code wiki / _hdl_build / nx_mgmt_api_gate.nx
`nx_mgmt_api_gate.nx` source

↩ module page · 707 lines · 46970 B
1// nx_mgmt_api_gate.nx -- SOVEREIGN in-process referee for the ecosystem control-plane API. NO socket, NO
2// curl, NO shell: arms a realm + registers an admin via the real Modern Auth, writes snapshot FIXTURES via
3// syscalls, then feeds crafted HTTP request BYTES straight into the pure router ma_handle and asserts the
4// response bytes. Proves the "true monitoring, no false +/-" property mechanically:
5//   T1  GET  /api                       -> 200 + route index            (public)
6//   T2  POST /api/login (correct)       -> 200 + {"token":...}          (mint no-cookie session)
7//   T3  GET  /api/health  (degraded) +tok -> 200 DEGRADED + dueling-supervisors + crash-loop  (no false-GREEN)
8//   T4  GET  /api/health  NO tok        -> 401                          (infra state default-deny)
9//   T5  GET  /api/services(degraded) +tok -> 200 + the down/loop svc + "dup":1                 (per-svc truth)
10//   T6  POST /api/deploy  NO tok        -> 401                          (privileged route GUARDED)
11//   T7  POST /api/deploy  +tok          -> 501                          (route reserved; honest, not faked)
12//   T8  GET  /api/health  (healthy) +tok -> 200 + overall OK            (no false-RED)
13//   T9  GET  /api/bogus                 -> 404
14//   T10 GET  /api/health  (MISSING snap) +tok -> 200 + UNKNOWN + no-snapshot                   (no false-GREEN on absent data)
15// GREEN iff T1..T10 hold. Sovereign: nx_mgmt_api + nx_modern_auth_flow + nx_syscalls. license_tier: ORIGINAL
16import "nx_mgmt_api.nx"
17import "nx_gate_verdict.nx"   // D001 MIGRATE-ON-TOUCH: the verdict must be READABLE by nx_gate_green
18
19// The check count was an inline literal in two places (`pass == 20` and the text "pass=20/20"), so adding a
20// tooth meant remembering to edit a string. One declared constant, per rule 11.
21//
22// ⚠CORRECTED 20 -> 22 ON 2026-08-07, AND THE OLD VALUE MADE THIS GATE RED-BY-CONSTRUCTION. Twenty-two teeth
23// actually execute: the T12b and T12c rows were added without bumping the count, so the success condition
24// `pass == 20` was UNREACHABLE -- with every single tooth passing the gate still printed RED (observed:
25// "passed 22/20"). Nothing noticed because the gate had ALSO never been compiled, so it emitted exit 127
26// NOT-FOUND rather than a verdict anyone read.
27// ★A GATE WHOSE PASS CONDITION CANNOT BE REACHED IS NOT STRICT, IT IS BROKEN -- AND IT IS INDISTINGUISHABLE
28// FROM A GATE THAT IS MERELY FAILING, WHICH IS WHY A DECLARED COUNT MUST BE ASSERTED AGAINST THE EXECUTED ONE.
29const MG_CHECKS: i64 = 22
30import "hub/nx_modern_auth_flow.nx"
31import "nx_syscalls.nx"
32
33func g_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
34func g_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
35func g_row(name: *u8, ok: i64) -> i64 {
  if ok == 1 { g_w("  PASS " as *u8) }
  if ok != 1 { g_w("  FAIL " as *u8) }
  g_w(name)
  g_w("\n" as *u8)
  return ok
41}
42func g_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o + i] = s[i]; i = i + 1 } return o + i }
43func g_find(hay: *u8, hn: i64, ndl: *u8) -> i64 { var nl: i64=0; while ndl[nl]!=(0 as u8){nl=nl+1} if nl==0 { return 0-1 } var s: i64=0; while s+nl<=hn { var m: i64=1; var k: i64=0; while k<nl { if hay[s+k]!=ndl[k] { m=0; k=nl } else { k=k+1 } } if m==1 { return s } s=s+1 } return 0-1 }
44func g_cat_n(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { d[o + i] = s[i]; i = i + 1 } return o + n }
45func g_trunc(path: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x180); if fd >= 0 { sys_close(fd) } return 0 }
46func g_log(s: *u8) -> i64 {
  let fd: i64 = sys_openat_append("knowledge/status/mgmt_api_gate.log" as *u8, 0x1a4)
  if fd >= 0 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); sys_close(fd) }
  return 0
50}
51func g_write_file(path: *u8, s: *u8) -> i64 {
  let fd: i64 = sys_openat_wr(path, 0x180)
  if fd < 0 { return 0 - 1 }
  sys_write(fd, s, g_len(s))
  sys_close(fd)
  return 0
57}
58func g_starts(buf: *u8, n: i64, s: *u8) -> i64 {
  let sn: i64 = g_len(s)
  if n < sn { return 0 }
  var i: i64 = 0
  while i < sn { if (buf[i] as i64) != (s[i] as i64) { return 0 } i = i + 1 }
  return 1
64}
65func g_contains(hay: *u8, n: i64, needle: *u8) -> i64 {
  let nn: i64 = g_len(needle)
  var i: i64 = 0
  while i + nn <= n {
      var m: i64 = 1
      var j: i64 = 0
      while j < nn { if (hay[i + j] as i64) != (needle[j] as i64) { m = 0; j = nn } else { j = j + 1 } }
      if m == 1 { return 1 }
      i = i + 1
  }
  return 0
76}
77func g_extract_token(resp: *u8, n: i64, out: *u8) -> i64 {
  let key: *u8 = "{\"token\":\"" as *u8
  let kn: i64 = 10
  var start: i64 = 0 - 1
  var i: i64 = 0
  while i + kn <= n {
      var m: i64 = 1
      var j: i64 = 0
      while j < kn { if (resp[i + j] as i64) != (key[j] as i64) { m = 0; j = kn } else { j = j + 1 } }
      if m == 1 { start = i + kn; i = n }
      i = i + 1
  }
  if start < 0 { return 0 }
  var w: i64 = 0
  var k: i64 = start
  var done: i64 = 0
  while done == 0 {
      if k >= n { done = 1 }
      if done == 0 { if (resp[k] as i64) == 34 { done = 1 } }
      if done == 0 { out[w] = resp[k]; w = w + 1; k = k + 1 }
  }
  return w
99}
100
101
102func mg_args_case(label: *u8, input: *u8, encoded: i64, cap: i64, maxargs: i64, expected: i64, ctr: *i64) -> i64 {
  let buf: *u8 = sys_mmap(MA_MAGIC_4096)
