code wiki / _hdl_build / nx_cms_tls_gate.nx
`nx_cms_tls_gate.nx` source

↩ module page · 464 lines · 22168 B
1// nx_cms_tls_gate.nx -- CMS C8 GATE (re-runnable, evidence-driven): the CMS behind OUR TLS 1.3
2// front, proven with OUR TLS client doing FULL certificate validation. The gate generates a
3// self-signed Ed25519 cert sovereignly (nx_x509_build, the andelinwest daemon's cert shape), makes
4// it the client's ONLY trust anchor, boots the real admin (loopback) behind nx_cms_tls_front (TLS
5// terminator), and walks the admin flow over the encrypted wire: page serve, login (cookie must now
6// carry Secure), editor, edit-publish. NEGATIVE CONTROL: a client with an EMPTY trust store must
7// FAIL the handshake -- proves the validation is real, not pass-through. Appends
8// "CMSGATE row=nx_cms_tls ... verdict=PASS|FAIL". Exit 0 iff all rows pass. license_tier: ORIGINAL
9import "nx_syscalls.nx"
10import "nx_connect.nx"   // bounded connect: a raw sys_connect hangs ~127s on a black-holed host
11import "nx_csprng.nx"
12import "nx_sha256.nx"
13import "nx_ed25519_signature.nx"
14import "hub/nx_x509_build.nx"
15import "nx_x509.nx"
16import "nx_x509_trust_store.nx"
17import "nx_tls13_client_validate_certificate.nx"
18import "nx_tls13_client_session_run.nx"
19import "nx_tls13_read_record_from_fd.nx"
20import "nx_cms_store.nx"
21import "_hdl_build/nx_kill_portable.nx"
22import "nx_gate_verdict.nx"   // D001: inherit the shared verdict contract instead of hand-rolling it
23
24// PORT MOVED 8447 -> 19861 (2026-08-01). ★★8447 IS NOT FREE AND NEVER WAS: it is the LIVE, SUPERVISED
25// nx_translate_daemon (nx_hostctl HC_XLATE, watched by nx_keeper, on the status page, in nx_port_audit).
26// This gate squatted a PRODUCTION service's port from the day it was written, so its front could never
27// bind and every TLS row was red for a reason with nothing to do with TLS. ★A GATE THAT PICKS A PORT BY
28// TASTE INSTEAD OF BY REGISTRY EVENTUALLY PICKS ONE THAT IS ALREADY OWNED -- and then grades the collision
29// as a failure of its subject. 19861 verified unused across a full 21433-file corpus scan.
30const TG_FRONT_PORT: i64 = 19861
31const TG_BACK_PORT: i64 = 8086
32const TG_SITE: *u8 = "/tmp/_cms_tls_site"
33const TG_SNI: *u8 = "cms.gate.local"
34const TG_SNI_N: i64 = 14
35
36func tg_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
37func tg_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
38func tg_cat(dst: *u8, off: i64, s: *u8) -> i64 {
  var o: i64 = off
  var k: i64 = 0
  while s[k] != (0 as u8) { dst[o] = s[k]; o = o + 1; k = k + 1 }
  return o
43}
44func tg_catn(dst: *u8, off: i64, s: *u8, n: i64) -> i64 {
  var o: i64 = off
  var k: i64 = 0
  while k < n { dst[o] = s[k]; o = o + 1; k = k + 1 }
  return o
49}
50func tg_index(hay: *u8, n: i64, needle: *u8) -> i64 {
  let nl: i64 = tg_len(needle)
  var i: i64 = 0
  while i + nl <= n {
      var q: i64 = 0
      var ok: i64 = 1
      while q < nl { if (hay[i+q] as i64) != (needle[q] as i64) { ok = 0; q = nl } q = q + 1 }
      if ok == 1 { return i }
      i = i + 1
  }
  return 0 - 1
61}
