nx_inflate_gate.nx source

1// nx_inflate_gate.nx -- PROVE THE DECOMPRESSOR AGAINST AN INDEPENDENT IMPLEMENTATION. 2// 3// ★A ROUND-TRIP AGAINST OUR OWN COMPRESSOR WOULD VALIDATE ITS OWN BUGS. If nx_gzip and nx_inflate 4// shared a misreading of RFC 1951 they would agree perfectly and both be wrong -- the banked 5// "a round-trip equivalence gate cannot kill a symmetric mutant" law, applied to compression. So 6// the fixture below is a REAL gzip stream produced by an INDEPENDENT implementation (system gzip), 7// embedded byte-for-byte, together with the exact plaintext it must yield. Agreement here is 8// cross-implementation evidence, not self-consistency. 9// 10// The CRC32 tooth uses the PUBLISHED IEEE check value for "123456789" (0xCBF43926) -- a constant 11// from the standard itself, not a number we produced and then declared correct. 12// 13// NEGATIVE CONTROLS ARE THE POINT. A decompressor that silently truncates on corruption is worse 14// than one that is absent, because it hands you plausible partial data. Every wall is fired in-run. 15// license_tier: ORIGINAL No hw writes (Rule 26). 16import "nx_syscalls.nx" 17import "nx_gate_verdict.nx" 18import "nx_inflate.nx" 19 20// gzip stream from system gzip -1 of "hello hello hello hello world world world" (41 bytes) 21const IG_N: i64 = 46 22func ig_fixture() -> *u8 { 23 let b: *u8 = sys_mmap(64) 24 b[0]=0x1f as u8; b[1]=0x8b as u8; b[2]=0x08 as u8; b[3]=0x08 as u8 25 b[4]=0x2d as u8; b[5]=0x7e as u8; b[6]=0x71 as u8; b[7]=0x6a as u8 26 b[8]=0x04 as u8; b[9]=0x03 as u8 27 b[10]=0x73 as u8; b[11]=0x6d as u8; b[12]=0x61 as u8; b[13]=0x6c as u8 28 b[14]=0x6c as u8; b[15]=0x2e as u8; b[16]=0x74 as u8; b[17]=0x78 as u8 29 b[18]=0x74 as u8; b[19]=0x00 as u8 30 b[20]=0xcb as u8; b[21]=0x48 as u8; b[22]=0xcd as u8; b[23]=0xc9 as u8 31 b[24]=0xc9 as u8; b[25]=0x57 as u8; b[26]=0xc8 as u8; b[27]=0xc0 as u8 32 b[28]=0x20 as u8; b[29]=0xcb as u8; b[30]=0xf3 as u8; b[31]=0x8b as u8 33 b[32]=0x72 as u8; b[33]=0x52 as u8; b[34]=0x14 as u8; b[35]=0x90 as u8 34 b[36]=0x48 as u8; b[37]=0x00 as u8; b[38]=0x31 as u8; b[39]=0xbd as u8 35 b[40]=0xf1 as u8; b[41]=0x19 as u8; b[42]=0x29 as u8; b[43]=0x00 as u8 36 b[44]=0x00 as u8; b[45]=0x00 as u8 37 return b 38} 39func ig_expect() -> *u8 { return "hello hello hello hello world world world" as *u8 } 40 41func main(argc: i64, argv: *i64) -> i64 { 42 let ctr: *i64 = gv_ctr() 43 gv_head("nx_inflate_gate -- sovereign DEFLATE proven against an independent implementation" as *u8) 44 let out: *u8 = sys_mmap(65536) 45 46 // T1 -- the cross-implementation tooth 47 let src: *u8 = ig_fixture() 48 let n: i64 = inf_gunzip(src, IG_N, out, 65536) 49 var t1: i64 = 0 50 if n == 41 { 51 t1 = 1 52 let want: *u8 = ig_expect() 53 var i: i64 = 0 54 while i < 41 { if out[i] != want[i] { t1 = 0 } i = i + 1 } 55 } 56 gv_puts(" gunzip returned " as *u8); gv_num(n); gv_puts(" bytes (expect 41)\n" as *u8) 57 gv_check("T1 CROSS-IMPLEMENTATION: a gzip stream