  let av: *i64 = sys_mmap(MA_MAGIC_4096) as *i64
  let got: i64 = ma_organ_args_parse(input, sd_len(input), encoded, buf, cap, av, maxargs)
  gv_check(label, got == expected, ctr)
  return 0
108}
109func mg_args_gate() -> i64 {
  let ctr: *i64 = gv_ctr()
  let buf: *u8 = sys_mmap(MA_MAGIC_4096)
  let av: *i64 = sys_mmap(MA_MAGIC_4096) as *i64
  let form: *u8 = "args_encoding=percent-v1&args=https%3A%2F%2Fnishifamily.com%2Fcompare%2Ftoolchain%2F+--hdr+Accept-Encoding%3A%20identity" as *u8
  let n: i64 = ma_organ_args_form(form, sd_len(form), buf, MA_MAGIC_4000, av, MA_ORGAN_MAXARGS)
  gv_check("encoded form produces three arguments" as *u8, n == 3, ctr)
  if n == 3 {
      gv_check("URL punctuation preserved" as *u8, g_contains(av[0] as *u8, sd_len(av[0] as *u8), "https://nishifamily.com/compare/toolchain/" as *u8) == 1, ctr)
      gv_check("header flag preserved" as *u8, sd_len(av[1] as *u8) == 5, ctr)
      gv_check("encoded space remains inside header argument" as *u8, g_contains(av[2] as *u8, sd_len(av[2] as *u8), "Accept-Encoding: identity" as *u8) == 1, ctr)
      gv_check("argv terminator" as *u8, av[3] == 0, ctr)
  }
  mg_args_case("legacy arguments retained", "buildroot+../sites/nishifamily/compare/+--domain+toolchain", 0, MA_MAGIC_4000, MA_ORGAN_MAXARGS, 4, ctr)
  mg_args_case("legacy URL rejected rather than corrupted", "https://nishifamily.com/", 0, MA_MAGIC_4000, MA_ORGAN_MAXARGS, MA_OA_INVALID, ctr)
  mg_args_case("legacy percent rejected rather than corrupted", "a%20b", 0, MA_MAGIC_4000, MA_ORGAN_MAXARGS, MA_OA_INVALID, ctr)
  mg_args_case("empty input", "", 1, MA_MAGIC_4000, MA_ORGAN_MAXARGS, 0, ctr)
  mg_args_case("repeated separators", " ++ a ++ b + ", 1, MA_MAGIC_4000, MA_ORGAN_MAXARGS, 2, ctr)
  mg_args_case("short percent refused", "a%", 1, MA_MAGIC_4000, MA_ORGAN_MAXARGS, MA_OA_ENCODING, ctr)
  mg_args_case("one hex digit refused", "%2", 1, MA_MAGIC_4000, MA_ORGAN_MAXARGS, MA_OA_ENCODING, ctr)
  mg_args_case("nonhex refused", "%gg", 1, MA_MAGIC_4000, MA_ORGAN_MAXARGS, MA_OA_ENCODING, ctr)
  mg_args_case("NUL refused", "%00", 1, MA_MAGIC_4000, MA_ORGAN_MAXARGS, MA_OA_INVALID, ctr)
  mg_args_case("newline refused", "%0a", 1, MA_MAGIC_4000, MA_ORGAN_MAXARGS, MA_OA_INVALID, ctr)
  mg_args_case("DEL refused", "%7f", 1, MA_MAGIC_4000, MA_ORGAN_MAXARGS, MA_OA_INVALID, ctr)
  mg_args_case("argument overflow refused", "a+b", 1, MA_MAGIC_4000, 1, MA_OA_CAPACITY, ctr)
  mg_args_case("exact byte capacity includes terminator", "abc", 1, 4, MA_ORGAN_MAXARGS, 1, ctr)
  mg_args_case("byte overflow refused", "abcd", 1, 4, MA_ORGAN_MAXARGS, MA_OA_CAPACITY, ctr)
  mg_args_case("second token overflow refused", "abc+d", 1, 4, MA_ORGAN_MAXARGS, MA_OA_CAPACITY, ctr)
  let one: *u8 = "%2b%25%26%3d%22" as *u8
  let on: i64 = ma_organ_args_parse(one, sd_len(one), 1, buf, MA_MAGIC_4000, av, MA_ORGAN_MAXARGS)
  gv_check("encoded punctuation stays in one token" as *u8, on == 1, ctr)
  gv_check("plus percent ampersand equals quote preserved" as *u8, buf[0] == (43 as u8) && buf[1] == (37 as u8) && buf[2] == (38 as u8) && buf[3] == (61 as u8) && buf[4] == (34 as u8) && buf[5] == (0 as u8), ctr)
  let bad: *u8 = "args_encoding=unknown&args=x" as *u8
  gv_check("unknown form encoding refused" as *u8, ma_organ_args_form(bad,sd_len(bad),buf,MA_MAGIC_4000,av,MA_ORGAN_MAXARGS) == MA_OA_ENCODING, ctr)
  return gv_verdict("MGMT-ORGAN-ARGS" as *u8, ctr, "actual API parser preserves complete tokens or refuses before execution" as *u8)
144}
145func mg_release_identity_gate(expected: *u8) -> i64 {
  let ctr: *i64=gv_ctr()
  let out: *u8=sys_mmap(SD_OUTCAP)
  let n: i64=ma_release_identity(out)
  gv_check("executing artifact identity is HTTP 200",g_starts(out,n,"HTTP/1.1 200") == 1,ctr)
  gv_check("identity names executing inode basis",g_contains(out,n,"\"basis\":\"running-executable\"") == 1,ctr)
  gv_check("identity is versioned",g_contains(out,n,"\"schema\":\"nishi.release-identity.v1\"") == 1,ctr)
  let prefix: *u8="\"sha256\":\""
  let cap: i64=sd_len(prefix)+sd_len(expected)+2
  let needle: *u8=sys_mmap(cap)
  var w: i64=sd_cat(needle,0,prefix)
  w=sd_cat(needle,w,expected);w=sd_cat(needle,w,"\"");needle[w]=0 as u8
  gv_check("digest matches independently hashed gate executable",sd_len(expected) == 64 && g_contains(out,n,needle) == 1,ctr)
  let first: i64=sd_len(prefix)
  if needle[first] == (48 as u8) { needle[first]=49 as u8 } else { needle[first]=48 as u8 }
  gv_check("different executable digest cannot match",g_contains(out,n,needle) == 0,ctr)
  let req: *u8="GET /api/release_identity HTTP/1.1\r\nHost: localhost\r\n\r\n"
  let denied: i64=ma_handle(0 as *NxAuthContext,req,sd_len(req),"",out)
  gv_check("exact identity route requires authentication",g_starts(out,denied,"HTTP/1.1 401") == 1,ctr)
  gv_check("unauthenticated response does not disclose digest",g_contains(out,denied,"\"sha256\"") == 0,ctr)
  let spec: i64=ma_openapi(out)
  gv_check("OpenAPI advertises identity route",g_contains(out,spec,"\"/api/release_identity\"") == 1,ctr)
  gv_check("route index advertises identity route",g_contains(MA_ROUTES,sd_len(MA_ROUTES),"/api/release_identity") == 1,ctr)
  sys_munmap(needle,cap);sys_munmap(out,SD_OUTCAP)
  return gv_verdict("MGMT-RELEASE-IDENTITY",ctr,"real executing inode hash and real request router; network readiness is qualified separately")
170}
171
172// Real filesystem refusal fixture: occupied rollback directories prevent banking.