62func tg_has(hay: *u8, n: i64, needle: *u8) -> i64 { if tg_index(hay, n, needle) >= 0 { return 1 } return 0 }
63
64func tg_row(id: i64, ok: i64, what: *u8) -> i64 {
  tg_w("TLSROW " as *u8)
  let d: *u8 = sys_mmap(8); d[0] = (48 + id/10) as u8; d[1] = (48 + id%10) as u8; d[2] = 32 as u8; d[3] = 0 as u8
  tg_w(d)
  if ok == 1 { tg_w("PASS " as *u8) }
  if ok == 0 { tg_w("FAIL " as *u8) }
  tg_w(what); tg_w("\n" as *u8)
  return ok
72}
73
74func tg_mkdir(path: *u8, mode: i64) -> i64 {
  let nb: *i64 = sys_mmap(8) as *i64
  nb[0] = 258
  return __syscall(nb[0], 0 - 100, path, mode, 0, 0, 0)
78}
79
80// build + run a module via the sovereign runner (blocking, output discarded)
81func tg_build(name: *u8) -> i64 {
  let pid: i64 = sys_fork()
  if pid == 0 {
      let dn: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4)
      if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) }
      let bargv: *i64 = sys_mmap(32) as *i64
      bargv[0] = "_offc/nx_sov_build_run.elf" as *u8 as i64
      bargv[1] = name as i64
      bargv[2] = 0
      let benvp: *i64 = sys_mmap(16) as *i64
      benvp[0] = 0
      sys_execve("_offc/nx_sov_build_run.elf" as *u8, bargv, benvp); sys_exit(127)
  }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, st, 0)
  return 0
97}
98
99// one HTTPS request through the front: connect, validated TLS 1.3 handshake, ONE app record out,
100// pump records to close collecting plaintext into resp. Returns resp length, or negative verdict
101// (handshake failure surfaces here -- the negative-control row relies on that).
102func tg_https(store: *TrustStore, req: *u8, rn: i64, resp: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_socket(2, 1, 0)
  if fd < 0 { return 0 - 91 }
  sys_set_socket_timeout(fd, 15)
  let addr: *u8 = sys_mmap(16)
  addr[0] = 2 as u8; addr[1] = 0 as u8
  addr[2] = ((TG_FRONT_PORT >> 8) & 0xff) as u8
  addr[3] = (TG_FRONT_PORT & 0xff) as u8
  addr[4] = 127 as u8; addr[5] = 0 as u8; addr[6] = 0 as u8; addr[7] = 1 as u8
  var zi: i64 = 8
  while zi < 16 { addr[zi] = 0 as u8; zi = zi + 1 }
  if nx_connect_bounded(fd, addr, 16, NX_CONN_DEFAULT_MS) < 0 { sys_close(fd); return 0 - 92 }
114
  let cr: *u8 = sys_mmap(32)
  let cpriv: *u8 = sys_mmap(32)
  nx_csprng_fill(cr, 32)
  nx_csprng_fill(cpriv, 32)
  let vraw: *u8 = sys_mmap(64)
  let val_ctx: *TlsValidationContext = vraw as *TlsValidationContext
  val_ctx.store = store
  val_ctx.sni_host = TG_SNI
  val_ctx.sni_host_len = TG_SNI_N
  val_ctx.now_epoch = sys_now_realtime_sec()
  let r: i64 = nx_tls13_client_session_run(fd, TG_SNI, TG_SNI_N, cr, cpriv, val_ctx)
  if r < 0 { sys_close(fd); return r }
  let s: *Tls13ClientSession = r as *Tls13ClientSession
128
  // send the request as one application_data record (requests are small)
  let rec: *u8 = sys_mmap(rn + 64)
  let v: i64 = nx_tls13_record_encrypt_v2(
      s.cipher_suite, s.client_app_traffic_key, s.client_app_iv,
      s.client_app_seq, req, rn, NX_TLS13_CT_APPLICATION_DATA, 0,
      rec, rec + NX_TLS13_RECORD_HEADER_LEN, rec + NX_TLS13_RECORD_HEADER_LEN + rn + 1)
  s.client_app_seq = s.client_app_seq + 1
