nx_pub_exceed_gate.nx source

1// nx_pub_exceed_gate.nx -- the MEASURED S-class exceed organ for THE NISHI PUBLISHER. A live head-to-head vs the 2// NAIVE direct-deploy baseline (plain copy / multi-write = what ad-hoc workstream deploys do, and what crashed 3// sites.elf). Four SAFETY/COORDINATION axes, each graded EXCEEDS *only if* the naive baseline MEASURABLY fails 4// AND the publisher MEASURABLY succeeds (the liar-kill: no strawman -> no exceed). NEVER self-scored: every grade 5// is a number computed here. HONEST SCOPE: this is exceed-on-safety vs the relevant naive baseline, achieved 6// SOVEREIGNLY (no git/rsync/CI dep) + by construction; it is NOT a claim to beat mature CI/CD on features (those 7// cells are ABSENT in the R0 census). Mirrors nx_ws_exceed_gate / nx_lockstep_exceed_gate. Sovereign, per-wsid. 8// license_tier: ORIGINAL expect_exit: 0 9import "nx_syscalls.nx" 10import "nx_publisher.nx" 11import "nx_runpath.nx" 12 13const EG_TORN_N: i64 = 3 14const EG_TORN_K: i64 = 50 15const EG_PUB_N: i64 = 2 16 17func g_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 18func g_n(v: i64) -> i64 { var m: i64=v; if m<0{g_w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 19func g_row(id: *u8, ok: i64, pass: *i64) -> i64 { g_w(" " as *u8); g_w(id); g_w(": " as *u8); if ok==1 { g_w("EXCEEDS\n" as *u8); pass[0]=pass[0]+1 } else { g_w("-- (not proven)\n" as *u8) } return 0 } 20 21func eg_reset(path: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd >= 0 { sys_close(fd) } return 0 } 22func eg_make(path: *u8, content: *u8) -> i64 { 23 let fd: i64 = sys_openat_wr(path, 0x1a4); if fd < 0 { return 0 } 24 var n: i64 = 0; while content[n]!=(0 as u8){n=n+1} 25 sys_write(fd, content, n); sys_close(fd); return 1 26} 27// LEAN reads (raw sys_read into a 64KB buffer, NOT sys_read_file's big mmap) so the parent stays small enough 28// that every later fork() has memory (the files here are all < 64KB). 29func eg_count(path: *u8) -> i64 { 30 let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } 31 let buf: *u8 = sys_mmap(65536); let n: i64 = sys_read(fd, buf, 65536); sys_close(fd) 32 if n <= 0 { return 0 } 33 var i: i64 = 0; var c: i64 = 0 34 while i < n { if buf[i]==(10 as u8){ c=c+1 } i=i+1 } 35 return c 36} 37func eg_scan_torn(path: *u8) -> i64 { 38 let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } 39 let buf: *u8 = sys_mmap(65536); let n: i64 = sys_read(fd, buf, 65536); sys_close(fd) 40 if n <= 0 { return 0 } 41 var i: i64 = 0; var tabs: i64 = 0; var torn: i64 = 0 42 while i < n { let c: i64 = buf[i]&0xff; if c==9 { tabs=tabs+1 } if c==10 { if tabs != 6 { torn=torn+1 } tabs=0 } i=i+1 } 43 return torn 44} 45// LEAN sha256-of-file -> 64 hex (raw read, no sys_read_file). reuses pub_hexd + sha256_digest. 