code wiki / _hdl_build / nx_pub_plane_gate.nx
`nx_pub_plane_gate.nx` source

↩ module page · 285 lines · 18632 B
1// nx_pub_plane_gate.nx -- the VERIFIER for the publishing plane (nx_pub_lib / nx_pub_plane).
2//
3// Proves the two properties the operator actually asked for:
4//   1. every discovery artifact (sitemap.xml, robots.txt, llms.txt) is DERIVED from the per-site
5//      registry -- so what a crawler sees and what the team believes are the same object, and no
6//      page can be "put somewhere" and quietly become site truth;
7//   2. the publish GATEWAY is FAIL-CLOSED -- an unregistered path is refused, and an unreadable
8//      registry refuses everything rather than waving it through;
9//   3. adoption walks the WHOLE docroot TREE (debt 1785614931: the one-level walk skipped every
10//      subdirectory, so a nested page could never be registered and the gateway refused code/
11//      pages forever) -- nested pages enter under their FULL relpath, idempotently, and a
12//      beyond-depth tree REFUSES LOUDLY rather than truncating.
13//
14// NON-VACUITY IS STRUCTURAL HERE, not a promise: the exclusion teeth are gv_bite cells, which count
15// only if they FIRE on the crafted-bad input AND stay SILENT on the crafted-good one. A sitemap
16// filter that excluded everything, or nothing, fails both bites.
17// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
18import "nx_pub_lib.nx"
19import "nx_gate_verdict.nx"
20import "nx_syscalls.nx"
21
22const PG_PATHCAP: i64 = 1024
23const PG_BUF: i64 = 65536
24const PG_SPAN: i64 = 16
25const PG_DIRMODE: i64 = 493
26const PG_ARG_A: i64 = 1
27
28func pg_fixfile(dir: *u8, name: *u8, body: *u8) -> i64 {
  let p: *u8 = sys_mmap(PG_PATHCAP)
  pl_join(p, dir, name)
  let rc: i64 = pl_wfile(p, body, pl_vlen(body))
  sys_munmap(p, PG_PATHCAP)
  return rc
34}
35func pg_has(path: *u8, needle: *u8) -> i64 {
  let b: *u8 = sys_mmap(PG_BUF)
  let n: i64 = pl_rfile(path, b, PG_BUF)
  if n <= 0 { sys_munmap(b, PG_BUF); return 0 }
  let r: i64 = pl_find(b, n, needle)
  sys_munmap(b, PG_BUF)
  return r
42}
43
44func main(argc: i64, argv: *i64) -> i64 {
  var tmpdir: *u8 = "knowledge/pubgate" as *u8
  if argc > PG_ARG_A { tmpdir = argv[PG_ARG_A] as *u8 }
  sys_mkdir(tmpdir, PG_DIRMODE)
  // SETUP MUST FAIL LOUD. The first run of this gate reported 5/24 with a plausible-looking
  // transcript because its scratch directory did not exist: every fixture write silently failed
  // and the exclusion teeth then "passed" on an empty sitemap. A gate that cannot build its
  // fixtures has proved NOTHING, so it must refuse to emit checks at all rather than grade a void.
  if pg_fixfile(tmpdir, "_setup.probe" as *u8, "ok" as *u8) != 0 {
      pl_werr("PUB-GATE-SETUP-FAIL scratch dir not writable: " as *u8)
      pl_werr(tmpdir)
      pl_werr(" -- refusing to grade a void\n" as *u8)
      sys_exit(1)
      return 1
  }
  let ctr: *i64 = gv_ctr()
  gv_head("nx_pub_plane gate -- registry-DERIVED discovery artifacts, canonical URLs, and a fail-closed publish gateway" as *u8)
  // fixtures on disk: present pages, one deliberately ABSENT (ghost), one with an XML metacharacter
  pg_fixfile(tmpdir, "index.html" as *u8, "<h1>home</h1>" as *u8)
  pg_fixfile(tmpdir, "a.html" as *u8, "<h1>alpha</h1>" as *u8)
  pg_fixfile(tmpdir, "b.html" as *u8, "<h1>bee</h1>" as *u8)
  pg_fixfile(tmpdir, "old.html" as *u8, "<h1>retired</h1>" as *u8)
  pg_fixfile(tmpdir, "style.css" as *u8, "body{}" as *u8)
  pg_fixfile(tmpdir, "old.html.prev" as *u8, "<h1>a rollback artifact</h1>" as *u8)
  // DELIBERATELY ABSENT from the registry below: this is the orphan case -- a page someone dropped
  // into the docroot. 54 of these were measured live on nishifamily.com. Adoption must register it
  // WITHOUT publishing it.
