nx_build_bypass_gate.nx source

1// nx_build_bypass_gate.nx -- R2 of BACKEND-BUILD GOVERNANCE: the NO-BYPASS LAW + audit (PM control-plane), 2// the build-time twin of the publisher's nx_pub_bypass_gate. It disk-WALKS a directory of organs 3// (getdents64, the nx_ws_index_lib idiom) and cross-checks each against the build-registry (br_registered 4// from nx_build_registry_lib): any organ on disk NOT in the registry = a BYPASS (built without registering), 5// unless it is on the ALLOWLIST (exempt infra, the registrar's own analog of allowlisting the publisher). 6// 7// HERMETIC GATE w/ NEGATIVE CONTROL (GREEN means the audit actually discriminates, and the allowlist works): 8// T1 reg=[A,B], C unregistered, no allowlist -> flagged == 1 (only C, the bypass) 9// T2 then register C too -> flagged == 0 (no bypass remains -> responds to state) 10// T3 fresh reg=[A,B], C unregistered, allowlist=[C] -> flagged == 0 (C exempt -> allowlist works) 11// Sovereign: imports nx_build_registry_lib (+ nx_syscalls). license_tier: ORIGINAL expect_exit: 0 12import "nx_build_registry_lib.nx" 13import "nx_syscalls.nx" 14 15func bp(s: *u8) -> i64 { let n: i64 = br_len(s); sys_write(1, s, n); return 0 } 16func bpn(v: i64) -> i64 { 17 let bb: *u8 = sys_mmap(28); var m: i64 = v 18 if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m } 19 let t: *u8 = sys_mmap(28); var k: i64 = 0 20 if m == 0 { t[0] = 48 as u8; k = 1 } 21 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 22 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } 23 sys_write(1, bb, k); return 0 24} 25 26func bga_getdents(fd: i64, buf: *u8, count: i64) -> i64 { return __syscall(217, fd, buf, count, 0, 0, 0) } 27func bga_touch(path: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 420); if fd >= 0 { sys_close(fd) } return 0 } 28func bga_trunc(path: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 420); if fd >= 0 { sys_close(fd) } return 0 } 29 30// name starts with `prefix` AND ends with ".nx" 31func bga_isorgan(name: *u8, prefix: *u8) -> i64 { 32 var i: i64 = 0 33 while prefix[i] != (0 as u8) { if name[i] != prefix[i] { return 0 } i = i + 1 } 34 let n: i64 = br_len(name) 35 if n < 3 { return 0 } 36 if name[n - 3] != (46 as u8) { return 0 } // '.' 37 if name[n - 2] != (110 as u8) { return 0 } // 'n' 38 if name[n - 1] != (120 as u8) { return 0 } // 'x' 39 return 1 40} 41func bga_in_allow(name: *u8, allow: *i64, allow_n: i64) -> i64 { 42 var k: i64 = 0 43 while k < allow_n { if br_streq(name, allow[k] as *u8) == 1 { return 1 } k = k + 1 } 44 return 0 45} 46 47// THE AUDIT: walk `dir`, for each `prefix`*.nx organ not registered and not allowlisted -> flag (bypass). 48// Records flagged name ptrs into flagged_out (copied). Returns the flagged count. 