code wiki / (root) / nx_formatlaw_gate.nx
`nx_formatlaw_gate.nx` source

↩ module page · 146 lines · 8559 B
1// nx_formatlaw_gate.nx -- the referee for nx_formatlaw_lib: does the source-law scanner fire on every planted class,
2// stay silent on every exemption and on prose, and count what it cannot show?
3// Fixtures are ASSEMBLED AT RUNTIME (never written as literals in this file, or a scanner that reads source would
4// find its own test), in memory -- no files, no /tmp, idempotent by construction.
5// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
6import "nx_gate_verdict.nx"
7import "nx_formatlaw_lib.nx"
8
9const FG_BUF: i64 = 65536
10const FG_Q: i64 = 34
11const FG_NL: i64 = 10
12
13func fg_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; var p: i64 = o; while s[i] != (0 as u8) { d[p] = s[i]; p = p + 1; i = i + 1 } return p }
14// a source line `let x: *u8 = "<lit>"` assembled from parts so the literal is never a literal here
15func fg_line(d: *u8, o: i64, lit_a: *u8, lit_b: *u8) -> i64 {
  var p: i64 = fg_cat(d, o, "let x: *u8 = " as *u8)
  d[p] = FG_Q as u8; p = p + 1
  p = fg_cat(d, p, lit_a); p = fg_cat(d, p, lit_b)
  d[p] = FG_Q as u8; p = p + 1
  p = fg_cat(d, p, " as *u8" as *u8)
  d[p] = FG_NL as u8; p = p + 1
  return p
23}
24func fg_comment(d: *u8, o: i64, text_a: *u8, text_b: *u8) -> i64 {
  var p: i64 = fg_cat(d, o, "// " as *u8); p = fg_cat(d, p, text_a); p = fg_cat(d, p, text_b)
  d[p] = FG_NL as u8; p = p + 1
  return p
28}
29func fg_license(d: *u8, o: i64) -> i64 { return fg_comment(d, o, "license_tier" as *u8, ": ORIGINAL" as *u8) }
30
31func main(argc: i64, argv: *i64) -> i64 {
  gv_head("nx_formatlaw_gate -- the source-law scanner fires on every planted class, never on exemptions or prose" as *u8)
  let ctr: *i64 = gv_ctr()
  let b: *u8 = sys_mmap(FG_BUF)
  let hits: *i64 = sys_mmap(FL_MAX_HITS * FL_HIT_WORDS * 8) as *i64
  let counts: *i64 = sys_mmap(FL_CLASSES * 8) as *i64
37
  // (1) CLEAN: a licensed source whose literals are all plane paths and estate binaries -> zero findings
  var n: i64 = fg_license(b, 0)
  n = fg_line(b, n, "knowledge/store/" as *u8, "frametrace-" as *u8)
  n = fg_line(b, n, "./nx_store_put" as *u8, ".elf" as *u8)
  n = fg_line(b, n, "_offc/nx_debt" as *u8, ".elf" as *u8)
  let t0: i64 = fl_scan(b, n, hits, counts)
  gv_check("neg-control-clean-licensed-source-yields-zero-findings" as *u8, t0 == 0, ctr)
  gv_check("neg-control-clean-source-has-no-F3" as *u8, counts[FL_F3] == 0, ctr)
46
  // (2) F1: a durable .tsv under knowledge/status/ fires once at the right line
  n = fg_license(b, 0)
  n = fg_line(b, n, "knowledge/status/frametrace_beach" as *u8, ".tsv" as *u8)
  let t1: i64 = fl_scan(b, n, hits, counts)
  gv_check("F1-durable-tsv-under-knowledge-fires" as *u8, t1 == 1, ctr)
  gv_check("F1-finding-carries-class-F1" as *u8, hits[0] == FL_F1, ctr)
