nx_cam_chaturbate_gate.nx source
↩ module page · 229 lines · 11403 B
1// nx_cam_chaturbate_gate.nx -- REFEREE for nx_cam_chaturbate (/compare/mediaingest R9 lr_watch, site half).
2//
3// NO NETWORK, BY CONSTRUCTION. Every fixture host is under the reserved .invalid TLD and nothing is
4// ever fetched: the whole subject under test is the adapter's PURE decision core -- the state
5// machine, the JSON field reader and the CMAF rewrite -- so a flaky exit IP or an offline room can
6// never make this gate red, and a green here is never evidence that the live endpoint answered.
7// The live half (one real resolve against one real room) is a separate, declared step and is NOT
8// claimed by this gate.
9//
10// The teeth that matter most are the three the incumbent recorder paid for in production:
11// - a PUBLIC room with an EMPTY url is RESTRICTED, not PUBLIC (else the capture path is handed an
12// empty input and retries forever);
13// - 403 is RATELIMIT, not ERROR (else fast retries lengthen a Cloudflare block);
14// - an unrecognised room_status lands in UNKNOWN and NEVER in a known bucket.
15// license_tier: ORIGINAL
16import "nx_syscalls.nx"
17import "nx_cam_chaturbate.nx"
18import "nx_gate_verdict.nx"
19
20const G_BUFCAP: i64 = 1024
21
22// A planted ajax response, byte-for-byte the shape the endpoint returns.
23const G_JSON_PUBLIC: *u8 = "{\"room_status\": \"public\", \"url\": \"https://edge1.example.invalid/live-abc/amlst:xyz/playlist.m3u8?tkn=1\", \"cmaf_edge\": true}"
24const G_JSON_RESTRICTED: *u8 = "{\"room_status\": \"public\", \"url\": \"\", \"cmaf_edge\": false}"
25const G_JSON_OFFLINE: *u8 = "{\"room_status\": \"offline\", \"url\": \"\"}"
26
27const G_URL_IN: *u8 = "https://edge1.example.invalid/live-abc/amlst:xyz/playlist.m3u8?tkn=1"
28const G_URL_CMAF: *u8 = "https://edge1.example.invalid/live-c-fhls/amlst:xyz/playlist_sfm4s.m3u8?tkn=1"
29const G_URL_PLAIN: *u8 = "https://edge1.example.invalid/hls/stream.ts"
30
31const G_HTTP_200: i64 = 200
32const G_HTTP_403: i64 = 403
33const G_HTTP_404: i64 = 404
34const G_HTTP_429: i64 = 429
35const G_HTTP_503: i64 = 503
36const G_HTTP_418: i64 = 418 // an unmapped status: must land in UNKNOWN, not in a known bucket
37
38const G_URLLEN_PRESENT: i64 = 40 // any non-zero: the DECISION keys on presence, never on length
39const G_URLLEN_EMPTY: i64 = 0
40
41func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
42
43// byte-exact compare of buf[off..off+len) against a literal
44func g_eqs(buf: *u8, off: i64, len: i64, lit: *u8) -> i64 {
45 let ll: i64 = g_slen(lit)
46 if len != ll { return 0 }
47 var i: i64 = 0
48 var same: i64 = 1
49 while i < len { if buf[off + i] != lit[i] { same = 0 } i = i + 1 }
50 return same
51}
52
53// does buf contain lit? used ONLY by the anti-vacuity teeth
54func g_has(buf: *u8, n: i64, lit: *u8) -> i64 {
55 let ll: i64 = g_slen(lit)
56 var i: i64 = 0
57 while i + ll <= n {
58 var same: i64 = 1
59 var j: i64 = 0
60 while j < ll { if buf[i + j] != lit[j] { same = 0 } j = j + 1 }
61 if same == 1 { return 1 }
62 i = i + 1
63 }
64 return 0
65}
66
67// cb_decide takes the room_status as (buffer, offset, length); the gate plants it as a bare literal
68func g_decide_lit(status: i64, rs: *u8, url_len: i64) -> i64 {
69 return cb_decide(status, rs, 0, g_slen(rs), url_len)
70}
71
72func main() -> i64 {
73 gv_head("=== nx_cam_chaturbate_gate -- chaturbate adapter decision core (mediaingest R9) ===" as *u8)
74 let c: *i64 = gv_ctr()
75
76 // ---- ANTI-VACUITY FIRST: prove the fixtures actually carry what the teeth below look for, so a
77 // fixture that silently lost its tokens cannot make the rest of this gate pass by examining nothing.
