nx_ediscovery_gate.nx source
↩ module page · 134 lines · 6567 B
1// nx_ediscovery_gate.nx -- F994 INDEPENDENT GATE: the production screen.
2// Proves production is an ALLOW-LIST: only affirmatively-responsive docs are producible, and a set
3// containing a privileged OR an unreviewed doc is blocked. The unreviewed-is-blocked tooth is the one
4// that prevents disclosure by omission -- the failure mode a deny-list cannot stop.
5// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
6
7import "nx_ediscovery_lib.nx"
8
9func eg_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
10func eg_putn(v: i64) -> i64 {
11 let t: *u8 = sys_mmap(32)
12 var o: i64 = 0
13 var m: i64 = v
14 if m < 0 { t[o] = 45 as u8; o = o + 1; m = 0 - m }
15 let d: *u8 = sys_mmap(32)
16 var k: i64 = 0
17 if m == 0 { d[0] = 48 as u8; k = 1 }
18 while m > 0 { d[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
19 var i: i64 = 0
20 while i < k { t[o] = d[k - 1 - i]; o = o + 1; i = i + 1 }
21 sys_write(1, t, o)
22 return 0
23}
24func eg_ck(cnt: *i64, name: *u8, got: i64, want: i64) -> i64 {
25 if got == want {
26 cnt[0] = cnt[0] + 1
27 eg_puts(" PASS " as *u8); eg_puts(name); eg_puts(" = " as *u8); eg_putn(got); eg_puts("\n" as *u8)
28 return 1
29 }
30 cnt[1] = cnt[1] + 1
31 eg_puts(" FAIL " as *u8); eg_puts(name); eg_puts(" got " as *u8); eg_putn(got)
32 eg_puts(" want " as *u8); eg_putn(want); eg_puts("\n" as *u8)
33 return 0
34}
35func eg_id(tag: *u8, nonce: i64, out: *u8) -> i64 {
36 var o: i64 = mt_catcopy(out, 0, tag)
37 o = mt_catn(out, o, nonce)
38 out[o] = 0 as u8
39 return o
40}
41
42func main(argc: i64, argv: *i64) -> i64 {
43 // FIXTURE MOVED OUT OF THE SWEPT STORE (2026-08-07). knowledge/store/ is walked every 600s by
44 // the nx_segguard beat; this gate's fixture is one of TEN measured as actually folded by it. A
45 // fold landing mid-run rewrites the manifest under the code being measured, so a RED could not
46 // be attributed. Proven on the sibling defect: the SAME code went RED on a knowledge/store
47 // fixture and GREEN 24/24 on a /tmp one -- the RED tracked the FIXTURE, not the code.
48 // Created at SETUP, not teardown: a teardown does not run when a run crashes.
49 sys_mkdir("/tmp/edgate\x00" as *u8, 0x1ed)
50 let pfx: *u8 = "/tmp/edgate/edgate-" as *u8
51 let nonce: i64 = sys_now_us()
52 let cnt: *i64 = sys_mmap(16) as *i64
53 cnt[0] = 0
54 cnt[1] = 0
55
56 eg_puts("NISHI-EDISCOVERY-GATE (F994 production is an allow-list: nothing leaks by omission)\n" as *u8)
57
58 let respo: *u8 = sys_mmap(64)
59 let priv: *u8 = sys_mmap(64)
60 let nonr: *u8 = sys_mmap(64)
61 let unrev: *u8 = sys_mmap(64)
62 let junk: *u8 = sys_mmap(64)
63 eg_id("DOC-RESP-" as *u8, nonce, respo)
64 eg_id("DOC-PRIV-" as *u8, nonce, priv)
65 eg_id("DOC-NONR-" as *u8, nonce, nonr)
66 eg_id("DOC-UNREV-" as *u8, nonce, unrev)
67 eg_id("DOC-JUNK-" as *u8, nonce, junk)
68
69 ed_classify(pfx, respo, "responsive" as *u8)
70 ed_classify(pfx, priv, "privileged" as *u8)
71 ed_classify(pfx, nonr, "nonresponsive" as *u8)
72 // unrev is deliberately NOT classified -> defaults unreviewed
73 ed_classify(pfx, junk, "maybe-ok" as *u8) // an unknown status string
74
75 // ---- E1..E4: the allow-list -- only responsive is producible ----