173func mg_tc_fixture_elf(path: *u8, tag: i64) -> i64 {
  let buf: *u8=sys_mmap(MD_TC_MIN_ELF)
  buf[0]=127 as u8; buf[1]=69 as u8; buf[2]=76 as u8; buf[3]=70 as u8; buf[4]=tag as u8
  let fd: i64=sys_openat_wr(path,0x180)
  if fd < 0 { return 1 }
  let n: i64=sys_write(fd,buf,MD_TC_MIN_ELF)
  sys_close(fd); sys_munmap(buf,MD_TC_MIN_ELF)
  if n != MD_TC_MIN_ELF { return 1 }
  return 0
182}
183func mg_tc_tag(path: *u8) -> i64 {
  let fd: i64=sys_openat_rd(path)
  if fd < 0 { return 0-1 }
  let buf: *u8=sys_mmap(16)
  let n: i64=sys_read(fd,buf,5)
  sys_close(fd)
  if n != 5 { return 0-1 }
  return buf[4] as i64
191}
192func mg_tc_bank_gate() -> i64 {
  sys_mkdir("_build/toolchain-bank-qualification",0x1c0)
  if sys_chdir("_build/toolchain-bank-qualification") != 0 { return 1 }
  sys_mkdir("buildroot",0x1c0); sys_mkdir("buildroot/_offc",0x1c0)
  let live: *u8="buildroot/_offc/nx_cc_sovereign.elf"
  let stage: *u8="nx_cc_sovereign.elf.new"
  let prev: *u8="buildroot/_offc/nx_cc_sovereign.elf.prev"
  sys_mkdir(prev,0x1c0)
  sys_mkdir("buildroot/_offc/nx_cc_sovereign.elf.prev2",0x1c0)
  if g_write_file("buildroot/_offc/nx_cc_sovereign.elf.prev/marker","retained") != 0 { return 1 }
  if g_write_file("buildroot/_offc/nx_cc_sovereign.elf.prev2/marker","retained") != 0 { return 1 }
  if mg_tc_fixture_elf(live,65) != 0 { return 1 }
  if mg_tc_fixture_elf(stage,66) != 0 { return 1 }
  let ctr: *i64=gv_ctr()
  let rc: i64=md_tc_install("nx_cc_sovereign.elf")
  gv_check("rollback banking failure refuses installation",rc < 0,ctr)
  gv_check("bank refusal preserves live bytes",mg_tc_tag(live) == 65,ctr)
  gv_check("bank refusal preserves staged bytes",mg_tc_tag(stage) == 66,ctr)
  gv_check("earlier rollback contents preserved",ma_path_exists("buildroot/_offc/nx_cc_sovereign.elf.prev/marker") == 1,ctr)
  gv_check("older rollback contents preserved",ma_path_exists("buildroot/_offc/nx_cc_sovereign.elf.prev2/marker") == 1,ctr)
  let out: *u8=sys_mmap(SD_OUTCAP)
  let installed: *i64=sys_mmap(16) as *i64
  let n: i64=ma_tc_install_checked("nx_cc_sovereign.elf",out,installed)
  gv_check("backup refusal has explicit API cause",g_contains(out,n,"TOOLCHAIN_BACKUP_FAILED") == 1,ctr)
  gv_check("backup refusal reports canary not started",g_contains(out,n,"\"canary_started\":false") == 1,ctr)
  sys_mkdir("positive",0x1c0)
  if sys_chdir("positive") != 0 { return 1 }
  sys_mkdir("buildroot",0x1c0); sys_mkdir("buildroot/_offc",0x1c0)
  if mg_tc_fixture_elf(live,65) != 0 { return 1 }
  if mg_tc_fixture_elf(stage,66) != 0 { return 1 }
  if mg_tc_fixture_elf(prev,64) != 0 { return 1 }
  let good: i64=md_tc_install("nx_cc_sovereign.elf")
  gv_check("valid backup permits installation",good == MD_TC_MIN_ELF,ctr)
  gv_check("successful install has candidate bytes",mg_tc_tag(live) == 66,ctr)
  gv_check("successful install banks outgoing bytes",mg_tc_tag(prev) == 65,ctr)
  gv_check("successful install retains older backup",mg_tc_tag("buildroot/_offc/nx_cc_sovereign.elf.prev2") == 64,ctr)
  let rollback: i64=md_tc_rollback("nx_cc_sovereign.elf")
  gv_check("rollback restores outgoing bytes",rollback == 1 && mg_tc_tag(live) == 65,ctr)
  return gv_verdict("MGMT-TOOLCHAIN-BANK",ctr,"actual filesystem refusal, positive install and rollback; isolated fixture only")
231}
232
233// Actual management handler gate. Fixture registry is isolated in a unique temporary directory;
234// its only executable is the already-vetted, side-effect-free argecho organ.
235func oa_contains(b:*u8,n:i64,s:*u8)->i64{let z:i64=sd_len(s);var p:i64=0;while p+z<=n{var k:i64=0;while k<z{if b[p+k]!=s[k]{break};k=k+1};if k==z{return 1};p=p+1};return 0}
236func oa_call(form:*u8,out:*u8)->i64 {
let req:*u8=sys_mmap(sd_len(form)+512);var n:i64=sd_cat(req,0,"POST /api/organ_run HTTP/1.1\r\nHost: localhost\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: ")
n=sd_catn(req,n,sd_len(form));n=sd_cat(req,n,"\r\n\r\n");n=sd_cat(req,n,form)
return ma_do_organ_run(req,n,out)
240}
241func oa_refuse(c:*i64,label:*u8,form:*u8,out:*u8)->i64 {
let n:i64=oa_call(form,out)
gv_check(label,oa_contains(out,n,"HTTP/1.1 400")==1&&oa_contains(out,n,"NX_TOOL_ARGECHO_OK")==0,c);return 0
244}
245func mg_organ_capacity_gate()->i64 {
let c:*i64=gv_ctr();gv_head("MGMT-ORGAN-ACTUAL-HANDLER-CAPACITY")
let dir:*u8=sys_mmap(256);var dn:i64=sd_cat(dir,0,"/tmp/nishi-organ-args-gate-");dn=sd_catn(dir,dn,sys_now_ms());dir[dn]=0 as u8
if sys_mkdir(dir,448)!=0{return 2};if sys_chdir(dir)!=0{return 2}
let reg:*u8="argecho\t/volume1/homes/elderwesto/nishihost/nx_tool_argecho.elf\tGREEN\npinned_echo\t/volume1/homes/elderwesto/nishihost/nx_tool_argecho.elf\tGREEN\tPINNED first second third fourth fifth sixth seventh eighth ninth tenth eleventh twelfth thirteenth\n"
let fd:i64=sys_openat_exclusive("tool_allowlist.conf",384);if fd<0{return 2}
if sys_write(fd,reg,sd_len(reg))!=sd_len(reg){sys_close(fd);return 2};sys_close(fd)
let out:*u8=sys_mmap(SD_OUTCAP);let form:*u8=sys_mmap(16384)
var z:i64=sd_cat(form,0,"target=argecho&confirm=yes&args_encoding=percent-v1&args=");var i:i64=1
while i<=20{if i>1{z=sd_cat(form,z,"+")};z=sd_cat(form,z,"argument");z=sd_catn(form,z,i);i=i+1};form[z]=0 as u8
var n:i64=oa_call(form,out)
gv_check("twenty arguments execute",oa_contains(out,n,"HTTP/1.1 200")==1&&oa_contains(out,n,"\"argc\":20")==1&&oa_contains(out,n,"\"exit_code\":0")==1&&oa_contains(out,n,"argument20")==1,c)
n=oa_call(form,out)
gv_check("same safe request repeatable",oa_contains(out,n,"\"argc\":20")==1&&oa_contains(out,n,"argument20")==1,c)
z=sd_cat(form,0,"target=argecho&confirm=yes&args_encoding=percent-v1&args=")
i=0;while i<5001{form[z]=65 as u8;z=z+1;i=i+1};form[z]=0 as u8
n=oa_call(form,out);var count:i64=0;i=0;while i<n{if out[i]==65 as u8{count=count+1};i=i+1}
gv_check("5001-byte argument not truncated",oa_contains(out,n,"HTTP/1.1 200")==1&&oa_contains(out,n,"\"argc\":1")==1&&oa_contains(out,n,"\"exit_code\":0")==1&&count>=5001,c)
n=oa_call("target=argecho&confirm=yes&args_encoding=percent-v1&args=plus%2Bpercent%25+space%20inside+amp%26equals%3D+quote%22",out)
gv_check("encoded delimiters preserve four tokens",oa_contains(out,n,"\"argc\":4")==1&&oa_contains(out,n,"plus+percent%")==1&&oa_contains(out,n,"space inside")==1&&oa_contains(out,n,"amp&equals=")==1&&oa_contains(out,n,"quote\\\"")==1,c)
n=oa_call("target=pinned_echo&confirm=yes&args_encoding=percent-v1&args=CALLER_MUST_NOT_APPEAR%00",out)
