nx_meet_pipeline_gate.nx source

1// nx_meet_pipeline_gate.nx -- END-TO-END liar-kill gate for the submission backend: a form submission flows 2// screen (R6 anti-fake + R7 curation) -> sanitized application record (P2 nx_meet_intake_process) -> durable 3// persist (P4 nx_meet_store, seg-store no-TSV) -> read back with the verdict reflected. Proves a clean apply 4// lands SCREENED + persisted, an AI-slop apply lands FLAGGED + persisted, and a CRLF-injection name is stripped 5// in the PERSISTED record (defense survives storage). expect_exit: 0 6import "nx_syscalls.nx" 7import "nx_meet_lib.nx" 8import "nx_meet_curate.nx" 9import "nx_meet_intake_process.nx" 10import "nx_meet_store.nx" 11 12func has(hay: *u8, n: i64, needle: *u8) -> i64 { 13 let nl: i64 = mlen(needle); if nl == 0 { return 0 } 14 var i: i64 = 0 15 while i + nl <= n { var k: i64=0; var hit: i64=1; while k<nl { if hay[i+k]!=needle[k]{hit=0;k=nl}else{k=k+1} } if hit==1 {return 1} i=i+1 } 16 return 0 17} 18 19func main() -> i64 { 20 mputs("=== nx_meet_pipeline_gate: submission -> screen -> sanitize -> persist -> read back ===\n" as *u8) 21 let mt: *u8 = sys_mmap(8); mt[0] = 0 as u8 22 let cleanres: *u8 = "Built payment service handling 12000 req/s at Acme; cut latency 38 percent. jane@example.com github.com/jane" as *u8 23 let slopres: *u8 = "As an AI language model, results-driven professional with synergy, a proven track record, detail-oriented go-getter." as *u8 24 let pq: *i64 = sys_mmap(16) as *i64 25 let lq: *i64 = sys_mmap(16) as *i64 26 var pass: i64 = 0; var fail: i64 = 0 27 28 // 1) CLEAN apply -> SCREENED -> sanitized record -> persisted -> readable with status 29 let v1: i64 = curate_screen_resume(cleanres, mt) 30 let rec1: *u8 = sys_mmap(4096) 31 var o: i64 = rec_field(rec1, 0, "kind" as *u8, "apply" as *u8) 32 o = rec_field(rec1, o, "name" as *u8, "Jane Doe" as *u8) 33 o = rec_field(rec1, o, "email" as *u8, "jane@example.com" as *u8) 34 o = rec_field(rec1, o, "status" as *u8, curate_state_name(v1)) 35 meet_store_put("appl-gate-clean" as *u8, rec1) 36 if v1 == ST_SCREENED { pass=pass+1 } else { fail=fail+1; mputs(" FAIL clean-not-screened\n" as *u8) } 37 if meet_store_get("appl-gate-clean" as *u8, pq, lq) == 1 { if has(pq[0] as *u8, lq[0], "status: SCREENED" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL clean-status-not-persisted\n" as *u8) } } else { fail=fail+1; mputs(" FAIL clean-not-stored\n" as *u8) } 38 if meet_store_indexed("appl-gate-clean" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL clean-not-indexed\n" as *u8) } 39 40 // 2) AI-slop apply -> FLAGGED -> persisted as flagged 41 let v2: i64 = curate_screen_resume(slopres, mt) 42 let rec2: *u8 = sys_mmap(4096) 43 o = rec_field(rec2, 0, "kind" as *u8, "apply" as *u8) 44 o = rec_field(rec2, o, "status" as *u8, curate_state_name(v2)) 45 meet_store_put("appl-gate-slop" as *u8, rec2) 46 if v2 == ST_FLAGGED { pass=pass+1 } else { fail=fail+1; mputs(" FAIL slop-not-flagged\n" as *u8) } 47 if meet_store_get("appl-gate-slop" as *u8, pq, lq) == 1 { if has(pq[0] as *u8, lq[0], "status: FLAGGED" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL slop-status-not-persisted\n" as *u8) } } else { fail=fail+1; mputs(" FAIL slop-not-stored\n" as *u8) } 48 49 // 3) injection name -> the PERSISTED record is sanitized (CRLF stripped, "Eve\r\nBcc:" -> "EveBcc:") 50 let injname: *u8 = sys_mmap(64) 51 var p: i64 = mcat(injname, 0, "Eve" as *u8); injname[p] = 13 as u8; injname[p+1] = 10 as u8; p = p + 2; p = mcat(injname, p, "Bcc: evil" as *u8) 52 let rec3: *u8 = sys_mmap(4096) 53 o = rec_field(rec3, 0, "name" as *u8, injname) 54 o = rec_field(rec3, o, "status" as *u8, "SCREENED" as *u8) 55 meet_store_put("appl-gate-inj" as *u8, rec3) 56 if meet_store_get("appl-gate-inj" as *u8, pq, lq) == 1 { if has(pq[0] as *u8, lq[0], "name: EveBcc: evil" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL persisted-record-not-sanitized\n" as *u8) } } else { fail=fail+1; mputs(" FAIL inj-not-stored\n" as *u8) } 57 58 mputs("MEET-PIPELINE-GATE pass=" as *u8); mnum(pass); mputs(" fail=" as *u8); mnum(fail) 59 if fail == 0 { mputs(" verdict=GREEN (end-to-end: screen R6+R7 -> sanitize P2 -> persist P4, verdict reflected, injection-safe through storage)\n" as *u8); sys_exit(0); return 0 } 60 mputs(" verdict=RED\n" as *u8); sys_exit(1); return 1 61}