nx_motion_gate.nx source
↩ module page · 248 lines · 18351 B
1// nx_motion_gate.nx -- THE /motion SURFACE'S REFEREE (2026-09-06): the ONE lib's rulers on planted inputs (typing by
2// magic, the multipart parser, form decoding, path shape, status rows, the renderers) and the job organ END TO END on a
3// box fixture this gate writes itself -- rig, render, export, digest -- run TWICE, so determinism is a tooth and not a
4// sentence, plus a refusal control (an OBJ upload must fail at the named stage with the named code). It never touches
5// the served daemon or a live job directory: every artifact lands under /tmp/nx_motion_gate/<clock>/.
6// NAMED FOR THE SURFACE, NOT THE DAEMON: it proves nx_motion_serve's rulers AND nx_motion_rig's pipeline, and it is
7// declared as both organs' gate in knowledge/organ_gate.conf. (Its first name, nx_motion_serve_gate, was refused by the
8// async launcher's deny-by-class bound because the segment "serve" reads as a daemon stem -- a verifier that exits was
9// denied for carrying its subject's name. That residual is filed against the bound; this gate's scope was the honest fix.)
10// license_tier: ORIGINAL expect_exit: 0
11import "nx_syscalls.nx"
12import "nx_gate_verdict.nx"
13import "nx_nxa.nx"
14import "nx_boneheat_lib.nx"
15import "nx_motion_lib.nx"
16
17const MG_ROOT: *u8 = "/tmp/nx_motion_gate"
18const MG_RIG_ELF: *u8 = "_offc/nx_motion_rig.elf"
19const MG_BOX_HX: i64 = 2000 // a 40 x 40 x 120 mm box in 0.01 mm units: a bar, which the peeler reads as two limbs
20const MG_BOX_HY: i64 = 2000
21const MG_BOX_HZ: i64 = 6000
22const MG_BOX_VERTS: i64 = 8
23const MG_BOX_TRIS: i64 = 12
24const MG_CELLS: i64 = 48
25const MG_BUF: i64 = 65536
26const MG_SHA_LEN: i64 = 64
27
28func mg_quad(tris: *i64, k: i64, a: i64, b: i64, c: i64, d: i64) -> i64 {
29 tris[1 + k * 3] = a; tris[2 + k * 3] = b; tris[3 + k * 3] = c
30 tris[1 + (k + 1) * 3] = a; tris[2 + (k + 1) * 3] = c; tris[3 + (k + 1) * 3] = d
31 return k + 2
32}
33// the fixture: a closed box as VERT + TRIS in NXA units, written by the estate's own NXA writer
34func mg_box(path: *u8) -> i64 {
35 let vert: *i64 = sys_mmap((1 + MG_BOX_VERTS * 3) * 8 + 64) as *i64
36 let tris: *i64 = sys_mmap((1 + MG_BOX_TRIS * 3) * 8 + 64) as *i64
37 vert[0] = MG_BOX_VERTS
38 var i: i64 = 0
39 while i < MG_BOX_VERTS {
40 var x: i64 = 0 - MG_BOX_HX
41 var y: i64 = 0 - MG_BOX_HY
42 var z: i64 = 0 - MG_BOX_HZ
43 if (i & 1) == 1 { x = MG_BOX_HX }
44 if (i & 2) == 2 { y = MG_BOX_HY }
45 if (i & 4) == 4 { z = MG_BOX_HZ }
46 vert[1 + i * 3] = x; vert[2 + i * 3] = y; vert[3 + i * 3] = z
47 i = i + 1
48 }
49 tris[0] = MG_BOX_TRIS
50 var k: i64 = 0
51 k = mg_quad(tris, k, 0, 2, 6, 4) // -x
52 k = mg_quad(tris, k, 1, 5, 7, 3) // +x
53 k = mg_quad(tris, k, 0, 4, 5, 1) // -y
54 k = mg_quad(tris, k, 2, 3, 7, 6) // +y
55 k = mg_quad(tris, k, 0, 1, 3, 2) // -z
56 k = mg_quad(tris, k, 4, 6, 7, 5) // +z
57 let tags: *i64 = sys_mmap(32) as *i64
