nx_meet_publish_gate.nx source

1import "nx_gate_gn.nx" 2// nx_meet_publish_gate.nx -- liar-kill gate for R8-PREP (publish readiness). Sovereign fork/exec: regenerate the 3// full demo bundle, run the stager, then assert the isolated staging queue holds ALL 10 pages, every row is HELD 4// (outward policy = fail-closed, nothing auto-deploys), the dest paths are the clean NAS layout, and ONLY HTML 5// pages were staged (no .meet/.openings/.about DATA files leaked). Spot-checks two pages are sovereign. expect_exit: 0 6import "nx_syscalls.nx" 7 8func gp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 9func gslen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 10func gfind(hay: *u8, hl: i64, needle: *u8) -> i64 { 11 let nl: i64 = gslen(needle); if nl == 0 { return 0-1 } 12 var i: i64 = 0 13 while i + nl <= hl { var k: i64=0; var hit: i64=1; while k<nl { if hay[i+k]!=needle[k]{hit=0;k=nl}else{k=k+1} } if hit==1 {return i} i=i+1 } 14 return 0-1 15} 16func ghas(hay: *u8, hl: i64, needle: *u8) -> i64 { if gfind(hay, hl, needle) >= 0 { return 1 } return 0 } 17func gcount(hay: *u8, hl: i64, needle: *u8) -> i64 { 18 let nl: i64 = gslen(needle); if nl == 0 { return 0 } 19 var c: i64 = 0; var i: i64 = 0 20 while i + nl <= hl { var k: i64=0; var hit: i64=1; while k<nl { if hay[i+k]!=needle[k]{hit=0;k=nl}else{k=k+1} } if hit==1 {c=c+1; i=i+nl} else {i=i+1} } 21 return c 22} 23func spawn(path: *u8, a0: *u8, a1: *u8, redir: *u8) -> i64 { 24 let pid: i64 = sys_fork() 25 if pid == 0 { 26 let fd: i64 = sys_openat_wr(redir, 420) 27 if fd >= 0 { sys_dup3(fd, 1, 0); sys_dup3(fd, 2, 0) } 28 let argv: *i64 = sys_mmap(64) as *i64 29 var n: i64 = 0 30 argv[0] = path as i64; n = 1 31 if (a0 as i64) != 0 { argv[n] = a0 as i64; n = n + 1 } 32 if (a1 as i64) != 0 { argv[n] = a1 as i64; n = n + 1 } 33 argv[n] = 0 34 let envp: *i64 = sys_mmap(16) as *i64 35 envp[0] = "PATH=/usr/bin:/bin\x00" as *u8 as i64; envp[1] = 0 36 sys_execve(path, argv, envp) 37 sys_exit(127) 38 } 39 let st: *i64 = sys_mmap(16) as *i64 40 sys_wait4(pid, st, 0) 41 return (st[0] >> 8) & 0xff 42} 43 44func main() -> i64 { 45 gp("=== nx_meet_publish_gate: R8-PREP publish readiness -- assembled, held, clean layout, sovereign ===\n" as *u8) 46 let RUNNER: *u8 = "_offc/nx_sov_build_run.elf\x00" as *u8 47 let SCR: *u8 = "knowledge/status/meet_publish_gate_scratch.log\x00" as *u8 48 49 // regenerate the full demo bundle (hermetic) then stage 50 spawn(RUNNER, "nx_meet_emit\x00" as *u8, 0 as *u8, SCR) 51 spawn(RUNNER, "nx_meet_jobs\x00" as *u8, 0 as *u8, SCR) 52 spawn(RUNNER, "nx_meet_intake\x00" as *u8, 0 as *u8, SCR) 53 spawn("/tmp/nx_meet_intake.sov.elf\x00" as *u8, "demo\x00" as *u8, "hire\x00" as *u8, SCR) 54 spawn(RUNNER, "nx_meet_about\x00" as *u8, 0 as *u8, SCR) 55 spawn(RUNNER, "nx_meet_publish\x00" as *u8, 0 as *u8, SCR) 56 57 let lp: *i64 = sys_mmap(16) as *i64; lp[0] = 0 58 let q: *u8 = sys_read_file("knowledge/publish/meet_stage_queue.tsv\x00" as *u8, lp) 59 if (q as i64) == 0 { gp("MEET-PUBLISH-GATE verdict=RED reason=queue-missing\n" as *u8); sys_exit(1); return 1 } 60 let n: i64 = lp[0] 61 gp(" staged rows (PENDING)=" as *u8); gn(gcount(q, n, "PENDING" as *u8)); gp(" held (outward)=" as *u8); gn(gcount(q, n, "outward" as *u8)); gp("\n" as *u8) 62 63 var pass: i64 = 0; var fail: i64 = 0 64 // all 10 staged + all held (fail-closed) 65 if gcount(q, n, "PENDING" as *u8) == 10 { pass=pass+1 } else { fail=fail+1; gp(" FAIL not-10-staged\n" as *u8) } 66 if gcount(q, n, "outward" as *u8) == 10 { pass=pass+1 } else { fail=fail+1; gp(" FAIL not-all-held\n" as *u8) } 67 // clean NAS layout present 68 if ghas(q, n, "/volume1/homes/elderwesto/nishihost/sites/meet/" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-nas-root\n" as *u8) } 69 if ghas(q, n, "index.html" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-index\n" as *u8) } 70 if ghas(q, n, "jobs.html" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-jobs\n" as *u8) } 71 if ghas(q, n, "apply.html" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-apply\n" as *u8) } 72 if ghas(q, n, "hire.html" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-hire\n" as *u8) } 73 if ghas(q, n, "about.html" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-about\n" as *u8) } 74 if ghas(q, n, "job-swe-001.html" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-job-detail\n" as *u8) } 75 if ghas(q, n, "job-ae-005.html" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-job-detail-2\n" as *u8) } 76 // TEETH: only HTML pages staged -- no editable DATA files leaked into the publish 77 if gfind(q, n, ".meet" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL leaked-dot-meet\n" as *u8) } 78 if gfind(q, n, ".openings" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL leaked-openings\n" as *u8) } 79 if gfind(q, n, ".about" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL leaked-about-data\n" as *u8) } 80 // spot-check two staged pages are sovereign 81 let lp2: *i64 = sys_mmap(16) as *i64; lp2[0] = 0 82 let h: *u8 = sys_read_file("web_assets/site_demo/index.html\x00" as *u8, lp2) 83 if (h as i64) != 0 { if gfind(h, lp2[0], "<script" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL home-has-script\n" as *u8) } } else { fail=fail+1; gp(" FAIL home-missing\n" as *u8) } 84 let lp3: *i64 = sys_mmap(16) as *i64; lp3[0] = 0 85 let hh: *u8 = sys_read_file("web_assets/site_demo/hire.html\x00" as *u8, lp3) 86 if (hh as i64) != 0 { if gfind(hh, lp3[0], "<script" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL hire-has-script\n" as *u8) } } else { fail=fail+1; gp(" FAIL hire-missing\n" as *u8) } 87 88 gp("MEET-PUBLISH-GATE pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail) 89 if fail == 0 { gp(" verdict=GREEN (10-page bundle assembled + HELD + clean layout + data-files-excluded + sovereign)\n" as *u8); sys_exit(0); return 0 } 90 gp(" verdict=RED\n" as *u8); sys_exit(1); return 1 91}