nx_ediscovery_gate.nx source
↩ module page · 127 lines · 5955 B
1// nx_ediscovery_gate.nx -- F994 INDEPENDENT GATE: the production screen.
2// Proves production is an ALLOW-LIST: only affirmatively-responsive docs are producible, and a set
3// containing a privileged OR an unreviewed doc is blocked. The unreviewed-is-blocked tooth is the one
4// that prevents disclosure by omission -- the failure mode a deny-list cannot stop.
5// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
6
7import "nx_ediscovery_lib.nx"
8
9func eg_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
10func eg_putn(v: i64) -> i64 {
11 let t: *u8 = sys_mmap(32)
12 var o: i64 = 0
13 var m: i64 = v
14 if m < 0 { t[o] = 45 as u8; o = o + 1; m = 0 - m }
15 let d: *u8 = sys_mmap(32)
16 var k: i64 = 0
17 if m == 0 { d[0] = 48 as u8; k = 1 }
18 while m > 0 { d[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
19 var i: i64 = 0
20 while i < k { t[o] = d[k - 1 - i]; o = o + 1; i = i + 1 }
21 sys_write(1, t, o)
22 return 0
23}
24func eg_ck(cnt: *i64, name: *u8, got: i64, want: i64) -> i64 {
25 if got == want {
26 cnt[0] = cnt[0] + 1
27 eg_puts(" PASS " as *u8); eg_puts(name); eg_puts(" = " as *u8); eg_putn(got); eg_puts("\n" as *u8)
28 return 1
29 }
30 cnt[1] = cnt[1] + 1
31 eg_puts(" FAIL " as *u8); eg_puts(name); eg_puts(" got " as *u8); eg_putn(got)
32 eg_puts(" want " as *u8); eg_putn(want); eg_puts("\n" as *u8)
33 return 0
34}
35func eg_id(tag: *u8, nonce: i64, out: *u8) -> i64 {
36 var o: i64 = mt_catcopy(out, 0, tag)
37 o = mt_catn(out, o, nonce)
38 out[o] = 0 as u8
39 return o
40}
41
42func main(argc: i64, argv: *i64) -> i64 {
43 let pfx: *u8 = "knowledge/store/edgate-" as *u8
44 let nonce: i64 = sys_now_us()
45 let cnt: *i64 = sys_mmap(16) as *i64
46 cnt[0] = 0
47 cnt[1] = 0
48
49 eg_puts("NISHI-EDISCOVERY-GATE (F994 production is an allow-list: nothing leaks by omission)\n" as *u8)
50
51 let respo: *u8 = sys_mmap(64)
52 let priv: *u8 = sys_mmap(64)
53 let nonr: *u8 = sys_mmap(64)
54 let unrev: *u8 = sys_mmap(64)
55 let junk: *u8 = sys_mmap(64)
56 eg_id("DOC-RESP-" as *u8, nonce, respo)
57 eg_id("DOC-PRIV-" as *u8, nonce, priv)
58 eg_id("DOC-NONR-" as *u8, nonce, nonr)
59 eg_id("DOC-UNREV-" as *u8, nonce, unrev)
60 eg_id("DOC-JUNK-" as *u8, nonce, junk)
61
62 ed_classify(pfx, respo, "responsive" as *u8)
63 ed_classify(pfx, priv, "privileged" as *u8)
64 ed_classify(pfx, nonr, "nonresponsive" as *u8)
65 // unrev is deliberately NOT classified -> defaults unreviewed
66 ed_classify(pfx, junk, "maybe-ok" as *u8) // an unknown status string
67
68 // ---- E1..E4: the allow-list -- only responsive is producible ----
69 eg_ck(cnt, "E1 responsive doc IS producible" as *u8, ed_is_producible(pfx, respo), 1)
70 eg_ck(cnt, "E2 privileged doc NOT producible" as *u8, ed_is_producible(pfx, priv), 0)
71 eg_ck(cnt, "E3 nonresponsive doc NOT producible" as *u8, ed_is_producible(pfx, nonr), 0)