58 let ptrs: *i64 = sys_mmap(32) as *i64
59 let wls: *i64 = sys_mmap(32) as *i64
60 tags[0] = nxa_tag4("VERT" as *u8); ptrs[0] = vert as i64; wls[0] = 1 + MG_BOX_VERTS * 3
61 tags[1] = nxa_tag4("TRIS" as *u8); ptrs[1] = tris as i64; wls[1] = 1 + MG_BOX_TRIS * 3
62 return bh_nxa_write(path, 2, tags, ptrs, wls)
63}
64// a job directory under the gate root holding in.<kind> + kind; returns its path
65func mg_jobdir(root: *u8, name: *u8, kindname: *u8, inbytes: *u8, n: i64) -> *u8 {
66 let d: *u8 = mo_join(root, name)
67 sys_mkdir(d, 493)
68 let inname: *u8 = sys_mmap(32)
69 var o: i64 = mo_cat(inname, 0, "in." as *u8); o = mo_cat(inname, o, kindname); inname[o] = 0 as u8
70 mo_write_all(mo_join(d, inname), inbytes, n)
71 let kb: *u8 = sys_mmap(32)
72 var ko: i64 = mo_cat(kb, 0, kindname); kb[ko] = 10 as u8
73 mo_write_all(mo_join(d, "kind" as *u8), kb, ko + 1)
74 return d
75}
76func mg_run_rig(jobdir: *u8) -> i64 {
77 let words: *i64 = sys_mmap(MO_ARGV_CAP * 8) as *i64
78 let vrig: *u8 = "rig" as *u8
79 let cells: *u8 = sys_mmap(16)
80 let cl: i64 = mo_num(cells, 0, MG_CELLS)
81 cells[cl] = 0 as u8
82 words[0] = vrig as i64; words[1] = jobdir as i64; words[2] = cells as i64
83 return mo_run(MG_RIG_ELF, words, 3, mo_join(jobdir, "gate_run.log" as *u8))
84}
85func main() -> i64 {
86 let ctr: *i64 = gv_ctr()
87 gv_head("nx_motion_gate -- the /motion door's rulers on planted inputs, then the job organ end to end on a box the gate writes itself, twice, with an OBJ refusal control" as *u8)
88 let lp: *i64 = sys_mmap(16) as *i64
89 // ---- typing by magic ----
90 let b: *u8 = sys_mmap(MG_BUF)
91 var n: i64 = mo_cat(b, 0, "glTF" as *u8); b[n] = 2 as u8; b[n + 1] = 0 as u8; b[n + 2] = 0 as u8; b[n + 3] = 0 as u8
92 gv_check_eq("T1 magic: glTF at byte 0 types as GLB" as *u8, mo_kind_of(b, n + 4), MO_KIND_GLB, ctr)
93 n = mo_cat(b, 0, "Kaydara FBX Binary " as *u8)
94 gv_check_eq("T2 magic: Kaydara FBX Binary types as FBX" as *u8, mo_kind_of(b, n), MO_KIND_FBX, ctr)
95 n = mo_cat(b, 0, "NXANIM01" as *u8); b[n] = 1 as u8
96 gv_check_eq("T3 magic: NXANIM01 types as NXA" as *u8, mo_kind_of(b, n + 1), MO_KIND_NXA, ctr)
97 n = mo_cat(b, 0, "v 1.0 2.0 3.0\nv 0 0 0\nf 1 2 3\n" as *u8)
98 gv_check_eq("T4 magic: a v-line text file types as OBJ so it can be refused BY NAME" as *u8, mo_kind_of(b, n), MO_KIND_OBJ, ctr)
99 b[0] = 137 as u8; b[1] = 80 as u8; b[2] = 78 as u8; b[3] = 71 as u8; b[4] = 13 as u8; b[5] = 10 as u8; b[6] = 26 as u8; b[7] = 10 as u8
100 gv_check_eq("T5 neg-control-magic: PNG bytes type as UNKNOWN, never as a mesh" as *u8, mo_kind_of(b, 8), MO_KIND_UNKNOWN, ctr)
101 // ---- multipart ----
102 let hdr: *u8 = sys_mmap(MG_BUF)
103 let hn: i64 = mo_cat(hdr, 0, "POST /motion/upload HTTP/1.1\r\nHost: x\r\nContent-Type: multipart/form-data; boundary=----abc123\r\nContent-Length: 10\r\n\r\n" as *u8)
104 let bnd: *u8 = sys_mmap(MO_VAL_CAP)
105 let bl: i64 = mo_boundary(hdr, hn, bnd, MO_VAL_CAP)