  pg_fixfile(tmpdir, "stray.html" as *u8, "<h1>someone just dropped this here</h1>" as *u8)
  pg_fixfile(tmpdir, "r&d.html" as *u8, "<h1>r and d</h1>" as *u8)
  let subd: *u8 = sys_mmap(PG_PATHCAP)
  pl_join(subd, tmpdir, "contact" as *u8)
  sys_mkdir(subd, PG_DIRMODE)
  pg_fixfile(subd, "index.html" as *u8, "<h1>contact</h1>" as *u8)
  // NESTED, UNREGISTERED pages -- the 2026-08-01 defect (debt 1785614931): pre-fix, pl_adopt
  // walked ONE level, so these could never enter the registry and the fail-closed gateway
  // refused them FOREVER while they were live and serving. Adoption must find BOTH depths.
  let codd: *u8 = sys_mmap(PG_PATHCAP)
  pl_join(codd, tmpdir, "code" as *u8)
  sys_mkdir(codd, PG_DIRMODE)
  pg_fixfile(codd, "nested.html" as *u8, "<h1>a page in a subdirectory</h1>" as *u8)
  let codd2: *u8 = sys_mmap(PG_PATHCAP)
  pl_join(codd2, codd, "deep" as *u8)
  sys_mkdir(codd2, PG_DIRMODE)
  pg_fixfile(codd2, "leaf.html" as *u8, "<h1>two directory levels down</h1>" as *u8)
  // the registry: one row per status in the vocabulary, so every exclusion rule is exercised
  let reg: *u8 = sys_mmap(PG_BUF)
  var o: i64 = 0
  o = pl_cat(reg, o, "1\tHome\tops\tlive\tFamily\tindex.html\tthe front door\n" as *u8)
  o = pl_cat(reg, o, "2\tAlpha\tops\tlive\tFamily\ta.html\tfirst page\n" as *u8)
  o = pl_cat(reg, o, "3\tGhost\tops\tlive\tFamily\tghost.html\tregistered but never written\n" as *u8)
  o = pl_cat(reg, o, "4\tBee\tops\tdraft\tWork\tb.html\tnot published yet\n" as *u8)
  o = pl_cat(reg, o, "5\tStyle\tops\tasset\tWork\tstyle.css\tserved, never indexed\n" as *u8)
  o = pl_cat(reg, o, "6\tOld\tops\twithdrawn\tWork\told.html\tretired page\n" as *u8)
  o = pl_cat(reg, o, "7\tAmp\tops\tlive\tWork\tr&d.html\tXML metacharacter in the path\n" as *u8)
  o = pl_cat(reg, o, "8\tContact\tops\tlive\tWork\tcontact/index.html\ta DIRECTORY index, not a page named index\n" as *u8)
  let prefix: *u8 = sys_mmap(PG_PATHCAP)
  // the registry lives OUTSIDE the docroot -- as in production (knowledge/store/, not sites/).
