code wiki / _hdl_build / nx_connect_app_gate.nx
`nx_connect_app_gate.nx` source

↩ module page · 456 lines · 27721 B
1// nx_connect_app_gate.nx -- offline gate for the CONNECT interactive app (nx_connect_serve pure core).
2// Drives cs_handle DIRECTLY with synthetic HTTP requests (no sockets, deterministic) and asserts on the
3// rendered bytes. Rewritten 2026-07-23 for the MULTI-PAGE app, and extended to gate the newly-surfaced
4// LDS reconnection page -- the first time that capability is reachable by a real user.
5// license_tier: ORIGINAL  expect_exit: 0
6import "nx_connect_serve.nx"
7
8const AG_BUF: i64 = 1048576
9
10func ga_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
11func ga_n(v: i64) -> i64 { let t: *u8=sys_mmap(32); let o: i64=cu_putn(t,0,v); t[o]=0 as u8; ga_w(t); return 0 }
12func ga_check(pass: i64, label: *u8, fails: *i64) -> i64 {
  ga_w("  " as *u8); ga_w(label); ga_w(": " as *u8)
  if pass==1 { ga_w("PASS\n" as *u8) } else { ga_w("FAIL\n" as *u8); fails[0]=fails[0]+1 }
  return 0
16}
17// count non-overlapping occurrences (a plain has() cannot express "exactly one active tab")
18func ga_count(buf: *u8, n: i64, needle: *u8) -> i64 {
  let nl: i64 = cs_slen(needle)
  if nl==0 { return 0 }
  var hits: i64=0
  var i: i64=0
  while i+nl<=n {
      var k: i64=0
      var hit: i64=1
      while k<nl { if buf[i+k]!=needle[k] { hit=0; k=nl } else { k=k+1 } }
      if hit==1 { hits=hits+1; i=i+nl } else { i=i+1 }
  }
  return hits
30}
31func ga_has(buf: *u8, n: i64, needle: *u8) -> i64 { if ga_count(buf,n,needle)>0 { return 1 } return 0 }
32
33func ga_get(dst: *u8, path: *u8) -> i64 {
  var o: i64 = cs_cat(dst, 0, "GET " as *u8)
  o = cs_cat(dst, o, path)
  o = cs_cat(dst, o, " HTTP/1.1\r\nHost: x\r\n\r\n" as *u8)
  return o
38}
39func ga_post(dst: *u8, path: *u8, body: *u8) -> i64 {
  let bl: i64 = cs_slen(body)
  var o: i64 = cs_cat(dst, 0, "POST " as *u8)
  o = cs_cat(dst, o, path)
  o = cs_cat(dst, o, " HTTP/1.1\r\nHost: x\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: " as *u8)
  o = cs_catn(dst, o, bl)
  o = cs_cat(dst, o, "\r\n\r\n" as *u8)
  o = cs_cat(dst, o, body)
  return o
48}
49
50func main() -> i64 {
  let fails: *i64 = sys_mmap(16) as *i64
  fails[0]=0
  let req: *u8 = sys_mmap(65536)
  let out: *u8 = sys_mmap(AG_BUF)
  let ctx: *i64 = cs_world_new()
  ga_w("=== nx_connect_app_gate -- the multi-page CONNECT app core, driven offline ===\n" as *u8)
57
  // ---- T1: home renders through the UI kit with ADA landmarks + the nishi_ds tokens ----
  var rn: i64 = ga_get(req, "/connect" as *u8)
  var n: i64 = cs_handle(ctx, req, rn, out, AG_BUF)
  var t1: i64 = 1
  if ga_has(out, n, "HTTP/1.1 200 OK" as *u8)==0 { t1=0 }
  if ga_has(out, n, "<main id=\"main\">" as *u8)==0 { t1=0 }
  if ga_has(out, n, "class=\"skip\" href=\"#main\"" as *u8)==0 { t1=0 }
  if ga_has(out, n, "--accent:#7aa2ff" as *u8)==0 { t1=0 }
  if ga_has(out, n, "Reconnect" as *u8)==0 { t1=0 }
  if ga_has(out, n, "<script" as *u8)==1 { t1=0 }
  ga_check(t1, "T1 home: 200, skip-link/main landmarks, nishi_ds tokens, nav present, zero JS" as *u8, fails)
69
  // ---- T2: exactly one nav tab is aria-current and it follows the route ----
  var t2: i64 = 1
  if ga_count(out, n, "aria-current=\"page\"" as *u8)!=1 { t2=0 }
  rn = ga_get(req, "/connect/events" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  if ga_count(out, n, "aria-current=\"page\"" as *u8)!=1 { t2=0 }
