nx_https_ladder_gate.nx source

1// nx_https_ladder_gate.nx -- teeth for the TLS-1.3 -> Chrome-hello -> TLS-1.2 fetch ladder's ONE decision, 2// ff_leg_verdict in nx_https_fetch_follow.nx (2026-09-17). 3// 4// THE DEFECT IT GUARDS: the ladder's leg rule was hand-written in BOTH _best twins and both carried the same 5// error -- only a 2xx counted as an answer -- so a COMPLETE 404 from the 1.3 legs fell through to the TLS-1.2 6// leg, a 1.3-only host refused that leg, the 1.2 leg zeroed out_status on entry, and the 404 body was handed 7// back under status=0. The mirror lane (nx_research_fetch) reads status<=0 as "no HTTP answer, transient" and 8// retried a definitive 404 (about.marginalia-search.com, twice). One decision function now serves both twins; 9// this gate pins its truth table so neither twin can drift back. 10// 11// IN-PROCESS BY CONSTRUCTION: it imports nx_https_fetch_follow.nx and calls ff_leg_verdict directly with the 12// four inputs the ladder reads (leg, byte count, status, body state), so it exercises the code the transport 13// runs, needs no network, and has no NOT-DEPLOYED failure mode. 14import "nx_https_fetch_follow.nx" 15import "nx_gate_verdict.nx" 16 17func main(argc: i64, argv: *i64) -> i64 { 18 let ctr: *i64 = gv_ctr() 19 // --- the plain hello (leg 0): only a complete 2xx settles it; a non-2xx may be a fingerprint wall --- 20 gv_check_eq("plain-2xx-complete-DONE" as *u8, ff_leg_verdict(FF_LEG_PLAIN, 512, 200, NX_HTTPS_BODY_COMPLETE), FF_LEG_DONE, ctr) 21 gv_check_eq("plain-2xx-unjudgeable-chunked-DONE" as *u8, ff_leg_verdict(FF_LEG_PLAIN, 512, 200, NX_HTTPS_BODY_UNJUDGEABLE), FF_LEG_DONE, ctr) 22 gv_check_eq("plain-2xx-truncated-KEEP" as *u8, ff_leg_verdict(FF_LEG_PLAIN, 512, 200, NX_HTTPS_BODY_TRUNCATED), FF_LEG_KEEP, ctr) 23 gv_check_eq("plain-404-complete-NEXT-the-chrome-hello-still-gets-its-turn" as *u8, ff_leg_verdict(FF_LEG_PLAIN, 555, 404, NX_HTTPS_BODY_COMPLETE), FF_LEG_NEXT, ctr) 24 gv_check_eq("plain-403-complete-NEXT-a-fingerprint-wall-is-not-the-origin" as *u8, ff_leg_verdict(FF_LEG_PLAIN, 900, 403, NX_HTTPS_BODY_COMPLETE), FF_LEG_NEXT, ctr) 25 gv_check_eq("plain-301-hops-exhausted-NEXT" as *u8, ff_leg_verdict(FF_LEG_PLAIN, 300, 301, NX_HTTPS_BODY_COMPLETE), FF_LEG_NEXT, ctr) 26 // --- the Chrome hello (leg 1), the last 1.3 arm: a complete answer of ANY status ends the ladder --- 27 gv_check_eq("chrome-2xx-complete-DONE" as *u8, ff_leg_verdict(FF_LEG_CHROME, 512, 200, NX_HTTPS_BODY_COMPLETE), FF_LEG_DONE, ctr) 28 gv_check_eq("chrome-404-complete-DONE-THE-LAW-a-complete-answer-ends-the-ladder" as *u8, ff_leg_verdict(FF_LEG_CHROME, 555, 404, NX_HTTPS_BODY_COMPLETE), FF_LEG_DONE, ctr) 