nx_portcheck_staged_cli_gate.nx source
↩ module page · 140 lines · 9644 B
1// Executes the caller-pinned staged CLI; only this gate owns the two listeners.
2// Captures are exclusive retained files. No production signals or deployment writes; the shared runner bounds its own children.
3import "nx_os_introspect.nx"
4import "nx_http_server.nx"
5import "nx_tool_run.nx"
6import "nx_gate_verdict.nx"
7const PG_ARG_SLOTS: i64 = 6
8const PG_SOCKADDR_BYTES: i64 = 16
9const PG_EXPECTED_ROWS: i64 = 2
10const PG_PRIVATE_DIR_MODE: i64 = 448
11const PG_PRIVATE_FILE_MODE: i64 = 384
12
13func pg_contains(b: *u8, n: i64, wanted: *u8) -> i64 {
14 let m: i64=pon_strlen(wanted); var i: i64=0
15 while i+m <= n {
16 var j: i64=0
17 while j < m && b[i+j] == wanted[j] { j=j+1 }
18 if j == m { return 1 }; i=i+1
19 }; return 0
20}
21func pg_append(b: *u8, at: i64, s: *u8) -> i64 {
22 var i: i64=0; while s[i] != (0 as u8) { b[at+i]=s[i]; i=i+1 }
23 b[at+i]=0 as u8; return at+i
24}
25func pg_path_ok(s: *u8, directory: i64) -> i64 {
26 let n: i64=pon_strlen(s)
27 if n <= 1 || n >= SYS_PATH_MAX/2 || s[0] != (47 as u8) { return 0 }
28 var i: i64=0
29 while i < n { if s[i] < (33 as u8) || s[i] > (126 as u8) { return 0 }; i=i+1 }
30 if directory == 1 {
31 if n <= 5 { return 0 }
32 let pre: *u8="/tmp/" as *u8; i=0
33 while i < 5 { if s[i] != pre[i] { return 0 }; i=i+1 }
34 while i < n {
35 let c: i64=s[i] as i64
36 if (c < 48 || c > 57) && (c < 65 || c > 90) && (c < 97 || c > 122) && c != 45 && c != 95 { return 0 }
37 i=i+1
38 }
39 }; return 1
40}
41// Same readlink/inode path used in the native-passed listener-census gate.
42func pg_inode(fd: i64) -> i64 {
43 let path: *u8=sys_mmap(SYS_PATH_MAX); let link: *u8=sys_mmap(SYS_PATH_MAX)
44 if (path as i64) <= 0 || (link as i64) <= 0 { return 0-1 }
45 let n: i64=pg_append(path,0,"/proc/self/fd/" as *u8)
46 pon_obs_number(path,n,fd)
47 let got: i64=sys_readlinkat(path,link,SYS_PATH_MAX); var inode: i64=0-1
48 if got > 0 && got < SYS_PATH_MAX { inode=pon_obs_socket_inode(link,got) }
49 sys_munmap(path,SYS_PATH_MAX); sys_munmap(link,SYS_PATH_MAX); return inode
50}
51func pg_save(dir: *u8, name: *u8, b: *u8, n: i64) -> i64 {
52 let path: *u8=sys_mmap(SYS_PATH_MAX)
53 if (path as i64) <= 0 { return 0 }
54 var p: i64=pg_append(path,0,dir); p=pg_append(path,p,"/" as *u8); pg_append(path,p,name)
55 let fd: i64=sys_openat_exclusive(path,PG_PRIVATE_FILE_MODE)
56 if fd < 0 { sys_munmap(path,SYS_PATH_MAX); return 0 }
57 var done: i64=0; var ok: i64=1
58 while done < n && ok == 1 {
59 let wrote: i64=sys_write(fd,((b as i64)+done) as *u8,n-done)
60 if wrote <= 0 { ok=0 } else { done=done+wrote }
61 }
62 if sys_fsync(fd) != 0 { ok=0 }
63 if sys_close(fd) != 0 { ok=0 }