  if ga_has(out, n, "/connect/events\" aria-current=\"page\"" as *u8)==0 { t2=0 }
  ga_check(t2, "T2 nav: exactly one aria-current tab per page, tracking the active route" as *u8, fails)
78
  // ---- T3: reciprocal ZERO is visible on the partners page (the R1 harmonic-mean law) ----
  rn = ga_get(req, "/connect/partners" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  // Scores must be ENGINE OUTPUT, not page copy: Piotr/Mia 55 (reciprocal + 2 shared interests),
  // Vera 45 (reciprocal + 1), Lena exactly 0 (one-sided). If anyone re-hardcodes the page these break.
  var t3: i64 = 1
  if ga_has(out, n, "rank 55" as *u8)==0 { t3=0 }
  if ga_has(out, n, "rank 45" as *u8)==0 { t3=0 }
  if ga_has(out, n, "rank 0" as *u8)==0 { t3=0 }
  if ga_has(out, n, "Lena" as *u8)==0 { t3=0 }
  if ga_has(out, n, "match 92" as *u8)==1 { t3=0 }        // the old fabricated number must be gone
  ga_check(t3, "T3 partners: ranks are COMPUTED by the shared engine (55/45/0), not hardcoded copy" as *u8, fails)
91
  // ---- T3b: the dating lane returns a non-numeric exclusion for a minor, on the live page ----
  var t3b: i64 = 1
  if ga_has(out, n, "Mia" as *u8)==0 { t3b=0 }
  if ga_has(out, n, "excluded" as *u8)==0 { t3b=0 }
  ga_check(t3b, "T3b partners: minor ranks high for LANGUAGE yet the romance lane renders 'excluded'" as *u8, fails)
97
  // ---- T4: the seeded thread translates BOTH directions through the real MT substrate ----
  rn = ga_get(req, "/connect/chat" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  var t4: i64 = 1
  if ga_has(out, n, "hello friend" as *u8)==0 { t4=0 }
  if ga_has(out, n, "привет друг" as *u8)==0 { t4=0 }
  ga_check(t4, "T4 chat: seeded thread translates ru->en AND en->ru through nx_mt_multi" as *u8, fails)
105
  // ---- T5: POST a urlencoded Russian message -> live translation renders ----
  rn = ga_post(req, "/connect/say" as *u8, "text=%D1%81%D0%BF%D0%B0%D1%81%D0%B8%D0%B1%D0%BE&speaker=vera" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  var t5: i64 = 1
  if ga_has(out, n, "thank" as *u8)==0 { t5=0 }        // спасибо -> thanks (lexicon token, not a phrase)
  if ga_has(out, n, "спасибо" as *u8)==0 { t5=0 }      // the original is kept beside it
  if ga_has(out, n, "class=\"tr\"" as *u8)==0 { t5=0 } // rendered on the translation line, not inline
  ga_check(t5, "T5 POST /say: urlencoded Russian renders the original AND its live translation" as *u8, fails)
114
  // ---- T6: a correction attaches WITHOUT destroying the original ----
  rn = ga_post(req, "/connect/correct" as *u8, "text=spasibo+means+thank+you" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  var t6: i64 = 1
  if ga_has(out, n, "corrected: spasibo means thank you" as *u8)==0 { t6=0 }
  if ga_has(out, n, "спасибо" as *u8)==0 { t6=0 }
  ga_check(t6, "T6 correction attaches beside the preserved original" as *u8, fails)
122
  // ---- T7: TWO-DEEP wall enforced LIVE, refusal RENDERED ----
  rn = ga_post(req, "/connect/rsvp" as *u8, "who=minor&ev=youth" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  var t7: i64 = 1
  if ga_has(out, n, "RSVP refused" as *u8)==0 { t7=0 }
  rn = ga_post(req, "/connect/rsvp" as *u8, "who=adult&ev=youth" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  rn = ga_post(req, "/connect/rsvp" as *u8, "who=minor&ev=youth" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  if ga_has(out, n, "RSVP recorded" as *u8)==0 { t7=0 }
