nx_jsemit_gate.nx source

1// nx_jsemit_gate.nx -- THE EMITTED PAGE'S JAVASCRIPT MUST LEX BEFORE IT REACHES A BROWSER. 2// 3// WHY THIS EXISTS. 2026-08-25 an edit to nx_game_page_emit's emitted guard went through build -> 4// promote -> ship lane -> live docroot and took /world/beach and /world/craft to a BLACK SCREEN. 5// Every gate in that chain was GREEN: the organ compiled, the wasm-vm gate passed with a PAINTS 6// tooth, and the ship lane read the page back and verified its marker. NOT ONE OF THEM LOOKED AT 7// THE JAVASCRIPT. The estate emits ~410 KB of it per page, and one stray brace or unterminated 8// string takes the entire script down -- at which point even the software-renderer FALLBACK never 9// runs, which is the difference between a page that looks wrong and a page that shows nothing. 10// ★A PIPELINE THAT VERIFIES EVERY STAGE EXCEPT THE ARTIFACT'S OWN LANGUAGE IS GREEN ALL THE WAY TO 11// THE OUTAGE. 12// 13// THE SUBJECT IS THE SHIPPED FILE, not a fixture: it reads the live docroot page directly, on the 14// NAS, with sys_read_file -- which sizes its buffer from the file and cannot short-read. Every 15// attempt to inspect this page through the MCP transport during the incident CORRUPTED IT (a 16// windowed read injects a marker every 160 KB and one lands inside the base64 wasm blob), so a 17// checker that read it that way would report faults that exist only in the capture. 18// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0 19import "nx_syscalls.nx" 20import "nx_jsbalance.nx" 21import "nx_gate_verdict.nx" 22 23const JE_PAGE: *u8 = "sites/nishifamily/world/beach.html" 24// A real emitted page is hundreds of KB. Anything far below that is a truncated or empty read, and 25// a lexer that says "balanced" about 12 bytes is the gate-passes-on-the-empty-set defect. 26const JE_MIN_SCRIPT: i64 = 100000 27 28// DERIVE the length, never hand-count it beside the literal. The first cut of this gate passed 23 29// for a 24-byte fixture and truncated its own closing brace, so T1 "failed" on well-formed input -- 30// the hand-counted-length defect, in the gate written to prevent a shipping defect. 31func je_len(s: *u8) -> i64 { 32 var n: i64 = 0 33 while (s[n] & 255) != 0 { n = n + 1 } 34 return n 35} 36 37func je_ck(src: *u8, out: *i64) -> i64 { return jsb_check(src, je_len(src), out) } 38 39func je_codename(rc: i64) -> *u8 { 40 if rc == JSB_OK { return "OK" as *u8 } 41 if rc == JSB_UNTERM_STR { return "UNTERMINATED-STRING" as *u8 } 42 if rc == JSB_UNTERM_CMT { return "UNTERMINATED-BLOCK-COMMENT" as *u8 } 43 if rc == JSB_NEGATIVE { return "CLOSE-BEFORE-OPEN" as *u8 } 44 if rc == JSB_DEPTH { return "UNBALANCED-DEPTH" as *u8 } 45 if rc == JSB_NO_SCRIPT { return "NO-SCRIPT-ELEMENT" as *u8 } 46 return "UNKNOWN" as *u8 47} 48 49func main() -> i64 { 50 let ctr: *i64 = gv_ctr() 51 gv_head("nx_jsemit_gate -- the emitted page's JavaScript lexes, and the checker is bite-proven" as *u8) 52 53 let out: *i64 = sys_mmap(JSB_O_N*8) as *i64 54 55 // ---- the CONTROLS run FIRST, on planted fixtures, because a checker that has only ever seen 56 // good input has not been shown to detect anything, and its GREEN on the real page would then 57 // mean nothing at all. 58 var t1: i64 = 0 59 if je_ck("function f(){ return 1 }" as *u8, out) == JSB_OK { t1 = 1 } 60 gv_check("T1 the checker ACCEPTS well-formed JavaScript" as *u8, t1, ctr) 61 62 // THE LOAD-BEARING CONTROL. A brace inside a STRING must not be counted -- that is precisely 63 // what separates a lexer from a naive character count, and the emitted page is full of braces 64 // inside string literals. If this fails the checker would refuse every page ever emitted. 