  // Putting it inside would make the adopt-idempotence tooth lie: adopt would keep discovering
  // the store files its own previous run had just written.
  var po: i64 = pl_cat(prefix, 0, tmpdir)
  po = pl_cat(prefix, po, "-store-" as *u8)
  prefix[po] = 0 as u8
  let seeded: i64 = sts_seed(prefix, reg, o)
  gv_check("T0 registry seeded (8 rows)" as *u8, (seeded == 8) as i64, ctr)
  // ---- sitemap ----
  let smp: *u8 = sys_mmap(PG_PATHCAP)
  pl_join(smp, tmpdir, "sitemap.xml" as *u8)
  let flags: *i64 = sys_mmap(64) as *i64   // 3 i64 flags from sts_load_honest; 16B overruns
  let nurl: i64 = pl_sitemap(tmpdir, prefix, "https://x.test" as *u8, smp, flags)
  gv_check("T1 sitemap emits exactly the 4 live+present rows" as *u8, (nurl == 4) as i64, ctr)
  gv_check("T1b nested index -> the DIRECTORY URL, never /contact/index" as *u8, pg_has(smp, "<loc>https://x.test/contact/</loc>" as *u8), ctr)
  gv_check("T1c no /contact/index URL was emitted" as *u8, (1 - pg_has(smp, "/contact/index<" as *u8)) as i64, ctr)
  gv_check("T2 index.html -> the bare canonical root URL" as *u8, pg_has(smp, "<loc>https://x.test/</loc>" as *u8), ctr)
  gv_check("T3 a.html -> the clean extensionless URL" as *u8, pg_has(smp, "<loc>https://x.test/a</loc>" as *u8), ctr)
  gv_check("T4 & in a path is XML-ESCAPED, not dropped or dotted" as *u8, pg_has(smp, "<loc>https://x.test/r&amp;d</loc>" as *u8), ctr)
  gv_check("T5 lastmod is a real machine date, not self-reported" as *u8, pg_has(smp, "<lastmod>20" as *u8), ctr)
  gv_check("T6 draft page EXCLUDED" as *u8, (1 - pg_has(smp, "/b</loc>" as *u8)) as i64, ctr)
  gv_check("T7 asset EXCLUDED (served, never indexed)" as *u8, (1 - pg_has(smp, "style.css" as *u8)) as i64, ctr)
  gv_check("T8 honest load reports declared==loaded" as *u8, (flags[0] == flags[1]) as i64, ctr)
  // both-polarity teeth: the exclusions must fire on the bad case AND stay silent on the good one
  gv_bite("T9 BITE absent-file excluded / present-file included" as *u8,
          (1 - pg_has(smp, "ghost" as *u8)) as i64,
          (1 - pg_has(smp, "/a</loc>" as *u8)) as i64, ctr)
  gv_bite("T10 BITE withdrawn excluded / live included" as *u8,
          (1 - pg_has(smp, "/old</loc>" as *u8)) as i64,
          (1 - pg_has(smp, "/r&amp;d</loc>" as *u8)) as i64, ctr)
  // ---- robots ----
  let rbp: *u8 = sys_mmap(PG_PATHCAP)
  pl_join(rbp, tmpdir, "robots.txt" as *u8)
  let dis: *u8 = "private/,preview/" as *u8
  let nd: i64 = pl_robots("https://x.test" as *u8, dis, 0, pl_vlen(dis), rbp)
  gv_check("T11 robots emits one Disallow per configured prefix" as *u8, (nd == 2) as i64, ctr)
  gv_check("T12 robots Disallow: /private/" as *u8, pg_has(rbp, "Disallow: /private/" as *u8), ctr)
  gv_check("T13 robots points at the sitemap" as *u8, pg_has(rbp, "Sitemap: https://x.test/sitemap.xml" as *u8), ctr)
  // ---- llms.txt ----
  let lmp: *u8 = sys_mmap(PG_PATHCAP)
  pl_join(lmp, tmpdir, "llms.txt" as *u8)
  let nlk: i64 = pl_llms(tmpdir, prefix, "https://x.test" as *u8, "Test Site" as *u8, lmp)
