nx_comparestale_dependency_gate_t138.nx source
↩ module page · 105 lines · 7867 B
1// nx_comparestale_dependency_gate_t138.nx -- Verifies ABI consistency and hashes files for dependency comparison in a sandboxed environment.
2import "nx_comparestale_dependency_t138.nx"
3import "nx_gate_verdict.nx"
4func dg_write(path: *u8,body: *u8,n: i64) -> i64 {
5 let fd: i64=sys_openat_exclusive(path,420);if fd<0{return fd};var off: i64=0
6 while off<n{let wrote: i64=sys_write(fd,body+off,n-off);if wrote<=0{sys_close(fd);return 0-5};off=off+wrote}
7 let synced: i64=sys_fsync(fd);let closed: i64=sys_close(fd);if synced!=0||closed!=0{return 0-5};return 0
8}
9func dg_hex(body: *u8,n: i64,hex: *u8) -> i64 {
10 let digest: *u8=sys_mmap_shared(SHA256_DIGEST_BYTES);let rc: i64=sha256_digest_checked_native(body,n,digest)
11 let digits: *u8="0123456789abcdef";var i: i64=0
12 while i<SHA256_DIGEST_BYTES{let c: i64=digest[i] as i64;hex[i*2]=digits[c/16];hex[i*2+1]=digits[c%16];i=i+1};hex[64]=0
13 sys_munmap(digest,SHA256_DIGEST_BYTES);return rc
14}
15
16func dg_path(root: *u8,suffix: *u8) -> *u8 {
17 let p: *u8=sys_mmap_shared(cd_len(root)+cd_len(suffix)+1);var n: i64=cs_cat(p,0,root);n=cs_cat(p,n,suffix);p[n]=0;return p
18}
19func dg_abi() -> i64 {
20 let marker: *u8="single-abi-marker";let addr: i64=marker as i64
21 let rb: *i64=sys_mmap_shared(CD_REGION_BYTES+CD_ABI_WORD_BYTES) as *i64;let r: *NxFileReadRegion=rb as *NxFileReadRegion
22 rb[9]=991;fio_region_init(r);var ok: i64=1
23 if rb[9]!=991||rb[0]!=(0-1)||rb[8]!=0{ok=0}
24 r.fd=1;r.total=2;r.start=3;r.length=4;r.read_bytes=5;r.last_read=6;r.stage=marker;r.code=8;r.close_code=9
25 w("ABI region slots:");var i: i64=0;while i<10{w(" ");wn(rb[i]);i=i+1};w(" marker=");wn(addr);w("\n")
26 i=0;while i<9{if i!=6{if rb[i]!=i+1{ok=0}};i=i+1};if rb[6]!=addr||rb[9]!=991{ok=0}
27 let jb: *i64=sys_mmap_shared(CD_WRITER_BYTES+CD_ABI_WORD_BYTES) as *i64;let j: *JsonWriter=jb as *JsonWriter;jb[5]=992
28 j.buf=marker;j.pos=2;j.cap=3;j.depth=4;j.prior=marker
29 w("ABI writer slots:");i=0;while i<6{w(" ");wn(jb[i]);i=i+1};w("\n")
30 if jb[0]!=addr||jb[1]!=2||jb[2]!=3||jb[3]!=4||jb[4]!=addr||jb[5]!=992{ok=0}
31 let cb: *i64=sys_mmap_shared(CD_FILE_BYTES+CD_ABI_WORD_BYTES) as *i64;let c: *CsDependencyFile=cb as *CsDependencyFile;cb[6]=993
32 c.code=1;c.bytes=2;c.read_bytes=3;c.reference_found=4;c.hash=marker;c.stage=marker
33 w("ABI file slots:");i=0;while i<7{w(" ");wn(cb[i]);i=i+1};w("\n")
34 if cb[0]!=1||cb[1]!=2||cb[2]!=3||cb[3]!=4||cb[4]!=addr||cb[5]!=addr||cb[6]!=993{ok=0}
35 sys_munmap(rb as *u8,CD_REGION_BYTES+CD_ABI_WORD_BYTES);sys_munmap(jb as *u8,CD_WRITER_BYTES+CD_ABI_WORD_BYTES);sys_munmap(cb as *u8,CD_FILE_BYTES+CD_ABI_WORD_BYTES)
36 return ok