gv_check("pinned fourteen args override caller",oa_contains(out,n,"\"argc\":14")==1&&oa_contains(out,n,"thirteenth")==1&&oa_contains(out,n,"CALLER_MUST_NOT_APPEAR")==0&&oa_contains(out,n,"\"exit_code\":0")==1,c)
n=oa_call("target=argecho&confirm=yes",out)
gv_check("zero args remain valid",oa_contains(out,n,"\"argc\":0")==1&&oa_contains(out,n,"\"exit_code\":0")==1,c)
oa_refuse(c,"malformed percent refuses","target=argecho&confirm=yes&args_encoding=percent-v1&args=%gg",out)
oa_refuse(c,"NUL refuses","target=argecho&confirm=yes&args_encoding=percent-v1&args=%00",out)
oa_refuse(c,"newline refuses","target=argecho&confirm=yes&args_encoding=percent-v1&args=%0a",out)
oa_refuse(c,"unknown encoding refuses","target=argecho&confirm=yes&args_encoding=other&args=x",out)
oa_refuse(c,"legacy unsafe byte refuses","target=argecho&confirm=yes&args=a;b",out)
oa_refuse(c,"confirmation required","target=argecho&args_encoding=percent-v1&args=x",out)
oa_refuse(c,"unlisted executable refuses","target=not_registered&confirm=yes&args=x",out)
gv_check("optional allocation rejects zero", (sys_mmap_try(0) as i64)==0,c)
gv_check("optional allocation rejects negative", (sys_mmap_try(-1) as i64)==0,c)
gv_check("kernel-impossible mapping refuses without process death", (sys_mmap_try(NX_RA_SIZE_MAX) as i64)==0,c)
let mapping:*u8=sys_mmap_try(4096)
gv_check("optional allocation succeeds zeroed", (mapping as i64)>0&&mapping[0]==0 as u8,c)
if (mapping as i64)>0{mapping[0]=77 as u8;sys_munmap(mapping,4096)}
n=ma_do_organ_run(0 as *u8,0,out)
gv_check("null request refuses before dereference",oa_contains(out,n,"ORGAN_REQUEST_BOUNDS")==1,c)
n=ma_do_organ_run("x",NX_RA_SIZE_MAX,out)
gv_check("overflow-sized request refuses before reading",oa_contains(out,n,"ORGAN_REQUEST_BOUNDS")==1,c)
n=ma_do_organ_run("x",-1,out)
gv_check("negative request length refuses",oa_contains(out,n,"ORGAN_REQUEST_BOUNDS")==1,c)
return gv_verdict("MGMT-ORGAN-ACTUAL-HANDLER-CAPACITY",c,"Actual canonical ma_do_organ_run, safe child argv witness, isolated registry, complete admitted arguments or refusal.")
289}
290
291func main(argc: i64, argv: *i64) -> i64 {
  if argc > 1 { if md_streq(argv[1] as *u8,"organ-capacity") == 1 { return mg_organ_capacity_gate() } }
  if argc > 1 { if md_streq(argv[1] as *u8,"toolchain-bank") == 1 { return mg_tc_bank_gate() } }
  if argc > 2 { if md_streq(argv[1] as *u8,"release-identity") == 1 { return mg_release_identity_gate(argv[2] as *u8) } }
  if argc > 1 { if g_contains(argv[1] as *u8, sd_len(argv[1] as *u8), "organ-args" as *u8) == 1 { return mg_args_gate() } }
  return mg_api_legacy_main()
297}
298
299func mg_api_legacy_main() -> i64 {
  g_w("mgmt-api SOVEREIGN in-process gate (no socket/curl/shell -- ma_handle bytes-in/bytes-out)\n" as *u8)
  let store_path: *u8 = "/tmp/nx_ma_gate_store.log" as *u8
  let keys_path: *u8 = "/tmp/nx_ma_gate_keys.log" as *u8
  let deg: *u8 = "/tmp/nx_ma_degraded.snap" as *u8
  let hea: *u8 = "/tmp/nx_ma_healthy.snap" as *u8
  let miss: *u8 = "/tmp/nx_ma_missing.snap" as *u8
  g_trunc(store_path)
  g_trunc(keys_path)
308
  // ---- snapshot fixtures via syscalls (NOT a shell). degraded = duel + dup + loop + down. ----
  if g_write_file(deg, "SUP 2\nSVC sites.elf 8443 UP 2 0 12\nSVC nx_gallery_serve 18090 DOWN 0 6 40\nSVC nx_vroom_daemon 0 HUNG 1 5 33\n" as *u8) != 0 { g_w("FIXTURE FAIL\n" as *u8); sys_exit(1) }
  if g_write_file(hea, "SUP 1\nSVC sites.elf 8443 UP 1 0 3\nSVC nx_gallery_serve 18090 UP 1 0 4\n" as *u8) != 0 { g_w("FIXTURE FAIL\n" as *u8); sys_exit(1) }
  // miss is deliberately NOT created.
313
  // ---- arm a realm + register an admin via the real Modern Auth ----
  let oprf_seed: *u8 = sys_mmap(32)
  let akp: *u8 = sys_mmap(32)
  let akb: *u8 = sys_mmap(33)
  let edp: *u8 = sys_mmap(32)
  let edb: *u8 = sys_mmap(32)
  if nx_uas_server_keys_load_or_init(keys_path, oprf_seed, akp, akb, edp, edb) != NX_UAS_OK { g_w("KEYS FAIL\n" as *u8); sys_exit(1) }
  let realm: *u8 = "nishi_mgmt_admin" as *u8
  let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext
  if nx_auth_context_init(ctx, realm, 16, realm, 16, store_path as i64, oprf_seed, edp, edb, 900, 8192, 1, 1, 5, 1) != NX_MAUTH_OK { g_w("CTX FAIL\n" as *u8); sys_exit(1) }
  let mn: *u8 = sys_mmap(512)
  let mn_n: *i64 = sys_mmap(16) as *i64
  if nx_modern_auth_register(ctx, "elder" as *u8, 5, "correct horse battery staple" as *u8, 28, mn, 512, mn_n) != NX_MAUTH_OK { g_w("REGISTER FAIL\n" as *u8); sys_exit(1) }
327
  let req: *u8 = sys_mmap(8192)
  let out: *u8 = sys_mmap(SD_OUTCAP)
  var pass: i64 = 0
331
  // ---- T1: GET /api -> 200 + index ----
  var n1: i64 = g_cat(req, 0, "GET /api HTTP/1.1\r\nHost: x\r\n\r\n" as *u8)
  let o1: i64 = ma_handle(ctx, req, n1, deg, out)
  var t1: i64 = 0
  if g_starts(out, o1, "HTTP/1.1 200" as *u8) == 1 { if g_contains(out, o1, "nishi-mgmt" as *u8) == 1 { t1 = 1 } }
  pass = pass + g_row("T1 GET /api -> 200 + route index\x00" as *u8, t1)
338
  // ---- T2: POST /api/login (correct) -> 200 + token ----
  var n2: i64 = g_cat(req, 0, "POST /api/login HTTP/1.1\r\nHost: x\r\n\r\nhandle=elder&passphrase=correct+horse+battery+staple" as *u8)
  let o2: i64 = ma_handle(ctx, req, n2, deg, out)
  var t2: i64 = 0
  let tokbuf: *u8 = sys_mmap(256)
  var tok_n: i64 = 0
  if g_starts(out, o2, "HTTP/1.1 200" as *u8) == 1 {
      tok_n = g_extract_token(out, o2, tokbuf)
      if tok_n > 0 { t2 = 1 }
  }
  pass = pass + g_row("T2 POST /api/login ok -> 200 + token\x00" as *u8, t2)
350
  // ---- T3: GET /api/health (degraded) WITH token -> 200 DEGRADED + duel + loop (no false-GREEN) ----
  var n3: i64 = g_cat(req, 0, "GET /api/health HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8)
  n3 = g_cat_n(req, n3, tokbuf, tok_n)
  n3 = g_cat(req, n3, "\r\n\r\n" as *u8)
  // SUBJECT SPLIT 2026-08-07. This tooth existed to prove MONITORING TRUTH, and it was asserting that
  // through the AUTHORIZED route -- so when access levels arrived it began failing for a reason that has
  // nothing to do with its subject: ma_level_of resolves the level via ag_uid_to_level(uid, MA_IDX,
  // MA_ROLES) at ABSOLUTE paths, this gate registers a SYNTHETIC admin in a /tmp store, that uid is not in
  // the production index, so deny-by-default gives level 0 < MA_LVL_READ=2 and the router answers 403
  // BEFORE the emitter ever runs. The API is CORRECT; a gate must never write production auth files to buy
  // itself a level. So assert the subject where it actually lives: the emitter is a pure function.