106 gv_check("T6 multipart: the boundary token is read from the header exactly" as *u8, (mo_streq(bnd, "----abc123" as *u8) == 1) as i64, ctr)
107 let body: *u8 = sys_mmap(MG_BUF)
108 var bn: i64 = mo_cat(body, 0, "------abc123\r\nContent-Disposition: form-data; name=\"cells\"\r\n\r\n128\r\n------abc123\r\nContent-Disposition: form-data; name=\"model\"; filename=\"x.glb\"\r\nContent-Type: application/octet-stream\r\n\r\nglTFDATA\r\n------abc123--\r\n" as *u8)
109 let off: *i64 = sys_mmap(16) as *i64
110 let len: *i64 = sys_mmap(16) as *i64
111 let f1: i64 = mo_part_find(body, bn, bnd, bl, "cells" as *u8, off, len)
112 var cellsok: i64 = 0
113 if f1 == 1 { if len[0] == 3 { if mo_atoi(((body as i64) + off[0]) as *u8, 3) == 128 { cellsok = 1 } } }
114 gv_check("T7a multipart: the cells part is found with exactly its three bytes" as *u8, cellsok, ctr)
115 let f2: i64 = mo_part_find(body, bn, bnd, bl, "model" as *u8, off, len)
116 var modelok: i64 = 0
117 if f2 == 1 { if len[0] == 8 { if mo_starts(((body as i64) + off[0]) as *u8, 8, "glTFDATA" as *u8) == 1 { modelok = 1 } } }
118 gv_check("T7b multipart: the file part is found with exactly its eight bytes" as *u8, modelok, ctr)
119 gv_check_eq("T7c multipart: the file part's bytes type as GLB" as *u8, mo_kind_of(((body as i64) + off[0]) as *u8, len[0]), MO_KIND_GLB, ctr)
120 let cut: i64 = bn - 16
121 gv_check_eq("T8 neg-control-multipart: a body cut before its closing boundary is REFUSED (-1), never half-read" as *u8, mo_part_find(body, cut, bnd, bl, "model" as *u8, off, len), 0 - 1, ctr)
122 gv_check_eq("T8b multipart: an absent part name answers 0, distinct from malformed" as *u8, mo_part_find(body, bn, bnd, bl, "nothere" as *u8, off, len), 0, ctr)
123 // ---- form and query decoding ----
124 let q: *u8 = sys_mmap(MG_BUF)
125 let qn: i64 = mo_cat(q, 0, "job=123&v=accept&words=hello+world%21" as *u8)
126 let val: *u8 = sys_mmap(MO_VAL_CAP)
127 let wl: i64 = mo_kv(q, qn, "words" as *u8, val, MO_VAL_CAP)
128 var wok: i64 = 0
129 if wl == 12 { if mo_starts(val, 11, "hello world" as *u8) == 1 { if (val[11] as i64) == 33 { wok = 1 } } }
130 gv_check("T9 form decode: plus becomes space and a percent escape decodes to its byte" as *u8, wok, ctr)
131 mo_kv(q, qn, "v" as *u8, val, MO_VAL_CAP)
132 gv_check("T9b form decode: a key that is a prefix of another (v vs words) answers its own value" as *u8, (mo_streq(val, "accept" as *u8) == 1) as i64, ctr)
133 let pth: *u8 = sys_mmap(MO_VAL_CAP)
134 let pn: i64 = mo_cat(pth, 0, "/motion/anim?job=123&clip=salsa" as *u8)
135 mo_qparam(pth, pn, "clip" as *u8, val, MO_VAL_CAP)
136 gv_check("T9c query: clip is read after the question mark" as *u8, (mo_streq(val, "salsa" as *u8) == 1) as i64, ctr)
137 gv_check_eq("T9d neg-control-decode: a truncated percent escape is refused (-1)" as *u8, mo_urldecode("ab%2" as *u8, 4, val, MO_VAL_CAP), 0 - 1, ctr)
138 // ---- path shape ----
