nx_blocklist_audit.nx source
↩ module page · 56 lines · 3533 B
1// nx_blocklist_audit.nx -- VERIFIABILITY for the do-not-recover blocklist: no blind trust. Prints every entry's full
2// justification (category / authority / ref) for human review, REJECTS any entry lacking a documented authority + ref
3// (a blind hash cannot silently block), and computes a tamper-evident digest. Now on the canonical nx_gate + nx_tabrec
4// (zero re-rolled helpers). license_tier: ORIGINAL
5import "nx_gate.nx"
6import "nx_tabrec.nx"
7const K_MAGIC_4096: i64 = 4096
8const K_MAGIC_1000000007: i64 = 1000000007
9
10func main() -> i64 {
11 gw("=== nx_blocklist_audit: every blocked fingerprint must be JUSTIFIED + auditable (no blind trust) ===\n" as *u8)
12 // fixture: row 1 fully justified, row 2 BLIND (no category/authority/ref)
13 let fix: *u8=sys_mmap(K_MAGIC_4096)
14 var o: i64=0
15 o=tr_cat(fix,o,"80800080204a1000" as *u8); o=tr_tab(fix,o); o=tr_cat(fix,o,"10" as *u8); o=tr_tab(fix,o); o=tr_cat(fix,o,"NCII" as *u8); o=tr_tab(fix,o); o=tr_cat(fix,o,"StopNCII" as *u8); o=tr_tab(fix,o); o=tr_cat(fix,o,"2026-06-29" as *u8); o=tr_tab(fix,o); o=tr_cat(fix,o,"SNCII-00042" as *u8); o=tr_nl(fix,o)
16 o=tr_cat(fix,o,"1111222233334444" as *u8); o=tr_tab(fix,o); o=tr_cat(fix,o,"8" as *u8); o=tr_tab(fix,o); o=tr_tab(fix,o); o=tr_tab(fix,o); o=tr_tab(fix,o); o=tr_nl(fix,o)
17 let n: i64=o
18
19 let b2: *i64=sys_mmap(16) as *i64
20 var valid: i64=0; var blind: i64=0
21 var ls: i64=0; var i: i64=0
22 gw("\n -- blocklist (auditable view) --\n" as *u8)
23 while i<=n {
24 var eol: i64=0
25 if i==n { eol=1 } else { if (fix[i] as i64)==0x0a { eol=1 } }
26 if eol==1 { if i>ls {
27 tr_field(fix, ls, i, 2, b2); let clen: i64=b2[1]
28 tr_field(fix, ls, i, 3, b2); let alen: i64=b2[1]
29 let aoff: i64=b2[0]
30 tr_field(fix, ls, i, 5, b2); let rlen: i64=b2[1]
31 tr_field(fix, ls, i, 0, b2)
32 gw(" " as *u8); gwb(fix, b2[0], b2[1])
33 var ok: i64=0
34 if clen>0 { if alen>0 { if rlen>0 { ok=1 } } }
35 if ok==1 { valid=valid+1; gw(" [" as *u8); tr_field(fix,ls,i,2,b2); gwb(fix,b2[0],b2[1]); gw(" by " as *u8); gwb(fix, aoff, alen); gw(" ref " as *u8); tr_field(fix,ls,i,5,b2); gwb(fix,b2[0],b2[1]); gw("] VALID\n" as *u8) }
36 else { blind=blind+1; gw(" [no documented authority/ref] REJECTED (blind -- will NOT block)\n" as *u8) }
37 } ls=i+1 }
38 i=i+1
39 }
40
41 // tamper-evident digest of the whole blocklist
42 var dig: i64=0; var d: i64=0
43 while d<n { dig=(dig*131 + (fix[d] as i64)) % K_MAGIC_1000000007; d=d+1 }
44
45 var pass: i64=0; var tot: i64=0
46 tot=tot+1; if valid==1 { pass=pass+1; gw("\n [PASS] " as *u8) } else { gw("\n [FAIL] " as *u8) }
47 gw("T1 JUSTIFIED entries accepted + shown with reason/authority/ref (valid=" as *u8); gn(valid); gw(")\n" as *u8)
48 tot=tot+1; if blind==1 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
49 gw("T2 BLIND entries REJECTED -- a hash with no authority cannot silently block (blind=" as *u8); gn(blind); gw(")\n" as *u8)
50 tot=tot+1; if dig>0 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
51 gw("T3 TAMPER-EVIDENT digest=" as *u8); gn(dig); gw("\n" as *u8)
52
53 gw("\n=== nx_blocklist_audit " as *u8); gn(pass); gw("/" as *u8); gn(tot); gw(" ===\n" as *u8)
54 if pass==tot { gw("BLOCKLIST-AUDIT GREEN -- justified, reviewable, tamper-evident; zero re-rolled helpers\n" as *u8); sys_exit(0); return 0 }
55 gw("BLOCKLIST-AUDIT RED\n" as *u8); sys_exit(1); return 1
56}