code wiki / (root) / nx_fetchfail_gate.nx
`nx_fetchfail_gate.nx` source

↩ module page · 231 lines · 14108 B
1// nx_fetchfail_gate.nx -- teeth for the CONTENT axis and the plane that carries it.
2//
3// IN-PROCESS BY CONSTRUCTION: it imports nx_mirrorintegrity_lib.nx and calls mi_content_class directly,
4// so it exercises THE SAME ruler nx_fetchfail runs instead of parsing that program's stdout. It has no
5// NOT-DEPLOYED failure mode.
6//
7// EVERY FIXTURE IS ASSEMBLED AT RUNTIME UNDER /tmp/fetchfail_gate/, never checked in and never shared
8// with a production beat, and the prose floor is passed as an ARGUMENT rather than read from the
9// shipped conf -- so this gate cannot be turned green or red by an edit to production data.
10// Setup unlinks before it creates: A GATE THAT IS NOT IDEMPOTENT REPORTS ON ITS FIRST RUN AND LIES
11// ABOUT EVERY RUN AFTER.
12//
13// THE FIRST REAL TOOTH IS ANTI-VACUITY. The trivial wrong implementation is "flag every body", which
14// passes every detection tooth below. Only bodies that MUST NOT be flagged can refute it, and the one
15// that actually matters is a page whose PROSE DISCUSSES bot walls in the very words the rules match on.
16// A DETECTOR THAT CANNOT TELL A PAGE ABOUT A DEFECT FROM THE DEFECT IS A FALSE-POSITIVE GENERATOR.
17// license_tier: ORIGINAL  expect_exit: 0
18import "nx_mirrorintegrity_lib.nx"
19import "nx_gate_verdict.nx"
20
21const FG_DIR:     *u8 = "/tmp/fetchfail_gate\x00"
22const FG_MODE644: i64 = 420
23const FG_MODE755: i64 = 493
24// The gate's OWN bar, deliberately not the shipped one. 64 bytes of rendered text is far above what any
25// interstitial renders and far below any real document, so every fixture below sits unambiguously on
26// one side of it -- the fixtures, not the bar, are what these teeth are testing.
27const FG_FLOOR:   i64 = 64
28
29func fg_put(path: *u8, data: *u8) -> i64 {
  sys_unlinkat(path)
  let fd: i64 = sys_openat_wr(path, FG_MODE644)
  if fd<0 { return 0-1 }
  var n: i64 = 0
  while data[n]!=(0 as u8) { n=n+1 }
  if n>0 { sys_write(fd, data, n) }
  sys_close(fd)
  return n
38}
39func fg_path(buf: *u8, name: *u8) -> i64 {
  var a: i64 = mi_cat(buf, 0, FG_DIR as *u8)
  a = mi_cat(buf, a, "/" as *u8)
  a = mi_cat(buf, a, name)
  buf[a]=0 as u8
  return a
45}
46
47func main(argc: i64, argv: *i64) -> i64 {
  gv_head("=== NX-FETCHFAIL-GATE -- can this axis tell a bot wall from a page ABOUT bot walls? ===" as *u8)
  let ctr: *i64 = gv_ctr()
  sys_mkdir(FG_DIR as *u8, FG_MODE755)
51
  let pb: *u8 = sys_mmap(1024)
  let prose: *i64 = sys_mmap(16) as *i64
  let hb: *i64 = sys_mmap(16) as *i64
55
  // ---------- plant one body per class, plus the controls ----------
  fg_path(pb, "good.html\x00" as *u8)
  fg_put(pb, "<html><head><title>Web Content Accessibility Guidelines</title></head><body><h1>WCAG 2.2</h1><p>This document defines success criteria and conformance requirements for making web content more accessible to people with disabilities, including blindness, deafness, limited movement and combinations of these.</p></body></html>\x00" as *u8)
59
  // THE CONTROL THAT MATTERS: every rule's vocabulary, in real prose, on a page that is NOT a failure.
