nx_mcp_coverage_gate.nx source
↩ module page · 54 lines · 3161 B
1// nx_mcp_coverage_gate.nx -- gate for the standing MCP/API exposure coverage organ.
2// T1 the REAL map grades clean: mc_run(coverage_map) returns 0 policy-violations (our seeded
3// map obeys the exposure policy) AND areas>0.
4// T2 NEG blind-wrapping caught: a planted map marking a PRIMITIVE (std_slen) and a GATE
5// (nx_foo_gate) as EXPOSED capabilities -> violations >= 2 (the anti-"expose everything
6// stupidly" tooth fires).
7// T3 the policy classifier is correct on both sides (pure): std_/fc_/sys_/_gate/_test/_smoke = internal-kind;
8// a real capability name (nx_forge_engine) = NOT internal-kind.
9// license_tier: ORIGINAL expect_exit: 0
10import "nx_mcp_coverage.nx"
11import "nx_gate_verdict.nx"
12
13func cvg_write(path: *u8, s: *u8) -> i64 {
14 let fd: i64 = sys_openat_wr(path, 420)
15 if fd < 0 { return 0 - 1 }
16 let n: i64 = std_slen(s)
17 sys_write(fd, s, n)
18 sys_close(fd)
19 return 0
20}
21
22func main(argc: i64, argv: *i64) -> i64 {
23 std_putln("MCP-COVERAGE-GATE: standing exposure policy (small-sharp-tools vs curated capabilities)" as *u8)
24 var pass: i64 = 0
25 // T1 real map clean -- from the SOVEREIGN STORE (the default source; no-TSV law)
26 let v1: i64 = mc_run_store()
27 if v1 == 0 { pass = pass + 1; std_putln("T1 PASS real map from sovereign store: 0 policy-violations" as *u8) }
28 if v1 != 0 { std_puts("T1 FAIL violations=" as *u8); std_pdec(v1); std_puts("\n" as *u8) }
29 // T2 NEG: plant primitive + gate marked EXPOSED
30 let neg: *u8 = "# negctl\nAREA|bad-prim|mcp-api-broad|wire|std_slen|primitive marked exposed\nAREA|bad-gate|cap|wire|nx_foo_gate|gate marked exposed\n" as *u8
31 cvg_write("/tmp/cov_neg.txt" as *u8, neg)
32 let v2: i64 = mc_run("/tmp/cov_neg.txt" as *u8)
33 if v2 >= 2 { pass = pass + 1; std_putln("T2 PASS NEG blind-wrap caught (>=2 violations)" as *u8) }
34 if v2 < 2 { std_puts("T2 FAIL violations=" as *u8); std_pdec(v2); std_puts("\n" as *u8) }
35 // T3 pure classifier both sides
36 let a: i64 = mc_is_internal_kind("std_slen" as *u8)
37 let b: i64 = mc_is_internal_kind("nx_foo_gate" as *u8)
38 let c: i64 = mc_is_internal_kind("fc_read" as *u8)
39 let d: i64 = mc_is_internal_kind("nx_forge_engine" as *u8)
40 let e: i64 = mc_is_internal_kind("nx_https_get" as *u8)
41 if a == 1 && b == 1 && c == 1 && d == 0 && e == 0 { pass = pass + 1; std_putln("T3 PASS classifier (primitives/gates internal, capabilities not)" as *u8) }
42 if a != 1 || b != 1 || c != 1 || d != 0 || e != 0 { std_putln("T3 FAIL classifier" as *u8) }
43 std_puts("MCP-COVERAGE-GATE pass=" as *u8)
44 std_pdec(pass)
45 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check
46 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled
47 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify.
48 let ctr__dry: *i64 = gv_ctr()
49 ctr__dry[0] = pass
50 ctr__dry[1] = 3
51 let rc__dry: i64 = gv_verdict("MCP-COVERAGE-GATE" as *u8, ctr__dry, "teeth unchanged; verdict emission migrated onto the shared base class" as *u8)
52 sys_exit(rc__dry)
53 return rc__dry
54}