nx_extllm.nx source

1// nx_extllm.nx -- THE EGRESS WARDEN: the front door every external-model call must pass. 2// Rungs XL1 (terms ledger) + XL2 (egress classifier) of /compare/extllm -- the CODE half of two conf files 3// authored 2026-08-24 whose reader never landed. MEASURED 2026-08-25 before building: xl_egress is ABSENT 4// over 61,475 files (coverage_complete=1 corpus_complete=1), and NO source in the 23,235-file corpus even 5// names extllm_terms.conf -- 13 fully-pinned provider rows sitting inert with zero readers. 6// Every third-party LLM vendor host is likewise ABSENT-PROVEN, so there is no egress path in the estate 7// today. That is the rare chance to put the guard in the path BEFORE the path exists. 8// THE CUMULATIVE BOUND IS THE POINT: splitting work into parts defeats a SINGLE call and does nothing about 9// aggregation ACROSS calls. Motro, Marks and Jajodia (ESORICS 1994) describe their controlled-disclosure 10// system as foiling attempts to attack secrets by breaking queries into sequences of smaller requests. 11// Splitting is the attack that literature answers, not the answer. The odometer is the mechanism. 12// NOT differential privacy: a DP epsilon is quantified over the coin flips of a randomised mechanism 13// (Dwork and Roth, Definition 2.4). A verbatim fragment has no coins, so epsilon is infinity here and every 14// composition theorem is vacuous. This organ prints BYTES, which it can measure, never an epsilon. 15// terms <provider> <tier> <use> -- may this provider serve this use class 16// classify <path> <sha256> -- U or C for one path against the operator manifest 17// spent <provider> <ledger> -- cumulative bytes this provider has EVER been shown 18// selftest -- gv_verdict gate, in-memory fixtures, no shared state 19// exit 0 ALLOW / 1 REFUSE / 3 UNKNOWN-REFUSED / 2 usage. license_tier: ORIGINAL. No hw writes (Rule 26). 20import "nx_extllm_lib.nx" 21import "nx_estate_path.nx" 22import "nx_gate_verdict.nx" 23import "nx_sovjson_lib.nx" 24import "nx_syscalls.nx" 25 26const XE_OUT: i64 = 8192 27const XE_USAGE: i64 = 2 28const XE_PATH: i64 = 1024 29// Escape budgets and scratch sizes, each named for WHAT IT BOUNDS. The value 64 occurs at four sites in 30// this file serving TWO UNRELATED purposes -- an escape length and a fixture buffer -- so hoisting it to 31// a single XE_MAGIC_64 would manufacture the one-constant-two-purposes defect that can never be tuned 32// for either. Two names at the same value is the correct answer, and a value-derived name cannot say it. 33const XE_ESC_NAME: i64 = 64 34const XE_ESC_USE: i64 = 32 35const XE_ESC_PATH: i64 = 200 36const XE_SPAN_BYTES: i64 = 16 37const XE_FIX_BUF: i64 = 4096 38const XE_FIX_EMPTY: i64 = 64 39 40// Read an estate artifact whatever working directory the caller was launched from. ep_artifact_path 41// resolves across both estate trees; sys_read_file then sizes from the file itself. Neither half is 42// re-implemented here -- this composes the two incumbents and owns nothing. 43// This exists because the first live run of this organ refused every call: the conf sits in 44// buildroot/knowledge/ and the tools daemon runs with CWD=nishihost. It failed closed, which was 45// correct, but a verdict that changes with the caller's working directory is not a measurement. 