nx_extllm_publish_guard.nx source

1// nx_extllm_publish_guard.nx -- RUNG XL8: what we may SAY about a provider we are allowed to USE. 2// This stopped being hypothetical the moment the estate started making real calls. The OpenRouter Stealth 3// AUP forbids publicly disseminating confidential technical information regarding the performance of the 4// models; Cerebras prohibits benchmarking or competitive analysis; SambaNova prohibits publishing capability 5// or performance results without written consent. We now HOLD such numbers -- a 200, a 429, a wall time -- 6// and /compare publishes to the open web on a beat. Nothing stood between those two facts until this organ. 7// 8// THE RULE, three decidable conjuncts on a single line: 9// (1) a token identifying a provider whose terms row reads benchmark_publish_restricted=YES, 10// (2) any metric token from knowledge/extllm_metric_vocab.conf, and 11// (3) a run of two or more digits. 12// The identifying tokens come from the ledger itself, never from a list in this file: the provider name, plus 13// the tier when the tier is written as a model id (it contains a slash, e.g. stealth/ox-alpha). A tier like 14// "free" or "trial" is NOT used as an identifier -- it would match half the corpus and a detector with false 15// positives everywhere is one everybody learns to ignore. 16// 17// THE IMPRECISION IS DECLARED, in the vocab conf and here: a performance claim in pure prose carries no metric 18// token and PASSES, so this is a FLOOR and never a proof of compliance; and a capability row citing a published 19// rate cap trips all three conjuncts and is REFUSED. That direction is deliberate -- an AUP breach is not 20// undoable once a page is served, so the guard fails toward making a human look. 21// exit 0 ALLOW / 1 REFUSE / 3 UNKNOWN / 2 usage. license_tier: ORIGINAL. No hw writes (Rule 26). 22import "nx_extllm_lib.nx" 23import "nx_estate_path.nx" 24import "nx_sovjson_lib.nx" 25import "nx_gate_verdict.nx" 26import "nx_syscalls.nx" 27 28const PG_PATH_CAP: i64 = 1024 29const PG_MIN_DIGIT_RUN: i64 = 2 30const PG_ASCII_0: i64 = 48 31const PG_ASCII_9: i64 = 57 32const PG_BYTE_SLASH: i64 = 47 33const PG_USAGE: i64 = 2 34const PG_VOCAB_COL: i64 = 1 35const PG_VOCAB_COLS: i64 = 2 36 37func pg_vocab_path() -> *u8 { return "knowledge/extllm_metric_vocab.conf" as *u8 } 38 39func pg_read_estate(p: *u8, out_len: *i64) -> *u8 { 40 let rp: *u8 = sys_mmap(PG_PATH_CAP) 41 if ep_artifact_path(rp, p) == 0 { out_len[0] = 0; return 0 as *u8 } 42 return sys_read_file(rp, out_len) 43} 44 45// Two or more consecutive digits anywhere in the span. A single digit is not a measurement. 46func pg_has_digit_run(q: *u8, s: i64, e: i64) -> i64 { 47 var run: i64 = 0 48 var i: i64 = s 49 while i < e { 50 let c: i64 = q[i] as i64 51 if c >= PG_ASCII_0 { if c <= PG_ASCII_9 { run = run + 1 } else { run = 0 } } else { run = 0 } 52 if run >= PG_MIN_DIGIT_RUN { return 1 } 53 i = i + 1 54 } 55 return 0 56} 57 58// A token must match as a WORD, never as a substring. MEASURED on this guard's own first real run against 59// the live board: the metric token "ms" matched INSIDE "terms", so every line citing a terms-of-service 60// document was refused and the guard condemned the entire surface it exists to protect -- all four refusals 61// were that ONE bucket. Reading the early