code wiki / _hdl_build / nx_meet_intake_gate.nx
`nx_meet_intake_gate.nx` source

↩ module page · 110 lines · 7784 B
1import "nx_gate_gn.nx"
2// nx_meet_intake_gate.nx -- liar-kill gate for R3+R4 (candidate apply + employer request-talent intake).
3// Sovereign fork/exec: build the intake emitter, write a brand .meet, emit BOTH kinds, then assert: the forms
4// carry ZERO client code (a real no-JS form -- the whole capability), are token-driven, POST to the right route,
5// embed the anti-fake controls (CSS honeypot name="website", required attestation checkbox), and the two sides
6// are DISTINCT (apply has the candidate attestation + no employer field/route; hire has company + /request-talent
7// + no /apply). expect_exit: 0
8import "nx_syscalls.nx"
9import "nx_gate_verdict.nx"
10
11func gp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
12func gslen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
13func gfind(hay: *u8, hl: i64, needle: *u8) -> i64 {
  let nl: i64 = gslen(needle); if nl == 0 { return 0-1 }
  var i: i64 = 0
  while i + nl <= hl { var k: i64=0; var hit: i64=1; while k<nl { if hay[i+k]!=needle[k]{hit=0;k=nl}else{k=k+1} } if hit==1 {return i} i=i+1 }
  return 0-1
18}
19func ghas(hay: *u8, hl: i64, needle: *u8) -> i64 { if gfind(hay, hl, needle) >= 0 { return 1 } return 0 }
20func gwrite(path: *u8, s: *u8) -> i64 {
  let fd: i64 = sys_openat_wr(path, 0x1a4)
  if fd < 0 { return 0 - 1 }
  var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 }
  sys_write(fd, s, n); sys_close(fd); return n
25}
26func spawn(path: *u8, a0: *u8, a1: *u8, redir: *u8) -> i64 {
  let pid: i64 = sys_fork()
  if pid == 0 {
      let fd: i64 = sys_openat_wr(redir, 420)
      if fd >= 0 { sys_dup3(fd, 1, 0); sys_dup3(fd, 2, 0) }
      let argv: *i64 = sys_mmap(64) as *i64
      var n: i64 = 0
      argv[0] = path as i64; n = 1
      if (a0 as i64) != 0 { argv[n] = a0 as i64; n = n + 1 }
      if (a1 as i64) != 0 { argv[n] = a1 as i64; n = n + 1 }
      argv[n] = 0
      let envp: *i64 = sys_mmap(16) as *i64
      envp[0] = "PATH=/usr/bin:/bin\x00" as *u8 as i64; envp[1] = 0
      sys_execve(path, argv, envp)
      sys_exit(127)
  }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, st, 0)
  return (st[0] >> 8) & 0xff
45}
46
47func main() -> i64 {
  gp("=== nx_meet_intake_gate: R3+R4 apply + request-talent -- sovereign 0-JS forms, anti-fake built in ===\n" as *u8)
  let RUNNER: *u8 = "_offc/nx_sov_build_run.elf\x00" as *u8
  let EMIT: *u8 = "/tmp/nx_meet_intake.sov.elf\x00" as *u8
  let SCRATCH: *u8 = "knowledge/status/meet_intake_gate_scratch.log\x00" as *u8
52
  spawn(RUNNER, "nx_meet_intake\x00" as *u8, 0 as *u8, SCRATCH)
  gwrite("web_assets/meet_gateintk.meet\x00" as *u8, "meet|brand|Community Meet -- McKinney & DFW\nmeet|region|McKinney & the Dallas metro\nmeet|zip|75071\nmeet|cta_href|/apply\n" as *u8)
  spawn(EMIT, "gateintk\x00" as *u8, "apply\x00" as *u8, SCRATCH)
  spawn(EMIT, "gateintk\x00" as *u8, "hire\x00" as *u8, SCRATCH)
57
  let lp: *i64 = sys_mmap(16) as *i64; lp[0] = 0
  let h: *u8 = sys_read_file("web_assets/site_gateintk/apply.html\x00" as *u8, lp)
  if (h as i64) == 0 { gp("MEET-INTAKE-GATE verdict=RED reason=apply-missing\n" as *u8); sys_exit(1); return 1 }
  let n: i64 = lp[0]
  let lp2: *i64 = sys_mmap(16) as *i64; lp2[0] = 0
  let b: *u8 = sys_read_file("web_assets/site_gateintk/hire.html\x00" as *u8, lp2)
  if (b as i64) == 0 { gp("MEET-INTAKE-GATE verdict=RED reason=hire-missing\n" as *u8); sys_exit(1); return 1 }
  let bn: i64 = lp2[0]
  gp("  apply bytes=" as *u8); gn(n); gp("  hire bytes=" as *u8); gn(bn); gp("\n" as *u8)
67
  var pass: i64 = 0; var fail: i64 = 0
  // (1) APPLY is a real no-JS form