  gv_check("T14 llms.txt links exactly the live+present set" as *u8, (nlk == 4) as i64, ctr)
  gv_check("T15 llms.txt carries the H1 title" as *u8, pg_has(lmp, "# Test Site" as *u8), ctr)
  gv_check("T16 llms.txt groups by registry section" as *u8, pg_has(lmp, "## Family" as *u8), ctr)
  gv_check("T17 llms.txt link carries title + note" as *u8, pg_has(lmp, "- [Alpha](https://x.test/a): first page" as *u8), ctr)
  // ---- the gateway ----
  let g_live: i64 = pl_check(prefix, "a.html" as *u8)
  let g_asset: i64 = pl_check(prefix, "style.css" as *u8)
  let g_draft: i64 = pl_check(prefix, "b.html" as *u8)
  let g_withdrawn: i64 = pl_check(prefix, "old.html" as *u8)
  let g_unreg: i64 = pl_check(prefix, "whatever-someone-dropped.html" as *u8)
  gv_check("T18 gateway ADMITS a live registered page" as *u8, (g_live == 0) as i64, ctr)
  gv_check("T19 gateway ADMITS an asset" as *u8, (g_asset == 0) as i64, ctr)
  gv_check("T20 gateway ADMITS a draft (publishable, just not indexable)" as *u8, (g_draft == 0) as i64, ctr)
  gv_check("T21 gateway REFUSES a withdrawn page" as *u8, (g_withdrawn == 3) as i64, ctr)
  gv_bite("T22 BITE gateway refuses UNREGISTERED / admits registered" as *u8,
          (g_unreg == 3) as i64,
          (g_live != 0) as i64, ctr)
  // fail-CLOSED: a registry that cannot be read must refuse everything, never wave it through
  let nop: *u8 = sys_mmap(PG_PATHCAP)
  var xo: i64 = pl_cat(nop, 0, tmpdir)
  xo = pl_cat(nop, xo, "/plgate-no-such-plane-" as *u8)
  nop[xo] = 0 as u8
  gv_check("T23 unreadable registry FAILS CLOSED (refuses)" as *u8, (pl_check(nop, "a.html" as *u8) == 3) as i64, ctr)
  // ---- adopt: the migration step. It must be IDEMPOTENT, or re-running it duplicates the site.
  let ac1: *i64 = sys_mmap(64) as *i64
  let ac2: *i64 = sys_mmap(64) as *i64
  let add1: i64 = pl_adopt(tmpdir, prefix, ac1)
  let add2: i64 = pl_adopt(tmpdir, prefix, ac2)
  gv_check("T24 adopt registers the unregistered docroot entries" as *u8, (add1 > 0) as i64, ctr)
  gv_check("T25 adopt lands pages as DRAFT (registered, never auto-indexed)" as *u8, (ac1[0] > 0) as i64, ctr)
  gv_check("T26 adopt classifies backup/temp artifacts as debris" as *u8, (ac1[2] > 0) as i64, ctr)
  // THE property that makes adoption safe: it changes what the registry KNOWS, never what the
  // world SEES. Re-emitting after adoption must produce the same public URL set.
  let nurl2: i64 = pl_sitemap(tmpdir, prefix, "https://x.test" as *u8, smp, flags)
  gv_check("T25b adoption is publicly INERT: sitemap URL count unchanged" as *u8, (nurl2 == nurl) as i64, ctr)
  gv_bite("T27 BITE adopt is IDEMPOTENT (2nd run adds nothing / 1st run did add)" as *u8,
          (add2 == 0) as i64,
          (add1 == 0) as i64, ctr)
  gv_check("T28 an adopted path now passes the gateway" as *u8, (pl_check(prefix, "sitemap.xml" as *u8) == 0) as i64, ctr)
  // ---- RECURSIVE adoption (the fix for debt 1785614931): full relpaths, gateway-proven.