  // TEST THE SUBJECT, NOT THE ROUTE THAT HAPPENS TO REACH IT.
  let o3: i64 = ma_emit_health_file(deg, out)
  var t3: i64 = 0
  if g_starts(out, o3, "HTTP/1.1 200" as *u8) == 1 {
      if g_contains(out, o3, "\"overall\":\"DEGRADED\"" as *u8) == 1 {
          if g_contains(out, o3, "dueling-supervisors" as *u8) == 1 {
              if g_contains(out, o3, "crash-loop:" as *u8) == 1 { t3 = 1 }
          }
      }
  }
  pass = pass + g_row("T3 health(degraded) EMITTER -> DEGRADED + duel + crash-loop (no false-GREEN)\x00" as *u8, t3)
  // A GATE THAT REPORTS A BOOLEAN CANNOT SAY WHY. Every token-replaying tooth here fails while every
  // no-token tooth passes and T2 mints a token successfully -- one root cause wearing eleven masks -- but
  // the assertions only compare against "HTTP/1.1 200", so the actual status and error body were invisible.
  // T3 is the first token tooth, so its response DIAGNOSES the whole class. Printed only on FAIL: a
  // diagnostic that fires on success is noise, one that never fires is decoration.
  if t3 == 0 {
      g_w("    DIAG-T3 actual response head >>> " as *u8)
      var dn: i64 = o3
      if dn > 300 { dn = 300 }
      sys_write(1, out, dn)
      g_w(" <<<\n" as *u8)
      g_w("    DIAG-T3 token_bytes=" as *u8)
      gv_num(tok_n)
      g_w("\n" as *u8)
  }
388
  // ---- T4: GET /api/health NO token -> 401 ----
  var n4: i64 = g_cat(req, 0, "GET /api/health HTTP/1.1\r\nHost: x\r\n\r\n" as *u8)
  let o4: i64 = ma_handle(ctx, req, n4, deg, out)
  var t4: i64 = 0
  if g_starts(out, o4, "HTTP/1.1 401" as *u8) == 1 { t4 = 1 }
  pass = pass + g_row("T4 GET /api/health NO token -> 401 (default-deny)\x00" as *u8, t4)
395
  // ---- T5: GET /api/services (degraded) WITH token -> 200 + svc truth ----
  var n5: i64 = g_cat(req, 0, "GET /api/services HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8)
  n5 = g_cat_n(req, n5, tokbuf, tok_n)
  n5 = g_cat(req, n5, "\r\n\r\n" as *u8)
  // SUBJECT SPLIT (see T3): per-service truth is the emitter's job, not the authorizer's.
  let o5: i64 = ma_emit_services_file(deg, out)
  var t5: i64 = 0
  if g_starts(out, o5, "HTTP/1.1 200" as *u8) == 1 {
      if g_contains(out, o5, "nx_vroom_daemon" as *u8) == 1 {
          if g_contains(out, o5, "\"dup\":1" as *u8) == 1 { t5 = 1 }
      }
  }
  pass = pass + g_row("T5 services(degraded) EMITTER -> per-svc truth (dup flagged)\x00" as *u8, t5)
409
  // ---- T6: POST /api/deploy NO token -> 401 (privileged guarded) ----
  var n6: i64 = g_cat(req, 0, "POST /api/deploy HTTP/1.1\r\nHost: x\r\n\r\n{}" as *u8)
  let o6: i64 = ma_handle(ctx, req, n6, deg, out)
  var t6: i64 = 0
  if g_starts(out, o6, "HTTP/1.1 401" as *u8) == 1 { t6 = 1 }
  pass = pass + g_row("T6 POST /api/deploy NO token -> 401 (privileged guarded)\x00" as *u8, t6)
416
  // ---- T7-T19 AUTHORIZATION, re-aimed 2026-08-07 ------------------------------------------------------
  // These seven teeth were written to prove HANDLER fail-closed behaviour (no-target -> 400, no-confirm ->
  // 400, migrate -> 501) through an authorized session. Access levels arrived afterwards: this gate mints a
  // session for a SYNTHETIC admin whose uid is absent from MA_IDX, so deny-by-default yields level 0 and
  // every privileged route answers 403 before its handler runs. That is CORRECT, and a gate must never
  // write production auth files to buy itself a level.
  // SO THEY NOW PROVE A DIFFERENT AND STILL-REAL PROPERTY, ONE PER ROUTE: this route IS level-gated. A route
  // that forgot its ma_level_of check would answer 400/501 here and FAIL -- which is exactly the regression
  // worth catching on a control plane, and it is per-route coverage the old shape never had.
  // COVERAGE HONESTLY DECLARED, NOT SILENTLY DROPPED: the handler fail-closed logic these used to reach is
  // covered by the UNIT teeth that pass today -- T12 md_resolve_target, T12b md_hostctl_action_ok, T20
  // md_restart_sub. What is NOT covered any more is the end-to-end route->handler path for a PRIVILEGED
  // session, and it cannot be from inside a synthetic realm.
  // ---- T7: POST /api/deploy WITH token, NO target -> 400 (real handler, fail-closed; NOTHING promoted) ----
  var n7: i64 = g_cat(req, 0, "POST /api/deploy HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8)
  n7 = g_cat_n(req, n7, tokbuf, tok_n)
  n7 = g_cat(req, n7, "\r\n\r\n" as *u8)
  let o7: i64 = ma_handle(ctx, req, n7, deg, out)
  var t7: i64 = 0
  if g_starts(out, o7, "HTTP/1.1 403" as *u8) == 1 { t7 = 1 }
  pass = pass + g_row("T7 /api/deploy is LEVEL-GATED: level-0 session -> 403\x00" as *u8, t7)
438
  // ---- T8: GET /api/health (healthy) WITH token -> 200 + overall OK (no false-RED) ----
  var n8: i64 = g_cat(req, 0, "GET /api/health HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8)
  n8 = g_cat_n(req, n8, tokbuf, tok_n)
  n8 = g_cat(req, n8, "\r\n\r\n" as *u8)
  // SUBJECT SPLIT (see T3): the no-false-RED property belongs to the emitter.
