nx_gatedry.nx source

1// nx_gatedry.nx -- CLI over nx_gatedry_lib: classify ONE gate source at a submission chokepoint. 2// 3// WHY: L009 is not merely large, it is GROWING -- measured on the NAS within a single session on 4// 2026-07-31, 2035/2167 -> 2041/2182. A campaign that only removes old breaches LOSES to a tree that 5// adds new ones. The 2026 practice for this exact shape is a RATCHET (Notion's ESLint ratcheting bans an 6// INCREASE and requires a deliberate re-bank), and the shape is proven here three times already: the 7// warden's L009/L010 detectors and nx_magicratchet refusing new inline magic at /api/build. 8// This is the DETECTOR half, deliberately SINGLE-FILE so it judges the one file being submitted -- no 9// directory walk, no corpus cap, nothing to be dishonest about. 10// 11// The classifier lives in nx_gatedry_lib.nx (no main) so this CLI and its GATE share ONE copy. 12// 13// usage: nx_gatedry <path-to-gate-source> 14// exit 0 ADOPTER | 1 CUSTOM-VERDICT (L009 breach) | 2 NO-VERDICT (seq585 unjudgeable) | 3 UNREADABLE 15// license_tier: ORIGINAL No hw writes (Rule 26). 16import "nx_gatedry_lib.nx" 17import "nx_estr.nx" 18 19func main(argc: i64, argv: *i64) -> i64 { 20 if argc < 2 { 21 es_puts("usage: nx_gatedry <path-to-gate-source>\n" as *u8) 22 es_puts("exit 0 ADOPTER | 1 CUSTOM-VERDICT (L009) | 2 NO-VERDICT (seq585) | 3 UNREADABLE\n" as *u8) 23 sys_exit(GD_UNREADABLE) 24 return GD_UNREADABLE 25 } 26 let path: *u8 = argv[1] as *u8 27 let ln: *i64 = sys_mmap(16) as *i64 28 ln[0] = 0 29 let buf: *u8 = sys_read_file(path, ln) 30 if buf as i64 == 0 { 31 es_puts("NX-GATEDRY UNREADABLE " as *u8); es_puts(path); es_puts("\n" as *u8) 32 sys_exit(GD_UNREADABLE) 33 return GD_UNREADABLE 34 } 35 let n: i64 = ln[0] 36 let v: i64 = gd_classify(buf, n) 37 es_puts("NX-GATEDRY " as *u8); es_puts(gd_name(v)); es_puts(" " as *u8); es_puts(path) 38 es_puts(" bytes=" as *u8); es_putn(n) 39 es_puts(" method=substring-presence" as *u8); es_puts(gd_advice(v)); es_puts("\n" as *u8) 40 sys_exit(v) 41 return v 42}