nx_osattest_gate.nx source

1// nx_osattest_gate.nx -- GATE for LR6 (lang.plan rung LR6, symbol nxos_lang_ring_attest). 2// 3// SUBJECT: the DEPLOYED nx_osattest organ, driven end-to-end against a COMPILER THE CALLER NAMES. 4// The compiler is argv[1] and is MANDATORY: this gate exists to compare a challenger compiler against 5// the live one, and a silent default would produce a fully-formed verdict about a stale leftover binary. 6// 7// WHAT IT PROVES ABOUT THE ATTESTER (not about the estate's cleanliness -- a REFUSED closure is data): 8// * its partition SUMS to the population it declares; 9// * a source that MUST be refused under a live mode is counted REFUSED and the DECLARED RULE is 10// NAMED, so a refusal for an unrelated reason cannot wear the mode's name; 11// * a clean source is still counted ATTESTED under that same live mode -- an attester that refused 12// everything would score perfectly on the refusal tooth alone; 13// * a mode that is NOT enforcing is UNOBSERVABLE and is counted NEITHER clean NOR refused. This is 14// the load-bearing neg-control: nx_compile_x86's long-flag dispatch keys on ONE BYTE (arg[2]), so an 15// unrecognised flag is SILENTLY IGNORED and the compile returns 0. The fixture axis BOGUS carries a 16// real-looking flag the compiler does not know; an attester that trusted flag NAMES would report it 17// ATTESTED, and its green would be indistinguishable from a true one. 18// 19// FIXTURES ARE ASSEMBLED AT RUNTIME under /tmp/nxosattg/ and every receipt this gate produces is written 20// THERE -- the production receipt at knowledge/status/ is never touched by a gate run. 21// The two closure subjects are REAL estate sources whose behaviour under --ptrprov is already gate-proven 22// by nx_boundscheck_gate (T5 in-range accepted, T9 const-OOB builds under default, T10 refused under 23// ptrprov), so the expectations here are inherited measurements, not this author's guesses. 24// 25// usage: nx_osattest_gate [organ_elf] [compiler_elf] (CWD = the tree root, like nx_cc_equiv_gate) 26// organ_elf defaults to ../nx_osattest.elf; SUBJECT-FIRST because that is where nx_gate_bite puts it. 27// compiler_elf defaults to the gate_compiler row of knowledge/lang_attest.conf, and with neither the 28// gate REFUSES -- the binary under test is always named, never found lying around. 29// license_tier: ORIGINAL No hw writes (Rule 26). 30import "nx_syscalls.nx" 31import "nx_gate_verdict.nx" 32import "nx_ccgate_lib.nx" 33import "nx_lineconf_lib.nx" 34 35// WHERE THE MEASURED COMPILER COMES FROM WHEN NO ARGV OVERRIDE IS GIVEN. This is NOT a silent default: 36// it is a DECLARED row in versioned data, the gate PRINTS which source it used, and the receipt carries 37// that compiler's sha256 -- so the binary under test is always NAMED. With neither argv nor the row the 38// gate REFUSES. It exists because /api/gate_run forwards no arguments (MEASURED 2026-08-25: it ran this 39// gate bare and correctly got the refusal, exit_code=2 verdict=RED), and a gate the roster can only ever 40// see RED is a gate everyone learns to ignore -- which is how a real detector becomes a comment. 