  // pl_check here IS the gateway: the driver's `check` verb prints and exits with exactly
  // this function's verdict, so ==0 is the same fact as `nx_pub_plane check` exiting 0.
  gv_check("T28b adopted NESTED page admits at its FULL relpath (code/nested.html)" as *u8,
           (pl_check(prefix, "code/nested.html" as *u8) == 0) as i64, ctr)
  gv_check("T28c adoption reaches depth 2 (code/deep/leaf.html admits)" as *u8,
           (pl_check(prefix, "code/deep/leaf.html" as *u8) == 0) as i64, ctr)
  gv_check("T28d nested page registered by PATH, not basename (bare nested.html still refused)" as *u8,
           (pl_check(prefix, "nested.html" as *u8) == 3) as i64, ctr)
  gv_bite("T28e BITE gateway still refuses an UNREGISTERED nested path / admits the ADOPTED one" as *u8,
          (pl_check(prefix, "code/never-dropped-here.html" as *u8) == 3) as i64,
          (pl_check(prefix, "code/nested.html" as *u8) != 0) as i64, ctr)
  // ---- promote: the draft->live owner pass (2026-08-12). Adoption parks pages as DRAFT and the
  // plane shipped no way to lift one; pl_promote is that verb. Both polarities: the listed draft
  // ENTERS the sitemap, the unlisted stays out, a bogus list row is COUNTED not dropped, and a
  // second run lifts nothing (idempotent).
  let plst: *u8 = sys_mmap(PG_PATHCAP)
  pl_join(plst, tmpdir, "promote.list" as *u8)
  pg_fixfile(tmpdir, "promote.list" as *u8, "b.html\n# a comment row\nno-such-page.html\n" as *u8)
  let pc1: *i64 = sys_mmap(64) as *i64
  let pr1: i64 = pl_promote(prefix, plst, pc1)
  gv_check("T28f promote lifts exactly the listed draft row" as *u8, (pr1 == 1) as i64, ctr)
  gv_check("T28g promote COUNTS the unmatched list row, never drops it" as *u8, (pc1[2] == 1) as i64, ctr)
  let nurl3: i64 = pl_sitemap(tmpdir, prefix, "https://x.test" as *u8, smp, flags)
  gv_bite("T28h BITE promoted page ENTERS the sitemap / it was excluded while draft" as *u8,
          pg_has(smp, "/b</loc>" as *u8),
          (nurl3 == nurl) as i64, ctr)
  let pc2: *i64 = sys_mmap(64) as *i64
  let pr2: i64 = pl_promote(prefix, plst, pc2)
  gv_bite("T28i BITE promote is IDEMPOTENT (2nd run lifts nothing / 1st did lift)" as *u8,
          (pr2 == 0) as i64,
          (pr1 == 0) as i64, ctr)
  // ---- sectionize: mechanical taxonomy for adopted rows (2026-08-12). Promote two adopted pages
  // live first so the llms grouping exposes the assigned sections, both depths.
  pg_fixfile(tmpdir, "promote2.list" as *u8, "stray.html\ncode/nested.html\n" as *u8)
  let plst2: *u8 = sys_mmap(PG_PATHCAP)
  pl_join(plst2, tmpdir, "promote2.list" as *u8)
  let pc4: *i64 = sys_mmap(64) as *i64
  let pr4: i64 = pl_promote(prefix, plst2, pc4)
  let sc1: *i64 = sys_mmap(64) as *i64
  let sz1: i64 = pl_sectionize(prefix, sc1)
  gv_check("T28j sectionize rewrites the Unsorted rows" as *u8, (sz1 > 0) as i64, ctr)
  let nlk2: i64 = pl_llms(tmpdir, prefix, "https://x.test" as *u8, "Test Site" as *u8, lmp)
  gv_check("T28k dir-derived section groups the nested page (## code)" as *u8, pg_has(lmp, "## code" as *u8), ctr)
  gv_check("T28l top-level adopted page lands in ## Pages" as *u8, pg_has(lmp, "## Pages" as *u8), ctr)
  let sc2: *i64 = sys_mmap(64) as *i64
  let sz2: i64 = pl_sectionize(prefix, sc2)
  gv_bite("T28m BITE sectionize is IDEMPOTENT (2nd run rewrites nothing / 1st did)" as *u8,
          (sz2 == 0) as i64,
          (sz1 == 0) as i64, ctr)
  // ---- the read-modify-write safety tooth: adopt rewrites the WHOLE plane, so it must REFUSE a
  // plane whose declared row count exceeds what it can actually reach. Craft the bad input by
  // superseding q:n with a count no reader can satisfy, then prove the healthy plane still works.
