nx_mirrorintegrity_gate.nx source
↩ module page · 206 lines · 11073 B
1// nx_mirrorintegrity_gate.nx -- teeth for the mirror-completeness census.
2//
3// IN-PROCESS BY CONSTRUCTION: it imports nx_mirrorintegrity_lib.nx and calls mi_classify directly, so it
4// exercises THE SAME CODE the census runs instead of parsing the census's stdout. That also means it has no
5// NOT-DEPLOYED failure mode -- a gate that forks a deployed elf reports INCONCLUSIVE when the subject is
6// merely un-promoted, which reads as the gate's fault.
7//
8// EVERY FIXTURE IS ASSEMBLED AT RUNTIME UNDER /tmp/mirrorintegrity_gate/ -- never checked in, never shared
9// with a production beat. A gate that shares its fixture with a beat reports on the fixture, not the code.
10// Setup unlinks before it creates, so a crashed previous run cannot make this one pass or fail differently:
11// A GATE THAT IS NOT IDEMPOTENT REPORTS ON ITS FIRST RUN AND LIES ABOUT EVERY RUN AFTER.
12//
13// THE FIRST TOOTH IS THE ANTI-VACUITY ONE. The trivial wrong implementation of this census is "flag
14// everything", which would pass every detection tooth below. Only the positive controls -- complete bodies
15// that must NOT be flagged -- can refute it. A GUARD THAT REFUSES EVERYTHING PASSES EVERY NEGATIVE TEST.
16// license_tier: ORIGINAL expect_exit: 0
17import "nx_mirrorintegrity_lib.nx"
18import "nx_gate_verdict.nx"
19
20const MIG_DIR: *u8 = "/tmp/mirrorintegrity_gate\x00"
21const MIG_MODE644: i64 = 420
22const MIG_MODE755: i64 = 493
23const MIG_DECLARED: i64 = 999999 // the length the planted linearized header CLAIMS
24
25func mig_put(path: *u8, data: *u8) -> i64 {
26 sys_unlinkat(path)
27 let fd: i64=sys_openat_wr(path, MIG_MODE644)
28 if fd<0 { return 0-1 }
29 var n: i64=0
30 while data[n]!=(0 as u8) { n=n+1 }
31 if n>0 { sys_write(fd, data, n) }
32 sys_close(fd)
33 return n
34}
35func mig_path(buf: *u8, name: *u8) -> i64 {
36 var a: i64=mi_cat(buf, 0, MIG_DIR as *u8)
37 a=mi_cat(buf, a, "/" as *u8)
38 a=mi_cat(buf, a, name)
39 buf[a]=0 as u8
40 return a
41}
42
43func main(argc: i64, argv: *i64) -> i64 {
44 gv_head("=== NX-MIRRORINTEGRITY-GATE -- can this census tell a short body from a whole one, BOTH ways? ===" as *u8)
45 let ctr: *i64=gv_ctr()
46 sys_mkdir(MIG_DIR as *u8, MIG_MODE755)
47
48 let pb: *u8=sys_mmap(1024)
49 let hbuf: *u8=sys_mmap(MI_HEAD+16)
50 let tbuf: *u8=sys_mmap(MI_TAIL+16)
51 let rc: *i64=sys_mmap(16) as *i64
52 let sz: *i64=sys_mmap(16) as *i64
53 let dc: *i64=sys_mmap(16) as *i64
54
55 // ---------- plant every class at runtime ----------
56 mig_path(pb, "good.pdf\x00" as *u8); mig_put(pb, "%PDF-1.6\nbody\n%%EOF\n" as *u8)
57 mig_path(pb, "good.html\x00" as *u8); mig_put(pb, "<html><body>whole</body></html>\n" as *u8)
58 mig_path(pb, "good.json\x00" as *u8); mig_put(pb, "{\x22a\x22:1}\n" as *u8)
59 mig_path(pb, "shortlin.pdf\x00" as *u8); mig_put(pb, "%PDF-1.6\n1 0 obj<</Linearized 1/L 999999/O 5>>endobj\nshort\n%%EOF\n" as *u8)
60 mig_path(pb, "noeof.pdf\x00" as *u8); mig_put(pb, "%PDF-1.6\nno terminator here\n" as *u8)
61 mig_path(pb, "cut.html\x00" as *u8); mig_put(pb, "<html><body>this was cut mid sen" as *u8)
62 mig_path(pb, "cut.json\x00" as *u8); mig_put(pb, "{\x22a\x22:1,\x22b\x22:" as *u8)
63 // THE TWO HTML OUTCOMES ADDED 2026-08-25 WITH mi_html_tail_verdict. A NEW CLASS WITH NO PLANTED
64 // BODY IS AN UNVERIFIED CLASS: a green that never had a corresponding red proves nothing, and both
65 // of these are classes the old rule could not produce at all.
66 // opentag.html is cut INSIDE a tag -- the strongest evidence an HTML tail can carry, and the only
67 // shape this axis can now call PROVEN rather than merely suspect.
