code wiki / _hdl_build / nx_docportal_admin_daemon_gate.nx
`nx_docportal_admin_daemon_gate.nx` source

↩ module page · 250 lines · 19242 B
1// nx_docportal_admin_daemon_gate.nx -- SOVEREIGN in-process referee for the admin.<domain> document-portal daemon
2// on the CANONICAL ecosystem Modern Auth (no socket/curl/shell). Arms a realm + registers an admin via the REAL
3// Modern Auth, then feeds crafted HTTP request BYTES into the pure router dad_handle and asserts the response bytes
4// AND the real upload side effect in the sovereign store -- proving the document portal is gated by the SAME auth
5// the rest of the ecosystem uses (not a bespoke scheme):
6//   T1 GET /admin               -> 200 + the login/upload SPA shell (public)
7//   T2 POST /admin/login ok     -> 200 + {"token":...}  (mint a real no-cookie token)
8//   T3 POST /admin/upload +tok  -> 200 UPLOADED, the doc is stored, and the owner ai_blog flag took effect
9//   T4 POST /admin/upload NOtok -> 401 (deny-by-default at the daemon, before da_handle)
10//   T5 POST /admin/upload BADtok-> 401 (forged session rejected)
11//   T6 POST /admin/login WRONGpw-> 401
12//   R1 POST /admin/register +invite -> 200 + mnemonic, and the new firm admin can then log in
13//   R2 POST /admin/register garbage-invite -> 403, and the user is NOT registered (login fails)
14//   R3 POST /admin/register replayed (consumed) invite -> 403 (single-use enforced over HTTP)
15//   S1 GET /search?q=... (PUBLIC, no session) -> 200 + the seg_store hit rendered (route matched BEFORE the
16//      /admin chain; Host header -> dp-<host>-pub- shard; case-folded term match through the daemon)
17//   S2 GET /search with an absent-shard Host -> 200 + "0 result(s)" (graceful isolation, never a 500)
18//   S3 GET /doc?cid=<cid> (PUBLIC) -> 200 + the doc text (the SERP click-through, -pub- shard only)
19//   S4 GET /doc with an absent cid -> branded 404 (never a 500)
20// GREEN iff 13/13. Appends knowledge/status/docportal_admin_daemon_gate.log. license_tier: ORIGINAL
21import "nx_docportal_admin_daemon.nx"
22import "hub/nx_modern_auth_flow.nx"
23import "nx_syscalls.nx"
24
25func g_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
26func g_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
27func g_lw(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
28func g_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o + i] = s[i]; i = i + 1 } return o + i }
29func g_cat_n(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { d[o + i] = s[i]; i = i + 1 } return o + n }
30func g_trunc(path: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x180); if fd >= 0 { sys_close(fd) } return 0 }
31func g_starts(buf: *u8, n: i64, s: *u8) -> i64 { let sn: i64 = g_len(s); if n < sn { return 0 } var i: i64 = 0; while i < sn { if (buf[i] as i64) != (s[i] as i64) { return 0 } i = i + 1 } return 1 }
32func g_contains(hay: *u8, n: i64, needle: *u8) -> i64 {
  let nn: i64 = g_len(needle); var i: i64 = 0
  while i + nn <= n { var m: i64 = 1; var j: i64 = 0; while j < nn { if (hay[i + j] as i64) != (needle[j] as i64) { m = 0; j = nn } else { j = j + 1 } } if m == 1 { return 1 } i = i + 1 }
  return 0
36}
37func g_extract_token(resp: *u8, n: i64, out: *u8) -> i64 {
  let key: *u8 = "{\"token\":\"" as *u8; let kn: i64 = 10
  var start: i64 = 0 - 1; var i: i64 = 0
