code wiki / _hdl_build / nx_feed_gate.nx
`nx_feed_gate.nx` source

↩ module page · 189 lines · 10654 B
1// nx_feed_gate.nx -- KEYLESS-FEED REACHABILITY GATE (eats debt seq856).
2// WHY: on 2026-07-25 the live nx_https_get went chrome-hello-ONLY and silently broke api.nhtsa.gov,
3// data.sec.gov and efts.sec.gov for ~a day. Nothing gated the feed surface, so a fetcher promote that
4// regresses a feed was invisible until a consumer failed. This organ forks the LIVE sovereign fetcher
5// once per keyless feed and asserts exit 0 AND an "HTTP/1.1 200" status line -- so a TLS-hello change,
6// a cert-store break, or a server-side drift turns RED the next time the beat runs.
7// The nhtsa case specifically exercises the plain-hello FALLBACK path; the worldbank case exercises
8// the chrome-first path -- both hello paths are load-bearing and both are gated.
9// argv[1] (optional) = fetcher elf path override; default = the live nx_https_get_cli2.elf. If the
10// live row is ever repointed, update FDG default (or the pinned row arg) in the same rung.
11// D001: emits a `verdict=` anchor. license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
12import "nx_tool_run.nx"
13import "nx_gate_lib.nx"
14import "nx_syscalls.nx"
15
16const FDG_OUTCAP: i64 = 1048576   // 1 MiB per-fetch capture (h6 page > 64KB; complaints excluded by design)
17const FDG_BUF: i64 = 65536
18const FDG_AVCAP: i64 = 64
19const FDG_SCRATCH: i64 = 32
20const FDG_EXIT_RED: i64 = 1
21
22// CONVERTED 2026-07-25 (seq938): the private fdg_ printer/needle helpers are gone -- this gate composes
23// nx_gate_lib.nx. Thin wrappers keep the ~30 call sites below untouched, which is the lowest-risk fold
24// (same technique proven on nx_flip_gate). fdg_case stays local because it carries this gate's OWN
25// contract: assert HTTP 200 on a fetched feed, which is narrower than the generic gl_case.
26func fdg_puts(s: *u8) -> i64 { return gl_puts(s) }
27func fdg_putn(v: i64) -> i64 { return gl_putn(v) }
28func fdg_bcat(b: *u8, o: i64, s: *u8) -> i64 { return gl_bcat(b, o, s) }
29func fdg_bcatn(b: *u8, o: i64, v: i64) -> i64 { return gl_bcatn(b, o, v) }
30func fdg_contains(h: *u8, n: i64, needle: *u8) -> i64 { return gl_contains(h, n, needle) }
31
32// one feed case: fork the fetcher with [path,url]; require exit 0 + "HTTP/1.1 200" in the capture.
33func fdg_case(nm: *u8, fetcher: *u8, url: *u8, counts: *i64, pb: *u8, po: i64) -> i64 {
  let av: *i64 = sys_mmap(FDG_AVCAP) as *i64
  av[0] = fetcher as i64
  av[1] = url as i64
  av[2] = 0
  let out: *u8 = sys_mmap(FDG_OUTCAP)
  let ol: *i64 = sys_mmap(FDG_SCRATCH) as *i64
  let rc: i64 = tr_run_capture(fetcher, av, out, FDG_OUTCAP, ol)
  var ok: i64 = 1
  if rc != 0 { ok = 0 }
  if fdg_contains(out, ol[0], "HTTP/1.1 200" as *u8) == 0 { ok = 0 }
  counts[0] = counts[0] + 1
  if ok == 1 { counts[1] = counts[1] + 1; return po }
  var o: i64 = po
  o = fdg_bcat(pb, o, "FAIL " as *u8)
  o = fdg_bcat(pb, o, nm)
  o = fdg_bcat(pb, o, " exit=" as *u8); o = fdg_bcatn(pb, o, rc)
  o = fdg_bcat(pb, o, " bytes=" as *u8); o = fdg_bcatn(pb, o, ol[0])
  o = fdg_bcat(pb, o, " want=HTTP/1.1-200\n" as *u8)
  return o
53}
54
55func main(argc: i64, argv: *i64) -> i64 {
  let counts: *i64 = sys_mmap(FDG_SCRATCH) as *i64
  counts[0] = 0
  counts[1] = 0
  let pb: *u8 = sys_mmap(FDG_BUF)
  var po: i64 = 0
  // path consts are LET bindings (const *u8 indexing trap -- see nx_flip_gate header)