produced by an INDEPENDENT compressor decodes byte-for-byte to its exact plaintext -- agreement that a self-round-trip could never establish" as *u8, t1, ctr) 58 59 // T2 -- published standard constant, not one of ours 60 let kat: *u8 = "123456789" as *u8 61 let c: i64 = inf_crc32(kat, 9) 62 gv_puts(" CRC32(123456789)=" as *u8); gv_num(c); gv_puts(" (published 0xCBF43926=3421780262)\n" as *u8) 63 gv_check("T2 CRC32 MATCHES THE PUBLISHED CHECK VALUE: the integrity primitive is verified against the standard's own constant, so gzip corruption detection rests on the spec rather than on our arithmetic" as *u8, (c == 3421780262) as i64, ctr) 64 65 // T3 -- corruption must be REFUSED, never quietly truncated. This is the whole reason the 66 // container check exists: a decompressor that returns plausible partial data on a corrupt 67 // stream poisons everything downstream (our own search index, once). 68 let bad: *u8 = sys_mmap(64) 69 var k: i64 = 0 70 while k < IG_N { bad[k] = src[k]; k = k + 1 } 71 bad[25] = (((bad[25] as i64) ^ 0xFF) & 0xff) as u8 72 let r3: i64 = inf_gunzip(bad, IG_N, out, 65536) 73 gv_puts(" corrupted payload -> rc=" as *u8); gv_num(r3); gv_puts("\n" as *u8) 74 gv_check("T3 CORRUPTION IS REFUSED, NOT TRUNCATED: flipping a payload byte yields a negative error instead of plausible partial output -- silent truncation is the failure mode that poisoned an index before" as *u8, (r3 < 0) as i64, ctr) 75 76 // T4 -- capacity wall: untrusted input cannot write past the buffer 77 let r4: i64 = inf_gunzip(src, IG_N, out, 8) 78 gv_puts(" 8-byte capacity -> rc=" as *u8); gv_num(r4); gv_puts("\n" as *u8) 79 gv_check("T4 OUTPUT CAPACITY IS ENFORCED: a stream that expands past the caller's buffer is refused with the capacity code rather than overflowing it -- the property the pre-existing authored inflate did not have" as *u8, (r4 == 0 - 1) as i64, ctr) 80 81 // T5 -- truncated input 82 let r5: i64 = inf_gunzip(src, 30, out, 65536) 83 gv_check("T5 A TRUNCATED STREAM IS REFUSED: cutting the input short returns an error instead of whatever happened to decode first" as *u8, (r5 < 0) as i64, ctr) 84 85 // T6 -- container discrimination 86 let notgz: *u8 = "this is not a gzip file at all" as *u8 87 let r6: i64 = inf_gunzip(notgz, 30, out, 65536) 88 gv_check("T6 A NON-GZIP INPUT IS REFUSED BY MAGIC: the container is identified by its own bytes, so a mislabelled file cannot be fed to the deflate decoder" as *u8, (r6 == 0 - 7) as i64, ctr) 89 90 // T7 -- the reasons stay distinct, so a caller can act on WHICH failure occurred 91 var t7: i64 = 0 92 if r4 != r6 { if r3 != r4 { t7 = 1 } } 93 gv_check("T7 FAILURES ARE DISTINGUISHABLE: capacity, corruption and wrong-container return different codes, so a caller can retry, refuse, or resize instead of guessing" as *u8, t7, ctr) 94 95 return gv_verdict("INFLATE-GATE" as *u8, ctr, "DEFLATE/gzip decode proven cross-implementation with every failure wall fired in-run" as *u8) 96}