code wiki / _hdl_build / nx_porkbun_domain_gate.nx
nx_porkbun_domain_gate.nx source
↩ module page · 121 lines · 6154 B
1import "nx_gate_gn.nx"
2import "nx_gate_base.nx"
3// nx_porkbun_domain_gate.nx -- gate for the Porkbun DOMAIN purchase client (nx_porkbun_domain).
4// OFFLINE-deterministic teeth (always runnable): the spend wall's refusal ladder, the spec-verified
5// endpoint table (banked bytes on disk), body builders, response discrimination (a live-captured
6// INSUFFICIENT_FUNDS error must NEVER read as success), and the creds-file separator regression
7// that bit live (vault `get` emits no newline -> one 136-byte line -> must FAIL, not half-parse).
8// The LIVE proofs (2026-07-09, artifacts in knowledge/compare/staging/): ping credentialsValid=true;
9// checkDomain avail=yes price=11.08; dryrun -> server pre-flight reached INSUFFICIENT_FUNDS with
10// zero charge. license_tier: ORIGINAL expect_exit: 0
11import "nx_porkbun_domain.nx"
12
13func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw("
14" as *u8); return ok }
15func gcheck(pass: i64, label: *u8, fails: *i64) -> i64 {
16 gw(" " as *u8); gw(label); gw(": " as *u8)
17 if pass==1 { gw("PASS\n" as *u8) } else { gw("FAIL\n" as *u8); fails[0]=fails[0]+1 }
18 return 0
19}
20
21func main() -> i64 {
22 let fails: *i64 = sys_mmap(16) as *i64
23 fails[0]=0
24 gw("=== nx_porkbun_domain_gate -- purchase client: spend wall, spec-verified endpoints, parsers ===\n" as *u8)
25
26 // T1: the banked machine-readable spec is on disk and names ALL four endpoints we drive
27 let spec: *u8 = sys_mmap(1048576)
28 let sn: i64 = pbd_read_file(PBD_SPEC_PATH, spec, 1048576)
29 var t1: i64=0
30 if sn>100000 {
31 if pbd_find(spec, sn, "domain\\/create\\/{domain}" as *u8)==1 {
32 if pbd_find(spec, sn, "domain\\/checkDomain\\/{domain}" as *u8)==1 {
33 if pbd_find(spec, sn, "ssl\\/retrieve\\/{domain}" as *u8)==1 {
34 if pbd_find(spec, sn, "pricing\\/get" as *u8)==1 { t1=1 }
35 }
36 }
37 }
38 }
39 gw(" spec bytes=" as *u8); gn(sn); gw("\n" as *u8)
40 gcheck(t1, "T1 banked spec (>=100KB) names create/checkDomain/ssl-retrieve/pricing endpoints" as *u8, fails)
41
42 // T2: the SPEND WALL refusal ladder -- every gate must fire, in order, and all-green passes
43 var t2: i64=1
44 if pbd_register_wall(0,1,1,1108,1500) != (0-10) { t2=0 }
45 if pbd_register_wall(1,0,1,1108,1500) != (0-11) { t2=0 }
46 if pbd_register_wall(1,1,0,1108,1500) != (0-12) { t2=0 }
47 if pbd_register_wall(1,1,1,0,1500) != (0-13) { t2=0 }
48 if pbd_register_wall(1,1,1,1108,0) != (0-13) { t2=0 }
49 if pbd_register_wall(1,1,1,1600,1500) != (0-14) { t2=0 }
50 if pbd_register_wall(1,1,1,1108,1500) != 0 { t2=0 }
51 gcheck(t2, "T2 spend wall: unverified-endpoint/creds/confirm/quote/over-cap ALL refuse; clean passes" as *u8, fails)
52
53 // T3: integer body appender KATs
54 let nb: *u8 = sys_mmap(64)
55 var t3: i64=1
56 var e3: i64 = pbd_putn(nb, 0, 1108)
57 if e3!=4 { t3=0 }
58 if nb[0]!=(49 as u8) { t3=0 }
59 if nb[3]!=(56 as u8) { t3=0 }
60 e3 = pbd_putn(nb, 0, 0)
61 if e3!=1 { t3=0 }
