nx_pub_governed_gate.nx source

1// nx_pub_governed_gate.nx -- proof that the R6 policy is enforced INSIDE the production loop (pub_run_governed): 2// an INTERNAL request publishes; an OUTWARD request is HELD (not published, not live) until the operator approves 3// its exact artifact; after approval it publishes. Idempotent. This is the full operator-gated outward path, 4// proven end-to-end + sovereign + per-wsid. license_tier: ORIGINAL expect_exit: 0 5import "nx_syscalls.nx" 6import "nx_publisher.nx" 7import "nx_runpath.nx" 8 9func g_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 10func g_n(v: i64) -> i64 { var m: i64=v; if m<0{g_w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 11func g_row(id: *u8, ok: i64, pass: *i64) -> i64 { g_w(" " as *u8); g_w(id); g_w(": " as *u8); if ok==1 { g_w("OK\n" as *u8); pass[0]=pass[0]+1 } else { g_w("FAIL\n" as *u8) } return 0 } 12func dg_make(path: *u8, content: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd < 0 { return 0 } var n: i64=0; while content[n]!=(0 as u8){n=n+1} sys_write(fd, content, n); sys_close(fd); return 1 } 13func dg_reset(path: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd >= 0 { sys_close(fd) } return 0 } 14func dg_count(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } let buf: *u8 = sys_mmap(65536); let n: i64 = sys_read(fd, buf, 65536); sys_close(fd); if n<=0{return 0} var i: i64=0; var c: i64=0; while i<n { if buf[i]==(10 as u8){c=c+1} i=i+1 } return c } 15 16func main() -> i64 { 17 let pass: *i64 = sys_mmap(8) as *i64; pass[0]=0 18 g_w("=== NX-PUBLISHER GOVERNED LOOP (R6 policy enforced in the production pipeline) ===\n" as *u8) 19 let wsid: *u8 = sys_mmap(64); rp_wsid(wsid); rp_ensure(wsid) 20 let queue: *u8 = sys_mmap(512); rp_path(wsid, "gov_queue" as *u8, queue) 21 let ledger: *u8 = sys_mmap(512); rp_path(wsid, "gov_ledger" as *u8, ledger) 22 let stageroot: *u8 = sys_mmap(512); rp_path(wsid, "gov_stage" as *u8, stageroot); __syscall(83, stageroot as i64, 493, 0, 0, 0, 0) 23 let liveroot: *u8 = sys_mmap(512); rp_path(wsid, "gov_live" as *u8, liveroot); __syscall(83, liveroot as i64, 493, 0, 0, 0, 0) 24 let adir: *u8 = sys_mmap(512); rp_path(wsid, "gov_appr" as *u8, adir); __syscall(83, adir as i64, 493, 0, 0, 0, 0) 25 let src_int: *u8 = sys_mmap(512); rp_path(wsid, "gov_srcint" as *u8, src_int) 26 let src_out: *u8 = sys_mmap(512); rp_path(wsid, "gov_srcout" as *u8, src_out) 27 let lockres: *u8 = sys_mmap(128); var lo: i64=0; var li: i64=0 28 let lpfx: *u8 = "gov_"; while lpfx[li]!=(0 as u8){ lockres[lo]=lpfx[li]; lo=lo+1; li=li+1 } 29 li=0; while wsid[li]!=(0 as u8){ lockres[lo]=wsid[li]; lo=lo+1; li=li+1 } lockres[lo]=0 as u8 30 31 dg_make(src_int, "internal page\n" as *u8); dg_make(src_out, "outward page for nishifamily\n" as *u8) 32 let sha_out: *u8 = sys_mmap(72); pub_sha_file(src_out, sha_out) 33 // clean any leftover approval (idempotent gate) 34 let apath: *u8 = sys_mmap(700); pub_join(adir, sha_out, apath); __syscall(87, apath as i64, 0, 0, 0, 0, 0) 35 let live_out: *u8 = sys_mmap(700); pub_join(liveroot, "outward.html" as *u8, live_out) 36 let live_int: *u8 = sys_mmap(700); pub_join(liveroot, "internal.html" as *u8, live_int) 37 __syscall(87, live_out as i64, 0, 0, 0, 0, 0); __syscall(87, live_int as i64, 0, 0, 0, 0, 0) // clean live 38 39 dg_reset(queue); dg_reset(ledger) 40 pub_submit_to(queue, src_int, "internal.html" as *u8, "internal" as *u8, "ws" as *u8, "internal" as *u8) 41 pub_submit_to(queue, src_out, "outward.html" as *u8, "nishifamily" as *u8, "ws" as *u8, "outward" as *u8) 42 43 let pub1: i64 = pub_run_governed(queue, ledger, stageroot, liveroot, lockres, adir) // outward HELD 44 let led1: i64 = dg_count(ledger) 45 let out_live1: i64 = pub_exists(live_out) 46 47 pub_approve(sha_out, adir) // operator approves 48 let pub2: i64 = pub_run_governed(queue, ledger, stageroot, liveroot, lockres, adir) // outward now ships 49 let led2: i64 = dg_count(ledger) 50 let out_live2: i64 = pub_exists(live_out) 51 let pub3: i64 = pub_run_governed(queue, ledger, stageroot, liveroot, lockres, adir) // idempotent 52 53 g_w(" run1(unapproved): published="); g_n(pub1); g_w(" ledger="); g_n(led1); g_w(" outward_live="); g_n(out_live1); g_w("\n") 54 g_w(" run2(approved): published="); g_n(pub2); g_w(" ledger="); g_n(led2); g_w(" outward_live="); g_n(out_live2); g_w(" run3="); g_n(pub3); g_w("\n") 55 56 g_row("POLICY IN LOOP: internal ships, outward HELD (run1 published==1, ledger==1)" as *u8, ((pub1==1) as i64) & ((led1==1) as i64), pass) 57 g_row("OUTWARD NOT LIVE until approved (run1 left outward.html absent)" as *u8, (out_live1==0) as i64, pass) 58 g_row("APPROVE -> PUBLISH: operator-ok ships the outward artifact (run2 +1, now live)" as *u8, ((pub2==1) as i64) & ((led2==2) as i64) & ((out_live2==1) as i64), pass) 59 g_row("IDEMPOTENT: a third pass publishes 0" as *u8, (pub3==0) as i64, pass) 60 61 g_w("PUB-GOVERNED rows=4 pass="); g_n(pass[0]) 62 if pass[0]==4 { g_w(" verdict=GREEN\n"); sys_exit(0); return 0 } 63 g_w(" verdict=RED\n"); sys_exit(1); return 1 64}