  fg_path(pb, "about.html\x00" as *u8)
  fg_put(pb, "<html><head><title>How bot walls work</title></head><body><p>When Cloudflare interposes it returns a page titled Just a moment and sets cf_chl_opt while checking your browser. Some sites instead return 404 Not Found, or 403 Forbidden, or ask you to sign in to continue. Others simply say you need to enable javascript. Recognising each of these correctly is the whole problem, and a detector that flags this very paragraph is useless.</p></body></html>\x00" as *u8)
63
  fg_path(pb, "chal.html\x00" as *u8)
  fg_put(pb, "<html><head><title>Just a moment...</title></head><body><div id=\x22cf-wrapper\x22></div></body></html>\x00" as *u8)
66
  fg_path(pb, "login.html\x00" as *u8)
  fg_put(pb, "<html><head><title>x</title></head><body><p>Sign in to continue</p></body></html>\x00" as *u8)
69
  fg_path(pb, "err.html\x00" as *u8)
  fg_put(pb, "<html><head><title>x</title></head><body><h1>404 Not Found</h1></body></html>\x00" as *u8)
72
  fg_path(pb, "js.html\x00" as *u8)
  fg_put(pb, "<html><head><title>x</title></head><body><div id=\x22root\x22></div><noscript>You need to enable JavaScript</noscript></body></html>\x00" as *u8)
75
  // AMBIGUOUS ON PURPOSE: carries BOTH a challenge marker AND a JS-shell marker. The lib documents
  // that challenge is tested FIRST so a bot wall is never sent to the browser-render lane -- a remedy
  // that cannot possibly work on it. Nothing tested that ordering until this tooth.
  fg_path(pb, "both.html\x00" as *u8)
  fg_put(pb, "<html><head><title>Just a moment...</title></head><body><noscript>You need to enable JavaScript</noscript><div id=\x22root\x22></div></body></html>\x00" as *u8)
81
  // THE DEFECT THIS PAIR EXISTS TO CATCH, MEASURED 2026-08-25. A large JS bundle whose ERROR-HANDLING
  // CODE contains the string "404 Not Found" is NOT an error page -- the marker is in the BUNDLE, never
  // on the PAGE. That day, 17 of 17 bodies in the http-error class were exactly this shape, and every
  // one was routed to the fix-url-or-find-successor remedy while its url served real documentation.
  // This body therefore CARRIES the marker in raw bytes and MUST NOT be classified http-error.
  fg_path(pb, "bundle404.html\x00" as *u8)
  fg_put(pb, "<html><head><title>x</title><script>var e={s:404,m:\x22404 Not Found\x22,f:function(r){if(r.status===404)return this.m;}};</script></head><body><div id=\x22root\x22></div></body></html>\x00" as *u8)
89
  // The same defect on the login-wall class: "Please log in" is ordinary storefront nav and i18n JSON,
  // not a wall. Three bodies were convicted this way, all of them articles that were served in full.
  fg_path(pb, "bundlelogin.html\x00" as *u8)
  fg_put(pb, "<html><head><title>x</title><script>var i18n={account:{prompt:\x22Please log in\x22,cta:\x22Sign in to continue\x22}};</script></head><body><div id=\x22root\x22></div></body></html>\x00" as *u8)
94
  // an unjudgeable body: not HTML at all
  fg_path(pb, "plain.pdf\x00" as *u8)
  fg_put(pb, "%PDF-1.6\nnot markup at all\n%%EOF\n\x00" as *u8)
98
  // ---------- classify every planted body ----------
  fg_path(pb, "good.html\x00" as *u8);  let cgood: i64  = mi_content_class(pb, FG_FLOOR, prose, hb)
  let good_prose: i64 = prose[0]
  fg_path(pb, "about.html\x00" as *u8); let cabout: i64 = mi_content_class(pb, FG_FLOOR, prose, hb)
  let about_prose: i64 = prose[0]
  fg_path(pb, "chal.html\x00" as *u8);  let cchal: i64  = mi_content_class(pb, FG_FLOOR, prose, hb)
  fg_path(pb, "login.html\x00" as *u8); let clog: i64   = mi_content_class(pb, FG_FLOOR, prose, hb)
  fg_path(pb, "err.html\x00" as *u8);   let cerr: i64   = mi_content_class(pb, FG_FLOOR, prose, hb)
  fg_path(pb, "js.html\x00" as *u8);    let cjs: i64    = mi_content_class(pb, FG_FLOOR, prose, hb)
  fg_path(pb, "both.html\x00" as *u8);  let cboth: i64  = mi_content_class(pb, FG_FLOOR, prose, hb)
  fg_path(pb, "bundle404.html\x00" as *u8);   let cb404: i64 = mi_content_class(pb, FG_FLOOR, prose, hb)
  let b404_prose: i64 = prose[0]
  fg_path(pb, "bundlelogin.html\x00" as *u8); let cblog: i64 = mi_content_class(pb, FG_FLOOR, prose, hb)
  let blog_prose: i64 = prose[0]
  fg_path(pb, "plain.pdf\x00" as *u8);  let cpdf: i64   = mi_content_class(pb, FG_FLOOR, prose, hb)
  let pdf_prose: i64 = prose[0]
115
  // ---------- ASSERT THE FIXTURES REACHED THEIR CONDITIONS BEFORE ASSERTING ANY OUTCOME ----------
  // Without this, every tooth below could be passing because the renderer returned nothing for
  // everything -- which would ALSO make the failure classes fire. A fixture the defect cannot fail is
  // not a test, and here the fixture's own precondition is that real prose was actually extracted.
