nx_brand_manage_gate.nx source

1// nx_brand_manage_gate.nx -- R4 gate: ONE token SSOT, FOUR actors, governance-invariant, no lock-in. 2// DEV (lenient ops) · USER (pack+tweak) · AI/Claude + LOCAL-LLM (strict-guarded untrusted proposal). 3// Proves the invariants that make "manage in lots of ways, NOT lock in" real: same ops -> byte-identical result 4// regardless of actor (pure DATA->DATA); an untrusted proposal can neither INJECT (<script>) nor BREAK the brand 5// (sub-AA); the base is untouched (reversible). 100% sovereign. license_tier: ORIGINAL expect_exit: 0 6import "nx_syscalls.nx" 7import "nx_sitegate_emit_lib.nx" 8import "nx_brand_manage.nx" 9import "nx_brand_tokens.nx" 10 11 12func g_eqn(a: *u8, b: *u8, n: i64) -> i64 { var i: i64=0; while i<n { if a[i]!=b[i] { return 0 } i=i+1 } return 1 } 13// load token value (group/name) from a freshly-applied brand buffer into out 14func g_tok(brand: *u8, bn: i64, group: *u8, name: *u8, out: *u8) -> i64 { return bt_lookup(brand, bn, group, name, out, 64) } 15func inband4(v: i64, lo: i64, hi: i64) -> i64 { if v < lo { return 0 } if v > hi { return 0 } return 1 } 16 17func main() -> i64 { 18 let tot: *i64 = sys_mmap(32) as *i64 19 tot[0]=0; tot[1]=0 20 let base: *u8 = bt_default_brand() 21 let bn: i64 = bt_len(base) 22 let cap: i64 = 8192 23 let r: *u8 = sys_mmap(cap) 24 let val: *u8 = sys_mmap(64) 25 let val2: *u8 = sys_mmap(64) 26 gw("=== nx_brand_manage_gate -- R4 multi-actor brand management (one SSOT, governance-invariant, no lock-in) ===\n" as *u8) 27 28 // T1 DEVELOPER: lenient ops set a token 29 let ops1: *u8 = "set|color|primary|#ff0000\n" as *u8 30 let r1: i64 = bm_apply_ops(base, bn, ops1, bt_len(ops1), r, cap, 0) 31 g_tok(r, r1, "color" as *u8, "primary" as *u8, val) 32 var t1: i64 = 0 33 if r1 > 0 { if nb_streq(val, "#ff0000" as *u8) == 1 { t1 = 1 } } 34 t_row("T1 DEV: ops 'set|color|primary|#ff0000' -> brand primary updated" as *u8, t1, tot) 35 36 // T2 USER (guided): pick a pack, then tweak one token 37 let ops2: *u8 = "pack|ocean\nset|color|accent|#ff8800\n" as *u8 38 let r2: i64 = bm_apply_ops(base, bn, ops2, bt_len(ops2), r, cap, 0) 39 g_tok(r, r2, "color" as *u8, "primary" as *u8, val) 40 g_tok(r, r2, "color" as *u8, "accent" as *u8, val2) 41 var t2: i64 = 0 42 if nb_streq(val, "#0a3d62" as *u8) == 1 { if nb_streq(val2, "#ff8800" as *u8) == 1 { t2 = 1 } } 43 t_row("T2 USER: 'pack|ocean' + tweak -> ocean base (#0a3d62) with accent overridden (#ff8800)" as *u8, t2, tot) 44 45 // T3 NO-LOCK-IN: same ops -> byte-identical output no matter the actor (pure DATA->DATA) 46 let bufA: *u8 = sys_mmap(cap) 47 let bufB: *u8 = sys_mmap(cap) 48 let ra: i64 = bm_apply_ops(base, bn, ops2, bt_len(ops2), bufA, cap, 0) 49 let rb: i64 = bm_apply_ops(base, bn, ops2, bt_len(ops2), bufB, cap, 0) 50 var t3: i64 = 0 51 if ra == rb { if ra > 0 { if g_eqn(bufA, bufB, ra) == 1 { t3 = 1 } } } 52 t_row("T3 NO-LOCK-IN: identical ops -> byte-identical brand regardless of actor (actor-agnostic)" as *u8, t3, tot) 53 54 // T4 AI/LLM sovereignty: an untrusted proposal with <script> is REFUSED (no injection) 55 let opsbad: *u8 = "set|color|x|<script>alert\n" as *u8 56 let r4: i64 = bm_propose(base, bn, opsbad, bt_len(opsbad), r, cap) 57 t_row("T4 AI/LLM sovereignty: <script> proposal REFUSED (-1)" as *u8, inband4(r4, 0-1, 0-1), tot) 58 59 // T5 AI/LLM governance: a proposal that would break brand readability (sub-AA) is REFUSED 60 let opslo: *u8 = "set|color|ink|#cccccc\n" as *u8 61 let r5: i64 = bm_propose(base, bn, opslo, bt_len(opslo), r, cap) 62 t_row("T5 AI/LLM governance: sub-AA proposal REFUSED by the guard (-2)" as *u8, inband4(r5, 0-2, 0-2), tot) 63 64 // T6 AI/LLM good proposal: a safe, on-brand recolor is APPLIED 65 let opsok: *u8 = "set|color|primary|#7a0019\n" as *u8 66 let r6: i64 = bm_propose(base, bn, opsok, bt_len(opsok), r, cap) 67 g_tok(r, r6, "color" as *u8, "primary" as *u8, val) 68 var t6: i64 = 0 69 if r6 > 0 { if nb_streq(val, "#7a0019" as *u8) == 1 { t6 = 1 } } 70 t_row("T6 AI/LLM: a safe on-brand recolor proposal is APPLIED (primary #7a0019)" as *u8, t6, tot) 71 72 // T7 REVERSIBLE: the mutator is pure -- the base brand is never mutated (rollback = keep base) 73 let snap: *u8 = sys_mmap(cap) 74 var i: i64 = 0 75 while i < bn { snap[i] = base[i]; i = i + 1 } 76 bm_apply_ops(base, bn, ops1, bt_len(ops1), r, cap, 0) 77 var t7: i64 = 0 78 if g_eqn(base, snap, bn) == 1 { t7 = 1 } 79 t_row("T7 REVERSIBLE: base brand untouched after an edit (pure -> rollback by construction)" as *u8, t7, tot) 80 81 gw("\nrows pass=" as *u8); gn(tot[0]); gw(" fail=" as *u8); gn(tot[1]); gw("\n" as *u8) 82 if tot[1] == 0 { gw("VERDICT=GREEN -- 4 actors, one governed token SSOT, sovereignty+governance invariant, no lock-in\n" as *u8); return 0 } 83 gw("VERDICT=RED\n" as *u8) 84 return 1 85}