nx_hr_sov_gate.nx source

1// nx_hr_sov_gate.nx -- referee for the SOVEREIGN-STORED HR directory (nx_hr_sov on nx_seg_store + canon, NO tsv). 2// Proves the SAME access-SSOT semantics nx_hr's TAB-log gate proves, now on the sovereign store: enroll owner(3)/ 3// member(1) -> resolve 3/1; unknown -> 0 (deny-by-default); invite -> invited (no access) + is_invited; suspend -> 4// 0 (latest-wins in the additive store); set_role -> live role change; cred_id stable; realm isolation. GREEN iff 5// every row matches. -> knowledge/status/hr_sov_gate.log. This is the HR team's adoptable, de-risked migration core. 6import "nx_hr_sov.nx" 7import "nx_syscalls.nx" 8 9func g_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 10func g_n(v: i64) -> i64 { var m: i64=v; if m<0{g_w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 11func gw(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 12func g_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var i: i64=0; while s[i]!=(0 as u8){dst[o]=s[i];o=o+1;i=i+1} return o } 13func g_streq(a: *u8, b: *u8) -> i64 { var i: i64=0; while 1==1 { let ca: i64=a[i] as i64; let cb: i64=b[i] as i64; if ca!=cb {return 0} if ca==0 {return 1} i=i+1 } return 1 } 14func chk(got: i64, want: i64, label: *u8) -> i64 { g_w(" "); g_w(label); g_w(" got="); g_n(got); g_w(" want="); g_n(want); if got==want { g_w(" PASS\n"); return 1 } g_w(" FAIL\n"); return 0 } 15 16func main() -> i64 { 17 g_w("=== NISHI HR-SOV GATE (access SSOT on nx_seg_store + canon; NO tsv; same semantics as nx_hr) ===\n" as *u8) 18 var pass: i64=0; var rows: i64=0 19 // fresh per-run store (now_ms-suffixed; pids get reused) 20 let ms: i64=sys_now_ms() 21 let pfx: *u8=sys_mmap(128); var po: i64=g_cat(pfx,0,"/tmp/nx_hrsov_" as *u8); let nb: *u8=sys_mmap(24) 22 var m: i64=ms; var k: i64=0; if m==0{nb[0]=48 as u8;k=1} while m>0{nb[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var z: i64=k-1; while z>=0{pfx[po]=nb[z];po=po+1;z=z-1} pfx[po]=0 as u8 23 24 let NR: *u8="nishi_site_admin" as *u8; let NRN: i64=16 25 let AR: *u8="andelinwest_admin" as *u8; let ARN: i64=17 26 let fam: *u8="andelin" as *u8 27 let cid_o: *u8=sys_mmap(96); let cid_m: *u8=sys_mmap(96); let cid_g: *u8=sys_mmap(96) 28 29 hrs_enroll(pfx, NR, NRN, "elderwesto" as *u8, 10, HRS_OWNER, fam, 1000, "system" as *u8, cid_o) 30 rows=rows+1; pass=pass+chk(hrs_resolve_level(pfx, cid_o), 3, "enroll owner -> resolve 3" as *u8) 31 rows=rows+1; pass=pass+chk(hrs_is_superadmin(pfx, cid_o), 1, " owner is_superadmin=1" as *u8) 32 33 hrs_enroll(pfx, NR, NRN, "brad" as *u8, 4, HRS_MEMBER, fam, 1000, "elderwesto" as *u8, cid_m) 34 rows=rows+1; pass=pass+chk(hrs_resolve_level(pfx, cid_m), 1, "enroll member -> resolve 1" as *u8) 35 rows=rows+1; pass=pass+chk(hrs_resolve_level(pfx, "0000000000000000000000000000000000000000000000000000000000000000" as *u8), 0, "unknown cred -> 0 (deny-by-default)" as *u8) 36 37 hrs_invite(pfx, NR, NRN, "ghost" as *u8, 5, HRS_OWNER, fam, 1000, "elderwesto" as *u8, cid_g) 38 rows=rows+1; pass=pass+chk(hrs_status_code(pfx, cid_g), HRS_ST_INVITED, "invite -> status INVITED" as *u8) 39 rows=rows+1; pass=pass+chk(hrs_resolve_level(pfx, cid_g), 0, " invited owner has NO access yet (resolve 0)" as *u8) 40 rows=rows+1; pass=pass+chk(hrs_is_invited(pfx, NR, NRN, "ghost" as *u8, 5), 1, " is_invited(ghost)=1" as *u8) 41 42 hrs_suspend(pfx, cid_m, "brad" as *u8, fam, 2000, "elderwesto" as *u8) 43 rows=rows+1; pass=pass+chk(hrs_resolve_level(pfx, cid_m), 0, "suspend member -> resolve 0 (latest-wins)" as *u8) 44 rows=rows+1; pass=pass+chk(hrs_resolve_level(pfx, cid_o), 3, " owner UNAFFECTED (still 3)" as *u8) 45 46 hrs_set_role(pfx, cid_m, "brad" as *u8, HRS_OWNER, fam, 3000, "elderwesto" as *u8) 47 rows=rows+1; pass=pass+chk(hrs_resolve_level(pfx, cid_m), 3, "set_role member->owner -> resolve 3 (live role change)" as *u8) 48 49 // cred_id stable + realm isolation 50 let cid_chk: *u8=sys_mmap(96); hrs_cred_id(NR, NRN, "brad" as *u8, 4, cid_chk) 51 rows=rows+1; pass=pass+chk(g_streq(cid_m, cid_chk), 1, "cred_id STABLE (enroll == re-derived)" as *u8) 52 rows=rows+1; pass=pass+chk(hrs_is_invited(pfx, AR, ARN, "ghost" as *u8, 5), 0, "realm isolation: ghost NOT invited in andelinwest realm" as *u8) 53 54 // ROSTER ENUMERATION (seg_store via the index): elderwesto+brad active, ghost invited 55 rows=rows+1; pass=pass+chk(hrs_roster_count(pfx, HRS_ST_ACTIVE), 2, "roster: 2 active logins (elderwesto + brad)" as *u8) 56 rows=rows+1; pass=pass+chk(hrs_roster_count(pfx, HRS_ST_INVITED), 1, "roster: 1 pending invite (ghost)" as *u8) 57 58 g_w("----\nNISHI-HR-SOV-GATE rows=" as *u8); g_n(rows); g_w(" pass=" as *u8); g_n(pass) 59 if pass==rows { g_w(" verdict=GREEN\n" as *u8) } else { g_w(" verdict=RED\n" as *u8) } 60 let lg: i64=sys_openat_append("knowledge/status/hr_sov_gate.log" as *u8, 0x1a4) 61 if lg>=0 { gw(lg, "NISHI-HR-SOV-GATE pass=" as *u8); let bb:*u8=sys_mmap(8); var mm:i64=pass; var kk:i64=0; if mm==0{bb[0]=48 as u8;kk=1} while mm>0{bb[kk]=(48+(mm%10)) as u8;mm=mm/10;kk=kk+1} sys_write(lg,bb,kk); if pass==rows{gw(lg," verdict=GREEN\n" as *u8)}else{gw(lg," verdict=RED\n" as *u8)} sys_close(lg) } 62 if pass==rows { sys_exit(0); return 0 } 63 sys_exit(1); return 1 64}