  while i + kn <= n { var m: i64 = 1; var j: i64 = 0; while j < kn { if (resp[i + j] as i64) != (key[j] as i64) { m = 0; j = kn } else { j = j + 1 } } if m == 1 { start = i + kn; i = n } i = i + 1 }
  if start < 0 { return 0 }
  var w: i64 = 0; var k: i64 = start; var done: i64 = 0
  while done == 0 { if k >= n { done = 1 } if done == 0 { if (resp[k] as i64) == 34 { done = 1 } } if done == 0 { out[w] = resp[k]; w = w + 1; k = k + 1 } }
  return w
45}
46
47func main() -> i64 {
  g_w("=== DOCPORTAL ADMIN DAEMON GATE (admin.<domain> on the CANONICAL Modern Auth; sovereign in-process) ===\n" as *u8)
  let store_path: *u8 = "/tmp/nx_dad_gate_store.log" as *u8
  let keys_path: *u8 = "/tmp/nx_dad_gate_keys.log" as *u8
  g_trunc(store_path); g_trunc(keys_path)
52
  let oprf_seed: *u8 = sys_mmap(32); let akp: *u8 = sys_mmap(32); let akb: *u8 = sys_mmap(33)
  let edp: *u8 = sys_mmap(32); let edb: *u8 = sys_mmap(32)
  if nx_uas_server_keys_load_or_init(keys_path, oprf_seed, akp, akb, edp, edb) != NX_UAS_OK { g_w("KEYS FAIL\n" as *u8); sys_exit(1) }
  let realm: *u8 = "nishi_docportal" as *u8
  let realm_n: i64 = g_len(realm)
  let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext
  if nx_auth_context_init(ctx, realm, realm_n, realm, realm_n, store_path as i64, oprf_seed, edp, edb, 900, 8192, 1, 1, 5, 1) != NX_MAUTH_OK { g_w("CTX FAIL\n" as *u8); sys_exit(1) }
  let mn: *u8 = sys_mmap(512); let mn_n: *i64 = sys_mmap(16) as *i64
  if nx_modern_auth_register(ctx, "elder" as *u8, 5, "correct horse battery staple" as *u8, 28, mn, 512, mn_n) != NX_MAUTH_OK { g_w("REGISTER FAIL\n" as *u8); sys_exit(1) }
62
  let req: *u8 = sys_mmap(8192)
  let out: *u8 = sys_mmap(DAD_OUTCAP)
  var pass: i64 = 0
66
  // T1: GET /admin -> 200 + shell
  let n1: i64 = g_cat(req, 0, "GET /admin HTTP/1.1\r\nHost: x\r\n\r\n" as *u8)
  let o1: i64 = dad_handle(ctx, req, n1, out)
  var t1: i64 = 0
  if g_starts(out, o1, "HTTP/1.1 200" as *u8) == 1 { if g_contains(out, o1, "id=login" as *u8) == 1 { t1 = 1 } }
  pass = pass + t1; g_w("  T1 GET /admin -> 200 shell: "); if t1 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
73
  // T2: POST /admin/login (correct) -> token
  let n2: i64 = g_cat(req, 0, "POST /admin/login HTTP/1.1\r\nHost: x\r\n\r\nhandle=elder&passphrase=correct+horse+battery+staple" as *u8)
  let o2: i64 = dad_handle(ctx, req, n2, out)
  let tokbuf: *u8 = sys_mmap(256); var tok_n: i64 = 0
  var t2: i64 = 0
  if g_starts(out, o2, "HTTP/1.1 200" as *u8) == 1 { tok_n = g_extract_token(out, o2, tokbuf); if tok_n > 0 { t2 = 1 } }
  pass = pass + t2; g_w("  T2 POST /admin/login -> token: "); if t2 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
81
  // T3: authed upload (X-Nishi-Session + body) -> 200 UPLOADED + stored + ai_blog flag took effect
  let body: *u8 = "Daemon-path public estate planning guide cleared for AI blog use." as *u8
  let blen: i64 = g_len(body)
  let cid: i64 = dp_cid(body, blen)
  var n3: i64 = g_cat(req, 0, "POST /admin/upload?domain=ddaemon&visibility=public&pub_search=1&ai_blog=1 HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8)
  n3 = g_cat_n(req, n3, tokbuf, tok_n)
  n3 = g_cat(req, n3, "\r\n\r\n" as *u8)
  n3 = g_cat_n(req, n3, body, blen)
  let o3: i64 = dad_handle(ctx, req, n3, out)
  let pq: *i64 = sys_mmap(16) as *i64; let lq: *i64 = sys_mmap(16) as *i64
  var t3: i64 = 0
  if g_starts(out, o3, "HTTP/1.1 200" as *u8) == 1 { if g_contains(out, o3, "UPLOADED" as *u8) == 1 {
