code wiki / _hdl_build / nx_mvault_gate.nx
nx_mvault_gate.nx source
↩ module page · 130 lines · 5911 B
1// nx_mvault_gate.nx -- gate for the vault CLI wrapper (classify/tag/measure/record).
2// Authored 2026-07-18 (sess 02796e0e) on nx_gate_verdict lib (migrate-on-touch D001 -- every
3// gate you touch moves onto the DRY verdict lib). GATE-PROOFS the previously demo-proven wrapper:
4// T1 classify -> class/real/cid JSON T2 re-classify SAME bytes -> identical output
5// (deterministic content-CID = the dedup foundation, no store state needed)
6// T3 tag -> open booru namespace "ns:value" T4 measure -> lossless "axis=value@leg#conf"
7// T5 (neg) classify MISSING file -> rc!=0 (fail-closed) T6 record -> seg-store write path
8// Fixture = the staged ELF itself (/tmp/nx_mvault.sov.elf, guaranteed present at gate-run) so the
9// gate needs no file-create syscall. Drives the staged CLI via dep_run_capture (stdout->tmpfile).
10// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
11import "nx_gate_verdict.nx"
12import "nx_deploy_lib.nx"
13import "nx_syscalls.nx"
14
15const MVG_AVCAP: i64 = 128
16const MVG_LENBOX: i64 = 8
17
18func mvg_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
19func mvg_has(q: *u8, n: i64, s: *u8) -> i64 {
20 let sn: i64 = mvg_slen(s)
21 if sn == 0 { return 1 }
22 var i: i64 = 0
23 while i + sn <= n {
24 var hit: i64 = 1
25 var j: i64 = 0
26 while j < sn { if q[i+j] != s[j] { hit = 0; j = sn } else { j = j + 1 } }
27 if hit == 1 { return 1 }
28 i = i + 1
29 }
30 return 0
31}
32
33func main() -> i64 {
34 let ctr: *i64 = gv_ctr()
35 gv_head("nx_mvault gate -- vault CLI: classify JSON, CID determinism, tag/measure, fail-closed, record" as *u8)
36 let elf: *u8 = "/tmp/nx_mvault.sov.elf" as *u8
37 let fix: *u8 = "/tmp/nx_mvault.sov.elf" as *u8
38 let o1: *u8 = "/tmp/mvg1.txt" as *u8
39 let o2: *u8 = "/tmp/mvg2.txt" as *u8
40 let av: *i64 = sys_mmap(MVG_AVCAP) as *i64
41 let lb: *i64 = sys_mmap(MVG_LENBOX) as *i64
42
43 // T1 classify the fixture -> rc=0, JSON has class + real + cid
44 av[0] = "classify" as *u8 as i64
45 av[1] = fix as i64
46 av[2] = "real" as *u8 as i64
47 av[3] = "gatefix" as *u8 as i64
48 av[4] = "elf" as *u8 as i64
49 let r1: i64 = dep_run_capture(elf, av, 5, o1)
50 lb[0] = 0
51 let b1: *u8 = sys_read_file(o1, lb)
52 let n1: i64 = lb[0]
53 var t1: i64 = 0
54 if r1 == 0 { if (b1 as i64) != 0 { if mvg_has(b1, n1, "class" as *u8) == 1 { if mvg_has(b1, n1, "real" as *u8) == 1 { if mvg_has(b1, n1, "cid" as *u8) == 1 { t1 = 1 } } } } }
55 gv_check("T1 classify -> class/real/cid JSON (rc=0)" as *u8, t1, ctr)
56
57 // T2 classify SAME bytes -> byte-identical output = deterministic content-CID (dedup foundation)
58 let r2: i64 = dep_run_capture(elf, av, 5, o2)
59 lb[0] = 0
60 let b2: *u8 = sys_read_file(o2, lb)
61 let n2: i64 = lb[0]
62 var t2: i64 = 0
63 if r2 == 0 { if (b2 as i64) != 0 { if n2 == n1 { if n2 > 0 {
64 t2 = 1
65 var i: i64 = 0
