nx_hub_exceed_gate.nx source

1import "nx_gate_gn.nx" 2// nx_hub_exceed_gate.nx -- MEASURED head-to-head for the HUB maturity-flag publishing system. 3// NOT a self-graded rollup (the no-wave law): each dimension MEASURES the maturity design against a 4// NAIVE baseline on the SAME inputs, and the baseline's FAILURE is a load-bearing negative control -- 5// if the naive model did NOT fail, the exceed claim would be vacuous and this gate goes RED. 6// 7// DIM-A FAIL-CLOSED / NO-LEAK : probe every gated artifact at its public-root URL. 8// maturity router refuses (TIER_MISMATCH) by construction; the naive flat-doc-root+/hub-proxy 9// model serves it (the real /wiki fall-through). MEASURED: leaks_maturity vs leaks_naive. 10// DIM-B ATOMIC ONE-FLAG PROMOTE : actually promote an artifact; COUNT the registry writes and check 11// the reachable URL changed. maturity = 1 atomic append, reversible by 1 tombstone append. 12// naive reference (enumerated, by-design): move files between trees + edit proxy + restart (3, non-atomic). 13// DIM-C SOVEREIGNTY : third-party services in the serving path. maturity=0 (only nx_* organs); 14// SaaS reference = host + feature-flag + auth vendors = 3 metadata sinks. 15// DIM-D CONFIG-NOT-ROLLOUT : daemon restarts to apply a visibility change. maturity=0 (registry is 16// re-read live per request -> can NEVER crash hosting); naive reference >= 1 restart. 17// 18// HONEST SCOPE: EXCEED is on sovereignty + fail-closed safety + atomic/reversible operations + 19// can't-crash-hosting, BY CONSTRUCTION and MEASURED here -- NOT a parity claim vs mature CI/CD 20// (A/B targeting, analytics, global edge CDN). Those remain ABSENT until separately measured. 21// Sovereign: nx_syscalls + nx_maturity_registry. license_tier: ORIGINAL 22import "nx_syscalls.nx" 23import "nx_maturity_registry.nx" 24 25func gp(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 26func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 27func g_app(buf: *u8, off: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { buf[off + i] = s[i]; i = i + 1 } return off + i } 28func g_row7(buf: *u8, off: i64, a: *u8, b: *u8, c: *u8, d: *u8, e: *u8, f: *u8, g: *u8) -> i64 { 29 var o: i64 = g_app(buf, off, a); buf[o] = 9 as u8; o = o + 1 30 o = g_app(buf, o, b); buf[o] = 9 as u8; o = o + 1 31 o = g_app(buf, o, c); buf[o] = 9 as u8; o = o + 1 32 o = g_app(buf, o, d); buf[o] = 9 as u8; o = o + 1 33 o = g_app(buf, o, e); buf[o] = 9 as u8; o = o + 1 34 o = g_app(buf, o, f); buf[o] = 9 as u8; o = o + 1 35 o = g_app(buf, o, g); buf[o] = 10 as u8; o = o + 1 36 return o 37} 38 39// NAIVE baseline: flat doc-root served statically + a reverse-proxy gate ONLY on the /hub prefix. 