      if dp_read("ddaemon" as *u8, DP_VIS_PUBLIC, cid, pq, lq) == 1 { if dp_may("ddaemon" as *u8, DP_VIS_PUBLIC, cid, DP_USE_AI_BLOG) == 1 { t3 = 1 } }
  } }
  pass = pass + t3; g_w("  T3 authed upload stored + ai_blog flagged: "); if t3 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
97
  // T4: upload WITHOUT a session -> 401 (deny-by-default at the daemon)
  let nofake: *u8 = "Should never be stored: no session." as *u8
  let nflen: i64 = g_len(nofake)
  let nfcid: i64 = dp_cid(nofake, nflen)
  var n4: i64 = g_cat(req, 0, "POST /admin/upload?domain=ddaemon&visibility=public HTTP/1.1\r\nHost: x\r\n\r\n" as *u8)
  n4 = g_cat_n(req, n4, nofake, nflen)
  let o4: i64 = dad_handle(ctx, req, n4, out)
  var t4: i64 = 0
  if g_starts(out, o4, "HTTP/1.1 401" as *u8) == 1 { if dp_read("ddaemon" as *u8, DP_VIS_PUBLIC, nfcid, pq, lq) == 0 { t4 = 1 } }
  pass = pass + t4; g_w("  T4 no-session upload -> 401 + not stored: "); if t4 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
108
  // T5: upload with a FORGED session -> 401
  var n5: i64 = g_cat(req, 0, "POST /admin/upload?domain=ddaemon&visibility=public HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: AAAAAAAA\r\n\r\nx" as *u8)
  let o5: i64 = dad_handle(ctx, req, n5, out)
  var t5: i64 = 0
  if g_starts(out, o5, "HTTP/1.1 401" as *u8) == 1 { t5 = 1 }
  pass = pass + t5; g_w("  T5 forged-session upload -> 401: "); if t5 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
115
  // T6: wrong-passphrase login -> 401
  let n6: i64 = g_cat(req, 0, "POST /admin/login HTTP/1.1\r\nHost: x\r\n\r\nhandle=elder&passphrase=wrong+passphrase" as *u8)
  let o6: i64 = dad_handle(ctx, req, n6, out)
  var t6: i64 = 0
  if g_starts(out, o6, "HTTP/1.1 401" as *u8) == 1 { t6 = 1 }
  pass = pass + t6; g_w("  T6 wrong-pw login -> 401: "); if t6 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
122
  // ---- INVITE-GATED SELF-REGISTRATION (POST /admin/register) ----
  // Derive the SAME per-realm invite store the daemon derives (dad_invite_path) and start it clean.
  let invpath: *u8 = sys_mmap(512)
  dad_invite_path(ctx, invpath)
  g_trunc(invpath)
  let rnow: i64 = sys_now_realtime_sec()
129
  // R1: mint a real invite -> POST /admin/register (invite+handle+pw) -> 200 + mnemonic, and the
  // new firm admin can then nx_modern_auth_login (proves the OPAQUE record actually LANDED in the store).
  let invtok: *u8 = sys_mmap(80)
  let ri: i64 = inv_issue(invpath, realm, realm_n, 2, 3600, rnow, invtok)
  var nr1: i64 = g_cat(req, 0, "POST /admin/register HTTP/1.1\r\nHost: x\r\n\r\nhandle=firmadmin&pw=lawfirm+secret+passphrase&invite=" as *u8)
  nr1 = g_cat_n(req, nr1, invtok, NX_INV_TOKEN_HEX)
  let or1: i64 = dad_handle(ctx, req, nr1, out)
  var r1: i64 = 0
  if ri == NX_INV_OK { if g_starts(out, or1, "HTTP/1.1 200" as *u8) == 1 { if g_contains(out, or1, "mnemonic" as *u8) == 1 {
      let rtk: *u8 = sys_mmap(NX_MAUTH_SESSION_TOKEN_BYTES); let rtn: *i64 = sys_mmap(16) as *i64; rtn[0] = 0
      if nx_modern_auth_login(ctx, "firmadmin" as *u8, 9, "lawfirm secret passphrase" as *u8, 25, rtk, NX_MAUTH_SESSION_TOKEN_BYTES, rtn) == NX_MAUTH_OK { r1 = 1 }
  } } }
  pass = pass + r1; g_w("  R1 invite register -> 200 + the new admin can log in: "); if r1 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
143
  // R2: NEG garbage invite -> 403, and the intruder is NOT registered (a subsequent login must fail).
