nx_mediafacts_gate.nx source

1// nx_mediafacts_gate.nx -- PROVE THE MEDIA FACT EXTRACTOR MEASURES, NEVER FABRICATES, NEVER LEAKS. 2// 3// Teeth follow the refcorpus discipline: every capability is asserted in BOTH polarities, and the 4// PII wall gets a structural tooth -- two JPEGs identical except their Exif CONTENT must produce 5// identical fact arrays, proving segment content cannot flow through this lane (a witness that 6// can only agree is not a witness; a flag that fires on presence must also stay silent on absence). 7// Fixtures are constructed byte-for-byte from the published specs (PNG sig+IHDR, JPEG markers, 8// RIFF/WAVE chunk layout) -- not from our own writers, so a shared misreading cannot self-validate. 9// license_tier: ORIGINAL No hw writes (Rule 26). 10import "nx_syscalls.nx" 11import "nx_gate_verdict.nx" 12import "nx_mediafacts_lib.nx" 13import "nx_refcorpus.nx" 14 15// minimal PNG: signature + IHDR header region with W=640 H=480 at the spec offsets 16func mg_png(b: *u8) -> i64 { 17 var i: i64 = 0 18 while i < 64 { b[i] = 0 as u8; i = i + 1 } 19 b[0]=0x89 as u8; b[1]=0x50 as u8; b[2]=0x4e as u8; b[3]=0x47 as u8 20 b[4]=0x0d as u8; b[5]=0x0a as u8; b[6]=0x1a as u8; b[7]=0x0a as u8 21 b[11]=13 as u8 22 b[12]=0x49 as u8; b[13]=0x48 as u8; b[14]=0x44 as u8; b[15]=0x52 as u8 23 b[16]=0 as u8; b[17]=0 as u8; b[18]=2 as u8; b[19]=128 as u8 // W=640 BE 24 b[20]=0 as u8; b[21]=0 as u8; b[22]=1 as u8; b[23]=224 as u8 // H=480 BE 25 return 33 26} 27 28// JPEG: SOI + APP1(Exif, content_a/content_b in the segment body) + SOF0 240x320 + SOS 29func mg_jpeg(b: *u8, with_exif: i64, content: i64) -> i64 { 30 var i: i64 = 0 31 while i < 64 { b[i] = 0 as u8; i = i + 1 } 32 b[0]=0xff as u8; b[1]=0xd8 as u8 33 b[2]=0xff as u8 34 if with_exif == 1 { b[3]=0xe1 as u8 } else { b[3]=0xe0 as u8 } 35 b[4]=0 as u8; b[5]=20 as u8 // segment len 20 = 2 + 18 payload 36 if with_exif == 1 { 37 b[6]=0x45 as u8; b[7]=0x78 as u8; b[8]=0x69 as u8; b[9]=0x66 as u8 // "Exif" 38 } else { 39 b[6]=0x4a as u8; b[7]=0x46 as u8; b[8]=0x49 as u8; b[9]=0x46 as u8 // "JFIF" 40 } 41 b[10]=0 as u8; b[11]=0 as u8 42 // 12 bytes of segment CONTENT -- the twin tooth varies exactly these 43 var c: i64 = 12 44 while c < 24 { if content == 1 { b[c] = 0x41 as u8 } else { b[c] = 0x5a as u8 } c = c + 1 } 45 // SOF0 at 24: FF C0 len 17, precision, H=240 BE, W=320 BE 46 b[24]=0xff as u8; b[25]=0xc0 as u8 47 b[26]=0 as u8; b[27]=17 as u8 48 b[28]=8 as u8 49 b[29]=0 as u8; b[30]=240 as u8 50 b[31]=1 as u8; b[32]=64 as u8 51 b[33]=3 as u8 52 // SOS far enough that the walk ends at SOF/segment-skip first 53 b[45]=0xff as u8; b[46]=0xda as u8 54 return 48 55} 56 57// canonical 44-byte RIFF/WAVE header, PCM 2ch 44100Hz 16-bit, data DECLARED 352800B, NO body bytes 58func mg_wav(b: *u8) -> i64 { 59 var i: i64 = 0 60 while i < 48 { b[i] = 0 as u8; i = i + 1 } 61 b[0]=0x52 as u8; b[1]=0x49 as u8; b[2]=0x46 as u8; b[3]=0x46 as u8 62 b[4]=0x24 as u8; b[5]=0x62 as u8; b[6]=0x05 as u8; b[7]=0 as u8 63 b[8]=0x57 as u8; b[9]=0x41 as u8; b[10]=0x56 as u8; b[11]=0x45 as u8 64 b[12]=0x66 as u8; b[13]=0x6d as u8; b[14]=0x74 as u8; b[15]=0x20 as u8 65 b[16]=16 as u8 66 b[20]=1 as u8 // PCM 67 b[22]=2 as u8 // channels 68 b[24]=0x44 as u8; b[25]=0xac as u8 // 44100 LE 69 b[28]=0x10 as u8; b[29]=0xb1 as u8; b[30]=0x02 as u8 // byte_rate 176400 LE 70 b[32]=4 as u8 71 b[34]=16 as u8 // bits 72 b[36]=0x64 as u8; b[37]=0x61 as u8; b[38]=0x74 as u8; b[39]=0x61 as u8 73 b[40]=0xa0 as u8; b[41]=0x62 as u8; b[42]=0x05 as u8 // data size 352800 LE 74 return 44 75} 76 77func main(argc: i64, argv: *i64) -> i64 { 78 let ctr: *i64 = gv_ctr() 79 gv_head("nx_mediafacts_gate -- measured facts only: parsed where real, -1 where absent, content never flows" as *u8) 80 81 let b: *u8 = sys_mmap(4096) 82 let facts: *i64 = sys_mmap(MF_N_SLOTS * 8) as *i64 83 84 // T1 PNG dims