  if ga_has(out, n, "RSVP refused" as *u8)==1 { t7=0 }
  ga_check(t7, "T7 two-deep LIVE: youth refused at one adult, admitted once a second adult joins" as *u8, fails)
135
  // ---- T7b: the wall is RENDERED as live verdicts, and it is narrow (peers/parents free) ----
  rn = ga_get(req, "/connect/events" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  var t7b: i64 = 1
  if ga_has(out, n, "Who can reach whom" as *u8)==0 { t7b=0 }
  if ga_has(out, n, "private one-to-one" as *u8)==0 { t7b=0 }
  // exactly two rows are blocked: the one-adult group and the private adult-to-youth message.
  // Peers and parents must stay ALLOWED -- an over-blocking wall is its own failure.
  if ga_count(out, n, ">blocked<" as *u8)!=2 { t7b=0 }
  if ga_count(out, n, ">allowed<" as *u8)!=4 { t7b=0 }
  ga_check(t7b, "T7b wall RENDERED as live verdicts: exactly 2 blocked, 4 allowed (narrow, no over-block)" as *u8, fails)
147
  // ---- T8: revote REPLACES, so a tally can never inflate ----
  rn = ga_post(req, "/connect/vote" as *u8, "opt=1" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  var t8: i64 = 1
  if ga_has(out, n, "Vote recorded" as *u8)==0 { t8=0 }
  rn = ga_post(req, "/connect/vote" as *u8, "opt=2" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  // Library falls back to 2 and Riverside rises to 2 of 4 -> two meters at 50%
  if ga_count(out, n, "width:50%" as *u8)<2 { t8=0 }
  ga_check(t8, "T8 poll: a revote REPLACES the prior ballot (Library 3->2, Riverside 1->2)" as *u8, fails)
158
  // ---- T7c: CAPACITY is real, and a minor cannot join a non-youth event at all ----
  // The picnic seats 6 and starts with 2 going, so 4 more adults fill it and the 5th must be refused.
  var t7c: i64 = 1
  rn = ga_post(req, "/connect/rsvp" as *u8, "who=minor&ev=picnic" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  if ga_has(out, n, "not a youth event" as *u8)==0 { t7c=0 }   // engine code -4, not a two-deep refusal
  var fillc: i64 = 0
  while fillc < 4 {
      rn = ga_post(req, "/connect/rsvp" as *u8, "who=adult&ev=picnic" as *u8)
      n = cs_handle(ctx, req, rn, out, AG_BUF)
      fillc = fillc + 1
  }
  if ga_has(out, n, "RSVP recorded" as *u8)==0 { t7c=0 }        // the 6th seat still admits
  rn = ga_post(req, "/connect/rsvp" as *u8, "who=adult&ev=picnic" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  if ga_has(out, n, "Event is full" as *u8)==0 { t7c=0 }        // the 7th is refused by capacity
  ga_check(t7c, "T7c events engine LIVE: capacity refuses the 7th of 6 seats; a minor on an adult event is -4 not -3" as *u8, fails)
176
  // ---- T8a: INTENT LANES -- escalation needs MUTUAL consent, blocking is unilateral ----
  rn = ga_post(req, "/connect/lane" as *u8, "mine=3&theirs=0" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  var t8a: i64 = 1
  // I asked for Dating, she stayed on Language -> the relationship must NOT move
  if ga_has(out, n, "relationship is <b>Language exchange</b>" as *u8)==0 { t8a=0 }
  rn = ga_post(req, "/connect/lane" as *u8, "mine=3&theirs=3" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  if ga_has(out, n, "relationship is <b>Dating</b>" as *u8)==0 { t8a=0 }   // both opted in -> moves
