nx_meet_publish_gate.nx source

1import "nx_gate_gn.nx" 2// nx_meet_publish_gate.nx -- liar-kill gate for R8-PREP (publish readiness). Sovereign fork/exec: regenerate the 3// full demo bundle, run the stager, then assert the isolated staging queue holds ALL 10 pages, every row is HELD 4// (outward policy = fail-closed, nothing auto-deploys), the dest paths are the clean NAS layout, and ONLY HTML 5// pages were staged (no .meet/.openings/.about DATA files leaked). Spot-checks two pages are sovereign. expect_exit: 0 6import "nx_syscalls.nx" 7import "nx_gate_verdict.nx" 8 9func gp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 10func gslen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 11func gfind(hay: *u8, hl: i64, needle: *u8) -> i64 { 12 let nl: i64 = gslen(needle); if nl == 0 { return 0-1 } 13 var i: i64 = 0 14 while i + nl <= hl { var k: i64=0; var hit: i64=1; while k<nl { if hay[i+k]!=needle[k]{hit=0;k=nl}else{k=k+1} } if hit==1 {return i} i=i+1 } 15 return 0-1 16} 17func ghas(hay: *u8, hl: i64, needle: *u8) -> i64 { if gfind(hay, hl, needle) >= 0 { return 1 } return 0 } 18func gcount(hay: *u8, hl: i64, needle: *u8) -> i64 { 19 let nl: i64 = gslen(needle); if nl == 0 { return 0 } 20 var c: i64 = 0; var i: i64 = 0 21 while i + nl <= hl { var k: i64=0; var hit: i64=1; while k<nl { if hay[i+k]!=needle[k]{hit=0;k=nl}else{k=k+1} } if hit==1 {c=c+1; i=i+nl} else {i=i+1} } 22 return c 23} 24func spawn(path: *u8, a0: *u8, a1: *u8, redir: *u8) -> i64 { 25 let pid: i64 = sys_fork() 26 if pid == 0 { 27 let fd: i64 = sys_openat_wr(redir, 420) 28 if fd >= 0 { sys_dup3(fd, 1, 0); sys_dup3(fd, 2, 0) } 29 let argv: *i64 = sys_mmap(64) as *i64 30 var n: i64 = 0 31 argv[0] = path as i64; n = 1 32 if (a0 as i64) != 0 { argv[n] = a0 as i64; n = n + 1 } 33 if (a1 as i64) != 0 { argv[n] = a1 as i64; n = n + 1 } 34 argv[n] = 0 35 let envp: *i64 = sys_mmap(16) as *i64 36 envp[0] = "PATH=/usr/bin:/bin\x00" as *u8 as i64; envp[1] = 0 37 sys_execve(path, argv, envp) 38 sys_exit(127) 39 } 40 let st: *i64 = sys_mmap(16) as *i64 41 sys_wait4(pid, st, 0) 42 return (st[0] >> 8) & 0xff 43} 44 45func main() -> i64 { 46 gp("=== nx_meet_publish_gate: R8-PREP publish readiness -- assembled, held, clean layout, sovereign ===\n" as *u8) 47 let RUNNER: *u8 = "_offc/nx_sov_build_run.elf\x00" as *u8 48 let SCR: *u8 = "knowledge/status/meet_publish_gate_scratch.log\x00" as *u8 49 50 // regenerate the full demo bundle (hermetic) then stage 51 spawn(RUNNER, "nx_meet_emit\x00" as *u8, 0 as *u8, SCR) 52 spawn(RUNNER, "nx_meet_jobs\x00" as *u8, 0 as *u8, SCR) 53 spawn(RUNNER, "nx_meet_intake\x00" as *u8, 0 as *u8, SCR) 54 spawn("/tmp/nx_meet_intake.sov.elf\x00" as *u8, "demo\x00" as *u8, "hire\x00" as *u8, SCR) 55 spawn(RUNNER, "nx_meet_about\x00" as *u8, 0 as *u8, SCR) 56 spawn(RUNNER, "nx_meet_publish\x00" as *u8, 0 as *u8, SCR) 57 58 let lp: *i64 = sys_mmap(16) as *i64; lp[0] = 0 59 let q: *u8 = sys_read_file("knowledge/publish/meet_stage_queue.tsv\x00" as *u8, lp) 60 if (q as i64) == 0 { gp("MEET-PUBLISH-GATE verdict=RED reason=queue-missing\n" as *u8); sys_exit(1); return 1 } 61 let n: i64 = lp[0] 62 gp(" staged rows (PENDING)=" as *u8); gn(gcount(q, n, "PENDING" as *u8)); gp(" held (outward)=" as *u8); gn(gcount(q, n, "outward" as *u8)); gp("\n" as *u8) 63 64 var pass: i64 = 0; var fail: i64 = 0 65 // all 10 staged + all held (fail-closed) 66 if gcount(q, n, "PENDING" as *u8) == 10 { pass=pass+1 } else { fail=fail+1; gp(" FAIL not-10-staged\n" as *u8) } 67 if gcount(q, n, "outward" as *u8) == 10 { pass=pass+1 } else { fail=fail+1; gp(" FAIL not-all-held\n" as *u8) } 68 // clean NAS layout present 69 if ghas(q, n, "/volume1/homes/elderwesto/nishihost/sites/meet/" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-nas-root\n" as *u8) } 70 if ghas(q, n, "index.html" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-index\n" as *u8) } 71 if ghas(q, n, "jobs.html" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-jobs\n" as *u8) } 72 if ghas(q, n, "apply.html" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-apply\n" as *u8) } 73 if ghas(q, n, "hire.html" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-hire\n" as *u8) } 74 if ghas(q, n, "about.html" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-about\n" as *u8) } 75 if ghas(q, n, "job-swe-001.html" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-job-detail\n" as *u8) } 76 if ghas(q, n, "job-ae-005.html" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-job-detail-2\n" as *u8) } 77 // TEETH: only HTML pages staged -- no editable DATA files leaked into the publish 78 if gfind(q, n, ".meet" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL leaked-dot-meet\n" as *u8) } 79 if gfind(q, n, ".openings" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL leaked-openings\n" as *u8) } 80 if gfind(q, n, ".about" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL leaked-about-data\n" as *u8) } 81 // spot-check two staged pages are sovereign 82 let lp2: *i64 = sys_mmap(16) as *i64; lp2[0] = 0 83 let h: *u8 = sys_read_file("web_assets/site_demo/index.html\x00" as *u8, lp2) 84 if (h as i64) != 0 { if gfind(h, lp2[0], "<script" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL home-has-script\n" as *u8) } } else { fail=fail+1; gp(" FAIL home-missing\n" as *u8) } 85 let lp3: *i64 = sys_mmap(16) as *i64; lp3[0] = 0 86 let hh: *u8 = sys_read_file("web_assets/site_demo/hire.html\x00" as *u8, lp3) 87 if (hh as i64) != 0 { if gfind(hh, lp3[0], "<script" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL hire-has-script\n" as *u8) } } else { fail=fail+1; gp(" FAIL hire-missing\n" as *u8) } 88 89 gp("MEET-PUBLISH-GATE pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail) 90 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 91 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 92 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 93 let ctr__dry: *i64 = gv_ctr() 94 ctr__dry[0] = pass 95 ctr__dry[1] = pass + fail 96 let rc__dry: i64 = gv_verdict("MEET-PUBLISH-GATE" as *u8, ctr__dry, "10-page bundle assembled + HELD + clean layout + data-files-excluded + sovereign)" as *u8) 97 sys_exit(rc__dry) 98 return rc__dry 99}