code wiki / _hdl_build / nx_feed_gate.nx
`nx_feed_gate.nx` source

↩ module page · 246 lines · 13961 B
1// nx_feed_gate.nx -- KEYLESS-FEED REACHABILITY GATE (eats debt seq856).
2// WHY: on 2026-07-25 the live nx_https_get went chrome-hello-ONLY and silently broke api.nhtsa.gov,
3// data.sec.gov and efts.sec.gov for ~a day. Nothing gated the feed surface, so a fetcher promote that
4// regresses a feed was invisible until a consumer failed. This organ forks the LIVE sovereign fetcher
5// once per keyless feed and asserts exit 0 AND an "HTTP/1.1 200" status line -- so a TLS-hello change,
6// a cert-store break, or a server-side drift turns RED the next time the beat runs.
7// The nhtsa case specifically exercises the plain-hello FALLBACK path; the worldbank case exercises
8// the chrome-first path -- both hello paths are load-bearing and both are gated.
9// argv[1] (optional) = fetcher elf path override; default = the live nx_https_get_cli2.elf. If the
10// live row is ever repointed, update FDG default (or the pinned row arg) in the same rung.
11// D001: emits a `verdict=` anchor. license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
12import "nx_tool_run.nx"
13import "nx_gate_lib.nx"
14import "nx_syscalls.nx"
15
16const FDG_OUTCAP: i64 = 1048576   // 1 MiB per-fetch capture (h6 page > 64KB; complaints excluded by design)
17const FDG_BUF: i64 = 65536
18const FDG_AVCAP: i64 = 64
19const FDG_SCRATCH: i64 = 32
20const FDG_EXIT_RED: i64 = 1
21// ★A ZERO-DELAY RETRY AGAINST A RATE-LIMITING HOST MAKES THINGS WORSE, NOT BETTER: it doubles the
22// request rate on exactly the host that just told you to slow down. Measured 2026-08-06 --
23// publicreporting.cftc.gov passed, then failed TWICE consecutively while the gate was being run
24// repeatedly, then passed again after a pause. That is a rate limit, not a broken fetcher.
25const FDG_RETRY_MS: i64 = 2000
26
27// CONVERTED 2026-07-25 (seq938): the private fdg_ printer/needle helpers are gone -- this gate composes
28// nx_gate_lib.nx. Thin wrappers keep the ~30 call sites below untouched, which is the lowest-risk fold
29// (same technique proven on nx_flip_gate). fdg_case stays local because it carries this gate's OWN
30// contract: assert HTTP 200 on a fetched feed, which is narrower than the generic gl_case.
31func fdg_puts(s: *u8) -> i64 { return gl_puts(s) }
32func fdg_putn(v: i64) -> i64 { return gl_putn(v) }
33func fdg_bcat(b: *u8, o: i64, s: *u8) -> i64 { return gl_bcat(b, o, s) }
34func fdg_bcatn(b: *u8, o: i64, v: i64) -> i64 { return gl_bcatn(b, o, v) }
35func fdg_contains(h: *u8, n: i64, needle: *u8) -> i64 { return gl_contains(h, n, needle) }
36
37// one feed case: fork the fetcher with [path,url]; require exit 0 + "HTTP/1.1 200" in the capture.
38//
39// ★★DOUBLE-FETCH SEPARATES A FLAKY HOST FROM A BROKEN FETCHER (2026-08-06). Measured: this gate
40// returned RED 10/11 on tls12-sha512-authenticates-cftc and GREEN 11/11 on an immediate re-run, with
41// no code change in between -- i.e. one remote host's mood decided the verdict. A gate that cries wolf
42// is a gate people learn to ignore, and this one guards the whole feed surface.
43// So: on failure, try EXACTLY ONCE more. A genuinely broken fetcher fails BOTH attempts, so a retry
44// cannot manufacture a pass -- but a host that blinked no longer turns the estate red.
45// ★AND THE RETRY IS NEVER SILENT: a case that needed the second attempt is counted and printed as
46// FLAKY. Hiding the retry would trade a false RED for an invisible degradation, which is the worse
47// trade -- a host that now needs two attempts every run is telling you something.
48// SCOPE, DELIBERATE: retry applies ONLY to positive REACHABILITY cases. The two negative interlocks
49// (ske-mutation-must-refuse, x509-wrong-hostname-must-refuse) are left byte-identical: retrying a
50// must-refuse assertion is how a security gate goes vacuous, and a vacuous gate is worse than none.
