nx_pub_bypass2_gate.nx source

1// nx_pub_bypass2_gate.nx -- R7c: the STRICT no-bypass LAW covers the WHOLE live-touching surface. 2// 3// Writes fixture sources that each call one publishing primitive DIRECTLY, then asserts pub_audit_file_strict: 4// - FLAGS a workstream calling pub_deploy / pub_promote_atomic / pub_blue_green_flip / pub_canary_rollout / 5// pub_record_ledger / nx_aw_send directly (each = a bypass of pub_submit + governance); 6// - CLEARS a well-behaved workstream that calls ONLY pub_submit (no false positive -- liar-kill); 7// - CLEARS the publisher itself (allowlisted) even though it contains every primitive. 8// File-based (no forks). license_tier: ORIGINAL expect_exit: 0 9import "nx_syscalls.nx" 10import "nx_publisher.nx" 11import "nx_runpath.nx" 12 13func g_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 14func g_n(v: i64) -> i64 { var m: i64=v; if m<0{g_w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 15func g_row(id: *u8, ok: i64, pass: *i64) -> i64 { g_w(" " as *u8); g_w(id); g_w(": " as *u8); if ok==1 { g_w("OK\n" as *u8); pass[0]=pass[0]+1 } else { g_w("FAIL\n" as *u8) } return 0 } 16func sv_write(path: *u8, content: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd<0 { return 0 } var n: i64=0; while content[n]!=(0 as u8){n=n+1} sys_write(fd, content, n); sys_close(fd); return 1 } 17 18func main() -> i64 { 19 let pass: *i64 = sys_mmap(8) as *i64; pass[0]=0 20 g_w("=== NX-PUB-BYPASS2 GATE (strict no-bypass law covers the whole live-touching surface) ===\n" as *u8) 21 let wsid: *u8 = sys_mmap(64); rp_wsid(wsid); rp_ensure(wsid) 22 let D: *u8 = sys_mmap(512); rp_path(wsid, "pbz" as *u8, D); __syscall(83, D as i64, 493, 0, 0, 0, 0) 23 24 let f_dep: *u8 = sys_mmap(700); pub_join(D, "ws_deploy.nx" as *u8, f_dep); sv_write(f_dep, "func ship(){ pub_deploy(sha, src, st, live) }\n" as *u8) 25 let f_prom: *u8 = sys_mmap(700); pub_join(D, "ws_promote.nx" as *u8, f_prom); sv_write(f_prom, "func ship(){ pub_promote_atomic(st, live) }\n" as *u8) 26 let f_flip: *u8 = sys_mmap(700); pub_join(D, "ws_flip.nx" as *u8, f_flip); sv_write(f_flip, "func ship(){ pub_blue_green_flip(root, d, green) }\n" as *u8) 27 let f_can: *u8 = sys_mmap(700); pub_join(D, "ws_canary.nx" as *u8, f_can); sv_write(f_can, "func ship(){ pub_canary_rollout(sha, src, root, d, u, p, 3) }\n" as *u8) 28 let f_led: *u8 = sys_mmap(700); pub_join(D, "ws_ledger.nx" as *u8, f_led); sv_write(f_led, "func ship(){ pub_record_ledger(led, sha, d, site) }\n" as *u8) 29 let f_tr: *u8 = sys_mmap(700); pub_join(D, "ws_transport.nx" as *u8, f_tr); sv_write(f_tr, "func ship(){ nx_aw_send(host, path, bytes) }\n" as *u8) 30 let f_good: *u8 = sys_mmap(700); pub_join(D, "ws_good.nx" as *u8, f_good); sv_write(f_good, "func ship(){ pub_submit(src, dest, site, me, internal) }\n" as *u8) 31 32 let flag_dep: i64 = pub_audit_file_strict(f_dep, 0) 33 let flag_prom: i64 = pub_audit_file_strict(f_prom, 0) 34 let flag_flip: i64 = pub_audit_file_strict(f_flip, 0) 35 let flag_can: i64 = pub_audit_file_strict(f_can, 0) 36 let flag_led: i64 = pub_audit_file_strict(f_led, 0) 37 let flag_tr: i64 = pub_audit_file_strict(f_tr, 0) 38 let clean_good: i64 = pub_audit_file_strict(f_good, 0) // a pub_submit-only workstream 39 let clean_pub: i64 = pub_audit_file_strict(f_dep, 1) // same file, but allowlisted (publisher) 40 41 g_w(" flagged: deploy=" as *u8); g_n(flag_dep); g_w(" promote=" as *u8); g_n(flag_prom); g_w(" flip=" as *u8); g_n(flag_flip); g_w(" canary=" as *u8); g_n(flag_can); g_w(" ledger=" as *u8); g_n(flag_led); g_w(" transport=" as *u8); g_n(flag_tr); g_w("\n" as *u8) 42 g_w(" pub_submit-only clean=" as *u8); g_n((clean_good==0) as i64); g_w(" publisher(allowlisted) clean=" as *u8); g_n((clean_pub==0) as i64); g_w("\n" as *u8) 43 44 g_row("FLAG direct pub_deploy + pub_promote_atomic (live-write bypass)" as *u8, flag_dep & flag_prom, pass) 45 g_row("FLAG direct pub_blue_green_flip + pub_canary_rollout (progressive-delivery bypass)" as *u8, flag_flip & flag_can, pass) 46 g_row("FLAG direct pub_record_ledger (provenance forgery) + nx_aw_send (transport)" as *u8, flag_led & flag_tr, pass) 47 g_row("LIAR-KILL: a pub_submit-ONLY workstream is CLEAN (no false positive)" as *u8, (clean_good==0) as i64, pass) 48 g_row("publisher itself (allowlisted) is CLEAN despite containing every primitive" as *u8, (clean_pub==0) as i64, pass) 49 50 g_w("NX-PUB-BYPASS2 rows=5 pass=" as *u8); g_n(pass[0]) 51 if pass[0]==5 { g_w(" verdict=GREEN\n" as *u8); sys_exit(0); return 0 } 52 g_w(" verdict=RED\n" as *u8); sys_exit(1); return 1 53}