41const OG_CONF: *u8 = "knowledge/lang_attest.conf" 42const OG_CCKEY: *u8 = "gate_compiler" 43const OG_CCW: i64 = 1024 44 45const OG_WORD: i64 = 8 46const OG_ARGV: i64 = 8 47 48// the attester's declared exit codes, mirrored here so a tooth compares against a NAME not a digit 49const OG_RC_OK: i64 = 0 50const OG_RC_USAGE: i64 = 2 51const OG_RC_UNPROVEN: i64 = 3 52 53func og_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 54 55// EVERY stderr write goes through here: a hand-counted length beside a literal is a second copy of that 56// literal's shape and the two drift silently. Derive it, never count it. 57func og_err(s: *u8) -> i64 { sys_write(2, s, og_len(s)); return 0 } 58 59// write a NUL-terminated string to path, length DERIVED from the string (never hand-counted beside it) 60func og_write(path: *u8, s: *u8) -> i64 { 61 let fd: i64 = sys_openat_wr(path, CCG_MODE_RW) 62 if fd < 0 { return 0 - 1 } 63 let n: i64 = og_len(s) 64 sys_write(fd, s, n) 65 sys_close(fd) 66 return n 67} 68 69// fork the organ with up to three arguments (0 = omit); returns its EXIT CODE. 70func og_run(elf: *u8, a1: *u8, a2: *u8, a3: *u8, outp: *u8, errp: *u8) -> i64 { 71 let a: *i64 = sys_mmap(OG_WORD * OG_ARGV) as *i64 72 var n: i64 = 0 73 a[n] = elf as i64; n = n + 1 74 if (a1 as i64) != 0 { a[n] = a1 as i64; n = n + 1 } 75 if (a2 as i64) != 0 { a[n] = a2 as i64; n = n + 1 } 76 if (a3 as i64) != 0 { a[n] = a3 as i64; n = n + 1 } 77 a[n] = 0 78 let ofd: i64 = sys_openat_wr(outp, CCG_MODE_RW) 79 let efd: i64 = sys_openat_wr(errp, CCG_MODE_RW) 80 let st: i64 = ccg_run(elf, a, ofd, efd) 81 sys_close(ofd) 82 sys_close(efd) 83 return wait_status_rc(st) 84} 85 86func og_exists(p: *u8) -> i64 { let fd: i64 = sys_openat_rd(p); if fd < 0 { return 0 } sys_close(fd); return 1 } 87 88// A CALLER HANDS US PATHS RELATIVE TO THE TREE ROOT, AND ccg_anchor_root MAY HAVE CHDIR'D INTO buildroot 89// UNDERNEATH THEM -- which silently invalidates every one of them. MEASURED 2026-08-25: nx_gate_bite 90// passes its rebuilt subject as `buildroot/_build/<t>.sov.elf`; after the anchor that resolves to 91// buildroot/buildroot/... , the file does not open, and the gate reads RED for a reason that has nothing 92// to do with its subject -- a red for the wrong reason, which is the easiest false proof to accept. 93// RESOLVE BY TRYING, never by assuming: the path as given, then the same path from the parent. Returns 94// 1 and fills `out`, or 0 when it resolves nowhere -- and 0 REFUSES rather than guessing a third form. 95func og_resolve(p: *u8, anchored: i64, out: *u8, cap: i64) -> i64 { 96 if og_exists(p) == 1 { 97 var i: i64 = 0 98 while p[i] != (0 as u8) { if i < cap - 1 { out[i] = p[i] } i = i + 1 } 99 out[i] = 0 as u8 100 return 1 101 } 102 if anchored == 1 { 103 out[0] = 46 as u8 104 out[1] = 46 as u8 105 out[2] = 47 as u8 106 var j: i64 = 0 107 while p[j] != (0 as u8) { if j + 3 < cap - 1 { out[j + 3] = p[j] } j = j + 1 } 108 out[j + 3] = 0 as u8 109 if og_exists(out) == 1 { return 1 } 110 } 111 out[0] = 0 as u8 112 return 0 113} 114 115// how many lines of `path` contain BOTH needles; -1 when the file cannot be read, so "could not look" 116// can never be mistaken for "zero matches". 117func og_lines2(path: *u8, n1: *u8, n2: *u8) -> i64 { return ccg_file_count_lines_with2(path, n1, n2) } 118 119func main(argc: i64, argv: *i64) -> i64 { 120 let anchored: i64 = ccg_anchor_root() 121 // THE ARGV ORDER IS THE MUTATION HARNESS'S, NOT THIS AUTHOR'S PREFERENCE. nx_gate_bite's end-to-end 122 // mode rebuilds the SUBJECT per mutant and hands it to the gate as argv[1]. MEASURED 2026-08-25: 123 // with the compiler in argv[1] the harness handed this gate the ORGAN as its "compiler", the baseline 124 // run went RED, and the bite reported UNCONTROLLED -- so the gate's non-vacuity could never be 125 // measured at all. Subject first, compiler second. 