139 let ap: *u8 = sys_mmap(MO_VAL_CAP)
140 let an: i64 = mo_cat(ap, 0, "/motion/art/17887/rig.glb" as *u8)
141 mo_last_seg(ap, an, val, MO_VAL_CAP)
142 gv_check("T10a path: the last segment is the artifact name" as *u8, (mo_streq(val, "rig.glb" as *u8) == 1) as i64, ctr)
143 mo_prev_seg(ap, an, val, MO_VAL_CAP)
144 gv_check("T10b path: the segment before it is the job id" as *u8, (mo_streq(val, "17887" as *u8) == 1) as i64, ctr)
145 gv_check_eq("T10c path: /art/ is recognised anywhere in the path, prefix-agnostic" as *u8, mo_path_has(ap, an, "/art/" as *u8), 1, ctr)
146 gv_check_eq("T11a shape: a job id is digits only" as *u8, mo_digits_only("17887" as *u8), 1, ctr)
147 gv_check_eq("T11b neg-control-shape: a job id with a letter is refused" as *u8, mo_digits_only("178a7" as *u8), 0, ctr)
148 gv_check_eq("T11c neg-control-shape: a traversal name is refused" as *u8, mo_safe_name("../status" as *u8), 0, ctr)
149 gv_check_eq("T11d neg-control-shape: a slash in a name is refused" as *u8, mo_safe_name("a/b.png" as *u8), 0, ctr)
150 gv_check_eq("T11e shape: an ordinary artifact name passes" as *u8, mo_safe_name("posed_walk_2.glb" as *u8), 1, ctr)
151 // ---- status rows and log fields ----
152 let st: *u8 = sys_mmap(MG_BUF)
153 let sn: i64 = mo_cat(st, 0, "stage=done\nok=1\nmixed_limbs=9\nlimbs=2\nrig_sha256=abc\n" as *u8)
154 gv_check_eq("T12a status: a line-anchored key reads its own line, not a suffix match (limbs=2, not mixed_limbs=9)" as *u8, mo_status_field(st, sn, "limbs" as *u8), 2, ctr)
155 gv_check_eq("T12b status: an absent key answers -1, never 0" as *u8, mo_status_field(st, sn, "joints" as *u8), 0 - 1, ctr)
156 mo_status_str(st, sn, "rig_sha256" as *u8, val, MO_VAL_CAP)
157 gv_check("T12c status: a string field reads to the end of its line" as *u8, (mo_streq(val, "abc" as *u8) == 1) as i64, ctr)
158 let lg: *u8 = sys_mmap(MG_BUF)
159 let ln: i64 = mo_cat(lg, 0, "CURVESKEL verts=193368 tris=64456 grid=100x29x67 limbs=6 joints=54\nNXAUTORIG-MESH rc=0 limbs=6 joints=54 branches=5 mixed_verts=120\n" as *u8)
160 gv_check_eq("T13a log field: verts is read from the organ's own report line" as *u8, mo_log_field(lg, ln, "verts" as *u8), 193368, ctr)
161 gv_check_eq("T13b log field: mixed_verts is read by its full key" as *u8, mo_log_field(lg, ln, "mixed_verts" as *u8), 120, ctr)
162 // ---- renderers (the real template on this host; SKIP if it is absent) ----
163 let tmpl: *u8 = mo_read(MO_TMPL, lp)
164 var have_tmpl: i64 = 0
165 if (tmpl as i64) != 0 { have_tmpl = 1 }
166 if gv_need("template knowledge/motion_page.tmpl present on this host" as *u8, have_tmpl, ctr) == 1 {
167 let clips: *u8 = sys_mmap(MG_BUF)
168 let cn: i64 = mo_cat(clips, 0, "walk_a|/tmp/nx_motion_gate/absent_donor.nxa|10|House walk, frame A|house|frozen from ref9d ANIM\n" as *u8)
169 let demos: *u8 = sys_mmap(MG_BUF)
170 let dn: i64 = mo_cat(demos, 0, "d1|Demo|d1.png|d1.nxa|923|4010|233|192|peel plus heat|note\nd2|Ungraded demo|||||||||\n" as *u8)
