nx_meet_intake_process_gate.nx source

1// nx_meet_intake_process_gate.nx -- liar-kill gate for P2 (submission processing). Proves: the processor SCREENS 2// (clean apply -> SCREENED; AI-slop / ghost / honeypot-bot -> FLAGGED, composing R6+R7), and SANITIZES untrusted 3// values so a CRLF header-injection attempt ("Eve\r\nBcc: evil") collapses to inert text in BOTH the application 4// record AND the confirmation email -- no injected record line, no injected mail header. expect_exit: 0 5import "nx_syscalls.nx" 6import "nx_meet_lib.nx" 7import "nx_meet_curate.nx" 8import "nx_meet_intake_process.nx" 9import "nx_gate_verdict.nx" 10 11func mfind(hay: *u8, n: i64, needle: *u8) -> i64 { 12 let nl: i64 = mlen(needle); if nl == 0 { return 0 - 1 } 13 var i: i64 = 0 14 while i + nl <= n { var k: i64=0; var hit: i64=1; while k<nl { if hay[i+k]!=needle[k]{hit=0;k=nl}else{k=k+1} } if hit==1 {return i} i=i+1 } 15 return 0 - 1 16} 17 18func main() -> i64 { 19 mputs("=== nx_meet_intake_process_gate: screen (R6+R7) + injection-safe record/confirm ===\n" as *u8) 20 21 let mt: *u8 = sys_mmap(8); mt[0] = 0 as u8 // empty honeypot (real empty buffer; "" literal is unsafe for mlen) 22 let cleanres: *u8 = "Built payment service handling 12000 req/s at Acme; cut latency 38 percent. jane@example.com github.com/jane" as *u8 23 let slopres: *u8 = "As an AI language model, results-driven professional with synergy, a proven track record, detail-oriented go-getter." as *u8 24 let ghost: *u8 = "Be your own boss, unlimited earning! Competitive salary, fast-paced environment, always hiring rockstars." as *u8 25 26 // an untrusted name + email carrying a CRLF header-injection payload (built with real control bytes) 27 let injname: *u8 = sys_mmap(64) 28 var p: i64 = mcat(injname, 0, "Eve" as *u8); injname[p] = 13 as u8; injname[p+1] = 10 as u8; p = p + 2; p = mcat(injname, p, "Bcc: evil@x.com" as *u8) 29 let injmail: *u8 = sys_mmap(64) 30 var q: i64 = mcat(injmail, 0, "eve@x.com" as *u8); injmail[q] = 13 as u8; injmail[q+1] = 10 as u8; q = q + 2; q = mcat(injmail, q, "Bcc: evil" as *u8) 31 32 // build a sanitized application record for the injection submission (status from the screen verdict) 33 let rec: *u8 = sys_mmap(4096) 34 var ro: i64 = rec_field(rec, 0, "kind" as *u8, "apply" as *u8) 35 ro = rec_field(rec, ro, "name" as *u8, injname) 36 ro = rec_field(rec, ro, "email" as *u8, injmail) 37 ro = rec_field(rec, ro, "status" as *u8, curate_state_name(curate_screen_resume(cleanres, mt))) 38 39 // build confirmations: one for the injection submission, one clean 40 let conf: *u8 = sys_mmap(4096); intake_confirm(conf, injname, injmail, "application" as *u8) 41 let cn: i64 = mlen(conf) 42 let conf2: *u8 = sys_mmap(4096); intake_confirm(conf2, "Jane Doe" as *u8, "jane@example.com" as *u8, "application" as *u8) 43 let c2n: i64 = mlen(conf2) 44 let rn: i64 = mlen(rec) 45 46 var pass: i64 = 0; var fail: i64 = 0 47 // screening (composes R6 + R7) 48 if curate_screen_resume(cleanres, mt) == ST_SCREENED { pass=pass+1 } else { fail=fail+1; mputs(" FAIL clean-not-screened\n" as *u8) } 49 if curate_screen_resume(cleanres, "bot-filled" as *u8) == ST_FLAGGED { pass=pass+1 } else { fail=fail+1; mputs(" FAIL honeypot-not-flagged\n" as *u8) } 50 if curate_screen_resume(slopres, mt) == ST_FLAGGED { pass=pass+1 } else { fail=fail+1; mputs(" FAIL slop-not-flagged\n" as *u8) } 51 if curate_screen_posting(ghost, mt) == ST_FLAGGED { pass=pass+1 } else { fail=fail+1; mputs(" FAIL ghost-not-flagged\n" as *u8) } 52 // record built + status from verdict 53 if mfind(rec, rn, "status: SCREENED" as *u8) >= 0 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL record-status-missing\n" as *u8) } 54 // INJECTION TEETH: the CRLF was stripped, collapsing "Eve\r\nBcc:" -> "EveBcc:" (one inert line, no new header) 55 if mfind(rec, rn, "name: EveBcc: evil@x.com" as *u8) >= 0 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL record-not-sanitized\n" as *u8) } 56 if mfind(rec, rn, "email: eve@x.comBcc: evil" as *u8) >= 0 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL record-email-not-sanitized\n" as *u8) } 57 // confirmation: injection neutralized in headers 58 if mfind(conf, cn, "To: eve@x.comBcc: evil" as *u8) >= 0 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL confirm-header-injection\n" as *u8) } 59 if mfind(conf, cn, "From: intake@" as *u8) >= 0 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL confirm-no-from\n" as *u8) } 60 // clean confirmation well-formed 61 if mfind(conf2, c2n, "To: jane@example.com" as *u8) >= 0 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL clean-confirm-to\n" as *u8) } 62 if mfind(conf2, c2n, "Hi Jane Doe" as *u8) >= 0 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL clean-confirm-body\n" as *u8) } 63 64 mputs("MEET-INTAKE-PROCESS-GATE pass=" as *u8); mnum(pass); mputs(" fail=" as *u8); mnum(fail) 65 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 66 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 67 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 68 let ctr__dry: *i64 = gv_ctr() 69 ctr__dry[0] = pass 70 ctr__dry[1] = pass + fail 71 let rc__dry: i64 = gv_verdict("MEET-INTAKE-PROCESS-GATE" as *u8, ctr__dry, "screen R6+R7 + CRLF/header-injection-safe record + confirmation)" as *u8) 72 sys_exit(rc__dry) 73 return rc__dry 74}