code wiki / _hdl_build / nx_packmirror_gate.nx
`nx_packmirror_gate.nx` source

↩ module page · 144 lines · 10116 B
1// nx_packmirror_gate.nx -- prove the pack-manifest parse core: files counted, folders never
2// miscounted, missing fields honest, traversal structurally neutralized, size-verify both
3// polarities. Fixtures are ASSEMBLED AT RUNTIME (the fixture law: a source-scanning detector must
4// never find its own trap in prose) and gate scratch lives under /tmp/packmirrorgate/ (the
5// fixture-ratchet law: never beside production data).
6// license_tier: ORIGINAL   No hw writes (Rule 26).
7import "nx_syscalls.nx"
8import "nx_gate_verdict.nx"
9import "nx_packmirror_lib.nx"
10
11// FIXTURE VALUES AS NAMED DATA (rule 11): each fixture literal is bound ONCE and asserted through the
12// same name, so the JSON the gate assembles and the value the tooth expects can never drift apart.
13const PG_BUF: i64 = 4096                    // gate scratch buffer for runtime-assembled manifests
14const PG_FILE_A_SIZE: i64 = 1234            // T1 first file's declared size
15const PG_TIM_A: i64 = 1787000000000001      // T6 first media post's tim (a 4chan microsecond stamp shape)
16const PG_TIM_A_FSIZE: i64 = 4321            // T6 first media post's fsize
17
18func pg_s(b: *u8, at: i64, s: *u8) -> i64 { var i: i64 = 0; var p: i64 = at; while s[i] != (0 as u8) { b[p] = s[i]; p = p + 1; i = i + 1 } return p }
19// write v in decimal at b[at..]; returns the new offset. Fixture numbers flow from the consts above.
20func pg_n(b: *u8, at: i64, v: i64) -> i64 {
  let t: *u8 = sys_mmap(32)
  var x: i64 = v
  var k: i64 = 0
  if x == 0 { t[0] = 48 as u8; k = 1 }
  while x > 0 { t[k] = (48 + x % 10) as u8; x = x / 10; k = k + 1 }
  var o: i64 = at
  var i: i64 = 0
  while i < k { b[o] = t[k-1-i]; o = o + 1; i = i + 1 }
  return o
30}
31func pg_eq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } if b[i] != (0 as u8) { return 0 } return 1 }
32
33func main(argc: i64, argv: *i64) -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_packmirror_gate -- manifest parse core: counted, honest, traversal-proof, size-verified" as *u8)
  let b: *u8 = sys_mmap(PG_BUF)
  let ids: *i64 = sys_mmap(64 * 8) as *i64
  let sizes: *i64 = sys_mmap(64 * 8) as *i64
  let names: *u8 = sys_mmap(64 * PM_NAME_CAP)
  let counts: *i64 = sys_mmap(16) as *i64
41
  // T1: a folder + two files, pCloud field order (name ... fileid ... size)
  var p: i64 = pg_s(b, 0, "{\"name\": \"Pack\", \"folderid\": 77, \"contents\": [" as *u8)
  p = pg_s(b, p, "{\"name\": \"guide one.png\", \"fileid\": 101, \"hash\": 9, \"size\": " as *u8)
  p = pg_n(b, p, PG_FILE_A_SIZE)
  p = pg_s(b, p, "}," as *u8)
  p = pg_s(b, p, "{\"name\": \"b.pdf\", \"fileid\": 202, \"hash\": 8, \"size\": 55}]}" as *u8)
  let c1: i64 = pm_parse_manifest(b, p, ids, sizes, names, 64, counts)
  var t1: i64 = 0
  if c1 == 2 { if ids[0] == 101 { if sizes[0] == PG_FILE_A_SIZE { if ids[1] == 202 { if sizes[1] == 55 { if counts[PM_UNPARSED_SLOT] == 0 {
      if pg_eq(names as *u8, "guide_one.png" as *u8) == 1 { if pg_eq(((names as i64) + PM_NAME_CAP) as *u8, "b.pdf" as *u8) == 1 { t1 = 1 } } } } } } } }
  gv_check("T1 PARSE EXACT: two files with pCloud field order yield count=2, exact fileids and sizes, sanitized names (space becomes underscore) -- the FOLDER entry contributes nothing" as *u8, t1, ctr)
53
  // T2 neg-control: a folder-only manifest parses to ZERO files -- folderid never reads as fileid
  var p2: i64 = pg_s(b, 0, "{\"name\": \"OnlyFolder\", \"folderid\": 88, \"contents\": []}" as *u8)
  let c2: i64 = pm_parse_manifest(b, p2, ids, sizes, names, 64, counts)
  var t2: i64 = 0
  if c2 == 0 { if counts[PM_UNPARSED_SLOT] == 0 { t2 = 1 } }
  gv_check("T2 NEG-CONTROL FOLDERS: a manifest holding only a folder yields count=0 unparsed=0 -- the quoted fileid needle cannot match folderid" as *u8, t2, ctr)
60
  // T3: an entry missing its size is UNPARSED, never a guessed row
  var p3: i64 = pg_s(b, 0, "{\"name\": \"broken.bin\", \"fileid\": 303, \"hash\": 7}," as *u8)
  p3 = pg_s(b, p3, "{\"name\": \"good.bin\", \"fileid\": 404, \"size\": 9}" as *u8)
  let c3: i64 = pm_parse_manifest(b, p3, ids, sizes, names, 64, counts)
  var t3: i64 = 0
  // structural note: the broken entry has no size before the next fileid; the good one parses.
