nx_deploy_stage_gate.nx source

1// nx_deploy_stage_gate.nx -- D001 gate (gv-verdict anchored) for the deploy rename-gap closer. 2// Proves the copy is byte-exact + SAFE BY CONSTRUCTION: refuses a non-.new dst (can't clobber a live binary), 3// refuses a non-ELF src, and stages a valid ELF byte-identically with a size-verified landing. 4// license_tier: ORIGINAL expect_exit: 0 5import "nx_deploy_stage_lib.nx" 6import "nx_gate_verdict.nx" 7 8func main() -> i64 { 9 let ctr: *i64 = gv_ctr() 10 gv_head("nx_deploy_stage_gate -- sovereign build->deploy rename-gap closer: byte-exact + safe-by-construction" as *u8) 11 12 // T1: .new suffix guard discriminates 13 var t1: i64 = 0 14 if ds_dst_is_new("sites.elf.new" as *u8) == 1 { if ds_dst_is_new("sites.elf" as *u8) == 0 { if ds_dst_is_new("x.new" as *u8) == 1 { if ds_dst_is_new("neww" as *u8) == 0 { t1 = 1 } } } } 15 gv_check("T1 dst .new guard: sites.elf.new ok, sites.elf refused, boundary correct" as *u8, t1, ctr) 16 17 // build a fixture ELF 18 let fx: *u8 = sys_mmap(4096) 19 fx[0]=127 as u8; fx[1]=69 as u8; fx[2]=76 as u8; fx[3]=70 as u8 20 var i: i64 = 4 21 while i < 1500 { fx[i] = (48 + (i % 40)) as u8; i = i + 1 } 22 let wf: i64 = sys_openat_wr("dsg_src.elf" as *u8, 420) 23 sys_write(wf, fx, 1500); sys_close(wf) 24 25 // T2: stage a valid ELF -> rc 0 26 let rc: i64 = ds_stage("dsg_src.elf" as *u8, "dsg_dst.elf.new" as *u8) 27 var t2: i64 = 0 28 if rc == 0 { t2 = 1 } 29 gv_check("T2 valid ELF stages -> rc 0" as *u8, t2, ctr) 30 31 // T3: landed bytes are byte-identical 32 var t3: i64 = 0 33 let vf: i64 = sys_openat_rd("dsg_dst.elf.new" as *u8) 34 if vf >= 0 { 35 let vb: *u8 = sys_mmap(4096) 36 let vn: i64 = sys_read(vf, vb, 4096) 37 sys_close(vf) 38 if vn == 1500 { 39 var mism: i64 = 0; var j: i64 = 0 40 while j < 1500 { if vb[j] != fx[j] { mism = 1; j = 1500 } else { j = j + 1 } } 41 if mism == 0 { t3 = 1 } 42 } 43 } 44 gv_check("T3 landed artifact is BYTE-IDENTICAL to source (1500B)" as *u8, t3, ctr) 45 46 // T4: refuse non-.new dst (cannot clobber a live binary) -> rc -2 47 var t4: i64 = 0 48 if ds_stage("dsg_src.elf" as *u8, "dsg_live.elf" as *u8) == (0 - 2) { t4 = 1 } 49 gv_check("T4 non-.new dst REFUSED rc=-2 (never overwrites a live binary -- safe by construction)" as *u8, t4, ctr) 50 51 // T5: refuse non-ELF src 52 let bf: i64 = sys_openat_wr("dsg_bad.txt" as *u8, 420) 53 sys_write(bf, "plain text not elf, but padded well over one kilobyte.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................." as *u8, 1100); sys_close(bf) 54 var t5: i64 = 0 55 if ds_stage("dsg_bad.txt" as *u8, "dsg_bad.elf.new" as *u8) == (0 - 4) { t5 = 1 } 56 gv_check("T5 non-ELF src REFUSED rc=-4 (bad magic) -- truncated/garbage stage cannot deploy" as *u8, t5, ctr) 57 58 // T6: embedded selftest (the CLI --kat contract) 59 var t6: i64 = 0 60 if ds_selftest() == 0 { t6 = 1 } 61 gv_check("T6 embedded selftest (CLI --kat contract) 0 fails" as *u8, t6, ctr) 62 63 let rcx: i64 = gv_verdict("DEPLOY-STAGE-GATE" as *u8, ctr, "byte-exact ELF copy into a .new slot; refuses non-.new dst + non-ELF src; safe-by-construction rename-gap closer" as *u8) 64 sys_exit(rcx) 65 return rcx 66}