hits as a taxonomy instead of widening a blocklist is what found it. 62const PG_CH_0: i64 = 48 63const PG_CH_9: i64 = 57 64const PG_CH_A: i64 = 65 65const PG_CH_Z: i64 = 90 66const PG_CH_a: i64 = 97 67const PG_CH_z: i64 = 122 68const PG_CH_UNDERSCORE: i64 = 95 69const PG_WINDOW_KEY_COL: i64 = 0 70 71func pg_is_wordchar(c: i64) -> i64 { 72 if c >= PG_CH_0 { if c <= PG_CH_9 { return 1 } } 73 if c >= PG_CH_A { if c <= PG_CH_Z { return 1 } } 74 if c >= PG_CH_a { if c <= PG_CH_z { return 1 } } 75 if c == PG_CH_UNDERSCORE { return 1 } 76 return 0 77} 78 79// Word-bounded search. The span's own edges count as boundaries; with a window of a couple of hundred bytes 80// an edge-straddling token is rare, and that residual is declared here rather than left for a reader to find. 81func pg_span_has_word(q: *u8, s: i64, e: i64, lit: *u8) -> i64 { 82 let ll: i64 = sj_vlen(lit) 83 if ll == 0 { return 0 } 84 var i: i64 = s 85 while i + ll <= e { 86 var j: i64 = 0 87 var ok: i64 = 1 88 while j < ll { if q[i+j] != lit[j] { ok = 0; j = ll } else { j = j + 1 } } 89 if ok == 1 { 90 var lb: i64 = 1 91 if i > s { if pg_is_wordchar(q[i-1] as i64) == 1 { lb = 0 } } 92 var rb: i64 = 1 93 if i + ll < e { if pg_is_wordchar(q[i+ll] as i64) == 1 { rb = 0 } } 94 if lb == 1 { if rb == 1 { return 1 } } 95 } 96 i = i + 1 97 } 98 return 0 99} 100 101// The proximity window, read from the conf. A missing or malformed row returns 0, and the caller treats that 102// as UNKNOWN rather than guessing a default -- an unconfigured window must not silently become "the whole file". 103func pg_window(vocab: *u8, vn: i64) -> i64 { 104 let c: *i64 = sys_mmap(XL_SPAN_BYTES) as *i64 105 var i: i64 = 0 106 while i < vn { 107 let le: i64 = sj_le(vocab, i, vn) 108 if xl_is_comment(vocab, i, le) == 0 { 109 if xl_ncols(vocab, i, le) == PG_VOCAB_COLS { 110 if xl_col(vocab, i, le, PG_WINDOW_KEY_COL, c) == 1 { 111 if sj_lit_eq(vocab, c[0], c[1], "window" as *u8) == 1 { 112 if xl_col(vocab, i, le, PG_VOCAB_COL, c) == 1 { return sj_atoi_span(vocab, c[0], c[1]) } 113 } 114 } 115 } 116 } 117 i = le + 1 118 } 119 return 0 120} 121 122// Does this span carry any declared metric token? 123func pg_has_metric(vocab: *u8, vn: i64, q: *u8, s: i64, e: i64) -> i64 { 124 let c: *i64 = sys_mmap(XL_SPAN_BYTES) as *i64 125 var i: i64 = 0 126 while i < vn { 127 let le: i64 = sj_le(vocab, i, vn) 128 if xl_is_comment(vocab, i, le) == 0 { 129 if xl_ncols(vocab, i, le) == PG_VOCAB_COLS { 130 var ismetric: i64 = 0 131 if xl_col(vocab, i, le, PG_WINDOW_KEY_COL, c) == 1 { 132 if sj_lit_eq(vocab, c[0], c[1], "metric" as *u8) == 1 { ismetric = 1 } 133 } 134 if ismetric == 1 { 135 if xl_col(vocab, i, le, PG_VOCAB_COL, c) == 1 { 136 if c[1] > c[0] { 137 let tok: *u8 = sys_mmap(PG_PATH_CAP) 138 var k: i64 = 0 139 while c[0] + k < c[1] { tok[k] = vocab[c[0] + k]; k = k + 1 } 140 tok[k] = 0 as u8 141 if pg_span_has_word(q, s, e, tok) == 1 { return 1 } 142 } 143 } 144 } 145 } 146 } 147 i = le + 1 148 } 149 return 0 150} 151 152// Does this span name a provider whose terms row restricts publishing? Identifiers come from the ledger. 