  if c3 == 1 { if ids[0] == 404 { if counts[PM_UNPARSED_SLOT] == 1 { t3 = 1 } } }
  gv_check("T3 MISSING FIELD IS UNPARSED: an entry with no size in its span counts unparsed=1 and emits no row -- an honest gap, never a fabricated size" as *u8, t3, ctr)
69
  // T4: traversal is structurally impossible -- every path byte outside the safe set becomes _
  var p4: i64 = pg_s(b, 0, "{\"name\": \"../../etc/pw name.png\", \"fileid\": 505, \"size\": 3}" as *u8)
  let c4: i64 = pm_parse_manifest(b, p4, ids, sizes, names, 64, counts)
  var t4: i64 = 0
  if c4 == 1 { if pg_eq(names as *u8, ".._.._etc_pw_name.png" as *u8) == 1 { t4 = 1 } }
  gv_check("T4 TRAVERSAL NEUTRALIZED BY CONSTRUCTION: slashes in a manifest name sanitize to underscores, so a hostile name cannot leave the destination directory -- structure, not filtering" as *u8, t4, ctr)
76
  // T5: size-verify both polarities against a real file in gate scratch
  sys_mkdir("/tmp/packmirrorgate" as *u8, 493)
  let fpath: *u8 = "/tmp/packmirrorgate/probe.bin" as *u8
  let fd: i64 = sys_openat_wr(fpath, 420)
  var t5: i64 = 0
  if fd >= 0 {
      sys_write(fd, "12345" as *u8, 5)
      sys_close(fd)
      if pm_dest_ok(fpath, 5) == 1 { if pm_dest_ok(fpath, 6) == 0 { if pm_dest_ok("/tmp/packmirrorgate/absent.bin" as *u8, 5) == 0 { t5 = 1 } } }
  }
  gv_check("T5 SIZE-VERIFY BOTH POLARITIES: a 5-byte file passes at declared=5, fails at declared=6, and an absent path fails -- the skip/verify ruler cannot acquit what it cannot see" as *u8, t5, ctr)
88
  // T6: thread dialect -- a media post (ext ... tim ... fsize) and a media-less post; the file name
  // is <tim><ext>, the size is fsize, and the text-only post contributes nothing.