126 var organ_in: *u8 = "../nx_osattest.elf" 127 if argc >= 2 { organ_in = argv[1] as *u8 } 128 let organ: *u8 = sys_mmap(OG_CCW) 129 let organ_ok: i64 = og_resolve(organ_in, anchored, organ, OG_CCW) 130 var cc_in: *u8 = 0 as *u8 131 var cc_from_argv: i64 = 0 132 if argc >= 3 { cc_in = argv[2] as *u8; cc_from_argv = 1 } 133 if cc_from_argv == 0 { 134 let cb: *u8 = sys_mmap(OG_CCW) 135 if lcf_str_of(OG_CONF, OG_CCKEY, cb, OG_CCW) > 0 { cc_in = cb } 136 } 137 var cc: *u8 = 0 as *u8 138 if (cc_in as i64) != 0 { 139 let ccr: *u8 = sys_mmap(OG_CCW) 140 if og_resolve(cc_in, anchored, ccr, OG_CCW) == 1 { cc = ccr } 141 } 142 if (cc as i64) == 0 { 143 og_err("usage: nx_osattest_gate [organ_elf] [compiler_elf]\n" as *u8) 144 og_err("REFUSED: no compiler in argv and no gate_compiler row in knowledge/lang_attest.conf -- this gate measures a NAMED compiler and will not guess one.\n" as *u8) 145 sys_exit(OG_RC_USAGE) 146 return OG_RC_USAGE 147 } 148 149 let dir: *u8 = "/tmp/nxosattg" 150 sys_mkdir(dir, CCG_MODE_X) 151 let pid: i64 = ccg_pid() 152 let confA: *u8 = ccg_path("/tmp/nxosattg/a_" as *u8, pid, ".conf" as *u8) 153 let rcptA: *u8 = ccg_path("/tmp/nxosattg/a_" as *u8, pid, ".receipt" as *u8) 154 let outA: *u8 = ccg_path("/tmp/nxosattg/a_" as *u8, pid, ".out" as *u8) 155 let errA: *u8 = ccg_path("/tmp/nxosattg/a_" as *u8, pid, ".err" as *u8) 156 let confB: *u8 = ccg_path("/tmp/nxosattg/b_" as *u8, pid, ".conf" as *u8) 157 let rcptB: *u8 = ccg_path("/tmp/nxosattg/b_" as *u8, pid, ".receipt" as *u8) 158 let outB: *u8 = ccg_path("/tmp/nxosattg/b_" as *u8, pid, ".out" as *u8) 159 let errB: *u8 = ccg_path("/tmp/nxosattg/b_" as *u8, pid, ".err" as *u8) 160 let confC: *u8 = ccg_path("/tmp/nxosattg/c_" as *u8, pid, ".conf" as *u8) 161 let rcptC: *u8 = ccg_path("/tmp/nxosattg/c_" as *u8, pid, ".receipt" as *u8) 162 let outC: *u8 = ccg_path("/tmp/nxosattg/c_" as *u8, pid, ".out" as *u8) 163 let errC: *u8 = ccg_path("/tmp/nxosattg/c_" as *u8, pid, ".err" as *u8) 164 let outD: *u8 = ccg_path("/tmp/nxosattg/d_" as *u8, pid, ".out" as *u8) 165 let errD: *u8 = ccg_path("/tmp/nxosattg/d_" as *u8, pid, ".err" as *u8) 166 167 let ctr: *i64 = gv_ctr() 168 gv_head("=== nx_osattest_gate -- LR6 NishiOS/Browser language-ring attestation: the partition sums, a planted refusal is counted AND named, a clean source is still counted clean, and a silently-ignored flag reports UNOBSERVABLE instead of ATTESTED ===" as *u8) 169 170 var t0: i64 = 0 171 if og_exists(organ) == 1 { t0 = 1 } 172 gv_check("T0 organ-elf-present-before-any-verdict-about-it (an absent artifact is indistinguishable from a broken one)" as *u8, t0, ctr) 173 var t0b: i64 = 0 174 if og_exists(cc) == 1 { t0b = 1 } 175 gv_check("T0b named-compiler-present (the gate measures the compiler it was HANDED, never one it found)" as *u8, t0b, ctr) 176 // PRINTED, deliberately NOT a tooth: both branches are legitimate, so any check here would pass in 177 // every reachable state -- decoration wearing a verdict. T0b proves the resolved path exists and T16 178 // proves the receipt names it; this line only says WHICH source supplied it. 179 ccg_val("compiler_from_argv" as *u8, cc_from_argv) 180 181 // ---- fixture A: two real closures x four axes, one of which the compiler silently ignores ---- 182 og_write(confA, "closurehash_elf=../nx_closurehash.elf\nclosurehash_root=.