nx_edge_refusal_gate.nx source

1// nx_edge_refusal_gate.nx -- the REFEREE for nx_edge_refusal_lib, and the guard that debt row EC32 named as 2// owed the moment its fix shipped. The 503 change went live on 2026-09-03 and witnessed itself on a real 3// write within minutes, but a witness that HAPPENED TO OCCUR is not a control: it proves the branch can 4// fire, never that it fires on exactly the right inputs and no others. These teeth pin both directions. 5// 6// WHY THIS IS AN IN-PROCESS GATE AND NOT A SOCKET FIXTURE. Proving the branch end to end needs a backend 7// that ACCEPTS a request and then stays silent for the whole edge window -- a fixture that is slow by 8// construction and that shares the front door every seat calls through. Extracting the decision into a lib 9// made it testable in microseconds with no socket and no shared surface, which is why the extraction came 10// first. The residual is stated rather than hidden: these teeth prove the DECISION, not the WIRING. The 11// wiring is evidenced separately by nx_contentdiff showing both emitted strings present in the live binary. 12// license_tier: ORIGINAL. Reads nothing, writes only stdout. No hw writes (Rule 26). 13import "nx_syscalls.nx" 14import "nx_gate_verdict.nx" 15import "nx_edge_refusal_lib.nx" 16 17const EG_BUF: i64 = 256 18const EG_PBR_CONNECT_FAILED: i64 = 0 - 1 19const EG_PBR_DEADLINE_EXPIRED: i64 = 0 - 2 20const EG_PBR_REAL_BODY: i64 = 1024 21 22func eg_set(b: *u8, s: *u8) -> i64 { 23 var i: i64 = 0 24 while s[i] != (0 as u8) { b[i] = s[i]; i = i + 1 } 25 b[i] = 0 as u8 26 return i 27} 28 29func main(argc: i64, argv: **u8) -> i64 { 30 let ctr: *i64 = gv_ctr() 31 let b: *u8 = sys_mmap(EG_BUF) 32 33 // ---- THE UNSAFE SET. Every method whose replay can change server state must read 1. ---- 34 eg_set(b, "POST /api/build HTTP/1.1\r\n" as *u8) 35 gv_check_eq("unsafe-POST" as *u8, er_unsafe_method(b), 1, ctr) 36 eg_set(b, "PUT /x HTTP/1.1\r\n" as *u8) 37 gv_check_eq("unsafe-PUT" as *u8, er_unsafe_method(b), 1, ctr) 38 eg_set(b, "PATCH /x HTTP/1.1\r\n" as *u8) 39 gv_check_eq("unsafe-PATCH" as *u8, er_unsafe_method(b), 1, ctr) 40 eg_set(b, "DELETE /x HTTP/1.1\r\n" as *u8) 41 gv_check_eq("unsafe-DELETE" as *u8, er_unsafe_method(b), 1, ctr) 42 43 // ---- THE SAFE SET, which is the half that decides whether the discriminator is exact or merely 44 // convenient. If any of these read 1 the edge would stop advising a retry on ordinary reads, which is a 45 // usability regression on every GET the estate serves. 46 eg_set(b, "GET /compare HTTP/1.1\r\n" as *u8) 47 gv_check_eq("neg-control-safe-GET-must-not-suppress-retry" as *u8, er_unsafe_method(b), 0, ctr) 48 eg_set(b, "HEAD /x HTTP/1.1\r\n" as *u8) 49 gv_check_eq("neg-control-safe-HEAD" as *u8, er_unsafe_method(b), 0, ctr) 50 eg_set(b, "OPTIONS /x HTTP/1.1\r\n" as *u8) 51 gv_check_eq("neg-control-safe-OPTIONS" as *u8, er_unsafe_method(b), 0, ctr) 52 eg_set(b, "TRACE /x HTTP/1.1\r\n" as *u8) 53 gv_check_eq("neg-control-safe-TRACE" as *u8, er_unsafe_method(b), 0, ctr) 54 55 // ---- THE STAGE GATE. Only an ACCEPTED-THEN-SILENT proxy read may suppress the retry advice. A refused 56 // connection and an already-expired deadline are DIFFERENT subjects with correct existing messages, and 57 // folding them in here would report the wrong cause -- the exact defect the 2026-09-02 stage fix cured. 58 eg_set(b, "POST /api/promote HTTP/1.1\r\n" as *u8) 59 gv_check_eq("accepted-then-silent-on-a-write-is-outcome-unknown" as *u8, 60 er_read_after_accept(b, ER_PROXY_ACCEPTED_THEN_SILENT), 1, ctr) 61 gv_check_eq("neg-control-connect-refused-is-NOT-outcome-unknown" as *u8, 62 er_read_after_accept(b, EG_PBR_CONNECT_FAILED), 0, ctr) 63 gv_check_eq("neg-control-expired-deadline-is-NOT-outcome-unknown" as *u8, 64 er_read_after_accept(b, EG_PBR_DEADLINE_EXPIRED), 0, ctr) 65 gv_check_eq("neg-control-a-real-body-is-not-a-refusal-at-all" as *u8, 66 er_read_after_accept(b, EG_PBR_REAL_BODY), 0, ctr) 67 68 // ---- THE CROSS PRODUCT THAT MATTERS: a SAFE method on the accepted-then-silent path must still get the 69 // ordinary retryable 503. Without this tooth the gate would pass an implementation that suppressed the 70 // advice for every request, which is the guard-that-refuses-everything failure. 71 eg_set(b, "GET /library HTTP/1.1\r\n" as *u8) 72 gv_check_eq("neg-control-safe-method-on-the-same-stage-keeps-its-retry" as *u8, 73 er_read_after_accept(b, ER_PROXY_ACCEPTED_THEN_SILENT), 0, ctr) 74 75 // ---- FIXTURE-REACHED-THE-CONDITION. Assert the buffers actually carry what the teeth above assume, 76 // so a silently-empty fixture cannot score a pass on every comparison against 0. 77 eg_set(b, "POST /x HTTP/1.1\r\n" as *u8) 78 gv_check_eq("fixture-reached-the-condition-first-byte-is-P" as *u8, b[0] as i64, ER_METH_P, ctr) 79 eg_set(b, "GET /x HTTP/1.1\r\n" as *u8) 80 gv_check_eq("fixture-reached-the-condition-first-byte-is-G" as *u8, b[0] as i64, 71, ctr) 81 82 gv_values_head() 83 gv_kv("unsafe_first_bytes" as *u8, 2) 84 gv_kv("stage_accepted_then_silent" as *u8, ER_PROXY_ACCEPTED_THEN_SILENT) 85 return gv_verdict("NX-EDGE-REFUSAL-GATE" as *u8, ctr, 86 "the retry advice is suppressed for exactly the unsafe methods on exactly the accepted-then-silent stage: every safe method keeps its retryable 503, and a refused connection and an expired deadline are left to their own messages" as *u8) 87}