nx_hr_sheriff_gate.nx source

1// nx_hr_sheriff_gate.nx -- referee for the SHERIFF (team procedure-compliance monitor). PROVES it flags each 2// procedure violation -- deploy-without-a-green-gate, release-not-via-the-publisher, acting-outside-your-RACI-lane -- 3// passes compliant actions, sweeps a log, and COUNTS per-actor violations (repeat-offender behavioral pattern). 4// GREEN iff every row matches. Prints verdict=GREEN to STDOUT + returns the exit code. 5// Durable -> knowledge/status/hr_sheriff_gate.log. license_tier: ORIGINAL 6import "nx_hr_sheriff.nx" 7import "nx_g_puts_lib.nx" 8import "nx_syscalls.nx" 9 10func g_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 11func g_w(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 12func g_wn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 13func rput(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){ dst[off+i]=s[i]; i=i+1 } return off+i } 14func gwrite(path: *u8, s: *u8, n: i64) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd<0 { return 0 } if n>0 { sys_write(fd, s, n) } sys_close(fd); return 0 } 15func hrow(buf: *u8, o: i64, area: *u8, role: *u8, lc: i64) -> i64 { var p: i64=rput(buf,o,area); buf[p]=9 as u8;p=p+1; p=rput(buf,p,role); buf[p]=9 as u8;p=p+1; buf[p]=lc as u8;p=p+1; buf[p]=10 as u8;p=p+1; return p } 16func ev(buf: *u8, o: i64, actor: *u8, action: *u8, area: *u8, g: i64, p: i64) -> i64 { var x: i64=rput(buf,o,actor);buf[x]=9 as u8;x=x+1; x=rput(buf,x,action);buf[x]=9 as u8;x=x+1; x=rput(buf,x,area);buf[x]=9 as u8;x=x+1; buf[x]=g as u8;x=x+1;buf[x]=9 as u8;x=x+1; buf[x]=p as u8;x=x+1;buf[x]=10 as u8;x=x+1; return x } 17func has(path: *u8, needle: *u8) -> i64 { 18 let buf: *u8 = sys_mmap(262144); let fd: i64=sys_openat_rd(path); if fd<0 {return 0} 19 var n: i64=0; var go: i64=1; while go==1 { let r: i64=sys_read(fd,buf+n,262144-n); if r<=0 {go=0} else {n=n+r; if n>=262144 {go=0}} } sys_close(fd) 20 var nl: i64=0; while needle[nl]!=(0 as u8){nl=nl+1}; if nl<=0 { return 0 } 21 var i: i64=0; while i+nl<=n { var j: i64=0; var m: i64=1; while j<nl { if buf[i+j]!=needle[j] {m=0;j=nl} else {j=j+1} } if m==1 { return 1 } i=i+1 } return 0 22} 23func chk(got: i64, want: i64, label: *u8) -> i64 { 24 g_puts(" "); g_puts(label); g_puts(" got="); g_num(got); g_puts(" want="); g_num(want) 25 if got == want { g_puts(" PASS\n"); return 1 } 26 g_puts(" FAIL\n"); return 0 27} 28 29func main() -> i64 { 30 g_puts("=== NISHI HR SHERIFF GATE (procedure-compliance monitor for the autonomous team) ===\n" as *u8) 31 var pass: i64=0 32 var rows: i64=0 33 let raci: *u8 = "/tmp/nx_sh_raci" as *u8 34 let log: *u8 = "/tmp/nx_sh_log" as *u8 35 let rep: *u8 = "/tmp/nx_sh_report" as *u8 36 37 let rb: *u8 = sys_mmap(512); var ro: i64 = 0 38 ro = hrow(rb, ro, "deploy" as *u8, "release_master" as *u8, 65) // Accountable 39 ro = hrow(rb, ro, "deploy" as *u8, "engineer" as *u8, 82) // Responsible 40 gwrite(raci, rb, ro) 41 42 // direct checks (actor, actorlen, action, actionlen, area, arealen, gate, pub, raci) 