153func pg_has_restricted(terms: *u8, tn: i64, q: *u8, s: i64, e: i64) -> i64 { 154 let c: *i64 = sys_mmap(XL_SPAN_BYTES) as *i64 155 var i: i64 = 0 156 while i < tn { 157 let le: i64 = sj_le(terms, i, tn) 158 if xl_is_comment(terms, i, le) == 0 { 159 if xl_ncols(terms, i, le) == XL_TC_COLS { 160 if xl_cell_is(terms, i, le, XL_TC_PUBRESTRICT, "YES" as *u8) == 1 { 161 if xl_col(terms, i, le, XL_TC_PROVIDER, c) == 1 { 162 let pn: *u8 = sys_mmap(PG_PATH_CAP) 163 var k: i64 = 0 164 while c[0] + k < c[1] { pn[k] = terms[c[0] + k]; k = k + 1 } 165 pn[k] = 0 as u8 166 if pg_span_has_word(q, s, e, pn) == 1 { return 1 } 167 } 168 // the tier counts as an identifier ONLY when it is written as a model id (has a slash) 169 if xl_col(terms, i, le, XL_TC_TIER, c) == 1 { 170 var slash: i64 = 0 171 var j: i64 = c[0] 172 while j < c[1] { if (terms[j] as i64) == PG_BYTE_SLASH { slash = 1 } j = j + 1 } 173 if slash == 1 { 174 let tn2: *u8 = sys_mmap(PG_PATH_CAP) 175 var m: i64 = 0 176 while c[0] + m < c[1] { tn2[m] = terms[c[0] + m]; m = m + 1 } 177 tn2[m] = 0 as u8 178 if pg_span_has_word(q, s, e, tn2) == 1 { return 1 } 179 } 180 } 181 } 182 } 183 } 184 i = le + 1 185 } 186 return 0 187} 188 189// THE XL8 CONTRACT SYMBOL. Returns the offending line's start offset, or -1 when the body is publishable. 190// The window is a SLIDING BYTE RANGE, not a line. MEASURED: the first version used the line, and a published 191// api.json is ONE line of 33 KB -- so "same line" silently meant "anywhere in the file" and the guard refused 192// the whole board. A line is also not the unit a performance claim lives in; a sentence is. 193// Windows overlap by half so a claim straddling a boundary is still seen by one of them. 194// Returns the offending window's start offset, -1 when publishable, -2 when the window is unconfigured (an 195// unconfigured bound must ABSTAIN, never silently become "the whole file" -- that was the original bug). 196func xl_publish_guard(terms: *u8, tn: i64, vocab: *u8, vn: i64, body: *u8, bn: i64) -> i64 { 197 let w: i64 = pg_window(vocab, vn) 198 if w <= 0 { return 0 - 2 } 199 let step: i64 = w / 2 200 if step <= 0 { return 0 - 2 } 201 var s: i64 = 0 202 while s < bn { 203 var e: i64 = s + w 204 if e > bn { e = bn } 205 if pg_has_restricted(terms, tn, body, s, e) == 1 { 206 if pg_has_metric(vocab, vn, body, s, e) == 1 { 207 if pg_has_digit_run(body, s, e) == 1 { return s } 208 } 209 } 210 s = s + step 211 } 212 return 0 - 1 213} 214 215func pg_selftest() -> i64 { 216 let ctr: *i64 = gv_ctr() 217 gv_head("nx_extllm_publish_guard selftest -- XL8: what we may SAY about a provider we may USE" as *u8) 218 let t: *u8 = sys_mmap(4096) 219 var tn: i64 = 0 220 tn = sj_cat(t, tn, "openrouter|stealth/ox-alpha|YES|UNKNOWN|YES|retains|NO|20|50|WORKER,JUDGE|stealtheula|h0000000000000000000000000000000000000000000000000000000000000001\n" as *u8) 221 tn = sj_cat(t, tn, "groq|free|NO|YES|NO|none|NO|30|1000|WORKER,JUDGE,DISTILL|groqsa|h0000000000000000000000000000000000000000000000000000000000000002\n" as *u8) 222 let v: *u8 = sys_mmap(1024) 223 var vn: i64 = 0 224 // NOTE THE "scored" ROW. Word-bounding means MORPHOLOGY IS NOT FREE: "score" does not match inside 225 // "scored", so every inflected form needs its own row. The first fixture omitted it and this gate went 226 // RED on the one tooth that matters -- the guard was correct and the TEST was wrong, which is exactly 227 // what a neg-control is for. The production conf already lists both forms. 