code wiki / _hdl_build / nx_langintel_trustfence_gate.nx
`nx_langintel_trustfence_gate.nx` source

1// nx_langintel_trustfence_gate.nx -- LangIntel LI9 WARDEN CI fixture: re-proves the trust fence each run.
2// Self-contained inline fixtures, each carrying its EXPECTED sealed verdict (per the ecosystem law: a neg
3// control must assert the synthesized OUTCOME, never call 'the old code' which rots when fixed). Runs the
4// SHARED ltg_classify_code from nx_trustfence_lib -- so this gate proves the exact classifier the CLI uses.
5// Fixture A permanently guards the master->main rename regression I found on rust-lang/rust#50000.
6// exit 0 = all GREEN, 1 = any FAIL. Read-only, NO exec (Rule 26). license_tier: ORIGINAL
7import "nx_trustfence_lib.nx"
8import "nx_ingest_base.nx"
9import "nx_syscalls.nx"
10
11const LTGATE_EXPECT: *u8 = "rust-lang/rust"
12
13func ltgate_case(js: *u8, expect_code: i64, label: *u8, counters: *i64) -> i64 {
14    let n: i64 = ib_slen(js)
15    let msha: *u8 = sys_mmap(LTG_VCAP)
16    let bfull: *u8 = sys_mmap(LTG_VCAP)
17    let bref: *u8 = sys_mmap(LTG_VCAP)
18    let bdef: *u8 = sys_mmap(LTG_VCAP)
19    let got: i64 = ltg_classify_code(js, n, LTGATE_EXPECT, msha, bfull, bref, bdef)
20    if got == expect_code {
21        counters[0] = counters[0] + 1
22        ib_wr(1, "  PASS " as *u8); ib_wr(1, label); ib_wr(1, " (code=" as *u8); ib_wn(1, got); ib_wr(1, ")\n" as *u8)
23    } else {
24        counters[1] = counters[1] + 1
25        ib_wr(1, "  FAIL " as *u8); ib_wr(1, label); ib_wr(1, " expected=" as *u8); ib_wn(1, expect_code); ib_wr(1, " got=" as *u8); ib_wn(1, got); ib_wr(1, "\n" as *u8)
26    }
27    return 0
28}
29
30func main() -> i64 {
31    let c: *i64 = sys_mmap(16) as *i64
32    c[0] = 0
33    c[1] = 0
34    ib_wr(1, "TRUSTFENCE-GATE LI9 adversarial fixtures (inline, self-contained, synthesized outcomes):\n" as *u8)
35    ltgate_case("{\"merged\":true,\"merge_commit_sha\":\"abc123\",\"base\":{\"ref\":\"master\",\"repo\":{\"full_name\":\"rust-lang/rust\",\"default_branch\":\"main\",\"fork\":false}}}" as *u8, LTG_ACCEPT, "accept-canonical-MASTER-with-MAIN-default (rename regression guard)" as *u8, c)
36    ltgate_case("{\"merged\":true,\"merge_commit_sha\":\"def456\",\"base\":{\"ref\":\"main\",\"repo\":{\"full_name\":\"rust-lang/rust\",\"default_branch\":\"main\",\"fork\":false}}}" as *u8, LTG_ACCEPT, "accept-canonical-main" as *u8, c)
37    ltgate_case("{\"merged\":false,\"merge_commit_sha\":null,\"base\":{\"ref\":\"main\",\"repo\":{\"full_name\":\"rust-lang/rust\",\"default_branch\":\"main\",\"fork\":false}}}" as *u8, LTG_REJ_NOT_MERGED, "reject-trojan-unmerged" as *u8, c)
38    ltgate_case("{\"merged\":true,\"merge_commit_sha\":\"deadbeef\",\"base\":{\"ref\":\"main\",\"repo\":{\"full_name\":\"evilcorp-fork/rust\",\"default_branch\":\"main\",\"fork\":true}}}" as *u8, LTG_REJ_NOT_CANONICAL, "reject-trojan-attacker-fork" as *u8, c)
39    ltgate_case("{\"merged\":true,\"merge_commit_sha\":null,\"base\":{\"ref\":\"main\",\"repo\":{\"full_name\":\"rust-lang/rust\",\"default_branch\":\"main\",\"fork\":false}}}" as *u8, LTG_REJ_NO_MERGE_SHA, "reject-trojan-null-merge-sha" as *u8, c)
40    ib_wr(1, "TRUSTFENCE-GATE " as *u8); ib_wn(1, c[0]); ib_wr(1, "/" as *u8); ib_wn(1, c[0] + c[1])
41    if c[1] == 0 { ib_wr(1, " GREEN\n" as *u8); return 0 }
42    ib_wr(1, " RED\n" as *u8)
43    return 1
44}
nx_langintel_trustfence_gate.nx source

`nx_langintel_trustfence_gate.nx` source
