nx_job_launch_bound_gate.nx source

1// nx_job_launch_bound_gate.nx -- proves the widened async-launch bound before it ships into the 2// SHARED nx_job_run launcher. 3// 4// Two failure modes, opposite directions, both fatal, so both are teeth: 5// TOO TIGHT -> the widening does nothing and generators still need shell (T1-T4). 6// TOO LOOSE -> a daemon or a control-plane organ becomes async-launchable, which is the brick 7// (T5-T13). T13 is the one that matters most: nx_mgmt itself must be refused. 8// T14 is the back-compat tooth: every organ the OLD substring rule allowed must still be allowed, 9// because widening a shared launcher that quietly drops an existing caller is a regression wearing 10// a feature's clothes. 11// license_tier: ORIGINAL No hw writes (Rule 26). 12import "nx_job_launch_bound.nx" 13import "nx_gate_verdict.nx" 14 15func jb_allow(name: *u8) -> i64 { if jlb_denied(name) == 0 { return 1 } return 0 } 16func jb_deny(name: *u8) -> i64 { if jlb_denied(name) == 1 { return 1 } return 0 } 17 18func main(argc: i64, argv: *i64) -> i64 { 19 let ctr: *i64 = gv_ctr() 20 gv_head("nx_job_launch_bound -- generators launchable, daemons and control-plane organs never" as *u8) 21 22 gv_check("T1 a generator organ is launchable (nx_ecomat_domledger)" as *u8, jb_allow("nx_ecomat_domledger" as *u8), ctr) 23 gv_check("T2 a page emitter is launchable (nx_ecomat_page)" as *u8, jb_allow("nx_ecomat_page" as *u8), ctr) 24 gv_check("T3 a rollup is launchable (nx_ecosystem_maturity_rollup)" as *u8, jb_allow("nx_ecosystem_maturity_rollup" as *u8), ctr) 25 gv_check("T4 a census is launchable (nx_cap_census)" as *u8, jb_allow("nx_cap_census" as *u8), ctr) 26 27 gv_check("T5 a daemon is REFUSED (nx_office_daemon)" as *u8, jb_deny("nx_office_daemon" as *u8), ctr) 28 gv_check("T6 a server is REFUSED (nx_tools_api_serve)" as *u8, jb_deny("nx_tools_api_serve" as *u8), ctr) 29 gv_check("T7 the supervisor is REFUSED (nx_hostctl)" as *u8, jb_deny("nx_hostctl" as *u8), ctr) 30 gv_check("T8 a deployer is REFUSED (nx_deploy_stage)" as *u8, jb_deny("nx_deploy_stage" as *u8), ctr) 31 gv_check("T9 a promoter is REFUSED (nx_promote_toolchain)" as *u8, jb_deny("nx_promote_toolchain" as *u8), ctr) 32 gv_check("T10 a killer is REFUSED (nx_proc_kill)" as *u8, jb_deny("nx_proc_kill" as *u8), ctr) 33 gv_check("T11 an empty name is REFUSED (fail-closed)" as *u8, jb_deny("" as *u8), ctr) 34 gv_check("T12 the LLM server is REFUSED (nx_f32_llm_serve, never exits)" as *u8, jb_deny("nx_f32_llm_serve" as *u8), ctr) 35 gv_check("T13 the control plane itself is REFUSED (nx_mgmt)" as *u8, jb_deny("nx_mgmt" as *u8), ctr) 36 37 gv_check("T14 BACK-COMPAT the old rule's organs still pass (nx_sota_research_fetch)" as *u8, jb_allow("nx_sota_research_fetch" as *u8), ctr) 38 gv_check("T15 BACK-COMPAT sibling research_fetch organs still pass (nx_swebv_research_fetch)" as *u8, jb_allow("nx_swebv_research_fetch" as *u8), ctr) 39 40 // ---- T16-T19 SUBSTRING-COLLISION TEETH, added after self-review caught the first cut using a 41 // bare contains(). They pin BOTH directions at once, which is why they are worth their lines: 42 // T16/T17 -- "observe" contains "serve", "skill" contains "kill". Under contains() these are 43 // FALSE DENIES: legitimate generators shoved back onto the shell by the very lib 44 // meant to get them off it. 45 // T18/T19 -- the obvious repair (demand '_' both sides) then FALSE-ALLOWS "nx_server", since 46 // "serve" is followed by 'r'. A server escaping this bound is the brick. 47 // Segment-prefix is the only rule satisfying all four simultaneously. 48 gv_check("T16 COLLISION nx_observe_sites is ALLOWED (contains 'serve', does not start a segment)" as *u8, jb_allow("nx_observe_sites" as *u8), ctr) 49 gv_check("T17 COLLISION nx_skill_tree is ALLOWED (contains 'kill', does not start a segment)" as *u8, jb_allow("nx_skill_tree" as *u8), ctr) 50 gv_check("T18 COLLISION nx_server is still REFUSED (stem, so the -r variant cannot escape)" as *u8, jb_deny("nx_server" as *u8), ctr) 51 gv_check("T19 COLLISION nx_supervisor is still REFUSED (stem catches the -or variant)" as *u8, jb_deny("nx_supervisor" as *u8), ctr) 52 53 let rc: i64 = gv_verdict("JOB-LAUNCH-BOUND" as *u8, ctr, "deny-by-class: generators open, daemons and control plane closed, old callers preserved" as *u8) 54 sys_exit(rc) 55 return rc 56}