  if gfind(h, n, "<script" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-has-script\n" as *u8) }
  if gfind(h, n, "onclick" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-has-onclick\n" as *u8) }
  if gfind(h, n, "javascript:" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-has-jsurl\n" as *u8) }
  if gfind(h, n, "eval(" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-has-eval\n" as *u8) }
  if ghas(h, n, ":root{" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-no-tokens\n" as *u8) }
  if ghas(h, n, "var(--nx-color-primary)" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-not-token-driven\n" as *u8) }
  if ghas(h, n, "class=\"nav\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-no-nav\n" as *u8) }
  if ghas(h, n, "<form" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-no-form\n" as *u8) }
  if ghas(h, n, "method=\"post\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-no-post\n" as *u8) }
  if ghas(h, n, "action=\"/apply\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-wrong-action\n" as *u8) }
  // (2) anti-fake controls built into APPLY
  if ghas(h, n, "class=\"hp\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-no-honeypot-style\n" as *u8) }
  if ghas(h, n, "name=\"website\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-no-honeypot-field\n" as *u8) }
  if ghas(h, n, "name=\"email\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-no-email\n" as *u8) }
  if ghas(h, n, "required" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-no-required\n" as *u8) }
  if ghas(h, n, "name=\"attest\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-no-attest\n" as *u8) }
  if ghas(h, n, "type=\"checkbox\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-no-checkbox\n" as *u8) }
  if ghas(h, n, "not AI-generated" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-no-attestation-text\n" as *u8) }
  // (3) TEETH: apply is the candidate side only
  if gfind(h, n, "/request-talent" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-leaks-employer-route\n" as *u8) }
  if gfind(h, n, "name=\"company\"" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp("  FAIL apply-leaks-company-field\n" as *u8) }
  // (4) HIRE is the distinct employer side, still sovereign
  if gfind(b, bn, "<script" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp("  FAIL hire-has-script\n" as *u8) }
  if ghas(b, bn, "action=\"/request-talent\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL hire-wrong-action\n" as *u8) }
  if ghas(b, bn, "method=\"post\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL hire-no-post\n" as *u8) }
  if ghas(b, bn, "name=\"company\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL hire-no-company\n" as *u8) }
  if ghas(b, bn, "name=\"attest\"" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL hire-no-attest\n" as *u8) }
  if ghas(b, bn, "ghost posting" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL hire-no-attestation-text\n" as *u8) }
  if gfind(b, bn, "action=\"/apply\"" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp("  FAIL hire-leaks-apply-route\n" as *u8) }
99
  gp("MEET-INTAKE-GATE pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail)
  // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check
  // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled
  // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify.
  let ctr__dry: *i64 = gv_ctr()
  ctr__dry[0] = pass
  ctr__dry[1] = pass + fail
  let rc__dry: i64 = gv_verdict("MEET-INTAKE-GATE" as *u8, ctr__dry, "sovereign 0-JS intake forms, anti-fake honeypot+attestation, two distinct sides)" as *u8)
  sys_exit(rc__dry)
  return rc__dry
110}
nx_meet_intake_gate.nx source

`nx_meet_intake_gate.nx` source
