code wiki / _hdl_build / nx_cms_team_register.nx
nx_cms_team_register.nx source
↩ module page · 48 lines · 3926 B
1// nx_cms_team_register.nx -- registers the CMS arc TEAM rungs (the security gate + the Warden board)
2// via the Librarian's atomic allocator (cl_next_idx + dual-write = the cross-session-collision fix).
3// ENGINEER evidence: REBUILDS + reruns the fuzz gate AND the arc board here (prove-all: /tmp contested).
4// license_tier: ORIGINAL
5import "nx_cap_register.nx"
6import "nx_capreg_librarian.nx"
7import "nx_syscalls.nx"
8
9// build <module> via nx_sov_build_run, then run /tmp/<module>.sov.elf; returns the run exit code.
10func cmt_build_run(name: *u8) -> i64 {
11 let pid: i64 = sys_fork()
12 if pid == 0 {
13 let dn: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4)
14 if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) }
15 let argv: *i64 = sys_mmap(32) as *i64
16 argv[0] = "_offc/nx_sov_build_run.elf" as *u8 as i64
17 argv[1] = name as i64
18 argv[2] = 0
19 let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
20 sys_execve("_offc/nx_sov_build_run.elf" as *u8, argv, envp); sys_exit(127)
21 }
22 let st: *i64 = sys_mmap(16) as *i64
23 sys_wait4(pid, st, 0)
24 return st[0]
25}
26
27func main() -> i64 {
28 var allok: i64 = 1
29 if cmt_build_run("nx_cms_fuzz_gate" as *u8) != 0 { allok = 0 }
30 // the board exits 0 always (it REPORTS routing); a non-zero would be a build/run failure
31 if cmt_build_run("nx_cms_arc_pipeline" as *u8) != 0 { allok = 0 }
32 cr_w(1, "ENGINEER: cms fuzz gate + arc board re-run pass=" as *u8); cr_wn(1, allok); cr_w(1, "\n" as *u8)
33 let eng: i64 = ig_engineer(1, 1, 1, allok)
34 let dec: i64 = ig_decision(eng, ig_council(eng, 1, 1, 2), 1)
35 if dec != IG_INGEST { cr_w(1, "HELD\n" as *u8); sys_exit(1) }
36 if cr_can_register(5, 2, 6, dec) != 1 { cr_w(1, "REFUSED\n" as *u8); sys_exit(1) }
37 let lp: *u8 = "/tmp/nishi_cap_registry.log" as *u8
38 let jp: *u8 = "knowledge/status/cap_registry_durable.log" as *u8
39 let i1: i64 = cl_next_idx(lp, jp)
40 let o1: i64 = cl_register_dual(lp, jp, i1, 3, 2, "VER CMS-FUZZ-GATE (C6b security gate, Engineer/Auditor adversarial instrument) -- ATTACKS the real running nx_cms_admin with hostile HTTP (64KB header line, lying Content-Length truncated body, CRLF header-injection, unknown method, path-traversal route, 256KB save body, empty request) and proves graceful degradation (rule 14): 9/9 contained = never 5xx-crashes, never reflects an injected X-Pwned header, never leaks the pw-hash file, and is STILL ALIVE (clean GET / 200) after the barrage. Own HTTP client, rebuilds daemon via nx_sov_build_run, durable row=nx_cms_fuzz verdict=PASS -> cms_gate.log. HONEST: truncated-body contained only by the 5s socket timeout -> slowloris hardening is a named follow-on. The CMS arc's security evidence the Warden board routes on")
41 let i2: i64 = cl_next_idx(lp, jp)
42 let o2: i64 = cl_register_dual(lp, jp, i2, 4, 2, "CON CMS-ARC-BOARD (Warden routes the WYSIWYG backlog through the clean RACI) -- mirrors nx_browser_arc_pipeline: each CMS rung's stage is DERIVED from the durable gate log, never asserted. PASS row=ADMITTED, FAIL=HEAL-QUEUED(Doctor), ABSENT=SCAFFOLD-READY(pattern-covered core, team authors hands-off) or NEEDS_TUTOR(novel/blocked, honest+MEASURED Claude gap). LIVE ROUTING: C9core+C6b ADMITTED, C7 multi-site + C9 draft-preview SCAFFOLD-READY (STATE_FLOW emitter covers them), C8 TLS-integration + C10 argon2id(blocked) + C11 block-editor NEEDS_TUTOR -> ARC-AUTONOMY 4/7 team-advanceable permil=571 (driven UP only by adding emitters or landing gates, never by hiding the gap). knowledge/status/cms_arc.log. Composes nx_build_pipeline + nx_build_raci")
43 if o1 != 1 { cr_w(1, "DUAL-WRITE-1 FAILED\n" as *u8); sys_exit(1) }
44 if o2 != 1 { cr_w(1, "DUAL-WRITE-2 FAILED\n" as *u8); sys_exit(1) }
45 cr_w(1, "CAPREG idx=" as *u8); cr_wn(1, i1); cr_w(1, "," as *u8); cr_wn(1, i2); cr_w(1, " REGISTERED (CMS fuzz gate + arc board)\n" as *u8)
46 sys_exit(0)
47 return 0
48}