66 while i < n2 { if b2[i] != b1[i] { t2 = 0; i = n2 } else { i = i + 1 } }
67 } } } }
68 gv_check("T2 re-classify SAME bytes -> identical output (deterministic CID = dedup)" as *u8, t2, ctr)
69
70 // T3 tag ns value -> "perf:crouching"
71 av[0] = "tag" as *u8 as i64
72 av[1] = "perf" as *u8 as i64
73 av[2] = "crouching" as *u8 as i64
74 let r3: i64 = dep_run_capture(elf, av, 3, o1)
75 lb[0] = 0
76 let b3: *u8 = sys_read_file(o1, lb)
77 let n3: i64 = lb[0]
78 var t3: i64 = 0
79 if r3 == 0 { if (b3 as i64) != 0 { if mvg_has(b3, n3, "perf:crouching" as *u8) == 1 { t3 = 1 } } }
80 gv_check("T3 tag perf crouching -> perf:crouching (open booru namespace)" as *u8, t3, ctr)
81
82 // T4 measure axis value leg conf -> "hip_waist=700" + "math"
83 av[0] = "measure" as *u8 as i64
84 av[1] = "hip_waist" as *u8 as i64
85 av[2] = "700" as *u8 as i64
86 av[3] = "math" as *u8 as i64
87 av[4] = "920" as *u8 as i64
88 let r4: i64 = dep_run_capture(elf, av, 5, o1)
89 lb[0] = 0
90 let b4: *u8 = sys_read_file(o1, lb)
91 let n4: i64 = lb[0]
92 var t4: i64 = 0
93 if r4 == 0 { if (b4 as i64) != 0 { if mvg_has(b4, n4, "hip_waist=700" as *u8) == 1 { if mvg_has(b4, n4, "math" as *u8) == 1 { t4 = 1 } } } }
94 gv_check("T4 measure hip_waist 700 math 920 -> hip_waist=700@math# lossless" as *u8, t4, ctr)
95
96 // T5 (neg) classify a MISSING file -> rc!=0 (fail-closed, cannot read)
97 av[0] = "classify" as *u8 as i64
98 av[1] = "/tmp/mvg_absent_zzz.bin" as *u8 as i64
99 av[2] = "real" as *u8 as i64
100 av[3] = "x" as *u8 as i64
101 av[4] = "bin" as *u8 as i64
102 let r5: i64 = dep_run_capture(elf, av, 5, o1)
103 var t5: i64 = 0
104 if r5 != 0 { t5 = 1 }
105 gv_check("T5 classify MISSING file -> rc!=0 (fail-closed)" as *u8, t5, ctr)
106
107 // Ensure a writable knowledge/store/ in CWD so record's seg-store put works from ANY CWD.
108 // (record writes CWD-relative knowledge/store/mvault-; build env + prod nishihost/ have it,
109 // bare /tmp did not -> was the honest 5/6-from-/tmp cause. mkdir makes the gate CWD-robust,
110 // no silent context-dependence. mkdir returns -EEXIST if present = harmless.)
111 sys_mkdir("knowledge" as *u8, 511)
112 sys_mkdir("knowledge/store" as *u8, 511)
113 // T6 record the fixture -> rc=0 + "recorded" (exercises the seg-store write path)
114 av[0] = "record" as *u8 as i64
115 av[1] = fix as i64
116 av[2] = "real" as *u8 as i64
117 av[3] = "gatefix" as *u8 as i64
118 av[4] = "elf" as *u8 as i64
119 let r6: i64 = dep_run_capture(elf, av, 5, o1)
120 lb[0] = 0
121 let b6: *u8 = sys_read_file(o1, lb)
122 let n6: i64 = lb[0]
123 var t6: i64 = 0
124 if r6 == 0 { if (b6 as i64) != 0 { if mvg_has(b6, n6, "recorded" as *u8) == 1 { t6 = 1 } } }
125 gv_check("T6 record -> rc=0 + recorded (seg-store write path)" as *u8, t6, ctr)
126
127 let rc: i64 = gv_verdict("MVAULT-GATE" as *u8, ctr, "vault CLI wrapper: classify JSON, deterministic CID dedup, tag/measure lossless, fail-closed, record" as *u8)
128 sys_exit(rc)
129 return rc
130}