72 eg_ck(cnt, "E4 UNREVIEWED (unclassified) doc NOT producible -- fail-closed default" as *u8, ed_is_producible(pfx, unrev), 0)
73 eg_ck(cnt, "E4a unknown status string NOT producible -- only 'responsive' opens the gate" as *u8, ed_is_producible(pfx, junk), 0)
74
75 // ---- E5: a clean production set (all responsive) -> 0 blocked, safe ----
76 let clean: *i64 = sys_mmap(8 * 2) as *i64
77 let respo2: *u8 = sys_mmap(64)
78 eg_id("DOC-RESP2-" as *u8, nonce, respo2)
79 ed_classify(pfx, respo2, "responsive" as *u8)
80 clean[0] = respo as i64
81 clean[1] = respo2 as i64
82 eg_ck(cnt, "E5 clean set (2 responsive) -> 0 blocked" as *u8, ed_screen(pfx, clean, 2), 0)
83 eg_ck(cnt, "E5a clean set is safe to produce" as *u8, ed_set_clean(pfx, clean, 2), 1)
84
85 // ---- E6: THE CLAWBACK TOOTH. a set with a privileged doc -> blocked ----
86 let leaky: *i64 = sys_mmap(8 * 3) as *i64
87 leaky[0] = respo as i64
88 leaky[1] = priv as i64 // privileged snuck in
89 leaky[2] = respo2 as i64
90 eg_ck(cnt, "E6 set with a privileged doc -> 1 blocked (clawback prevented)" as *u8, ed_screen(pfx, leaky, 3), 1)
91 eg_ck(cnt, "E6a leaky set is NOT safe to produce" as *u8, ed_set_clean(pfx, leaky, 3), 0)
92
93 // ---- E7: DISCLOSURE-BY-OMISSION TOOTH. a set with an UNREVIEWED doc -> blocked ----
94 // a deny-list would produce this (nobody flagged it); the allow-list blocks it.
95 let omission: *i64 = sys_mmap(8 * 2) as *i64
96 omission[0] = respo as i64
97 omission[1] = unrev as i64
98 eg_ck(cnt, "E7 set with an UNREVIEWED doc -> 1 blocked (no production by omission)" as *u8, ed_screen(pfx, omission, 2), 1)
99
100 // ---- E8: the privilege log population -- how many withheld-for-privilege in a review batch ----
101 let batch: *i64 = sys_mmap(8 * 4) as *i64
102 batch[0] = respo as i64
103 batch[1] = priv as i64
104 batch[2] = nonr as i64
105 batch[3] = respo2 as i64
106 eg_ck(cnt, "E8 privilege count in the batch = 1" as *u8, ed_privilege_count(pfx, batch, 4), 1)
107
108 // ---- E9: re-classifying a privileged doc as responsive (a review decision) flips producibility ----
109 // newest-wins on the append-only plane: a later classification supersedes.
110 let flipped: *u8 = sys_mmap(64)
111 eg_id("DOC-FLIP-" as *u8, nonce, flipped)
112 ed_classify(pfx, flipped, "privileged" as *u8)
113 eg_ck(cnt, "E9 initially privileged -> not producible" as *u8, ed_is_producible(pfx, flipped), 0)
114 ed_classify(pfx, flipped, "responsive" as *u8)
115 eg_ck(cnt, "E9a after a responsive re-classification -> producible (newest-wins)" as *u8, ed_is_producible(pfx, flipped), 1)
116
117 eg_puts("nx_ediscovery_gate: pass=" as *u8); eg_putn(cnt[0])
118 eg_puts(" fail=" as *u8); eg_putn(cnt[1]); eg_puts("\n" as *u8)
119 if cnt[1] == 0 {
120 eg_puts("F994 nx_ediscovery: VERDICT=GREEN (production is allow-list; privileged and unreviewed docs cannot be produced)\n" as *u8)
121 sys_exit(0)
122 return 0
123 }
124 eg_puts("F994 nx_ediscovery: VERDICT=RED\n" as *u8)
125 sys_exit(1)
126 return 1
127}