nx_embed_exceed.nx source

1// nx_embed_exceed.nx -- MEASURED exceed census for the sovereign iframe replacement (<nishi-embed>) vs the 2// HTML <iframe>. Organ-graded by GREP over the REAL emitted runtime (web_assets/nishi_embed_demo.html) + the 3// sovereign-fetched evidence (knowledge/index/web_seed_corpus.tsv: Web_Components / Clickjacking / CSP / 4// Same-origin), each cell cited, uncited cells REFUSED. HONEST: <nishi-embed> EXCEEDS for embedding OUR OWN 5// (first-party) capabilities; the ONE axis where iframe genuinely wins -- true process isolation of UNTRUSTED 6// code -- is exactly the third-party tracking/ad "bullshit" Nishi deliberately does NOT embed, so it is graded 7// BEHIND and named, not hidden. license_tier: ORIGINAL 8import "nx_syscalls.nx" 9import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc) 10const G_MAGIC_4194304: i64 = 4194304 11 12const G_EXCEED: i64 = 3 13const G_BEHIND: i64 = 2 14const G_UNCITED: i64 = 9 15 16func ex_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 17// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer 18// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the 19// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls). 20// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign. 21func ex_pn(v: i64) -> i64 { nxi_out(v); return 0 } 22func ex_w(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 23// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer 24// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the 25// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls). 26// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign. 27func ex_wn(fd: i64, v: i64) -> i64 { nxi_fd(fd, v); return 0 } 28func ex_strlen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 29 30// 1 found / 0 absent / -1 file missing (uncited) 31func ex_has(path: *u8, needle: *u8) -> i64 { 32 let fd: i64=sys_openat_rd(path); if fd<0 { return 0-1 } 33 let cap: i64=G_MAGIC_4194304 34 let buf: *u8=sys_mmap(cap+16) 35 var total: i64=0; var nrd: i64=sys_read(fd, buf, cap) 36 while nrd>0 { total=total+nrd; if total>=cap { nrd=0 } else { nrd=sys_read(fd, ((buf as i64)+total) as *u8, cap-total) } } 37 sys_close(fd) 38 let nl: i64=ex_strlen(needle); if nl==0 { return 0 } 39 var i: i64=0 40 while i+nl<=total { var j: i64=0; var ok: i64=1; while j<nl { if buf[i+j]!=needle[j] { ok=0; j=nl } else { j=j+1 } } if ok==1 { return 1 } i=i+1 } 41 return 0 42} 43 44// axis where <nishi-embed> should have a property (want_present=1) or NOT have bullshit (want_present=0). 45// evidence file must also exist (cited). returns grade. 46func ex_axis(name: *u8, embed_path: *u8, marker: *u8, want_present: i64, ev_path: *u8, ev_marker: *u8) -> i64 { 47 let nv: i64=ex_has(embed_path, marker) 48 let ev: i64=ex_has(ev_path, ev_marker) 49 var g: i64=G_EXCEED 50 if nv<0 { g=G_UNCITED } 51 if ev<0 { g=G_UNCITED } 52 if g!