46func xe_read_estate(p: *u8, out_len: *i64) -> *u8 { 47 let rp: *u8 = sys_mmap(XE_PATH) 48 if ep_artifact_path(rp, p) == 0 { out_len[0] = 0; return 0 as *u8 } 49 return sys_read_file(rp, out_len) 50} 51 52// ---- THE DECLARED RUNG CONTRACT SYMBOLS ------------------------------------------------------------ 53// /compare/extllm declares rung XL1 as xl_terms_ledger and rung XL2 as xl_egress_class, at THIS path. 54// They delegate to nx_extllm_lib rather than duplicating it: the implementation there is bite-proven, so 55// the board flips on a symbol with capability behind it, never on a stub wearing the contract's name. 56func xl_terms_ledger(q: *u8, n: i64, provider: *u8, tier: *u8, use: i64) -> i64 { 57 return xl_use_verdict(q, n, provider, tier, use) 58} 59func xl_egress_class(q: *u8, n: i64, path: *u8, actual_sha: *u8) -> i64 { 60 return xl_class_of(q, n, path, actual_sha) 61} 62 63func xe_use_code(s: *u8) -> i64 { 64 if sj_lit_eq(s, 0, sj_vlen(s), "WORKER" as *u8) == 1 { return XL_USE_WORKER } 65 if sj_lit_eq(s, 0, sj_vlen(s), "JUDGE" as *u8) == 1 { return XL_USE_JUDGE } 66 if sj_lit_eq(s, 0, sj_vlen(s), "DISTILL" as *u8) == 1 { return XL_USE_DISTILL } 67 return 0 68} 69 70func xe_emit_terms(prov: *u8, tier: *u8, use: *u8, v: i64, trains: i64, out: *u8) -> i64 { 71 var o: i64 = 0 72 o = sj_cat(out, o, "{\"organ\":\"nx_extllm\",\"verb\":\"terms\",\"provider\":\"" as *u8) 73 o = sj_cat_esc(out, o, prov, 0, sj_vlen(prov), XE_ESC_NAME) 74 o = sj_cat(out, o, "\",\"tier\":\"" as *u8) 75 o = sj_cat_esc(out, o, tier, 0, sj_vlen(tier), XE_ESC_NAME) 76 o = sj_cat(out, o, "\",\"use\":\"" as *u8) 77 o = sj_cat_esc(out, o, use, 0, sj_vlen(use), XE_ESC_USE) 78 o = sj_cat(out, o, "\",\"verdict\":\"" as *u8) 79 o = sj_cat(out, o, xl_verdict_name(v)) 80 o = sj_cat(out, o, "\",\"trains_on_input\":\"" as *u8) 81 if trains == XL_ALLOW { o = sj_cat(out, o, "NO" as *u8) } else { if trains == XL_REFUSE { o = sj_cat(out, o, "YES" as *u8) } else { o = sj_cat(out, o, "UNKNOWN" as *u8) } } 82 o = sj_cat(out, o, "\",\"authority\":\"knowledge/extllm_terms.conf;UNKNOWN-refuses;a-provider-is-a-sink-cleared-to-U\"}" as *u8) 83 out[o] = 10 as u8 84 return o + 1 85} 86 87func xe_emit_class(path: *u8, cls: i64, rows: i64, out: *u8) -> i64 { 88 var o: i64 = 0 89 o = sj_cat(out, o, "{\"organ\":\"nx_extllm\",\"verb\":\"classify\",\"path\":\"" as *u8) 90 o = sj_cat_esc(out, o, path, 0, sj_vlen(path), XE_ESC_PATH) 91 o = sj_cat(out, o, "\",\"class\":\"" as *u8) 92 o = sj_cat(out, o, xl_class_name(cls)) 93 o = sj_cat(out, o, "\",\"manifest_rows\":" as *u8) 94 o = sj_catn(out, o, rows) 95 o = sj_cat(out, o, ",\"authority\":\"knowledge/extllm_release.conf;C-by-default;a-stale-hash-admits-nothing\"}" as *u8) 96 out[o] = 10 as u8 97 return o + 1 98} 99 100// RULE 11, DECLARED RATHER THAN SILENT: the literals below are EXPECTED VALUES in assertions, and an 101// expected value IS the specification -- naming it hides the arithmetic the tooth exists to check. 