228 vn = sj_cat(v, vn, "window|200\nmetric|score\nmetric|scored\nmetric|latency\nmetric|rpm\nmetric|ms\n" as *u8) 229 let b: *u8 = sys_mmap(4096) 230 var bn: i64 = 0 231 bn = sj_cat(b, bn, "ox-alpha is a free stealth model routed by OpenRouter and cleared to U only\n" as *u8) 232 gv_check("T1 a CAPABILITY line naming a restricted model but carrying no metric is publishable" as *u8, xl_publish_guard(t, tn, v, vn, b, bn) < 0, ctr) 233 bn = sj_cat(b, 0, "stealth/ox-alpha scored 1760 on the coding probe\n" as *u8) 234 gv_check("neg-control-a-PERFORMANCE-number-about-a-restricted-model-is-REFUSED (the AUP breach)" as *u8, xl_publish_guard(t, tn, v, vn, b, bn) >= 0, ctr) 235 bn = sj_cat(b, 0, "groq scored 1760 on the coding probe\n" as *u8) 236 gv_check("T2 fixture-reached-the-condition: the SAME sentence about an UNRESTRICTED provider passes" as *u8, xl_publish_guard(t, tn, v, vn, b, bn) < 0, ctr) 237 bn = sj_cat(b, 0, "stealth/ox-alpha latency was 7 units\n" as *u8) 238 gv_check("neg-control-a-SINGLE-digit-is-not-a-measurement-and-must-not-refuse" as *u8, xl_publish_guard(t, tn, v, vn, b, bn) < 0, ctr) 239 bn = sj_cat(b, 0, "openrouter latency 4200 ms measured on the shared pool\n" as *u8) 240 gv_check("T3 the PROVIDER name is an identifier too, not only the model id" as *u8, xl_publish_guard(t, tn, v, vn, b, bn) >= 0, ctr) 241 bn = sj_cat(b, 0, "the free tier gave 30 rpm on this run\n" as *u8) 242 gv_check("neg-control-a-GENERIC-tier-word-is-NOT-an-identifier (free would match half the corpus)" as *u8, xl_publish_guard(t, tn, v, vn, b, bn) < 0, ctr) 243 bn = sj_cat(b, 0, "stealth/ox-alpha is fast and capable\n" as *u8) 244 gv_check("T4 DECLARED IMPRECISION: a prose performance claim with no metric token PASSES -- this guard is a floor" as *u8, xl_publish_guard(t, tn, v, vn, b, bn) < 0, ctr) 245 let e: *u8 = sys_mmap(64) 246 gv_check("neg-control-an-EMPTY-body-is-publishable-and-does-not-crash" as *u8, xl_publish_guard(t, tn, v, vn, e, 0) < 0, ctr) 247 gv_check("neg-control-an-EMPTY-terms-ledger-restricts-NOBODY-so-nothing-is-refused" as *u8, xl_publish_guard(e, 0, v, vn, b, bn) < 0, ctr) 248 bn = sj_cat(b, 0, "the OpenRouter Stealth Program terms updated 2026-07-06 govern every stealth model\n" as *u8) 249 gv_check("neg-control-THE-BUG-THAT-SHIPPED: the token ms must NOT match inside the word terms" as *u8, xl_publish_guard(t, tn, v, vn, b, bn) < 0, ctr) 250 bn = sj_cat(b, 0, "openrouter replied in 4200 ms on this run\n" as *u8) 251 gv_check("T5 fixture-reached-the-condition: a REAL standalone ms measurement is still refused" as *u8, xl_publish_guard(t, tn, v, vn, b, bn) >= 0, ctr) 252 let nowin: *u8 = sys_mmap(256) 253 let nwn: i64 = sj_cat(nowin, 0, "metric|score\n" as *u8) 254 gv_check("neg-control-an-UNCONFIGURED-window-ABSTAINS-rather-than-becoming-the-whole-file" as *u8, xl_publish_guard(t, tn, nowin, nwn, b, bn) == 0 - 2, ctr) 255 let rc: i64 = gv_verdict("EXTLLM-PUBLISH-GUARD-GATE" as *u8, ctr, "XL8: a performance number about a publish-restricted provider is refused; a capability row about the same provider is published; the identifiers come from the ledger and the imprecision is declared" as *u8) 256 return rc 257} 258 259func main(argc: i64, argv: *i64) -> i64 { 260 if argc < 2 { 261 sj_werr("usage: nx_extllm_publish_guard {check <file> | selftest}\n" as *u8) 262 sys_exit(PG_USAGE) 263 return PG_USAGE 264 } 265 let verb: *u8 = argv[1] as *u8 266 if sj_lit_eq(verb, 