nx_buildecho_gate.nx source
↩ module page · 122 lines · 7722 B
1// nx_buildecho_gate.nx -- BITE-PROVE THE CROSS-TARGET GUARD, BOTH WAYS (2026-08-07, debt 1786128134).
2//
3// The guard this tests is the only thing standing between a wrong-target compile and a wrong organ going
4// live under the right name. It had been written, compiled, and NEVER FIRED.
5// *A GUARD THAT HAS ONLY EVER BEEN COMPILED IS UNVERIFIED, NOT SAFE* -- and a deny-guard that is only
6// ever shown inputs it should refuse passes every test while being wholly broken, which is why T2 and T5
7// exist: they are the inputs it must ALLOW.
8//
9// The fixtures are REAL captures, copied byte-for-byte from what /api/build actually produced today --
10// including the mismatch that started this (asked nx_filecopy, builder echoed nx_seg_store_gate).
11// A fixture invented to suit the parser proves only that the parser suits the fixture.
12// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
13import "nx_buildecho.nx"
14import "nx_gate_verdict.nx"
15
16func bp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
17func bn(v: i64) -> i64 {
18 var m: i64 = v
19 if m < 0 { bp("-" as *u8); m = 0 - m }
20 let t: *u8 = sys_mmap(32)
21 var k: i64 = 0
22 if m == 0 { t[0] = 48 as u8; k = 1 }
23 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
24 let b: *u8 = sys_mmap(32)
25 var i: i64 = 0
26 while i < k { b[i] = t[k-1-i]; i = i + 1 }
27 sys_write(1, b, k)
28 return 0
29}
30func blen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
31func bsame(a: *u8, b: *u8) -> i64 {
32 var i: i64 = 0
33 var go: i64 = 1
34 while go == 1 {
35 let x: i64 = a[i] as i64
36 let y: i64 = b[i] as i64
37 if x != y { return 0 }
38 if x == 0 { go = 0 }
39 i = i + 1
40 }
41 return 1
42}
43
44func main() -> i64 {
45 var pass: i64 = 0
46 var total: i64 = 0
47 let got: *u8 = sys_mmap(512)
48
49 // The REAL capture from the failed build, verbatim.
50 let real_mismatch: *u8 = "[hostctl] buildrun: compile 'nx_seg_store_gate' on the NAS (nx_cc -> nxasm)\n" as *u8
51 let real_match: *u8 = "[hostctl] buildrun: compile 'nx_filecopy' on the NAS (nx_cc -> nxasm)\n" as *u8
52
53 // ---- T1: extracts the name from a REAL capture, and the name is NOT at offset 0
54 total = total + 1
55 var t1: i64 = 0
56 if be_compiled_name(real_mismatch, blen(real_mismatch), got) == 1 {
57 if bsame(got, "nx_seg_store_gate" as *u8) == 1 { t1 = 1 }
58 }
59 if t1 == 1 { pass = pass + 1; bp("T1 GREEN extracted 'nx_seg_store_gate' from a real capture (marker at offset 28, not 0)\n" as *u8) } else { bp("T1 RED got[" as *u8); bp(got); bp("]\n" as *u8) }
60
61 // ---- T2: POSITIVE CONTROL -- the guard must ALLOW a correct build.
62 // *A DENY-GUARD THAT REFUSES EVERYTHING PASSES EVERY NEGATIVE TEST.* Without this tooth a parser that
63 // always returned "mismatch" would score perfectly on T3 and break every build in the estate.
64 total = total + 1
65 if be_echo_matches(real_match, blen(real_match), "nx_filecopy" as *u8) == 1 { pass = pass + 1; bp("T2 GREEN POSITIVE CONTROL: a correct build is ALLOWED (guard does not refuse everything)\n" as *u8) } else { bp("T2 RED the guard refused a CORRECT build -- it would block the whole estate\n" as *u8) }
66
67 // ---- T3: the actual defect -- asked nx_filecopy, builder echoed something else -> MISMATCH
68 total = total + 1
69 if be_echo_matches(real_mismatch, blen(real_mismatch), "nx_filecopy" as *u8) == 0 { pass = pass + 1; bp("T3 GREEN the real cross-target capture is REFUSED against the requested name\n" as *u8) } else { bp("T3 RED the guard accepted a wrong-target compile\n" as *u8) }
70
71 // ---- T4: ABSENCE IS NOT A MISMATCH. No marker -> abstain (0 from be_compiled_name), so a caller
72 // must be able to tell "no evidence" from "contradicted evidence". An older builder that stops
73 // printing this line must not brick every build.