  if v != NX_TLS13_REC_VERDICT_OK { sys_close(fd); return 0 - 93 }
  let total: i64 = NX_TLS13_RECORD_HEADER_LEN + rn + 1 + NX_TLS13_RECORD_TAG_LEN
  var off: i64 = 0
  while off < total {
      let w: i64 = sys_write(fd, (rec as i64 + off) as *u8, total - off)
      if w <= 0 { sys_close(fd); return 0 - 94 }
      off = off + w
  }
144
  // pump response records until close/alert
  var got: i64 = 0
  var go: i64 = 1
  while go == 1 {
      go = 0
      let rb: *u8 = sys_mmap(20480)
      let tn: i64 = nx_tls13_read_record_from_fd(fd, rb, 20480)
      if tn > 0 {
          let ct_len: i64 = tn - NX_TLS13_RECORD_HEADER_LEN - NX_TLS13_RECORD_TAG_LEN
          if ct_len > 0 {
              let pl: *u8 = sys_mmap(ct_len + 16)
              let ctp: *i64 = sys_mmap(16) as *i64
              let lnp: *i64 = sys_mmap(16) as *i64
              let dv: i64 = nx_tls13_record_decrypt_v2(
                  s.cipher_suite, s.server_app_traffic_key, s.server_app_iv,
                  s.server_app_seq, rb, rb + NX_TLS13_RECORD_HEADER_LEN, ct_len,
                  rb + tn - NX_TLS13_RECORD_TAG_LEN, pl, ctp, lnp)
              s.server_app_seq = s.server_app_seq + 1
              if dv == NX_TLS13_REC_VERDICT_OK {
                  if *ctp == NX_TLS13_CT_APPLICATION_DATA {
                      var i: i64 = 0
                      while i < *lnp { if got + i < cap { resp[got + i] = pl[i] } i = i + 1 }
                      got = got + *lnp
                      go = 1
                  }
                  if *ctp != NX_TLS13_CT_APPLICATION_DATA { if *ctp != NX_TLS13_CT_ALERT { go = 1 } }
              }
          }
      }
  }
  sys_close(fd)
  return got
177}
178
179func tg_post(req: *u8, path: *u8, cookie: *u8, body: *u8) -> i64 {
  var o: i64 = tg_cat(req, 0, "POST " as *u8)
  o = tg_cat(req, o, path)
  o = tg_cat(req, o, " HTTP/1.1\r\nHost: cms.gate.local\r\nContent-Type: application/x-www-form-urlencoded\r\n" as *u8)
  if (cookie[0] as i64) != 0 {
      o = tg_cat(req, o, "Cookie: nsess=" as *u8)
      o = tg_catn(req, o, cookie, 32)
      o = tg_cat(req, o, "\r\n" as *u8)
  }
  o = tg_cat(req, o, "Content-Length: " as *u8)
  let bl: i64 = tg_len(body)
  let t: *u8 = sys_mmap(24)
  var m: i64 = bl
  var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0
  while i < k { req[o] = t[k-1-i]; o = o + 1; i = i + 1 }
  o = tg_cat(req, o, "\r\n\r\n" as *u8)
  o = tg_cat(req, o, body)
  return o
200}
201func tg_get(req: *u8, path: *u8, cookie: *u8) -> i64 {
  var o: i64 = tg_cat(req, 0, "GET " as *u8)
  o = tg_cat(req, o, path)
  o = tg_cat(req, o, " HTTP/1.1\r\nHost: cms.gate.local\r\n" as *u8)
  if (cookie[0] as i64) != 0 {
      o = tg_cat(req, o, "Cookie: nsess=" as *u8)
      o = tg_catn(req, o, cookie, 32)
      o = tg_cat(req, o, "\r\n" as *u8)
  }
  o = tg_cat(req, o, "\r\n" as *u8)
  return o
212}
213
214func main() -> i64 {
  // ---- 1. sovereign self-signed Ed25519 cert (the andelinwest daemon's cert shape) ----
  let priv: *u8 = sys_mmap(32)
  let pub: *u8 = sys_mmap(32)
  nx_csprng_fill(priv, 32)
  if ed25519_pub_from_priv(priv, pub) != 0 { tg_w("CMSGATE row=nx_cms_tls KEYGEN-FAIL\n" as *u8); sys_exit(1) }