0, sj_vlen(verb), "selftest" as *u8) == 1 { 267 let rc: i64 = pg_selftest() 268 sys_exit(rc) 269 return rc 270 } 271 if sj_lit_eq(verb, 0, sj_vlen(verb), "check" as *u8) == 1 { 272 if argc < 3 { sj_werr("XL8-FAIL check needs <file>\n" as *u8); sys_exit(PG_USAGE); return PG_USAGE } 273 let tl: *i64 = sys_mmap(XL_SPAN_BYTES) as *i64 274 let terms: *u8 = pg_read_estate(xl_terms_path(), tl) 275 if tl[0] <= 0 { sj_werr("XL8-UNKNOWN terms ledger unreadable -- refusing to certify rather than assuming\n" as *u8); sys_exit(XL_UNKNOWN); return XL_UNKNOWN } 276 let vl: *i64 = sys_mmap(XL_SPAN_BYTES) as *i64 277 let vocab: *u8 = pg_read_estate(pg_vocab_path(), vl) 278 if vl[0] <= 0 { sj_werr("XL8-UNKNOWN metric vocabulary unreadable -- refusing to certify rather than assuming\n" as *u8); sys_exit(XL_UNKNOWN); return XL_UNKNOWN } 279 let bl: *i64 = sys_mmap(XL_SPAN_BYTES) as *i64 280 let body: *u8 = pg_read_estate(argv[2] as *u8, bl) 281 if bl[0] <= 0 { sj_werr("XL8-UNKNOWN subject file unreadable\n" as *u8); sys_exit(XL_UNKNOWN); return XL_UNKNOWN } 282 let off: i64 = xl_publish_guard(terms, tl[0], vocab, vl[0], body, bl[0]) 283 let out: *u8 = sys_mmap(4096) 284 var o: i64 = 0 285 o = sj_cat(out, o, "{\"organ\":\"nx_extllm_publish_guard\",\"verb\":\"check\",\"file\":\"" as *u8) 286 o = sj_cat_esc(out, o, argv[2] as *u8, 0, sj_vlen(argv[2] as *u8), 200) 287 // THREE OUTCOMES, THREE EXIT CODES. -2 is UNKNOWN and must NOT read as publishable: an unconfigured 288 // window means the guard could not look, and an axis that cannot see must abstain, never acquit. 289 // Each branch also closes its own JSON. The old shared tail appended a quote the PUBLISHABLE branch 290 // had not opened, so that path emitted MALFORMED JSON -- invisible because every live run refused. 291 if off == 0 - 2 { 292 o = sj_cat(out, o, "\",\"verdict\":\"UNKNOWN-NO-WINDOW-CONFIGURED\",\"offending_offset\":-2,\"authority\":\"knowledge/extllm_metric_vocab.conf carries no window row; refusing to certify rather than assuming one\"}" as *u8) 293 out[o] = 10 as u8 294 sys_write(1, out, o + 1) 295 sys_exit(XL_UNKNOWN) 296 return XL_UNKNOWN 297 } 298 if off < 0 { 299 o = sj_cat(out, o, "\",\"verdict\":\"PUBLISHABLE\",\"offending_offset\":-1,\"authority\":\"knowledge/extllm_terms.conf benchmark_publish_restricted + knowledge/extllm_metric_vocab.conf; a FLOOR, never a proof of compliance\"}" as *u8) 300 out[o] = 10 as u8 301 sys_write(1, out, o + 1) 302 sys_exit(XL_ALLOW) 303 return XL_ALLOW 304 } 305 o = sj_cat(out, o, "\",\"verdict\":\"REFUSED\",\"offending_offset\":" as *u8) 306 o = sj_catn(out, o, off) 307 o = sj_cat(out, o, ",\"offending_window\":\"" as *u8) 308 var we: i64 = off + pg_window(vocab, vl[0]) 309 if we > bl[0] { we = bl[0] } 310 o = sj_cat_esc(out, o, body, off, we, 300) 311 o = sj_cat(out, o, "\",\"authority\":\"knowledge/extllm_terms.conf benchmark_publish_restricted + knowledge/extllm_metric_vocab.conf; a FLOOR, never a proof of compliance\"}" as *u8) 312 out[o] = 10 as u8 313 sys_write(1, out, o + 1) 314 sys_exit(XL_REFUSE) 315 return XL_REFUSE 316 } 317 sj_werr("XL8-FAIL unknown verb\n" as *u8) 318 sys_exit(PG_USAGE) 319 return PG_USAGE 320} 321 322// xl_publish_guard is defined ABOVE its callers on purpose: nx is single-pass, so pg_selftest and main can 323// only see a function that was declared earlier in the file.