nx_compare_instrument_verify.nx source

1// nx_compare_instrument_verify.nx -- SOVEREIGN live-verify of the /compare/instrument integration (operator 2// 2026-07-10: verify via nishi browser/TLS on OUR hardware, NOT WebFetch). Fetches the live pages over the 3// sovereign TLS stack (nx_https_fetch_follow + Mozilla trust store -- same path as nx_live_verify / the connect 4// verifier) and counts THIS integration's unique markers in the served bytes. Proves: the instrument is a 5// /compare domain (not a separate page), the hub card is wired, the JSON API is served for workstreams, and the 6// old /instrument redirects. GREEN = the sovereign verifier ran and measured live state byte-true. 7// license_tier: ORIGINAL expect_exit: 0 8import "nx_syscalls.nx" 9import "nx_x509_trust_store.nx" 10import "nx_trust_store_load_from_certdata.nx" 11import "nx_https_fetch_follow.nx" 12const K_MAGIC_4194304: i64 = 4194304 13 14func lv(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 15func lvn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)} let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1} sys_write(1,bb,k); return 0 } 16func slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 17func count_in(hay: *u8, n: i64, needle: *u8) -> i64 { 18 let m: i64 = slen(needle) 19 if m == 0 { return 0 } 20 var c: i64=0; var i: i64=0 21 while i + m <= n { 22 var j: i64=0; var ok: i64=1 23 while j < m { if hay[i+j] != needle[j] { ok=0; j=m } else { j=j+1 } } 24 if ok==1 { c=c+1 } 25 i=i+1 26 } 27 return c 28} 29func mark(label: *u8, hay: *u8, n: i64, needle: *u8, fails: *i64) -> i64 { 30 let c: i64 = count_in(hay, n, needle) 31 lv(" "); lv(label); lv(" = "); lvn(c) 32 if c > 0 { lv(" OK\n") } else { lv(" MISS\n"); fails[0] = fails[0] + 1 } 33 return c 34} 35 36func main() -> i64 { 37 let r: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt" as *u8, 512, K_MAGIC_4194304) 38 if r <= 0 { lv("CMPVERIFY: certdata load failed\n" as *u8); return 1 } 39 let store: *TrustStore = r as *TrustStore 40 let cap: i64 = K_MAGIC_4194304 41 let out: *u8 = sys_mmap(cap) 42 let status: *i64 = sys_mmap(8) as *i64 43 let fails: *i64 = sys_mmap(8) as *i64 44 fails[0] = 0 45 46 lv("=== nx_compare_instrument_verify -- /compare/instrument LIVE, byte-true over SOVEREIGN TLS (no WebFetch) ===\n") 47 48 // 1. the integrated matrix page 49 let n1: i64 = nx_https_fetch_follow("https://nishifamily.com/compare/instrument" as *u8, store, out, cap, 6, status) 50 lv(" /compare/instrument status="); lvn(status[0]); lv(" bytes="); lvn(n1); lv("\n") 51 mark("title 'Evaluation Instrument'" as *u8, out, n1, "Evaluation Instrument" as *u8, fails) 52 mark("honest 'coverage 666/1000'" as *u8, out, n1, "666/1000" as *u8, fails) 53 mark("row 'Drift and claim/proof gating'" as *u8, out, n1, "claim/proof gating" as *u8, fails) 54 mark("competitor 'OpenSSF Scorecard'" as *u8, out, n1, "OpenSSF Scorecard" as *u8, fails) 55 mark("breadcrumb 'Compare' (IN the compare family)" as *u8, out, n1, "Compare" as *u8, fails) 56 57 // 2. the hub -- the instrument card must be wired in (integration, not separate page) 58 let n2: i64 = nx_https_fetch_follow("https://nishifamily.com/compare" as *u8, store, out, cap, 6, status) 59 lv(" /compare status="); lvn(status[0]); lv(" bytes="); lvn(n2); lv("\n") 60 mark("hub card links /compare/instrument" as *u8, out, n2, "/compare/instrument" as *u8, fails) 61 62 // 3. the JSON API -- workstream-integratable 63 let n3: i64 = nx_https_fetch_follow("https://nishifamily.com/compare/instrument/api.json" as *u8, store, out, cap, 6, status) 64 lv(" /compare/instrument/api.json status="); lvn(status[0]); lv(" bytes="); lvn(n3); lv("\n") 65 mark("json coverage field" as *u8, out, n3, "coverage" as *u8, fails) 66 mark("json exceeds field" as *u8, out, n3, "exceeds" as *u8, fails) 67 68 // 4. the old /instrument redirects into the compare family (duplicate retired) 69 let n4: i64 = nx_https_fetch_follow("https://nishifamily.com/instrument" as *u8, store, out, cap, 6, status) 70 lv(" /instrument (old) status="); lvn(status[0]); lv(" bytes="); lvn(n4); lv("\n") 71 mark("redirects to /compare/instrument" as *u8, out, n4, "/compare/instrument" as *u8, fails) 72 73 lv(" ---- VERDICT (sovereign, byte-true, on our hardware) ----\n") 74 lv(" fails="); lvn(fails[0]); lv("\n") 75 if fails[0] == 0 { lv("CMPVERIFY: GREEN -- the instrument is LIVE as a /compare domain (integrated, hub-wired, API-served, dupe redirected), verified by our own TLS+parser, zero WebFetch\n"); sys_exit(0); return 0 } 76 lv("CMPVERIFY: RED -- one or more markers not served (see MISS above)\n"); sys_exit(1) 77 return 1 78}