76 eg_ck(cnt, "E1 responsive doc IS producible" as *u8, ed_is_producible(pfx, respo), 1)
77 eg_ck(cnt, "E2 privileged doc NOT producible" as *u8, ed_is_producible(pfx, priv), 0)
78 eg_ck(cnt, "E3 nonresponsive doc NOT producible" as *u8, ed_is_producible(pfx, nonr), 0)
79 eg_ck(cnt, "E4 UNREVIEWED (unclassified) doc NOT producible -- fail-closed default" as *u8, ed_is_producible(pfx, unrev), 0)
80 eg_ck(cnt, "E4a unknown status string NOT producible -- only 'responsive' opens the gate" as *u8, ed_is_producible(pfx, junk), 0)
81
82 // ---- E5: a clean production set (all responsive) -> 0 blocked, safe ----
83 let clean: *i64 = sys_mmap(8 * 2) as *i64
84 let respo2: *u8 = sys_mmap(64)
85 eg_id("DOC-RESP2-" as *u8, nonce, respo2)
86 ed_classify(pfx, respo2, "responsive" as *u8)
87 clean[0] = respo as i64
88 clean[1] = respo2 as i64
89 eg_ck(cnt, "E5 clean set (2 responsive) -> 0 blocked" as *u8, ed_screen(pfx, clean, 2), 0)
90 eg_ck(cnt, "E5a clean set is safe to produce" as *u8, ed_set_clean(pfx, clean, 2), 1)
91
92 // ---- E6: THE CLAWBACK TOOTH. a set with a privileged doc -> blocked ----
93 let leaky: *i64 = sys_mmap(8 * 3) as *i64
94 leaky[0] = respo as i64
95 leaky[1] = priv as i64 // privileged snuck in
96 leaky[2] = respo2 as i64
97 eg_ck(cnt, "E6 set with a privileged doc -> 1 blocked (clawback prevented)" as *u8, ed_screen(pfx, leaky, 3), 1)
98 eg_ck(cnt, "E6a leaky set is NOT safe to produce" as *u8, ed_set_clean(pfx, leaky, 3), 0)
99
100 // ---- E7: DISCLOSURE-BY-OMISSION TOOTH. a set with an UNREVIEWED doc -> blocked ----
101 // a deny-list would produce this (nobody flagged it); the allow-list blocks it.
102 let omission: *i64 = sys_mmap(8 * 2) as *i64
103 omission[0] = respo as i64
104 omission[1] = unrev as i64
105 eg_ck(cnt, "E7 set with an UNREVIEWED doc -> 1 blocked (no production by omission)" as *u8, ed_screen(pfx, omission, 2), 1)
106
107 // ---- E8: the privilege log population -- how many withheld-for-privilege in a review batch ----
108 let batch: *i64 = sys_mmap(8 * 4) as *i64
109 batch[0] = respo as i64
110 batch[1] = priv as i64
111 batch[2] = nonr as i64
112 batch[3] = respo2 as i64
113 eg_ck(cnt, "E8 privilege count in the batch = 1" as *u8, ed_privilege_count(pfx, batch, 4), 1)
114
115 // ---- E9: re-classifying a privileged doc as responsive (a review decision) flips producibility ----
116 // newest-wins on the append-only plane: a later classification supersedes.
117 let flipped: *u8 = sys_mmap(64)
118 eg_id("DOC-FLIP-" as *u8, nonce, flipped)
119 ed_classify(pfx, flipped, "privileged" as *u8)
120 eg_ck(cnt, "E9 initially privileged -> not producible" as *u8, ed_is_producible(pfx, flipped), 0)
121 ed_classify(pfx, flipped, "responsive" as *u8)
122 eg_ck(cnt, "E9a after a responsive re-classification -> producible (newest-wins)" as *u8, ed_is_producible(pfx, flipped), 1)
123
124 eg_puts("nx_ediscovery_gate: pass=" as *u8); eg_putn(cnt[0])
125 eg_puts(" fail=" as *u8); eg_putn(cnt[1]); eg_puts("\n" as *u8)
126 if cnt[1] == 0 {
127 eg_puts("F994 nx_ediscovery: VERDICT=GREEN (production is allow-list; privileged and unreviewed docs cannot be produced)\n" as *u8)
128 sys_exit(0)
129 return 0
130 }
131 eg_puts("F994 nx_ediscovery: VERDICT=RED\n" as *u8)
132 sys_exit(1)
133 return 1
134}