nx_charjudge_frame_gate.nx source

1// nx_charjudge_frame_gate.nx -- THE REFEREE FOR GR38 cjc_frame_guard: the judge grades or abstains, never dies. 2// 3// GR38's done-rule, quoted from graphics.plan so the bar cannot drift: 4// "the judge grades a full-resolution frame or ABSTAINS by name and never dies, a debug build exists so 5// the next crash is locatable, and the abstention is a THIRD state that can neither acquit nor convict" 6// 7// WHAT THIS GATE IS DEFENDING. The reproduced trigger is that argv is NULL-TERMINATED, so a call with no 8// LABEL makes argv[2] the terminator and printing it dereferences 0x0 -- exit 139 = 128+11 before the 9// guard, answered as {"abstain":"NO-LABEL-ARGUMENT"} rc=4 after it. 10// * A CRASH ATTRIBUTED TO THE DATA WHEN IT BELONGS TO THE CALL SENDS EVERY READER INTO THE WRONG ORGAN. 11// SCOPE DECLARED: the board also recorded the crash as happening ON THE BEACH CAPTURE, implying frame size 12// was the trigger. That half is UNPROVEN either way here -- it was measured only against a laptop tree 13// whose nx_charjudge_lib is ~14 KB behind the shipping one, and a cross-tree control is not a control. 14// 15// The guard is a PURE function taking pointer values as integers, so every refusal path is reachable here 16// without manufacturing a corrupt PNG -- a gate that could only test the paths a real file can produce 17// would leave the null-pointer branches, which are the ones that crashed, permanently unexercised. 18// license_tier: ORIGINAL No hw writes (Rule 26). 19import "nx_syscalls.nx" 20import "nx_gate_verdict.nx" 21import "nx_charjudge.nx" 22 23// a frame description that must PASS, so every refusal tooth below is a single-field mutation of it 24const CJT_P: i64 = 4096 // stand-in non-null pointer values 25const CJT_L: i64 = 8192 26const CJT_HDR: i64 = 12288 27const CJT_PX: i64 = 16384 28const CJT_W: i64 = 2868 // the real beach capture, measured 29const CJT_H: i64 = 1604 30const CJT_CH: i64 = 3 31const CJT_SIZE: i64 = 13800816 // 2868 * 1604 * 3, exactly 32 33func main() -> i64 { 34 let ctr: *i64 = gv_ctr() 35 gv_head("nx_charjudge_frame_gate -- GR38 cjc_frame_guard" as *u8) 36 37 // ---- THE POSITIVE CONTROL FIRST: a guard that refused everything would pass every deny tooth ------- 38 gv_check_eq("pos-control-the-real-beach-frame-is-ACCEPTED" as *u8, 39 cjc_frame_guard(CJT_P, CJT_L, CJT_HDR, CJT_PX, CJT_W, CJT_H, CJT_CH, CJT_SIZE), CJG_OK, ctr) 40 // a 4-channel RGBA frame of the same size must also pass -- the alpha capture path 41 gv_check_eq("pos-control-an-RGBA-frame-is-ACCEPTED" as *u8, 42 cjc_frame_guard(CJT_P, CJT_L, CJT_HDR, CJT_PX, CJT_W, CJT_H, 4, CJT_W * CJT_H * 4), CJG_OK, ctr) 43 // and a single-pixel greyscale frame: the smallest thing that is still a frame 44 gv_check_eq("pos-control-a-1x1-greyscale-frame-is-ACCEPTED" as *u8, 45 cjc_frame_guard(CJT_P, CJT_L, CJT_HDR, CJT_PX, 1, 1, 1, 1), CJG_OK, ctr) 46 47 // ---- THE HISTORICAL CRASH, NOW A NAMED REFUSAL --------------------------------------------------- 48 gv_check_eq("HISTORICAL-CRASH-missing-label-refuses-by-name" as *u8, 49 cjc_frame_guard(CJT_P, 0, CJT_HDR, CJT_PX, CJT_W, CJT_H, CJT_CH, CJT_SIZE), CJG_NO_LABEL, ctr) 50 gv_check_eq("missing-path-refuses-by-name" as *u8, 51 cjc_frame_guard(0, CJT_L, CJT_HDR, CJT_PX, CJT_W, CJT_H, CJT_CH, CJT_SIZE), CJG_NO_PATH, ctr) 52 53 // ---- every other unchecked