49func bga_audit(dir: *u8, prefix: *u8, registry: *u8, allow: *i64, allow_n: i64, flagged_out: *i64, fcap: i64) -> i64 { 50 let fd: i64 = sys_openat_rd(dir) 51 if fd < 0 { return 0 - 1 } 52 let gbuf: *u8 = sys_mmap(65536) 53 var cnt: i64 = 0 54 var nread: i64 = bga_getdents(fd, gbuf, 65536) 55 while nread > 0 { 56 var off: i64 = 0 57 while off < nread { 58 let reclen: i64 = (gbuf[off + 16] as i64) | ((gbuf[off + 17] as i64) << 8) 59 if reclen <= 0 { off = nread } else { 60 let name: *u8 = ((gbuf as i64) + off + 19) as *u8 61 if bga_isorgan(name, prefix) == 1 { 62 if br_registered(registry, name) == 0 { 63 if bga_in_allow(name, allow, allow_n) == 0 { 64 if cnt < fcap { 65 let nb: *u8 = sys_mmap(128) 66 var c: i64 = 0 67 while name[c] != (0 as u8) { nb[c] = name[c]; c = c + 1 } 68 nb[c] = 0 as u8 69 flagged_out[cnt] = nb as i64 70 } 71 cnt = cnt + 1 72 } 73 } 74 } 75 off = off + reclen 76 } 77 } 78 nread = bga_getdents(fd, gbuf, 65536) 79 } 80 sys_close(fd) 81 return cnt 82} 83 84func main() -> i64 { 85 bp("=== nx_build_bypass_gate: R2 NO-BYPASS LAW + audit (PM control-plane) ===\n" as *u8) 86 let dir: *u8 = "/tmp" as *u8 87 let prefix: *u8 = "__bgaud_organ_" as *u8 88 let reg1: *u8 = "/tmp/__bgaud_reg.log" as *u8 89 let reg2: *u8 = "/tmp/__bgaud_reg2.log" as *u8 90 91 // fixtures: 3 synthetic organs on disk 92 bga_touch("/tmp/__bgaud_organ_A.nx" as *u8) 93 bga_touch("/tmp/__bgaud_organ_B.nx" as *u8) 94 bga_touch("/tmp/__bgaud_organ_C.nx" as *u8) 95 96 // reg1 = A,B registered (C built but NOT registered = a bypass) 97 bga_trunc(reg1) 98 br_submit(reg1, "__bgaud_organ_A.nx" as *u8, "LIB" as *u8, "BUILT" as *u8) 99 br_submit(reg1, "__bgaud_organ_B.nx" as *u8, "LIB" as *u8, "BUILT" as *u8) 100 101 let flagged: *i64 = sys_mmap(8 * 64) as *i64 102 let f1: i64 = bga_audit(dir, prefix, reg1, 0 as *i64, 0, flagged, 64) 103 bp(" T1 (reg=[A,B], no allowlist): flagged=" as *u8); bpn(f1); bp(" (expect 1 = C the bypass)" as *u8) 104 if f1 >= 1 { bp(" first=" as *u8); bp(flagged[0] as *u8) } 105 bp("\n" as *u8) 106 107 // T2: register C -> no bypass remains 108 br_submit(reg1, "__bgaud_organ_C.nx" as *u8, "LIB" as *u8, "BUILT" as *u8) 109 let f2: i64 = bga_audit(dir, prefix, reg1, 0 as *i64, 0, flagged, 64) 110 bp(" T2 (then register C): flagged=" as *u8); bpn(f2); bp(" (expect 0 = audit responds to state)\n" as *u8) 111 112 // T3: fresh reg=[A,B], C unregistered but ALLOWLISTED -> exempt 113 bga_trunc(reg2) 114 br_submit(reg2, "__bgaud_organ_A.nx" as *u8, "LIB" as *u8, "BUILT" as *u8) 115 br_submit(reg2, "__bgaud_organ_B.nx" as *u8, "LIB" as *u8, "BUILT" as *u8) 116 let allow: *i64 = sys_mmap(8 * 4) as *i64 117 allow[0] = "__bgaud_organ_C.nx" as *u8 as i64 118 let f3: i64 = bga_audit(dir, prefix, reg2, allow, 1, flagged, 64) 119 bp(" T3 (reg=[A,B], allowlist=[C]): flagged=" as *u8); bpn(f3); bp(" (expect 0 = allowlist exempts C)\n" as *u8) 120 121 var pass: i64 = 0 122 var ok: i64 = 1 123 if f1 == 1 { pass = pass + 1 } else { ok = 0 } 124 if f2 == 0 { pass = pass + 1 } else { ok = 0 } 125 if f3 == 0 { pass = pass + 1 } else { ok = 0 } 126 127 bp(" RESULT pass=" as *u8); bpn(pass); bp("/3 verdict=" as *u8) 128 if ok == 1 { 129 bp("GREEN (NO-BYPASS audit flags the unregistered build, clears on register, honors the allowlist)\n" as *u8) 130 sys_exit(0); return 0 131 } 132 bp("RED\n" as *u8) 133 sys_exit(1); return 1 134}