78 let jn: i64 = g_slen(G_JSON_PUBLIC)
79 var fixture_ok: i64 = 0
80 if g_has(G_JSON_PUBLIC, jn, "room_status" as *u8) == 1 {
81 if g_has(G_JSON_PUBLIC, jn, "cmaf_edge" as *u8) == 1 {
82 if g_has(G_JSON_PUBLIC, jn, "playlist.m3u8" as *u8) == 1 { fixture_ok = 1 }
83 }
84 }
85 gv_check("fixture-reached-the-condition-json-carries-status-cmaf-and-playlist-token" as *u8, fixture_ok, c)
86 var url_fixture_ok: i64 = 0
87 if g_has(G_URL_IN, g_slen(G_URL_IN), "live-" as *u8) == 1 {
88 if g_has(G_URL_IN, g_slen(G_URL_IN), "amlst" as *u8) == 1 { url_fixture_ok = 1 }
89 }
90 gv_check("fixture-reached-the-condition-url-carries-both-cmaf-rewrite-tokens" as *u8, url_fixture_ok, c)
91
92 // ---- the state machine ----
93 var t: i64 = 0
94 if g_decide_lit(G_HTTP_200, "public" as *u8, G_URLLEN_PRESENT) == CB_PUBLIC { t = 1 }
95 gv_check("public-room-with-a-url-is-PUBLIC" as *u8, t, c)
96
97 // THE ONE THE INCUMBENT PAID FOR: public + empty url = geo/age-restricted for this exit IP.
98 t = 0
99 if g_decide_lit(G_HTTP_200, "public" as *u8, G_URLLEN_EMPTY) == CB_RESTRICTED { t = 1 }
100 gv_check("public-room-with-an-EMPTY-url-is-RESTRICTED-not-PUBLIC" as *u8, t, c)
101
102 t = 0
103 if g_decide_lit(G_HTTP_200, "private" as *u8, G_URLLEN_PRESENT) == CB_PRIVATE { t = 1 }
104 gv_check("private-room-is-PRIVATE" as *u8, t, c)
105 t = 0
106 if g_decide_lit(G_HTTP_200, "hidden" as *u8, G_URLLEN_PRESENT) == CB_HIDDEN { t = 1 }
107 gv_check("hidden-room-is-HIDDEN" as *u8, t, c)
108 t = 0
109 if g_decide_lit(G_HTTP_200, "offline" as *u8, G_URLLEN_EMPTY) == CB_OFFLINE { t = 1 }
110 gv_check("offline-room-is-OFFLINE" as *u8, t, c)
111 t = 0
112 if g_decide_lit(G_HTTP_200, "PUBLIC" as *u8, G_URLLEN_PRESENT) == CB_PUBLIC { t = 1 }
113 gv_check("room-status-match-is-case-insensitive" as *u8, t, c)
114
115 // ---- transport verdicts ----
116 t = 0
117 if g_decide_lit(G_HTTP_429, "public" as *u8, G_URLLEN_PRESENT) == CB_RATELIMIT { t = 1 }
118 gv_check("429-is-RATELIMIT" as *u8, t, c)
119 t = 0
120 if g_decide_lit(G_HTTP_503, "public" as *u8, G_URLLEN_PRESENT) == CB_RATELIMIT { t = 1 }
121 gv_check("5xx-is-RATELIMIT" as *u8, t, c)
122 // 403 on this endpoint is a Cloudflare challenge. Classing it ERROR produces fast retries that
123 // make the block longer -- the measured reason the incumbent demoted it to the backoff cadence.