  let san_ptrs: *i64 = sys_mmap(16) as *i64
  let san_lens: *i64 = sys_mmap(16) as *i64
  san_ptrs[0] = TG_SNI as i64
  san_lens[0] = TG_SNI_N
  let iraw: *u8 = sys_mmap(256)
  let inp: *NxX509BuildInputs = iraw as *NxX509BuildInputs
  let irc: i64 = nx_x509_inputs_init(inp, TG_SNI, TG_SNI_N, san_ptrs, san_lens, 1,
      priv, pub, "20260101000000Z" as *u8, "20300101000000Z" as *u8, 7)
  if irc != NX_X509_OK { tg_w("CMSGATE row=nx_cms_tls INPUTS-FAIL\n" as *u8); sys_exit(1) }
  let cert: *u8 = sys_mmap(4096)
  let cnb: *i64 = sys_mmap(16) as *i64
  cnb[0] = 0
  let brc: i64 = nx_x509_build_self_signed(inp, cert, 4096, cnb)
  if brc != NX_X509_OK { tg_w("CMSGATE row=nx_cms_tls CERTBUILD-FAIL\n" as *u8); sys_exit(1) }
  let cert_n: i64 = cnb[0]
  let cf: i64 = sys_openat_wr("/tmp/_cms_tls_cert.der" as *u8, 0x1a4)
  sys_write(cf, cert, cert_n)
  sys_close(cf)
  let kf: i64 = sys_openat_wr("/tmp/_cms_tls_key.bin" as *u8, 0x180)
  sys_write(kf, priv, 32)
  sys_close(kf)
241
  // ---- 2. trust store: OUR cert is the ONLY anchor ----
  let store: *TrustStore = trust_store_alloc(2)
  let xraw: *u8 = sys_mmap(256)
  let xc: *X509Cert = xraw as *X509Cert
  if x509_parse(cert, cert_n, xc) != 0 { tg_w("CMSGATE row=nx_cms_tls SELFPARSE-FAIL\n" as *u8); sys_exit(1) }
  if trust_store_add(store, cert, xc) != NX_TRUST_STORE_OK { tg_w("CMSGATE row=nx_cms_tls ANCHOR-FAIL\n" as *u8); sys_exit(1) }
  let empty_store: *TrustStore = trust_store_alloc(1)   // the negative control's store
249
  // ---- 3. site fixture + builds + boots ----
  tg_mkdir(TG_SITE, 0x1ed)
  cst_copy("knowledge/cms/andelinwest/template.html" as *u8, "/tmp/_cms_tls_site/template.html" as *u8)
  cst_copy("knowledge/cms/andelinwest/content.txt" as *u8, "/tmp/_cms_tls_site/content.txt" as *u8)
  sys_renameat("/tmp/_cms_tls_site/draft.txt" as *u8, "/tmp/_cms_tls_site/draft.stale" as *u8)
  let dig: *u8 = sys_mmap(32)
  sha256_digest("tls-gate-pw-1" as *u8, 13, dig)
  let hexs: *u8 = sys_mmap(80)
  let hxc: *u8 = "0123456789abcdef" as *u8
  var hi: i64 = 0
  while hi < 32 {
      hexs[hi*2] = hxc[((dig[hi] as i64) >> 4) & 15]
      hexs[hi*2+1] = hxc[(dig[hi] as i64) & 15]
      hi = hi + 1
  }
  let pf: i64 = sys_openat_wr("/tmp/_cms_tls_site/admin_pw.sha256" as *u8, 0x1a4)
  sys_write(pf, hexs, 64)
  sys_close(pf)
  tg_build("nx_cms_admin" as *u8)
  tg_build("nx_cms_tls_front" as *u8)
  // CALLER-GAP FIX 2026-08-01 (seq1267 class): the runner emits buildroot/_build/<t>.sov.elf under
  // the no-/tmp doctrine while this probed /tmp. Proven by control: _build copy 208962B, /tmp absent.
  var bchk: i64 = sys_openat_rd("buildroot/_build/nx_cms_admin.sov.elf" as *u8)
  var badm: *u8 = "buildroot/_build/nx_cms_admin.sov.elf" as *u8
  if bchk < 0 { bchk = sys_openat_rd("/tmp/nx_cms_admin.sov.elf" as *u8); badm = "/tmp/nx_cms_admin.sov.elf" as *u8 }
  if bchk < 0 { tg_w("CMSGATE row=nx_cms_tls ADMIN-BUILD-MISSING (probed buildroot/_build AND /tmp)\n" as *u8); sys_exit(1) }
  sys_close(bchk)
  // ★SAME CALLER GAP, SECOND ARTIFACT -- and it only surfaced once the FIRST one was fixed.