  var nr2: i64 = g_cat(req, 0, "POST /admin/register HTTP/1.1\r\nHost: x\r\n\r\nhandle=intruder&pw=intruder+pw+here&invite=00000000000000000000000000000000000000000000000000000000deadbeef" as *u8)
  let or2: i64 = dad_handle(ctx, req, nr2, out)
  var r2: i64 = 0
  if g_starts(out, or2, "HTTP/1.1 403" as *u8) == 1 {
      let rtk2: *u8 = sys_mmap(NX_MAUTH_SESSION_TOKEN_BYTES); let rtn2: *i64 = sys_mmap(16) as *i64; rtn2[0] = 0
      if nx_modern_auth_login(ctx, "intruder" as *u8, 8, "intruder pw here" as *u8, 16, rtk2, NX_MAUTH_SESSION_TOKEN_BYTES, rtn2) != NX_MAUTH_OK { r2 = 1 }
  }
  pass = pass + r2; g_w("  R2 NEG garbage invite -> 403 + not registered: "); if r2 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
153
  // R3: NEG single-use replay. The R1 invite was consumed on success; replaying it must -> 403.
  var nr3: i64 = g_cat(req, 0, "POST /admin/register HTTP/1.1\r\nHost: x\r\n\r\nhandle=replayer&pw=replayer+pw+ok&invite=" as *u8)
  nr3 = g_cat_n(req, nr3, invtok, NX_INV_TOKEN_HEX)
  let or3: i64 = dad_handle(ctx, req, nr3, out)
  var r3: i64 = 0
  if g_starts(out, or3, "HTTP/1.1 403" as *u8) == 1 {
      let rtk3: *u8 = sys_mmap(NX_MAUTH_SESSION_TOKEN_BYTES); let rtn3: *i64 = sys_mmap(16) as *i64; rtn3[0] = 0
      if nx_modern_auth_login(ctx, "replayer" as *u8, 8, "replayer pw ok" as *u8, 14, rtk3, NX_MAUTH_SESSION_TOKEN_BYTES, rtn3) != NX_MAUTH_OK { r3 = 1 }
  }
  pass = pass + r3; g_w("  R3 NEG single-use replay -> 403: "); if r3 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
164
  // ---- PUBLIC SOVEREIGN /search THROUGH THE DAEMON (R4b: route + Host->shard, no auth) ----
  // Write a real PUBLIC doc into the dadsearch shard through the raw sovereign store (same
  // incantation as nx_docportal_search_seg_gate; content-addressed key -> re-runs are clean).
  let sdoc: *u8 = "Probate and estate administration guidance for Texas families." as *u8
  let sw: *i64 = ss_begin()
  ss_add(sw, 1, "doc:501" as *u8, sdoc, g_len(sdoc))
  ss_commit("knowledge/store/dp-dadsearch-pub-" as *u8, sw, 1)
172
  // S1: PUBLIC GET /search (NO session header) routed to dss_serve; Host: dadsearch keys the shard;
  // capital "Probate" in the doc vs lowercase query proves the case-folded tokenizer alignment E2E.