124 t = 0
125 if g_decide_lit(G_HTTP_403, "public" as *u8, G_URLLEN_PRESENT) == CB_RATELIMIT { t = 1 }
126 gv_check("403-challenge-is-RATELIMIT-not-a-fast-retryable-error" as *u8, t, c)
127 t = 0
128 if g_decide_lit(G_HTTP_404, "public" as *u8, G_URLLEN_PRESENT) == CB_NOTEXIST { t = 1 }
129 gv_check("404-is-NOTEXIST" as *u8, t, c)
130
131 // ORDER: a transport verdict is decided BEFORE the body is trusted at all. The 403 fixture
132 // carries a perfectly good "public" status and a url; it must STILL read RATELIMIT.
133 t = 0
134 if g_decide_lit(G_HTTP_403, "public" as *u8, G_URLLEN_PRESENT) != CB_PUBLIC { t = 1 }
135 gv_check("transport-verdict-precedes-the-body-a-403-carrying-a-public-body-is-never-PUBLIC" as *u8, t, c)
136
137 // ---- neg-controls: the unknown bucket ----
138 t = 0
139 if g_decide_lit(G_HTTP_200, "banana" as *u8, G_URLLEN_PRESENT) == CB_UNKNOWN { t = 1 }
140 gv_check("neg-control-unrecognised-room-status-is-UNKNOWN-never-a-known-bucket" as *u8, t, c)
141 t = 0
142 if g_decide_lit(G_HTTP_418, "public" as *u8, G_URLLEN_PRESENT) == CB_UNKNOWN { t = 1 }
143 gv_check("neg-control-unmapped-http-status-is-UNKNOWN" as *u8, t, c)
144 t = 0
145 if cb_decide(G_HTTP_200, "public" as *u8, 0, 0, G_URLLEN_PRESENT) == CB_UNKNOWN { t = 1 }
146 gv_check("neg-control-empty-room-status-is-UNKNOWN" as *u8, t, c)
147
148 // ---- the scheduling predicates ----
149 t = 0
150 if cb_is_recordable(CB_PUBLIC) == 1 { t = 1 }
151 gv_check("PUBLIC-is-recordable" as *u8, t, c)
152 t = 0
153 if cb_is_recordable(CB_RESTRICTED) == 0 { t = 1 }
154 gv_check("neg-control-RESTRICTED-is-NOT-recordable" as *u8, t, c)
155 t = 0
156 if cb_is_recordable(CB_PRIVATE) == 0 { t = 1 }
157 gv_check("neg-control-PRIVATE-is-NOT-recordable" as *u8, t, c)
158 t = 0
159 if cb_should_backoff(CB_RATELIMIT) == 1 { if cb_should_backoff(CB_WALL) == 1 { t = 1 } }
160 gv_check("RATELIMIT-and-WALL-both-back-off" as *u8, t, c)
161 t = 0
162 if cb_should_backoff(CB_OFFLINE) == 0 { t = 1 }
163 gv_check("neg-control-OFFLINE-does-not-back-off" as *u8, t, c)
164 t = 0
165 if cb_state_is_valid(CB_STATE_N) == 0 { if cb_state_is_valid(CB_PUBLIC) == 1 { t = 1 } }
166 gv_check("neg-control-state-bounds-reject-the-sentinel-and-accept-a-real-state" as *u8, t, c)
167
168 // ---- the JSON field reader, against the planted ajax body ----
169 let off: *i64 = sys_mmap(G_BUFCAP) as *i64
170 let rl: i64 = cb_field(G_JSON_PUBLIC, jn, "room_status" as *u8, off)
171 t = 0
172 if rl > 0 { if g_eqs(G_JSON_PUBLIC, off[0], rl, "public" as *u8) == 1 { t = 1 } }
173 gv_check("json-reader-extracts-room-status-byte-exact" as *u8, t, c)
174
175 let ul: i64 = cb_field(G_JSON_PUBLIC, jn, "url" as *u8, off)
176 t = 0
177 if ul > 0 { if g_eqs(G_JSON_PUBLIC, off[0], ul, G_URL_IN) == 1 { t = 1 } }