  // This gate builds TWO things (nx_cms_admin and nx_cms_tls_front) and probed /tmp for both;
  // fixing only the admin probe moved the error from ADMIN-BUILD-MISSING to FRONT-BUILD-MISSING.
  // ★A DEFECT WITH N INSTANCES IN ONE FILE REVEALS THEM ONE AT A TIME, EACH BEHIND THE LAST --
  // so "the fix worked" must mean the gate REACHED ITS SUBJECT, never merely that the message changed.
  var fchk: i64 = sys_openat_rd("buildroot/_build/nx_cms_tls_front.sov.elf" as *u8)
  var bfront: *u8 = "buildroot/_build/nx_cms_tls_front.sov.elf" as *u8
  if fchk < 0 { fchk = sys_openat_rd("/tmp/nx_cms_tls_front.sov.elf" as *u8); bfront = "/tmp/nx_cms_tls_front.sov.elf" as *u8 }
  if fchk < 0 { tg_w("CMSGATE row=nx_cms_tls FRONT-BUILD-MISSING (probed buildroot/_build AND /tmp)\n" as *u8); sys_exit(1) }
  sys_close(fchk)
287
  let pid_admin: i64 = sys_fork()
  if pid_admin == 0 {
      let lg: i64 = sys_openat_wr("/tmp/_cms_admin_tls_gate.log" as *u8, 0x1a4)
      if lg >= 0 { sys_dup3(lg, 1, 0); sys_dup3(lg, 2, 0) }
      let argvv: *i64 = sys_mmap(8*7) as *i64
      argvv[0] = badm as i64
      argvv[1] = "8086" as *u8 as i64
      argvv[2] = TG_SITE as i64
      argvv[3] = "99" as *u8 as i64
      argvv[4] = "tls" as *u8 as i64
      argvv[5] = 0
      let envp: *i64 = sys_mmap(16) as *i64
      envp[0] = 0
      sys_execve(badm, argvv, envp)
      sys_exit(127)
  }
  let pid_front: i64 = sys_fork()
  if pid_front == 0 {
      let lg2: i64 = sys_openat_wr("/tmp/_cms_tls_front_gate.log" as *u8, 0x1a4)
      if lg2 >= 0 { sys_dup3(lg2, 1, 0); sys_dup3(lg2, 2, 0) }
      let argvv2: *i64 = sys_mmap(8*8) as *i64
      argvv2[0] = bfront as i64
      argvv2[1] = "19861" as *u8 as i64
      argvv2[2] = "8086" as *u8 as i64
      argvv2[3] = "/tmp/_cms_tls_cert.der" as *u8 as i64
      argvv2[4] = "/tmp/_cms_tls_key.bin" as *u8 as i64
      argvv2[5] = "99" as *u8 as i64
      argvv2[6] = 0
      let envp2: *i64 = sys_mmap(16) as *i64
      envp2[0] = 0
      sys_execve(bfront, argvv2, envp2)
      sys_exit(127)
  }
321
  let req: *u8 = sys_mmap(65536)
  let resp: *u8 = sys_mmap(524288)
  let nocookie: *u8 = sys_mmap(8)
  nocookie[0] = 0 as u8
  let sess: *u8 = sys_mmap(64)
  sess[0] = 0 as u8
  let csrf: *u8 = sys_mmap(64)
  csrf[0] = 0 as u8
330
  // T0: validated HTTPS GET / through the front (boot-poll: handshake fails until both are up)
  var rn: i64 = 0 - 1
  var tries: i64 = 0
  while tries < 60 {
      let rl0: i64 = tg_get(req, "/" as *u8, nocookie)
      rn = tg_https(store, req, rl0, resp, 524287)
      if rn > 0 { tries = 60 }
      if rn <= 0 { sys_sleep_ms(200); tries = tries + 1 }
  }
  // ★★SETUP-FAILED IS NOT A SUBJECT FAILURE -- ADDED 2026-08-01 AFTER THIS GATE LIED BY 4 ROWS.
  // If the boot-poll never got a single response, the daemons never came up and NOTHING downstream
  // can be evidence about TLS. Previously the gate ploughed on and reported 1/5: four positive rows
  // red and the untrusted-anchor row "PASS" -- a NEGATIVE CONTROL THAT PASSES BECAUSE EVERYTHING IS
  // REFUSED, which cannot tell correct validation from a dead listener. ★A NEG-CONTROL IS ONLY
  // EVIDENCE WHEN THE POSITIVE PATH WORKS; on a dead subject it is the most dangerous green there is.