  var reached: i64 = 0
  if good_prose >= FG_FLOOR { if about_prose >= FG_FLOOR { reached=1 } }
  gv_check("fixture-reached-the-condition-both-control-bodies-render-prose-above-the-floor" as *u8, reached, ctr)
123
  // ---------- ANTI-VACUITY FIRST: the flag-everything implementation dies on these two ----------
  var okgood: i64 = 0
  if cgood==MC_OK { okgood=1 }
  gv_check("neg-control-a-real-document-is-NOT-flagged" as *u8, okgood, ctr)
128
  var okabout: i64 = 0
  if cabout==MC_OK { okabout=1 }
  gv_check("neg-control-a-page-ABOUT-bot-walls-carrying-every-marker-phrase-in-PROSE-is-NOT-flagged" as *u8, okabout, ctr)
132
  // ---------- the real defect shapes, BOTH directions ----------
  // gv_bite's 3rd argument is DID-IT-FIRE-ON-GOOD and must be 0, so each bite carries its own control.
  var fired_good: i64 = 1
  if cgood==MC_OK { fired_good=0 }
137
  var b1: i64 = 0
  if cchal==MC_BOT_CHALLENGE { b1=1 }
  gv_bite("bot-challenge-interstitial-stored-instead-of-the-document" as *u8, b1, fired_good, ctr)
141
  var b2: i64 = 0
  if clog==MC_LOGIN_WALL { b2=1 }
  gv_bite("login-wall-stored-instead-of-the-document" as *u8, b2, fired_good, ctr)
145
  var b3: i64 = 0
  if cerr==MC_HTTP_ERROR { b3=1 }
  gv_bite("http-error-page-stored-as-a-200-body" as *u8, b3, fired_good, ctr)
149
  var b4: i64 = 0
  if cjs==MC_JS_SHELL { b4=1 }
  gv_bite("js-shell-that-rendered-empty" as *u8, b4, fired_good, ctr)
153
  // ---------- DISCRIMINATION, not just detection ----------
  // Two teeth that each isolate one signal do NOT prove the ruler can tell them apart. This body
  // carries both at once, and the remedy differs: a render lane cannot get past a bot wall.
  var okboth: i64 = 0
  if cboth==MC_BOT_CHALLENGE { okboth=1 }
  gv_check("a-body-carrying-BOTH-a-challenge-and-a-js-shell-marker-classifies-CHALLENGE-not-JS-SHELL" as *u8, okboth, ctr)
160
  // ---------- THE MISCLASSIFICATION DEFECT, BOTH DIRECTIONS ----------
  // ANTI-VACUITY FIRST, AND IT IS LOAD-BEARING HERE. A fixture that did not actually CONTAIN the
  // marker would pass the two teeth below for entirely the wrong reason, and the pass would read as
  // proof. So prove the RAW bytes carry it, and prove the RENDERED prose sits below the floor so the
  // marker tests are genuinely reached rather than short-circuited by the p>=floor acquittal.
