nx_https_fetch_lib_gate.nx source
↩ module page · 146 lines · 8127 B
1// nx_https_fetch_lib_gate.nx -- runtime proof for the fetch composition extracted
2// out of nx_https_get_cli.nx into nx_https_fetch_lib.nx (2026-07-31).
3//
4// WHY A LIVE FETCH AND NOT A MOCK: the thing being refactored is a TLS 1.3
5// handshake, a cert-chain validation and a chunked HTTP read. A mock would prove
6// only that the function names still resolve. The whole risk of lifting this code
7// is that some piece of state the old main() set up implicitly is now missing --
8// and only a real handshake against a real endpoint can show that.
9//
10// ★ A REFACTOR OF A CROWN-JEWEL PATH IS NOT DONE UNTIL THE BEHAVIOUR IS RE-PROVEN.
11// license_tier: ORIGINAL
12import "nx_https_fetch_lib.nx"
13import "nx_gate.nx"
14import "nx_gate_verdict.nx" // D001: canonical verdict emission + actlog frame
15
16const FL_CAP: i64 = 1048576
17
18func fl_has(b: *u8, n: i64, s: *u8) -> i64 {
19 var sl: i64 = 0
20 while s[sl] != (0 as u8) { sl = sl + 1 }
21 if sl == 0 { return 1 }
22 var i: i64 = 0
23 while i + sl <= n {
24 var m: i64 = 1
25 var j: i64 = 0
26 while j < sl { if b[i+j]!=s[j] { m=0; j=sl } else { j=j+1 } }
27 if m == 1 { return 1 }
28 i = i + 1
29 }
30 return 0
31}
32
33func main() -> i64 {
34 gw("=== nx_https_fetch_lib_gate: the extracted fetch still really fetches ===\n" as *u8)
35 var pass: i64=0; var tot: i64=0
36
37 let store: i64 = hf_store_load()
38 tot=tot+1; if store > 0 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
39 gw("T1 the Mozilla trust store loads once (reused across every fetch)\n" as *u8)
40
41 let out: *u8 = sys_mmap(FL_CAP)
42 let n: i64 = hf_fetch(store, "https://example.com" as *u8, 0, 0, out, FL_CAP)
43 tot=tot+1; if n > 0 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
44 gw("T2 a REAL TLS 1.3 fetch returns bytes (" as *u8); gn(n); gw(")\n" as *u8)
45
46 var st: i64 = 0 - 1
47 if n > 0 { st = hf_status(out, n) }
48 tot=tot+1; if st == 200 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
49 gw("T3 status line parses to 200 (" as *u8); gn(st); gw(")\n" as *u8)
50
51 var bo: i64 = 0 - 1
52 if n > 0 { bo = hf_body_off(out, n) }
53 tot=tot+1; if bo > 0 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
54 gw("T4 the body offset is found past CRLFCRLF (" as *u8); gn(bo); gw(")\n" as *u8)
55
56 var got: i64 = 0
57 if n > 0 { got = fl_has(out, n, "Example Domain" as *u8) }
58 tot=tot+1; if got == 1 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
59 gw("T5 the body is the REAL page, not an error surface\n" as *u8)
60
61 // negative control: a malformed url must name its own failure, not be
62 // indistinguishable from a network outage.
63 let bad: i64 = hf_fetch(store, "notaurl" as *u8, 0, 0, out, FL_CAP)
64 tot=tot+1; if bad == HF_ERR_URL { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
65 gw("T6 NEG-CONTROL a bad url returns HF_ERR_URL, distinct from a connect failure (" as *u8); gn(bad); gw(")\n" as *u8)
66
67 // ---- THE STREAMING TAIL: media never goes through a full-size buffer ----
68 let dst: *u8 = "knowledge/hfgate_stream.bin" as *u8
69 let st1: *i64 = sys_mmap(16) as *i64
70 var wrote: i64 = 0 - 99
71 let wfd: i64 = sys_openat_wr(dst, 420)
72 if wfd >= 0 {
73 wrote = hf_fetch_to_file(store, "https://example.com" as *u8, 0, 0, wfd, 0, st1)
74 sys_close(wfd)
75 }
76 tot=tot+1; if wrote > 0 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
77 gw("T7 hf_fetch_to_file STREAMS real bytes to an fd (" as *u8); gn(wrote); gw(" status " as *u8); gn(st1[0]); gw(")\n" as *u8)
78
79 // the file on disk must actually hold what we were told was written --
80 // a byte count returned by the writer is not evidence the bytes landed.