171 let pg: *u8 = sys_mmap(MO_PAGE_CAP)
172 let bodyb: *u8 = sys_mmap(MO_PAGE_CAP)
173 let bl2: i64 = mo_body_index(bodyb, clips, cn, demos, dn)
174 let pn2: i64 = mo_splice(pg, MO_PAGE_CAP, tmpl, lp[0], "" as *u8, 0, bodyb, bl2)
175 gv_check("T14a index: renders and carries the upload form (name=model, multipart)" as *u8, ((pn2 > 0) as i64) * ((mo_find(pg, pn2, "name=\"model\"" as *u8) >= 0) as i64) * ((mo_find(pg, pn2, "multipart/form-data" as *u8) >= 0) as i64), ctr)
176 gv_check("T14b index: no script tag anywhere -- plain forms only" as *u8, (mo_find(pg, pn2, "<script" as *u8) < 0) as i64, ctr)
177 gv_check("T14c index: a demo with no referee fields prints UNGRADED, never a blank" as *u8, (mo_find(pg, pn2, "UNGRADED" as *u8) >= 0) as i64, ctr)
178 gv_check("T14d index: a clip whose donor is absent is marked ABSENT on the page" as *u8, (mo_find(pg, pn2, "ABSENT" as *u8) >= 0) as i64, ctr)
179 gv_check("T14e index: the cap is printed from the ONE constant" as *u8, (mo_find(pg, pn2, "Direct upload cap 8 MB" as *u8) >= 0) as i64, ctr)
180 let jb: *u8 = sys_mmap(MO_PAGE_CAP)
181 let jn: i64 = mo_body_job(jb, "17887" as *u8, st, sn, 0, clips, cn, "" as *u8, 0, "" as *u8, 0)
182 gv_check("T15a job: an unfinished job renders RUNNING and no download links" as *u8, ((mo_find(jb, jn, "RUNNING" as *u8) >= 0) as i64) * ((mo_find(jb, jn, "rig.glb" as *u8) < 0) as i64), ctr)
183 let jn2: i64 = mo_body_job(jb, "17887" as *u8, st, sn, 1, clips, cn, "" as *u8, 0, "" as *u8, 0)
184 gv_check("T15b job: a finished job renders the download links, the clip form and the verdict form" as *u8, ((mo_find(jb, jn2, "rig.glb" as *u8) >= 0) as i64) * ((mo_find(jb, jn2, "name=\"clip\"" as *u8) >= 0) as i64) * ((mo_find(jb, jn2, "/motion/verdict" as *u8) >= 0) as i64), ctr)
185 }
186 // ---- END TO END: the job organ on a box, twice, and an OBJ refusal ----
187 var have_rig: i64 = 0
188 if mo_exists(MG_RIG_ELF) == 1 { have_rig = 1 }
189 if gv_need("job organ _offc/nx_motion_rig.elf deployed on this host" as *u8, have_rig, ctr) == 1 {
190 sys_mkdir(MG_ROOT, 493)
191 let root: *u8 = sys_mmap(MO_PATH_CAP)
192 var ro: i64 = mo_cat(root, 0, MG_ROOT); root[ro] = 47 as u8; ro = mo_num(root, ro + 1, sys_clock_now_us()); root[ro] = 0 as u8
193 sys_mkdir(root, 493)
194 let boxp: *u8 = mo_join(root, "box.nxa" as *u8)
195 let wrote: i64 = mg_box(boxp)
196 gv_check("T16a fixture-reached-the-condition: the box NXA was written by the estate's own writer" as *u8, (wrote > 0) as i64, ctr)
197 let boxb: *u8 = mo_read(boxp, lp)
198 // CAPTURE THE FIXTURE LENGTH ONCE. The first cut re-read lp[0] after run a's status read had overwritten it, so run b's
199 // box was written truncated to the status file's length and refused at the skeleton stage -- the determinism tooth
200 // then failed on a fixture that never reached its condition (measured 2026-09-06, 43 of 44). The length is pinned here.
