code wiki / (root) / nx_deployjrnl_gate.nx
`nx_deployjrnl_gate.nx` source

↩ module page · 220 lines · 12812 B
1// nx_deployjrnl_gate.nx -- THE REFEREE for the deploy-audit reconstruction.
2//
3// It tests the SHIPPING ruler, not a paraphrase of it: every judgement nx_deployjrnl makes lives in
4// nx_deployjrnl_lib as a pure function, and this gate imports that same lib. There is one copy, so a
5// tooth here cannot pass while the organ does something else.
6//
7// Fixtures are assembled at RUNTIME under /tmp/<gate>/ and never share a path with a production
8// beat: a gate whose RED tracks its fixture rather than its code has been measured in this estate,
9// and a detector that scans source will otherwise find its own test data.
10//
11// license_tier: ORIGINAL
12import "nx_syscalls.nx"
13import "nx_gate_verdict.nx"
14import "nx_deployjrnl_lib.nx"
15
16const G_DIR: *u8 = "/tmp/nx_deployjrnl_gate" as *u8
17const G_BANK: *u8 = "/tmp/nx_deployjrnl_gate/bank" as *u8
18const G_MODE_DIR: i64 = 511
19const G_A_LIVE: *u8 = "/tmp/nx_deployjrnl_gate/a.elf" as *u8
20const G_A_PREV: *u8 = "/tmp/nx_deployjrnl_gate/a.elf.prev" as *u8
21const G_B_LIVE: *u8 = "/tmp/nx_deployjrnl_gate/b.elf" as *u8
22const G_B_PREV: *u8 = "/tmp/nx_deployjrnl_gate/b.elf.prev" as *u8
23const G_BANKED: *u8 = "/tmp/nx_deployjrnl_gate/bank/a.elf.pre-tag" as *u8
24const G_MISSING: *u8 = "/tmp/nx_deployjrnl_gate/definitely-absent" as *u8
25
26func g_eq(a: i64, b: i64) -> i64 { if a == b { return 1 } return 0 }
27func g_not(a: i64) -> i64 { if a == 1 { return 0 } return 1 }
28func g_and(a: i64, b: i64) -> i64 { if a == 1 { if b == 1 { return 1 } } return 0 }
29func g_ge0(v: i64) -> i64 { if v >= 0 { return 1 } return 0 }
30
31func g_write(path: *u8, s: *u8) -> i64 {
  let fd: i64 = sys_openat_wr(path, DJ_MODE_644)
  if fd < 0 { return 0 }
  sys_write(fd, s, dj_slen(s))
  sys_close(fd)
  return 1
37}
38
39func main(argc: i64, argv: *i64) -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("NX-DEPLOYJRNL-GATE -- deploy reconstruction + rollback survivability" as *u8)
42
  // ---- SETUP. Created at setup, not teardown: a teardown does not run when a run crashes. ----
  sys_mkdir(G_DIR, G_MODE_DIR)
  sys_mkdir(G_BANK, G_MODE_DIR)
  // a.elf.prev content is ALSO in the bank -> banked rollback.
  // b.elf.prev content is banked NOWHERE -> the hazard that actually fired on 2026-08-25.
  var setup: i64 = 1
  if g_write(G_A_LIVE, "AAAA-live" as *u8) == 0 { setup = 0 }
  if g_write(G_A_PREV, "AAAA-rollback" as *u8) == 0 { setup = 0 }
  if g_write(G_BANKED, "AAAA-rollback" as *u8) == 0 { setup = 0 }
  if g_write(G_B_LIVE, "BBBB-live" as *u8) == 0 { setup = 0 }
  if g_write(G_B_PREV, "BBBB-rollback" as *u8) == 0 { setup = 0 }
  gv_check("fixture-assembled" as *u8, setup, ctr)
55
  // ---- 1. THE PURE TRANSITION RULER ----
  gv_check("transition-first-sight-is-BASELINE" as *u8,
      g_eq(dj_transition(0, 0, 0, 0), DJ_T_NEW), ctr)
  gv_check("transition-nothing-moved-is-UNCHANGED" as *u8,
      g_eq(dj_transition(1, 0, 0, 0), DJ_T_UNCHANGED), ctr)
  // ONE deploy satisfies the invariant: the new prev IS the live we recorded last scan.
  gv_check("transition-single-deploy-is-WITNESSED" as *u8,
      g_eq(dj_transition(1, 1, 1, 1), DJ_T_DEPLOY_WITNESSED), ctr)
  // The invariant BROKEN means a binary passed through the serving slot we never hashed.
