nx_ingest_admit_gate.nx source
↩ module page · 75 lines · 4270 B
1// nx_ingest_admit_gate.nx -- GATE for nx_ingest_admit (/compare/mediaingest R2, ig_disk_floor). No filesystem is
2// touched: the decision is PURE (ig_decide), so every one of the three states is proven with planted numbers, and
3// the conf/statfs I/O wrapper is exercised once against the real vault root only to confirm it returns a valid
4// verdict and fills both out numbers. license_tier: ORIGINAL
5import "nx_syscalls.nx"
6import "nx_ingest_admit.nx"
7import "nx_gate_verdict.nx"
8
9const G_FLOOR: i64 = 5368709120 // 5 GiB fixture floor (= IG_DEFAULT_FLOOR_BYTES; the policy is what is under test, not the number)
10const G_ABOVE: i64 = 6000000000 // just over the floor -> ADMIT
11const G_BELOW: i64 = 1000000000 // 1 GB, under the floor -> REFUSE_FULL
12const G_AT: i64 = 5368709120 // exactly at the floor -> ADMIT (the boundary is inclusive: >= floor admits)
13const G_STATFS_ERR: i64 = 0 - 1 // what sys_fs_avail_bytes returns when statfs fails
14const G_VAULT_ROOT: *u8 = "/volume1/homes/elderwesto/vaultfs"
15
16// full-string equality: 1 if a and b are the same NUL-terminated bytes, else 0.
17func g_streq(a: *u8, b: *u8) -> i64 {
18 var i: i64 = 0
19 while a[i] != (0 as u8) {
20 if a[i] != b[i] { return 0 }
21 i = i + 1
22 }
23 if b[i] == (0 as u8) { return 1 }
24 return 0
25}
26
27func main() -> i64 {
28 gv_head("=== nx_ingest_admit_gate -- disk-floor admission (mediaingest R2) ===" as *u8)
29 let c: *i64 = gv_ctr()
30
31 // ---- pure policy: all three states, planted numbers ----
32 var a1: i64 = 0
33 if ig_decide(G_ABOVE, G_FLOOR) == IG_ADMIT { a1 = 1 }
34 gv_check("free-above-floor-admits" as *u8, a1, c)
35 var a2: i64 = 0
36 if ig_decide(G_AT, G_FLOOR) == IG_ADMIT { a2 = 1 }
37 gv_check("free-exactly-at-floor-admits-boundary-inclusive" as *u8, a2, c)
38 var r1: i64 = 0
39 if ig_decide(G_BELOW, G_FLOOR) == IG_REFUSE_FULL { r1 = 1 }
40 gv_check("free-below-floor-refuses" as *u8, r1, c)
41 var u1: i64 = 0
42 if ig_decide(G_STATFS_ERR, G_FLOOR) == IG_UNMEASURABLE { u1 = 1 }
43 gv_check("statfs-error-is-unmeasurable-not-admit" as *u8, u1, c)
44
45 // ---- neg-control: UNMEASURABLE must NOT be the same verdict as a healthy ADMIT (the fail-closed property) ----
46 var nc: i64 = 0
47 if ig_decide(G_STATFS_ERR, G_FLOOR) != ig_decide(G_ABOVE, G_FLOOR) { nc = 1 }
48 gv_check("neg-control-unmeasurable-differs-from-admit" as *u8, nc, c)
49
50 // ---- verdict strings are distinct (a refusal that reads like an admit is a silent pass). The two REFUSE
51 // strings both begin 'R', so a first-byte check is WRONG (it was, on this gate's first run); compare the
52 // whole strings by length AND content -- the three lengths are 5 / 23 / 24, all distinct. ----
53 let va: *u8 = ig_verdict_str(IG_ADMIT)
54 let vf: *u8 = ig_verdict_str(IG_REFUSE_FULL)
55 let vu: *u8 = ig_verdict_str(IG_UNMEASURABLE)
56 var s1: i64 = 0
57 if g_streq(va, vf) == 0 { if g_streq(vf, vu) == 0 { if g_streq(va, vu) == 0 { s1 = 1 } } }
58 gv_check("verdict-strings-distinct-per-state" as *u8, s1, c)
59
60 // ---- the live I/O wrapper returns a real verdict and fills BOTH numbers on the real vault root ----
61 let oa: *i64 = sys_mmap(16) as *i64
62 let of: *i64 = sys_mmap(16) as *i64
63 oa[0] = 0
64 of[0] = 0
65 let live: i64 = ig_disk_floor(G_VAULT_ROOT, oa, of)
66 var lv: i64 = 0
67 if live >= IG_ADMIT { if live <= IG_UNMEASURABLE { lv = 1 } }
68 gv_check("live-wrapper-returns-a-valid-3state-verdict" as *u8, lv, c)
69 var lf: i64 = 0
70 if of[0] > 0 { lf = 1 } // the floor is always a positive number (conf or default)
71 gv_check("live-wrapper-fills-the-floor-for-the-announcement" as *u8, lf, c)
72 gv_puts(" REPORT vault root avail=" as *u8); gv_num(oa[0]); gv_puts(" floor=" as *u8); gv_num(of[0]); gv_puts(" verdict=" as *u8); gv_puts(ig_verdict_str(live)); gv_puts("\n" as *u8)
73
74 return gv_verdict("nx_ingest_admit_gate" as *u8, c, "ig_decide is pure so all three states are planted-number proofs; the live wrapper is exercised once against the real vault root only to confirm it returns a valid verdict and fills both announce numbers -- it asserts nothing about the current free space, which is not the subject" as *u8)
75}