  var fetcher: *u8 = "/volume1/homes/elderwesto/nishihost/nx_https_get_cli2.elf" as *u8
  if argc >= 2 { fetcher = argv[1] as *u8 }
64
  // the seven keyless feeds (small-bodied endpoints chosen deliberately; nhtsa complaints excluded --
  // its response can exceed the capture cap and recalls already proves host+fallback)
  po = fdg_case("sec-xbrl" as *u8, fetcher,
      "https://data.sec.gov/api/xbrl/companyconcept/CIK0000320193/us-gaap/Goodwill.json" as *u8, counts, pb, po)
  po = fdg_case("sec-fts" as *u8, fetcher,
      "https://efts.sec.gov/LATEST/search-index?q=%22spoofing%22&forms=8-K" as *u8, counts, pb, po)
  po = fdg_case("nhtsa-recalls-fallbackpath" as *u8, fetcher,
      "https://api.nhtsa.gov/recalls/recallsByVehicle?make=ford&model=focus&modelYear=2013" as *u8, counts, pb, po)
  po = fdg_case("worldbank-chromepath" as *u8, fetcher,
      "https://api.worldbank.org/v2/sources?format=json&per_page=1" as *u8, counts, pb, po)
  po = fdg_case("ecb-fx" as *u8, fetcher,
      "https://data-api.ecb.europa.eu/service/data/EXR/D.USD.EUR.SP00.A?lastNObservations=1&format=jsondata" as *u8, counts, pb, po)
  po = fdg_case("fed-h6" as *u8, fetcher,
      "https://www.federalreserve.gov/releases/h6/current/default.htm" as *u8, counts, pb, po)
  po = fdg_case("doj-rss" as *u8, fetcher,
      "https://www.justice.gov/news/rss?type=press_release" as *u8, counts, pb, po)
81
  // ---- TLS-1.2 SAFETY INTERLOCK (2026-07-25) ----
  // nx_tls12_client completes a real TLS-1.2 handshake to hosts our 1.3-only stack cannot reach (BLS,
  // CFTC, Treasury, USGS) -- but it performs NO X.509 chain validation and NO ServerKeyExchange signature
  // check, so the peer is unauthenticated. It therefore REFUSES (rc=4) to emit application data unless an
  // explicit --unauthenticated-ok is passed. This case asserts that refusal still fires: if a future edit
  // ever makes the unauthenticated path emit data by default, THIS turns the gate RED. The interlock is
  // the only thing standing between an MITM-open channel and a live government-data feed.
  let t12: *u8 = "/volume1/homes/elderwesto/nishihost/nx_tls12_client.elf" as *u8
  let t12m: *u8 = "/volume1/homes/elderwesto/nishihost/nx_tls12_mutant.elf" as *u8
  let blsurl: *u8 = "https://api.bls.gov/publicAPI/v2/timeseries/data/CUUR0000SA0" as *u8
92
  // (a) POSITIVE: the real client must AUTHENTICATE the peer (X.509 chain + SKE signature) and fetch.
  let avt: *i64 = sys_mmap(FDG_AVCAP) as *i64
  avt[0] = t12 as i64
  avt[1] = blsurl as i64
  avt[2] = 0
  let outt: *u8 = sys_mmap(FDG_OUTCAP)
  let olt: *i64 = sys_mmap(FDG_SCRATCH) as *i64
  let rct: i64 = tr_run_capture(t12, avt, outt, FDG_OUTCAP, olt)
  var okt: i64 = 1
  if rct != 0 { okt = 0 }
  if fdg_contains(outt, olt[0], "verdict=AUTHENTICATED" as *u8) == 0 { okt = 0 }
  if fdg_contains(outt, olt[0], "ske_sig=VALID" as *u8) == 0 { okt = 0 }
  counts[0] = counts[0] + 1
  if okt == 1 { counts[1] = counts[1] + 1 } else {
      po = fdg_bcat(pb, po, "FAIL tls12-authenticates-bls exit=" as *u8)
      po = fdg_bcatn(pb, po, rct)
      po = fdg_bcat(pb, po, " want_exit=0+AUTHENTICATED+ske_sig=VALID\n" as *u8)
  }
111
  // (b) MUTATION PROOF (the assertion that makes (a) mean something): nx_tls12_mutant is byte-identical to
  // the real client EXCEPT one flipped byte of the SIGNED payload. It MUST refuse. If this ever passes,
  // the ServerKeyExchange signature check has gone vacuous and the AUTHENTICATED verdict above is worthless.