  gv_check("transition-broken-invariant-is-MULTI-UNWITNESSED" as *u8,
      g_eq(dj_transition(1, 1, 0, 1), DJ_T_DEPLOY_MULTI), ctr)
  gv_check("transition-prev-moved-alone-is-PREV-ONLY" as *u8,
      g_eq(dj_transition(1, 0, 0, 1), DJ_T_PREV_ONLY), ctr)
69
  // THE TOOTH THAT MATTERS MOST FOR HONESTY: a multi-deploy must NEVER be reported as a clean
  // single deploy. If this ever passes silently the instrument is claiming to have witnessed
  // something it did not.
  gv_bite("bite-unwitnessed-multi-deploy-not-laundered-as-witnessed" as *u8,
      g_eq(dj_transition(1, 1, 0, 1), DJ_T_DEPLOY_MULTI),
      g_eq(dj_transition(1, 1, 1, 1), DJ_T_DEPLOY_MULTI), ctr)
76
  // ---- 2. RISK + THE HAZARD PREDICATE ----
  gv_check("risk-no-prev-is-NO-ROLLBACK" as *u8, g_eq(dj_risk(0, 0), DJ_R_NO_ROLLBACK), ctr)
  gv_check("risk-prev-banked-is-OK" as *u8, g_eq(dj_risk(1, 1), DJ_R_OK), ctr)
  gv_check("risk-prev-unbanked-is-AT-RISK" as *u8, g_eq(dj_risk(1, 0), DJ_R_AT_RISK), ctr)
81
  // THE HAZARD THAT FIRED LIVE: a second deploy destroying the only rollback.
  gv_bite("bite-second-deploy-would-destroy-only-rollback" as *u8,
      dj_would_destroy_only_rollback(1, 0),
      dj_would_destroy_only_rollback(1, 1), ctr)
  // neg-control: with NO rollback slot there is nothing to destroy, so the alarm must stay silent.
  // A guard that refuses everything passes every deny-test; this is the input that must be ALLOWED.
  gv_check("neg-control-absent-prev-raises-no-destroy-alarm" as *u8,
      g_eq(dj_would_destroy_only_rollback(0, 0), 0), ctr)
90
  // ---- 3. VERDICT ORDERING ----
  // UNPROVEN outranks everything: an axis that could not look must not be spelled like a clean run.
  gv_check("verdict-unobserved-is-UNPROVEN-not-GREEN" as *u8,
      g_eq(dj_verdict(0, 0, 0, 0, 0), DJ_V_UNPROVEN), ctr)
  gv_check("verdict-irreplaceable-eviction-is-RED" as *u8,
      g_eq(dj_verdict(1, 0, 0, 0, 1), DJ_V_RED), ctr)
  gv_check("verdict-unwitnessed-deploy-is-RED" as *u8,
      g_eq(dj_verdict(0, 1, 0, 0, 1), DJ_V_RED), ctr)
  gv_check("verdict-atrisk-above-floor-is-AMBER" as *u8,
      g_eq(dj_verdict(0, 0, 5, 3, 1), DJ_V_AMBER), ctr)
  // AT-RISK at or below the floor is the NORMAL post-deploy state. If this went RED the board
  // would be permanently red and everyone would learn to ignore it.
  gv_check("verdict-atrisk-at-floor-is-GREEN-not-permanently-red" as *u8,
      g_eq(dj_verdict(0, 0, 3, 3, 1), DJ_V_GREEN), ctr)
105
  // ---- 4. THE RATCHET, ALL THREE DIRECTIONS ----
  gv_check("ratchet-tightens-on-a-fall" as *u8, g_eq(dj_new_floor(1, 3), 1), ctr)
  gv_check("ratchet-holds-when-flat" as *u8, g_eq(dj_new_floor(3, 3), 3), ctr)
  // The direction that matters: a ratchet that raised its own floor on a rise would launder every
  // regression green -- the exact failure a ratchet exists to prevent.