51func fdg_case(nm: *u8, fetcher: *u8, url: *u8, counts: *i64, pb: *u8, po: i64) -> i64 {
  let av: *i64 = sys_mmap(FDG_AVCAP) as *i64
  av[0] = fetcher as i64
  av[1] = url as i64
  av[2] = 0
  let out: *u8 = sys_mmap(FDG_OUTCAP)
  let ol: *i64 = sys_mmap(FDG_SCRATCH) as *i64
  var rc: i64 = 0
  var ok: i64 = 0
  var tries: i64 = 0
  while tries < 2 {
      rc = tr_run_capture(fetcher, av, out, FDG_OUTCAP, ol)
      ok = 1
      if rc != 0 { ok = 0 }
      if fdg_contains(out, ol[0], "HTTP/1.1 200" as *u8) == 0 { ok = 0 }
      if ok == 1 {
          if tries == 1 { counts[2] = counts[2] + 1 }
          tries = 9
      } else {
          tries = tries + 1
          if tries == 1 { sys_sleep_ms(FDG_RETRY_MS) }
      }
  }
  counts[0] = counts[0] + 1
  if ok == 1 {
      counts[1] = counts[1] + 1
      if tries == 9 { return po }
      return po
  }
  var o: i64 = po
  o = fdg_bcat(pb, o, "FAIL " as *u8)
  o = fdg_bcat(pb, o, nm)
  o = fdg_bcat(pb, o, " exit=" as *u8); o = fdg_bcatn(pb, o, rc)
  o = fdg_bcat(pb, o, " bytes=" as *u8); o = fdg_bcatn(pb, o, ol[0])
  o = fdg_bcat(pb, o, " want=HTTP/1.1-200 (RETRIED ONCE, both attempts failed)\n" as *u8)
  return o
87}
88
89func main(argc: i64, argv: *i64) -> i64 {
  let counts: *i64 = sys_mmap(FDG_SCRATCH) as *i64
  counts[0] = 0
  counts[1] = 0
  counts[2] = 0        // cases that PASSED only on the second attempt -- reported, never hidden
  let pb: *u8 = sys_mmap(FDG_BUF)
  var po: i64 = 0
  // path consts are LET bindings (const *u8 indexing trap -- see nx_flip_gate header)
  var fetcher: *u8 = "/volume1/homes/elderwesto/nishihost/nx_https_get_cli2.elf" as *u8
  if argc >= 2 { fetcher = argv[1] as *u8 }
99
  // the seven keyless feeds (small-bodied endpoints chosen deliberately; nhtsa complaints excluded --
  // its response can exceed the capture cap and recalls already proves host+fallback)
  po = fdg_case("sec-xbrl" as *u8, fetcher,
      "https://data.sec.gov/api/xbrl/companyconcept/CIK0000320193/us-gaap/Goodwill.json" as *u8, counts, pb, po)
  po = fdg_case("sec-fts" as *u8, fetcher,
      "https://efts.sec.gov/LATEST/search-index?q=%22spoofing%22&forms=8-K" as *u8, counts, pb, po)
  po = fdg_case("nhtsa-recalls-fallbackpath" as *u8, fetcher,
      "https://api.nhtsa.gov/recalls/recallsByVehicle?make=ford&model=focus&modelYear=2013" as *u8, counts, pb, po)
  po = fdg_case("worldbank-chromepath" as *u8, fetcher,
      "https://api.worldbank.org/v2/sources?format=json&per_page=1" as *u8, counts, pb, po)
  po = fdg_case("ecb-fx" as *u8, fetcher,
      "https://data-api.ecb.europa.eu/service/data/EXR/D.USD.EUR.SP00.A?lastNObservations=1&format=jsondata" as *u8, counts, pb, po)
  po = fdg_case("fed-h6" as *u8, fetcher,
      "https://www.federalreserve.gov/releases/h6/current/default.htm" as *u8, counts, pb, po)
  po = fdg_case("doj-rss" as *u8, fetcher,
      "https://www.justice.gov/news/rss?type=press_release" as *u8, counts, pb, po)
116
  // ---- TLS-1.2 SAFETY INTERLOCK (2026-07-25) ----
  // nx_tls12_client completes a real TLS-1.2 handshake to hosts our 1.3-only stack cannot reach (BLS,
  // CFTC, Treasury, USGS) -- but it performs NO X.509 chain validation and NO ServerKeyExchange signature
  // check, so the peer is unauthenticated. It therefore REFUSES (rc=4) to emit application data unless an
  // explicit --unauthenticated-ok is passed. This case asserts that refusal still fires: if a future edit
  // ever makes the unauthenticated path emit data by default, THIS turns the gate RED. The interlock is
  // the only thing standing between an MITM-open channel and a live government-data feed.