  let avm: *i64 = sys_mmap(FDG_AVCAP) as *i64
  avm[0] = t12m as i64
  avm[1] = blsurl as i64
  avm[2] = 0
  let outm: *u8 = sys_mmap(FDG_OUTCAP)
  let olm: *i64 = sys_mmap(FDG_SCRATCH) as *i64
  let rcm: i64 = tr_run_capture(t12m, avm, outm, FDG_OUTCAP, olm)
  var okm: i64 = 1
  if rcm != 4 { okm = 0 }
  if fdg_contains(outm, olm[0], "serverkeyexchange-signature-invalid" as *u8) == 0 { okm = 0 }
  counts[0] = counts[0] + 1
  if okm == 1 { counts[1] = counts[1] + 1 } else {
      po = fdg_bcat(pb, po, "FAIL tls12-ske-mutation-must-refuse exit=" as *u8)
      po = fdg_bcatn(pb, po, rcm)
      po = fdg_bcat(pb, po, " want_exit=4\n" as *u8)
  }
131
  // (c) SHA-512 SIGNER: publicreporting.cftc.gov signs its SKE with RSA-PKCS1-SHA512, a DIFFERENT verifier
  // from the SHA-256 path above. Both must stay green or one signer silently stops being authenticated.
  let avf: *i64 = sys_mmap(FDG_AVCAP) as *i64
  avf[0] = t12 as i64
  avf[1] = "https://publicreporting.cftc.gov/resource/6dca-aqww.json?%24limit=1" as *u8 as i64
  avf[2] = 0
  let outf: *u8 = sys_mmap(FDG_OUTCAP)
  let olf: *i64 = sys_mmap(FDG_SCRATCH) as *i64
  let rcf: i64 = tr_run_capture(t12, avf, outf, FDG_OUTCAP, olf)
  var okf: i64 = 1
  if rcf != 0 { okf = 0 }
  if fdg_contains(outf, olf[0], "RSA-PKCS1-SHA512" as *u8) == 0 { okf = 0 }
  if fdg_contains(outf, olf[0], "verdict=AUTHENTICATED" as *u8) == 0 { okf = 0 }
  counts[0] = counts[0] + 1
  if okf == 1 { counts[1] = counts[1] + 1 } else {
      po = fdg_bcat(pb, po, "FAIL tls12-sha512-authenticates-cftc exit=" as *u8)
      po = fdg_bcatn(pb, po, rcf)
      po = fdg_bcat(pb, po, " want_exit=0+SHA512+AUTHENTICATED\n" as *u8)
  }
151
  // ---- TLS-1.2 X.509 NON-VACUITY (INC3 part 1) ----
  // A chain validator that can never REFUSE is worse than none: it launders a hostile cert into a green
  // light. This asserts the validator still rejects a cert whose SAN does not cover the host it was served
  // for -- the exact shape of an impersonation. If chain validation is ever weakened or bypassed, the
  // refusal stops firing and this turns the gate RED. (Measured 2026-07-25: hostname->cv=5, expired->cv=4,
  // untrusted-root->cv=7 -- three DISTINCT codes, so the validator discriminates rather than just failing.)
  let avc: *i64 = sys_mmap(FDG_AVCAP) as *i64
  avc[0] = t12 as i64
  avc[1] = "https://wrong.host.badssl.com/" as *u8 as i64
  avc[2] = 0
  let outc: *u8 = sys_mmap(FDG_OUTCAP)
  let olc: *i64 = sys_mmap(FDG_SCRATCH) as *i64
  let rcc: i64 = tr_run_capture(t12, avc, outc, FDG_OUTCAP, olc)
  var okc: i64 = 1
  if rcc != 4 { okc = 0 }
  if fdg_contains(outc, olc[0], "certificate-chain-validation-failed" as *u8) == 0 { okc = 0 }
  counts[0] = counts[0] + 1
  if okc == 1 { counts[1] = counts[1] + 1 } else {
      po = fdg_bcat(pb, po, "FAIL tls12-x509-rejects-wrong-hostname exit=" as *u8)
      po = fdg_bcatn(pb, po, rcc)
      po = fdg_bcat(pb, po, " want_exit=4
173" as *u8)
  }
175
  // DURABLE EVIDENCE (2026-07-25): the clock daemon dispatches this hourly but clk_dispatch_run does NOT
  // record the exit code and does NOT capture stdout -- so without this a RED would turn red in a VACUUM.
  gl_log("knowledge/status/feed_gate.log" as *u8, "NX-FEED-GATE" as *u8, counts)
  fdg_puts("NX-FEED-GATE\n" as *u8)
  fdg_puts("verdict=" as *u8)
  if counts[1] == counts[0] { fdg_puts("GREEN" as *u8) } else { fdg_puts("RED" as *u8) }
  fdg_puts(" pass=" as *u8); fdg_putn(counts[1])
  fdg_puts("/" as *u8); fdg_putn(counts[0])
  fdg_puts("\n" as *u8)
  sys_write(1, pb, po)
  if counts[1] == counts[0] { sys_exit(0); return 0 }
  sys_exit(FDG_EXIT_RED)
  return FDG_EXIT_RED
189}
nx_feed_gate.nx source

`nx_feed_gate.nx` source
