nx_docportal_ingest_gate.nx source

1// nx_docportal_ingest_gate.nx -- the REAL, MEASURED gate for the per-domain document-portal ingest primitive. 2// Self-contained (in-process; no forked CLI, no /tmp staging) per the sovereign-exec doctrine: it drives 3// dp_ingest/dp_read directly against the sovereign seg_store and MEASURES the exceed dimensions of the standard 4// (knowledge/research/2026-06-28-legaldocs-portal-exceed-standard.md): 5// T1 PUBLIC ingest -> stored byte-exact in the public shard AND findable via the SOVEREIGN store-native 6// search (dss_search over the shard's own .terms postings -- NO derived tsv). 7// T2 PRIVATE isolation -> stored in the private shard, NOT in the public shard, and a public dss_search for a 8// private-only term returns 0 (the -prv- shard is physically never opened). [dim #3] 9// T3 CID determinism -> re-ingesting identical bytes yields the SAME content id (idempotent). [dimension #8] 10// T4 cross-domain -> a doc in domain dptest is NOT readable from domain dpother's shard. [dimension #6] 11// T5 integrity -> the private doc reads back byte-exact (immutable, never-delete). [dimension #2] 12// Verdict MEASURED from real store reads + live queries, never asserted. GREEN iff 5/5. Appends to 13// knowledge/status/docportal_ingest_gate.log. license_tier: ORIGINAL 14import "nx_docportal_lib.nx" 15import "nx_g_puts_lib.nx" 16import "nx_docportal_search_seg.nx" // dss_search: the store-native searchability referee (tsv emitter retired) 17 18func g_num(v: i64) -> i64 { 19 let bb: *u8 = sys_mmap(28); var m: i64 = v 20 if m < 0 { m = 0 - m; sys_write(1, "-" as *u8, 1) } 21 let t: *u8 = sys_mmap(28); var k: i64 = 0 22 if m == 0 { t[0] = 48 as u8; k = 1 } 23 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 24 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } sys_write(1, bb, k); return 0 25} 26func g_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 27func g_wn(fd: i64, v: i64) -> i64 { 28 let bb: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { m = 0 - m } 29 let t: *u8 = sys_mmap(28); var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 } 30 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 31 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } sys_write(fd, bb, k); return 0 32} 33 34func g_eq(a: *u8, al: i64, b: *u8, bl: i64) -> i64 { if al != bl { return 0 } var i: i64 = 0; while i < al { if a[i] != b[i] { return 0 } i = i + 1 } return 1 } 35func g_contains(hay: *u8, n: i64, ndl: *u8, nl: i64) -> i64 { 36 if nl == 0 { return 0 } 37 var i: i64 = 0 38 while i + nl <= n { 39 var j: i64 = 0; var hit: i64 = 1 40 while j < nl { if hay[i + j] != ndl[j] { hit = 0; j = nl } else { j = j + 1 } } 41 if hit == 1 { return 1 } 42 i = i + 1 43 } 44 return 0 45} 46// search the domain's PUBLIC shard for one term; returns nresults, top cid via topout[0] (-1 if none) 47func g_search1(domain: *u8, term: *u8, topout: *i64) -> i64 { 48 let cids: *i64 = sys_mmap(16 * 8) as *i64 49 let scores: *i64 = sys_mmap(16 * 8) as *i64 50 var tl: i64 = 0; while term[tl] != (0 as u8) { tl = tl + 1 } 51 let n: i64 = dss_search(domain, term, tl, cids, scores, 16) 52 if n > 0 { topout[0] = cids[0] } else { topout[0] = 0 - 1 } 53 return n 54} 55 56func main() -> i64 { 57 g_puts("=== DOCPORTAL INGEST GATE (per-domain public/private; sovereign seg_store; store-native search; MEASURED) ===\n" as *u8) 58 59 let text_pub: *u8 = "Memorandum regarding a divorce and child custody matter under Utah family law." as *u8 60 let text_prv: *u8 = "CONFIDENTIAL client retainer agreement and SSN under attorney-client privilege." as *u8 61 let lp: i64 = dp_len(text_pub) 62 let lv: i64 = dp_len(text_prv) 63 64 let cidA: *i64 = sys_mmap(16) as *i64 