  let t12: *u8 = "/volume1/homes/elderwesto/nishihost/nx_tls12_client.elf" as *u8
  let t12m: *u8 = "/volume1/homes/elderwesto/nishihost/nx_tls12_mutant.elf" as *u8
  let blsurl: *u8 = "https://api.bls.gov/publicAPI/v2/timeseries/data/CUUR0000SA0" as *u8
127
  // (a) POSITIVE: the real client must AUTHENTICATE the peer (X.509 chain + SKE signature) and fetch.
  let avt: *i64 = sys_mmap(FDG_AVCAP) as *i64
  avt[0] = t12 as i64
  avt[1] = blsurl as i64
  avt[2] = 0
  let outt: *u8 = sys_mmap(FDG_OUTCAP)
  let olt: *i64 = sys_mmap(FDG_SCRATCH) as *i64
  // POSITIVE reachability case -> one retry (see fdg_case). Negative interlocks below are NOT retried.
  var rct: i64 = 0
  var okt: i64 = 0
  var tb: i64 = 0
  while tb < 2 {
      rct = tr_run_capture(t12, avt, outt, FDG_OUTCAP, olt)
      okt = 1
      if rct != 0 { okt = 0 }
      if fdg_contains(outt, olt[0], "verdict=AUTHENTICATED" as *u8) == 0 { okt = 0 }
      if fdg_contains(outt, olt[0], "ske_sig=VALID" as *u8) == 0 { okt = 0 }
      if okt == 1 { if tb == 1 { counts[2] = counts[2] + 1 } tb = 9 } else { tb = tb + 1; if tb == 1 { sys_sleep_ms(FDG_RETRY_MS) } }
  }
  counts[0] = counts[0] + 1
  if okt == 1 { counts[1] = counts[1] + 1 } else {
      po = fdg_bcat(pb, po, "FAIL tls12-authenticates-bls exit=" as *u8)
      po = fdg_bcatn(pb, po, rct)
      po = fdg_bcat(pb, po, " want_exit=0+AUTHENTICATED+ske_sig=VALID\n" as *u8)
  }
153
  // (b) MUTATION PROOF (the assertion that makes (a) mean something): nx_tls12_mutant is byte-identical to
  // the real client EXCEPT one flipped byte of the SIGNED payload. It MUST refuse. If this ever passes,
  // the ServerKeyExchange signature check has gone vacuous and the AUTHENTICATED verdict above is worthless.
  let avm: *i64 = sys_mmap(FDG_AVCAP) as *i64
  avm[0] = t12m as i64
  avm[1] = blsurl as i64
  avm[2] = 0
  let outm: *u8 = sys_mmap(FDG_OUTCAP)
  let olm: *i64 = sys_mmap(FDG_SCRATCH) as *i64
  let rcm: i64 = tr_run_capture(t12m, avm, outm, FDG_OUTCAP, olm)
  var okm: i64 = 1
  if rcm != 4 { okm = 0 }
  if fdg_contains(outm, olm[0], "serverkeyexchange-signature-invalid" as *u8) == 0 { okm = 0 }
  counts[0] = counts[0] + 1
  if okm == 1 { counts[1] = counts[1] + 1 } else {
      po = fdg_bcat(pb, po, "FAIL tls12-ske-mutation-must-refuse exit=" as *u8)
      po = fdg_bcatn(pb, po, rcm)
      po = fdg_bcat(pb, po, " want_exit=4\n" as *u8)
  }
173
  // (c) SHA-512 SIGNER: publicreporting.cftc.gov signs its SKE with RSA-PKCS1-SHA512, a DIFFERENT verifier
  // from the SHA-256 path above. Both must stay green or one signer silently stops being authenticated.
  let avf: *i64 = sys_mmap(FDG_AVCAP) as *i64
  avf[0] = t12 as i64
  avf[1] = "https://publicreporting.cftc.gov/resource/6dca-aqww.json?%24limit=1" as *u8 as i64
  avf[2] = 0
  let outf: *u8 = sys_mmap(FDG_OUTCAP)
  let olf: *i64 = sys_mmap(FDG_SCRATCH) as *i64
  // POSITIVE reachability case -> same one-retry rule as fdg_case (this is the exact case that
  // flaked RED then GREEN on 2026-08-06 with no code change). The AUTHENTICATED + SHA512 assertions
  // are re-evaluated in full on the retry, so a genuine authentication regression still fails twice.