\nscratch_dir=/tmp/nxosattg\nclosures=2\nclosure0_name=clean-control\nclosure0_target=nx_boundscheck\nclosure1_name=planted-refuse\nclosure1_target=nx_boundscheck_constidx\naxes=4\naxis0_id=PTR\naxis0_kind=refuse\naxis0_flag=--ptrprov\naxis0_probe=runtime/nx_boundscheck_constidx.nx\naxis0_accept=runtime/nx_boundscheck.nx\naxis0_rule=outside the allocation this pointer provably refers to\naxis1_id=BOGUS\naxis1_kind=refuse\naxis1_flag=--zqx-no-such-mode\naxis1_probe=runtime/nx_boundscheck_constidx.nx\naxis1_accept=runtime/nx_boundscheck.nx\naxis1_rule=outside the allocation this pointer provably refers to\naxis2_id=UNDECL\naxis2_kind=refuse\naxis2_flag=_UNDECLARED_\naxis2_probe=_UNDECLARED_\naxis2_accept=_UNDECLARED_\naxis2_rule=_UNDECLARED_\naxis3_id=CG\naxis3_kind=emit\naxis3_flag=--no-crash-guard\naxis3_probe=runtime/nx_option_enforce_ok.nx\naxis3_accept=runtime/nx_option_enforce_ok.nx\naxis3_rule=nx_crash_guard\n" as *u8) 183 let rcA: i64 = og_run(organ, cc, confA, rcptA, outA, errA) 184 ccg_val("runA_exit" as *u8, rcA) 185 186 var t1: i64 = 0 187 if rcA == OG_RC_OK { t1 = 1 } 188 gv_check("T1 runA-exit-code-CARRIES-the-attestation-verdict (a gate deriving GREEN from a printed line would bless a failing exit)" as *u8, t1, ctr) 189 190 let s_sum: i64 = og_lines2(rcptA, "partition attested=" as *u8, "sum=8 reconciles=1" as *u8) 191 ccg_val("partition_sum_lines" as *u8, s_sum) 192 var t2: i64 = 0 193 if s_sum == 1 { t2 = 1 } 194 gv_check("T2 partition-SUMS-to-the-declared-population-2x4=8 (an unexplained residual is a leak)" as *u8, t2, ctr) 195 196 let s_pop: i64 = og_lines2(rcptA, "population=8 " as *u8, "closures=2 axes=4" as *u8) 197 ccg_val("population_lines" as *u8, s_pop) 198 var t3: i64 = 0 199 if s_pop == 1 { t3 = 1 } 200 gv_check("T3 population-is-PRINTED-not-implied (the denominator every count below is read against)" as *u8, t3, ctr) 201 202 let s_base: i64 = og_lines2(rcptA, "closure=planted-refuse " as *u8, "default_build_rc=0" as *u8) 203 ccg_val("planted_default_build_rc0_lines" as *u8, s_base) 204 var t4: i64 = 0 205 if s_base == 1 { t4 = 1 } 206 gv_check("T4 fixture-REACHED-the-condition: the planted source DOES build under the default, so its refusal under the mode is attributable to the mode and not to broken fixture source" as *u8, t4, ctr) 207 208 let s_ref: i64 = og_lines2(rcptA, "cell=planted-refuse/PTR " as *u8, "verdict=REFUSED" as *u8) 209 ccg_val("planted_refused_lines" as *u8, s_ref) 210 var t5: i64 = 0 211 if s_ref == 1 { t5 = 1 } 212 gv_check("T5 planted-source-that-MUST-be-refused-under-a-live-mode-IS-counted-REFUSED" as *u8, t5, ctr) 213 214 let s_rule: i64 = og_lines2(rcptA, "cell=planted-refuse/PTR " as *u8, "reason=outside the allocation this pointer provably refers to" as *u8) 215 ccg_val("planted_rule_named_lines" as *u8, s_rule) 216 var t6: i64 = 0 217 if s_rule == 1 { t6 = 1 } 218 gv_check("T6 the-refusal-NAMES-the-declared-rule-not-merely-THAT-it-was-refused (a refusal for an unrelated reason must not wear the mode's name)" as *u8, t6, ctr) 219 220 let s_clean: i64 = og_lines2(rcptA, "cell=clean-control/PTR " as *u8, "verdict=ATTESTED" as *u8) 221 ccg_val("clean_attested_lines" as *u8, s_clean) 222 var t7: i64 = 0 223 if s_clean == 1 { t7 = 1 } 224 gv_check("T7 POSITIVE-CONTROL a clean source is still counted ATTESTED under that same live mode (an attester that refused everything scores perfectly on T5/T6 alone)" as *u8, t7, ctr) 225 226 let s_bog: i64 = og_lines2(rcptA, "axis=BOGUS " as *u8, "why=flag-not-enforcing" as *u8) 227 ccg_val("bogus_axis_not_enforcing_lines" as *u8, s_bog) 228 var t8: i64 = 0 229 if s_bog == 1 { t8 = 1 } 230 gv_check("T8 neg-control-SILENTLY-IGNORED-FLAG: a real-looking flag the compiler does not know is reported UNOBSERVABLE with that exact reason, never LIVE (the one-byte flag dispatch makes an unknown long flag a silent no-op returning 0)" as *u8, t8, ctr) 231 232 let s_bog_att: i64 = og_lines2(rcptA, "cell=clean-control/BOGUS " as *u8, "verdict=ATTESTED" as *u8) 233 ccg_val("bogus_counted_clean_lines" as *u8, s_bog_att) 234 var t9: i64 = 0 235 if s_bog_att == 0 { t9 = 1 } 236 gv_check("T9 an-UNOBSERVABLE-mode-is-NOT-counted-CLEAN (the abstention must not flatter the score)" as *u8, t9, ctr) 237 238 let s_bog_ref: i64 = og_lines2(rcptA, "cell=clean-control/BOGUS " as *u8, "verdict=REFUSED" as *u8) 239 ccg_val("bogus_counted_refused_lines" as *u8, s_bog_ref) 240 var t10: i64 = 0 241 if s_bog_ref == 0 { t10 = 1 } 242 gv_check("T10 an-UNOBSERVABLE-mode-is-NOT-counted-REFUSED either (it is a third state, not a rounding of the other two)" as *u8, t10, ctr) 243 244 let s_bog_uno: i64 = og_lines2(rcptA, "cell=clean-control/BOGUS " as *u8, "verdict=UNOBSERVABLE" as *u8) 245 ccg_val("bogus_unobservable_lines" as *u8, s_bog_uno) 246 var t11: i64 = 0 247 if s_bog_uno == 1 { t11 = 1 } 248 gv_check("T11 and-it-IS-positively-recorded-as-UNOBSERVABLE (T9+T10 alone would pass on a cell that vanished)" as *u8, t11, ctr) 249 250 let s_und: i64 = og_lines2(rcptA, "axis=UNDECL " as *u8, "why=flag-undeclared" as *u8) 251 ccg_val("undeclared_axis_lines" as *u8, s_und) 252 var t12: i64 = 0 253 if s_und == 1 { t12 = 1 } 254 gv_check("T12 a-rung-with-NO-compiler-flag-yet-reports-flag-undeclared, a DIFFERENT reason from a flag that exists and does not enforce" as *u8, t12, ctr) 255 256 let s_den: i64 = og_lines2(rcptA, "modes_live=2 of=4" as *u8, "unobservable_modes=BOGUS,UNDECL" as *u8) 257 ccg_val("denominator_and_names_lines" as *u8, s_den) 258 var t13: i64 = 0 259 if s_den == 1 { t13 = 1 } 260 gv_check("T13 the-DENOMINATOR-travels-with-the-score-and-the-missing-modes-are-NAMED (an abstention nobody reads is a lie nobody told)" as *u8, t13, ctr) 261 262 let s_cg: i64 = og_lines2(rcptA, "cell=clean-control/CG " as *u8, "reason=guard-marker-present-in-emitted-assembly" as *u8) 263 ccg_val("emit_axis_attested_lines" as *u8, s_cg) 264 var t14: i64 = 0 265 if s_cg == 1 { t14 = 1 } 266 gv_check("T14 the-EMIT-kind-axis-reads-the-crash-guard-out-of-the-baseline-assembly (a second kind of evidence, costing no extra compile)" as *u8, t14, ctr) 267 268 let s_cgprobe: i64 = og_lines2(rcptA, "axis=CG " as *u8, "why=two-sided-emit-probe-passed" as *u8) 269 ccg_val("emit_axis_twosided_lines" as *u8, s_cgprobe) 270 var t15: i64 = 0 271 if s_cgprobe == 1 { t15 = 1 } 272 gv_check("T15 the-emit-axis-is-proven-BOTH-WAYS: the marker appears by default AND vanishes under the opt-out, so its presence tracks