  rn = ga_post(req, "/connect/block" as *u8, "set=on" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  if ga_has(out, n, "relationship is <b>Blocked</b>" as *u8)==0 { t8a=0 }  // unilateral, immediate
  rn = ga_post(req, "/connect/block" as *u8, "set=off" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  if ga_has(out, n, "relationship is <b>Dating</b>" as *u8)==0 { t8a=0 }   // returns to the mutual level
  // restore the default lane so later teeth see a clean world
  rn = ga_post(req, "/connect/lane" as *u8, "mine=0&theirs=0" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  ga_check(t8a, "T8a intent lanes: unilateral escalation REFUSED, mutual opt-in moves it, block is instant" as *u8, fails)
196
  // ---- T8b: ward join is CONSENT-GATED, revocable, and idempotent (Art.9 by construction) ----
  rn = ga_post(req, "/connect/join" as *u8, "x=1" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  var t8b: i64 = 1
  if ga_has(out, n, "Join refused" as *u8)==0 { t8b=0 }            // no faith consent yet -> refused
  rn = ga_post(req, "/connect/faith" as *u8, "set=on" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  rn = ga_post(req, "/connect/join" as *u8, "x=1" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  if ga_has(out, n, "Joined the community group" as *u8)==0 { t8b=0 }
  rn = ga_post(req, "/connect/join" as *u8, "x=1" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  if ga_has(out, n, "Already a member" as *u8)==0 { t8b=0 }        // idempotent, never double-counts
  rn = ga_post(req, "/connect/faith" as *u8, "set=off" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  if ga_has(out, n, "Faith consent withdrawn" as *u8)==0 { t8b=0 }
  if ga_has(out, n, "Join the group" as *u8)==0 { t8b=0 }          // membership removed with the consent
  ga_check(t8b, "T8b ward join: refused without faith consent, idempotent, and revoked when consent is withdrawn" as *u8, fails)
215
  // ---- T8c: the community-only boundary is CHECKED by the registry, not asserted in copy ----
  rn = ga_get(req, "/connect/community" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  var t8c: i64 = 1
  if ga_has(out, n, "would need: <b>0</b>" as *u8)==0 { t8c=0 }    // our schema: zero admin fields
  if ga_has(out, n, "reports <b>3</b>" as *u8)==0 { t8c=0 }        // NEG-CONTROL admin model: three
  ga_check(t8c, "T8c community boundary MEASURED live: our schema 0 admin fields, admin model 3 (check is load-bearing)" as *u8, fails)
223
  // ---- T8d: group PERMISSIONS rendered as live verdicts -- no admin coup, owner unremovable ----
  rn = ga_get(req, "/connect/community" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  var t8d: i64 = 1
  if ga_has(out, n, "Who may do what here" as *u8)==0 { t8d=0 }
  if ga_has(out, n, "removes a fellow admin" as *u8)==0 { t8d=0 }
  if ga_has(out, n, "announcement channel" as *u8)==0 { t8d=0 }
  // exactly 3 allowed (admin removes member, member posts in group, admin posts in channel)
  // and 4 blocked (peer-admin removal, owner removal, member removing an admin, member posting in channel)
  if ga_count(out, n, ">allowed<" as *u8)!=3 { t8d=0 }
  if ga_count(out, n, ">blocked<" as *u8)!=4 { t8d=0 }
  ga_check(t8d, "T8d group permissions RENDERED live: 3 allowed / 4 blocked (no admin coup, owner unremovable)" as *u8, fails)
236
  // ---- T9: RECONNECT consent gate -- nothing surfaces until opt-in ----