  // Without both halves, "not classified http-error" is a fact about an empty fixture, not the ruler.
  let lb: *i64 = sys_mmap(16) as *i64
  fg_path(pb, "bundle404.html\x00" as *u8)
  lb[0]=0
  let rawe: *u8 = sys_read_file(pb, lb)
  var carries_err: i64 = 0
  if (rawe as i64)!=0 { carries_err = mi_has(rawe, lb[0], "404 not found\x00" as *u8) }
  fg_path(pb, "bundlelogin.html\x00" as *u8)
  lb[0]=0
  let rawl: *u8 = sys_read_file(pb, lb)
  var carries_log: i64 = 0
  if (rawl as i64)!=0 { carries_log = mi_has(rawl, lb[0], "please log in\x00" as *u8) }
178
  var fixt: i64 = 0
  if carries_err==1 { if carries_log==1 { if b404_prose < FG_FLOOR { if blog_prose < FG_FLOOR { fixt=1 } } } }
  gv_check("fixture-reached-the-condition-both-bundles-CARRY-the-marker-in-raw-bytes-and-render-below-the-floor" as *u8, fixt, ctr)
182
  var okb404: i64 = 0
  if cb404==MC_JS_SHELL { okb404=1 }
  gv_check("neg-control-a-JS-bundle-carrying-404-Not-Found-in-SCRIPT-is-JS-SHELL-not-HTTP-ERROR" as *u8, okb404, ctr)
186
  var okblog: i64 = 0
  if cblog==MC_JS_SHELL { okblog=1 }
  gv_check("neg-control-a-JS-bundle-carrying-Please-log-in-in-SCRIPT-is-JS-SHELL-not-LOGIN-WALL" as *u8, okblog, ctr)
190
  // AND THE TWO CLASSES MUST STILL FIRE. Relocating their markers to the rendered text could have
  // disarmed them wholesale, and that failure would read as a CLEAN CORPUS rather than a broken
  // ruler -- the flattering direction nobody audits. err.html and login.html carry their marker in
  // VISIBLE PROSE, so this is the positive control that a real error page and a real wall are still
  // convicted after the move.
  var still: i64 = 0
  if cerr==MC_HTTP_ERROR { if clog==MC_LOGIN_WALL { still=1 } }
  gv_check("the-two-relocated-classes-STILL-FIRE-when-their-marker-is-in-VISIBLE-prose" as *u8, still, ctr)
199
  // ---------- UNKNOWN is its own bucket, never folded into OK ----------
  var okpdf: i64 = 0
  if cpdf==MC_NOT_HTML { okpdf=1 }
  gv_check("neg-control-a-non-HTML-body-is-NOT-HTML-and-is-NOT-counted-content-present" as *u8, okpdf, ctr)
204
  var okpdfp: i64 = 0
  if pdf_prose < 0 { okpdfp=1 }
  gv_check("an-unjudgeable-body-reports-prose-as-ABSENT-not-as-zero" as *u8, okpdfp, ctr)
208
  // ---------- the remedy must travel with the finding, and must DIFFER by class ----------
  // A remedy table that returned one string for everything would pass a mere non-empty check.
  var rem_ok: i64 = 0
  let r_chal: *u8 = mi_content_remedy(MC_BOT_CHALLENGE)
  let r_js:   *u8 = mi_content_remedy(MC_JS_SHELL)
  if mi_find(r_chal, 0, mi_slen(r_chal), r_js) < 0 { rem_ok=1 }
  gv_check("the-remedy-lane-DIFFERS-between-challenge-and-js-shell-not-just-present" as *u8, rem_ok, ctr)
216
  // ---------- the SHIPPED bar must actually be shipped ----------
  // mi_prose_floor falls back to MI_DEF_PROSE_FLOOR when knowledge/mirror_content.conf is absent, and
  // that bootstrap value is 1 -- a floor of one byte acquits almost every interstitial, so an absent
  // conf silently DISARMS the detector while every tooth above still passes. Measured absent on
  // 2026-08-25. This tooth is the one that notices.
  var conf_ok: i64 = 0
  if mi_prose_floor() > MI_DEF_PROSE_FLOOR { conf_ok=1 }
  gv_check("the-shipped-prose-floor-conf-EXISTS-so-the-detector-is-not-silently-disarmed" as *u8, conf_ok, ctr)
225
  // The note names the SUBJECT only. It deliberately recites no counts, no tally and no scope claim:
  // a note that enumerates the teeth silently becomes a lie the moment a tooth is added, and it drifts
  // toward understatement, which is the direction nobody audits. Each tooth already states itself.
  return gv_verdict("nx_fetchfail_gate" as *u8, ctr,
      "subject: mi_content_class in nx_mirrorintegrity_lib.nx, and the shipped prose-floor conf it reads" as *u8)
231}
nx_fetchfail_gate.nx source

`nx_fetchfail_gate.nx` source