  gv_check("F1-finding-carries-line-2" as *u8, hits[1] == 2, ctr)
  gv_check("F1-finding-literal-bounds-select-the-path" as *u8, fl_ends_ci(b, hits[2], hits[3], ".tsv" as *u8) == 1, ctr)
55
  // (3) F1 is case-insensitive and covers .csv .sqlite .yaml .jsonl
  n = fg_license(b, 0)
  n = fg_line(b, n, "knowledge/a" as *u8, ".CSV" as *u8)
  n = fg_line(b, n, "runtime/cache" as *u8, ".sqlite" as *u8)
  n = fg_line(b, n, "conf/x" as *u8, ".yaml" as *u8)
  n = fg_line(b, n, "log/y" as *u8, ".jsonl" as *u8)
  let t2: i64 = fl_scan(b, n, hits, counts)
  gv_check("F1-four-legacy-extensions-fire-four-times" as *u8, counts[FL_F1] == 4, ctr)
  gv_check("F1-total-equals-class-count-when-nothing-else-fires" as *u8, t2 == 4, ctr)
65
  // (4) EXEMPTIONS: fetched evidence, fixtures, wire formats, documents -> silent
  n = fg_license(b, 0)
  n = fg_line(b, n, "knowledge/fetched/ansur2_female" as *u8, ".csv" as *u8)
  n = fg_line(b, n, "/tmp/nx_gate/fixture" as *u8, ".tsv" as *u8)
  n = fg_line(b, n, "sites/nishifamily/compare/api" as *u8, ".json" as *u8)
  n = fg_line(b, n, "web_assets/_game_build/x" as *u8, ".json" as *u8)
  n = fg_line(b, n, "_jobs/job_1" as *u8, ".json" as *u8)
  n = fg_line(b, n, "specs/nx_patent_table" as *u8, ".txt" as *u8)
  let t3: i64 = fl_scan(b, n, hits, counts)
  gv_check("neg-control-exemptions-are-silent" as *u8, t3 == 0, ctr)
76
  // (5) F1J: a .json under knowledge/ (not fetched) is its own class
  n = fg_license(b, 0)
  n = fg_line(b, n, "knowledge/status/thing" as *u8, ".json" as *u8)
  let t4: i64 = fl_scan(b, n, hits, counts)
  gv_check("F1J-json-under-knowledge-fires-as-its-own-class" as *u8, counts[FL_F1J] == 1, ctr)
  gv_check("F1J-does-not-count-as-F1" as *u8, counts[FL_F1] == 0, ctr)
  gv_check("F1J-total-one" as *u8, t4 == 1, ctr)
84
  // (6) F2: third-party executable paths fire; estate paths do not
  n = fg_license(b, 0)
  n = fg_line(b, n, "/usr/bin/" as *u8, "python3" as *u8)
  n = fg_line(b, n, "/bin/" as *u8, "sh" as *u8)
  n = fg_line(b, n, "/opt/" as *u8, "node/bin/node" as *u8)
  n = fg_line(b, n, "/volume1/homes/elderwesto/nishihost/" as *u8, "nx_debt.elf" as *u8)
  let t5: i64 = fl_scan(b, n, hits, counts)
  gv_check("F2-three-third-party-exec-paths-fire" as *u8, counts[FL_F2] == 3, ctr)
  gv_check("neg-control-estate-serving-root-path-is-not-F2" as *u8, t5 == 3, ctr)
94
  // (7) PROSE IS NOT CODE: the same offending path inside a comment does not fire
  n = fg_license(b, 0)
  n = fg_comment(b, n, "this used to write knowledge/status/x" as *u8, ".tsv and forked /usr/bin/python3" as *u8)
  n = fg_comment(b, n, "quoted in prose: \"knowledge/y" as *u8, ".csv\" is gone" as *u8)
  let t6: i64 = fl_scan(b, n, hits, counts)
  gv_check("neg-control-a-comment-naming-the-defect-does-not-fire" as *u8, t6 == 0, ctr)
101