  let w: *i64 = ss_begin_cap(STS_WCAP)
  ss_add(w, STS_KIND_LIVE, "q:n" as *u8, "9999" as *u8, 4)
  ss_commit(prefix, w, ss_next_segid(prefix))
  let ac3: *i64 = sys_mmap(64) as *i64
  let lossy: i64 = pl_adopt(tmpdir, prefix, ac3)
  gv_bite("T29 BITE adopt REFUSES a lossy plane / accepts a healthy one" as *u8,
          (lossy == 0 - 2) as i64,
          (add2 == 0 - 2) as i64, ctr)
  // promote must obey the SAME lossy-load law as adopt: never rewrite over a short read
  let pc3: *i64 = sys_mmap(64) as *i64
  let pr3: i64 = pl_promote(prefix, plst, pc3)
  gv_bite("T29b BITE promote REFUSES the lossy plane / accepted the healthy one" as *u8,
          (pr3 == 0 - 2) as i64,
          (pr1 <= 0) as i64, ctr)
  gv_check("T30 the refusal committed NOTHING (plane still readable)" as *u8, (pl_check(prefix, "a.html" as *u8) == 0) as i64, ctr)
  // ---- depth bounding: REFUSE, never truncate. Its OWN docroot and its OWN registry plane,
  // so the refusal cannot disturb the main fixture's teeth -- and "NOTHING COMMITTED" is
  // provable: had adopt truncated instead of refused, the in-range top.html WOULD have been
  // registered. (The deep plane is never seeded, so a regression that commits leaves a row
  // behind and T31b stays red until it is cleaned -- a deliberate ratchet.)
  let deepd: *u8 = sys_mmap(PG_PATHCAP)
  var ddo: i64 = pl_cat(deepd, 0, tmpdir)
  ddo = pl_cat(deepd, ddo, "-deep" as *u8)
  deepd[ddo] = 0 as u8
  sys_mkdir(deepd, PG_DIRMODE)
  pg_fixfile(deepd, "top.html" as *u8, "<h1>within depth</h1>" as *u8)
  let dchain: *u8 = sys_mmap(PG_PATHCAP)
  var dco: i64 = pl_cat(dchain, 0, deepd)
  dchain[dco] = 0 as u8
  var lvl: i64 = 0
  while lvl < PL_MAXDEPTH + 1 {
      dco = pl_cat(dchain, dco, "/d" as *u8)
      dchain[dco] = 0 as u8
      sys_mkdir(dchain, PG_DIRMODE)
      lvl = lvl + 1
  }
  pg_fixfile(dchain, "lost.html" as *u8, "<h1>beyond PL_MAXDEPTH -- truncation would drop me silently</h1>" as *u8)
  let dpfx: *u8 = sys_mmap(PG_PATHCAP)
  var dpo: i64 = pl_cat(dpfx, 0, tmpdir)
  dpo = pl_cat(dpfx, dpo, "-deepstore-" as *u8)
  dpfx[dpo] = 0 as u8
  let ac4: *i64 = sys_mmap(64) as *i64
  let deep_rc: i64 = pl_adopt(deepd, dpfx, ac4)
  gv_bite("T31 BITE beyond-depth tree REFUSED LOUDLY (-3, cap named on stderr) / within-depth tree adopted" as *u8,
          (deep_rc == 0 - 3) as i64,
          (add1 < 0) as i64, ctr)
  gv_check("T31b depth refusal committed NOTHING -- even in-range top.html stayed unregistered" as *u8,
           (pl_check(dpfx, "top.html" as *u8) == 3) as i64, ctr)
  let rc: i64 = gv_verdict("PUB-PLANE-GATE" as *u8, ctr, "every discovery artifact is derived from the registry, the gateway is fail-closed, and adoption walks the whole tree -- bounded, refusing over truncating" as *u8)
  sys_exit(rc)
  return rc
285}
nx_pub_plane_gate.nx source

`nx_pub_plane_gate.nx` source