  // MEASURED ROOT CAUSE the first time this fired: both daemon logs said BIND-FAIL -- ports 8086/8447
  // were still held by ORPHANS from an earlier run that gate_run KILLED ON ITS 12s DEADLINE, so the
  // gate never reached its own nxk_kill teardown. ★A GATE KILLED BY A DEADLINE SKIPS ITS TEARDOWN AND
  // ITS ORPHANED DAEMONS POISON EVERY LATER RUN -- run port-binding gates through nx_job_run (uncapped).
  if rn <= 0 {
      tg_w("CMSGATE row=nx_cms_tls SETUP-FAILED daemons never served -- NOT a TLS failure. READ THE ERRNO in /tmp/_cms_tls_front_gate.log and /tmp/_cms_admin_tls_gate.log; do NOT assume a cause. 98=EADDRINUSE (something already listens: identify the OWNER before killing anything -- this gate's original port 8447 belonged to the live nx_translate_daemon, and a name-based reaper aimed at it would have killed a supervised production service), 13=EACCES, 99=EADDRNOTAVAIL.\n" as *u8)
      sys_exit(2)
  }
  var pass: i64 = 0
  var rows: i64 = 0
  var ok: i64 = 0
  let ctr: *i64 = gv_ctr()
  gv_head("nx_cms_tls_gate -- CMS behind a real TLS 1.3 front" as *u8)
  if rn > 0 { if tg_has(resp, rn, "200 OK" as *u8) == 1 { if tg_has(resp, rn, "Andelin West Law" as *u8) == 1 { ok = 1 } } }
  rows = rows + 1; pass = pass + tg_row(0, ok, "validated TLS1.3 handshake + proxied GET /" as *u8)
  gv_check("validated TLS1.3 handshake + proxied GET /" as *u8, ok, ctr)
362
  // T1: login over TLS -> 303 + Secure cookie
  var rl: i64 = tg_post(req, "/admin/login" as *u8, nocookie, "pw=tls-gate-pw-1" as *u8)
  rn = tg_https(store, req, rl, resp, 524287)
  ok = 0
  if rn > 0 { if tg_has(resp, rn, "303" as *u8) == 1 { if tg_has(resp, rn, "; Secure" as *u8) == 1 {
      let sp: i64 = tg_index(resp, rn, "nsess=" as *u8)
      if sp >= 0 {
          var m2: i64 = 0
          while m2 < 32 { sess[m2] = resp[sp+6+m2]; m2 = m2 + 1 }
          sess[32] = 0 as u8
          ok = 1
      }
  } } }
  rows = rows + 1; pass = pass + tg_row(1, ok, "login over TLS issues Secure cookie" as *u8)
  gv_check("login over TLS issues Secure cookie" as *u8, ok, ctr)
378
  // T2: editor over TLS with the session
  rl = tg_get(req, "/admin" as *u8, sess)
  rn = tg_https(store, req, rl, resp, 524287)
  ok = 0
  if rn > 0 { if tg_has(resp, rn, "name=\"hero_title\"" as *u8) == 1 {
      let cp: i64 = tg_index(resp, rn, "name=\"csrf\" value=\"" as *u8)
      if cp >= 0 {
          var m3: i64 = 0
          while m3 < 32 { csrf[m3] = resp[cp+19+m3]; m3 = m3 + 1 }
          csrf[32] = 0 as u8
          ok = 1
      }
  } }
  rows = rows + 1; pass = pass + tg_row(2, ok, "editor reached over TLS" as *u8)
  gv_check("editor reached over TLS" as *u8, ok, ctr)
394
  // T3: edit-publish over TLS, live page reflects it
  let body3: *u8 = sys_mmap(4096)
  var b3: i64 = tg_cat(body3, 0, "csrf=" as *u8)
  b3 = tg_catn(body3, b3, csrf, 32)
  b3 = tg_cat(body3, b3, "&hero_title=TLS+Edited+Headline" as *u8)
  body3[b3] = 0 as u8
  rl = tg_post(req, "/admin/save" as *u8, sess, body3)