  gv_check("ratchet-refuses-to-rewrite-baseline-on-a-rise" as *u8, g_eq(dj_new_floor(9, 3), 3), ctr)
  gv_bite("bite-ratchet-holds-on-rise-and-moves-on-fall" as *u8,
      g_eq(dj_new_floor(9, 3), 3),
      g_eq(dj_new_floor(1, 3), 3), ctr)
115
  // ---- 5. HASHING: FAIL LOUD, NEVER THE SHA OF NOTHING ----
  let h1: *u8 = sys_mmap(DJ_HEXSLOT)
  let h2: *u8 = sys_mmap(DJ_HEXSLOT)
  let hm: *u8 = sys_mmap(DJ_HEXSLOT)
  let na: i64 = dj_hash_file(G_A_PREV, h1)
  let nb: i64 = dj_hash_file(G_BANKED, h2)
  let nm: i64 = dj_hash_file(G_MISSING, hm)
  gv_check("fixture-reached-condition-both-files-hashed" as *u8,
      g_and(g_ge0(na), g_ge0(nb)), ctr)
  gv_check("identical-content-hashes-identical" as *u8, dj_streq(h1, h2), ctr)
  // A hasher that digested an empty buffer would return a real-looking 64-hex answer for a file
  // that does not exist. That is a lying instrument, and it is the shape a bank lookup would
  // silently trust.
  gv_check("neg-control-missing-file-returns-minus-one-not-a-digest" as *u8, g_eq(nm, 0 - 1), ctr)
130
  // ---- 5b. THE STAT PRIMITIVE ----
  // THIS TOOTH EXISTS BECAUSE ITS ABSENCE LET A REAL DEFECT SHIP. On 2026-08-25 this gate read
  // GREEN 42/42 while dj_stat was failing for EVERY path in the estate: a syscall number split by
  // target left both consts in the build, the wrong one won, and on x86_64 it dispatched getcwd.
  // Every tooth here tested a PURE ruler; nothing tested the one impure primitive, so the gate had
  // no opinion about the only thing that was broken. A GREEN GATE THAT HAS NEVER EXERCISED THE
  // SYSCALL IT DEPENDS ON IS NOT EVIDENCE ABOUT THAT SYSCALL.
  let stt: *i64 = sys_mmap(DJ_LENSLOT * 2) as *i64
  let statok: i64 = dj_stat(G_A_LIVE, stt)
  gv_check("stat-succeeds-on-a-real-file" as *u8, g_eq(statok, 1), ctr)
  // The size is asserted against the fixture this gate WROTE, so it cannot pass on a stale buffer.
  gv_check("stat-returns-the-true-size" as *u8, g_eq(stt[1], 9), ctr)
  gv_check("stat-returns-a-nonzero-mtime" as *u8, g_ge0(stt[0] - 1), ctr)
  let stmiss: i64 = dj_stat(G_MISSING, stt)
  gv_check("neg-control-stat-fails-on-an-absent-file" as *u8, g_eq(stmiss, 0), ctr)
  gv_bite("bite-stat-discriminates-present-from-absent" as *u8,
      g_eq(statok, 1), g_eq(stmiss, 1), ctr)
148
  // ---- 6. BANK MEMBERSHIP IS BY CONTENT, NOT BY NAME ----
  let bank: *u8 = sys_mmap(DJ_HEXSLOT * 4)
  dj_cat(bank, 0, h2)
  let e0: *u8 = ((bank as i64) + 0) as *u8
  e0[DJ_HEX_BYTES] = 0 as u8
  let hb: *u8 = sys_mmap(DJ_HEXSLOT)
  let nbp: i64 = dj_hash_file(G_B_PREV, hb)
  gv_check("fixture-reached-condition-b-prev-hashed" as *u8, g_ge0(nbp), ctr)
  // a.elf.prev is banked under a DIFFERENT filename (a.elf.pre-tag) and must still be found.
  gv_check("bank-hit-despite-unpredicted-filename-tag" as *u8, dj_bank_has(bank, 1, h1), ctr)
  gv_check("neg-control-unbanked-content-is-not-found" as *u8, g_eq(dj_bank_has(bank, 1, hb), 0), ctr)
  gv_bite("bite-bank-membership-discriminates" as *u8,
      dj_bank_has(bank, 1, h1),
      dj_bank_has(bank, 1, hb), ctr)
163
  // ---- 7. THE DIRECTORY WALK ----
  let nm1: *u8 = sys_mmap(64 * DJ_NAME_SLOT)
  let cn: *i64 = sys_mmap(DJ_LENSLOT) as *i64
  let sk: *i64 = sys_mmap(DJ_LENSLOT) as *i64
  let wrc: i64 = dj_walk(G_DIR, ".elf.prev" as *u8, nm1, DJ_NAME_SLOT, 64, cn, sk)
  gv_check("walk-returns-OK-on-a-real-directory" as *u8, g_eq(wrc, DJ_W_OK), ctr)
  gv_subjects("walk-found-rollback-slots" as *u8, cn[0], ctr)
  gv_check("walk-found-both-planted-prev-files" as *u8, g_eq(cn[0], 2), ctr)
172
  // A suffix that matches nothing must return OK with zero rows -- that is a real, proven empty.
