 0 { dom[rows * BK_FIELD + w] = 0 as u8 } 229 if f == 1 { lab[rows * BK_FIELD + w] = 0 as u8 } 230 if f == 2 { knd[rows * BK_FIELD + w] = 0 as u8 } 231 if f == 3 { ids[rows * BK_FIELD + w] = 0 as u8 } 232 f = f + 1 233 w = 0 234 } else { 235 if w + 1 < BK_FIELD { 236 if f == 0 { dom[rows * BK_FIELD + w] = conf[q] } 237 if f == 1 { lab[rows * BK_FIELD + w] = conf[q] } 238 if f == 2 { knd[rows * BK_FIELD + w] = conf[q] } 239 if f == 3 { ids[rows * BK_FIELD + w] = conf[q] } 240 if f == 4 { bnk[rows * BK_FIELD + w] = conf[q] } 241 w = w + 1 242 } 243 } 244 q = q + 1 245 } 246 if f == 4 { 247 bnk[rows * BK_FIELD + w] = 0 as u8 248 rows = rows + 1 249 } 250 } 251 } 252 } 253 ls = i + 1 254 } 255 i = i + 1 256 } 257 } 258 259 let page: *u8 = sys_mmap(BK_FETCHCAP) 260 let cur: *u8 = sys_mmap(BK_FIELD) 261 let rep: *u8 = sys_mmap(BK_OUTBUF) 262 var ro: i64 = 0 263 var okc: i64 = 0 264 var stale: i64 = 0 265 var unreach: i64 = 0 266 267 var r: i64 = 0 268 while r < rows { 269 let d: *u8 = ((dom as i64) + r * BK_FIELD) as *u8 270 let l: *u8 = ((lab as i64) + r * BK_FIELD) as *u8 271 let kk: *u8 = ((knd as i64) + r * BK_FIELD) as *u8 272 let ii: *u8 = ((ids as i64) + r * BK_FIELD) as *u8 273 let bb: *u8 = ((bnk as i64) + r * BK_FIELD) as *u8 274 let got: i64 = bk_fetch_version(kk, ii, store, page, cur) 275 bk_puts(" " as *u8); bk_puts(d); bk_puts(" / " as *u8); bk_puts(l); bk_puts(": " as *u8) 276 ro = bk_cat(rep, ro, d); ro = bk_cat(rep, ro, "|" as *u8); ro = bk_cat(rep, ro, l); ro = bk_cat(rep, ro, "|" as *u8) 277 if got == 0 { 278 unreach = unreach + 1 279 bk_puts("UNREACHABLE banked=" as *u8); bk_puts(bb); bk_nl() 280 ro = bk_cat(rep, ro, "UNREACHABLE|banked=" as *u8); ro = bk_cat(rep, ro, bb) 281 } else { 282 if bk_eq(cur, bb) == 1 { 283 okc = okc + 1 284 bk_puts("OK " as *u8); bk_puts(cur); bk_nl() 285 ro = bk_cat(rep, ro, "OK|" as *u8); ro = bk_cat(rep, ro, cur) 286 } else { 287 stale = stale + 1 288 bk_puts("STALE banked=" as *u8); bk_puts(bb); bk_puts(" live=" as *u8); bk_puts(cur); bk_nl() 289 ro = bk_cat(rep, ro, "STALE|banked=" as *u8); ro = bk_cat(rep, ro, bb) 290 ro = bk_cat(rep, ro, "|live=" as *u8); ro = bk_cat(rep, ro, cur) 291 } 292 } 293 rep[ro] = BK_NL as u8 294 ro = ro + 1 295 r = r + 1 296 } 297 298 bk_nl() 299 var t1: i64 = 0 300 if rows > 0 { t1 = 1 } 301 gv_check("T1 barcheck.conf declares at least one version bar" as *u8, t1, ctr) 302 var t2: i64 = 0 303 if unreach == 0 { t2 = 1 } 304 gv_check("T2 every declared bar was READ from its own registry (unreachable=0)" as *u8, t2, ctr) 305 var t3: i64 = 0 306 if stale == 0 { t3 = 1 } 307 gv_check("T3 no published bar has rotted (stale=0)" as *u8, t3, ctr) 308 309 var bad4: i64 = 0 310 var good4: i64 = 1 311 if rows > 0 { 312 let kk0: *u8 = knd as *u8 313 let ii0: *u8 = ids as *u8 314 if bk_fetch_version(kk0, ii0, store, page, cur) == 1 { 315 let fake: *u8 = sys_mmap(BK_FIELD) 316 var fo: i64 = bk_cat(fake, 0, cur) 317 fake[fo] = 90 as u8 318 fo = fo + 1 319 fake[fo] = 0 as u8 320 if bk_eq(cur, fake) == 0 { bad4 = 1 } 321 if bk_eq(cur, cur) == 1 { good4 = 0 } 322 } 323 } 324 gv_bite("T4 stale detector fires on a corrupted bar and not on the true one" as *u8, bad4, good4, ctr) 325 326 var bad5: i64 = 0 327 var good5: i64 = 1 328 if bk_fetch_version("npm" as *u8, "nishi-negctl-package-that-does-not-exist-1785853" as *u8, store, page, cur) == 0 { bad5 = 1 } 329 if bk_fetch_version("npm" as *u8, "jscpd" as *u8, store, page, cur) == 1 { good5 = 0 } 330 gv_bite("T5 fabricated package reads UNREACHABLE while a real one resolves" as *u8, bad5, good5, ctr) 331 332 let vb: *u8 = sys_mmap(BK_OUTBUF) 333 var vo: i64 = 0 334 vo = bk_cat(vb, vo, "rows=" as *u8); vo = gv_catn(vb, vo, rows) 335 vo = bk_cat(vb, vo, " ok=" as *u8); vo = gv_catn(vb, vo, okc) 336 vo = bk_cat(vb, vo, " stale=" as *u8); vo = gv_catn(vb, vo, stale) 337 vo = bk_cat(vb, vo, " unreachable=" as *u8); vo = gv_catn(vb, vo, unreach) 338 vb[vo] = BK_NL as u8 339 vo = vo + 1 340 var c2: i64 = 0 341 while c2 < ro { vb[vo] = rep[c2]; vo = vo + 1; c2 = c2 + 1 } 342 let fd: i64 = sys_openat_wr("knowledge/status/barcheck.verdict" as *u8, 0x1a4) 343 if fd >= 0 { sys_write(fd, vb, vo); sys_close(fd) } 344 345 return gv_verdict("NX-BARCHECK" as *u8, ctr, "published version bars re-read from the rivals own registries" as *u8) 346}