nx_deploy_ready_scope_gate.nx source

1// nx_deploy_ready_scope_gate.nx -- proves the pre-deploy gate SCOPES its evidence-honesty block to the deploy 2// target's blast radius (own domain + shared-fate domains) and NEVER to an unrelated domain's RED. 3// 4// THE DEFECT THIS GATE EXISTS FOR (measured 2026-09-02): nx_deploy_ready's evidence-honesty row was a GLOBAL 5// conjunction over knowledge/status/evidence_honesty.log, so two content domains (autodev, performersearch) 6// reading RED blocked the UNRELATED fleet-supervisor memory-leak deploy (daemonsup -> loadgov), and the deploy 7// shipped only through an audited override. Operator: "a supervisor deploy has no business being blocked by a 8// search domain's RED ... estate wide loose coupling small sharp intelligent pieces microservice type 9// architecture not single monolithic coding." A gate that blocks too broadly is overridden in practice and 10// protects nothing. 11// 12// HOW IT PROVES IT: it builds an ISOLATED fixture tree under /tmp/nx_deploy_ready_scope_gate/ (its own 13// knowledge/registry/{deploy_checks.tsv,deploy_domain.conf,deploy_sharedfate.conf} + evidence logs), CHDIRs 14// into it, and forks the REAL subject binary (absolute path) so the subject reads the fixture confs at the 15// exact relative paths production uses -- zero contact with the live registry (the fixture-ratchet law). 16// Every scenario is a different evidence log or target; the teeth assert the JSON and the EXIT CODE both. 17// The fixture-reached-condition tooth runs FIRST (a fixture the defect cannot fail is not a test), and 18// gv_bite pairs the decoupling case with its own-domain-RED control so the gate cannot pass vacuously. 19// nx_deploy_ready_scope_gate [subject-elf-ABSOLUTE] (default: the promoted nishihost binary) 20// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0 21import "nx_syscalls.nx" 22import "nx_gate_verdict.nx" 23import "nx_gatekit_lib.nx" 24 25const SG_SUBJECT_DEFAULT: *u8 = "/volume1/homes/elderwesto/nishihost/nx_deploy_ready.elf" 26const SG_FX: *u8 = "/tmp/nx_deploy_ready_scope_gate" 27const SG_FX_K: *u8 = "/tmp/nx_deploy_ready_scope_gate/knowledge" 28const SG_FX_R: *u8 = "/tmp/nx_deploy_ready_scope_gate/knowledge/registry" 29const SG_FX_DOMAIN: *u8 = "/tmp/nx_deploy_ready_scope_gate/knowledge/registry/deploy_domain.conf" 30const SG_FX_SHARED: *u8 = "/tmp/nx_deploy_ready_scope_gate/knowledge/registry/deploy_sharedfate.conf" 31const SG_FX_MAN_A: *u8 = "/tmp/nx_deploy_ready_scope_gate/man_a.tsv" 32const SG_FX_MAN_B: *u8 = "/tmp/nx_deploy_ready_scope_gate/man_b.tsv" 33const SG_FX_MAN_C: *u8 = "/tmp/nx_deploy_ready_scope_gate/man_c.tsv" 34const SG_FX_MAN_D: *u8 = "/tmp/nx_deploy_ready_scope_gate/man_d.tsv" 35const SG_FX_EV_A: *u8 = "/tmp/nx_deploy_ready_scope_gate/ev_a.log" 36const SG_FX_EV_B: *u8 = "/tmp/nx_deploy_ready_scope_gate/ev_b.log" 37const SG_FX_EV_C: *u8 = "/tmp/nx_deploy_ready_scope_gate/ev_c.log" 38const SG_FX_EV_D: *u8 = "/tmp/nx_deploy_ready_scope_gate/ev_d.log" 39const SG_CAP: i64 = 262144 40const SG_TAB: i64 = 9 41const SG_EXIT_BLOCKED: i64 = 3 42// FIXTURE TARGETS: named for the incident (rule 11). supd -> loadgov (the real daemonsup mapping), perfd -> the 43// content domain that WAS red, srchd -> the domain whose name is a SUBSTRING of performersearch (token test). 