37}
38
39func main(argc: i64,argv: *i64) -> i64 {
40 if argc!=2{return 2};let root: *u8=argv[1] as *u8
41 let ctr: *i64=gv_ctr();gv_head("DEPENDENCY-OBSERVATION")
42 if gv_need("isolated-directory",sys_mkdir(root,493)==0,ctr)==0{return 2}
43 gv_check("native-struct-field-offsets-and-canaries",dg_abi(),ctr)
44 let cp: *u8=dg_path(root,"/consumer.html");let dp: *u8=dg_path(root,"/body.wasm")
45 let token: *u8="releases/body.wasm";let tn: i64=cd_len(token);let wn: i64=sha256_workspace_bytes()
46 let n: i64=CS_CAP+wn+tn;let body: *u8=sys_mmap_shared(n);var i: i64=0
47 while i<n{body[i]=120 as u8;i=i+1};i=0;while i<tn{body[wn-3+i]=token[i];i=i+1}
48 let ch: *u8=sys_mmap_shared(65);let dh: *u8=sys_mmap_shared(65);dg_hex(body,n,ch);dg_hex("abcdefgh",8,dh)
49 gv_check("consumer-larger-than-legacy-cap",n>CS_CAP,ctr)
50 gv_check("durable-consumer-fixture",dg_write(cp,body,n)==0,ctr)
51 gv_check("durable-dependency-fixture",dg_write(dp,"abcdefgh",8)==0,ctr)
52 let c: *CsDependencyFile=sys_mmap_shared(CD_FILE_BYTES) as *CsDependencyFile
53 let d: *CsDependencyFile=sys_mmap_shared(CD_FILE_BYTES) as *CsDependencyFile
54 let hashes: *u8=sys_mmap_shared(130);cd_file_init(c,hashes);cd_file_init(d,hashes+65)
55 gv_check("consumer-full-stream",cd_scan(cp,token,c)==0&&c.bytes==n&&c.read_bytes==n,ctr)
56 gv_check("consumer-sha-exact",cd_equal(cd_file_state(c,ch),"IDENTITY_MATCH"),ctr)
57 gv_check("reference-spans-buffer-boundary",c.reference_found==1,ctr)
58 gv_check("dependency-identity",cd_scan(dp,"",d)==0&&cd_equal(cd_file_state(d,dh),"IDENTITY_MATCH"),ctr)
59 let priorhash: *u8=sys_mmap_shared(65);i=0;while i<65{priorhash[i]=c.hash[i];i=i+1}
60 cd_scan(cp,token,c)
61 gv_check("repeat-read-same-identity",cd_equal(c.hash,priorhash)&&c.bytes==n,ctr)
62 gv_check("same-size-wrong-fixture",dg_write(dg_path(root,"/wrong.wasm"),"xbcdefgh",8)==0,ctr)
63 cd_scan(dg_path(root,"/wrong.wasm"),"",d)
64 gv_check("same-size-wrong-refused",d.bytes==8&&cd_equal(cd_file_state(d,dh),"IDENTITY_MISMATCH"),ctr)
65 gv_check("truncated-prefix-fixture",dg_write(dg_path(root,"/prefix.html"),body,wn)==0,ctr)
66 cd_scan(dg_path(root,"/prefix.html"),token,c)
67 gv_check("truncated-prefix-not-consumer",cd_equal(cd_file_state(c,ch),"IDENTITY_MISMATCH")&&c.reference_found==0,ctr)
68 cd_scan(dg_path(root,"/missing"),"",d)
69 gv_check("missing-distinct",d.code==(0-2)&&cd_equal(cd_file_state(d,dh),"MISSING"),ctr)
70 cd_scan(root,"",d)
71 gv_check("directory-read-unobservable-not-missing",d.code!=0&&cd_equal(cd_file_state(d,dh),"UNOBSERVABLE"),ctr)
72 cd_scan(cp,"not-present-reference",c)
73 gv_check("reference-absent-not-bound",cd_equal(cd_file_state(c,ch),"IDENTITY_MATCH")&&c.reference_found==0,ctr)