81 var onfd: i64 = 0 - 1
82 let rfd: i64 = sys_openat_rd(dst)
83 if rfd >= 0 { onfd = sys_lseek(rfd, 0, 2); sys_close(rfd) }
84 tot=tot+1; if onfd > 0 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
85 gw("T8 the bytes LANDED ON DISK, verified by stat not by the return value (" as *u8); gn(onfd); gw(")\n" as *u8)
86
87 // ★ RESUME TOOTH: with range_start>0 the server must answer 206 Partial
88 // Content. If Range were silently ignored it would answer 200 with the WHOLE
89 // body, and a resumed download would append duplicate bytes onto the partial
90 // file -- silent corruption that looks like a successful resume.
91 let st2: *i64 = sys_mmap(16) as *i64
92 var rwrote: i64 = 0 - 99
93 let wfd2: i64 = sys_openat_wr("knowledge/hfgate_stream_resume.bin" as *u8, 420)
94 if wfd2 >= 0 {
95 rwrote = hf_fetch_to_file(store, "https://example.com" as *u8, 0, 0, wfd2, 200, st2)
96 sys_close(wfd2)
97 }
98 tot=tot+1; if st2[0] == 206 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
99 gw("T9 TOOTH range_start>0 gets 206 PARTIAL, so a resume cannot silently re-append (" as *u8); gn(st2[0]); gw(")\n" as *u8)
100
101 tot=tot+1; if rwrote < wrote { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
102 gw("T10 the resumed fetch returns FEWER bytes than the whole file (" as *u8); gn(rwrote); gw(" < " as *u8); gn(wrote); gw(")\n" as *u8)
103
104 // THE REDIRECT TOOTH. Host chosen by MEASUREMENT, not convenience: a scan
105 // showed en.wikipedia.org answers 301 AND our TLS stack can handshake it,
106 // while the iana.org APEX fails cert validation (verdict=7) even though
107 // www.iana.org succeeds. Testing redirects against a host we cannot reach
108 // would have proven nothing -- which is exactly what the first attempt did.
109 let rst: *i64 = sys_mmap(16) as *i64
110 var rwrote: i64 = 0 - 99
111 let rfd: i64 = sys_openat_wr("knowledge/hfgate_redirect.bin" as *u8, 420)
112 if rfd >= 0 { rwrote = hf_fetch_to_file(store, "https://en.wikipedia.org" as *u8, 0, 0, rfd, 0, rst); sys_close(rfd) }
113 tot=tot+1; if rst[0] == 200 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
114 gw("T11 TOOTH a 301 host ends at status 200, so the redirect was FOLLOWED (" as *u8); gn(rst[0]); gw(")\n" as *u8)
115
116 tot=tot+1; if rwrote > 0 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
117 gw("T12 TOOTH bytes from the REDIRECT TARGET actually landed (" as *u8); gn(rwrote); gw(")\n" as *u8)
118
119 // ★ THE TLS-1.2 TOOTH. graphis.ne.jp is Apache/2.2.31 + OpenSSL 1.0.0, TLS-1.2 ONLY -- it never answers
120 // a 1.3 ClientHello, so a 1.3-only stack CANNOT produce these bytes and this tooth cannot pass by accident.
121 // It also replies CHUNKED (no Content-Length), which is exactly what the 2026-08-05 fix addressed: the
122 // read loop used to treat a missing Content-Length as "response complete", returning a 200 with an EMPTY
123 // body that the fetch ladder then reported as a handshake failure (debt 1785971025).
124 // T16 asserting BYTES rather than status is the whole point -- a status-only assertion PASSES while broken.
125 let o12: *u8 = sys_mmap(FL_CAP)
126 let n12: i64 = hf_fetch12_once(store, "https://graphis.ne.jp/" as *u8, 0, 0, o12, FL_CAP)
127 tot=tot+1; if n12 > 0 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
128 gw("T14 TOOTH hf_fetch12_once reaches a TLS-1.2-ONLY host that a 1.3 hello cannot (" as *u8); gn(n12); gw(")\n" as *u8)
129
130 var s12: i64 = 0 - 1
131 if n12 > 0 { s12 = hf_status(o12, n12) }
132 tot=tot+1; if s12 == 200 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
133 gw("T15 TOOTH that 1.2 fetch parses to a real 200 (" as *u8); gn(s12); gw(")\n" as *u8)
134
135 var b12: i64 = 0
136 if n12 > 0 { b12 = fl_has(o12, n12, "<html" as *u8) }
137 tot=tot+1; if b12 == 1 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
138 gw("T16 TOOTH the CHUNKED body ARRIVED -- a 200 with an empty body is the defect this exists to catch\n" as *u8)
139
140 let ctr: *i64 = gv_ctr()
141 ctr[0] = pass
142 ctr[1] = tot
143 let rc: i64 = gv_verdict("HTTPS-FETCH-LIB" as *u8, ctr, "the lifted fetch composition performs a real TLS fetch end to end" as *u8)
144 sys_exit(rc)
145 return rc
146}