`nx_cr_gate.nx` source

1// nx_cr_gate.nx -- the SINGLE-ARG, /mcp-shaped code review gate. `nx_cr_gate <file>` reviews ONE file and
2// exits nonzero if it has blocking findings (incomplete / non-sovereign / leak). This exact shape (one
3// positional arg) is what the execution allowlist's tea_run (name -> ELF, ONE arg) needs to make the
4// `code_review_gate` tool RUNNABLE over /mcp tools/call -- so an engaging LLM/agent can self-check a file
5// BEFORE submitting it ("so LLMs don't write garbage", via the API). Without this wrapper the gate's two-arg
6// form (`nx_code_review gate <file>`) does not fit the single-arg exec model.
7//
8// COMPOSES _offc/nx_code_review.elf gate (Cardinal 15: no detection logic duplicated -- it fork+execs the real
9// reviewer and passes the verdict + exit code straight through). Sovereign (syscalls only). Run from nxc2 root.
10// The operator still curates the allowlist row + issues the cap token -- this only makes that step POSSIBLE.
11// license_tier: ORIGINAL   expect_exit: 0  (on a clean file; 1 on blocking findings; 2 on usage)
12import "nx_syscalls.nx"
13
14func g_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
15
16func main(argc: i64, argv: *i64) -> i64 {
17    if argc < 2 { g_puts("usage: nx_cr_gate <file>  (single-arg code review gate; exit 1 = blocking findings)\n" as *u8); sys_exit(2); return 2 }
18    let file: *u8 = argv[1] as *u8
19    let pid: i64 = sys_fork()
20    if pid == 0 {
21        // compose the real reviewer's gate mode; INHERIT stdout/stderr so the caller (or /mcp capture) sees the verdict
22        let elf: *u8 = "_offc/nx_code_review.elf\x00" as *u8
23        let a1: i64 = "gate\x00" as *u8 as i64
24        let av: *i64 = sys_mmap(32) as *i64
25        av[0] = elf as i64; av[1] = a1; av[2] = file as i64; av[3] = 0
26        let envp: *i64 = sys_mmap(16) as *i64
27        envp[0] = "PATH=/usr/bin:/bin\x00" as *u8 as i64; envp[1] = 0
28        sys_execve(elf, av, envp)
29        sys_exit(127)
30    }
31    let st: *i64 = sys_mmap(16) as *i64
32    sys_wait4(pid, st, 0)
33    if (st[0] % 128) != 0 { g_puts("nx_cr_gate: reviewer crashed\n" as *u8); sys_exit(1); return 1 }
34    let ec: i64 = (st[0] >> 8) & 0xff
35    sys_exit(ec)
36    return ec
37}
nx_cr_gate.nx source

`nx_cr_gate.nx` source
