nx_mgmt_call_gate.nx source
↩ module page · 87 lines · 4276 B
1// nx_mgmt_call_gate.nx -- TEETH FOR THE CONTROL-PLANE DRIVER FAILURE PATH, PROVEN WITHOUT CAUSING A FAILURE.
2//
3// WHY THIS EXISTS: nx_mgmt_call diagnostics were invisible to every MCP caller because they went to fd 2
4// while the tools-API capture surfaces fd 1. Fixed 2026-08-07 by writing FETCH-FAIL and MINT-FAIL to BOTH.
5// But a fix to a FAILURE path is unverified until the failure happens, and the honest options looked bad:
6// wait for the next outage, or manufacture one on a shared control plane. Neither is acceptable.
7// THE THIRD OPTION IS THE ONE WORTH HAVING: the organ resolves its key bundle as the RELATIVE path
8// "opaque_keys.bin", so running it from a directory with no key bundle drives the MINT-FAIL branch
9// deterministically -- no daemon touched, no port bound, nothing mutated.
10// * A FAILURE PATH IS TESTABLE WITHOUT A FAILURE WHENEVER ITS PRECONDITION IS AN INPUT YOU CONTROL -- look
11// for that input before reaching for an outage.
12//
13// T4 IS THE NEG-CONTROL AND IT CARRIES THE PROOF: T1-T3 would ALSO pass if the binary were simply broken and
14// always failed. T4 runs the SAME argv from the CORRECT cwd and demands success, so the pair shows the
15// failure is caused by the missing key bundle and nothing else.
16// license_tier: ORIGINAL Read-only: forks the driver twice, writes nothing, binds nothing. (Rule 26)
17// expect_exit: 0
18import "nx_syscalls.nx"
19import "nx_tool_run.nx"
20import "nx_gate_verdict.nx"
21
22const MG_ELF: *u8 = "/volume1/homes/elderwesto/nishihost/nx_mgmt_call.elf"
23const MG_HOME: *u8 = "/volume1/homes/elderwesto/nishihost"
24const MG_NOKEYS: *u8 = "/tmp"
25const MG_CAP: i64 = 65536
26
27func mg_has(buf: *u8, n: i64, needle: *u8) -> i64 {
28 var m: i64 = 0
29 while needle[m] != (0 as u8) { m = m + 1 }
30 if m == 0 { return 0 }
31 var i: i64 = 0
32 while i + m <= n {
33 var k: i64 = 0
34 var ok: i64 = 1
35 while k < m {
36 if buf[i + k] != needle[k] { ok = 0; k = m }
37 else { k = k + 1 }
38 }
39 if ok == 1 { return 1 }
40 i = i + 1
41 }
42 return 0
43}
44
45func main(argc: i64, argv: *i64) -> i64 {
46 let ctr: *i64 = gv_ctr()
47 gv_head("nx_mgmt_call_gate -- driver failure path VISIBLE to an MCP caller (fd 1, not just fd 2)" as *u8)
48
49 let av: *i64 = sys_mmap(64) as *i64
50 av[0] = MG_ELF as i64
51 av[1] = "GET" as *u8 as i64
52 av[2] = "/api" as *u8 as i64
53 av[3] = 0
54
55 let o1: *u8 = sys_mmap(MG_CAP + 1)
56 let l1: *i64 = sys_mmap(16) as *i64
57 sys_chdir(MG_NOKEYS)
58 let rc1: i64 = tr_run_capture(MG_ELF, av, o1, MG_CAP, l1)
59 sys_chdir(MG_HOME)
60
61 gv_check("T1 MINT-FAIL reaches STDOUT (the channel an MCP caller reads)" as *u8, mg_has(o1, l1[0], "MINT-FAIL" as *u8), ctr)
62 // The retry ADVICE is the load-bearing content, not the token: MINT-FAIL means the call was never sent,
63 // the OPPOSITE of FETCH-FAIL OUTCOME=UNKNOWN. A caller that cannot tell them apart will either re-send a
64 // non-idempotent mutation or refuse to retry a call that never happened.
65 gv_check("T2 message states the call was NEVER SENT (retry-safety, not just a token)" as *u8, mg_has(o1, l1[0], "NEVER SENT" as *u8), ctr)
66 var rcok: i64 = 0
67 if rc1 == 2 { rcok = 1 }
68 gv_check("T3 exit code 2, distinct from FETCH-FAIL 3 and from success 0" as *u8, rcok, ctr)
69
70 let o2: *u8 = sys_mmap(MG_CAP + 1)
71 let l2: *i64 = sys_mmap(16) as *i64
72 let rc2: i64 = tr_run_capture(MG_ELF, av, o2, MG_CAP, l2)
73 var negok: i64 = 0
74 if rc2 == 0 { if mg_has(o2, l2[0], "nishi-mgmt" as *u8) == 1 { negok = 1 } }
75 gv_check("T4 NEG-CONTROL same argv correct cwd RETURNS THE ROUTE INDEX (so T1-T3 prove the key bundle, not a broken binary)" as *u8, negok, ctr)
76
77 var bothspoke: i64 = 0
78 if l1[0] > 0 { if l2[0] > 0 { bothspoke = 1 } }
79 gv_check("T5 both runs produced bytes (a silent capture cannot support either verdict)" as *u8, bothspoke, ctr)
80
81 gv_puts(" mintfail_bytes=" as *u8); gv_num(l1[0])
82 gv_puts(" mintfail_rc=" as *u8); gv_num(rc1)
83 gv_puts(" control_bytes=" as *u8); gv_num(l2[0])
84 gv_puts(" control_rc=" as *u8); gv_num(rc2)
85 gv_puts("\n" as *u8)
86
87 return gv_verdict("MGMT-CALL-GATE" as *u8, ctr, "failure path visible on fd 1, proven via a controlled precondition with a success neg-control" as *u8)
88}