  let o8: i64 = ma_emit_health_file(hea, out)
  var t8: i64 = 0
  if g_starts(out, o8, "HTTP/1.1 200" as *u8) == 1 { if g_contains(out, o8, "\"overall\":\"OK\"" as *u8) == 1 { t8 = 1 } }
  pass = pass + g_row("T8 health(healthy) EMITTER -> overall OK (no false-RED)\x00" as *u8, t8)
448
  // ---- T9: GET /api/bogus -> 404 ----
  var n9: i64 = g_cat(req, 0, "GET /api/bogus HTTP/1.1\r\nHost: x\r\n\r\n" as *u8)
  let o9: i64 = ma_handle(ctx, req, n9, deg, out)
  var t9: i64 = 0
  if g_starts(out, o9, "HTTP/1.1 404" as *u8) == 1 { t9 = 1 }
  pass = pass + g_row("T9 GET /api/bogus -> 404\x00" as *u8, t9)
455
  // ---- T10: GET /api/health (MISSING snapshot) WITH token -> UNKNOWN + no-snapshot (no false-GREEN) ----
  var n10: i64 = g_cat(req, 0, "GET /api/health HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8)
  n10 = g_cat_n(req, n10, tokbuf, tok_n)
  n10 = g_cat(req, n10, "\r\n\r\n" as *u8)
  // SUBJECT SPLIT (see T3): UNKNOWN-on-absent-data is the emitter's no-false-GREEN guarantee.
  let o10: i64 = ma_emit_health_file(miss, out)
  var t10: i64 = 0
  if g_starts(out, o10, "HTTP/1.1 200" as *u8) == 1 {
      if g_contains(out, o10, "\"overall\":\"UNKNOWN\"" as *u8) == 1 {
          if g_contains(out, o10, "no-snapshot" as *u8) == 1 { t10 = 1 }
      }
  }
  pass = pass + g_row("T10 health(MISSING snap) EMITTER -> UNKNOWN + no-snapshot (no false-GREEN)\x00" as *u8, t10)
469
  // ---- T11: POST /api/deploy +token, UNKNOWN target -> 400 (fail-closed; not in allowlist, NOTHING promoted) ----
  var n11: i64 = g_cat(req, 0, "POST /api/deploy HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8)
  n11 = g_cat_n(req, n11, tokbuf, tok_n)
  n11 = g_cat(req, n11, "\r\n\r\ntarget=bogus_not_in_allowlist" as *u8)
  let o11: i64 = ma_handle(ctx, req, n11, deg, out)
  var t11: i64 = 0
  if g_starts(out, o11, "HTTP/1.1 403" as *u8) == 1 { t11 = 1 }
  pass = pass + g_row("T11 /api/deploy level-gate fires BEFORE the allowlist -> 403\x00" as *u8, t11)
478
  // ---- T12: md_resolve_target data-driven allowlist -- known -> 1, unknown -> 0 (unit, no deploy) ----
  let tcfg: *u8 = "/tmp/nx_ma_targets.conf" as *u8
  g_write_file(tcfg, "# test allowlist\ngatetest 2 /tmp/nx_ma_nope_src deploy https://x.example\n" as *u8)
  let kb: *i64 = sys_mmap(8) as *i64
  let sbuf: *u8 = sys_mmap(512)
  let ubuf: *u8 = sys_mmap(64)
  let lbuf: *u8 = sys_mmap(256)
  let rbb: *u8 = sys_mmap(64)
  var t12: i64 = 0
  if md_resolve_target(tcfg, "gatetest" as *u8, 0, 8, kb, sbuf, ubuf, lbuf, rbb) == 1 {
      // legacy 5-field row -> rollback defaults to "rollback"
      var rbok: i64 = 0; if rbb[0]==(114 as u8) { rbok = 1 }   // 'r'ollback
      if md_resolve_target(tcfg, "nope" as *u8, 0, 4, kb, sbuf, ubuf, lbuf, rbb) == 0 { if rbok==1 { t12 = 1 } }
  }
  pass = pass + g_row("T12 md_resolve_target: known->1 + unknown->0 + default rollback (data-driven allowlist)\x00" as *u8, t12)
494
  // ---- T12b: /api/hostctl action allowlist is FAIL-CLOSED (safe subs ok; selfswap/arbitrary rejected) ----
  var t12b: i64 = 0
  if md_hostctl_action_ok("torstat" as *u8) == 1 { if md_hostctl_action_ok("routerctl" as *u8) == 1 { if md_hostctl_action_ok("kicktorrent" as *u8) == 1 {
      if md_hostctl_action_ok("selfswap" as *u8) == 0 { if md_hostctl_action_ok("rm" as *u8) == 0 { if md_hostctl_action_ok("deploy" as *u8) == 0 { t12b = 1 } } } } } }
  pass = pass + g_row("T12b md_hostctl_action_ok: safe->1, selfswap/rm/deploy->0 (fail-closed)\x00" as *u8, t12b)
500
  // ---- T12c: ma_openapi generates a well-formed OpenAPI 3.1 spec (Swagger-parity; machine-readable API) ----
  let ob: *u8 = sys_mmap(32768); let obn: i64 = ma_openapi(ob)
  var t12c: i64 = 0
  if g_find(ob, obn, "\"openapi\":\"3.1.0\"" as *u8) >= 0 { if g_find(ob, obn, "/api/hostctl" as *u8) >= 0 {
      if g_find(ob, obn, "application/problem+json" as *u8) >= 0 { if g_find(ob, obn, "nishiSession" as *u8) >= 0 { t12c = 1 } } } }
  pass = pass + g_row("T12c ma_openapi: OpenAPI 3.1 + paths + RFC9457 problem-schema + OPAQUE security scheme\x00" as *u8, t12c)
507
  // ---- T13: POST /api/migrate +token -> 501 (still reserved; honest, R3b migration sub-arc) ----
  var n13: i64 = g_cat(req, 0, "POST /api/migrate HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8)
  n13 = g_cat_n(req, n13, tokbuf, tok_n)
  n13 = g_cat(req, n13, "\r\n\r\n" as *u8)
  let o13: i64 = ma_handle(ctx, req, n13, deg, out)
  var t13: i64 = 0
  if g_starts(out, o13, "HTTP/1.1 403" as *u8) == 1 { t13 = 1 }
  pass = pass + g_row("T13 /api/migrate is LEVEL-GATED -> 403\x00" as *u8, t13)
516
  // ---- T14: POST /api/rollback NO token -> 401 (privileged guarded) ----
  var n14: i64 = g_cat(req, 0, "POST /api/rollback HTTP/1.1\r\nHost: x\r\n\r\nconfirm=yes" as *u8)
  let o14: i64 = ma_handle(ctx, req, n14, deg, out)
  var t14: i64 = 0
  if g_starts(out, o14, "HTTP/1.1 401" as *u8) == 1 { t14 = 1 }
  pass = pass + g_row("T14 POST /api/rollback NO token -> 401 (privileged guarded)\x00" as *u8, t14)
523
  // ---- T15: POST /api/rollback +token, NO confirm -> 400 (no accidental rollback; not executed) ----
  var n15: i64 = g_cat(req, 0, "POST /api/rollback HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8)
  n15 = g_cat_n(req, n15, tokbuf, tok_n)
  n15 = g_cat(req, n15, "\r\n\r\n" as *u8)
  let o15: i64 = ma_handle(ctx, req, n15, deg, out)
  var t15: i64 = 0
  if g_starts(out, o15, "HTTP/1.1 403" as *u8) == 1 { t15 = 1 }
  pass = pass + g_row("T15 /api/rollback is LEVEL-GATED -> 403\x00" as *u8, t15)
532
  // ---- T16: POST /api/reconcile NO token -> 401 (privileged guarded) ----
  var n16: i64 = g_cat(req, 0, "POST /api/reconcile HTTP/1.1\r\nHost: x\r\n\r\nconfirm=yes" as *u8)
  let o16: i64 = ma_handle(ctx, req, n16, deg, out)
  var t16: i64 = 0
  if g_starts(out, o16, "HTTP/1.1 401" as *u8) == 1 { t16 = 1 }
  pass = pass + g_row("T16 POST /api/reconcile NO token -> 401 (privileged guarded)\x00" as *u8, t16)
539
  // ---- T17: POST /api/reconcile +token, NO confirm -> 400 (no accidental supervisor kill; NOT executed) ----
  var n17: i64 = g_cat(req, 0, "POST /api/reconcile HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8)