201 let boxn: i64 = lp[0]
202 gv_check("T16a2 fixture-reached-the-condition: the box read back with the bytes the writer reported" as *u8, (boxn == wrote) as i64, ctr)
203 let ja: *u8 = mg_jobdir(root, "a" as *u8, "nxa" as *u8, boxb, boxn)
204 let rca: i64 = mg_run_rig(ja)
205 gv_check_eq("T16b end to end: rig exits 0 on the box" as *u8, rca, 0, ctr)
206 let sta: *u8 = mo_read(mo_join(ja, "status" as *u8), lp)
207 var san: i64 = lp[0]
208 if (sta as i64) == 0 { san = 0 }
209 gv_check_eq("T16c end to end: status ok=1 with the done marker present" as *u8, mo_status_field(sta, san, "ok" as *u8) * mo_exists(mo_join(ja, "done" as *u8)), 1, ctr)
210 let limbs: i64 = mo_status_field(sta, san, "limbs" as *u8)
211 let joints: i64 = mo_status_field(sta, san, "joints" as *u8)
212 gv_check("T16d end to end: a bar peels at least two limbs with at least three joints (the curveskel gate's prism reads 2)" as *u8, ((limbs >= 2) as i64) * ((joints >= 3) as i64), ctr)
213 let glbn: i64 = mo_size(mo_join(ja, "rig.glb" as *u8))
214 gv_check("T16e end to end: rig.glb was exported with bytes" as *u8, (glbn > 0) as i64, ctr)
215 let pngn: i64 = mo_size(mo_join(ja, "rig_view.png" as *u8))
216 gv_check("T16f end to end: rig_view.png was rendered with bytes (UV unwrap then the textured rasteriser)" as *u8, (pngn > 0) as i64, ctr)
217 let sha_a: *u8 = sys_mmap(MO_VAL_CAP)
218 let hl: i64 = mo_status_str(sta, san, "rig_sha256" as *u8, sha_a, MO_VAL_CAP)
219 gv_check_eq("T16g end to end: the rig digest is a 64-hex sha256" as *u8, hl, MG_SHA_LEN, ctr)
220 let jb2: *u8 = mg_jobdir(root, "b" as *u8, "nxa" as *u8, boxb, boxn)
221 let rcb: i64 = mg_run_rig(jb2)
222 gv_check_eq("T17a fixture-reached-the-condition: the second run rigged the same bytes with exit 0" as *u8, rcb, 0, ctr)
223 let stb: *u8 = mo_read(mo_join(jb2, "status" as *u8), lp)
224 var sbn: i64 = lp[0]
225 if (stb as i64) == 0 { sbn = 0 }
226 let sha_b: *u8 = sys_mmap(MO_VAL_CAP)
227 mo_status_str(stb, sbn, "rig_sha256" as *u8, sha_b, MO_VAL_CAP)
228 gv_check("T17b determinism: the same bytes rigged twice print ONE 64-hex digest" as *u8, ((mo_streq(sha_a, sha_b) == 1) as i64) * ((hl == MG_SHA_LEN) as i64), ctr)
229 let objb: *u8 = sys_mmap(MG_BUF)
230 let on: i64 = mo_cat(objb, 0, "v 0 0 0\nv 1 0 0\nv 0 1 0\nf 1 2 3\n" as *u8)
231 let jc: *u8 = mg_jobdir(root, "c" as *u8, "obj" as *u8, objb, on)
232 let rcc: i64 = mg_run_rig(jc)
233 let stc: *u8 = mo_read(mo_join(jc, "status" as *u8), lp)
234 var scn: i64 = lp[0]
235 if (stc as i64) == 0 { scn = 0 }
236 mo_status_str(stc, scn, "stage" as *u8, val, MO_VAL_CAP)
237 gv_check("T18 neg-control-refusal: an OBJ job fails at stage convert with code 415 and still writes done" as *u8, ((rcc != 0) as i64) * ((mo_streq(val, "convert" as *u8) == 1) as i64) * ((mo_status_field(stc, scn, "rc_convert" as *u8) == 415) as i64) * mo_exists(mo_join(jc, "done" as *u8)), ctr)
238 gv_values_head()
239 gv_kv("box_limbs" as *u8, limbs)
240 gv_kv("box_joints" as *u8, joints)
241 gv_kv("box_mixed_verts" as *u8, mo_status_field(sta, san, "mixed_verts" as *u8))
242 gv_kv("box_rig_glb_bytes" as *u8, glbn)
243 gv_kv("box_rig_view_png_bytes" as *u8, pngn)
244 gv_kv("box_rig_ms" as *u8, mo_status_field(sta, san, "ms" as *u8))
245 gv_kv("upload_cap_bytes" as *u8, MO_UPLOAD_CAP)
246 }
247 return gv_verdict("nx_motion_gate" as *u8, ctr, "the door's rulers and the job organ, on inputs the gate wrote itself" as *u8)
248}