178 gv_check("json-reader-extracts-the-full-tokenised-url-byte-exact" as *u8, t, c)
179
180 let rn: i64 = g_slen(G_JSON_RESTRICTED)
181 let ul2: i64 = cb_field(G_JSON_RESTRICTED, rn, "url" as *u8, off)
182 t = 0
183 if ul2 == 0 { t = 1 }
184 gv_check("json-reader-reports-an-empty-url-as-length-zero-not-as-absent" as *u8, t, c)
185
186 t = 0
187 if cb_field(G_JSON_PUBLIC, jn, "no_such_key" as *u8, off) < 0 { t = 1 }
188 gv_check("neg-control-absent-json-key-returns-minus-one" as *u8, t, c)
189
190 // cmaf_edge flag
191 t = 0
192 if cb_flag(G_JSON_PUBLIC, jn, "cmaf_edge" as *u8) == 1 { t = 1 }
193 gv_check("cmaf-edge-true-is-read-as-set" as *u8, t, c)
194 t = 0
195 if cb_flag(G_JSON_RESTRICTED, rn, "cmaf_edge" as *u8) == 0 { t = 1 }
196 gv_check("neg-control-cmaf-edge-false-is-read-as-clear" as *u8, t, c)
197 t = 0
198 if cb_flag(G_JSON_OFFLINE, g_slen(G_JSON_OFFLINE), "cmaf_edge" as *u8) == 0 { t = 1 }
199 gv_check("neg-control-absent-cmaf-edge-is-clear" as *u8, t, c)
200
201 // ---- the CMAF rewrite, byte-exact ----
202 let outb: *u8 = sys_mmap(G_BUFCAP)
203 let rw: i64 = cb_cmaf_rewrite(G_URL_IN, g_slen(G_URL_IN), outb, G_BUFCAP)
204 t = 0
205 if rw > 0 { if g_eqs(outb, 0, rw, G_URL_CMAF) == 1 { t = 1 } }
206 gv_check("cmaf-rewrite-swaps-both-the-playlist-name-and-the-amlst-path-byte-exact" as *u8, t, c)
207
208 // a URL carrying neither token must come back UNCHANGED: calling the rewrite on a non-CMAF url
209 // is safe, so the caller never needs to branch before composing it.
210 let rw2: i64 = cb_cmaf_rewrite(G_URL_PLAIN, g_slen(G_URL_PLAIN), outb, G_BUFCAP)
211 t = 0
212 if rw2 == g_slen(G_URL_PLAIN) { if g_eqs(outb, 0, rw2, G_URL_PLAIN) == 1 { t = 1 } }
213 gv_check("neg-control-url-without-either-token-is-copied-unchanged" as *u8, t, c)
214
215 // ---- the handoff contract, asserted from OUTSIDE rather than trusted as a comment ----
216 t = 0
217 if cb_capture_contract() == CB_HANDOFF_SINGLE_CONSUMER { t = 1 }
218 gv_check("capture-handoff-contract-is-single-consumer-the-edge-token-is-single-use" as *u8, t, c)
219
220 // ---- the form body ----
221 let body: *u8 = sys_mmap(G_BUFCAP)
222 let bn: i64 = cb_build_body("avaowenss" as *u8, body, G_BUFCAP)
223 t = 0
224 if bn > 0 { if g_eqs(body, 0, bn, "room_slug=avaowenss&bandwidth=high" as *u8) == 1 { t = 1 } }
225 gv_check("form-body-is-room-slug-and-bandwidth-byte-exact" as *u8, t, c)
226
227 return gv_verdict("nx_cam_chaturbate_gate" as *u8, c,
228 "pure decision core only, on planted .invalid fixtures with no network -- a green here says the state machine, JSON reader and CMAF rewrite are correct, and says NOTHING about whether the live endpoint answers; the live resolve is a separate declared step" as *u8)
229}