68 mig_path(pb, "opentag.html\x00" as *u8); mig_put(pb, "<html><body><p>ended inside a tag</p><di" as *u8)
69 // optional.html is WHOLE and simply omits the optional end tag, which HTML5 permits. It is the
70 // shape of all 21 measured false positives, and the axis must ABSTAIN on it rather than accuse.
71 mig_path(pb, "optional.html\x00" as *u8); mig_put(pb, "<html><body><p>whole, and it omits the optional end tag</p></body>\n" as *u8)
72 mig_path(pb, "plain.txt\x00" as *u8); mig_put(pb, "plain text in no container format\n" as *u8)
73 mig_path(pb, "empty.bin\x00" as *u8); sys_unlinkat(pb)
74 let efd: i64=sys_openat_wr(pb, MIG_MODE644)
75 if efd>=0 { sys_close(efd) }
76
77 // ---------- classify each ----------
78 mig_path(pb, "good.pdf\x00" as *u8); let cgpdf: i64=mi_classify(pb, hbuf, tbuf, rc, sz, dc)
79 mig_path(pb, "good.html\x00" as *u8); let cghtm: i64=mi_classify(pb, hbuf, tbuf, rc, sz, dc)
80 mig_path(pb, "good.json\x00" as *u8); let cgjsn: i64=mi_classify(pb, hbuf, tbuf, rc, sz, dc)
81 mig_path(pb, "shortlin.pdf\x00" as *u8); let cshort: i64=mi_classify(pb, hbuf, tbuf, rc, sz, dc)
82 let short_decl: i64=dc[0]
83 let short_rc: i64=rc[0]
84 mig_path(pb, "noeof.pdf\x00" as *u8); let cnoeof: i64=mi_classify(pb, hbuf, tbuf, rc, sz, dc)
85 mig_path(pb, "cut.html\x00" as *u8); let cchtm: i64=mi_classify(pb, hbuf, tbuf, rc, sz, dc)
86 mig_path(pb, "cut.json\x00" as *u8); let ccjsn: i64=mi_classify(pb, hbuf, tbuf, rc, sz, dc)
87 mig_path(pb, "opentag.html\x00" as *u8); let copen: i64=mi_classify(pb, hbuf, tbuf, rc, sz, dc)
88 let open_rc: i64=rc[0]
89 mig_path(pb, "optional.html\x00" as *u8); let copt: i64=mi_classify(pb, hbuf, tbuf, rc, sz, dc)
90 let opt_rc: i64=rc[0]
91 mig_path(pb, "plain.txt\x00" as *u8); let cplain: i64=mi_classify(pb, hbuf, tbuf, rc, sz, dc)
92 mig_path(pb, "empty.bin\x00" as *u8); let cempty: i64=mi_classify(pb, hbuf, tbuf, rc, sz, dc)
93
94 // ---------- ANTI-VACUITY FIRST: the flag-everything implementation dies here ----------
95 var allgood: i64=0
96 if cgpdf==MI_COMPLETE { if cghtm==MI_COMPLETE { if cgjsn==MI_COMPLETE { allgood=1 } } }
97 gv_check("neg-control-anti-vacuity-three-COMPLETE-bodies-are-NOT-flagged" as *u8, allgood, ctr)
98
99 // ---------- the real defect shape, both directions ----------
100 var badp: i64=0
101 if cshort==MI_PROVEN { badp=1 }
102 var goodp: i64=1
103 if cgpdf==MI_COMPLETE { goodp=0 } // gv_bite's 3rd arg is DID-IT-FIRE-ON-GOOD and must be 0, not a pass flag
104 gv_bite("pdf-declared-length-exceeds-file" as *u8, badp, goodp, ctr)
105
106 var bade: i64=0
107 if cempty==MI_PROVEN { bade=1 }
108 gv_bite("zero-byte-body" as *u8, bade, goodp, ctr)
109
110 var badh: i64=0
111 if cchtm==MI_SUSPECT { badh=1 }
112 var goodh: i64=1
113 if cghtm==MI_COMPLETE { goodh=0 }
114 gv_bite("html-cut-mid-document" as *u8, badh, goodh, ctr)
115
116 // THE TWO OUTCOMES mi_html_tail_verdict ADDED, BOTH DIRECTIONS. The pair above only ever exercised
117 // SUSPECT. Each tooth asserts the REASON CODE as well as the class, because a worklist row that
118 // carries a class without the reason that decided it cannot be triaged without re-running the ruler.
119 var openp: i64=0
120 if copen==MI_PROVEN { if open_rc==MI_RC_HTML_OPENTAG { openp=1 } }
121 gv_bite("html-ends-inside-an-unclosed-tag-is-PROVEN-truncation" as *u8, openp, goodh, ctr)
122
123 // THE ANTI-VACUITY TOOTH FOR THE WHOLE REWRITE. The trivial wrong implementation is the one that
124 // actually shipped: flag every body lacking a closing html element. It passes every tooth above and
125 // it produced 22 of 22 false positives on the live corpus, measured against fresh downloads of all
126 // 21 distinct urls. Only a WHOLE body that omits the optional end tag refutes it -- and it must read
127 // UNKNOWN, never COMPLETE, because COMPLETE would be an acquittal this axis has not earned.