  var rcf: i64 = 0
  var okf: i64 = 0
  var tf: i64 = 0
  while tf < 2 {
      rcf = tr_run_capture(t12, avf, outf, FDG_OUTCAP, olf)
      okf = 1
      if rcf != 0 { okf = 0 }
      if fdg_contains(outf, olf[0], "RSA-PKCS1-SHA512" as *u8) == 0 { okf = 0 }
      if fdg_contains(outf, olf[0], "verdict=AUTHENTICATED" as *u8) == 0 { okf = 0 }
      if okf == 1 { if tf == 1 { counts[2] = counts[2] + 1 } tf = 9 } else { tf = tf + 1; if tf == 1 { sys_sleep_ms(FDG_RETRY_MS) } }
  }
  counts[0] = counts[0] + 1
  if okf == 1 { counts[1] = counts[1] + 1 } else {
      po = fdg_bcat(pb, po, "FAIL tls12-sha512-authenticates-cftc exit=" as *u8)
      po = fdg_bcatn(pb, po, rcf)
      po = fdg_bcat(pb, po, " want_exit=0+SHA512+AUTHENTICATED\n" as *u8)
  }
202
  // ---- TLS-1.2 X.509 NON-VACUITY (INC3 part 1) ----
  // A chain validator that can never REFUSE is worse than none: it launders a hostile cert into a green
  // light. This asserts the validator still rejects a cert whose SAN does not cover the host it was served
  // for -- the exact shape of an impersonation. If chain validation is ever weakened or bypassed, the
  // refusal stops firing and this turns the gate RED. (Measured 2026-07-25: hostname->cv=5, expired->cv=4,
  // untrusted-root->cv=7 -- three DISTINCT codes, so the validator discriminates rather than just failing.)
  let avc: *i64 = sys_mmap(FDG_AVCAP) as *i64
  avc[0] = t12 as i64
  avc[1] = "https://wrong.host.badssl.com/" as *u8 as i64
  avc[2] = 0
  let outc: *u8 = sys_mmap(FDG_OUTCAP)
  let olc: *i64 = sys_mmap(FDG_SCRATCH) as *i64
  let rcc: i64 = tr_run_capture(t12, avc, outc, FDG_OUTCAP, olc)
  var okc: i64 = 1
  if rcc != 4 { okc = 0 }
  if fdg_contains(outc, olc[0], "certificate-chain-validation-failed" as *u8) == 0 { okc = 0 }
  counts[0] = counts[0] + 1
  if okc == 1 { counts[1] = counts[1] + 1 } else {
      po = fdg_bcat(pb, po, "FAIL tls12-x509-rejects-wrong-hostname exit=" as *u8)
      po = fdg_bcatn(pb, po, rcc)
      po = fdg_bcat(pb, po, " want_exit=4
224" as *u8)
  }
226
  // DURABLE EVIDENCE (2026-07-25): the clock daemon dispatches this hourly but clk_dispatch_run does NOT
  // record the exit code and does NOT capture stdout -- so without this a RED would turn red in a VACUUM.
  gl_log("knowledge/status/feed_gate.log" as *u8, "NX-FEED-GATE" as *u8, counts)
  fdg_puts("NX-FEED-GATE\n" as *u8)
  fdg_puts("verdict=" as *u8)
  if counts[1] == counts[0] { fdg_puts("GREEN" as *u8) } else { fdg_puts("RED" as *u8) }
  fdg_puts(" pass=" as *u8); fdg_putn(counts[1])
  fdg_puts("/" as *u8); fdg_putn(counts[0])
  if counts[2] > 0 {
      // A host that needs two attempts EVERY run is degrading, not merely blinking. Surfacing the
      // count is what makes that visible instead of quietly absorbed by the retry.
      fdg_puts(" flaky=" as *u8); fdg_putn(counts[2])
      fdg_puts(" (passed only on the 2nd attempt -- host blinked, not a fetcher regression)" as *u8)
  }
  fdg_puts("\n" as *u8)
  sys_write(1, pb, po)
  if counts[1] == counts[0] { sys_exit(0); return 0 }
  sys_exit(FDG_EXIT_RED)
  return FDG_EXIT_RED
246}
nx_feed_gate.nx source

`nx_feed_gate.nx` source
