nx_meet_intake_gate.nx source

1import "nx_gate_gn.nx" 2// nx_meet_intake_gate.nx -- liar-kill gate for R3+R4 (candidate apply + employer request-talent intake). 3// Sovereign fork/exec: build the intake emitter, write a brand .meet, emit BOTH kinds, then assert: the forms 4// carry ZERO client code (a real no-JS form -- the whole capability), are token-driven, POST to the right route, 5// embed the anti-fake controls (CSS honeypot name="website", required attestation checkbox), and the two sides 6// are DISTINCT (apply has the candidate attestation + no employer field/route; hire has company + /request-talent 7// + no /apply). expect_exit: 0 8import "nx_syscalls.nx" 9 10func gp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 11func gslen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 12func gfind(hay: *u8, hl: i64, needle: *u8) -> i64 { 13 let nl: i64 = gslen(needle); if nl == 0 { return 0-1 } 14 var i: i64 = 0 15 while i + nl <= hl { var k: i64=0; var hit: i64=1; while k<nl { if hay[i+k]!=needle[k]{hit=0;k=nl}else{k=k+1} } if hit==1 {return i} i=i+1 } 16 return 0-1 17} 18func ghas(hay: *u8, hl: i64, needle: *u8) -> i64 { if gfind(hay, hl, needle) >= 0 { return 1 } return 0 } 19func gwrite(path: *u8, s: *u8) -> i64 { 20 let fd: i64 = sys_openat_wr(path, 0x1a4) 21 if fd < 0 { return 0 - 1 } 22 var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } 23 sys_write(fd, s, n); sys_close(fd); return n 24} 25func spawn(path: *u8, a0: *u8, a1: *u8, redir: *u8) -> i64 { 26 let pid: i64 = sys_fork() 27 if pid == 0 { 28 let fd: i64 = sys_openat_wr(redir, 420) 29 if fd >= 0 { sys_dup3(fd, 1, 0); sys_dup3(fd, 2, 0) } 30 let argv: *i64 = sys_mmap(64) as *i64 31 var n: i64 = 0 32 argv[0] = path as i64; n = 1 33 if (a0 as i64) != 0 { argv[n] = a0 as i64; n = n + 1 } 34 if (a1 as i64) != 0 { argv[n] = a1 as i64; n = n + 1 } 35 argv[n] = 0 36 let envp: *i64 = sys_mmap(16) as *i64 37 envp[0] = "PATH=/usr/bin:/bin\x00" as *u8 as i64; envp[1] = 0 38 sys_execve(path, argv, envp) 39 sys_exit(127) 40 } 41 let st: *i64 = sys_mmap(16) as *i64 42 sys_wait4(pid, st, 0) 43 return (st[0] >> 8) & 0xff 44} 45 46func main() -> i64 { 47 gp("=== nx_meet_intake_gate: R3+R4 apply + request-talent -- sovereign 0-JS forms, anti-fake built in ===\n" as *u8) 48 let RUNNER: *u8 = "_offc/nx_sov_build_run.elf\x00" as *u8 49 let EMIT: *u8 = "/tmp/nx_meet_intake.sov.elf\x00" as *u8 50 let SCRATCH: *u8 = "knowledge/status/meet_intake_gate_scratch.log\x00" as *u8 51 52 spawn(RUNNER, "nx_meet_intake\x00" as *u8, 0 as *u8, SCRATCH) 53 gwrite("web_assets/meet_gateintk.meet\x00" as *u8, "meet|brand|Community Meet -- McKinney & DFW\nmeet|region|McKinney & the Dallas metro\nmeet|zip|75071\nmeet|cta_href|/apply\n" as *u8) 54 spawn(EMIT, "gateintk\x00" as *u8, "apply\x00" as *u8, SCRATCH) 55 spawn(EMIT, "gateintk\x00" as *u8, "hire\x00" as *u8, SCRATCH) 56 57 let lp: *i64 = sys_mmap(16) as *i64; lp[0] = 0 58 let h: *u8 = sys_read_file("web_assets/site_gateintk/apply.html\x00" as *u8, lp) 59 if (h as i64) == 0 { gp("MEET-INTAKE-GATE verdict=RED reason=apply-missing\n" as *u8); sys_exit(1); return 1 } 60 let n: i64 = lp[0] 61 let lp2: *i64 = sys_mmap(16) as *i64; lp2[0] = 0 62 let b: *u8 = sys_read_file("web_assets/site_gateintk/hire.html\x00" as *u8, lp2) 63 if (b as i64) == 0 { gp("MEET-INTAKE-GATE verdict=RED reason=hire-missing\n" as *u8); sys_exit(1); return 1 } 64 let bn: i64 = lp2[0] 65 gp(" apply bytes=" as *u8); gn(n); gp(" hire bytes=" as *u8); gn(bn); gp("\n" as *u8) 