  var p6: i64 = pg_s(b, 0, "{\"posts\":[{\"no\":1,\"com\":\"hello\",\"filename\":\"x\",\"ext\":\".webm\",\"w\":10,\"tim\":" as *u8)
  p6 = pg_n(b, p6, PG_TIM_A)
  p6 = pg_s(b, p6, ",\"time\":9,\"fsize\":" as *u8)
  p6 = pg_n(b, p6, PG_TIM_A_FSIZE)
  p6 = pg_s(b, p6, ",\"resto\":0}," as *u8)
  p6 = pg_s(b, p6, "{\"no\":2,\"com\":\"text only\",\"time\":10,\"resto\":1}," as *u8)
  p6 = pg_s(b, p6, "{\"no\":3,\"ext\":\".png\",\"tim\":" as *u8)
  p6 = pg_n(b, p6, PG_TIM_A + 1)
  p6 = pg_s(b, p6, ",\"fsize\":77,\"resto\":1}]}" as *u8)
  let c6: i64 = pm_parse_thread(b, p6, ids, sizes, names, 64, counts)
  // expected names derived from the SAME consts the fixture was built from
  let want0: *u8 = sys_mmap(64)
  var w0: i64 = pg_n(want0, 0, PG_TIM_A)
  w0 = pg_s(want0, w0, ".webm" as *u8); want0[w0] = 0 as u8
  let want1: *u8 = sys_mmap(64)
  var w1: i64 = pg_n(want1, 0, PG_TIM_A + 1)
  w1 = pg_s(want1, w1, ".png" as *u8); want1[w1] = 0 as u8
  var t6: i64 = 0
  if c6 == 2 { if ids[0] == PG_TIM_A { if sizes[0] == PG_TIM_A_FSIZE { if sizes[1] == 77 { if counts[PM_UNPARSED_SLOT] == 0 {
      if pg_eq(names as *u8, want0) == 1 { if pg_eq(((names as i64) + PM_NAME_CAP) as *u8, want1) == 1 { t6 = 1 } } } } } } }
  gv_check("T6 THREAD DIALECT EXACT: two media posts parse to <tim><ext> names with their fsize, and the text-only post between them contributes nothing -- neg-control-textpost is inside the same fixture" as *u8, t6, ctr)
112
  // T7 neg-control: a thread whose media post lacks fsize is UNPARSED, never a guessed size
  var p7: i64 = pg_s(b, 0, "{\"posts\":[{\"no\":1,\"ext\":\".jpg\",\"tim\":1787000000000009,\"resto\":0}]}" as *u8)
  let c7: i64 = pm_parse_thread(b, p7, ids, sizes, names, 64, counts)
  var t7: i64 = 0
  if c7 == 0 { if counts[PM_UNPARSED_SLOT] == 1 { t7 = 1 } }
  gv_check("T7 neg-control-nofsize: a media post with tim and ext but no fsize yields count=0 unparsed=1 -- the verify verb can never acquit against a size it did not read" as *u8, t7, ctr)
119
  // T8/T9 THE BEPIS DIALECT (2026-08-18, watch contract pm_bepis; grounding fixture
  // knowledge/library/bepis/AI_248895.meta.json, pin-verified -- this runtime fixture mirrors its
  // measured field shape, uploader-id decoy included: the card id must be the FIRST id after
  // cardType, never the uploader's).
  let bm: *u8 = sys_mmap(PG_BUF)
  var bn: i64 = pg_s(bm, 0, "{\"type\":\"success\",\"data\":{\"cardType\":\"AI\",\"id\":42,\"uploader\":{\"id\":999},\"fileSize\":777,\"sha256CardHash\":\"8FETk8mFXHYF+rNrH8ggOzXbNplJgUZT0Yy2NVHtDfg=\"}}" as *u8)
  let bids: *i64 = sys_mmap(64) as *i64
  let bsizes: *i64 = sys_mmap(64) as *i64
  let bnames: *u8 = sys_mmap(4 * PM_NAME_CAP)
  let bhashes: *u8 = sys_mmap(4 * PM_HASH_CAP)
  let bcounts: *i64 = sys_mmap(16) as *i64
  let bseen: i64 = pm_parse_bepis(bm, bn, bids, bsizes, bnames, 4, bcounts, bhashes)
  var t8: i64 = 0
  if bseen == 1 { if bids[0] == 42 { if bsizes[0] == 777 { if pg_eq(bnames, "AI_000042.png" as *u8) == 1 { if bhashes[0] == (56 as u8) { if bcounts[PM_UNPARSED_SLOT] == 0 { t8 = 1 } } } } } }
  gv_check("T8 BEPIS ROW MEASURED: one metadata response parses to id=42 (the FIRST id after cardType, not the uploader decoy 999), size=777, dest AI_000042.png (the measured zero-pad-6 file-URL shape), base64 pin captured verbatim, unparsed=0" as *u8, t8, ctr)
  bn = pg_s(bm, 0, "{\"type\":\"success\",\"data\":{\"cardType\":\"AI\",\"id\":43,\"uploader\":{\"id\":999},\"fileSize\":778}}" as *u8)
  let bseen2: i64 = pm_parse_bepis(bm, bn, bids, bsizes, bnames, 4, bcounts, bhashes)
  var t9: i64 = 0
  if bseen2 == 0 { if bcounts[PM_UNPARSED_SLOT] == 1 { t9 = 1 } }
  gv_check("T9 neg-control-nopin: a bepis row without sha256CardHash yields count=0 unparsed=1 -- the verify verb can never acquit a card whose pin it did not read" as *u8, t9, ctr)
140
  let rc: i64 = gv_verdict("PACKMIRROR-GATE", ctr, "fixtures assembled at runtime in /tmp gate scratch; every tooth states its own strength" as *u8)
  sys_exit(rc)
  return rc
144}
nx_packmirror_gate.nx source

`nx_packmirror_gate.nx` source