62 if nb[0]!=(48 as u8) { t3=0 }
63 gcheck(t3, "T3 integer cost appender KATs (1108, 0)" as *u8, fails)
64
65 // T4: create-body fixture carries the SPEC-REQUIRED fields (cost + agreeToTerms + dryRun)
66 let body: *u8 = sys_mmap(2048)
67 var bo: i64 = pk_creds(body, 0, "pkTEST" as *u8, 6, "skTEST" as *u8, 6)
68 bo = pk_put(body, bo, ",\"cost\":" as *u8)
69 bo = pbd_putn(body, bo, 1108)
70 bo = pk_put(body, bo, ",\"agreeToTerms\":\"yes\"" as *u8)
71 bo = pk_put(body, bo, ",\"dryRun\":true" as *u8)
72 bo = pk_put(body, bo, "}" as *u8)
73 var t4: i64=0
74 if pbd_find(body, bo, "\"cost\":1108" as *u8)==1 {
75 if pbd_find(body, bo, "\"agreeToTerms\":\"yes\"" as *u8)==1 {
76 if pbd_find(body, bo, "\"dryRun\":true" as *u8)==1 {
77 if pbd_find(body, bo, "\"apikey\":\"pkTEST\"" as *u8)==1 { t4=1 }
78 }
79 }
80 }
81 gcheck(t4, "T4 create body fixture: cost + agreeToTerms + dryRun + creds all present" as *u8, fails)
82
83 // T5: response discrimination -- SUCCESS parses OK; the LIVE-CAPTURED error bytes NEVER read
84 // as success (liar-kill: a broke account cannot look like a purchase).
85 let okresp: *u8 = "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\n\r\n{\"status\":\"SUCCESS\",\"domain\":\"x.com\",\"cost\":1108}" as *u8
86 let okn: i64 = pbd_slen(okresp)
87 let errresp: *u8 = "HTTP/1.1 400 Bad Request\r\nContent-Type: application/json\r\n\r\n{\"status\":\"ERROR\",\"message\":\"No funds.\",\"code\":\"INSUFFICIENT_FUNDS\"}" as *u8
88 let errn: i64 = pbd_slen(errresp)
89 let vok: i64 = pk_check(okresp, okn)
90 let verr: i64 = pk_check(errresp, errn)
91 var t5: i64=0
92 if vok==NX_PORKBUN_OK { if verr!=NX_PORKBUN_OK { t5=1 } }
93 gcheck(t5, "T5 SUCCESS parses OK; live INSUFFICIENT_FUNDS bytes refuse (never reads as success)" as *u8, fails)
94
95 // T6: creds-file separator regression (the live bug): a two-line file parses; the ONE-LINE
96 // 136-byte concatenation (vault get emits no newline) must FAIL, never half-parse.
97 let f2: *u8 = "/tmp/pbg_creds2.txt\x00" as *u8
98 let fd2: i64 = sys_openat_wr(f2, 0x180)
99 sys_write(fd2, "pk1_alpha\nsk1_beta\n" as *u8, 19)
100 sys_close(fd2)
101 let f1: *u8 = "/tmp/pbg_creds1.txt\x00" as *u8
102 let fd1: i64 = sys_openat_wr(f1, 0x180)
103 sys_write(fd1, "pk1_alphask1_beta" as *u8, 17)
104 sys_close(fd1)
105 let raw: *u8 = sys_mmap(2048)
106 let ao: *i64 = sys_mmap(8) as *i64
107 let an: *i64 = sys_mmap(8) as *i64
108 let so: *i64 = sys_mmap(8) as *i64
109 let s2n: *i64 = sys_mmap(8) as *i64
110 let r2: i64 = pbd_creds(f2, ao, an, so, s2n, raw)
111 let r1: i64 = pbd_creds(f1, ao, an, so, s2n, raw)
112 var t6: i64=0
113 if r2==0 { if r1!=0 { t6=1 } }
114 gcheck(t6, "T6 creds parser: two-line OK; separator-less one-line REFUSED (live-bug regression)" as *u8, fails)
115
116 gw(" fails=" as *u8); gn(fails[0]); gw("\n" as *u8)
117 if fails[0]==0 { gw("VERDICT: GREEN (spend wall + spec-verified endpoints + discriminating parsers; live proofs banked 2026-07-09)\n" as *u8); sys_exit(0) }
118 gw("VERDICT: RED\n" as *u8)
119 sys_exit(1)
120 return 1
121}