65 var t2: i64 = 0 66 if je_ck("var s=\"}}}}\"; function f(){ return s }" as *u8, out) == JSB_OK { t2 = 1 } 67 gv_check("T2 BRACES INSIDE A STRING ARE NOT COUNTED -- a lexer, not a character tally" as *u8, t2, ctr) 68 69 // ...and an ESCAPED quote must not end the string, or every "\"" in the page shifts the state. 70 var t3: i64 = 0 71 if je_ck("var s=\"a\\\"}\"; f(){}" as *u8, out) == JSB_OK { t3 = 1 } 72 gv_check("T3 AN ESCAPED QUOTE does not end the string, so a quoted brace stays uncounted" as *u8, t3, ctr) 73 74 // neg-controls: each fault must be detected AND NAMED as itself. A single generic failure code 75 // sends the next reader to the wrong place -- the exact cost this gate exists to avoid. 76 var t4: i64 = 0 77 if je_ck("var s=\"never closed; f(){}" as *u8, out) == JSB_UNTERM_STR { t4 = 1 } 78 gv_check("neg-control-an-UNTERMINATED-STRING-is-detected-and-named-as-one" as *u8, t4, ctr) 79 80 var t5: i64 = 0 81 if je_ck("function f(){ return 1 }}" as *u8, out) == JSB_NEGATIVE { t5 = 1 } 82 gv_check("neg-control-a-CLOSE-BEFORE-OPEN-is-detected-and-named-as-one" as *u8, t5, ctr) 83 84 var t6: i64 = 0 85 if je_ck("function f(){ return 1 " as *u8, out) == JSB_DEPTH { t6 = 1 } 86 gv_check("neg-control-an-UNCLOSED-BRACE-is-detected-and-named-as-one" as *u8, t6, ctr) 87 88 var t7: i64 = 0 89 if je_ck("/* never closed f(){}" as *u8, out) == JSB_UNTERM_CMT { t7 = 1 } 90 gv_check("neg-control-an-UNTERMINATED-BLOCK-COMMENT-is-detected-and-named-as-one" as *u8, t7, ctr) 91 92 // ...and a // comment must NOT swallow the rest of the file, which is what happens when a 93 // comment is emitted into JS whose newlines did not survive the string literal that carried it. 94 var t8: i64 = 0 95 if je_ck("// note }}}\nfunction f(){ return 1 }" as *u8, out) == JSB_OK { t8 = 1 } 96 gv_check("T8 a LINE COMMENT ends at its newline and does not swallow the code after it" as *u8, t8, ctr) 97 98 // ---- THE SUBJECT: the actually-shipped page ------------------------------------------------ 99 // sys_read_file sizes its buffer from the file itself (lseek END) and cannot short-read, which 100 // is exactly why the subject is read HERE on the NAS rather than pulled through the transport. 101 let plenp: *i64 = sys_mmap(8) as *i64 102 plenp[0] = 0 103 let page: *u8 = sys_read_file(JE_PAGE, plenp) 104 let plen: i64 = plenp[0] 105 gv_puts(" subject="); gv_puts(JE_PAGE) 106 gv_puts(" bytes="); gv_num(plen); gv_puts("\n" as *u8) 107 108 var t9: i64 = 0 109 if plen > JE_MIN_SCRIPT { t9 = 1 } 110 gv_check("T9 THE SHIPPED PAGE WAS READ and is a real page, not an empty or truncated read" as *u8, t9, ctr) 111 112 var rc: i64 = JSB_NO_SCRIPT 113 if t9 == 1 { rc = jsb_check_page(page, plen, out) } 114 gv_puts(" verdict="); gv_puts(je_codename(rc)) 115 gv_puts(" brace="); gv_num(out[JSB_O_BRACE]) 116 gv_puts(" paren="); gv_num(out[JSB_O_PAREN]) 117 gv_puts(" brack="); gv_num(out[JSB_O_BRACK]) 118 gv_puts(" state="); gv_num(out[JSB_O_STATE]) 119 gv_puts(" scanned="); gv_num(out[JSB_O_SCAN]); gv_puts("\n" as *u8) 120 121 var t10: i64 = 0 122 if rc == JSB_OK { t10 = 1 } 123 gv_check("T10 THE SHIPPED PAGE'S SCRIPT LEXES: balanced, no unterminated string or comment" as *u8, t10, ctr) 124 125 // The script body must be the BULK of the page. A <script> that scanned a few hundred bytes 126 // would mean the element was found but the body was not, and T10 would be green about nothing. 127 var t11: i64 = 0 128 if out[JSB_O_SCAN] > JE_MIN_SCRIPT { t11 = 1 } 129 gv_check("T11 the scanned SCRIPT BODY is the bulk of the page, so T10 judged the real code" as *u8, t11, ctr) 130 131 return gv_verdict("JS-EMIT" as *u8, ctr, 132 "the shipped page's JavaScript lexes, and the checker is proven to detect each fault by name" as *u8) 133}