  rn = ga_get(req, "/connect/reconnect" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  var t9: i64 = 1
  if ga_has(out, n, "discovery is <b>off</b>" as *u8)==0 { t9=0 }
  if ga_has(out, n, "Sister Cortez" as *u8)==1 { t9=0 }
  if ga_has(out, n, "Brother Reyes" as *u8)==1 { t9=0 }
  rn = ga_post(req, "/connect/consent" as *u8, "set=on" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  if ga_has(out, n, "Sister Cortez" as *u8)==0 { t9=0 }
  ga_check(t9, "T9 reconnect consent-gate: zero people surfaced while off; roster appears only on opt-in" as *u8, fails)
248
  // ---- T10: the RECONNECTION LAW is visible -- all three conditions necessary, consent absolute ----
  var t10: i64 = 1
  if ga_has(out, n, "strong match" as *u8)==0 { t10=0 }
  if ga_has(out, n, "a different area" as *u8)==0 { t10=0 }
  if ga_has(out, n, "after you left" as *u8)==0 { t10=0 }
  if ga_has(out, n, "A different mission." as *u8)==0 { t10=0 }
  if ga_has(out, n, "has not turned on reconnection discovery" as *u8)==0 { t10=0 }
  if ga_count(out, n, "no match" as *u8)!=4 { t10=0 }
  ga_check(t10, "T10 reconnect law visible: mission^area^time all necessary (4 no-match), opted-out peer hidden" as *u8, fails)
258
  // ---- T11: turning consent OFF withdraws everything again (not a one-way door) ----
  rn = ga_post(req, "/connect/consent" as *u8, "set=off" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  var t11: i64 = 1
  if ga_has(out, n, "Sister Cortez" as *u8)==1 { t11=0 }
  if ga_has(out, n, "discovery is <b>off</b>" as *u8)==0 { t11=0 }
  ga_check(t11, "T11 consent is revocable: turning discovery off withdraws the whole roster again" as *u8, fails)
266
  // ---- T12: NEG-CONTROL -- hostile input renders ESCAPED, never as live markup ----
  rn = ga_post(req, "/connect/say" as *u8, "text=%3Cscript%3Ealert(1)%3C%2Fscript%3E&speaker=you" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  var t12: i64 = 1
  if ga_has(out, n, "<script>alert(1)</script>" as *u8)==1 { t12=0 }
  if ga_has(out, n, "&lt;script&gt;" as *u8)==0 { t12=0 }
  ga_check(t12, "T12 NEG-CONTROL: a posted <script> renders escaped, never as live markup" as *u8, fails)
274
  // ---- T13: the direct-port path routes identically to the edge-mounted path ----
  let c2: *i64 = cs_world_new()
  rn = ga_get(req, "/reconnect" as *u8)
  let n2: i64 = cs_handle(c2, req, rn, out, AG_BUF)
  var t13: i64 = 1
  if ga_has(out, n2, "Reconnect" as *u8)==0 { t13=0 }
  if ga_has(out, n2, "discovery is <b>off</b>" as *u8)==0 { t13=0 }
  ga_check(t13, "T13 unprefixed path (direct :8032) routes the same as the /connect edge mount" as *u8, fails)
283
  // ---- T14: CONTENT-BLIND RECEIVE -- the server stores the browser's ciphertext and renders only that ----
  rn = ga_post(req, "/connect/seal" as *u8, "seq=1&ct=deadbeefcafe1234" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  var t14: i64 = 1
  if ga_has(out, n, "Ciphertext received" as *u8)==0 { t14=0 }         // accepted
  if ga_has(out, n, "deadbeefcafe1234" as *u8)==0 { t14=0 }            // stored + rendered as ciphertext
  if ga_has(out, n, "holds no key and cannot decrypt" as *u8)==0 { t14=0 }
  // NEG-CONTROL: a non-hex payload (i.e. plaintext) is REJECTED, never stored
  rn = ga_post(req, "/connect/seal" as *u8, "seq=2&ct=hello world plaintext" as *u8)
  n = cs_handle(ctx, req, rn, out, AG_BUF)
  if ga_has(out, n, "not valid ciphertext" as *u8)==0 { t14=0 }