44const SG_T_SUPD: *u8 = "supd" 45const SG_T_PERFD: *u8 = "perfd" 46const SG_T_SRCHD: *u8 = "srchd" 47const SG_T_NOSUCH: *u8 = "nosuchtarget" 48 49func sg_manifest(path: *u8, evlog: *u8) -> i64 { 50 // evidence-honesty<TAB><evlog><TAB>VERDICT=GREEN<TAB>BLOCK<TAB>fixture remediation 51 let b: *u8 = sys_mmap(1024) 52 var o: i64 = 0 53 o = gk_cat(b, o, "evidence-honesty" as *u8); b[o] = SG_TAB as u8; o = o + 1 54 o = gk_cat(b, o, evlog); b[o] = SG_TAB as u8; o = o + 1 55 o = gk_cat(b, o, "VERDICT=GREEN" as *u8); b[o] = SG_TAB as u8; o = o + 1 56 o = gk_cat(b, o, "BLOCK" as *u8); b[o] = SG_TAB as u8; o = o + 1 57 o = gk_cat(b, o, "fixture remediation\n" as *u8) 58 b[o] = 0 as u8 59 return gk_write(path, b) 60} 61 62// run the subject: check <manifest> [target]; returns rc, output in out/outlen 63func sg_run(subject: *u8, man: *u8, target: *u8, out: *u8, outlen: *i64) -> i64 { 64 return gk_run_capture(subject, "check" as *u8, man, target, 0 as *u8, out, SG_CAP, outlen) 65} 66 67func main(argc: i64, argv: *i64) -> i64 { 68 var subject: *u8 = SG_SUBJECT_DEFAULT 69 if argc > 1 { subject = argv[1] as *u8 } 70 gv_head("nx_deploy_ready_scope_gate -- evidence-honesty is SCOPED to the target's blast radius, never to an unrelated RED" as *u8) 71 let ctr: *i64 = gv_ctr() 72 73 // ---- SETUP: the isolated fixture tree (created at setup, never torn down by a run that crashes) ---- 74 gk_mkdir(SG_FX); gk_mkdir(SG_FX_K); gk_mkdir(SG_FX_R) 75 gk_write(SG_FX_DOMAIN, "supd loadgov\nperfd performersearch\nsrchd search\n" as *u8) 76 gk_write(SG_FX_SHARED, "deploy\n" as *u8) 77 // A: the real incident shape -- two content domains RED, loadgov green, deploy green. 78 gk_write(SG_FX_EV_A, "NX-EVIDENCE-HONESTY proven=0 of 105 permil=0 mech_ok=72 red=2\nVERDICT=RED a declared gate is not green, or a method is in dissent\nRED_DOMAINS= autodev performersearch \n" as *u8) 79 // B: the deploy machinery itself is RED -- shared fate must block every target. 80 gk_write(SG_FX_EV_B, "NX-EVIDENCE-HONESTY proven=0 of 105 permil=0 mech_ok=72 red=1\nVERDICT=RED a declared gate is not green, or a method is in dissent\nRED_DOMAINS= deploy \n" as *u8) 81 // C: an OLDER producer -- VERDICT=RED with NO RED_DOMAINS= line: scoping is impossible, fall back refuse-side. 82 gk_write(SG_FX_EV_C, "NX-EVIDENCE-HONESTY proven=0 of 105 permil=0 mech_ok=72 red=2\nVERDICT=RED a declared gate is not green, or a method is in dissent\n" as *u8) 83 // D: only 'search' is RED -- 'performersearch' must NOT read as red (exact token, no substring match). 84 gk_write(SG_FX_EV_D, "NX-EVIDENCE-HONESTY proven=0 of 105 permil=0 mech_ok=72 red=1\nVERDICT=RED a declared gate is not green, or a method is in dissent\nRED_DOMAINS= search \n" as *u8) 85 sg_manifest(SG_FX_MAN_A, SG_FX_EV_A) 86 sg_manifest(SG_FX_MAN_B, SG_FX_EV_B) 87 sg_manifest(SG_FX_MAN_C, SG_FX_EV_C) 88 sg_manifest(SG_FX_MAN_D, SG_FX_EV_D) 89 90 // ASSERT THE FIXTURE REACHED THE CONDITION before asserting any outcome. 91 gv_check("fixture-reached-condition: ev_a carries VERDICT=RED and names both RED domains" as *u8, 92 gk_contains(SG_FX_EV_A, "VERDICT=RED" as *u8) * gk_contains(SG_FX_EV_A, " autodev " as *u8) * gk_contains(SG_FX_EV_A, " performersearch " as *u8), ctr) 93 gv_check("fixture-reached-condition: ev_c has VERDICT=RED and NO RED_DOMAINS line (the old-producer shape)" as *u8, 94 gk_contains(SG_FX_EV_C, "VERDICT=RED" as *u8) * (1 - gk_contains(SG_FX_EV_C, "RED_DOMAINS=" as *u8)), ctr) 95 gv_need("subject binary present" as *u8, gk_exists(subject), ctr) 96 97 // CHDIR into the fixture tree: the subject now reads knowledge/registry/* from the fixture, never production. 