nx_doc_constscan_gate.nx source

1import "nx_gate_gn.nx" 2// nx_doc_constscan_gate.nx -- liar-kill gate for the LM-030 const-pointer-direct-index detector. MUST-FLAG: a 3// `const NAME: *T` indexed directly as NAME[i]. MUST-NOT-FLAG: the SAFE bind-then-index, a const passed to a func, 4// a NON-const pointer indexed, and the declaration itself. expect_exit: 0 5import "nx_syscalls.nx" 6import "nx_doc_constscan.nx" 7import "nx_gate_verdict.nx" 8 9func gp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 10func slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 11func seq(a: *u8, b: *u8) -> i64 { var i: i64=0; while a[i]!=(0 as u8){ if a[i]!=b[i]{return 0} i=i+1 } if b[i]!=(0 as u8){return 0} return 1 } 12func have_file(p: *u8) -> i64 { let fd: i64=sys_openat_rd(p); if fd<0 { return 0 } sys_close(fd); return 1 } 13 14func main() -> i64 { 15 gp("=== nx_doc_constscan_gate: detect LM-030 const-pointer direct index CONST[i] (recycler hardening) ===\n" as *u8) 16 let name: *u8 = sys_mmap(64) 17 let pos: *i64 = sys_mmap(16) as *i64 18 var pass: i64=0; var fail: i64=0 19 20 // KAT1 MUST-FLAG: a const pointer indexed directly 21 let s1: *u8 = "const SM_LIB: *u8 = \"abc\"\nfunc f() -> i64 { return SM_LIB[2] as i64 }" as *u8 22 let r1: i64 = cs_scan(s1, slen(s1), name, pos) 23 if r1 >= 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL kat1-missed\n" as *u8) } 24 if seq(name, "SM_LIB" as *u8)==1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL kat1-wrong-name=" as *u8); gp(name); gp("\n" as *u8) } 25 26 // KAT2 MUST-NOT-FLAG: bind-then-index (the LM-030 fix) 27 let s2: *u8 = "const SM_LIB: *u8 = \"abc\"\nfunc g() -> i64 { let p: *u8 = SM_LIB; return p[2] as i64 }" as *u8 28 if cs_scan(s2, slen(s2), name, pos) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL kat2-flagged-safe-bind\n" as *u8) } 29 30 // KAT3 MUST-NOT-FLAG: const passed to a func (indexes its param) 31 let s3: *u8 = "const SM_LIB: *u8 = \"abc\"\nfunc h() -> i64 { return foo(SM_LIB) }" as *u8 32 if cs_scan(s3, slen(s3), name, pos) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL kat3-flagged-passed-const\n" as *u8) } 33 34 // KAT4 MUST-NOT-FLAG: a NON-const pointer indexed 35 let s4: *u8 = "func k() -> i64 { let arr: *u8 = z(); return arr[0] as i64 }" as *u8 36 if cs_scan(s4, slen(s4), name, pos) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL kat4-flagged-nonconst\n" as *u8) } 37 38 // KAT5 MUST-NOT-FLAG: just the declaration, never indexed 39 let s5: *u8 = "const SM_LIB: *u8 = \"abc\"\nfunc m() -> i64 { return 0 }" as *u8 40 if cs_scan(s5, slen(s5), name, pos) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL kat5-flagged-decl-only\n" as *u8) } 41 42 // KAT6 grounding: the motivating critique artifact exists 43 if have_file("knowledge/fetched/recyc_crit_memsafety.raw" as *u8)==1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL kat6-ungrounded\n" as *u8) } 44 45 gp("DOC-CONSTSCAN-GATE pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail) 46 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 47 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 48 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 49 let ctr__dry: *i64 = gv_ctr() 50 ctr__dry[0] = pass 51 ctr__dry[1] = pass + fail 52 let rc__dry: i64 = gv_verdict("DOC-CONSTSCAN-GATE" as *u8, ctr__dry, "const-pointer direct-index flagged with its name; safe bind/pass/non-const/decl-only NOT flagged)" as *u8) 53 sys_exit(rc__dry) 54 return rc__dry 55}