  if ga_has(out, n, "hello world plaintext" as *u8)==1 { t14=0 }       // plaintext never stored/rendered
  ga_check(t14, "T14 content-blind receive: hex ciphertext stored+shown; plaintext REJECTED (server holds only ciphertext)" as *u8, fails)
297
  // ============ SHARED CONTENT-BLIND PLANE (full-E2E server half) -- driven via cs_handle2 ============
  let sh: *i64 = cs_shared_new()
300
  // ---- T15: pubkey directory -- store, list, and UPSERT (latest key wins, count never inflates) ----
  var t15: i64 = 1
  rn = ga_post(req, "/connect/pubkey" as *u8, "n=alice&p=8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  if ga_has(out, n, "application/json" as *u8)==0 { t15=0 }
  if ga_has(out, n, "\"ok\":1" as *u8)==0 { t15=0 }
  rn = ga_post(req, "/connect/pubkey" as *u8, "n=bob&p=de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  rn = ga_get(req, "/connect/pubkeys" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  if ga_has(out, n, "\"n\":\"alice\"" as *u8)==0 { t15=0 }
  if ga_has(out, n, "\"n\":\"bob\"" as *u8)==0 { t15=0 }
  // upsert: alice replaces her key -> directory still holds exactly one alice row, with the NEW key
  rn = ga_post(req, "/connect/pubkey" as *u8, "n=alice&p=0000000000000000000000000000000000000000000000000000000000000001" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  rn = ga_get(req, "/connect/pubkeys" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  if ga_count(out, n, "\"n\":\"alice\"" as *u8)!=1 { t15=0 }
  if ga_has(out, n, "0000000000000000000000000000000000000000000000000000000000000001" as *u8)==0 { t15=0 }
  if ga_has(out, n, "8520f009" as *u8)==1 { t15=0 }
  // a malformed key or name is refused outright
  rn = ga_post(req, "/connect/pubkey" as *u8, "n=Mallory!&p=zz20f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  if ga_has(out, n, "\"ok\":0" as *u8)==0 { t15=0 }
  if sh[0]!=2 { t15=0 }
  ga_check(t15, "T15 pubkey directory: store+list, upsert replaces (never duplicates), malformed refused" as *u8, fails)
327
  // ---- T16: ROUTED sealed delivery -- ciphertext crosses sessions to the named recipient only ----
  var t16: i64 = 1
  rn = ga_post(req, "/connect/seal" as *u8, "from=alice&to=bob&seq=12345&ct=deadbeefcafe1234" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  if ga_has(out, n, "\"ok\":1" as *u8)==0 { t16=0 }
  rn = ga_get(req, "/connect/sealed?u=bob" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  if ga_has(out, n, "\"f\":\"alice\"" as *u8)==0 { t16=0 }
  if ga_has(out, n, "\"s\":12345" as *u8)==0 { t16=0 }
  if ga_has(out, n, "deadbeefcafe1234" as *u8)==0 { t16=0 }
  // the sender's CURRENT directory key rides along so the recipient can derive without a second fetch
  if ga_has(out, n, "\"p\":\"0000000000000000000000000000000000000000000000000000000000000001\"" as *u8)==0 { t16=0 }
  // alice's OWN inbox stays empty -- routing is by recipient, not broadcast
  rn = ga_get(req, "/connect/sealed?u=alice" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  if ga_has(out, n, "\"msgs\":[]" as *u8)==0 { t16=0 }
  // sending to a name with NO published key is refused loudly (a message nobody can decrypt, never stored)
  rn = ga_post(req, "/connect/seal" as *u8, "from=alice&to=nobody&seq=2&ct=deadbeef" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  if ga_has(out, n, "\"r\":-3" as *u8)==0 { t16=0 }