40// A /hub URL is handled by the proxy (return 0 = not-leaked here); ANY other URL falls through to the 41// static doc-root and is served iff a file exists there -- modeled as "an artifact is registered at it", 42// regardless of that artifact's maturity/access. So a gated artifact is ALSO reachable at its root URL. 43func naive_serve(reg: *u8, reglen: i64, url: *u8, urllen: i64) -> i64 { 44 if mr_starts_with(url, urllen, "/hub/" as *u8, 5) == 1 { return 0 } 45 var rs: i64 = 0 46 if urllen > 0 { if url[0] == (47 as u8) { rs = 1 } } 47 let rest: *u8 = ((url as i64) + rs) as *u8 48 let restlen: i64 = urllen - rs 49 let z: *i64 = sys_mmap(8); let r: *i64 = sys_mmap(8) 50 let pb: *u8 = sys_mmap(512); let tb: *u8 = sys_mmap(256) 51 return mr_resolve(reg, reglen, rest, restlen, z, r, pb, 512, tb, 256) 52} 53 54func main(argc: i64, argv: *i64) -> i64 { 55 gp("=== nx_hub_exceed_gate (MEASURED head-to-head; baseline failure = built-in negative control) ===\n" as *u8) 56 let reg: *u8 = sys_mmap(16384); var rn: i64 = 0 57 rn = g_row7(reg, rn, "tictactoe" as *u8, "production" as *u8, "public" as *u8, "tictactoe" as *u8, "Tic-Tac-Toe" as *u8, "10" as *u8, "1" as *u8) 58 rn = g_row7(reg, rn, "newgame" as *u8, "beta" as *u8, "public" as *u8, "newgame" as *u8, "New Game" as *u8, "11" as *u8, "1" as *u8) 59 rn = g_row7(reg, rn, "notes" as *u8, "hub" as *u8, "member" as *u8, "notes" as *u8, "Family Notes" as *u8, "13" as *u8, "1" as *u8) 60 rn = g_row7(reg, rn, "gallery" as *u8, "hub" as *u8, "operator" as *u8, "gallery" as *u8, "Gallery" as *u8, "14" as *u8, "1" as *u8) 61 rn = g_row7(reg, rn, "secret" as *u8, "private" as *u8, "operator" as *u8, "secret" as *u8, "Secret" as *u8, "15" as *u8, "1" as *u8) 62 let roles: *u8 = sys_mmap(2048); var roln: i64 = 0 63 var o2: i64 = g_app(roles, roln, "operator_h" as *u8); roles[o2] = 9 as u8; o2 = o2 + 1; o2 = g_app(roles, o2, "3" as *u8); roles[o2] = 10 as u8; o2 = o2 + 1; roln = o2 64 65 let tgt: *u8 = sys_mmap(512); let req: *i64 = sys_mmap(8); let grant: *i64 = sys_mmap(8) 66 let op: *u8 = "operator_h" as *u8 67 var dims_exceeded: i64 = 0 68 69 // ---- DIM-A: FAIL-CLOSED / NO-LEAK (gated artifacts probed at their PUBLIC ROOT urls) ---- 70 let g0: *u8 = "/notes" as *u8; let g1: *u8 = "/gallery" as *u8; let g2: *u8 = "/secret" as *u8 71 var leaks_mat: i64 = 0; var leaks_naive: i64 = 0 72 var a: i64 = 0 73 a = mr_route(reg, rn, roles, roln, g0, g_slen(g0), op, g_slen(op), tgt, 512, req, grant); if a == 1 { leaks_mat = leaks_mat + 1 } 74 a = mr_route(reg, rn, roles, roln, g1, g_slen(g1), op, g_slen(op), tgt, 512, req, grant); if a == 1 { leaks_mat = leaks_mat + 1 } 75 a = mr_route(reg, rn, roles, roln, g2, g_slen(g2), op, g_slen(op), tgt, 512, req, grant); if a == 1 { leaks_mat = leaks_mat + 1 } 76 if naive_serve(reg, rn, g0, g_slen(g0)) == 1 { leaks_naive = leaks_naive + 1 } 77 if naive_serve(reg, rn, g1, g_slen(g1)) == 1 { leaks_naive = leaks_naive + 1 } 78 if naive_serve(reg, rn, g2, g_slen(g2)) == 1 { leaks_naive = leaks_naive + 1 } 79 gp(" DIM-A no-leak: gated-artifacts-leaked maturity=" as *u8); gn(leaks_mat); gp(" naive=" as *u8); gn(leaks_naive); gp(" (of 3)\n" as *u8) 80 var dimA_ok: i64 = 0 81 if leaks_mat == 0 { if leaks_naive == 3 { dimA_ok = 1; dims_exceeded = dims_exceeded + 1 } } 82 83 // ---- DIM-B: ATOMIC ONE-FLAG PROMOTE (measure writes + reachability