43 rows=rows+1; pass=pass+chk(sheriff_check_event("release_master" as *u8,14, "deploy" as *u8,6, "deploy" as *u8,6, 1, 1, raci), SH_OK, "release_master gated+via-publisher+A -> OK" as *u8) 44 rows=rows+1; pass=pass+chk(sheriff_check_event("engineer" as *u8,8, "deploy" as *u8,6, "deploy" as *u8,6, 0, 1, raci), SH_NO_GATE, "deploy without a gate -> NO_GATE" as *u8) 45 rows=rows+1; pass=pass+chk(sheriff_check_event("engineer" as *u8,8, "deploy" as *u8,6, "deploy" as *u8,6, 1, 0, raci), SH_NO_PUBLISHER, "release not via publisher -> NO_PUBLISHER" as *u8) 46 rows=rows+1; pass=pass+chk(sheriff_check_event("builder" as *u8,7, "deploy" as *u8,6, "deploy" as *u8,6, 1, 1, raci), SH_RACI_UNAUTH, "builder out of lane -> RACI_UNAUTH" as *u8) 47 rows=rows+1; pass=pass+chk(sheriff_check_event("engineer" as *u8,8, "build" as *u8,5, "deploy" as *u8,6, 0, 0, raci), SH_OK, "non-release in-lane action -> OK (no gate/publisher req)" as *u8) 48 rows=rows+1; pass=pass+chk(sh_raci_authorized(raci, "deploy" as *u8,6, "release_master" as *u8,14), 1, "RACI authorizes release_master on deploy" as *u8) 49 rows=rows+1; pass=pass+chk(sh_raci_authorized(raci, "deploy" as *u8,6, "builder" as *u8,7), 0, "RACI does NOT authorize builder on deploy" as *u8) 50 51 // sweep a log 52 let lb: *u8 = sys_mmap(1024); var lo: i64 = 0 53 lo = ev(lb, lo, "release_master" as *u8, "deploy" as *u8, "deploy" as *u8, 49, 49) // OK 54 lo = ev(lb, lo, "engineer" as *u8, "deploy" as *u8, "deploy" as *u8, 48, 49) // NO_GATE 55 lo = ev(lb, lo, "engineer" as *u8, "deploy" as *u8, "deploy" as *u8, 49, 48) // NO_PUBLISHER 56 lo = ev(lb, lo, "builder" as *u8, "deploy" as *u8, "deploy" as *u8, 49, 49) // RACI_UNAUTH 57 lo = ev(lb, lo, "engineer" as *u8, "build" as *u8, "deploy" as *u8, 48, 48) // OK 58 lo = ev(lb, lo, "release_master" as *u8, "deploy" as *u8, "deploy" as *u8, 49, 49) // OK 59 gwrite(log, lb, lo) 60 61 rows=rows+1; pass=pass+chk(sheriff_sweep(log, raci, rep), 3, "sweep -> 3 violations" as *u8) 62 rows=rows+1; pass=pass+chk(sheriff_actor_violations(log, raci, "engineer" as *u8, 8), 2, "engineer = 2 violations (repeat-offender pattern)" as *u8) 63 rows=rows+1; pass=pass+chk(has(rep, "VIOLATION:NO_GATE" as *u8), 1, "report flags NO_GATE" as *u8) 64 rows=rows+1; pass=pass+chk(has(rep, "builder\tVIOLATION:RACI_UNAUTH" as *u8), 1, "report flags builder out-of-lane" as *u8) 65 66 g_puts("----\nNISHI-HR-SHERIFF-GATE rows=" as *u8); g_num(rows); g_puts(" pass=" as *u8); g_num(pass) 67 if pass==rows { g_puts(" verdict=GREEN\n" as *u8) } else { g_puts(" verdict=RED\n" as *u8) } 68 let lg: i64=sys_openat_append("knowledge/status/hr_sheriff_gate.log" as *u8, 0x1a4) 69 if lg>=0 { 70 g_w(lg, "NISHI-HR-SHERIFF-GATE rows=" as *u8); g_wn(lg, rows); g_w(lg, " pass=" as *u8); g_wn(lg, pass) 71 if pass==rows { g_w(lg, " verdict=GREEN\n" as *u8) } else { g_w(lg, " verdict=RED\n" as *u8) } 72 sys_close(lg) 73 } 74 if pass==rows { sys_exit(0); return 0 } 75 sys_exit(1); return 1 76}