29 gv_check_eq("chrome-403-complete-DONE" as *u8, ff_leg_verdict(FF_LEG_CHROME, 900, 403, NX_HTTPS_BODY_COMPLETE), FF_LEG_DONE, ctr) 30 gv_check_eq("chrome-503-complete-DONE-retry-policy-belongs-to-the-caller" as *u8, ff_leg_verdict(FF_LEG_CHROME, 120, 503, NX_HTTPS_BODY_COMPLETE), FF_LEG_DONE, ctr) 31 gv_check_eq("chrome-301-hops-exhausted-DONE" as *u8, ff_leg_verdict(FF_LEG_CHROME, 300, 301, NX_HTTPS_BODY_COMPLETE), FF_LEG_DONE, ctr) 32 gv_check_eq("chrome-2xx-truncated-KEEP" as *u8, ff_leg_verdict(FF_LEG_CHROME, 512, 200, NX_HTTPS_BODY_TRUNCATED), FF_LEG_KEEP, ctr) 33 gv_check_eq("chrome-404-truncated-KEEP" as *u8, ff_leg_verdict(FF_LEG_CHROME, 200, 404, NX_HTTPS_BODY_TRUNCATED), FF_LEG_KEEP, ctr) 34 // --- no HTTP answer at all: every leg hands over to the next --- 35 gv_check_eq("plain-no-bytes-NEXT" as *u8, ff_leg_verdict(FF_LEG_PLAIN, 0 - 3, 0, NX_HTTPS_BODY_UNOBSERVED), FF_LEG_NEXT, ctr) 36 gv_check_eq("chrome-no-bytes-NEXT" as *u8, ff_leg_verdict(FF_LEG_CHROME, 0, 0, NX_HTTPS_BODY_UNOBSERVED), FF_LEG_NEXT, ctr) 37 gv_check_eq("chrome-bytes-but-status-zero-NEXT-unparseable-is-not-an-answer" as *u8, ff_leg_verdict(FF_LEG_CHROME, 555, 0, NX_HTTPS_BODY_COMPLETE), FF_LEG_NEXT, ctr) 38 // --- neg-controls: the old rule (2xx-only on every leg) must FAIL these, so a drift back cannot read green --- 39 gv_check("neg-control-chrome-404-complete-is-not-NEXT" as *u8, (ff_leg_verdict(FF_LEG_CHROME, 555, 404, NX_HTTPS_BODY_COMPLETE) != FF_LEG_NEXT) as i64, ctr) 40 gv_check("neg-control-chrome-503-complete-is-not-KEEP" as *u8, (ff_leg_verdict(FF_LEG_CHROME, 120, 503, NX_HTTPS_BODY_COMPLETE) != FF_LEG_KEEP) as i64, ctr) 41 gv_check("neg-control-plain-404-complete-is-not-DONE-the-fingerprint-arm-would-be-skipped" as *u8, (ff_leg_verdict(FF_LEG_PLAIN, 555, 404, NX_HTTPS_BODY_COMPLETE) != FF_LEG_DONE) as i64, ctr) 42 // --- the codes are distinct (a collapsed enum would make every tooth above vacuous) --- 43 let d1: i64 = (FF_LEG_NEXT != FF_LEG_DONE) as i64 44 let d2: i64 = (FF_LEG_DONE != FF_LEG_KEEP) as i64 45 let d3: i64 = (FF_LEG_NEXT != FF_LEG_KEEP) as i64 46 gv_check("codes-distinct-NEXT-DONE-KEEP" as *u8, d1 * d2 * d3, ctr) 47 gv_kv("legs" as *u8, 2) 48 gv_kv("truth_rows" as *u8, 16) 49 gv_kv("alert_code_tr_alerted" as *u8, TR_ALERTED) 50 return gv_exit(gv_verdict("https_ladder" as *u8, ctr, "ff_leg_verdict truth table: plain hello settles only a complete 2xx (a non-2xx may be a fingerprint wall the Chrome hello beats); the Chrome hello settles any complete answer; truncated bodies are banked; no-answer hands over; TR_ALERTED names a 1.3-only host refusing the 1.2 ClientHello" as *u8)) 51}