change) ---- 84 // before: /newgame at root -> MISMATCH (it lives in beta zone) 85 let nw: *u8 = "/newgame" as *u8 86 let before: i64 = mr_route(reg, rn, roles, roln, nw, g_slen(nw), "none" as *u8, 0, tgt, 512, req, grant) 87 var promote_writes: i64 = 0 88 rn = g_row7(reg, rn, "newgame" as *u8, "production" as *u8, "public" as *u8, "newgame" as *u8, "New Game" as *u8, "20" as *u8, "1" as *u8) 89 promote_writes = promote_writes + 1 90 let after: i64 = mr_route(reg, rn, roles, roln, nw, g_slen(nw), "none" as *u8, 0, tgt, 512, req, grant) 91 var reachable_changed: i64 = 0 92 if before != after { if after == 1 { reachable_changed = 1 } } 93 let naive_promote_steps: i64 = 3 94 gp(" DIM-B promote: maturity writes=" as *u8); gn(promote_writes); gp(" reachable_changed=" as *u8); gn(reachable_changed); gp(" atomic=1 | naive steps=" as *u8); gn(naive_promote_steps); gp(" atomic=0 (reference)\n" as *u8) 95 var dimB_ok: i64 = 0 96 if promote_writes == 1 { if reachable_changed == 1 { if promote_writes < naive_promote_steps { dimB_ok = 1; dims_exceeded = dims_exceeded + 1 } } } 97 98 // ---- DIM-C: SOVEREIGNTY (third-party services in the serving path) ---- 99 let tp_maturity: i64 = 0 // only nx_* organs (fa_appendz / slk_* / ag_*) -- by construction 100 let tp_saas: i64 = 3 // host SaaS + feature-flag SaaS + auth SaaS = 3 metadata sinks (reference) 101 gp(" DIM-C sovereignty: third-party-services maturity=" as *u8); gn(tp_maturity); gp(" saas-ref=" as *u8); gn(tp_saas); gp("\n" as *u8) 102 var dimC_ok: i64 = 0 103 if tp_maturity == 0 { if tp_saas > 0 { dimC_ok = 1; dims_exceeded = dims_exceeded + 1 } } 104 105 // ---- DIM-D: CONFIG-NOT-ROLLOUT (daemon restarts to apply a visibility change) ---- 106 let restarts_maturity: i64 = 0 // registry re-read live per request -> a flag edit needs 0 restarts 107 let restarts_naive: i64 = 1 // move files + restart proxy/daemon = >=1 restart (a crash-risk window) 108 gp(" DIM-D no-rollout: daemon-restarts-per-change maturity=" as *u8); gn(restarts_maturity); gp(" naive-ref=" as *u8); gn(restarts_naive); gp("\n" as *u8) 109 var dimD_ok: i64 = 0 110 if restarts_maturity == 0 { if restarts_naive > 0 { dimD_ok = 1; dims_exceeded = dims_exceeded + 1 } } 111 112 gp("HONEST SCOPE: exceed = sovereignty + fail-closed safety + atomic/reversible ops + cant-crash-hosting;\n" as *u8) 113 gp(" NOT parity vs mature CI/CD (A/B targeting, analytics, global edge CDN) -- those ABSENT.\n" as *u8) 114 gp("SCORECARD dims_exceeded=" as *u8); gn(dims_exceeded); gp("/4 (A=" as *u8); gn(dimA_ok); gp(" B=" as *u8); gn(dimB_ok); gp(" C=" as *u8); gn(dimC_ok); gp(" D=" as *u8); gn(dimD_ok); gp(")\n" as *u8) 115 116 // GREEN requires: we never leak AND the baseline DOES leak (discriminating measurement) AND all 4 dims exceed. 117 if leaks_mat == 0 { if leaks_naive == 3 { if dims_exceeded == 4 { gp("RESULT verdict=GREEN (MEASURED EXCEED on 4/4 axes; baseline failed the no-leak control)\n" as *u8); sys_exit(0); return 0 } } } 118 gp("RESULT verdict=RED\n" as *u8); sys_exit(1); return 1 119}