nx_pub_pd_exceed_gate.nx source

1// nx_pub_pd_exceed_gate.nx -- MEASURED head-to-head: progressive delivery LIMITS BLAST RADIUS vs naive. 2// 3// A corrupt artifact (bytes != approved sha) is pushed three ways. Each pub_* organ verifies-before-promote, so the 4// corrupt bytes reach ZERO targets; the naive baselines (no verify) splatter corruption: 5// PROMOTE-CHAIN : naive deploys straight to prod -> prod corrupt (blast 1) vs chain stops at dev -> prod clean (0) 6// FAN-OUT : naive writes each target -> all 3 corrupt (blast 3) vs all-or-nothing -> 0 corrupt 7// ROLLING : naive all-at-once -> all 3 corrupt (blast 3) vs halt at instance 0 -> 0 corrupt 8// EXCEEDS iff naive blast > 0 (gap real -> liar-kill) AND pub blast == 0. File-based. license_tier: ORIGINAL expect_exit: 0 9import "nx_syscalls.nx" 10import "nx_publisher.nx" 11import "nx_runpath.nx" 12 13func g_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 14func g_n(v: i64) -> i64 { var m: i64=v; if m<0{g_w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 15func g_row(id: *u8, ok: i64, pass: *i64) -> i64 { g_w(" " as *u8); g_w(id); g_w(": " as *u8); if ok==1 { g_w("OK\n" as *u8); pass[0]=pass[0]+1 } else { g_w("FAIL\n" as *u8) } return 0 } 16func sv_write(path: *u8, content: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd<0 { return 0 } var n: i64=0; while content[n]!=(0 as u8){n=n+1} sys_write(fd, content, n); sys_close(fd); return 1 } 17func g_mkdir(D: *u8, name: *u8) -> *u8 { let p: *u8 = sys_mmap(700); pub_join(D, name, p); __syscall(83, p as i64, 493, 0, 0, 0, 0); return p } 18func dest_in(root: *u8) -> *u8 { let p: *u8 = sys_mmap(700); pub_join(root, "d.html" as *u8, p); return p } 19 20func main() -> i64 { 21 let pass: *i64 = sys_mmap(8) as *i64; pass[0]=0 22 g_w("=== NX-PUB-PD-EXCEED GATE (progressive delivery limits blast radius vs naive; measured) ===\n" as *u8) 23 let wsid: *u8 = sys_mmap(64); rp_wsid(wsid); rp_ensure(wsid) 24 let D: *u8 = sys_mmap(512); rp_path(wsid, "ppde" as *u8, D); __syscall(83, D as i64, 493, 0, 0, 0, 0) 25 let stg: *u8 = g_mkdir(D, "stg" as *u8) 26 let good: *u8 = sys_mmap(700); pub_join(D, "good.src" as *u8, good); sv_write(good, "GOOD-BYTES\n" as *u8) 27 let corrupt: *u8 = sys_mmap(700); pub_join(D, "corrupt.src" as *u8, corrupt); sv_write(corrupt, "CORRUPT-XYZ\n" as *u8) 28 let sha_good: *u8 = sys_mmap(72); pub_sha_file(good, sha_good) // approve GOOD; we will push CORRUPT claiming this sha 29 30 // ---- PROMOTE-CHAIN: prod blast ---- 31 let dev: *u8 = g_mkdir(D, "dev" as *u8); let stage: *u8 = g_mkdir(D, "stage" as *u8); let prod: *u8 = g_mkdir(D, "prod" as *u8) 32 let prod_d: *u8 = dest_in(prod) 33 __syscall(87, prod_d as i64, 0,0,0,0,0) 34 pub_copy(corrupt, prod_d) // NAIVE: straight to prod, no verify 35 let naive_chain: i64 = pub_exists(prod_d) // prod now corrupt = blast 1 36 __syscall(87, prod_d as i64, 0,0,0,0,0) // reset 37 let roots: *i64 = sys_mmap(64) as *i64; roots[0]=dev as i64; roots[1]=stage as i64; roots[2]=prod as i64 38 pub_promote_chain(sha_good, corrupt, "d.html" as *u8, roots, 3, stg) // verify fails at dev -> prod untouched 39 let pub_chain: i64 = pub_exists(prod_d) // expect 0 40 41 // ---- FAN-OUT: corrupt-target count ---- 42 let f1: *u8 = g_mkdir(D, "f1" as *u8); let f2: *u8 = g_mkdir(D, "f2" as *u8); let f3: *u8 = g_mkdir(D, "f3" as *u8) 43 let f1d: *u8 = dest_in(f1); let f2d: *u8 = dest_in(f2); let f3d: *u8 = dest_in(f3) 44 __syscall(87, f1d as i64,0,0,0,0,0); __syscall(87, f2d as i64,0,0,0,0,0); __syscall(87, f3d as i64,0,0,0,0,0) 45 pub_copy(corrupt, f1d); pub_copy(corrupt, f2d); pub_copy(corrupt, f3d) // NAIVE: write each, no verify 46 let naive_fan: i64 = pub_exists(f1d) + pub_exists(f2d) + pub_exists(f3d) // 3 corrupt 47 __syscall(87, f1d as i64,0,0,0,0,0); __syscall(87, f2d as i64,0,0,0,0,0); __syscall(87, f3d as i64,0,0,0,0,0) 48 let tg: *i64 = sys_mmap(64) as *i64; tg[0]=f1 as i64; tg[1]=f2 as i64; tg[2]=f3 as i64 49 pub_fanout(sha_good, corrupt, "d.html" as *u8, tg, 3, stg) // verify fails once -> 0 promoted 50 let pub_fan: i64 = pub_exists(f1d) + pub_exists(f2d) + pub_exists(f3d) // expect 0 51 52 // ---- ROLLING: corrupt-instance count ---- 53 let r1: *u8 = g_mkdir(D, "r1" as *u8); let r2: *u8 = g_mkdir(D, "r2" as *u8); let r3: *u8 = g_mkdir(D, "r3" as *u8) 54 let r1d: *u8 = dest_in(r1); let r2d: *u8 = dest_in(r2); let r3d: *u8 = dest_in(r3) 55 __syscall(87, r1d as i64,0,0,0,0,0); __syscall(87, r2d as i64,0,0,0,0,0); __syscall(87, r3d as i64,0,0,0,0,0) 56 pub_copy(corrupt, r1d); pub_copy(corrupt, r2d); pub_copy(corrupt, r3d) // NAIVE: all-at-once, no verify 57 let naive_roll: i64 = pub_exists(r1d) + pub_exists(r2d) + pub_exists(r3d) // 3 corrupt 58 __syscall(87, r1d as i64,0,0,0,0,0); __syscall(87, r2d as i64,0,0,0,0,0); __syscall(87, r3d as i64,0,0,0,0,0) 59 let rg: *i64 = sys_mmap(64) as *i64; rg[0]=r1 as i64; rg[1]=r2 as i64; rg[2]=r3 as i64 60 pub_rolling(sha_good, corrupt, "d.html" as *u8, rg, 3, stg) // verify fails at instance 0 -> halt 61 let pub_roll: i64 = pub_exists(r1d) + pub_exists(r2d) + pub_exists(r3d) // expect 0 62 63 g_w(" PROMOTE-CHAIN prod-blast: naive=" as *u8); g_n(naive_chain); g_w(" pub=" as *u8); g_n(pub_chain); g_w("\n" as *u8) 64 g_w(" FAN-OUT corrupt-targets: naive=" as *u8); g_n(naive_fan); g_w(" pub=" as *u8); g_n(pub_fan); g_w("\n" as *u8) 65 g_w(" ROLLING corrupt-instances: naive=" as *u8); g_n(naive_roll); g_w(" pub=" as *u8); g_n(pub_roll); g_w("\n" as *u8) 66 67 let ex_chain: i64 = ((naive_chain>0) as i64) & ((pub_chain==0) as i64) 68 let ex_fan: i64 = ((naive_fan>0) as i64) & ((pub_fan==0) as i64) 69 let ex_roll: i64 = ((naive_roll>0) as i64) & ((pub_roll==0) as i64) 70 g_row("EXCEEDS promote-chain: corrupt reaches prod naive>0 vs chain 0 (fail-closed before prod)" as *u8, ex_chain, pass) 71 g_row("EXCEEDS fan-out: corrupt reaches targets naive=3 vs all-or-nothing 0" as *u8, ex_fan, pass) 72 g_row("EXCEEDS rolling: corrupt reaches instances naive=3 vs halt-at-0 -> 0" as *u8, ex_roll, pass) 73 74 g_w("NX-PUB-PD-EXCEED rows=3 pass=" as *u8); g_n(pass[0]) 75 if pass[0]==3 { g_w(" verdict=GREEN\n" as *u8); sys_exit(0); return 0 } 76 g_w(" verdict=RED\n" as *u8); sys_exit(1); return 1 77}