64 gv_puts("capture=" as *u8); gv_puts(path); gv_puts(" bytes=" as *u8); gv_num(done)
65 gv_puts(" saved=" as *u8); gv_num(ok); gv_puts("\n" as *u8)
66 sys_munmap(path,SYS_PATH_MAX); return ok
67}
68func pg_run(subject: *u8, av: *i64, dir: *u8, name: *u8, b: *u8, cap: i64, timeout: i64, expected_exit: i64, ctr: *i64) -> i64 {
69 let len: *i64=sys_mmap(PON_OBS_I64_BYTES) as *i64
70 if (len as i64) <= 0 { gv_check("capture length allocation" as *u8,0,ctr); return 0-1 }
71 len[0]=0
72 let ec: i64=tr_run_capture_to(subject,av,b,cap,len,timeout); let n: i64=len[0]
73 gv_puts("case=" as *u8); gv_puts(name); gv_puts(" exit=" as *u8); gv_num(ec); gv_puts("\n" as *u8)
74 gv_check("actual subject exit code" as *u8,ec == expected_exit,ctr)
75 gv_check("capture has positive length below capacity" as *u8,n > 0 && n < cap,ctr)
76 var saved: i64=0
77 if n >= 0 && n <= cap { saved=pg_save(dir,name,b,n) }
78 gv_check("complete captured bytes retained exclusively" as *u8,saved == 1 && n > 0 && n < cap,ctr)
79 sys_munmap(len as *u8,PON_OBS_I64_BYTES)
80 if saved != 1 || n <= 0 || n >= cap { return 0-1 }; return n
81}
82func pg_row(b: *u8, n: i64, port: i64, inode: i64, address: *u8, expected: *u8) -> i64 {
83 var p: i64=pg_append(expected,0,"{\"family\":\"ipv4\",\"port\":" as *u8)
84 p=pon_obs_number(expected,p,port); p=pg_append(expected,p,",\"inode\":" as *u8)
85 p=pon_obs_number(expected,p,inode); p=pg_append(expected,p,",\"address_hex\":\"" as *u8)
86 p=pg_append(expected,p,address); pg_append(expected,p,"\"}" as *u8)
87 return pg_contains(b,n,expected)
88}
89func main(argc: i64, argv: *i64) -> i64 {
90 if argc != 7 { gv_puts("usage: gate absolute-staged-subject /tmp/fresh-name unused-port read-capacity capture-capacity timeout-ms\n" as *u8); return 3 }
91 let subject: *u8=argv[1] as *u8; let dir: *u8=argv[2] as *u8
92 let port: i64=pon_obs_uint(argv[3] as *u8,0,pon_strlen(argv[3] as *u8))
93 let readcap: i64=pon_obs_uint(argv[4] as *u8,0,pon_strlen(argv[4] as *u8))
94 let cap: i64=pon_obs_uint(argv[5] as *u8,0,pon_strlen(argv[5] as *u8))
95 let timeout: i64=pon_obs_uint(argv[6] as *u8,0,pon_strlen(argv[6] as *u8))
96 if pg_path_ok(subject,0) != 1 || pg_path_ok(dir,1) != 1 || port <= 0 || port > PON_L_PORT_MAX || readcap <= 0 || readcap >= PON_OBS_I64_MAX/2 || cap <= 0 || cap >= PON_OBS_I64_MAX/2 || timeout <= 0 || timeout >= PON_OBS_I64_MAX/2 { return 3 }
97 let ctr: *i64=gv_ctr(); gv_head("PORTCHECK-STAGED-CLI / retained real child responses" as *u8)
98 let made: i64=sys_mkdir(dir,PG_PRIVATE_DIR_MODE)
99 gv_check("fresh private capture directory" as *u8,made == 0,ctr)
100 // Never reuse a directory: the failed check above must stop before execution.