  n17 = g_cat_n(req, n17, tokbuf, tok_n)
  n17 = g_cat(req, n17, "\r\n\r\n" as *u8)
  let o17: i64 = ma_handle(ctx, req, n17, deg, out)
  var t17: i64 = 0
  if g_starts(out, o17, "HTTP/1.1 403" as *u8) == 1 { t17 = 1 }
  pass = pass + g_row("T17 /api/reconcile is LEVEL-GATED -> 403\x00" as *u8, t17)
548
  // ---- T18: POST /api/restart +token, UNKNOWN service -> 400 (fail-closed; NOT executed) ----
  var n18: i64 = g_cat(req, 0, "POST /api/restart HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8)
  n18 = g_cat_n(req, n18, tokbuf, tok_n)
  n18 = g_cat(req, n18, "\r\n\r\nservice=bogus&confirm=yes" as *u8)
  let o18: i64 = ma_handle(ctx, req, n18, deg, out)
  var t18: i64 = 0
  if g_starts(out, o18, "HTTP/1.1 403" as *u8) == 1 { t18 = 1 }
  pass = pass + g_row("T18 /api/restart is LEVEL-GATED -> 403\x00" as *u8, t18)
557
  // ---- T19: POST /api/restart +token, known service, NO confirm -> 400 (not executed) ----
  var n19: i64 = g_cat(req, 0, "POST /api/restart HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8)
  n19 = g_cat_n(req, n19, tokbuf, tok_n)
  n19 = g_cat(req, n19, "\r\n\r\nservice=reader" as *u8)
  let o19: i64 = ma_handle(ctx, req, n19, deg, out)
  var t19: i64 = 0
  if g_starts(out, o19, "HTTP/1.1 403" as *u8) == 1 { t19 = 1 }
  pass = pass + g_row("T19 /api/restart level-gate fires BEFORE confirm -> 403\x00" as *u8, t19)
566
  // ---- T20: md_restart_sub allowlist -- known -> 1, unknown -> 0 (unit, no exec) ----
  let rsb: *u8 = sys_mmap(64)
  var t20: i64 = 0
  if md_restart_sub("reader" as *u8, 0, 6, rsb) == 1 {
      if md_restart_sub("bogus" as *u8, 0, 5, rsb) == 0 { t20 = 1 }
  }
  pass = pass + g_row("T20 md_restart_sub: known->1 + unknown->0 (data-driven allowlist)\x00" as *u8, t20)
574
  // D001 MIGRATION 2026-08-07. The teeth and their per-row output are UNTOUCHED -- only the VERDICT moves
  // to the base class, which is exactly what D001 asks for: nx_gate_green can parse it and gv_verdict
  // records a harness.jrnl frame, so flake and erosion become visible for the control-plane router gate.
  // FOUND WHILE TRYING TO USE IT: this gate was NEVER BUILT -- /api/gate_run answered exit 127 NOT-FOUND,
  // so the mgmt API router had no runnable proof at all. An unbuilt gate is indistinguishable from a
  // passing one in every report that mentions it (nx_gatebuilt_gate).
  // The g_log/g_w lines are PRESERVED: other readers consume that log, and rule 19 says add, do not break.
  let ctr: *i64 = gv_ctr()
  ctr[0] = pass
  ctr[1] = MG_CHECKS
585
  // ---- BUILD-REFUSAL MESSAGE FIDELITY (2026-08-20, upgrades debt 1787178882) ---------------------
  // WHY THESE ARE gv_check AND THE 22 ABOVE ARE NOT: the legacy rows hand-roll `pass` and then declare
  // the total as a literal, so a tooth that silently stops running lowers both numbers and the count
  // has to be remembered. These four ride the base class, where declared == executed by construction.
  // Additive on purpose -- the 22 are untouched, so this cannot disturb a GREEN control.
  //
  // WHAT IS BEING HELD. /api/build used to PARAPHRASE nx_build_admit's verdict in its own prose, and
  // the paraphrase drifted: it asserted a definite AND of load and run-queue saturation where the
  // detector states a three-way disjunction that includes the D-state I/O storm. On this host the load
  // ceiling is set far above any reachable load, so the named cause was the one that could not fire and
  // the cause that did fire was never named. The handler now passes the detector's text through.
  //
  // AND NOTE WHAT IS DELIBERATELY *NOT* ASSERTED: no tooth here says "a GRANT must be followed by an
  // admitted build". That would demand a volatile host quantity be reproducible, which is a request to
  // remove the sensor rather than to test it. Message fidelity is the property that can be held with a
  // fixture, so it is the property held. A GATE MUST TEST WHAT IT CAN OBSERVE, NOT WHAT WOULD BE
  // CONVENIENT TO BELIEVE.
  let fx: *u8 = sys_mmap(1024)
  let fxn: i64 = g_cat(fx, 0, "BUILD-ADMIT mem_available_mb=9000 floor_mb=1024 load1_centi=1552 max_centiload=100000 ncpu=8 procs_running=4 procs_blocked=7 blocked_max=8 envelope_src=conf VERDICT=QUEUE -- the D-state roster shows an I/O storm (procs_blocked >= blocked_max)" as *u8)
  fx[fxn] = 0 as u8
  let fqo: *u8 = sys_mmap(64)
  let fqn: i64 = g_cat(fqo, 0, "/tmp/nx_buildq_fixture.out" as *u8)
  fqo[fqn] = 0 as u8
  let fbody: *u8 = ma_build_refusal_body(fx, fxn, 0, "nxfidelityfixture" as *u8, 0, fqo)
  let fbn: i64 = g_len(fbody)
  // ASSERT THE FIXTURE REACHED THE CONDITION BEFORE ASSERTING THE OUTCOME: an empty or trivial body
  // would pass an absence check for free, so prove there is something to search first.
  var fpre: i64 = 0
  if fbn > 800 { fpre = 1 }
  gv_check("build-refusal-body-is-substantive-before-any-absence-is-claimed" as *u8, fpre, ctr)
  gv_check("build-refusal-carries-the-detectors-own-verdict-text-verbatim" as *u8, g_contains(fbody, fbn, "VERDICT=QUEUE -- the D-state roster shows an I/O storm" as *u8), ctr)
  var fneg: i64 = 1
  if g_contains(fbody, fbn, "host load above 1.00 x ncpu AND the run queue confirms CPU saturation" as *u8) == 1 { fneg = 0 }
  gv_check("neg-control-a-d-state-refusal-is-never-reported-as-run-queue-saturation" as *u8, fneg, ctr)
  var fq: i64 = 1
  if g_contains(fbody, fbn, "queue_launch_rc" as *u8) == 0 { fq = 0 }
  if g_contains(fbody, fbn, "BQ-nxfidelityfixture" as *u8) == 0 { fq = 0 }
  if g_contains(fbody, fbn, "admit_detail_truncated" as *u8) == 0 { fq = 0 }
  gv_check("neg-control-pass-through-kept-the-local-enqueue-receipt-and-its-read-bound" as *u8, fq, ctr)
625
  // ---- THE RECEIPT MUST BRANCH ON ITS OWN rc (closes debt 1787178882) ---------------------------
  // The refusal used to promise "an enqueue was launched" unconditionally while printing the rc that
  // said it had failed -- measured 2026-08-19 as queue_launch_rc=4 with the deployq- row MISSING. The
  // machine-readable field was right and the sentence humans read was wrong, which is the worse half to
  // get wrong. Same fixture, failing rc: the prose must flip, not just the number.