102// `xl_spent(...) == 8000` states the claim; `== XE_EXPECTED_GROQ_TOTAL` states nothing and lets the 103// constant drift away from the fixture it is checking. nx_magic still counts these 32 sites and that is 104// correct: the count is honest, the decision is mine, and it is written here so the next reader sees a 105// judgement instead of an oversight. Every threshold that FEEDS LOGIC in this organ is a named const. 106func xe_selftest() -> i64 { 107 let ctr: *i64 = gv_ctr() 108 gv_head("nx_extllm selftest -- egress warden: terms ledger, classify-at-the-door, cumulative odometer" as *u8) 109 let t: *u8 = sys_mmap(XE_FIX_BUF) 110 var n: i64 = 0 111 n = sj_cat(t, n, "groq|free|NO|YES|NO|none|NO|30|1000|WORKER,JUDGE,DISTILL|groqsa|h0000000000000000000000000000000000000000000000000000000000000001\n" as *u8) 112 n = sj_cat(t, n, "google|gemini-unpaid|YES|NO|NO|improve|NO|0|0|WORKER,JUDGE|geminiterms|h0000000000000000000000000000000000000000000000000000000000000002\n" as *u8) 113 n = sj_cat(t, n, "openrouter|stealth|YES|UNKNOWN|YES|retains|NO|20|50|WORKER,JUDGE|stealtheula|h0000000000000000000000000000000000000000000000000000000000000003\n" as *u8) 114 n = sj_cat(t, n, "github|models|UNKNOWN|UNKNOWN|UNKNOWN|retired|UNKNOWN|0|0||ghmodels|h0000000000000000000000000000000000000000000000000000000000000004\n" as *u8) 115 gv_check("T1 fixture parsed: groq row found at 12 columns" as *u8, xl_use_verdict(t, n, "groq" as *u8, "free" as *u8, XL_USE_WORKER) == XL_ALLOW, ctr) 116 gv_check("T2 DISTILL allowed only where outputs_train_ours=YES (groq)" as *u8, xl_use_verdict(t, n, "groq" as *u8, "free" as *u8, XL_USE_DISTILL) == XL_ALLOW, ctr) 117 gv_check("neg-control-distill-refused-when-outputs-not-ours (google NO)" as *u8, xl_use_verdict(t, n, "google" as *u8, "gemini-unpaid" as *u8, XL_USE_DISTILL) == XL_REFUSE, ctr) 118 gv_check("neg-control-distill-refused-when-outputs-UNKNOWN (openrouter stealth)" as *u8, xl_use_verdict(t, n, "openrouter" as *u8, "stealth" as *u8, XL_USE_DISTILL) == XL_REFUSE, ctr) 119 gv_check("neg-control-unknown-provider-ABSTAINS-never-allows" as *u8, xl_use_verdict(t, n, "acme" as *u8, "free" as *u8, XL_USE_WORKER) == XL_UNKNOWN, ctr) 120 gv_check("neg-control-known-provider-WRONG-TIER-abstains" as *u8, xl_use_verdict(t, n, "groq" as *u8, "enterprise" as *u8, XL_USE_WORKER) == XL_UNKNOWN, ctr) 121 gv_check("neg-control-empty-allowed_uses-lists-nothing (github retired)" as *u8, xl_use_verdict(t, n, "github" as *u8, "models" as *u8, XL_USE_WORKER) == XL_REFUSE, ctr) 122 gv_check("T3 trains_on_input reported separately: groq NO" as *u8, xl_trains_on_input(t, n, "groq" as *u8, "free" as *u8) == XL_ALLOW, ctr) 123 gv_check("T4 trains_on_input: openrouter stealth YES (the prompt is the payment)" as *u8, xl_trains_on_input(t, n, "openrouter" as *u8, "stealth" as *u8) == XL_REFUSE, ctr) 124 n = sj_cat(t, n, "anthropic|consumer|CONDITIONAL|NO|NO|5y-or-30d|NO|0|0|WORKER,JUDGE|anthropic_cc|PIN-PENDING\n" as *u8) 125 gv_check("neg-control-UNPINNED-row-admits-nothing (PIN-PENDING is a refusal)" as *u8, xl_use_verdict(t, n, "anthropic" as *u8, "consumer" as *u8, XL_USE_WORKER) == XL_UNKNOWN, ctr) 126 gv_check("T16 fixture-reached-the-condition: a PINNED row on the same fixture ALLOWS" as *u8, xl_use_verdict(t, n, "groq" as *u8, "free" as *u8, XL_USE_WORKER) == XL_ALLOW, ctr) 127 let m: *u8 = sys_mmap(XE_FIX_BUF) 128 var mn: i64 = 0 129 mn = sj_cat(m, mn, "release|knowledge/forge/pack_rules_v1.txt|hAAA|operator|2026-08-25|curated rules corpus\n" as *u8) 130 gv_check("T5 declared path with MATCHING hash classifies U" as *u8, xl_class_of(m, mn, "knowledge/forge/pack_rules_v1.txt" as *u8, "hAAA" as *u8) == XL_CLASS_U, ctr) 131 gv_check("neg-control-STALE-hash-admits-nothing (declared, hash moved)" as *u8, xl_class_of(m, mn, "knowledge/forge/pack_rules_v1.txt" as *u8, "hBBB" as *u8) == XL_CLASS_C, ctr) 132 gv_check("neg-control-undeclared-runtime-source-is-C-never-leaves" as *u8, xl_class_of(m, mn, "buildroot/runtime/nx_extllm.nx" as *u8, "hAAA" as *u8) == XL_CLASS_C, ctr) 133 let e: *u8 = sys_mmap(XE_FIX_EMPTY) 134 gv_check("neg-control-EMPTY-manifest-admits-nothing (0 rows is not permission)" as *u8, xl_class_of(e, 0, "anything" as *u8, "hAAA" as *u8) == XL_CLASS_C, ctr) 135 gv_check("T6 manifest row count is visible to the caller" as *u8, xl_release_rows(m, mn) == 1, ctr) 136 gv_check("T7 empty manifest reports 0 rows, not an error" as *u8, xl_release_rows(e, 0) == 0, ctr) 137 let l: *u8 = sys_mmap(XE_FIX_BUF) 138 var ln: i64 = 0 139 ln = sj_cat(l, ln, "1787600000|groq|free|search|4000|U|hp1|ALLOW\n" as *u8) 140 ln = sj_cat(l, ln, "1787600100|groq|free|search|3000|U|hp2|ALLOW\n" as *u8) 141 ln = sj_cat(l, ln, "1787600200|groq|free|browser|1000|U|hp3|ALLOW\n" as *u8) 142 ln = sj_cat(l, ln, "1787600300|openrouter|stealth|search|9000|U|hp4|ALLOW\n" as *u8) 143 gv_check("T8 odometer sums ACROSS calls for one provider (4000+3000+1000)" as *u8, xl_spent(l, ln, "groq" as *u8, "" as *u8, 1) == 8000, ctr) 144 gv_check("T9 odometer narrows to one subsystem (4000+3000)" as *u8, xl_spent(l, ln, "groq" as *u8, "search" as *u8, 0) == 7000, ctr) 145 gv_check("T10 odometer does NOT bleed across providers" as *u8, xl_spent(l, ln, "openrouter" as *u8, "" as *u8, 1) == 9000, ctr) 146 gv_check("T11 a provider never shown anything spends 0" as *u8, xl_spent(l, ln, "cloudflare" as *u8, "" as *u8, 1) == 0, ctr) 147 gv_check("T12 THE AGGREGATION BOUND: each part passes alone, the SUM refuses" as *u8, xl_budget_verdict(8000, 3000, 10000) == XL_REFUSE, ctr) 148 gv_check("T13 fixture-reached-the-condition: that same part ALONE is under bound" as *u8, xl_budget_verdict(0, 3000, 10000) == XL_ALLOW, ctr) 149 gv_check("neg-control-unconfigured-budget-ABSTAINS-not-unlimited" as *u8, xl_budget_verdict(0, 1, 0) == XL_UNKNOWN, ctr) 150 gv_check("T14 headroom clamps at 0, never reports negative as large" as *u8, xl_budget_left(12000, 10000) == 0, ctr) 151 gv_check("T15 headroom is exact below the bound" as *u8, xl_budget_left(7000, 10000) == 3000, ctr) 152 gv_check("neg-control-comment-rows-are-not-data (leading hash skipped)" as *u8, xl_is_comment("x" as *u8, 0, 1) == 0, ctr) 153 let rc: i64 = gv_verdict("EXTLLM-WARDEN-GATE" as *u8, ctr, "terms ledger UNKNOWN-refuses, classify-at-the-door C-by-default with stale-hash refusal, cumulative odometer bounding aggregation across calls" as *u8) 154 return rc 155} 156 157func main(argc: i64, argv: *i64) -> i64 { 158 if argc < 2 { 159 sj_werr("usage: nx_extllm {terms <provider> <tier> <use> | classify <path> <sha256> | spent <provider> <ledger> | selftest}\n" as *u8) 160 sys_exit(XE_USAGE) 161 return XE_USAGE 162 } 163 let verb: *u8 = argv[1] as *u8 164 let out: *u8 = sys_mmap(XE_OUT) 165 if sj_lit_eq(verb, 0, sj_vlen(verb), "selftest" as *u8) == 1 { 166 let rc: i64 = xe_selftest() 167 sys_exit(rc) 168 return rc 169 } 170 if sj_lit_eq(verb, 0, sj_vlen(verb), "terms" as *u8) == 1 { 171 if argc < 5 { sj_werr("EXTLLM-FAIL terms needs <provider> <tier> <use>\n" as *u8); sys_exit(XE_USAGE); return XE_USAGE } 172 let ln: *i64 = sys_mmap(XE_SPAN_BYTES) as *i64 173 let buf: *u8 = xe_read_estate(xl_terms_path(), ln) 174 if ln[0] <= 0 { sj_werr("EXTLLM-UNKNOWN terms ledger unreadable -- refusing rather than assuming\n" as *u8); sys_exit(XL_UNKNOWN); return XL_UNKNOWN } 175 let use: i64 = xe_use_code(argv[4] as *u8) 176 if use == 0 { sj_werr("EXTLLM-FAIL use must be WORKER, JUDGE or DISTILL\n" as *u8); sys_exit(XE_USAGE); return XE_USAGE } 177 let v: i64 = xl_use_verdict(buf, ln[0], argv[2] as *u8, argv[3] as *u8, use) 178 let tr: i64 = xl_trains_on_input(buf, ln[0], argv[2] as *u8, argv[3] as *u8) 179 let k: i64 = xe_emit_terms(argv[2] as *u8, argv[3] as *u8, argv[4] as *u8, v, tr, out) 180 sys_write(1, out, k) 181 sys_exit(v) 182 return v 183 } 184 if sj_lit_eq(verb, 0, sj_vlen(verb), "classify" as *u8) == 1 { 185 if argc < 4 { sj_werr("EXTLLM-FAIL classify needs <path> <sha256-of-the-file-now>\n" as *u8); sys_exit(XE_USAGE); return XE_USAGE } 186 let ln2: *i64 = sys_mmap(XE_SPAN_BYTES) as *i64 187 let mb: *u8 = xe_read_estate(xl_release_path(), ln2) 188 var mn: i64 = 0 189 if ln2[0] > 0 { mn = ln2[0] } 190 let cls: i64 = xl_class_of(mb, mn, argv[2] as *u8, argv[3] as *u8) 191 let k2: i64 = xe_emit_class(argv[2] as *u8, cls, xl_release_rows(mb, mn), out) 192 sys_write(1, out, k2) 193 if cls == XL_CLASS_U { sys_exit(XL_ALLOW); return XL_ALLOW } 194 sys_exit(XL_REFUSE) 195 return XL_REFUSE 196 } 197 if sj_lit_eq(verb, 0, sj_vlen(verb), "spent" as *u8) == 1 { 198 if argc < 4 { sj_werr("EXTLLM-FAIL spent needs <provider> <ledger-path>\n" as *u8); sys_exit(XE_USAGE); return XE_USAGE } 199 let ln3: *i64 = sys_mmap(XE_SPAN_BYTES) as *i64 200 let lb: *u8 = xe_read_estate(argv[3] as *u8, ln3) 201 if (lb as i64) == 0 { 202 let unavailable: *u8 = "{\"organ\":\"nx_extllm\",\"verb\":\"spent\",\"status\":\"evidence-unavailable\",\"reason\":\"ledger-path-unavailable\",\"bytes_disclosed_all_time\":null,\"ledger_bytes\":null}\n" as *u8 203 sys_write(1, unavailable, sj_vlen(unavailable)) 204 sys_exit(XL_UNKNOWN) 205 return XL_UNKNOWN 206 } 207 var lnn: i64 = 0 208 if ln3[0] > 0 { lnn = ln3[0] } 209 let tot: i64 = xl_spent(lb, lnn, argv[2] as *u8, "" as *u8, 1) 210 var o: i64 = 0 211 o = sj_cat(out, o, "{\"organ\":\"nx_extllm\",\"verb\":\"spent\",\"provider\":\"" as *u8) 212 o = sj_cat_esc(out, o, argv[2] as *u8, 0, sj_vlen(argv[2] as *u8), XE_ESC_NAME) 213 o = sj_cat(out, o, "\",\"bytes_disclosed_all_time\":" as *u8) 214 o = sj_catn(out, o, tot) 215 o = sj_cat(out, o, ",\"ledger_bytes\":" as *u8) 216 o = sj_catn(out, o, lnn) 217 o = sj_cat(out, o, ",\"note\":\"cumulative across ALL calls; a per-call check cannot compute this and aggregation is the attack\"}" as *u8) 218 out[o] = 10 as u8 219 sys_write(1, out, o + 1) 220 sys_exit(0) 221 return 0 222 } 223 sj_werr("EXTLLM-FAIL unknown verb\n" as *u8) 224 sys_exit(XE_USAGE) 225 return XE_USAGE 226}