code wiki / _hdl_build / nx_pub_policy_gate.nx
`nx_pub_policy_gate.nx` source

1// nx_pub_policy_gate.nx -- R6 proof for THE NISHI PUBLISHER release policy: outward-facing publishes are
2// operator-gated BY CONSTRUCTION. (1) an INTERNAL request proceeds with no approval; (2) an OUTWARD request is
3// HELD until approved (fail-closed -- the publisher won't push unapproved outward content); (3) once the operator
4// approves the EXACT artifact (token keyed by content sha), the outward request proceeds; (4) NEG-CONTROL: the
5// approval is per-artifact -- a DIFFERENT artifact's approval does NOT authorize this one. Sovereign, per-wsid.
6// license_tier: ORIGINAL  expect_exit: 0
7import "nx_syscalls.nx"
8import "nx_publisher.nx"
9import "nx_runpath.nx"
10
11func g_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
12func g_n(v: i64) -> i64 { var m: i64=v; if m<0{g_w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 }
13func g_row(id: *u8, ok: i64, pass: *i64) -> i64 { g_w("  " as *u8); g_w(id); g_w(": " as *u8); if ok==1 { g_w("OK\n" as *u8); pass[0]=pass[0]+1 } else { g_w("FAIL\n" as *u8) } return 0 }
14
15func main() -> i64 {
16    let pass: *i64 = sys_mmap(8) as *i64; pass[0]=0
17    g_w("=== NX-PUBLISHER POLICY GATE (outward publishes are operator-gated by construction) ===\n" as *u8)
18    let wsid: *u8 = sys_mmap(64); rp_wsid(wsid); rp_ensure(wsid)
19    let adir: *u8 = sys_mmap(512); rp_path(wsid, "pol_approvals" as *u8, adir); __syscall(83, adir as i64, 493, 0, 0, 0, 0)
20
21    // two distinct artifact shas (content hashes)
22    let shaA: *u8 = sys_mmap(72); var i: i64=0; while i<64 { shaA[i]=97 as u8; i=i+1 } shaA[64]=0 as u8   // "aaaa..."
23    let shaB: *u8 = sys_mmap(72); i=0; while i<64 { shaB[i]=98 as u8; i=i+1 } shaB[64]=0 as u8            // "bbbb..."
24    // clean any leftover approval token from a prior run (test isolation; unlink=87)
25    let cleanp: *u8 = sys_mmap(700); pub_join(adir, shaA, cleanp); __syscall(87, cleanp as i64, 0, 0, 0, 0, 0)
26
27    let internal_ok: i64 = pub_policy_allows("internal" as *u8, shaA, adir)         // expect 1
28    let outward_held: i64 = pub_policy_allows("outward" as *u8, shaA, adir)         // expect 0 (no approval yet)
29    pub_approve(shaA, adir)                                                          // operator approves artifact A
30    let outward_after: i64 = pub_policy_allows("outward" as *u8, shaA, adir)        // expect 1
31    let outward_other: i64 = pub_policy_allows("outward" as *u8, shaB, adir)        // expect 0 (B not approved)
32
33    g_w("  internal_allowed="); g_n(internal_ok); g_w(" outward_held(no approval)="); g_n((outward_held==0) as i64)
34    g_w(" outward_after_approve="); g_n(outward_after); g_w(" other_artifact_still_held="); g_n((outward_other==0) as i64); g_w("\n")
35
36    g_row("INTERNAL proceeds with no approval needed" as *u8, (internal_ok==1) as i64, pass)
37    g_row("OUTWARD HELD until operator approval (fail-closed: no unapproved outward push)" as *u8, (outward_held==0) as i64, pass)
38    g_row("OUTWARD PROCEEDS once the operator approves the exact artifact (by sha)" as *u8, (outward_after==1) as i64, pass)
39    g_row("NEG-CONTROL: approval is per-artifact -- a different artifact stays HELD" as *u8, (outward_other==0) as i64, pass)
40
41    g_w("PUB-POLICY rows=4 pass="); g_n(pass[0])
42    if pass[0]==4 { g_w(" verdict=GREEN\n"); sys_exit(0); return 0 }
43    g_w(" verdict=RED\n"); sys_exit(1); return 1
44}
nx_pub_policy_gate.nx source

`nx_pub_policy_gate.nx` source