74 gv_check("short-expected-hash-refused",cd_hash_valid("abcd")==0,ctr)
75 cd_scan(cp,token,c);cd_scan(dp,"",d)
76 let out: *u8=sys_mmap_shared(CS_CAP);let j: *JsonWriter=sys_mmap_shared(CD_WRITER_BYTES) as *JsonWriter;let prior: *u8=sys_mmap_shared(JE_MAX_DEPTH)
77 let rendered: i64=cd_report(cp,ch,dp,dh,token,c,d,out,CS_CAP,j,prior)
78 gv_check("structured-report-generated",rendered>0,ctr)
79 gv_check("no-overall-green",cs_find(out,rendered,"GREEN")<0&&cs_find(out,rendered,"PARTIAL_OBSERVATION")>=0,ctr)
80 gv_check("qualified-authority-unknown",cs_find(out,rendered,"caller assertion; qualified receipt linkage unknown")>=0,ctr)
81 gv_check("unknown-execution-and-coverage",cs_find(out,rendered,"\"executed_identity\":\"UNKNOWN\"")>=0&&cs_find(out,rendered,"\"complete_dependency_coverage\":\"UNKNOWN\"")>=0,ctr)
82 gv_check("read-only-repeat-preserves-fixture",dg_write(cp,body,n)==(0-17),ctr)
83
84 cd_scan(dg_path(root,"/missing"),"",d)
85 let missing_report: i64=cd_report(cp,ch,dp,dh,token,c,d,out,CS_CAP,j,prior)
86 gv_check("missing-observed-failure-not-unknown",cs_find(out,missing_report,"\"observed_selected_edge_failures\":1")>=0&&cs_find(out,missing_report,"\"unobservable_selected_edges\":0")>=0,ctr)
87 cd_scan(root,"",d)
88 let unreadable_report: i64=cd_report(cp,ch,dp,dh,token,c,d,out,CS_CAP,j,prior)
89 gv_check("unreadable-remains-unknown",cs_find(out,unreadable_report,"\"unobservable_selected_edges\":1")>=0&&cs_find(out,unreadable_report,"\"observed_selected_edge_failures\":0")>=0,ctr)
90 gv_check("output-capacity-refuses",cd_report(cp,ch,dp,dh,token,c,d,out,1,j,prior)<0,ctr)
91 let args: *i64=sys_mmap_shared(8*8) as *i64
92 args[0]="nx_comparestale" as i64;args[1]="dependency-check" as i64;args[2]=cp as i64;args[3]=ch as i64
93 args[4]=dg_path(root,"/wrong.wasm") as i64;args[5]=dh as i64;args[6]=token as i64;args[7]=0
94 let child: i64=sys_fork()
95 if child==0{sys_close(1);let rc: i64=cd_command(7,args);sys_exit(rc);return rc}
96 let status: *i64=sys_mmap_shared(8) as *i64;status[0]=0
97 var waited: i64=0-1;if child>0{waited=sys_wait4(child,status,0)}
98 gv_check("closed-output-io-precedes-mismatch",waited==child&&child>0&&((status[0]>>8)&255)==4,ctr)
99 gv_check("empty-artifact-fixture",dg_write(dg_path(root,"/empty"),"",0)==0,ctr)
100 cd_scan(dg_path(root,"/empty"),"",d);gv_check("empty-artifact-not-usable-match",d.code==0&&d.bytes==0&&cd_equal(cd_file_state(d,dh),"EMPTY"),ctr)
101 cd_scan(dp,"",d);cd_report(cp,ch,dp,dh,token,c,d,out,CS_CAP,j,prior)
102
103 sys_write(1,"OBSERVATION ",12);sys_write(1,out,rendered);sys_write(1,"\n",1)
104 return gv_verdict("nx_comparestale_dependency_gate",ctr,"One caller-selected local edge; runtime and complete dependency coverage unknown.")
105}