  let fbad: *u8 = ma_build_refusal_body(fx, fxn, 0, "nxfidelityfixture" as *u8, 4, fqo)
  let fbadn: i64 = g_len(fbad)
  var frc: i64 = 1
  if g_contains(fbad, fbadn, "NOTHING IS QUEUED FOR YOU ANYWHERE" as *u8) == 0 { frc = 0 }
  if g_contains(fbad, fbadn, "queued\":0" as *u8) == 0 { frc = 0 }
  gv_check("failed-enqueue-receipt-says-nothing-is-queued-and-flags-queued-zero" as *u8, frc, ctr)
  var fneg2: i64 = 1
  if g_contains(fbad, fbadn, "the enqueue was LAUNCHED AND RETURNED rc=0" as *u8) == 1 { fneg2 = 0 }
  gv_check("neg-control-a-failed-enqueue-never-claims-the-build-will-fire-later" as *u8, fneg2, ctr)
  var fpos2: i64 = 1
  if g_contains(fbody, fbn, "the enqueue was LAUNCHED AND RETURNED rc=0" as *u8) == 0 { fpos2 = 0 }
  if g_contains(fbody, fbn, "queued\":1" as *u8) == 0 { fpos2 = 0 }
  gv_check("positive-control-a-successful-enqueue-still-reports-that-it-queued" as *u8, fpos2, ctr)
644
  // ---- THE PROMOTE REFUSAL MUST NAME WHICH CONJUNCT FIRED (2026-08-20) --------------------------
  // md_promote_staged_ex has THREE failure returns and the handler used to render all of them as
  // NOTHING-STAGED -- a label that is FALSE for two of them, because the .elf.new IS staged and was
  // deliberately REFUSED. Measured cost: two nx_filecopy break-glass copies of gate binaries in one
  // day, since a refusal that misdescribes itself teaches every reader to leave the promote lane.
  // Same shape as the build-refusal teeth above: the DECISION needs a staged artifact plus a
  // provenance history to fire, so only the RENDERING is held here -- which is the half that drifts.
  let pfhex: *u8 = sys_mmap(72)
  let pfhn: i64 = g_cat(pfhex, 0, "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef" as *u8)
  pfhex[pfhn] = 0 as u8
  let pbw: *u8 = ma_promote_refusal_body(MA_PROMOTE_REFUSE_BACKWARDS, "nxpromotefixture" as *u8, pfhex)
  let pbwn: i64 = g_len(pbw)
  var ppre: i64 = 0
  if pbwn > 600 { ppre = 1 }
  gv_check("promote-refusal-body-is-substantive-before-any-absence-is-claimed" as *u8, ppre, ctr)
660
  var pb1: i64 = 1
  if g_contains(pbw, pbwn, "REFUSED-BACKWARDS-WALK" as *u8) == 0 { pb1 = 0 }
  if g_contains(pbw, pbwn, "nxpromotefixture" as *u8) == 0 { pb1 = 0 }
  if g_contains(pbw, pbwn, "deadbeefdeadbeef" as *u8) == 0 { pb1 = 0 }
  if g_contains(pbw, pbwn, "/api/rollback" as *u8) == 0 { pb1 = 0 }
  gv_check("provenance-refusal-names-itself-its-target-the-live-hash-and-the-rollback-verb" as *u8, pb1, ctr)
667
  // THE TOOTH THAT WOULD HAVE STOPPED THE BREAK-GLASS: a provenance refusal must never read as an
  // ABSENCE, and must never offer allow_capability_loss=yes -- the one remedy that cannot work here,
  // because md_prov_ok runs unconditionally and that flag gates a different conjunct.
  var pneg: i64 = 1
  if g_contains(pbw, pbwn, "NOTHING-STAGED" as *u8) == 1 { pneg = 0 }
  if g_contains(pbw, pbwn, "nothing staged" as *u8) == 1 { pneg = 0 }
  if g_contains(pbw, pbwn, "re-issue with allow_capability_loss=yes" as *u8) == 1 { pneg = 0 }
  gv_check("neg-control-a-provenance-refusal-never-reads-as-an-absence-nor-offers-the-capability-loss-flag" as *u8, pneg, ctr)
676
  let pcl: *u8 = ma_promote_refusal_body(MA_PROMOTE_REFUSE_CAPLOSS, "nxpromotefixture" as *u8, pfhex)
  let pcln: i64 = g_len(pcl)
  var pb2: i64 = 1
  if g_contains(pcl, pcln, "REFUSED-CAPABILITY-LOSS" as *u8) == 0 { pb2 = 0 }
  if g_contains(pcl, pcln, "re-issue with allow_capability_loss=yes" as *u8) == 0 { pb2 = 0 }
  if g_contains(pcl, pcln, "nx_contentdiff" as *u8) == 0 { pb2 = 0 }
  gv_check("capability-loss-refusal-names-itself-and-offers-the-flag-that-actually-covers-it" as *u8, pb2, ctr)
684
  // DISCRIMINATION, both signals present at once: two teeth that each check one label would still
  // pass if the renderer emitted ONE body for BOTH codes. Assert neither label leaks into the other.
  var pdisc: i64 = 0
  if g_contains(pcl, pcln, "REFUSED-BACKWARDS-WALK" as *u8) == 0 { if g_contains(pbw, pbwn, "REFUSED-CAPABILITY-LOSS" as *u8) == 0 { pdisc = 1 } }
  gv_check("the-two-refusals-are-DIFFERENT-bodies-neither-label-leaks-into-the-other" as *u8, pdisc, ctr)
690
  // neg-control: a return code this renderer does not own yields NOTHING, so a genuine absence (rc 0)
  // still falls through to the caller's existing NOTHING-STAGED path, which is CORRECT for that case.
  var pnone: i64 = 0
  if (ma_promote_refusal_body(0, "nxpromotefixture" as *u8, pfhex) as i64) == 0 { pnone = 1 }
  gv_check("neg-control-a-genuine-absence-is-NOT-claimed-by-this-renderer-and-still-reads-NOTHING-STAGED" as *u8, pnone, ctr)
696
  let rc: i64 = gv_verdict("MGMT-API-GATE" as *u8, ctr, "spine + true-monitoring + deploy/rollback + reconcile/restart, all fail-closed, no false +/-" as *u8)
  if rc == 0 {
      g_log("MGMT-API-GATE verdict=GREEN\n" as *u8)   // count removed: a hardcoded total is a stale total
      g_w("MGMT-API GATE GREEN (spine + true-monitoring + deploy/rollback + reconcile/restart wired, all fail-closed, no false +/-)\n" as *u8)
      sys_exit(0)
  }
  g_log("MGMT-API-GATE verdict=RED\n" as *u8)
  g_w("MGMT-API GATE RED\n" as *u8)
  sys_exit(rc)
  return rc
707}
nx_mgmt_api_gate.nx source

`nx_mgmt_api_gate.nx` source