  // scope=site EXPLICIT since the 2026-07-24 wiring fix made web the default scope -- site portals
  // reach their own shard via the same &scope=site every rendered site link carries.
  let ns1: i64 = g_cat(req, 0, "GET /search?q=probate&scope=site HTTP/1.1\r\nHost: dadsearch\r\n\r\n" as *u8)
  let os1: i64 = dad_handle(ctx, req, ns1, out)
  var s1: i64 = 0
  // the leading "Probate" is <b>-highlighted (R5), so assert the highlighted rendering exactly
  if g_starts(out, os1, "HTTP/1.1 200" as *u8) == 1 { if g_contains(out, os1, "<b>Probate</b> and estate administration" as *u8) == 1 { if g_contains(out, os1, "1 result(s)" as *u8) == 1 { s1 = 1 } } }
  pass = pass + s1; g_w("  S1 public /search -> 200 + seg_store hit: "); if s1 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
183
  // S2 NEG: absent-shard Host -> 200 + zero results (isolation degrades gracefully, never a 500)
  let ns2: i64 = g_cat(req, 0, "GET /search?q=probate HTTP/1.1\r\nHost: nosuchdomain-xyz\r\n\r\n" as *u8)
  let os2: i64 = dad_handle(ctx, req, ns2, out)
  var s2: i64 = 0
  if g_starts(out, os2, "HTTP/1.1 200" as *u8) == 1 { if g_contains(out, os2, "0 result(s)" as *u8) == 1 { s2 = 1 } }
  pass = pass + s2; g_w("  S2 NEG absent-shard /search -> 200 + 0 results: "); if s2 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
190
  // S3: PUBLIC /doc click-through routed through the daemon (boundary-guarded route -> dsv_doc_serve)
  let ns3: i64 = g_cat(req, 0, "GET /doc?cid=501&scope=site HTTP/1.1\r\nHost: dadsearch\r\n\r\n" as *u8)
  let os3: i64 = dad_handle(ctx, req, ns3, out)
  var s3: i64 = 0
  if g_starts(out, os3, "HTTP/1.1 200" as *u8) == 1 { if g_contains(out, os3, "Probate and estate administration" as *u8) == 1 { s3 = 1 } }
  pass = pass + s3; g_w("  S3 public /doc -> 200 + doc text: "); if s3 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
197
  // S4 NEG: /doc with an absent cid -> branded 404 through the daemon (never a 500)
  let ns4: i64 = g_cat(req, 0, "GET /doc?cid=424242 HTTP/1.1\r\nHost: dadsearch\r\n\r\n" as *u8)
  let os4: i64 = dad_handle(ctx, req, ns4, out)
  var s4: i64 = 0
  if g_starts(out, os4, "HTTP/1.1 404" as *u8) == 1 { s4 = 1 }
  pass = pass + s4; g_w("  S4 NEG /doc absent-cid -> 404: "); if s4 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
204
  // S5: API-FIRST through the router -- /api/search answers versioned JSON with CORS (public machine contract)
  let ns5: i64 = g_cat(req, 0, "GET /api/search?q=probate&scope=site HTTP/1.1\r\nHost: dadsearch\r\n\r\n" as *u8)
  let os5: i64 = dad_handle(ctx, req, ns5, out)
  var s5: i64 = 0
  if g_starts(out, os5, "HTTP/1.1 200" as *u8) == 1 { if g_contains(out, os5, "\"v\":1" as *u8) == 1 { if g_contains(out, os5, "\"nresults\":1" as *u8) == 1 { if g_contains(out, os5, "application/json" as *u8) == 1 { s5 = 1 } } } }
  pass = pass + s5; g_w("  S5 /api/search JSON through the router: "); if s5 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
211
  // S6 NEG: /api/doc structured 400 on a malformed cid (machine-readable error contract)
  let ns6: i64 = g_cat(req, 0, "GET /api/doc?cid=xyz HTTP/1.1\r\nHost: dadsearch\r\n\r\n" as *u8)
  let os6: i64 = dad_handle(ctx, req, ns6, out)
  var s6: i64 = 0
