nx_claim_check_gate.nx source
↩ module page · 93 lines · 5218 B
1// nx_claim_check_gate.nx -- gate for session claims (coordination rung 1).
2// Runs in a /tmp fixture (mkdir + chdir) so the REAL leash store is never touched.
3// Teeth: T1 register+readback; T2 pure scope battery (exact/csv/star/miss/empty/overlong);
4// T3 pure liveness battery (live/stale/RELEASED/RECLAIMED); T4 THE TOOTH foreign live
5// scope -> DENY(3); T5 own scope never self-blocks; T6 release frees (NEG: the same check
6// that denied now grants); T7 unclaimed session denied on foreign live scope (fail-closed).
7// expect_exit: 0 license_tier: ORIGINAL
8import "nx_claim_core.nx"
9
10const CG_DIRMODE: i64 = 493
11const CG_TTL: i64 = 60000
12const CG_AGE_FRESH: i64 = 100
13const CG_AGE_STALE: i64 = 70000
14
15func g(s: *u8) -> i64 { std_puts(s); return 0 }
16
17func main() -> i64 {
18 sys_mkdir("/tmp/ccg_fx" as *u8, CG_DIRMODE)
19 sys_mkdir("/tmp/ccg_fx/knowledge" as *u8, CG_DIRMODE)
20 sys_mkdir("/tmp/ccg_fx/knowledge/store" as *u8, CG_DIRMODE)
21 sys_mkdir("/tmp/ccg_fx/knowledge/status" as *u8, CG_DIRMODE)
22 if sys_chdir("/tmp/ccg_fx" as *u8) != 0 { std_putln("FIXTURE chdir failed" as *u8) return 1 }
23 g("=== nx_claim_check_gate: session claims over the leash store (coordination rung 1) ===\n" as *u8)
24 var pass: i64 = 0
25 var ttl: i64 = 0
26
27 // T1 register + readback
28 ttl = ttl + 1
29 cc_register("aaaa1111" as *u8, "alpha" as *u8, "runtime/nx_claim_,bench/alpha" as *u8, CG_TTL)
30 let row: *u8 = sys_mmap(512) as *u8
31 let vn: i64 = sov_get_copy("knowledge/store/leash" as *u8, "d:claude_aaaa1111" as *u8, row, 511)
32 let pur: *u8 = sys_mmap(512) as *u8
33 var t1: i64 = 0
34 if vn > 0 { if cc_field(row, vn, 2, pur, 511) > 0 { let sc: *u8 = sys_mmap(256) as *u8; if cc_purpose_scope(pur, sc, 255) > 0 { t1 = 1 } } }
35 if t1 == 1 { pass = pass + 1; g(" [PASS] T1 register + row readback (purpose carries scope=)\n" as *u8) } else { g(" [FAIL] T1 register/readback\n" as *u8) }
36
37 // T2 pure scope battery
38 ttl = ttl + 1
39 var t2: i64 = 1
40 if cc_scope_hit("runtime/nx_claim_,bench/alpha" as *u8, "runtime/nx_claim_core.nx" as *u8) != 1 { t2 = 0 }
41 if cc_scope_hit("runtime/nx_claim_,bench/alpha" as *u8, "bench/alpha/x.sh" as *u8) != 1 { t2 = 0 }
42 if cc_scope_hit("docs/dash*" as *u8, "docs/dashboards/a.md" as *u8) != 1 { t2 = 0 }
43 if cc_scope_hit("runtime/nx_claim_" as *u8, "docs/x.md" as *u8) != 0 { t2 = 0 }
44 let empty: *u8 = sys_mmap(8) as *u8
45 empty[0] = 0 as u8
46 if cc_scope_hit(empty, "runtime/anything.nx" as *u8) != 0 { t2 = 0 }