measured from the real IHDR offsets 85 let n1: i64 = mg_png(b) 86 mf_probe(b, n1, facts) 87 var t1: i64 = 0 88 if facts[0] == MF_FMT_PNG { if facts[1] == 640 { if facts[2] == 480 { t1 = 1 } } } 89 gv_check("T1 PNG MEASURED: format=png width=640 height=480 read from the IHDR bytes, not guessed" as *u8, t1, ctr) 90 91 // T2 unknown bytes fabricate NOTHING: format=unknown and every slot stays -1 92 var i2: i64 = 0 93 while i2 < 64 { b[i2] = 0x41 as u8; i2 = i2 + 1 } 94 mf_probe(b, 64, facts) 95 var t2: i64 = 0 96 if facts[0] == MF_FMT_UNKNOWN { if facts[1] == 0 - 1 { if facts[5] == 0 - 1 { t2 = 1 } } } 97 gv_check("T2 UNKNOWN FABRICATES NOTHING: garbage input yields format=unknown and every measurement slot -1 -- a plausible zero is the failure, absence is honest" as *u8, t2, ctr) 98 99 // T3 JPEG: dims from SOF0 AND the Exif presence flag fires 100 let n3: i64 = mg_jpeg(b, 1, 1) 101 mf_probe(b, n3, facts) 102 var t3: i64 = 0 103 if facts[0] == MF_FMT_JPEG { if facts[1] == 320 { if facts[2] == 240 { if facts[3] == 1 { t3 = 1 } } } } 104 gv_check("T3 JPEG MEASURED + EXIF PRESENCE FIRES: 320x240 from SOF0, exif_present=1 from the APP1 label" as *u8, t3, ctr) 105 106 // T4 the flag's other polarity: a JFIF APP0 jpeg reports exif_present=0 107 let n4: i64 = mg_jpeg(b, 0, 1) 108 mf_probe(b, n4, facts) 109 var t4: i64 = 0 110 if facts[0] == MF_FMT_JPEG { if facts[3] == 0 { t4 = 1 } } 111 gv_check("T4 EXIF FLAG STAYS SILENT ON ABSENCE: APP0-only jpeg reports exif_present=0 -- a flag that can only fire is not a flag" as *u8, t4, ctr) 112 113 // T5 WAV facts from a HEADER-ONLY window: data body absent, duration from DECLARED size 114 let n5: i64 = mg_wav(b) 115 mf_probe(b, n5, facts) 116 var t5: i64 = 0 117 if facts[0] == MF_FMT_WAV { if facts[4] == 2 { if facts[5] == 44100 { if facts[6] == 16 { if facts[7] == 2000 { t5 = 1 } } } } } 118 gv_check("T5 WAV WINDOW CONTRACT: 2ch 44100Hz 16-bit and duration 2000ms computed with ZERO body bytes present -- a 500MB recording measures from its first KB" as *u8, t5, ctr) 119 120 // T6 median sorts before min/max are read: odd + even, and the array ends ordered 121 let arr: *i64 = sys_mmap(64) as *i64 122 arr[0]=5; arr[1]=1; arr[2]=9; arr[3]=7; arr[4]=3 123 let m5: i64 = mf_median(arr, 5) 124 var t6: i64 = 0 125 if m5 == 5 { if arr[0] == 1 { if arr[4] == 9 { 126 arr[0]=4; arr[1]=2; arr[2]=8; arr[3]=6 127 if mf_median(arr, 4) == 6 { t6 = 1 } 128 } } } 129 gv_check("T6 MEDIAN SORTS IN PLACE: odd median 5, sorted ends min=1 max=9, even upper-median 6 -- min/max after this call are measurements, not file order" as *u8, t6, ctr) 130 131 // T7 the sweep's k-anonymity floor is the SAME wall the refcorpus gate proves: n=5 refused, n=8 admitted 132 var t7: i64 = 0 133 if rc_admit("640" as *u8, 5) == 0 - 3 { if rc_admit("640" as *u8, 8) == 0 { t7 = 1 } } 134 gv_check("T7 K-FLOOR REACHED IN-PROCESS: a 5-file bucket is refused with the k-anonymity reason and an 8-file bucket admits -- the composition reaches the identical wall, not a copy of it" as *u8, t7, ctr) 135 136 // T8 THE PII WALL, STRUCTURALLY: two jpegs identical except Exif segment CONTENT -> identical facts 137 let bb: *u8 = sys_mmap(4096) 138 let f2: *i64 = sys_mmap(MF_N_SLOTS * 8) as *i64 139 let na: i64 = mg_jpeg(b, 1, 1) 140 let nb: i64 = mg_jpeg(bb, 1, 2) 141 mf_probe(b, na, facts) 142 mf_probe(bb, nb, f2) 143 var t8: i64 = 1 144 var s8: i64 = 0 145 while s8 < MF_N_SLOTS { if facts[s8] != f2[s8] { t8 = 0 } s8 = s8 + 1 } 146 gv_check("T8 PII WALL IS STRUCTURAL: varying every Exif content byte changes NO fact slot -- segment content has no path into the output, so GPS/serials/thumbnails are unreadable through this lane" as *u8, t8, ctr) 147 148 let rc: i64 = gv_verdict("MEDIAFACTS-GATE", ctr, "closed vocabulary, both polarities per fact, content-flow twin, k-floor composition" as *u8) 149 sys_exit(rc) 150 return rc 151}