nx_nishi_builder_gate.nx source

1// nx_nishi_builder_gate.nx -- GATE for THE NISHI BUILDER (universal, domain-aware). Hermetic (/tmp): teach 2// across ad/web/game -> count + round-trip, DOMAIN ISOLATION (an ad emitter is not visible in web), idempotent 3// re-teach, GROW (count increases), and the SOVEREIGNTY invariant (a <script/src= template is REJECTED in ANY 4// domain). Sovereign. license_tier: ORIGINAL 5import "nx_nishi_builder.nx" 6import "nx_ad_serve.nx" 7import "nx_syscalls.nx" 8import "nx_gate_verdict.nx" 9 10const NG_PATH: *u8 = "/tmp/nishi_builder_gate.tsv" 11 12func g_p(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 13func g_i(v: i64) -> i64 { let t: *u8 = sys_mmap(24); var m: i64 = v; var k: i64 = 0; if m == 0 { t[0]=48 as u8; k=1 } while m>0 { t[k]=(48+(m%10)) as u8; m=m/10; k=k+1 } let o: *u8=sys_mmap(24); var w: i64=0; var q: i64=k-1; while q>=0 { o[w]=t[q]; w=w+1; q=q-1 } sys_write(1,o,w); return 0 } 14 15func main(argc: i64, argv: *i64) -> i64 { 16 g_p("=== nx_nishi_builder_gate ===\n" as *u8) 17 let fd: i64 = sys_openat_wr(NG_PATH, 420); if fd >= 0 { sys_close(fd) } 18 nb_register(NG_PATH, "ad" as *u8, "size" as *u8, "leaderboard" as *u8, "Leaderboard" as *u8, "728x90" as *u8) 19 nb_register(NG_PATH, "web" as *u8, "section" as *u8, "hero" as *u8, "Hero" as *u8, "<section><h1>{TITLE}</h1></section>" as *u8) 20 nb_register(NG_PATH, "game" as *u8, "mechanic" as *u8, "jump" as *u8, "Jump" as *u8, "impulse=12|gravity=0.6" as *u8) 21 var pass: i64 = 0; var tot: i64 = 0 22 23 // T1 cross-domain count + presence 24 tot = tot + 1; var ok1: i64 = 1 25 if nb_count(NG_PATH, "ad" as *u8, "*" as *u8) != 1 { ok1 = 0 } 26 if nb_count(NG_PATH, "web" as *u8, "*" as *u8) != 1 { ok1 = 0 } 27 if nb_count(NG_PATH, "game" as *u8, "*" as *u8) != 1 { ok1 = 0 } 28 if nb_present(NG_PATH, "web" as *u8, "section" as *u8, "hero" as *u8) != 1 { ok1 = 0 } 29 if ok1 == 1 { pass = pass + 1; g_p("PASS T1 cross-domain: ad/web/game each = 1, web hero present\n" as *u8) } else { g_p("FAIL T1\n" as *u8) } 30 31 // T2 round-trip the web hero template 32 let tpl: *u8 = sys_mmap(4096) 33 let got: i64 = nb_lookup(NG_PATH, "web" as *u8, "section" as *u8, "hero" as *u8, tpl) 34 tot = tot + 1; var ok2: i64 = 1 35 if got != 1 { ok2 = 0 } 36 if as_contains(tpl, as_len(tpl), "{TITLE}" as *u8) != 1 { ok2 = 0 } 37 if ok2 == 1 { pass = pass + 1; g_p("PASS T2 round-trip: web/section/hero template carries {TITLE}\n" as *u8) } else { g_p("FAIL T2\n" as *u8) } 38 39 // T3 DOMAIN ISOLATION: the ad emitter is NOT visible under web, and vice versa 40 tot = tot + 1; var ok3: i64 = 1 41 if nb_present(NG_PATH, "web" as *u8, "size" as *u8, "leaderboard" as *u8) != 0 { ok3 = 0 } 42 if nb_present(NG_PATH, "ad" as *u8, "section" as *u8, "hero" as *u8) != 0 { ok3 = 0 } 43 if ok3 == 1 { pass = pass + 1; g_p("PASS T3 domain isolation: emitters scoped to their domain\n" as *u8) } else { g_p("FAIL T3\n" as *u8) } 44 45 // T4 idempotent re-teach 46 let r: i64 = nb_register(NG_PATH, "web" as *u8, "section" as *u8, "hero" as *u8, "Hero" as *u8, "<section/>" as *u8) 47 tot = tot + 1; var ok4: i64 = 1 48 if r != 0 { ok4 = 0 } 49 if nb_count(NG_PATH, "web" as *u8, "*" as *u8) != 1 { ok4 = 0 } 50 if ok4 == 1 { pass = pass + 1; g_p("PASS T4 idempotent: re-teach returns 0, count unchanged\n" as *u8) } else { g_p("FAIL T4\n" as *u8) } 51 52 // T5 GROW a domain 53 nb_register(NG_PATH, "web" as *u8, "section" as *u8, "card" as *u8, "Card" as *u8, "<article>{BODY}</article>" as *u8) 54 tot = tot + 1 55 if nb_count(NG_PATH, "web" as *u8, "*" as *u8) == 2 { pass = pass + 1; g_p("PASS T5 grow: web 1->2 (the builder grew a domain)\n" as *u8) } else { g_p("FAIL T5\n" as *u8) } 56 57 // T6 SOVEREIGNTY invariant across domains 58 tot = tot + 1; var ok6: i64 = 1 59 if nb_template_safe("<section><h1>hi</h1></section>" as *u8) != 1 { ok6 = 0 } 60 if nb_template_safe("<script>x</script>" as *u8) != 0 { ok6 = 0 } 61 if nb_template_safe("<img src='//cdn/x'>" as *u8) != 0 { ok6 = 0 } 62 if ok6 == 1 { pass = pass + 1; g_p("PASS T6 sovereignty: clean safe; <script + src= REJECTED in any domain\n" as *u8) } else { g_p("FAIL T6\n" as *u8) } 63 64 g_p("nx_nishi_builder_gate pass=" as *u8); g_i(pass); g_p("/" as *u8); g_i(tot) 65 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 66 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 67 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 68 let ctr__dry: *i64 = gv_ctr() 69 ctr__dry[0] = pass 70 ctr__dry[1] = tot 71 let rc__dry: i64 = gv_verdict("NISHI-BUILDER-GATE" as *u8, ctr__dry, "ONE builder, MANY domains, sovereign-safe, self-growing)" as *u8) 72 sys_exit(rc__dry) 73 return rc__dry 74}