47 if cc_scope_hit("runtime/nx_claim_core.nx.bak" as *u8, "runtime/nx.nx" as *u8) != 0 { t2 = 0 }
48 if t2 == 1 { pass = pass + 1; g(" [PASS] T2 scope battery: exact/csv-2nd/star/miss/empty/overlong\n" as *u8) } else { g(" [FAIL] T2 scope battery\n" as *u8) }
49
50 // T3 pure liveness battery
51 ttl = ttl + 1
52 var t3: i64 = 1
53 if cc_live_verdict(CG_AGE_FRESH, CG_TTL, "ACTIVE" as *u8) != 1 { t3 = 0 }
54 if cc_live_verdict(CG_AGE_STALE, CG_TTL, "ACTIVE" as *u8) != 0 { t3 = 0 }
55 if cc_live_verdict(CG_AGE_FRESH, CG_TTL, "RELEASED" as *u8) != 0 { t3 = 0 }
56 if cc_live_verdict(CG_AGE_FRESH, CG_TTL, "RECLAIMED" as *u8) != 0 { t3 = 0 }
57 if t3 == 1 { pass = pass + 1; g(" [PASS] T3 liveness: live / stale>ttl / RELEASED / RECLAIMED\n" as *u8) } else { g(" [FAIL] T3 liveness battery\n" as *u8) }
58
59 // T4 THE TOOTH: foreign live scope -> DENY
60 ttl = ttl + 1
61 cc_register("bbbb2222" as *u8, "beta" as *u8, "docs/beta" as *u8, CG_TTL)
62 let pv: *i64 = sys_mmap(64) as *i64
63 pv[0] = ("docs/beta/notes.md" as *u8) as i64
64 let v4: i64 = cc_check("aaaa1111" as *u8, pv, 1)
65 if v4 == CC_DENY { pass = pass + 1; g(" [PASS] T4 foreign live scope -> DENY(3), holder named above\n" as *u8) } else { g(" [FAIL] T4 expected DENY\n" as *u8) }
66
67 // T5 own scope never self-blocks
68 ttl = ttl + 1
69 let pv5: *i64 = sys_mmap(64) as *i64
70 pv5[0] = ("runtime/nx_claim_core.nx" as *u8) as i64
71 let v5: i64 = cc_check("aaaa1111" as *u8, pv5, 1)
72 if v5 == CC_GRANT { pass = pass + 1; g(" [PASS] T5 own-scope path -> GRANT (self excluded)\n" as *u8) } else { g(" [FAIL] T5 expected GRANT\n" as *u8) }
73
74 // T6 release frees: the EXACT check that denied in T4 now grants (negative control pair)
75 ttl = ttl + 1
76 cc_release("bbbb2222" as *u8)
77 let v6: i64 = cc_check("aaaa1111" as *u8, pv, 1)
78 if v6 == CC_GRANT { pass = pass + 1; g(" [PASS] T6 release frees: T4's deny is now a grant\n" as *u8) } else { g(" [FAIL] T6 expected GRANT after release\n" as *u8) }
79
80 // T7 unclaimed session still denied on a foreign live scope (fail-closed for strangers)
81 ttl = ttl + 1
82 let pv7: *i64 = sys_mmap(64) as *i64
83 pv7[0] = ("runtime/nx_claim_check.nx" as *u8) as i64
84 let v7: i64 = cc_check("zzzz9999" as *u8, pv7, 1)
85 if v7 == CC_DENY { pass = pass + 1; g(" [PASS] T7 unclaimed session vs live foreign scope -> DENY\n" as *u8) } else { g(" [FAIL] T7 expected DENY\n" as *u8) }
86
87 g("\nnx_claim_check_gate " as *u8)
88 std_pdec(pass)
89 g("/" as *u8)
90 std_pdec(ttl)
91 if pass == ttl { g(" GREEN -- session claims: register/scope/liveness/deny/self/release/fail-closed all proven\n" as *u8) return 0 }
92 g(" RED\n" as *u8)
93 return 1
94}