66 67 var pass: i64 = 0; var fail: i64 = 0 68 // (1) APPLY is a real no-JS form 69 if gfind(h, n, "<script" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-has-script\n" as *u8) } 70 if gfind(h, n, "onclick" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-has-onclick\n" as *u8) } 71 if gfind(h, n, "javascript:" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-has-jsurl\n" as *u8) } 72 if gfind(h, n, "eval(" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-has-eval\n" as *u8) } 73 if ghas(h, n, ":root{" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-no-tokens\n" as *u8) } 74 if ghas(h, n, "var(--nx-color-primary)" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-not-token-driven\n" as *u8) } 75 if ghas(h, n, "class=\"nav\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-no-nav\n" as *u8) } 76 if ghas(h, n, "<form" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-no-form\n" as *u8) } 77 if ghas(h, n, "method=\"post\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-no-post\n" as *u8) } 78 if ghas(h, n, "action=\"/apply\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-wrong-action\n" as *u8) } 79 // (2) anti-fake controls built into APPLY 80 if ghas(h, n, "class=\"hp\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-no-honeypot-style\n" as *u8) } 81 if ghas(h, n, "name=\"website\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-no-honeypot-field\n" as *u8) } 82 if ghas(h, n, "name=\"email\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-no-email\n" as *u8) } 83 if ghas(h, n, "required" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-no-required\n" as *u8) } 84 if ghas(h, n, "name=\"attest\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-no-attest\n" as *u8) } 85 if ghas(h, n, "type=\"checkbox\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-no-checkbox\n" as *u8) } 86 if ghas(h, n, "not AI-generated" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-no-attestation-text\n" as *u8) } 87 // (3) TEETH: apply is the candidate side only 88 if gfind(h, n, "/request-talent" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-leaks-employer-route\n" as *u8) } 89 if gfind(h, n, "name=\"company\"" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL apply-leaks-company-field\n" as *u8) } 90 // (4) HIRE is the distinct employer side, still sovereign 91 if gfind(b, bn, "<script" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL hire-has-script\n" as *u8) } 92 if ghas(b, bn, "action=\"/request-talent\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL hire-wrong-action\n" as *u8) } 93 if ghas(b, bn, "method=\"post\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL hire-no-post\n" as *u8) } 94 if ghas(b, bn, "name=\"company\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL hire-no-company\n" as *u8) } 95 if ghas(b, bn, "name=\"attest\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL hire-no-attest\n" as *u8) } 96 if ghas(b, bn, "ghost posting" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL hire-no-attestation-text\n" as *u8) } 97 if gfind(b, bn, "action=\"/apply\"" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL hire-leaks-apply-route\n" as *u8) } 98 99 gp("MEET-INTAKE-GATE pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail) 100 if fail == 0 { gp(" verdict=GREEN (sovereign 0-JS intake forms, anti-fake honeypot+attestation, two distinct sides)\n" as *u8); sys_exit(0); return 0 } 101 gp(" verdict=RED\n" as *u8); sys_exit(1); return 1 102}