  // (8) F3: a source with no license_tier declaration fires once, at line 0, even when otherwise clean
  n = fg_line(b, 0, "knowledge/store/" as *u8, "review-" as *u8)
  let t7: i64 = fl_scan(b, n, hits, counts)
  gv_check("F3-missing-license-tier-fires-once" as *u8, counts[FL_F3] == 1, ctr)
  gv_check("F3-is-a-file-level-finding-at-line-0" as *u8, hits[1] == 0, ctr)
  gv_check("F3-total-one" as *u8, t7 == 1, ctr)
108
  // (9) BOTH SIGNALS AT ONCE: one source with F1 + F2 + no license counts three classes and three findings
  n = fg_line(b, 0, "knowledge/status/z" as *u8, ".tsv" as *u8)
  n = fg_line(b, n, "/usr/bin/" as *u8, "jq" as *u8)
  let t8: i64 = fl_scan(b, n, hits, counts)
  gv_check("mixed-source-counts-F1-F2-F3-together" as *u8, (counts[FL_F1] == 1) + (counts[FL_F2] == 1) + (counts[FL_F3] == 1) == 3, ctr)
  gv_check("mixed-source-total-is-the-sum-of-its-classes" as *u8, t8 == counts[FL_F1] + counts[FL_F1J] + counts[FL_F2] + counts[FL_F3], ctr)
115
  // (10) THE CAP COUNTS PAST WHAT IT KEEPS: FL_MAX_HITS + 3 offenders -> total exceeds kept, and kept == FL_MAX_HITS
  n = fg_license(b, 0)
  var k: i64 = 0
  while k < FL_MAX_HITS + 3 { n = fg_line(b, n, "knowledge/status/many" as *u8, ".tsv" as *u8); k = k + 1 }
  let t9: i64 = fl_scan(b, n, hits, counts)
  gv_check("count-continues-past-the-kept-cap" as *u8, t9 == FL_MAX_HITS + 3, ctr)
  gv_check("kept-is-the-cap-and-announced-as-a-prefix" as *u8, fl_kept(t9) == FL_MAX_HITS, ctr)
123
  // (10b) A TOKEN IS NOT A PATH, A DIRECTORY IS NOT A BINARY: the scanner's own tables must not be findings
  n = fg_license(b, 0)
  n = fg_line(b, n, ".tsv" as *u8, "" as *u8)
  n = fg_line(b, n, ".CSV" as *u8, "" as *u8)
  n = fg_line(b, n, "/usr/bin/" as *u8, "" as *u8)
  n = fg_line(b, n, "/bin/" as *u8, "" as *u8)
  let t9b: i64 = fl_scan(b, n, hits, counts)
  gv_check("neg-control-bare-extension-tokens-and-bare-exec-dirs-are-silent" as *u8, t9b == 0, ctr)
  n = fg_license(b, 0)
  n = fg_line(b, n, "x" as *u8, ".tsv" as *u8)
  n = fg_line(b, n, "/usr/bin/" as *u8, "x" as *u8)
  let t9c: i64 = fl_scan(b, n, hits, counts)
  gv_check("one-byte-basenames-still-fire-both-classes" as *u8, (counts[FL_F1] == 1) + (counts[FL_F2] == 1) == 2, ctr)
137
  // (11) the identity of a finding is stable and distinct: same literal in two files -> two ids; same file+literal twice -> one id
  let h1: i64 = fl_fnv("a.nx" as *u8, 0, 4, FL_FNV_OFFSET)
  let h2: i64 = fl_fnv("b.nx" as *u8, 0, 4, FL_FNV_OFFSET)
  let h1b: i64 = fl_fnv("a.nx" as *u8, 0, 4, FL_FNV_OFFSET)
  gv_check("finding-id-differs-across-files" as *u8, h1 != h2, ctr)
  gv_check("finding-id-is-stable-for-the-same-input" as *u8, h1 == h1b, ctr)
144
  return gv_verdict("nx_formatlaw_gate" as *u8, ctr, "planted F1/F1J/F2/F3 fire, exemptions and prose stay silent, the count outlives the kept cap" as *u8)
146}
nx_formatlaw_gate.nx source

`nx_formatlaw_gate.nx` source