98 let cd: i64 = sys_chdir(SG_FX) 99 gv_check("chdir into the isolated fixture tree" as *u8, (cd >= 0) as i64, ctr) 100 101 let out: *u8 = sys_mmap(SG_CAP) 102 let n: *i64 = sys_mmap(8) as *i64 103 104 // T1 -- THE DECOUPLING: unrelated RED domains, target in a green non-shared-fate domain -> SAFE. 105 let rc1: i64 = sg_run(subject, SG_FX_MAN_A, SG_T_SUPD, out, n) 106 let t1_safe: i64 = gk_out_has(out, n[0], "\"deploy_safe\":true" as *u8) 107 let t1_scope: i64 = gk_out_has(out, n[0], "\"scope\":\"domain:loadgov\"" as *u8) 108 gv_check("T1 unrelated RED does NOT block: target->loadgov reads deploy_safe true" as *u8, t1_safe, ctr) 109 gv_check("T1 exit code 0 (safe) carries the verdict" as *u8, (rc1 == 0) as i64, ctr) 110 gv_check("T1 JSON names the scope that applied: domain:loadgov" as *u8, t1_scope, ctr) 111 112 // T2 -- SAFETY PRESERVED: the target's OWN domain is RED -> BLOCKED. 113 let rc2: i64 = sg_run(subject, SG_FX_MAN_A, SG_T_PERFD, out, n) 114 let t2_blocked: i64 = gk_out_has(out, n[0], "\"deploy_safe\":false" as *u8) 115 gv_check("neg-control-own-domain-RED-must-block: target->performersearch reads deploy_safe false" as *u8, t2_blocked, ctr) 116 gv_check("neg-control-own-domain-RED-exit-3" as *u8, (rc2 == SG_EXIT_BLOCKED) as i64, ctr) 117 // the bite: gv_bite reads `bad` as "did the detector FIRE on the bad input" (must be 1) and `good` as "did 118 // it fire on the good input" (must be 0). Firing here = BLOCKING, so bad = the own-domain case blocked, 119 // good = the unrelated case blocked = NOT safe. 120 gv_bite("bite: same binary blocks the own-domain-RED target AND does NOT block the unrelated target" as *u8, t2_blocked, 1 - t1_safe, ctr) 121 122 // T3 -- SHARED FATE: the deploy machinery is RED -> blocks even a green-domain target. 123 let rc3: i64 = sg_run(subject, SG_FX_MAN_B, SG_T_SUPD, out, n) 124 gv_check("neg-control-shared-fate-RED-blocks-every-target: deploy RED blocks target->loadgov" as *u8, (rc3 == SG_EXIT_BLOCKED) as i64, ctr) 125 126 // T4 -- BACKWARD COMPATIBLE: no target -> the global marker check, unchanged -> BLOCKED, scope global. 127 let rc4: i64 = sg_run(subject, SG_FX_MAN_A, 0 as *u8, out, n) 128 gv_check("T4 no target keeps the GLOBAL behaviour: blocked, scope=global" as *u8, 129 ((rc4 == SG_EXIT_BLOCKED) as i64) * gk_out_has(out, n[0], "\"scope\":\"global\"" as *u8), ctr) 130 131 // T5 -- REFUSE-SIDE FALLBACK: an unmapped target cannot be scoped -> global -> BLOCKED, and it SAYS so. 132 let rc5: i64 = sg_run(subject, SG_FX_MAN_A, SG_T_NOSUCH, out, n) 133 gv_check("T5 unmapped target falls back to global (blocked) and names it: global-unmapped-target" as *u8, 134 ((rc5 == SG_EXIT_BLOCKED) as i64) * gk_out_has(out, n[0], "global-unmapped-target:nosuchtarget" as *u8), ctr) 135 136 // T6 -- OLD PRODUCER: VERDICT=RED with no RED_DOMAINS line -> cannot scope -> global -> BLOCKED, named. 137 let rc6: i64 = sg_run(subject, SG_FX_MAN_C, SG_T_SUPD, out, n) 138 gv_check("T6 evidence log without RED_DOMAINS falls back refuse-side and names it: global-no-RED_DOMAINS-line" as *u8, 139 ((rc6 == SG_EXIT_BLOCKED) as i64) * gk_out_has(out, n[0], "global-no-RED_DOMAINS-line" as *u8), ctr) 140 141 // T7 -- EXACT TOKEN: only 'search' RED; a performersearch target is NOT red (no substring match) ... 142 let rc7: i64 = sg_run(subject, SG_FX_MAN_D, SG_T_PERFD, out, n) 143 gv_check("T7 exact token: RED search does not convict performersearch (no substring false positive)" as *u8, (rc7 == 0) as i64, ctr) 144 // ... and the search target itself IS blocked by that same line. 145 let rc8: i64 = sg_run(subject, SG_FX_MAN_D, SG_T_SRCHD, out, n) 146 gv_check("neg-control-exact-token-search-target-is-blocked" as *u8, (rc8 == SG_EXIT_BLOCKED) as i64, ctr) 147 148 return gv_verdict("nx_deploy_ready_scope_gate" as *u8, ctr, 149 "subject forked from an isolated /tmp fixture tree (chdir), every scenario a distinct evidence log or target, JSON and exit code both asserted" as *u8) 150}