101 if made != 0 { return gv_verdict("PORTCHECK-STAGED-CLI" as *u8,ctr,"fresh directory required" as *u8) }
102 let b: *u8=sys_mmap(cap); let expected: *u8=sys_mmap(SYS_PATH_MAX)
103 let av: *i64=sys_mmap(PG_ARG_SLOTS*PON_OBS_I64_BYTES) as *i64
104 let addr: *u8=sys_mmap(PG_SOCKADDR_BYTES); let verdict: *i64=sys_mmap(PON_OBS_I64_BYTES) as *i64
105 if (b as i64) <= 0 || (expected as i64) <= 0 || (av as i64) <= 0 || (addr as i64) <= 0 || (verdict as i64) <= 0 { return 3 }
106 nx_http_server_addr_loopback(addr,port)
107 let first: i64=nx_http_server_listen(addr,1,verdict)
108 gv_check("owned first loopback listener" as *u8,first >= 0,ctr)
109 if first < 0 { return gv_verdict("PORTCHECK-STAGED-CLI" as *u8,ctr,"occupied port refused" as *u8) }
110 nx_http_server_make_sockaddr(addr,port,127,0,0,2)
111 let second: i64=nx_http_server_listen(addr,1,verdict)
112 gv_check("owned second same-port address" as *u8,second >= 0,ctr)
113 if second < 0 { sys_close(first); return gv_verdict("PORTCHECK-STAGED-CLI" as *u8,ctr,"second address refused" as *u8) }
114 let inode1: i64=pg_inode(first); let inode2: i64=pg_inode(second)
115 gv_check("distinct actual listener fd inodes" as *u8,inode1 > 0 && inode2 > 0 && inode1 != inode2,ctr)
116 gv_puts("port=" as *u8); gv_num(port); gv_puts(" inode_0100007F=" as *u8); gv_num(inode1); gv_puts(" inode_0200007F=" as *u8); gv_num(inode2); gv_puts("\n" as *u8)
117 av[0]=subject as i64; av[1]="listeners" as *u8 as i64; av[2]=argv[3]; av[3]="2" as *u8 as i64; av[4]=argv[4]; av[5]=0
118 var n: i64=pg_run(subject,av,dir,"complete.json" as *u8,b,cap,timeout,0,ctr)
119 gv_check("COMPLETE envelope and exact denominator" as *u8,pg_contains(b,n,"\"status\":\"COMPLETE\",\"complete\":true,\"error\":null" as *u8) && pg_contains(b,n,"\"matching_rows\":2,\"returned_rows\":2," as *u8) && pg_contains(b,n,"\"fully_read_files\":2," as *u8),ctr)
120 gv_check("actual first inode address and source port" as *u8,pg_row(b,n,port,inode1,"0100007F" as *u8,expected),ctr)
121 gv_check("actual second inode address and source port" as *u8,pg_row(b,n,port,inode2,"0200007F" as *u8,expected),ctr)
122 gv_check("no restart or process identity authority" as *u8,pg_contains(b,n,"\"atomic_snapshot\":false,\"process_identity_verified\":false,\"restart_authority\":false" as *u8),ctr)
123 av[3]="0" as *u8 as i64
124 n=pg_run(subject,av,dir,"row-capacity.json" as *u8,b,cap,timeout,2,ctr)
125 gv_check("zero row capacity retains census and refuses completion" as *u8,pg_contains(b,n,"\"status\":\"CAPACITY\",\"complete\":false" as *u8) && pg_contains(b,n,"\"first_stage\":\"rows\"" as *u8) && pg_contains(b,n,"\"matching_rows\":2,\"returned_rows\":0," as *u8) && pg_contains(b,n,"\"rows\":[]" as *u8),ctr)
126 av[3]="2" as *u8 as i64; av[4]="1" as *u8 as i64
127 n=pg_run(subject,av,dir,"read-capacity.json" as *u8,b,cap,timeout,2,ctr)
128 gv_check("one-byte read capacity refuses prefix evidence" as *u8,pg_contains(b,n,"\"status\":\"CAPACITY\",\"complete\":false" as *u8) && pg_contains(b,n,"\"first_stage\":\"read\"" as *u8) && pg_contains(b,n,"\"fully_read_files\":0," as *u8) && pg_contains(b,n,"\"returned_rows\":0," as *u8),ctr)
129 av[2]="12x" as *u8 as i64; av[4]=argv[4]
130 n=pg_run(subject,av,dir,"bad-input.json" as *u8,b,cap,timeout,3,ctr)
131 gv_check("malformed numeric input refused precisely" as *u8,pg_contains(b,n,"\"status\":\"BAD_INPUT\",\"complete\":false" as *u8) && pg_contains(b,n,"\"code\":\"invalid_port\",\"stage\":\"input\"" as *u8),ctr)
132 gv_check("second owned listener closed" as *u8,sys_close(second) == 0,ctr)
133 gv_check("first owned listener closed" as *u8,sys_close(first) == 0,ctr)
134 av[1]=0
135 n=pg_run(subject,av,dir,"legacy.txt" as *u8,b,cap,timeout,0,ctr)
136 gv_check("legacy no-argument five-case gate retained" as *u8,pg_contains(b,n,"NX-PORTCHECK GATE GREEN 5/5" as *u8),ctr)
137 sys_munmap(b,cap); sys_munmap(expected,SYS_PATH_MAX); sys_munmap(av as *u8,PG_ARG_SLOTS*PON_OBS_I64_BYTES)
138 sys_munmap(addr,PG_SOCKADDR_BYTES); sys_munmap(verdict as *u8,PON_OBS_I64_BYTES)
139 return gv_verdict("PORTCHECK-STAGED-CLI" as *u8,ctr,"real staged exec; retained captures require independent JSON schema validation; legacy port conflicts remain failures" as *u8)
140}