code wiki / _hdl_build / nx_live_reach_test.nx
`nx_live_reach_test.nx` source

1// nx_live_reach_test.nx -- prove the live-or-mirror policy degrades gracefully. The outcomes below are
2// the documented stages nx_https_get returns (REACHABLE / TLS_FAIL / TCP_FAIL / DNS_FAIL); the byte
3// fetch + cert validation are env-gated and proven elsewhere, so here we certify the team's DECISION:
4//   reachable + no mirror     -> USE_LIVE, answerable, mirror-it-now
5//   TLS blocked + have mirror -> USE_MIRROR, answerable  (the real local case: empty trust store)
6//   TCP blocked + no mirror   -> NO_DATA, NOT answerable (honest: nothing to serve)
7//   DNS fail + have mirror    -> USE_MIRROR, answerable
8// The guarantee: a blocked live web never starves us when we have mirrored. Exit 0 on 7/7.
9// license_tier: ORIGINAL
10
11import "nx_live_reach.nx"
12import "nx_syscalls.nx"
13
14func lt_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
15func lt_num(v: i64) -> i64 { let bb: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m; sys_write(1,"-" as *u8,1)}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=48+(m%10); m=m/10; k=k+1}; var i: i64=0; while i<k {bb[i]=t[k-1-i]; i=i+1}; sys_write(1, bb, k); return 0 }
16
17func main() -> i64 {
18    lt_puts("=== LIVE-OR-MIRROR policy: a blocked live web never starves us ===\n" as *u8)
19
20    let p_live: i64 = lr_policy(LR_REACHABLE, 0)
21    let p_tls:  i64 = lr_policy(LR_TLS_FAIL, 1)
22    let p_tcp:  i64 = lr_policy(LR_TCP_FAIL, 0)
23    let p_dns:  i64 = lr_policy(LR_DNS_FAIL, 1)
24    lt_puts(" reachable+no-mirror -> policy=" as *u8); lt_num(p_live); lt_puts(" (1=LIVE)  mirror-now=" as *u8); lt_num(lr_mirror_after_live(LR_REACHABLE)); lt_puts("\n" as *u8)
25    lt_puts(" TLS-block+mirror    -> policy=" as *u8); lt_num(p_tls); lt_puts(" (2=MIRROR)  covered=" as *u8); lt_num(lr_blocked_but_covered(LR_TLS_FAIL, 1)); lt_puts("\n" as *u8)
26    lt_puts(" TCP-block+no-mirror -> policy=" as *u8); lt_num(p_tcp); lt_puts(" (3=NO_DATA)  answerable=" as *u8); lt_num(lr_answerable(LR_TCP_FAIL, 0)); lt_puts("\n" as *u8)
27    lt_puts(" DNS-fail+mirror     -> policy=" as *u8); lt_num(p_dns); lt_puts(" (2=MIRROR)  answerable=" as *u8); lt_num(lr_answerable(LR_DNS_FAIL, 1)); lt_puts("\n" as *u8)
28
29    let r: *i64 = sys_mmap(8 * 8) as *i64
30    r[0] = 0; if p_live == LR_USE_LIVE { r[0] = 1 }                         // reachable -> use live
31    r[1] = 0; if lr_mirror_after_live(LR_REACHABLE) == 1 { r[1] = 1 }       // ...and mirror it now
32    r[2] = 0; if p_tls == LR_USE_MIRROR { r[2] = 1 }                        // TLS-blocked -> fall back to mirror
33    r[3] = 0; if lr_blocked_but_covered(LR_TLS_FAIL, 1) == 1 { r[3] = 1 }   // blocked but covered (the resilience win)
34    r[4] = 0; if p_tcp == LR_NO_DATA { r[4] = 1 }                          // TCP-blocked + no mirror -> honest NO_DATA
35    r[5] = 0; if lr_answerable(LR_TCP_FAIL, 0) == 0 { r[5] = 1 }            // ...not answerable (no bluffing)
36    r[6] = 0; if lr_answerable(LR_DNS_FAIL, 1) == 1 { if p_dns == LR_USE_MIRROR { r[6] = 1 } }  // any block + mirror = answerable
37    var pass: i64 = 0; var i: i64 = 0
38    while i < 7 { pass = pass + r[i]; i = i + 1 }
39    lt_puts("----\n passed " as *u8); lt_num(pass); lt_puts("/7\n" as *u8)
40    if pass == 7 { lt_puts(" GRACEFUL: live used when reachable (+mirrored), mirror serves when blocked, honest NO_DATA only when neither -- the team degrades, never bluffs. Live cert-validated HTTPS stays env-gated.\n" as *u8); sys_exit(0); return 0 }
41    lt_puts(" FAIL\n" as *u8); sys_exit(1); return 1
42}
nx_live_reach_test.nx source

`nx_live_reach_test.nx` source