46func eg_sha_lean(path: *u8, outhex: *u8) -> i64 { 47 let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } 48 let buf: *u8 = sys_mmap(65536); let n: i64 = sys_read(fd, buf, 65536); sys_close(fd) 49 if n <= 0 { return 0 } 50 let dig: *u8 = sys_mmap(32); sha256_digest(buf, n, dig) 51 var i: i64 = 0 52 while i < 32 { let b: i64 = dig[i]&0xff; outhex[i*2]=pub_hexd((b>>4)&0xf) as u8; outhex[i*2+1]=pub_hexd(b&0xf) as u8; i=i+1 } 53 outhex[64]=0 as u8; return 1 54} 55func eg_dest(child: i64, k: i64, out: *u8) -> i64 { 56 var o: i64 = 0; o = fa_cat(out, o, "x/g" as *u8); o = fa_catn(out, o, child); o = fa_cat(out, o, "_" as *u8); o = fa_catn(out, o, k); o = fa_cat(out, o, ".html" as *u8); out[o]=0 as u8; return o 57} 58// AXIS 1 children: framed pub_submit_to (publisher) vs pub_append_unlocked (naive multi-write) 59func eg_torn_child(qpath: *u8, srcpath: *u8, child: i64, framed: i64) -> i64 { 60 var k: i64 = 0 61 while k < EG_TORN_K { 62 let dest: *u8 = sys_mmap(64); eg_dest(child, k, dest) 63 if framed == 1 { pub_submit_to(qpath, srcpath, dest, "nf" as *u8, "ws" as *u8, "internal" as *u8) } 64 else { pub_append_unlocked(qpath, srcpath, dest, "nf" as *u8, "ws" as *u8, "internal" as *u8) } 65 k = k + 1 66 } 67 sys_exit(0); return 0 68} 69func eg_torn_phase(qpath: *u8, srcpath: *u8, framed: i64) -> i64 { 70 eg_reset(qpath) 71 var i: i64 = 0 72 while i < EG_TORN_N { let pid: i64 = sys_fork(); if pid == 0 { eg_torn_child(qpath, srcpath, i, framed) } i = i + 1 } 73 let status: *i64 = sys_mmap(8) as *i64; i = 0 74 while i < EG_TORN_N { sys_wait4(0 - 1, status, 0); i = i + 1 } 75 return eg_scan_torn(qpath) 76} 77// AXIS 2 children: pub_run locked (publisher) vs unlocked (naive) -- double-publish race 78func eg_pub_child(qpath: *u8, ledpath: *u8, lockres: *u8, locked: i64) -> i64 { pub_run(qpath, ledpath, lockres, locked, 500); sys_exit(0); return 0 } 79func eg_pub_phase(qpath: *u8, ledpath: *u8, lockres: *u8, locked: i64) -> i64 { 80 eg_reset(ledpath) 81 var i: i64 = 0 82 while i < EG_PUB_N { let pid: i64 = sys_fork(); if pid == 0 { eg_pub_child(qpath, ledpath, lockres, locked) } i = i + 1 } 83 let status: *i64 = sys_mmap(8) as *i64; i = 0 84 while i < EG_PUB_N { sys_wait4(0 - 1, status, 0); i = i + 1 } 85 return eg_count(ledpath) 86} 87func eg_rec(qpath: *u8, sha: *u8, dest: *u8) -> i64 { let rec: *u8 = sys_mmap(2048); pub_build_rec(rec, "nf" as *u8, "ws" as *u8, sha, "src" as *u8, dest, "internal" as *u8); fa_appendz(qpath, rec, 2048); return 0 } 88func eg_seed(qpath: *u8, sa: *u8, sb: *u8, sc: *u8) -> i64 { 89 let ha: *u8 = sys_mmap(72); eg_sha_lean(sa, ha) 90 let hb: *u8 = sys_mmap(72); eg_sha_lean(sb, hb) 91 let hc: *u8 = sys_mmap(72); eg_sha_lean(sc, hc) 92 eg_rec(qpath, ha, "d/a.html" as *u8); eg_rec(qpath, hb, "d/b.html" as *u8); eg_rec(qpath, hc, "d/c.html" as *u8) 93 eg_rec(qpath, ha, "d/a.html" as *u8); eg_rec(qpath, hb, "d/b.html" as *u8) 94 return 0 95} 96 97func main() -> i64 { 98 let pass: *i64 = sys_mmap(8) as *i64; pass[0]=0 99 g_w("=== NX-PUBLISHER S-CLASS EXCEED (measured head-to-head vs NAIVE direct-deploy) ===\n" as *u8) 100 let wsid: *u8 = sys_mmap(64); rp_wsid(wsid); rp_ensure(wsid) 101 let qT: *u8 = sys_mmap(512); rp_path(wsid, "eg_qT" as *u8, qT) 102 let srcT: *u8 = sys_mmap(512); rp_path(wsid, "eg_srcT" as *u8, srcT) 103 let qP: *u8 = sys_mmap(512); rp_path(wsid, "eg_qP" as *u8, qP) 104 let ledN: *u8 = sys_mmap(512); rp_path(wsid, "eg_ledN" as *u8, ledN) 105 let ledP: *u8 = sys_mmap(512); rp_path(wsid, "eg_ledP" as *u8, ledP) 106 let saP: *u8 = sys_mmap(512); rp_path(wsid, "eg_saP" as *u8, saP) 107 let sbP: *u8 = sys_mmap(512); rp_path(wsid, "eg_sbP" as *u8, sbP) 108 let scP: *u8 = sys_mmap(512); rp_path(wsid, "eg_scP" as *u8, scP) 109 let lockres: *u8 = sys_mmap(128); var lo: i64=0; var li: i64=0 110 let lpfx: *u8 = "eg_"; while lpfx[li]!=(0 as u8){ lockres[lo]=lpfx[li]; lo=lo+1; li=li+1 } 111 li=0; while wsid[li]!=(0 as u8){ lockres[lo]=wsid[li]; lo=lo+1; li=li+1 } lockres[lo]=0 as u8 112 let appx: *u8 = sys_mmap(512); rp_path(wsid, "eg_app" as *u8, appx) 113 let liveN3: *u8 = sys_mmap(512); rp_path(wsid, "eg_liveN3" as *u8, liveN3) 114 let stageP3: *u8 = sys_mmap(512); rp_path(wsid, "eg_stageP3" as *u8, stageP3) 115 let liveP3: *u8 = sys_mmap(512); rp_path(wsid, "eg_liveP3" as *u8, liveP3) 116 let v: *u8 = sys_mmap(512); rp_path(wsid, "eg_v" as *u8, v) 117 let liveN4: *u8 = sys_mmap(512); rp_path(wsid, "eg_liveN4" as *u8, liveN4) 118 let stageP4: *u8 = sys_mmap(512); rp_path(wsid, "eg_stageP4" as *u8, stageP4) 119 let liveP4: *u8 = sys_mmap(512); rp_path(wsid, "eg_liveP4" as *u8, liveP4) 120 121 // ===== FORK AXES FIRST (lean parent so fork() doesn't ENOMEM). The PUBLISHER (success) phases need EXACT 122 // counts, so run them while the parent is leanest; the NAIVE (failure) phases fail robustly even later. ===== 123 eg_make(srcT, "exceed test artifact\n" as *u8) 124 eg_make(saP, "A\n" as *u8); eg_make(sbP, "B\n" as *u8); eg_make(scP, "C\n" as *u8) 125 eg_reset(qP); eg_seed(qP, saP, sbP, scP) 126 let led_pub: i64 = eg_pub_phase(qP, ledP, lockres, 1) // publisher: serialized (FIRST, leanest) 127 let torn_pub: i64 = eg_torn_phase(qT, srcT, 1) // publisher framed 128 let led_naive: i64 = eg_pub_phase(qP, ledN, lockres, 0) // naive: no lock 129 let torn_naive: i64 = eg_torn_phase(qT, srcT, 0) // naive multi-write 130 131 // ===== NON-FORK AXES ===== 132 // AXIS 3: fail-closed integrity (artifact tampered after approval) 133 eg_make(appx, "approved payload\n" as *u8) 134 let sha3: *u8 = sys_mmap(72); pub_sha_file(appx, sha3) 135 eg_make(appx, "TAMPERED evil payload, longer\n" as *u8) 136 pub_copy(appx, liveN3) // NAIVE: copies tampered straight to live 137 let naive_corrupt: i64 = ((pub_exists(liveN3)==1) as i64) & ((pub_sha_match(liveN3, sha3)==0) as i64) 138 let r3: i64 = pub_deploy(sha3, appx, stageP3, liveP3) // PUBLISHER: verify -> reject 139 let pub_safe3: i64 = ((r3==0) as