65 let cidB: *i64 = sys_mmap(16) as *i64 66 dp_ingest("dptest" as *u8, DP_VIS_PUBLIC, text_pub, lp, cidA) 67 dp_ingest("dptest" as *u8, DP_VIS_PRIVATE, text_prv, lv, cidB) 68 g_puts(" ingested public cid="); g_num(cidA[0]); g_puts(" private cid="); g_num(cidB[0]); g_puts("\n" as *u8) 69 70 var pass: i64 = 0 71 let pq: *i64 = sys_mmap(16) as *i64; let lq: *i64 = sys_mmap(16) as *i64 72 let top: *i64 = sys_mmap(16) as *i64 73 74 // ---- T1: public doc stored byte-exact + findable via the STORE-NATIVE search (default policy grants 75 // DP_USE_PUB_SEARCH, so the query-time consent filter must keep it) ---- 76 var t1: i64 = 0 77 if dp_read("dptest" as *u8, DP_VIS_PUBLIC, cidA[0], pq, lq) == 1 { 78 if g_eq(pq[0] as *u8, lq[0], text_pub, lp) == 1 { 79 let sn: i64 = g_search1("dptest" as *u8, "memorandum" as *u8, top) 80 if sn >= 1 { if top[0] == cidA[0] { t1 = 1 } } 81 } 82 } 83 pass = pass + t1 84 g_puts(" T1 public stored + store-native searchable: "); if t1 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 85 86 // ---- T2: private doc isolated -- in private shard, NOT in public shard, and a public dss_search for a 87 // private-only term finds NOTHING (the -prv- shard's files are never opened by public search) ---- 88 var t2: i64 = 0 89 let in_prv: i64 = dp_read("dptest" as *u8, DP_VIS_PRIVATE, cidB[0], pq, lq) 90 let in_pub: i64 = dp_read("dptest" as *u8, DP_VIS_PUBLIC, cidB[0], pq, lq) 91 let leaked: i64 = g_search1("dptest" as *u8, "retainer" as *u8, top) 92 if in_prv == 1 { if in_pub == 0 { if leaked == 0 { t2 = 1 } } } 93 pass = pass + t2 94 g_puts(" T2 private isolated (prv="); g_num(in_prv); g_puts(" pub="); g_num(in_pub); g_puts(" search_leak="); g_num(leaked); g_puts("): ") 95 if t2 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 96 97 // ---- T3: CID determinism -- re-ingesting identical bytes yields the same content id ---- 98 var t3: i64 = 0 99 let cidA2: *i64 = sys_mmap(16) as *i64 100 dp_ingest("dptest" as *u8, DP_VIS_PUBLIC, text_pub, lp, cidA2) 101 if cidA2[0] == cidA[0] { t3 = 1 } 102 pass = pass + t3 103 g_puts(" T3 cid deterministic: "); if t3 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 104 105 // ---- T4: cross-domain isolation -- dptest's doc is not readable from dpother's shard ---- 106 var t4: i64 = 0 107 if dp_read("dpother" as *u8, DP_VIS_PUBLIC, cidA[0], pq, lq) == 0 { t4 = 1 } 108 pass = pass + t4 109 g_puts(" T4 cross-domain isolation: "); if t4 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 110 111 // ---- T5: integrity -- private doc reads back byte-exact (immutable, never-delete) ---- 112 var t5: i64 = 0 113 if dp_read("dptest" as *u8, DP_VIS_PRIVATE, cidB[0], pq, lq) == 1 { 114 if g_eq(pq[0] as *u8, lq[0], text_prv, lv) == 1 { t5 = 1 } 115 } 116 pass = pass + t5 117 g_puts(" T5 byte-exact integrity: "); if t5 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 118 119 g_puts("----\nDOCPORTAL-INGEST rows=5 pass="); g_num(pass); g_puts("\n" as *u8) 120 let lg: i64 = sys_openat_append("knowledge/status/docportal_ingest_gate.log" as *u8, 0x1a4) 121 if lg >= 0 { 122 g_w(lg, "DOCPORTAL-INGEST public_searchable="); g_wn(lg, t1) 123 g_w(lg, " private_isolated="); g_wn(lg, t2) 124 g_w(lg, " cid_deterministic="); g_wn(lg, t3) 125 g_w(lg, " cross_domain_isolated="); g_wn(lg, t4) 126 g_w(lg, " byte_exact="); g_wn(lg, t5) 127 g_w(lg, " rows=5 pass="); g_wn(lg, pass) 128 if pass == 5 { g_w(lg, " verdict=GREEN\n" as *u8) } else { g_w(lg, " verdict=RED\n" as *u8) } 129 sys_close(lg) 130 } 131 if pass == 5 { g_puts("DOCPORTAL-INGEST GREEN (per-domain public/private isolation, CID, integrity -- measured)\n" as *u8); sys_exit(0); return 0 } 132 g_puts("DOCPORTAL-INGEST RED\n" as *u8); sys_exit(1); return 1 133}