  if sh[1]!=1 { t16=0 }
  ga_check(t16, "T16 routed delivery: bob receives alice's ct+seq+her key; alice's inbox empty; keyless recipient refused" as *u8, fails)
350
  // ---- T17: NEG-CONTROL -- routed plaintext is REJECTED, the shared store never grows ----
  var t17: i64 = 1
  rn = ga_post(req, "/connect/seal" as *u8, "from=alice&to=bob&seq=3&ct=hello world plaintext" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  if ga_has(out, n, "\"ok\":0" as *u8)==0 { t17=0 }
  if sh[1]!=1 { t17=0 }
  ga_check(t17, "T17 NEG-CONTROL: routed plaintext refused -- the shared plane stores hex ciphertext only" as *u8, fails)
358
  // ---- T18: the legacy per-session seal path is UNCHANGED beside the shared plane ----
  var t18: i64 = 1
  rn = ga_post(req, "/connect/seal" as *u8, "seq=9&ct=0123456789abcdef" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  if ga_has(out, n, "Ciphertext received" as *u8)==0 { t18=0 }   // HTML banner, not JSON
  if sh[1]!=1 { t18=0 }                                          // shared plane untouched without from/to
  ga_check(t18, "T18 back-compat: seal without from/to still runs the per-session path (banner, shared plane untouched)" as *u8, fails)
366
  // ---- T20: DELETE-ON-DELIVERY -- an ack tombstones a routed message so it is never served again, and
  // the tombstone SURVIVES a log replay (the device that acked holds the durable copy; the server retains
  // nothing servable). This is the "nothing at rest on our server" property.
  var t20:i64=1
  // fresh plane: alice+bob published (from T15/T16 sh already has them); route a NEW message alice->bob
  rn = ga_post(req, "/connect/seal" as *u8, "from=alice&to=bob&seq=555&ct=cafef00dbaad" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  rn = ga_get(req, "/connect/sealed?u=bob" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  if ga_has(out, n, "\"s\":555" as *u8)==0 { t20=0 }              // bob can see it before ack
  // bob's device acks -> tombstone
  rn = ga_post(req, "/connect/ack" as *u8, "from=alice&to=bob&seq=555" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  if ga_has(out, n, "\"ok\":1" as *u8)==0 { t20=0 }
  rn = ga_get(req, "/connect/sealed?u=bob" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  if ga_has(out, n, "\"s\":555" as *u8)==1 { t20=0 }              // gone after ack -- never served again
  // a SECOND ack is idempotent (nothing to tombstone -> ok:0)
  rn = ga_post(req, "/connect/ack" as *u8, "from=alice&to=bob&seq=555" as *u8)
  n = cs_handle2(ctx, sh, req, rn, out, AG_BUF)
  if ga_has(out, n, "\"ok\":0" as *u8)==0 { t20=0 }
  // the tombstone survives a replay: emit sh's log, replay into a fresh plane, message still not served
  let tlog: *u8 = sys_mmap(65536)
  var tlo: i64 = 0
  var tpi: i64=0
  while tpi<sh[0] { tlo = cs_sh_emit_pub(sh, tpi, tlog, tlo); tpi=tpi+1 }
  var tmi: i64=0
  while tmi<sh[1] { tlo = cs_sh_emit_msg(sh, tmi, tlog, tlo); tmi=tmi+1 }
  // append the tombstone row for the acked msg (idx = sh[5])
  if sh[5]>=0 { tlo = cs_sh_emit_tomb(sh, sh[5], tlog, tlo) }
  let sh3: *i64 = cs_shared_new()
  cs_sh_replay(sh3, tlog, tlo)
  rn = ga_get(req, "/connect/sealed?u=bob" as *u8)
  n = cs_handle2(ctx, sh3, req, rn, out, AG_BUF)
  if ga_has(out, n, "\"s\":555" as *u8)==1 { t20=0 }              // still tombstoned after replay