  rn = tg_https(store, req, rl, resp, 524287)
  ok = 0
  if rn > 0 { if tg_has(resp, rn, "303" as *u8) == 1 {
      let rl3: i64 = tg_get(req, "/" as *u8, nocookie)
      let rn3: i64 = tg_https(store, req, rl3, resp, 524287)
      if rn3 > 0 { if tg_has(resp, rn3, "TLS Edited Headline" as *u8) == 1 { ok = 1 } }
  } }
  rows = rows + 1; pass = pass + tg_row(3, ok, "edit-publish round trip over TLS" as *u8)
  gv_check("edit-publish round trip over TLS" as *u8, ok, ctr)
411
  // T4: NEGATIVE CONTROL -- empty trust store must REFUSE the handshake
  let rl4: i64 = tg_get(req, "/" as *u8, nocookie)
  let rn4: i64 = tg_https(empty_store, req, rl4, resp, 524287)
  ok = 0
  if rn4 < 0 { ok = 1 }
  rows = rows + 1; pass = pass + tg_row(4, ok, "untrusted anchor handshake REFUSED (validation real)" as *u8)
  gv_check("untrusted anchor handshake REFUSED (validation real)" as *u8, ok, ctr)
419
  // ---- teardown ----
  nxk_kill(pid_front, 9)
  nxk_kill(pid_admin, 9)
  let stbuf: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid_front, stbuf, 0)
  sys_wait4(pid_admin, stbuf, 0)
426
  var verdict: *u8 = "FAIL" as *u8
  if pass == rows { verdict = "PASS" as *u8 }
  let line: *u8 = sys_mmap(512)
  var lo: i64 = tg_cat(line, 0, "CMSGATE row=nx_cms_tls rows=" as *u8)
  let t2: *u8 = sys_mmap(24)
  var mm: i64 = rows
  var kk: i64 = 0
  if mm == 0 { t2[0] = 48 as u8; kk = 1 }
  while mm > 0 { t2[kk] = (48 + (mm % 10)) as u8; mm = mm / 10; kk = kk + 1 }
  var ii: i64 = 0
  while ii < kk { line[lo] = t2[kk-1-ii]; lo = lo + 1; ii = ii + 1 }
  lo = tg_cat(line, lo, " pass=" as *u8)
  mm = pass; kk = 0
  if mm == 0 { t2[0] = 48 as u8; kk = 1 }
  while mm > 0 { t2[kk] = (48 + (mm % 10)) as u8; mm = mm / 10; kk = kk + 1 }
  ii = 0
  while ii < kk { line[lo] = t2[kk-1-ii]; lo = lo + 1; ii = ii + 1 }
  lo = tg_cat(line, lo, " verdict=" as *u8)
  lo = tg_cat(line, lo, verdict)
  lo = tg_cat(line, lo, " epoch=" as *u8)
  mm = sys_now_realtime_sec(); kk = 0
  if mm == 0 { t2[0] = 48 as u8; kk = 1 }
  while mm > 0 { t2[kk] = (48 + (mm % 10)) as u8; mm = mm / 10; kk = kk + 1 }
  ii = 0
  while ii < kk { line[lo] = t2[kk-1-ii]; lo = lo + 1; ii = ii + 1 }
  line[lo] = 10 as u8
  lo = lo + 1
  sys_write(1, line, lo)
  let gf: i64 = sys_openat_append("knowledge/status/cms_gate.log" as *u8, 0x1a4)
  if gf >= 0 { sys_write(gf, line, lo); sys_close(gf) }
  // D001 MIGRATION 2026-08-01 (hand-migrated: nx_gate_dry_apply SKIPped this gate -- "no verdict=GREEN
  // tail", the same shape gap that blocked the q4k KAT, so the mechanical remedy could not cover it).
  // The legacy CMSGATE line above is KEPT because other readers already parse it -- API contract
  // stability (rule 19): add the new contract first, never break the old one in the same change.
  let grc: i64 = gv_verdict("cms-tls" as *u8, ctr, "CMS served behind a real validated TLS 1.3 front" as *u8)
  sys_exit(grc)
  return grc
464}
nx_cms_tls_gate.nx source

`nx_cms_tls_gate.nx` source