  let wrc0: i64 = dj_walk(G_DIR, ".no-such-suffix" as *u8, nm1, DJ_NAME_SLOT, 64, cn, sk)
  gv_check("walk-genuine-empty-is-OK-with-zero-rows" as *u8,
      g_and(g_eq(wrc0, DJ_W_OK), g_eq(cn[0], 0)), ctr)
177
  // THE CONFIDENT-EMPTY DEFECT. Pointed at a FILE, getdents returns negative. If that were folded
  // into end-of-directory the walk would report a serene "zero entries" for a path it never read,
  // and every absence conclusion downstream would be false.
  let wrcf: i64 = dj_walk(G_A_LIVE, "" as *u8, nm1, DJ_NAME_SLOT, 64, cn, sk)
  gv_check("neg-control-walking-a-file-does-not-return-OK" as *u8, g_not(g_eq(wrcf, DJ_W_OK)), ctr)
  gv_bite("bite-error-and-empty-directory-are-distinguishable" as *u8,
      g_not(g_eq(wrcf, DJ_W_OK)),
      g_not(g_eq(wrc0, DJ_W_OK)), ctr)
186
  // The cap must REFUSE, not silently return a prefix: a cap reached in silence becomes a
  // measurement nobody knows is partial.
  let wrcc: i64 = dj_walk(G_DIR, ".elf.prev" as *u8, nm1, DJ_NAME_SLOT, 1, cn, sk)
  gv_check("walk-refuses-at-cap-instead-of-truncating-silently" as *u8, g_eq(wrcc, DJ_W_CAP), ctr)
191
  // ---- 8. STATUS ROUND-TRIP (the producer parses its own format) ----
  let line: *u8 = sys_mmap(DJ_PATH_SLOT)
  var o: i64 = dj_cat(line, 0, "ROW target=a.elf live=" as *u8)
  o = dj_cat(line, o, h1)
  o = dj_cat(line, o, " lbytes=13 lmtime=1787680659 prev=" as *u8)
  o = dj_cat(line, o, hb)
  o = dj_cat(line, o, " pbytes=13 banked=0 risk=1\n" as *u8)
  let fv: *u8 = sys_mmap(DJ_HEXSLOT)
  gv_check("roundtrip-target-parses" as *u8,
      g_eq(dj_field(line, 0, o, "target=" as *u8, fv, DJ_HEXSLOT), 1), ctr)
  gv_check("roundtrip-target-value-correct" as *u8, dj_streq(fv, "a.elf" as *u8), ctr)
  dj_field(line, 0, o, "live=" as *u8, fv, DJ_HEXSLOT)
  gv_check("roundtrip-live-sha-survives" as *u8, dj_streq(fv, h1), ctr)
  dj_field(line, 0, o, "prev=" as *u8, fv, DJ_HEXSLOT)
  gv_check("roundtrip-prev-sha-survives" as *u8, dj_streq(fv, hb), ctr)
  // ANCHORING. "live=" must not match inside "lbytes=" or any longer key, and a key that is not
  // present must report absent rather than returning the neighbouring field's value.
  gv_check("neg-control-absent-key-reports-absent" as *u8,
      g_eq(dj_field(line, 0, o, "nosuchkey=" as *u8, fv, DJ_HEXSLOT), 0), ctr)
211
  // ---- 9. NUMERIC PARSE REFUSES GARBAGE ----
  gv_check("atoi-parses-a-number" as *u8, g_eq(dj_atoi("42" as *u8), 42), ctr)
  // A corrupt ratchet conf read as 0 would refuse every future scan. Refuse the parse instead.
  gv_check("neg-control-atoi-refuses-non-numeric" as *u8, g_eq(dj_atoi("x9" as *u8), 0 - 1), ctr)
  gv_check("neg-control-atoi-refuses-empty" as *u8, g_eq(dj_atoi("" as *u8), 0 - 1), ctr)
217
  return gv_verdict("DEPLOYJRNL-GATE" as *u8, ctr,
      "reconstruction rulers, rollback-destruction hazard, walk coverage, ratchet direction" as *u8)
220}
nx_deployjrnl_gate.nx source

`nx_deployjrnl_gate.nx` source