  ga_check(t20, "T20 delete-on-delivery: an ack tombstones the message (gone from /sealed), idempotent, survives replay" as *u8, fails)
403
  // ---- T19: persistence round-trip -- emitted rows REPLAY into an identical plane ----
  var t19: i64 = 1
  let logb: *u8 = sys_mmap(8192)
  var lo: i64 = 0
  var ei: i64=0
  while ei<sh[0] { lo = cs_sh_emit_pub(sh, ei, logb, lo); ei=ei+1 }
  ei=0
  while ei<sh[1] { lo = cs_sh_emit_msg(sh, ei, logb, lo); ei=ei+1 }
  let sh2: *i64 = cs_shared_new()
  cs_sh_replay(sh2, logb, lo)
  if sh2[0]!=sh[0] { t19=0 }
  if sh2[1]!=sh[1] { t19=0 }
  if cs_sh_pub_find(sh2, "bob" as *u8)<0 { t19=0 }
  let mrow: *u8 = sh_msg_at(sh2, 0)
  if cs_seq(mrow, "alice" as *u8)==0 { t19=0 }
  if cs_seq((mrow as i64 + SH_NAME + SH_NAME + SH_SEQ) as *u8, "deadbeefcafe1234" as *u8)==0 { t19=0 }
  ga_check(t19, "T19 append-log round-trip: emit -> replay reconstructs the plane (boot persistence is real)" as *u8, fails)
421
  // ---- T21: COMPACTION physically drops delivered (tombstoned) bytes from the log. Build a plane with a
  // delivered message next to a live one; the compacted log must contain the LIVE ciphertext but NOT the
  // delivered one, must carry ZERO tombstone rows, and must replay to the SAME servable state. This makes
  // delete-on-delivery a PHYSICAL guarantee (the delivered bytes are gone from disk), not just logical.
  var t21:i64=1
  let shc: *i64 = cs_shared_new()
  cs_sh_pub_put(shc, "alice" as *u8, "8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a" as *u8)
  cs_sh_pub_put(shc, "bob" as *u8, "de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f" as *u8)
  cs_sh_msg_add(shc, "alice" as *u8, "bob" as *u8, "111" as *u8, "aaaa1111dead" as *u8)   // will be delivered
  cs_sh_msg_add(shc, "alice" as *u8, "bob" as *u8, "222" as *u8, "bbbb2222beef" as *u8)    // stays live
  cs_sh_msg_ack(shc, "alice" as *u8, "bob" as *u8, "111" as *u8)                            // tombstone #111
  if cs_sh_tomb_count(shc)!=1 { t21=0 }
  let cbuf: *u8 = sys_mmap(65536)
  let cn: i64 = cs_sh_compact_emit(shc, cbuf)
  // the delivered ciphertext + its D row are physically absent; the live one is present; no tombstone rows
  if ga_has(cbuf, cn, "aaaa1111dead" as *u8)==1 { t21=0 }    // delivered ciphertext GONE from the log bytes
  if ga_has(cbuf, cn, "bbbb2222beef" as *u8)==0 { t21=0 }    // live ciphertext retained
  if ga_has(cbuf, cn, "D\t" as *u8)==1 { t21=0 }              // zero tombstone rows in a compacted log
  // replay the compacted log -> only the live message is servable; the delivered one never reappears
  let shr: *i64 = cs_shared_new()
  cs_sh_replay(shr, cbuf, cn)
  if shr[1]!=1 { t21=0 }                                      // exactly one message survives
  let rr: *u8 = sh_msg_at(shr, 0)
  if cs_seq((rr as i64 + SH_NAME + SH_NAME) as *u8, "222" as *u8)==0 { t21=0 }   // and it's the live one
  ga_check(t21, "T21 compaction: delivered bytes PHYSICALLY dropped (gone from disk), live msg kept, replays clean" as *u8, fails)
447
  ga_w("  fails=" as *u8); ga_n(fails[0]); ga_w("\n" as *u8)
  if fails[0]==0 {
      ga_w("VERDICT: verdict=GREEN (multi-page app: live MT chat, two-deep wall, honest poll, consent-gated reconnection, escaped)\n" as *u8)
      sys_exit(0)
  }
  ga_w("VERDICT: verdict=RED\n" as *u8)
  sys_exit(1)
  return 1
456}
nx_connect_app_gate.nx source

`nx_connect_app_gate.nx` source