128 var optp: i64=0
129 if copt==MI_UNKNOWN { if opt_rc==MI_RC_HTML_OPTIONAL { optp=1 } }
130 gv_check("neg-control-a-WHOLE-body-omitting-the-optional-end-tag-ABSTAINS-not-accuses" as *u8, optp, ctr)
131
132 var badj: i64=0
133 if ccjsn==MI_SUSPECT { badj=1 }
134 var goodj: i64=1
135 if cgjsn==MI_COMPLETE { goodj=0 }
136 gv_bite("json-unterminated" as *u8, badj, goodj, ctr)
137
138 var badn: i64=0
139 if cnoeof==MI_SUSPECT { badn=1 }
140 gv_bite("pdf-missing-eof-marker" as *u8, badn, goodp, ctr)
141
142 // ---------- UNKNOWN is its own bucket, never folded into COMPLETE ----------
143 var isunk: i64=0
144 if cplain==MI_UNKNOWN { isunk=1 }
145 gv_check("neg-control-unjudgeable-body-is-UNKNOWN-and-NOT-counted-COMPLETE" as *u8, isunk, ctr)
146
147 // ---------- the declared length must be REPORTED, not merely used ----------
148 var decl_ok: i64=0
149 if short_decl==MIG_DECLARED { decl_ok=1 }
150 gv_check("declared-length-is-published-so-a-reader-can-check-the-arithmetic" as *u8, decl_ok, ctr)
151 var rc_ok: i64=0
152 if short_rc==2 { rc_ok=1 }
153 gv_check("the-reason-travels-with-the-verdict-not-just-the-class" as *u8, rc_ok, ctr)
154
155 // ---------- the partition must sum over a real walk ----------
156 let counts: *i64=sys_mmap(128) as *i64
157 var z: i64=0
158 while z<8 { counts[z]=0; z=z+1 }
159 let work: *u8=sys_mmap(MI_WORKCAP)
160 let wo: *i64=sys_mmap(16) as *i64
161 wo[0]=0
162 let wp: *u8=sys_mmap(MI_PATHCAP)
163 var dn: i64=mi_cat(wp, 0, MIG_DIR as *u8)
164 mi_walk(wp, dn, 0, hbuf, tbuf, counts, work, wo)
165 let files: i64=counts[4]
166 let sum: i64=counts[0]+counts[1]+counts[2]+counts[3]
167 var psum: i64=0
168 if files>0 { if sum==files { psum=1 } }
169 gv_check("partition-sums-to-the-file-count-over-a-real-walk" as *u8, psum, ctr)
170
171 // BIND THE ASSERTION TO ITS DENOMINATOR: a tooth that passes on the empty set is not a tooth.
172 var enough: i64=0
173 if files==11 { enough=1 }
174 gv_check("the-walk-actually-reached-all-eleven-planted-fixtures" as *u8, enough, ctr)
175
176 var mix: i64=0
177 if counts[0]==3 { if counts[1]==3 { if counts[2]==3 { if counts[3]==2 { mix=1 } } } }
178 gv_check("every-class-is-populated-so-no-bucket-is-silently-dead" as *u8, mix, ctr)
179
180 // ---------- idempotence: classify again, identical answer ----------
181 mig_path(pb, "shortlin.pdf\x00" as *u8)
182 let again: i64=mi_classify(pb, hbuf, tbuf, rc, sz, dc)
183 var idem: i64=0
184 if again==cshort { if dc[0]==short_decl { idem=1 } }
185 gv_check("idempotent-a-second-classification-returns-the-same-verdict" as *u8, idem, ctr)
186
187 gv_puts("\n observed: good.pdf=" as *u8); gv_num(cgpdf)
188 gv_puts(" good.html=" as *u8); gv_num(cghtm)
189 gv_puts(" good.json=" as *u8); gv_num(cgjsn)
190 gv_puts(" shortlin=" as *u8); gv_num(cshort)
191 gv_puts(" noeof=" as *u8); gv_num(cnoeof)
192 gv_puts(" cut.html=" as *u8); gv_num(cchtm)
193 gv_puts(" cut.json=" as *u8); gv_num(ccjsn)
194 gv_puts(" opentag.html=" as *u8); gv_num(copen)
195 gv_puts(" optional.html=" as *u8); gv_num(copt)
196 gv_puts(" plain=" as *u8); gv_num(cplain)
197 gv_puts(" empty=" as *u8); gv_num(cempty)
198 gv_puts("\n walk: proven=" as *u8); gv_num(counts[0])
199 gv_puts(" suspect=" as *u8); gv_num(counts[1])
200 gv_puts(" complete=" as *u8); gv_num(counts[2])
201 gv_puts(" unknown=" as *u8); gv_num(counts[3])
202 gv_puts(" files=" as *u8); gv_num(files)
203 gv_puts("\n" as *u8)
204
205 return gv_verdict("mirrorintegrity" as *u8, ctr, "codes 0=TRUNCATED-PROVEN 1=SUSPECT 2=COMPLETE 3=UNKNOWN; fixtures are runtime-planted under /tmp and unlinked before creation" as *u8)
206}