dereference the old main() carried ------------------------------------ 54 gv_check_eq("null-header-refuses-by-name" as *u8, 55 cjc_frame_guard(CJT_P, CJT_L, 0, CJT_PX, CJT_W, CJT_H, CJT_CH, CJT_SIZE), CJG_NO_HEADER, ctr) 56 gv_check_eq("null-pixels-refuses-by-name" as *u8, 57 cjc_frame_guard(CJT_P, CJT_L, CJT_HDR, 0, CJT_W, CJT_H, CJT_CH, CJT_SIZE), CJG_NO_PIXELS, ctr) 58 gv_check_eq("zero-width-refuses-by-name" as *u8, 59 cjc_frame_guard(CJT_P, CJT_L, CJT_HDR, CJT_PX, 0, CJT_H, CJT_CH, CJT_SIZE), CJG_BAD_DIMS, ctr) 60 // HEIGHT WAS NEVER CHECKED AT ALL before this rung -- only width was 61 gv_check_eq("zero-HEIGHT-refuses-by-name-it-was-never-checked-before" as *u8, 62 cjc_frame_guard(CJT_P, CJT_L, CJT_HDR, CJT_PX, CJT_W, 0, CJT_CH, CJT_SIZE), CJG_BAD_DIMS, ctr) 63 gv_check_eq("negative-height-refuses-by-name" as *u8, 64 cjc_frame_guard(CJT_P, CJT_L, CJT_HDR, CJT_PX, CJT_W, 0 - 1, CJT_CH, CJT_SIZE), CJG_BAD_DIMS, ctr) 65 gv_check_eq("zero-channels-refuses-by-name" as *u8, 66 cjc_frame_guard(CJT_P, CJT_L, CJT_HDR, CJT_PX, CJT_W, CJT_H, 0, CJT_SIZE), CJG_BAD_CHANNELS, ctr) 67 gv_check_eq("five-channels-refuses-by-name" as *u8, 68 cjc_frame_guard(CJT_P, CJT_L, CJT_HDR, CJT_PX, CJT_W, CJT_H, 5, CJT_SIZE), CJG_BAD_CHANNELS, ctr) 69 70 // ---- the short buffer: the decoder claiming a size the dimensions do not support ----------------- 71 gv_check_eq("pixel-buffer-one-byte-short-refuses-by-name" as *u8, 72 cjc_frame_guard(CJT_P, CJT_L, CJT_HDR, CJT_PX, CJT_W, CJT_H, CJT_CH, CJT_SIZE - 1), 73 CJG_SHORT_BUFFER, ctr) 74 // ...and EXACTLY the right size must pass, or the bound is off by one in the safe-looking direction 75 gv_check_eq("pixel-buffer-exactly-right-is-ACCEPTED" as *u8, 76 cjc_frame_guard(CJT_P, CJT_L, CJT_HDR, CJT_PX, CJT_W, CJT_H, CJT_CH, CJT_SIZE), CJG_OK, ctr) 77 78 // ---- the overflow fence, which is DERIVED from one i64 per pixel --------------------------------- 79 gv_check_eq("area-that-would-overflow-the-buffer-size-refuses" as *u8, 80 cjc_frame_guard(CJT_P, CJT_L, CJT_HDR, CJT_PX, 4000000000, 4000000000, CJT_CH, CJT_SIZE), 81 CJG_AREA_OVERFLOW, ctr) 82 // the largest area that still fits must NOT be refused: a fence set one step too tight would reject 83 // real frames and read as robustness 84 gv_check_eq("the-largest-safe-area-is-still-ACCEPTED" as *u8, 85 cjc_frame_guard(CJT_P, CJT_L, CJT_HDR, CJT_PX, 2, CJG_MAX_AREA / 2, 1, CJG_MAX_AREA), 86 CJG_OK, ctr) 87 88 // ---- every code has a distinct readable name, or a refusal cannot be acted on -------------------- 89 gv_check_eq("guard-code-count-is-declared" as *u8, CJG_N, 10, ctr) 90 gv_check("abstain-exit-is-a-THIRD-state-not-graded-and-not-decode" as *u8, 91 ((CJG_EXIT_ABSTAIN != CJG_EXIT_OK) as i64) * ((CJG_EXIT_ABSTAIN != 2) as i64) 92 * ((CJG_EXIT_ABSTAIN != 3) as i64), ctr) 93 94 gv_values_head() 95 gv_kv("guard_codes" as *u8, CJG_N) 96 gv_kv("abstain_exit_code" as *u8, CJG_EXIT_ABSTAIN) 97 gv_kv("max_safe_area_derived" as *u8, CJG_MAX_AREA) 98 gv_kv("max_channels" as *u8, CJG_MAX_CHANNELS) 99 gv_kv("beach_capture_width_measured" as *u8, CJT_W) 100 gv_kv("beach_capture_height_measured" as *u8, CJT_H) 101 gv_kv("beach_capture_pixel_bytes" as *u8, CJT_SIZE) 102 103 return gv_verdict("nx_charjudge_frame_gate" as *u8, ctr, 104 "every unchecked dereference the crash came from is now a named abstention with a positive control" as *u8) 105}