  if g_starts(out, os6, "HTTP/1.1 400" as *u8) == 1 { if g_contains(out, os6, "\"code\":\"bad_cid\"" as *u8) == 1 { s6 = 1 } }
  pass = pass + s6; g_w("  S6 NEG /api/doc malformed -> 400 bad_cid: "); if s6 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
218
  // S7: /api/openapi.json machine-readable contract through the router (enterprise API discovery)
  let ns7: i64 = g_cat(req, 0, "GET /api/openapi.json HTTP/1.1\r\nHost: dadsearch\r\n\r\n" as *u8)
  let os7: i64 = dad_handle(ctx, req, ns7, out)
  var s7: i64 = 0
  if g_starts(out, os7, "HTTP/1.1 200" as *u8) == 1 { if g_contains(out, os7, "\"openapi\":\"3.1.0\"" as *u8) == 1 { if g_contains(out, os7, "\"/api/search\":" as *u8) == 1 { s7 = 1 } } }
  pass = pass + s7; g_w("  S7 /api/openapi.json spec through the router: "); if s7 == 1 { g_w("PASS\n" as *u8) } else { g_w("FAIL\n" as *u8) }
225
  g_w("----\nDOCPORTAL-ADMIN-DAEMON rows=16 pass="); let db: *u8 = sys_mmap(8); var v: i64 = pass; var k: i64 = 0; if v == 0 { db[0] = 48 as u8; k = 1 } else { while v > 0 { db[k] = (48 + (v % 10)) as u8; v = v / 10; k = k + 1 } } let rv: *u8 = sys_mmap(8); var x: i64 = 0; while x < k { rv[x] = db[k - 1 - x]; x = x + 1 } sys_write(1, rv, k); g_w("\n" as *u8)
  let lg: i64 = sys_openat_append("knowledge/status/docportal_admin_daemon_gate.log" as *u8, 0x1a4)
  if lg >= 0 {
      g_lw(lg, "DOCPORTAL-ADMIN-DAEMON auth=modern-opaque shell="); g_lw(lg, "1"); g_lw(lg, " login_token="); if t2 == 1 { g_lw(lg, "1") } else { g_lw(lg, "0") }
      g_lw(lg, " authed_upload="); if t3 == 1 { g_lw(lg, "1") } else { g_lw(lg, "0") }
      g_lw(lg, " deny_no_session="); if t4 == 1 { g_lw(lg, "1") } else { g_lw(lg, "0") }
      g_lw(lg, " deny_forged="); if t5 == 1 { g_lw(lg, "1") } else { g_lw(lg, "0") }
      g_lw(lg, " deny_wrongpw="); if t6 == 1 { g_lw(lg, "1") } else { g_lw(lg, "0") }
      g_lw(lg, " self_register="); if r1 == 1 { g_lw(lg, "1") } else { g_lw(lg, "0") }
      g_lw(lg, " deny_bad_invite="); if r2 == 1 { g_lw(lg, "1") } else { g_lw(lg, "0") }
      g_lw(lg, " deny_replay_invite="); if r3 == 1 { g_lw(lg, "1") } else { g_lw(lg, "0") }
      g_lw(lg, " public_search="); if s1 == 1 { g_lw(lg, "1") } else { g_lw(lg, "0") }
      g_lw(lg, " search_absent_shard_0="); if s2 == 1 { g_lw(lg, "1") } else { g_lw(lg, "0") }
      g_lw(lg, " public_doc="); if s3 == 1 { g_lw(lg, "1") } else { g_lw(lg, "0") }
      g_lw(lg, " doc_absent_404="); if s4 == 1 { g_lw(lg, "1") } else { g_lw(lg, "0") }
      g_lw(lg, " api_search_json="); if s5 == 1 { g_lw(lg, "1") } else { g_lw(lg, "0") }
      g_lw(lg, " api_doc_400="); if s6 == 1 { g_lw(lg, "1") } else { g_lw(lg, "0") }
      g_lw(lg, " api_openapi="); if s7 == 1 { g_lw(lg, "1") } else { g_lw(lg, "0") }
      g_lw(lg, " rows=16 pass="); sys_write(lg, rv, k)
      if pass == 16 { g_lw(lg, " verdict=GREEN\n" as *u8) } else { g_lw(lg, " verdict=RED\n" as *u8) }
      sys_close(lg)
  }
  if pass == 16 { g_w("DOCPORTAL-ADMIN-DAEMON GREEN (canonical Modern Auth gates the portal + PUBLIC sovereign /search + /doc + API-FIRST /api/search + /api/doc + /api/openapi.json, measured)\n" as *u8); sys_exit(0); return 0 }
  g_w("DOCPORTAL-ADMIN-DAEMON RED\n" as *u8); sys_exit(1); return 1
250}
nx_docportal_admin_daemon_gate.nx source

`nx_docportal_admin_daemon_gate.nx` source
