nx_jobfollow_parse_gate.nx source
↩ module page · 110 lines · 8357 B
1// nx_jobfollow_parse_gate.nx -- THE GATE FOR THE JOB-POINTER PARSE, 2026-09-04.
2//
3// SUBJECT: jf_job_id / jf_artifact_ready / jf_json_safe, in-process, pure.
4//
5// THE DEFECT THIS EXISTS TO MAKE IMPOSSIBLE COST ELEVEN DAYS AND WAS INVISIBLE TO EVERY OTHER TEST.
6// The tools edge may answer any call with `JOB-STARTED id=<n>` instead of the organ's receipt. A client
7// scanning for a bare `id=` reads the JOB id as the ORGAN's id and reports a receipt that never existed.
8// MEASURED: nx_content_put_client printed `CP-BEGIN id=1788537161 chunk_raw= nchunks=` while the real
9// receipt in the job artifact was `CP-BEGIN id=1788537161795845 ... chunk_raw=48402 nchunks=1`. Both ids
10// are epoch-derived, so the wrong one is a plausible PREFIX of the right one -- which is exactly why it
11// was printed as a fact rather than questioned. The organ had never completed a single transfer.
12//
13// THE LOAD-BEARING TOOTH IS THE NEGATIVE ONE. Any implementation returns the right answer on a real job
14// pointer; the defect lives entirely in what happens to a receipt that merely CONTAINS an id. So the
15// tooth that matters asserts jf_job_id REFUSES a bare `id=`, and a gate without it would go green on the
16// very code that shipped broken.
17//
18// PURE BY CONSTRUCTION, WHICH IS WHY THE PARSE WAS SPLIT OUT AT ALL. nx_jobfollow_parse imports only
19// nx_syscalls, so this gate opens no socket -- on the nx_https_post_lib_gate precedent, a gate that needs
20// the network goes RED for someone else's outage and its RED then indicts this code.
21//
22// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
23import "nx_syscalls.nx"
24import "nx_gate_verdict.nx"
25import "nx_jobfollow_parse.nx"
26
27const JPG_BUF: i64 = 512
28
29// Copy a literal into a fresh buffer and return its length, so each tooth gets an independent subject
30// rather than sharing one that a previous tooth may have mutated.
31func jpg_lit(s: *u8, out: *u8) -> i64 {
32 var n: i64 = 0
33 while s[n] != (0 as u8) { out[n] = s[n]; n = n + 1 }
34 return n
35}
36
37func main() -> i64 {
38 let ctr: *i64 = gv_ctr()
39 let b: *u8 = sys_mmap(JPG_BUF)
40
41 // ---- jf_job_id: the anchored parse ----
42 var n: i64 = jpg_lit("JOB-STARTED id=1788537161 tool=nx_mgmt poll: _jobs/job_<id>.out" as *u8, b)
43 gv_check_eq("a-real-job-pointer-yields-its-id" as *u8, jf_job_id(b, n), 1788537161, ctr)
44
45 // THE TOOTH THAT MATTERS. This is the shape that shipped broken for eleven days.
46 n = jpg_lit("CP-BEGIN id=1788537161795845 dest=x total=12083 chunk_raw=48402 nchunks=1" as *u8, b)
47 gv_check_eq("neg-control-a-RECEIPT-carrying-a-bare-id-is-NOT-a-job-pointer (the unanchored scan read this id as the organ's own and reported a receipt that never existed)" as *u8,
48 jf_job_id(b, n), 0 - 1, ctr)
49
50 // A JSON envelope always carries \x22id\x22:1 -- an unanchored digit scan would find it.
51 n = jpg_lit("{\x22jsonrpc\x22:\x222.0\x22,\x22id\x22:1,\x22result\x22:{}}" as *u8, b)
52 gv_check_eq("neg-control-a-JSON-RPC-envelope-id-field-is-NOT-a-job-pointer" as *u8,
53 jf_job_id(b, n), 0 - 1, ctr)
54
55 gv_check_eq("neg-control-an-EMPTY-buffer-yields-no-job-id" as *u8, jf_job_id(b, 0), 0 - 1, ctr)
56
57 // A pointer with no digits after the anchor must refuse rather than return a fabricated zero.