i64) & ((pub_exists(liveP3)==0) as i64) 140 141 // AXIS 4: recoverability (rollback) 142 eg_make(v, "ver-one\n" as *u8); pub_copy(v, liveN4) 143 eg_make(v, "ver-two longer\n" as *u8); pub_copy(v, liveN4) // NAIVE overwrote, kept no prev 144 let prevN4: *u8 = sys_mmap(640); pub_pcat(liveN4, ".prev" as *u8, prevN4) 145 let naive_noprev: i64 = (pub_exists(prevN4)==0) as i64 146 eg_make(v, "ver-one\n" as *u8); let sha4: *u8 = sys_mmap(72); pub_sha_file(v, sha4) 147 pub_deploy(sha4, v, stageP4, liveP4) // PUBLISHER v1 148 eg_make(v, "ver-two longer\n" as *u8); let sha4b: *u8 = sys_mmap(72); pub_sha_file(v, sha4b) 149 pub_deploy(sha4b, v, stageP4, liveP4) // PUBLISHER v2 (keeps prev) 150 pub_rollback(liveP4) 151 let pub_recover4: i64 = (pub_sha_match(liveP4, sha4)==1) as i64 152 153 // ===== GRADES (EXCEEDS iff naive measurably FAILS and publisher measurably SUCCEEDS) ===== 154 let axis1: i64 = ((torn_naive>0) as i64) & ((torn_pub==0) as i64) 155 let axis2: i64 = ((led_naive>3) as i64) & ((led_pub==3) as i64) 156 let axis3: i64 = naive_corrupt & pub_safe3 157 let axis4: i64 = naive_noprev & pub_recover4 158 159 g_w(" -- measured head-to-head (naive direct-deploy vs Nishi Publisher) --\n" as *u8) 160 g_w(" concurrent-write torn: naive="); g_n(torn_naive); g_w(" publisher="); g_n(torn_pub); g_w("\n") 161 g_w(" double-publish ledger: naive="); g_n(led_naive); g_w(" (unique=3) publisher="); g_n(led_pub); g_w("\n") 162 g_w(" corrupt-served: naive="); g_n(naive_corrupt); g_w(" (1=served bad) publisher_rejected="); g_n(pub_safe3); g_w("\n") 163 g_w(" recoverable(rollback): naive_has_prev="); g_n((naive_noprev==0) as i64); g_w(" publisher_restored="); g_n(pub_recover4); g_w("\n") 164 165 g_row("concurrent-write integrity (naive tears -> publisher 0 torn)" as *u8, axis1, pass) 166 g_row("double-publish prevention (naive double-ships -> publisher unique)" as *u8, axis2, pass) 167 g_row("fail-closed integrity (naive serves corrupt -> publisher rejects)" as *u8, axis3, pass) 168 g_row("recoverability/rollback (naive no-prev -> publisher restores prev)" as *u8, axis4, pass) 169 170 // LIAR-KILL: the baseline must REALLY fail on every axis (else the exceed is a strawman -> refuse). 171 let baseline_fails: i64 = ((torn_naive>0) as i64) & ((led_naive>3) as i64) & naive_corrupt & naive_noprev 172 g_w(" LIAR-KILL: naive baseline measurably failed on all 4 axes (no strawman)="); g_n(baseline_fails); g_w("\n") 173 174 g_w("EXCEEDS "); g_n(pass[0]); g_w("/4 vs naive direct-deploy (SOVEREIGN, by-construction; scoped to safety/coordination, NOT feature-parity with mature CI/CD)\n") 175 if pass[0]==4 { if baseline_fails==1 { g_w("PUB-EXCEED verdict=GREEN (S-class exceed PROVEN on the safety axes, measured + liar-killed)\n" as *u8); sys_exit(0); return 0 } } 176 g_w("PUB-EXCEED verdict=RED (an axis unproven or the baseline did not really fail)\n" as *u8) 177 sys_exit(1); return 1 178}