code wiki / _hdl_build / nx_langintel_trustfence.nx
nx_langintel_trustfence.nx source
↩ module page · 39 lines · 1727 B
1// nx_langintel_trustfence.nx -- LangIntel LI9 fence CLI. Now a THIN wrapper over nx_trustfence_lib
2// (ltg_classify_code + ltg_reason/ltg_fix) = the OO consolidation: the classifier is shared with the CI
3// fixture gate, this file is just I/O + structured refusal. Read-only external, NO exec (Rule 26).
4// license_tier: ORIGINAL
5import "nx_trustfence_lib.nx"
6import "nx_ingest_base.nx"
7import "nx_syscalls.nx"
8
9const LTG_FCAP: i64 = 4194304
10
11func main(argc: i64, argv: *i64) -> i64 {
12 if argc < 3 {
13 ib_refuse("TRUSTFENCE" as *u8, "usage" as *u8, "nx_langintel_trustfence <pr-json-file> <canonical-owner/repo>" as *u8)
14 return 2
15 }
16 let path: *u8 = argv[1] as *u8
17 let expect: *u8 = argv[2] as *u8
18 let buf: *u8 = sys_mmap(LTG_FCAP)
19 let n: i64 = ib_read(path, buf, LTG_FCAP)
20 if n <= 0 {
21 ib_refuse("TRUSTFENCE" as *u8, "pr-json-unreadable" as *u8, "run nx_ghfetch <pr-api-url> <file> first, then pass that file path" as *u8)
22 return 2
23 }
24 let msha: *u8 = sys_mmap(LTG_VCAP)
25 let bfull: *u8 = sys_mmap(LTG_VCAP)
26 let bref: *u8 = sys_mmap(LTG_VCAP)
27 let bdef: *u8 = sys_mmap(LTG_VCAP)
28 let code: i64 = ltg_classify_code(buf, n, expect, msha, bfull, bref, bdef)
29 if ltg_is_accept(code) == 1 {
30 ib_wr(1, "TRUSTFENCE verdict=GREEN tier=1 merged=1 msha=" as *u8); ib_wr(1, msha)
31 ib_wr(1, " canonical_repo=" as *u8); ib_wr(1, bfull)
32 ib_wr(1, " base_ref=" as *u8); ib_wr(1, bref)
33 ib_wr(1, " default_branch=" as *u8); ib_wr(1, bdef)
34 ib_wr(1, " => ACCEPT as answer-key candidate (POST fence still required)\n" as *u8)
35 return 0
36 }
37 ib_refuse("TRUSTFENCE" as *u8, ltg_reason(code), ltg_fix(code))
38 return 3
39}