58 n = jpg_lit("JOB-STARTED id=" as *u8, b)
59 gv_check_eq("neg-control-an-anchor-with-NO-digits-refuses-rather-than-returning-zero (a fabricated 0 would poll _jobs/job_0.out forever)" as *u8,
60 jf_job_id(b, n), 0 - 1, ctr)
61
62 // ---- jf_artifact_ready: readiness is the ABSENCE of the two not-yet answers ----
63 n = jpg_lit("NX-FS ABSENT: _jobs/job_1.out" as *u8, b)
64 gv_check_eq("an-ABSENT-artifact-is-NOT-ready" as *u8, jf_artifact_ready(b, n), 0, ctr)
65 n = jpg_lit("NX-FS EMPTY: _jobs/job_1.out" as *u8, b)
66 gv_check_eq("an-EMPTY-artifact-is-NOT-ready (the job is still writing; treating it as ready would return a truncated receipt)" as *u8,
67 jf_artifact_ready(b, n), 0, ctr)
68 n = jpg_lit("NX-FS DENIED: capability" as *u8, b)
69 gv_check_eq("a-DENIED-read-is-its-OWN-state-not-merely-not-ready (polling on would burn the whole budget against a permission error)" as *u8,
70 jf_artifact_ready(b, n), 0 - 1, ctr)
71 n = jpg_lit("CP-BEGIN id=1788537161795845 chunk_raw=48402 nchunks=1" as *u8, b)
72 gv_check_eq("a-real-receipt-IS-ready" as *u8, jf_artifact_ready(b, n), 1, ctr)
73 gv_check_eq("a-zero-length-read-is-NOT-ready" as *u8, jf_artifact_ready(b, 0), 0, ctr)
74
75 // ---- jf_json_safe: refuse rather than escape ----
76 n = jpg_lit("nx_fs~1791132178~904.lMtg_-vGzIjkRwYNo9oIgqjTbemNBNGsQ52mKqrQK7k" as *u8, b)
77 gv_check_eq("POSITIVE-CONTROL-a-real-capability-token-is-accepted (without this the refusal teeth below pass on a checker that refuses everything)" as *u8,
78 jf_json_safe(b, n), 1, ctr)
79 n = jpg_lit("has a \x22quote" as *u8, b)
80 gv_check_eq("neg-control-a-QUOTE-is-refused-not-escaped" as *u8, jf_json_safe(b, n), 0, ctr)
81 b[0] = 9 as u8
82 gv_check_eq("neg-control-a-CONTROL-byte-is-refused" as *u8, jf_json_safe(b, 1), 0, ctr)
83 b[0] = 127 as u8
84 gv_check_eq("neg-control-DEL-is-refused" as *u8, jf_json_safe(b, 1), 0, ctr)
85
86 // ---- the keyed re-issue (dataio DI4, client half): replay pointer, outcome-unknown shape, keyed decision ----
87 n = jpg_lit("NX-IDEM REPLAY key=promote-x-20260905 first_outcome=lane=async tool=nx_mgmt job=1788650197 -- this key was already applied" as *u8, b)
88 gv_check_eq("a-transport-REPLAY-names-the-first-execution's-job-and-parses-as-the-pointer" as *u8, jf_job_id(b, n), 1788650197, ctr)
89 n = jpg_lit("NX-IDEM REPLAY key=k first_outcome=lane=sync tool=nx_fs exit=0 bytes=12 out=_jobs/idem_ab.out" as *u8, b)
90 gv_check_eq("neg-control-a-REPLAY-of-a-SYNC-outcome-carries-no-job-and-yields-no-pointer" as *u8, jf_job_id(b, n), 0 - 1, ctr)
91 n = jpg_lit("{\x22type\x22:\x22about:blank\x22,\x22title\x22:\x22Outcome Unknown\x22,\x22status\x22:503,\x22stage\x22:\x22read-after-accept\x22,\x22retry\x22:\x22unsafe\x22}" as *u8, b)
92 gv_check_eq("the-edge's-outcome-unknown-envelope-is-recognised-by-its-stage-field" as *u8, jf_outcome_unknown(b, n), 1, ctr)
93 let rq: *u8 = sys_mmap(512)
94 let rqn: i64 = jpg_lit("{\x22jsonrpc\x22:\x222.0\x22,\x22params\x22:{\x22name\x22:\x22nx_content_put\x22,\x22arguments\x22:{\x22argv\x22:[\x22begin\x22],\x22_idem\x22:\x22cpc-begin-1\x22}}}" as *u8, rq)
95 let ru: *u8 = sys_mmap(512)
96 let run: i64 = jpg_lit("{\x22jsonrpc\x22:\x222.0\x22,\x22params\x22:{\x22name\x22:\x22nx_content_put\x22,\x22arguments\x22:{\x22argv\x22:[\x22begin\x22]}}}" as *u8, ru)
97 gv_check_eq("a-KEYED-request-with-an-outcome-unknown-reply-IS-re-issued (the transport replays by construction)" as *u8, jf_should_reissue(b, n, rq, rqn), 1, ctr)
98 gv_check_eq("neg-control-an-UNKEYED-request-with-the-same-reply-is-NEVER-re-issued (a blind retry double-applies a write)" as *u8, jf_should_reissue(b, n, ru, run), 0, ctr)
99 n = jpg_lit("NX-IDEM IN-FLIGHT key=cpc-begin-1 -- the first execution is still running" as *u8, b)
100 gv_check_eq("a-KEYED-request-answered-INFLIGHT-asks-again-after-one-interval" as *u8, jf_should_reissue(b, n, rq, rqn), 1, ctr)
101 n = jpg_lit("CP-BEGIN id=1788650710547915 dest=x total=43709 chunk_raw=48402 nchunks=1" as *u8, b)
102 gv_check_eq("neg-control-a-real-receipt-to-a-keyed-request-is-NOT-re-issued" as *u8, jf_should_reissue(b, n, rq, rqn), 0, ctr)
103 gv_check_eq("an-EMPTY-reply-to-a-KEYED-request-IS-re-issued (no reply is the same uncertainty as outcome-unknown; the key makes the re-post safe)" as *u8, jf_should_reissue(b, 0, rq, rqn), 1, ctr)
104 gv_check_eq("neg-control-an-EMPTY-reply-to-an-UNKEYED-request-is-NOT-re-issued (without a key a re-post can double-apply)" as *u8, jf_should_reissue(b, 0, ru, run), 0, ctr)
105
106 gv_kv("job_id_of_real_pointer", 1788537161)
107 gv_kv("job_id_of_bare_receipt", jf_job_id(b, jpg_lit("CP-BEGIN id=9 x" as *u8, b)))
108 gv_kv("ready_on_absent", jf_artifact_ready(b, jpg_lit("NX-FS ABSENT: x" as *u8, b)))
109 return gv_verdict("jobfollow_parse" as *u8, ctr, "the job-pointer parse is ANCHORED on the whole report token so a receipt carrying an id is never mistaken for a pointer, readiness distinguishes not-yet from denied, and the capability check refuses rather than escapes" as *u8)
110}