nx_claim_verify.nx source
↩ module page · 88 lines · 5002 B
1// nx_claim_verify.nx -- AUTONOMOUS, GENERAL, sovereign claim verifier: the wired form of the evidence-grounded
2// verification proven by nx_evidence_verify_gate. Given a claim (a number in tenths), a live source URL, and a
3// text pattern the value follows, it FETCHES THE SOURCE ITSELF over the sovereign TLS-1.3 stack (no pasted
4// fixture, no curl/python), extracts the real value, and emits a machine-readable EVIDENCE RECORD with a verdict:
5// CONFIRMED (|extracted - claim| <= tolerance) / DISCREDITED (outside tolerance) / UNVERIFIABLE (pattern absent
6// -> it invents NO number) / FETCH-FAILED. Exit code carries the verdict (0/3/4/2) so it composes in a pipeline.
7// This is the anti-gaming discipline made autonomous: a claim is only CONFIRMED against a real fetched primary
8// source, and a wrong claim is DISCREDITED. Reuses nx_https_fetch_follow (the researcher's proven fetch).
9// usage: nx_claim_verify <url> <pattern> <claim_tenths> <tol_tenths> (run from a dir with data/mozilla_certdata.txt)
10// e.g.: nx_claim_verify https://arxiv.org/abs/1606.05250 "human performance (" 870 30 -> CONFIRMED (86.8 ~ 87.0)
11// license_tier: ORIGINAL expect_exit: 0
12import "nx_syscalls.nx"
13import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc)
14import "nx_x509_trust_store.nx"
15import "nx_trust_store_load_from_certdata.nx"
16import "nx_https_fetch_follow.nx"
17import "nx_claim_verify_core.nx"
18const K_MAGIC_4194304: i64 = 4194304
19const K_MAGIC_2000: i64 = 2000
20
21func cv_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
22// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer
23// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the
24// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls).
25// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign.
26func cv_putn(v: i64) -> i64 { nxi_out(v); return 0 }
27func slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
28
29// parse an unsigned decimal integer from a NUL-terminated string (non-digits ignored after the first run ends).
30func parse_int(s: *u8) -> i64 {
31 var v: i64 = 0
32 var any: i64 = 0
33 var go: i64 = 1
34 var i: i64 = 0
35 while go == 1 {
36 go = 0
37 let c: i64 = s[i] as i64
38 if c >= 48 { if c <= 57 { v = v*10 + (c-48); any = 1; i = i + 1; go = 1 } }
39 }
40 if any == 0 { return 0-1 }
41 return v
42}
43
44// find_after / parse_tenths / iabs / claim_verdict MOVED to nx_claim_verify_core.nx (cvc_*) -- Consolidation
45// STEP B 2026-07-14: byte-identical, the core is gate-locked by nx_research_refute_gate 8/8. This CLI now calls cvc_*.
46
47func main(argc: i64, argv: *i64) -> i64 {
48 if argc < 5 {
49 cv_puts("usage: nx_claim_verify <url> <pattern> <claim_tenths> <tol_tenths>\n" as *u8)
50 return 1
51 }
52 let url: *u8 = argv[1] as *u8
53 let pat: *u8 = argv[2] as *u8
54 let claim: i64 = parse_int(argv[3] as *u8)
55 let tol: i64 = parse_int(argv[4] as *u8)
56
57 // load the sovereign CA trust store (reference DATA, the one legitimate non-Nishi input).
58 let r: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt\x00" as *u8, 512, K_MAGIC_4194304)
59 if r <= 0 { cv_puts("{\"verdict\":\"FETCH-FAILED\",\"reason\":\"certdata load failed\"}\n" as *u8); return 2 }
60 let store: *TrustStore = r as *TrustStore
61
62 // fetch the source (one retry with a short backoff on transient failure).
63 let out: *u8 = sys_mmap(K_MAGIC_4194304)
64 let status: *i64 = sys_mmap(8) as *i64
65 var n: i64 = nx_https_fetch_follow_best(url, store, out, K_MAGIC_4194304, 6, status)
66 if n <= 0 { sys_sleep_ms(K_MAGIC_2000); n = nx_https_fetch_follow_best(url, store, out, K_MAGIC_4194304, 6, status) }
67 var http: i64 = 0
68 if n > 0 { http = status[0] }
69 var fetch_ok: i64 = 0
70 if n > 0 { if http < 400 { fetch_ok = 1 } }
71
72 // extract + verdict (claim_verdict = the refutation decision; fetch-fail keeps code 2)
73 var ext: i64 = 0-1
74 var code: i64 = 2
75 if fetch_ok == 1 { ext = cvc_parse_tenths(out, n, cvc_find_after(out, n, pat)); code = cvc_claim_verdict(ext, claim, tol) }
76 var verdict: *u8 = "FETCH-FAILED" as *u8
77 if code == 0 { verdict = "CONFIRMED" as *u8 }
78 if code == 3 { verdict = "DISCREDITED" as *u8 }
79 if code == 4 { verdict = "UNVERIFIABLE" as *u8 }
80
81 // emit the evidence record (JSON). url/pattern emitted raw -- callers pass clean values.
82 cv_puts("{\"source\":\"" as *u8); cv_puts(url); cv_puts("\",\"http_status\":" as *u8); cv_putn(http)
83 cv_puts(",\"bytes\":" as *u8); cv_putn(n)
84 cv_puts(",\"pattern\":\"" as *u8); cv_puts(pat); cv_puts("\",\"extracted_tenths\":" as *u8); cv_putn(ext)
85 cv_puts(",\"claim_tenths\":" as *u8); cv_putn(claim); cv_puts(",\"tol_tenths\":" as *u8); cv_putn(tol)
86 cv_puts(",\"verdict\":\"" as *u8); cv_puts(verdict); cv_puts("\"}\n" as *u8)
87 return code
88}