=G_UNCITED { 53 var holds: i64=0 54 if want_present==1 { if nv==1 { holds=1 } } else { if nv==0 { holds=1 } } // absence-based for "no bullshit" 55 if holds==1 { g=G_EXCEED } else { g=G_BEHIND } 56 } 57 ex_puts(" "); ex_puts(name) 58 if g==G_EXCEED { ex_puts(" -> nishi-embed EXCEEDS\n" as *u8) } 59 if g==G_BEHIND { ex_puts(" -> NOT met\n" as *u8) } 60 if g==G_UNCITED { ex_puts(" -> UNCITED (evidence missing)\n" as *u8) } 61 return g 62} 63 64func main() -> i64 { 65 ex_puts("=== NISHI-EMBED EXCEED CENSUS (<nishi-embed> vs <iframe>; grep over emitted runtime + fetched evidence) ===\n" as *u8) 66 let EMB: *u8="web_assets/nishi_embed_demo.html" as *u8 67 let EV: *u8="knowledge/index/web_seed_corpus.tsv" as *u8 // sovereign-fetched: clickjacking/CSP/same-origin/web-components 68 69 var exceed: i64=0; var uncited: i64=0 70 let g: *i64=sys_mmap(8*8) as *i64 71 // EXCEEDS axes (first-party capability embedding): nishi-embed property present + iframe-pain cited 72 g[0]=ex_axis("isolation w/o nested browsing context (Shadow DOM)" as *u8, EMB, "attachShadow" as *u8, 1, EV, "Shadow DOM" as *u8) 73 g[1]=ex_axis("capability-scoped native element (not opaque origin) " as *u8, EMB, "customElements.define" as *u8, 1, EV, "Custom element" as *u8) 74 g[2]=ex_axis("typed CustomEvent comms (not postMessage strings) " as *u8, EMB, "CustomEvent" as *u8, 1, EV, "same-origin" as *u8) 75 g[3]=ex_axis("no tracking: same-origin, credentials omitted " as *u8, EMB, "credentials:'omit'" as *u8, 1, EV, "same-origin" as *u8) 76 g[4]=ex_axis("no clickjacking surface (no nested frame to overlay) " as *u8, EMB, "<iframe" as *u8, 0, EV, "Clickjacking" as *u8) 77 g[5]=ex_axis("zero third-party deps (no react/jquery/cdn) " as *u8, EMB, "cdn" as *u8, 0, EV, "Web Components" as *u8) 78 var i: i64=0 79 while i<6 { if g[i]==G_EXCEED { exceed=exceed+1 } if g[i]==G_UNCITED { uncited=uncited+1 } i=i+1 } 80 81 ex_puts("----\nHONEST COUNTER-AXIS (where <iframe> genuinely wins):\n" as *u8) 82 ex_puts(" process-isolation of UNTRUSTED code: <iframe> = separate browsing context = a real security sandbox;\n" as *u8) 83 ex_puts(" <nishi-embed> Shadow DOM is NOT a security boundary -> iframe WINS for hostile third-party content.\n" as *u8) 84 ex_puts(" BUT that is exactly the third-party tracking/ad 'bullshit' Nishi does NOT embed; nishi-embed is for\n" as *u8) 85 ex_puts(" OUR OWN first-party capabilities, where it exceeds. (Cited: Same-origin_policy / Clickjacking.)\n" as *u8) 86 87 ex_puts("----\nCENSUS: nishi-embed EXCEEDS=" as *u8); ex_pn(exceed); ex_puts("/6 first-party-embed axes UNCITED=" as *u8); ex_pn(uncited) 88 ex_puts(" + 1 honest counter-axis (untrusted-isolation) to iframe = the bullshit use case Nishi avoids\n" as *u8) 89 ex_puts("HONEST: S-class exceed for embedding OUR OWN tools (lighter, capability-scoped, typed-comms, no tracking,\n" as *u8) 90 ex_puts(" auto-size, sovereign); NOT a sandbox for hostile code (nor should it be). NARROW + measured.\n" as *u8) 91 92 let lg: i64=sys_openat_append("knowledge/status/embed_exceed.log" as *u8, 0x1a4) 93 if lg>=0 { ex_w(lg, "EMBED-EXCEED first_party_exceeds=" as *u8); ex_wn(lg, exceed); ex_w(lg, "/6 uncited=" as *u8); ex_wn(lg, uncited); if uncited==0 { ex_w(lg, " integrity=GREEN\n" as *u8) } else { ex_w(lg, " integrity=RED\n" as *u8) } sys_close(lg) } 94 if uncited==0 { ex_puts("CENSUS-INTEGRITY GREEN (every cell cited to the emitted runtime + fetched evidence)\n" as *u8); sys_exit(0); return 0 } 95 ex_puts("CENSUS-INTEGRITY RED (a cell's evidence file was missing)\n" as *u8); sys_exit(1); return 1 96}