the guard and not some unrelated string" as *u8, t15, ctr) 273 274 let s_cid: i64 = og_lines2(rcptA, "compiler=" as *u8, cc) 275 ccg_val("compiler_named_lines" as *u8, s_cid) 276 var t16: i64 = 0 277 if s_cid == 1 { t16 = 1 } 278 gv_check("T16 the-receipt-NAMES-the-compiler-it-measured (an attestation that cannot say what it measured is not evidence)" as *u8, t16, ctr) 279 280 // ---- fixture B: a subject that does not exist. It must ABSTAIN loudly, not attest. ---- 281 og_write(confB, "closurehash_elf=../nx_closurehash.elf\nclosurehash_root=.\nscratch_dir=/tmp/nxosattg\nclosures=1\nclosure0_name=absent-subject\nclosure0_target=nx_no_such_lr6_subject_exists\naxes=1\naxis0_id=PTR\naxis0_kind=refuse\naxis0_flag=--ptrprov\naxis0_probe=runtime/nx_boundscheck_constidx.nx\naxis0_accept=runtime/nx_boundscheck.nx\naxis0_rule=outside the allocation this pointer provably refers to\n" as *u8) 282 let rcB: i64 = og_run(organ, cc, confB, rcptB, outB, errB) 283 ccg_val("runB_exit" as *u8, rcB) 284 var t17: i64 = 0 285 if rcB == OG_RC_UNPROVEN { t17 = 1 } 286 gv_check("T17 neg-control-ABSENT-SUBJECT-exits-UNPROVEN-not-OK (a confident attestation over a subject that is not there is the worst outcome available to this organ)" as *u8, t17, ctr) 287 let s_sab: i64 = og_lines2(rcptB, "cell=absent-subject/PTR " as *u8, "verdict=SUBJECT-ABSENT" as *u8) 288 ccg_val("subject_absent_lines" as *u8, s_sab) 289 var t18: i64 = 0 290 if s_sab == 1 { t18 = 1 } 291 gv_check("T18 the-absent-subject-gets-its-OWN-bucket, never folded into a mode verdict" as *u8, t18, ctr) 292 var t19: i64 = 0 293 if ccg_file_has(rcptB, "NX-OSATTEST verdict=RED" as *u8) == 1 { t19 = 1 } 294 gv_check("T19 the-canonical-LAST-line-of-an-untrustworthy-attestation-reads-RED (positional anchor: nothing above it can be mistaken for the verdict)" as *u8, t19, ctr) 295 296 // ---- fixture C: a conf declaring an empty population ---- 297 og_write(confC, "closurehash_elf=../nx_closurehash.elf\nclosurehash_root=.\nscratch_dir=/tmp/nxosattg\nclosures=0\naxes=1\naxis0_id=PTR\naxis0_kind=refuse\naxis0_flag=--ptrprov\naxis0_probe=runtime/nx_boundscheck_constidx.nx\naxis0_accept=runtime/nx_boundscheck.nx\naxis0_rule=outside the allocation this pointer provably refers to\n" as *u8) 298 let rcC: i64 = og_run(organ, cc, confC, rcptC, outC, errC) 299 ccg_val("runC_exit" as *u8, rcC) 300 var t20: i64 = 0 301 if rcC == OG_RC_USAGE { t20 = 1 } 302 gv_check("T20 neg-control-EMPTY-POPULATION-is-REFUSED, never reported as a clean sweep (a tooth that passes on the empty set is not a tooth)" as *u8, t20, ctr) 303 304 // ---- fixture D: no compiler argument at all ---- 305 let rcD: i64 = og_run(organ, 0 as *u8, 0 as *u8, 0 as *u8, outD, errD) 306 ccg_val("runD_exit" as *u8, rcD) 307 var t21: i64 = 0 308 if rcD == OG_RC_USAGE { t21 = 1 } 309 gv_check("T21 neg-control-NO-COMPILER-ARGUMENT-is-REFUSED (no silent default: a verdict about an unnamed binary is not evidence)" as *u8, t21, ctr) 310 var t22: i64 = 0 311 if ccg_file_has(errD, "NO default compiler on purpose" as *u8) == 1 { t22 = 1 } 312 gv_check("T22 and-the-refusal-SAYS-WHICH-RULE-fired, so a caller cannot mistake it for a crash or a missing file" as *u8, t22, ctr) 313 314 let rc: i64 = gv_verdict("OSATTEST-LR6" as *u8, ctr, "nxos_lang_ring_attest end-to-end against a named compiler" as *u8) 315 sys_exit(rc) 316 return rc 317}