74 let noecho: *u8 = "[hostctl] buildrun: something else entirely\nBUILDRUN OK\n" as *u8
75 total = total + 1
76 if be_compiled_name(noecho, blen(noecho), got) == 0 { pass = pass + 1; bp("T4 GREEN no marker -> ABSTAIN, not accuse\n" as *u8) } else { bp("T4 RED invented a name from a capture with no marker: [" as *u8); bp(got); bp("]\n" as *u8) }
77
78 // ---- T5: PREFIX TRAP. 'nx_filecopy' vs 'nx_filecopy_gate' must NOT be judged equal. A comparison
79 // that stopped at the shorter string would pass T1-T4 and silently accept a sibling target.
80 let prefixy: *u8 = "[hostctl] buildrun: compile 'nx_filecopy_gate' on the NAS\n" as *u8
81 total = total + 1
82 if be_echo_matches(prefixy, blen(prefixy), "nx_filecopy" as *u8) == 0 { pass = pass + 1; bp("T5 GREEN prefix trap refused: 'nx_filecopy_gate' is not 'nx_filecopy'\n" as *u8) } else { bp("T5 RED accepted a PREFIX match -- a sibling target would ship under the wrong name\n" as *u8) }
83
84 // ---- T6: truncated capture (quote never closes) must not overrun or fabricate a match.
85 let trunc: *u8 = "[hostctl] buildrun: compile 'nx_trun" as *u8
86 total = total + 1
87 var t6: i64 = 0
88 if be_compiled_name(trunc, blen(trunc), got) == 1 { if bsame(got, "nx_trun" as *u8) == 1 { t6 = 1 } }
89 if t6 == 1 { pass = pass + 1; bp("T6 GREEN truncated capture yields the partial name, no overrun, no fabrication\n" as *u8) } else { bp("T6 RED truncated capture mishandled: [" as *u8); bp(got); bp("]\n" as *u8) }
90
91 // ---- T7: be_after_hex extracts a full 64-hex digest that is NOT at offset 0
92 let cap1: *u8 = "# some header line\nfiles=77 unresolved=0\nclosure_sha=64fba072c68f5c4f6db85cee9c25c699418e692f30dcf5bb1da02f0eec472716 files=77\n" as *u8
93 total = total + 1
94 var t7: i64 = 0
95 if be_after_hex(cap1, blen(cap1), "closure_sha=" as *u8, got) == 1 {
96 if bsame(got, "64fba072c68f5c4f6db85cee9c25c699418e692f30dcf5bb1da02f0eec472716" as *u8) == 1 { t7 = 1 }
97 }
98 if t7 == 1 { pass = pass + 1; bp("T7 GREEN 64-hex digest extracted from mid-stream\n" as *u8) } else { bp("T7 RED got[" as *u8); bp(got); bp("]\n" as *u8) }
99
100 // ---- T8: ANTI-VACUITY for the digest reader. A TRUNCATED value must be REFUSED, not returned short.
101 // A reader that just copied 64 bytes blindly would pass T7 and publish garbage here; one that accepted
102 // a short value would put an authoritative-looking number on a receipt that identifies nothing.
103 let cap2: *u8 = "closure_sha=64fba072c68f\n" as *u8
104 total = total + 1
105 if be_after_hex(cap2, blen(cap2), "closure_sha=" as *u8, got) == 0 { pass = pass + 1; bp("T8 GREEN truncated digest REFUSED (not published as a digest)\n" as *u8) } else { bp("T8 RED accepted a short value as a 64-hex digest: [" as *u8); bp(got); bp("]\n" as *u8) }
106
107 // ---- T9: absent key -> 0, and the caller then omits the field rather than emitting an empty one.
108 let cap3: *u8 = "files=3 unresolved=0\n" as *u8
109 total = total + 1
110 if be_after_hex(cap3, blen(cap3), "closure_sha=" as *u8, got) == 0 { pass = pass + 1; bp("T9 GREEN absent key -> abstain\n" as *u8) } else { bp("T9 RED invented a digest from a capture with no key\n" as *u8) }
111
112 bp("nx_buildecho_gate " as *u8); bn(pass); bp("/" as *u8); bn(total); bp("\n" as *u8)
113 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check
114 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled
115 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify.
116 let ctr__dry: *i64 = gv_ctr()
117 ctr__dry[0] = pass
118 ctr__dry[1] = total
119 let rc__dry: i64 = gv_verdict("BUILDECHO-GATE" as *u8, ctr__dry, "teeth unchanged; verdict emission migrated onto the shared base class" as *u8)
120 sys_exit(rc__dry)
121 return rc__dry
122}